Delete SpamFilterService - remove 184 lines of unused code

SpamFilterService was disabled on Oct 7 because rate limits broke normal conversation (3 msg capacity, 0.5/sec refill = 1 msg per 2 seconds). Only the near-duplicate detection was being used, so: - Deleted SpamFilterService.swift (222 lines) - Moved near-dup LRU cache inline to ChatViewModel (40 lines) - Removed unused rate limiter config constants (6 lines) Net: -184 lines, clearer code, same functionality Services: 6 → 5 (SpamFilter removed) Build time: 6.10s (was 6.21s) Tests: 23/23 passing
Address PR #775 review feedback
2026-07-25 17:25:20 +00:00 · 2025-10-09 17:56:34 +02:00 · 2025-10-09 17:09:51 +02:00 · 2025-10-07 22:21:27 +01:00 · 2025-10-07 22:21:27 +01:00 · 2025-10-07 22:21:27 +01:00
2819 changed files with 399659 additions and 162732 deletions
@@ -0,0 +1,12 @@
+---
+path:            '/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift/macosx/prebuilt-modules/26.0/Swift.swiftmodule/arm64e-apple-macos.swiftmodule'
+dependencies:
+  - mtime:           1757258659000000000
+    path:            '/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift/macosx/prebuilt-modules/26.0/Swift.swiftmodule/arm64e-apple-macos.swiftmodule'
+    size:            14166264
+  - mtime:           1754189697000000000
+    path:            'usr/lib/swift/Swift.swiftmodule/arm64e-apple-macos.swiftinterface'
+    size:            2261306
+    sdk_relative:    true
+version:         1
+...
@@ -0,0 +1,16 @@
+---
+path:            '/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift/macosx/prebuilt-modules/26.0/SwiftOnoneSupport.swiftmodule/arm64e-apple-macos.swiftmodule'
+dependencies:
+  - mtime:           1757258662000000000
+    path:            '/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift/macosx/prebuilt-modules/26.0/SwiftOnoneSupport.swiftmodule/arm64e-apple-macos.swiftmodule'
+    size:            18068
+  - mtime:           1754189697000000000
+    path:            'usr/lib/swift/Swift.swiftmodule/arm64e-apple-macos.swiftinterface'
+    size:            2261306
+    sdk_relative:    true
+  - mtime:           1754191141000000000
+    path:            'usr/lib/swift/SwiftOnoneSupport.swiftmodule/arm64e-apple-macos.swiftinterface'
+    size:            1224
+    sdk_relative:    true
+version:         1
+...
@@ -0,0 +1,16 @@
+---
+path:            '/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift/macosx/prebuilt-modules/26.0/_Concurrency.swiftmodule/arm64e-apple-macos.swiftmodule'
+dependencies:
+  - mtime:           1757258669000000000
+    path:            '/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift/macosx/prebuilt-modules/26.0/_Concurrency.swiftmodule/arm64e-apple-macos.swiftmodule'
+    size:            699544
+  - mtime:           1754189697000000000
+    path:            'usr/lib/swift/Swift.swiftmodule/arm64e-apple-macos.swiftinterface'
+    size:            2261306
+    sdk_relative:    true
+  - mtime:           1754192470000000000
+    path:            'usr/lib/swift/_Concurrency.swiftmodule/arm64e-apple-macos.swiftinterface'
+    size:            364219
+    sdk_relative:    true
+version:         1
+...
@@ -0,0 +1,16 @@
+---
+path:            '/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift/macosx/prebuilt-modules/26.0/_StringProcessing.swiftmodule/arm64e-apple-macos.swiftmodule'
+dependencies:
+  - mtime:           1757258664000000000
+    path:            '/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift/macosx/prebuilt-modules/26.0/_StringProcessing.swiftmodule/arm64e-apple-macos.swiftmodule'
+    size:            83568
+  - mtime:           1754189697000000000
+    path:            'usr/lib/swift/Swift.swiftmodule/arm64e-apple-macos.swiftinterface'
+    size:            2261306
+    sdk_relative:    true
+  - mtime:           1754192532000000000
+    path:            'usr/lib/swift/_StringProcessing.swiftmodule/arm64e-apple-macos.swiftinterface'
+    size:            24507
+    sdk_relative:    true
+version:         1
+...
@@ -1,85 +0,0 @@
-name: Arti Binary Provenance
-
-# The Arti xcframework is a vendored binary; these checks turn the policy in
-# docs/ARTI-BINARY-PROVENANCE.md into an enforced gate:
-#  1. The checked-in binary must match the hash manifest in the provenance doc.
-#  2. A PR that changes the binary must also change at least one provenance
-#     input (Rust source, lockfile, build script, or the doc itself).
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - "localPackages/Arti/**"
-      - "docs/ARTI-BINARY-PROVENANCE.md"
-  pull_request:
-    paths:
-      - "localPackages/Arti/**"
-      - "docs/ARTI-BINARY-PROVENANCE.md"
-
-jobs:
-  verify-hashes:
-    name: Verify xcframework hashes against provenance doc
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-
-      - name: Compare artifact hashes with manifest
-        run: |
-          set -euo pipefail
-          doc="docs/ARTI-BINARY-PROVENANCE.md"
-
-          # Extract the manifest: lines of "<sha256>  <path>" from the doc.
-          grep -E '^[0-9a-f]{64}  localPackages/Arti/Frameworks/arti\.xcframework/' "$doc" \
-            | sort -k2 > expected.txt
-
-          if [ ! -s expected.txt ]; then
-            echo "::error::No hash manifest found in $doc"
-            exit 1
-          fi
-
-          # Hash the same file set the doc documents.
-          find localPackages/Arti/Frameworks/arti.xcframework -maxdepth 3 -type f -print0 \
-            | sort -z | xargs -0 sha256sum | sed 's/  \.\//  /' | sort -k2 > actual.txt
-
-          if ! diff -u expected.txt actual.txt; then
-            echo "::error::Checked-in arti.xcframework does not match the manifest in $doc. If the binary change is intentional, rebuild per the doc and update the manifest in the same PR."
-            exit 1
-          fi
-          echo "All $(wc -l < actual.txt) artifact hashes match the provenance manifest."
-
-  require-provenance-evidence:
-    name: Binary changes must ship with provenance inputs
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      - name: Check changed files
-        run: |
-          set -euo pipefail
-          base="origin/${{ github.base_ref }}"
-          git fetch --no-tags --depth=1 origin "${{ github.base_ref }}"
-          changed=$(git diff --name-only "$base"...HEAD)
-          echo "Changed files:"
-          echo "$changed"
-
-          if ! echo "$changed" | grep -q '^localPackages/Arti/Frameworks/arti\.xcframework/'; then
-            echo "No binary artifact changes; nothing to verify."
-            exit 0
-          fi
-
-          if echo "$changed" | grep -Eq '^(localPackages/Arti/(Cargo\.(toml|lock)|build-ios\.sh|arti-bitchat/)|docs/ARTI-BINARY-PROVENANCE\.md)'; then
-            echo "Binary change is accompanied by provenance inputs."
-            exit 0
-          fi
-
-          echo "::error::arti.xcframework changed without matching source, lockfile, build-script, or provenance-doc changes. See docs/ARTI-BINARY-PROVENANCE.md (\"Do not accept an xcframework-only update\")."
-          exit 1
@@ -7,7 +7,6 @@ on:

 permissions:
  contents: write
-  pull-requests: write

 jobs:
  update-relay-data:
@@ -18,11 +17,10 @@ jobs:
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
-          fetch-depth: 0
-
+      
      - name: Fetch GeoRelays
        run: |
-          wget -q https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv
+          wget https://raw.githubusercontent.com/permissionlesstech/georelays/refs/heads/main/nostr_relays.csv
          mv nostr_relays.csv ./relays/online_relays_gps.csv

      - name: Check for changes
@@ -1,30 +0,0 @@
-name: Dead Code
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-jobs:
-  periphery:
-    name: Periphery scan
-    runs-on: macos-latest
-    timeout-minutes: 30
-    # Advisory, like SwiftLint (#1361): findings annotate the PR but don't
-    # block merges. Drop continue-on-error once the baseline proves stable.
-    continue-on-error: true
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-
-      - name: Install Periphery
-        # homebrew-core formula; the peripheryapp tap lags years behind.
-        run: brew install periphery
-
-      - name: Scan for dead code
-        # Config comes from .periphery.yml; known findings (mostly iOS-only
-        # code invisible to a macOS scan) are suppressed by the committed
-        # baseline. --strict fails the step when NEW dead code appears.
-        run: periphery scan --strict --disable-update-check
@@ -5,175 +5,23 @@ on:
    branches:
      - main
  pull_request:
+    branches:
+      - main

 jobs:
  test:
-    name: Run Swift Tests (${{ matrix.name }})
+    name: Run Swift Tests
    runs-on: macos-latest
-    # A hung test must fail fast, not hold a runner for GitHub's 360-minute
-    # default (observed: intermittent app-suite hangs starving the queue).
-    # The long steps carry tighter individual bounds (5-minute test watchdog,
-    # 6-minute benchmark step, 10-minute floor gate that may re-run the
-    # benchmarks up to twice on a noisy runner); this is the backstop.
-    timeout-minutes: 25
-
-    strategy:
-      fail-fast: false # Don't cancel other matrix jobs when one fails
-      matrix:
-        include:
-          - name: app
-            path: .
-          - name: BitLogger
-            path: localPackages/BitLogger
-          - name: BitFoundation
-            path: localPackages/BitFoundation

    steps:
      - name: Checkout code
        uses: actions/checkout@v5

-      # Use the Xcode-bundled Swift toolchain: it always matches the SDK on
-      # the runner image. A standalone swift.org toolchain (setup-swift) broke
-      # whenever the image's Xcode moved ahead of it ("this SDK is not
-      # supported by the compiler").
-      - name: Note toolchain version (cache key)
-        id: swift-version
-        run: echo "version=$(swift --version 2>/dev/null | head -1 | shasum | cut -c1-12)" >> "$GITHUB_OUTPUT"
+      - name: Set up Swift
+        uses: swift-actions/setup-swift@v2

-      - name: Cache build artifacts
-        uses: actions/cache@v4
-        with:
-          path: ${{ matrix.path }}/.build
-          key: ${{ runner.os }}-${{ steps.swift-version.outputs.version }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/*.swift', matrix.path), format('{0}/**/Package.resolved', matrix.path)) }}
-          restore-keys: |
-            ${{ runner.os }}-${{ steps.swift-version.outputs.version }}-${{ matrix.name }}-${{ hashFiles(format('{0}/**/Package.resolved', matrix.path)) }}
-            ${{ runner.os }}-${{ steps.swift-version.outputs.version }}-${{ matrix.name }}-
-
-      - name: Build tests
-        # Built separately so the hang watchdog below times only test
-        # execution: a cold-cache coverage build on a slow runner can
-        # legitimately take several minutes, and is already bounded by the
-        # 15-minute job timeout.
-        run: swift build --build-tests --enable-code-coverage --package-path ${{ matrix.path }}
+      - name: Build the package
+        run: swift build

      - name: Run Tests
-        # Perf benchmarks are excluded here and run in their own serial step
-        # below: measuring while parallel test processes contend for cores
-        # produces noisy numbers, and the XCTest measure machinery has hung
-        # intermittently under parallel workers on loaded runners. Excluded
-        # via --skip (not just the env guard): every app run since the
-        # baselines landed timed out at the 15-minute job limit with the
-        # baseline tests dispatched into the parallel phase.
-        #
-        # The watchdog samples any still-running test processes after 5
-        # minutes (the suite passes in seconds when healthy; the build is
-        # done by this step) and kills the run, so a hang fails fast with
-        # stacks in the log instead of a silent timeout.
-        env:
-          BITCHAT_SKIP_PERF_BASELINES: "1"
-        run: |
-          swift test --skip-build --parallel --quiet --enable-code-coverage \
-            --skip PerformanceBaselineTests \
-            --package-path ${{ matrix.path }} &
-          test_pid=$!
-          (
-            sleep 300
-            if kill -0 "$test_pid" 2>/dev/null; then
-              echo "::group::Tests still running after 5 minutes — sampling before kill"
-              for pid in $(pgrep -if 'swiftpm-testing|xctest|PackageTests' || true); do
-                echo "--- sample of pid $pid ---"
-                sample "$pid" 5 2>/dev/null || true
-              done
-              echo "::endgroup::"
-              pkill -KILL -P "$test_pid" 2>/dev/null || true
-              kill -KILL "$test_pid" 2>/dev/null || true
-            fi
-          ) &
-          watchdog_pid=$!
-          wait "$test_pid" && status=0 || status=$?
-          kill "$watchdog_pid" 2>/dev/null || true
-          exit "$status"
-
-      # Benchmarks run serially on an otherwise idle runner for stable
-      # numbers; BITCHAT_PERF_LOG captures the PERF[...] lines for the gate.
-      - name: Run performance benchmarks (serial)
-        if: matrix.name == 'app'
-        timeout-minutes: 6
-        env:
-          BITCHAT_PERF_LOG: ${{ github.workspace }}/perf-output.log
-        run: swift test --quiet --filter PerformanceBaselineTests
-
-      # Order-of-magnitude performance regression gate. Floors are deliberately
-      # generous (see bitchatTests/Performance/perf-floors.json) so this
-      # catches algorithmic regressions, never runner variance. If a metric
-      # still lands below floor (a saturated runner can dip one), the script
-      # re-runs the benchmarks — appending to the same log and keeping each
-      # benchmark's best value per metric — so noise clears on retry while a
-      # real regression fails every attempt. Floors are never lowered by this.
-      - name: Performance floor gate
-        if: matrix.name == 'app'
-        timeout-minutes: 10
-        run: ./scripts/check-perf-floors.sh perf-output.log
-
-      # Informational only: surfaces per-file and total line coverage in the
-      # job log so coverage trends are visible on every PR. No thresholds —
-      # this must never be the reason a build goes red.
-      - name: Coverage summary
-        run: |
-          BIN_PATH=$(swift build --show-bin-path --package-path ${{ matrix.path }})
-          PROF="$BIN_PATH/codecov/default.profdata"
-          XCTEST=$(find "$BIN_PATH" -maxdepth 1 -name '*.xctest' | head -1)
-          BINARY="$XCTEST/Contents/MacOS/$(basename "$XCTEST" .xctest)"
-          if [ -f "$PROF" ] && [ -f "$BINARY" ]; then
-            xcrun llvm-cov report "$BINARY" -instr-profile "$PROF" \
-              -ignore-filename-regex='(Tests|\.build|checkouts|Mocks|_PreviewHelpers)' || true
-          else
-            echo "No coverage data found; skipping summary."
-          fi
-
-  # SPM tests above only compile the macOS slice; this job covers the
-  # iOS-conditional code paths (UIKit, CoreBluetooth restoration, etc.).
-  ios-build:
-    name: Build iOS app (simulator)
-    runs-on: macos-latest
-    timeout-minutes: 15
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v5
-
-      - name: Build iOS (simulator, no signing)
-        # arm64 only: the vendored arti.xcframework has no x86_64 simulator slice.
-        run: |
-          set -o pipefail
-          xcodebuild -project bitchat.xcodeproj \
-            -scheme "bitchat (iOS)" \
-            -sdk iphonesimulator \
-            -destination 'generic/platform=iOS Simulator' \
-            ARCHS=arm64 \
-            CODE_SIGNING_ALLOWED=NO \
-            build
-
-  # Advisory only: SwiftLint reports style violations without ever failing the
-  # build. Runs in a pinned container (no Xcode plugin, no pbxproj changes) so
-  # it can never break the documented xcodebuild path or block a merge.
-  lint:
-    name: SwiftLint (advisory)
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    # This job runs a third-party container image, so give it the least
-    # privilege we can: a read-only token, and no credentials left in the
-    # checkout for the container to find.
-    permissions:
-      contents: read
-    container:
-      # Tag for readability, digest for immutability (tags can be repointed).
-      # Bump both together, deliberately — never a floating tag.
-      image: ghcr.io/realm/swiftlint:0.65.0@sha256:a482729f4b58741875af1566f23397f3f6db300372756fc31606d0a4527fab9e
-    continue-on-error: true
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-      - name: Run SwiftLint
-        run: swiftlint lint --reporter github-actions-logging
+        run: swift test --parallel
@@ -8,7 +8,6 @@ plans/
 ## AI
 CLAUDE.md
 AGENTS.md
-.claude/

 ## compatibility with Xcode 8 and earlier (ignoring not required starting Xcode 9)
 *.xcscmblueprint
@@ -67,9 +66,6 @@ __pycache__/
 *.tmp
 *.temp

-## Cache
-.cache/
-
 # Local build results
 .Result*/
 .Result*.xcresult/
@@ -1 +0,0 @@
-{"v1":{"usrs":["param-buf-arti_bootstrap_summary(_:_:)-s:3Tor22arti_bootstrap_summary33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSpys4Int8VG_AEtF","param-dataDir-arti_start(_:_:)-s:3Tor10arti_start33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSPys4Int8VG_s6UInt16VtF","param-len-arti_bootstrap_summary(_:_:)-s:3Tor22arti_bootstrap_summary33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSpys4Int8VG_AEtF","param-socksPort-arti_start(_:_:)-s:3Tor10arti_start33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSPys4Int8VG_s6UInt16VtF","s:13BitFoundation16PeerCapabilitiesV8wifiBulkACvpZ","s:13BitFoundation18KeychainReadResultO18isRecoverableErrorSbvp","s:13BitFoundation23KeychainManagerProtocolP11secureClearyySSzF","s:18bitchatTests_macOS12MockKeychainC11secureClearyySSzF","s:18bitchatTests_macOS20TrackingMockKeychainC11resetCountsyyF","s:18bitchatTests_macOS20TrackingMockKeychainC11secureClearyySSzF","s:18bitchatTests_macOS20TrackingMockKeychainC25totalSecureClearCallCountSivp","s:18bitchatTests_macOS20TrackingMockKeychainC26secureClearStringCallCountSivp","s:18bitchatTests_macOS20TrackingMockKeychainC27_secureClearStringCallCount06_AB6D1M24FD239F2969C82F4108818260LLSivp","s:18bitchatTests_macOS24FailingCacheSaveKeychain33_22380C7A11A569A0B83FA83F34C498A7LLC11secureClearyySSzF","s:18bitchatTests_macOS24MockGeohashPresenceTimer33_483587EFB96650EE130EFB09BBA2A1AALLC7handleryycvp","s:3Tor0A7ManagerC21goDormantOnBackgroundyyF","s:7bitchat10AppRuntimeC24handleScreenshotCaptured33_C8B369AD8BC1D9963A50CEDA77A4332ALLyyF","s:7bitchat10AppRuntimeC33handleDidBecomeActiveNotificationyyF","s:7bitchat10BLEServiceC18logBluetoothStatus33_69191C53E68500C17D98DBCF2BDA7100LLyySSF","s:7bitchat10BLEServiceC20centralRestorationID33_69191C53E68500C17D98DBCF2BDA7100LLSSvpZ","s:7bitchat10BLEServiceC22captureBluetoothStatus33_69191C53E68500C17D98DBCF2BDA7100LL7contextySS_tF","s:7bitchat10BLEServiceC23peripheralRestorationID33_69191C53E68500C17D98DBCF2BDA7100LLSSvpZ","s:7bitchat10BLEServiceC29scheduleBluetoothStatusSample33_69191C53E68500C17D98DBCF2BDA7100LL5after7contextySd_SStF","s:7bitchat10QRScanViewV8isActiveSbvp","s:7bitchat15BLEPeerRegistryV5countSivp","s:7bitchat15KeychainManagerC11secureClearyySSzF","s:7bitchat15PaymentChipViewV7openURL33_10AC50641B1EBCD52E5092A2E521D236LL7SwiftUI13OpenURLActionVvp","s:7bitchat15TransportConfigO29uiBatchDispatchStaggerSecondsSdvpZ","s:7bitchat15TransportConfigO35uiShareExtensionDismissDelaySecondsSdvpZ","s:7bitchat15TransportConfigO38bleBackgroundPendingConnectSlotReserveSivpZ","s:7bitchat17GossipSyncManagerC10persistNowyyF","s:7bitchat17NostrRelayManagerC15InboundEventKey33_E4160FE8A9A2C9D6308EAAD5A8B5CB07LLV7eventIDSSvp","s:7bitchat17PrekeyBundleStoreC12StoredBundleV8noiseKey10Foundation4DataVvp","s:7bitchat25LocationNotesDependenciesV3now10Foundation4DateVycvp","s:7bitchat25NWPathReachabilityMonitorC7monitor33_84633C9DBCAF57538179C1E04DB8E015LL7Network0bD0CSgvp"]}}
@@ -1,14 +0,0 @@
-# Periphery dead-code scan configuration (https://github.com/peripheryapp/periphery)
-#
-# CI runs the macOS scheme only (an iOS scan needs a device destination and
-# doubles the build time). macOS-only scans falsely flag iOS-only code —
-# state restoration, screenshot handlers, background BLE sampling — so those
-# findings live in .periphery.baseline.json rather than being "fixed".
-# When auditing by hand, scan BOTH schemes and intersect:
-#   periphery scan --schemes "bitchat (iOS)" -- -destination 'generic/platform=iOS' ARCHS=arm64
-project: bitchat.xcodeproj
-schemes:
-  - bitchat (macOS)
-retain_swift_ui_previews: true
-relative_results: true
-baseline: .periphery.baseline.json
@@ -1,33 +0,0 @@
-# Build artifacts and generated sources; keeps local `swiftlint` runs clean
-# (CI checkouts are fresh, so this only matters in a working tree).
-excluded:
-  - .build
-  - .swiftpm
-  - .DerivedData
-  - DerivedData
-  - build
-  - localPackages/*/.build
-
-disabled_rules:
-  - line_length
-  - type_name
-  - identifier_name
-  - statement_position
-  - implicit_optional_initialization
-  - force_try
-  - vertical_whitespace
-  - for_where
-  - control_statement
-  - void_function_in_ternary
-  - redundant_discardable_let  # SwiftUI breaks without it
-  # To be enabled as we fix the issues
-  - trailing_whitespace
-  - cyclomatic_complexity
-  - function_body_length
-  - function_parameter_count
-  - type_body_length
-  - file_length
-  - large_tuple
-  - force_cast
-  - multiple_closures_with_trailing_closure
-  - nesting
@@ -1,4 +1,4 @@
-MARKETING_VERSION = 1.7.0
+MARKETING_VERSION = 1.4.4
 CURRENT_PROJECT_VERSION = 1

 IPHONEOS_DEPLOYMENT_TARGET = 16.0
@@ -9,4 +9,3 @@ DEVELOPMENT_TEAM = L3N5LHJD5Y
 CODE_SIGN_STYLE = Automatic

 PRODUCT_BUNDLE_IDENTIFIER = chat.bitchat
-APP_GROUP_ID = group.chat.bitchat
@@ -14,11 +14,8 @@ default:
 # Check prerequisites
 check:
    @echo "Checking prerequisites..."
-    @command -v xcodebuild >/dev/null 2>&1 || (echo "❌ xcodebuild not found. Install Xcode from App Store" && exit 1)
-    @xcode-select -p | grep -q "Xcode.app" || (echo "❌ Full Xcode required, not just command line tools. Install from App Store and run:\n   sudo xcode-select -s /Applications/Xcode.app/Contents/Developer" && exit 1)
-    @test -d "/Applications/Xcode.app" || (echo "❌ Xcode.app not found in Applications folder. Install from App Store" && exit 1)
-    @xcodebuild -version >/dev/null 2>&1 || (echo "❌ Xcode not properly configured. Try:\n   sudo xcode-select -s /Applications/Xcode.app/Contents/Developer" && exit 1)
-    @security find-identity -v -p codesigning | grep -q "Apple Development\|Developer ID" || (echo "⚠️  No Developer ID found - code signing may fail" && exit 0)
+    @command -v xcodebuild >/dev/null 2>&1 || (echo "❌ Xcode not found. Install Xcode from App Store" && exit 1)
+    @security find-identity -v -p codesigning | grep -q "Developer ID" || (echo "⚠️  No Developer ID found - code signing may fail" && exit 0)
    @echo "✅ All prerequisites met"

 # Backup original files
@@ -47,7 +44,7 @@ patch-for-macos: backup
 # Build the macOS app
 build: #check generate
    @echo "Building BitChat for macOS..."
-    @xcodebuild -project bitchat.xcodeproj -scheme "bitchat (macOS)" -configuration Debug CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO CODE_SIGN_ENTITLEMENTS="" build
+    @xcodebuild -project bitchat.xcodeproj -scheme "bitchat_macOS" -configuration Debug CODE_SIGN_IDENTITY="" CODE_SIGNING_REQUIRED=NO CODE_SIGN_ENTITLEMENTS="" build

 # Run the macOS app
 run: build
@@ -1,6 +1,6 @@
 # bitchat Privacy Policy

-*Last updated: June 2026*
+*Last updated: January 2025*

 ## Our Commitment

@@ -9,7 +9,7 @@ bitchat is designed with privacy as its foundation. We believe private communica
 ## Summary

 - **No personal data collection** - We don't collect names, emails, or phone numbers
- **No accounts or company servers** - Mesh chat works peer-to-peer; optional Nostr features use public or user-selected relays
+- **No servers** - Everything happens on your device and through peer-to-peer connections
 - **No tracking** - We have no analytics, telemetry, or user tracking
 - **Open source** - You can verify these claims by reading our code

@@ -17,11 +17,11 @@ bitchat is designed with privacy as its foundation. We believe private communica

 ### On Your Device Only

-1. **Identity Keys**
-   - Cryptographic private keys generated on first launch or when optional Nostr identities are created
+1. **Identity Key** 
+   - A cryptographic key generated on first launch
   - Stored locally in your device's secure storage
   - Allows you to maintain "favorite" relationships across app restarts
-   - Private keys never leave your device; public keys are shared when needed for messaging
+   - Never leaves your device

 2. **Nickname**
   - The display name you choose (or auto-generated)
@@ -38,19 +38,12 @@ bitchat is designed with privacy as its foundation. We believe private communica
   - Stored only on your device
   - Allows you to recognize these peers in future sessions

-5. **Optional Location Channel State**
-   - Your selected geohash channel, bookmarked geohashes, teleport flags, and bookmark display names
-   - Stored locally on your device so the location-channel UI can restore your choices
-   - Per-geohash Nostr identities are derived locally from a device seed stored in secure storage
-   - Exact latitude and longitude are not persisted by bitchat
-
 ### Temporary Session Data

 During each session, bitchat temporarily maintains:
 - Active peer connections (forgotten when app closes)
 - Routing information for message delivery
 - Cached messages for offline peers (12 hours max)
- Your current location while optional location channels are enabled, used locally to compute geohash channels and friendly place names

 ## What Information is Shared

@@ -69,21 +62,13 @@ When you join a password-protected room:
 - Your nickname appears in the member list
 - Room owners can see you've joined

-### With Nostr Relays (Optional Features)
-
-If you enable Nostr-backed features:
- Private fallback messages to mutual favorites are sent as encrypted NIP-17 gift wraps. Relays can see event metadata, but not message content.
- Public location-channel messages, location notes, and presence are scoped with geohash tags. Relays and other participants can see the geohash tag, event kind, timestamp, and public key used for that geohash.
- Exact GPS coordinates are not included in Nostr events by bitchat. The geohash precision you choose can still reveal an approximate area, from region-level to building-level.
- Automatic presence heartbeats are limited to low-precision geohashes (region, province, and city). More precise geohash posts happen only when you use those channels or location notes.
-
 ## What We DON'T Do

 bitchat **never**:
 - Collects personal information
- Sells or shares your exact GPS location
- Stores data on servers we operate
- Sells your data to advertisers or data brokers
+- Tracks your location
+- Stores data on servers
+- Shares data with third parties
 - Uses analytics or telemetry
 - Creates user profiles
 - Requires registration
@@ -99,27 +84,19 @@ All private messages use end-to-end encryption:
 ## Your Rights

 You have complete control:
- **Delete Local State**: Triple-tap the logo to instantly wipe local keys, sessions, caches, and preferences
- **Leave Anytime**: Close the app and local presence stops; relay-backed presence ages out
- **No Account**: No account record exists for you to delete from us
- **Portability**: Your local state stays on your device unless you send messages, use optional relay-backed features, or export it
+- **Delete Everything**: Triple-tap the logo to instantly wipe all data
+- **Leave Anytime**: Close the app and your presence disappears
+- **No Account**: Nothing to delete from servers because there are none
+- **Portability**: Your data never leaves your device unless you export it

 ## Bluetooth & Permissions

 bitchat requires Bluetooth permission to function:
 - Used only for peer-to-peer communication
+- No location data is accessed or stored
 - Bluetooth is not used for tracking
 - You can revoke this permission at any time in system settings

-## Location Permission
-
-Location permission is optional and is used only for location channels:
- Used to compute local geohash channels and display names
- Requested as when-in-use permission
- Exact coordinates are not shared in messages or stored by bitchat
- Selected and bookmarked geohashes may persist locally until you remove them, use panic wipe, or delete the app
- You can revoke this permission at any time in system settings
-
 ## Children's Privacy

 bitchat does not knowingly collect information from children. The app has no age verification because it collects no personal information from anyone.
@@ -129,15 +106,12 @@ bitchat does not knowingly collect information from children. The app has no age
 - **Messages**: Deleted from memory when app closes (unless room retention is enabled)
 - **Identity Key**: Persists until you delete the app
 - **Favorites**: Persist until you remove them or delete the app
- **Location channel choices**: Selected/bookmarked geohashes persist locally until removed, panic-wiped, or the app is deleted
- **Nostr relay data**: Public geohash events and encrypted gift wraps may be retained by relays according to each relay's policy
 - **Everything Else**: Exists only during active sessions

 ## Security Measures

 - All communication is encrypted
- No accounts or company servers
- Optional Nostr relays receive only the events needed for Nostr-backed private fallback or public location channels
+- No data transmitted to servers (there are none)
 - Open source code for public audit
 - Regular security updates
 - Cryptographic signatures prevent tampering
@@ -147,7 +121,7 @@ bitchat does not knowingly collect information from children. The app has no age
 If we update this policy:
 - The "Last updated" date will change
 - The updated policy will be included in the app
- No retroactive changes can make us collect data already held only in your app
+- No retroactive changes can affect data (since we don't collect any)

 ## Contact

@@ -158,7 +132,7 @@ bitchat is an open source project. For privacy questions:

 ## Philosophy

-Privacy isn't just a feature—it's the entire point. bitchat proves that modern communication doesn't require surrendering your privacy. No accounts, no company servers, no analytics. Just people talking freely.
+Privacy isn't just a feature—it's the entire point. bitchat proves that modern communication doesn't require surrendering your privacy. No accounts, no servers, no surveillance. Just people talking freely.

 ---

@@ -6,18 +6,17 @@ let package = Package(
    name: "bitchat",
    defaultLocalization: "en",
    platforms: [
-        .iOS(.v16),
+        .iOS(.v17),
        .macOS(.v13)
    ],
    products: [
        .executable(
            name: "bitchat",
            targets: ["bitchat"]
-        )
+        ),
    ],
-    dependencies: [
-        .package(path: "localPackages/Arti"),
-        .package(path: "localPackages/BitFoundation"),
+    dependencies:[
+        .package(path: "localPackages/Tor"),
        .package(path: "localPackages/BitLogger"),
        .package(url: "https://github.com/21-DOT-DEV/swift-secp256k1", exact: "0.21.1")
    ],
@@ -26,19 +25,16 @@ let package = Package(
            name: "bitchat",
            dependencies: [
                .product(name: "P256K", package: "swift-secp256k1"),
-                .product(name: "BitFoundation", package: "BitFoundation"),
                .product(name: "BitLogger", package: "BitLogger"),
-                .product(name: "Tor", package: "Arti")
+                .product(name: "Tor", package: "Tor")
            ],
            path: "bitchat",
            exclude: [
                "Info.plist",
                "Assets.xcassets",
-                "_PreviewHelpers/PreviewAssets.xcassets",
                "bitchat.entitlements",
                "bitchat-macOS.entitlements",
-                "LaunchScreen.storyboard",
-                "ViewModels/Extensions/README.md"
+                "LaunchScreen.storyboard"
            ],
            resources: [
                .process("Localizable.xcstrings")
@@ -46,24 +42,14 @@ let package = Package(
        ),
        .testTarget(
            name: "bitchatTests",
-            dependencies: [
-                "bitchat",
-                .product(name: "BitFoundation", package: "BitFoundation")
-            ],
+            dependencies: ["bitchat"],
            path: "bitchatTests",
            exclude: [
                "Info.plist",
-                "README.md",
-                // CI perf gate data (read by scripts/check-perf-floors.sh),
-                // not a test resource.
-                "Performance/perf-floors.json"
+                "README.md"
            ],
            resources: [
-                .process("Localization"),
-                // Only the vector fixture: declaring the whole "Noise"
-                // directory would claim its .swift test files as resources
-                // and silently drop them from compilation.
-                .process("Noise/NoiseTestVectors.json")
+                .process("Localization")
            ]
        )
    ]
@@ -8,6 +8,9 @@ A decentralized peer-to-peer messaging app with dual transport architecture: loc

 📲 [App Store](https://apps.apple.com/us/app/bitchat-mesh/id6748219622)

+> [!WARNING]
+> Private messages have not received external security review and may contain vulnerabilities. Do not use for sensitive use cases, and do not rely on its security until it has been reviewed. Now uses the [Noise Protocol](https://www.noiseprotocol.org) for identity and encryption. Public local chat (the main feature) has no security concerns.
+
 ## License

 This project is released into the public domain. See the [LICENSE](LICENSE) file for details.
@@ -1,141 +1,309 @@
-# bitchat Protocol Whitepaper
+# BitChat Protocol Whitepaper

-**Version 2.0**
+**Version 1.1**

-**Date: July 6, 2026**
+**Date: July 25, 2025**

 ---

 ## Abstract

-bitchat is a decentralized, peer-to-peer messaging application for secure, private, censorship-resistant communication that works with or without the internet. Nearby devices form an ad-hoc Bluetooth Low Energy (BLE) mesh; distant peers are reached over the Nostr protocol when a connection exists. A layered store-and-forward stack — a persistent sender outbox, opportunistic couriers with a spray-and-wait copy budget, gossip-synced public history, and Nostr relay mailboxes — delivers messages to peers who are out of range at send time. This document describes the protocol and its delivery guarantees as implemented.
+BitChat is a decentralized, peer-to-peer messaging application designed for secure, private, and censorship-resistant communication over ephemeral, ad-hoc networks. This whitepaper details the BitChat Protocol Stack, a layered architecture that combines a modern cryptographic foundation with a flexible application protocol. At its core, BitChat leverages the Noise Protocol Framework (specifically, the `XX` pattern) to establish mutually authenticated, end-to-end encrypted sessions between peers. This document provides a technical specification of the identity management, session lifecycle, message framing, and security considerations that underpin the BitChat network.

 ---

-## 1. Design Goals
+## 1. Introduction

-* **Confidentiality:** all private communication is end-to-end encrypted; intermediate nodes and couriers carry only opaque ciphertext.
-* **Authentication:** peers are identified by cryptographic keys; announcements are signed and verified.
-* **Resilience:** the network functions in lossy, low-bandwidth, partitioned environments with churning membership.
-* **Eventual delivery:** a message to an out-of-range peer should still arrive — relayed by the mesh, carried by a moving person, or resting on an internet relay — within a bounded retention window.
-* **Ephemerality by default:** no plaintext message content is ever written to disk. Everything the store-and-forward stack persists is either sealed ciphertext or already-public broadcast traffic, and all of it dies with the panic wipe.
+In an era of centralized communication platforms, BitChat offers a resilient alternative by operating without central servers. It is designed for scenarios where internet connectivity is unavailable or untrustworthy, such as protests, natural disasters, or remote areas. Communication occurs directly between devices over transports like Bluetooth Low Energy (BLE).

-## 2. Architecture Overview
+The design goals of the BitChat Protocol are:

-Two transports implement a common `Transport` interface and are coordinated by a `MessageRouter`:
+*   **Confidentiality:** All communication must be unreadable to third parties.
+*   **Authentication:** Users must be able to verify the identity of their correspondents.
+*   **Integrity:** Messages cannot be tampered with in transit.
+*   **Forward Secrecy:** The compromise of long-term identity keys must not compromise past session keys.
+*   **Deniability:** It should be difficult to cryptographically prove that a specific user sent a particular message.
+*   **Resilience:** The protocol must function reliably in lossy, low-bandwidth environments.

-* **BLE mesh** — every device is simultaneously a GATT central and peripheral, relaying packets in a controlled flood. No infrastructure, pairing, or accounts.
-* **Nostr** — private messages to mutual favorites travel as NIP-17 gift-wrapped events over public relays (over Tor where enabled), bridging separate meshes through the internet.
+This paper specifies the technical details of the protocol designed to meet these goals.

-The router prefers a live mesh link, falls back to Nostr, and engages the courier system when neither can deliver promptly.
+---

-## 3. Identity
+## 2. Protocol Stack

-Each device holds two long-term key pairs in the Keychain:
+The BitChat Protocol is a four-layer stack. This layered approach separates concerns, allowing for modularity and future extensibility.

-* a **Curve25519 static key** for Noise key agreement — its SHA-256 fingerprint is the peer's stable identity, and
-* an **Ed25519 signing key** for packet signatures.
+```mermaid
+graph TD
+    A[Application Layer] --> B[Session Layer];
+    B --> C[Encryption Layer];
+    C --> D[Transport Layer];

-On the mesh, peers appear under short ephemeral IDs derived per session; favoriting pins the full Noise public key so identity survives across sessions. Mutual favorites also exchange Nostr public keys for the internet path. Optional QR verification binds a nickname to a fingerprint in person.
+    subgraph "BitChat Application"
+        A
+    end

-## 4. BLE Mesh Layer
+    subgraph "Message Framing & State"
+        B
+    end

-### 4.1 Packet Format
+    subgraph "Noise Protocol Framework"
+        C
+    end

-A compact binary header (version, type, TTL, timestamp, flags) is followed by an 8-byte sender ID, an optional 8-byte recipient ID, the payload, and an optional Ed25519 signature. Version 2 packets may carry an explicit source route. Signatures exclude the TTL byte so relays can decrement it without invalidating them. Packets other than fragments are padded toward uniform sizes.
+    subgraph "BLE, Wi-Fi Direct, etc."
+        D
+    end

-### 4.2 Flood Control
+    style A fill:#cde4ff
+    style B fill:#b5d8ff
+    style C fill:#9ac2ff
+    style D fill:#7eadff
+```

-Relaying is a deterministic controlled flood tuned by local connection degree:
+*   **Application Layer:** Defines the structure of user-facing messages (`BitchatMessage`), acknowledgments (`DeliveryAck`), and other application-level data.
+*   **Session Layer:** Manages the overall communication packet (`BitchatPacket`). This includes routing information (TTL), message typing, fragmentation, and serialization into a compact binary format.
+*   **Encryption Layer:** Establishes and manages secure channels using the Noise Protocol Framework. It is responsible for the cryptographic handshake, session management, and transport message encryption/decryption.
+*   **Transport Layer:** The underlying physical medium used for data transmission, such as Bluetooth Low Energy (BLE). This layer is abstracted away from the core protocol.

-* **TTL:** packets originate with TTL 7. Relays clamp: dense graphs (≥ 6 links) cap broadcast TTL at 5; thin chains (≤ 2 links) relay at full incoming depth.
-* **Deduplication:** an LRU seen-set (1000 entries, 5-minute expiry) keyed by sender, timestamp, type, and a payload digest drops duplicates. A scheduled relay is cancelled when a duplicate arrives first from another relay.
-* **Jitter:** relays wait a random 10–220 ms (wider when dense) so duplicate suppression wins often.
-* **Fanout subsetting:** broadcast messages are re-sent to a deterministic, message-ID-seeded subset of links (~log₂ of degree) rather than all of them; announces, fragments, and sync packets use full fanout. The ingress link is always excluded (split horizon).
-* **Directed traffic** (handshakes, private messages, courier envelopes) relays deterministically with TTL − 1 and tight jitter, and is never subset.
+---

-### 4.3 Routing
+## 3. Identity and Key Management

-Announcements carry up to 10 direct-neighbor IDs, giving each node a shallow topology map (60 s freshness). When a bidirectionally-confirmed path exists, packets are source-routed along it; otherwise — and whenever a route fails — delivery falls back to flooding.
+A peer's identity in BitChat is defined by two persistent cryptographic key pairs, which are generated on first launch and stored securely in the device's Keychain.

-### 4.4 Fragmentation
+1.  **Noise Static Key Pair (`Curve25519`):** This is the long-term identity key used for the Noise Protocol handshake. The public part of this key is shared with peers to establish secure sessions.
+2.  **Signing Key Pair (`Ed25519`):** This key is used to sign announcements and other protocol messages where non-repudiation is required, such as binding a public key to a nickname.

-Packets exceeding the link MTU split into ~469-byte fragments (8-byte fragment ID, index/total header) that relay independently and reassemble at each receiving node (128 concurrent assemblies, 30 s timeout, 1 MiB cap).
+### 3.1. Fingerprint

-### 4.5 Presence
+A user's unique, verifiable fingerprint is the **SHA-256 hash** of their **Noise static public key**. This provides a user-friendly and secure way to verify an identity out-of-band (e.g., by reading it aloud or scanning a QR code).

-Signed announcements propagate multi-hop: every 4 s while isolated, backing off to ~15–30 s (jittered) when connected. A verified announce retains a peer as *reachable* for 60 s after last contact. Connection scheduling is RSSI-gated with duty-cycled scanning to bound battery drain.
+`Fingerprint = SHA256(StaticPublicKey_Curve25519)`

-## 5. Encryption
+### 3.2. Identity Management

-### 5.1 Live Sessions: Noise XX
+The `SecureIdentityStateManager` class is responsible for managing all cryptographic identity material and social metadata (petnames, trust levels, etc.). It uses an in-memory cache for performance and persists this cache to the Keychain after encrypting it with a separate AES-GCM key.

-Connected peers establish sessions with the Noise `XX` pattern (Curve25519 / ChaCha20-Poly1305 / SHA-256), providing mutual authentication and forward secrecy. All private payloads — messages, delivery acks, read receipts — ride inside the session as typed ciphertext. Intermediate relays see only opaque `noiseEncrypted` packets.
+---

-### 5.2 Offline Seals: Noise X
+## 4. The Social Trust Layer

-Courier envelopes are sealed to the recipient's *static* key with the one-way Noise `X` pattern; the sender's identity is authenticated inside the ciphertext. **This path has no forward secrecy** — compromise of the recipient's static key exposes sealed-but-undelivered mail. A prekey scheme is future work.
+Beyond cryptographic identity, BitChat incorporates a social trust layer, allowing users to manage their relationships with peers. This functionality is handled by the `SecureIdentityStateManager`.

-### 5.3 Nostr Path
+### 4.1. Peer Verification

-Private messages to mutual favorites are wrapped per NIP-17/NIP-59: a rumor (kind 14) sealed (kind 13) and gift-wrapped (kind 1059) under a throwaway ephemeral key, so relays learn neither sender nor content.
+While the Noise handshake cryptographically authenticates a peer's key, it doesn't confirm the real-world identity of the person holding the device. To solve this, users can perform out-of-band (OOB) verification by comparing fingerprints. Once a user confirms that a peer's fingerprint matches the one they expect, they can mark that peer as "verified". This status is stored locally and displayed in the UI, providing a strong assurance of identity for future conversations.

-## 6. Store and Forward
+### 4.2. Favorites and Blocking

-Four mechanisms cover the "recipient is not here right now" problem. All persisted state is wiped by panic mode.
+To improve the user experience and provide control over interactions, the protocol supports:
+*   **Favorites:** Users can mark trusted or frequently contacted peers as "favorites". This is a local designation that can be used by the application to prioritize notifications or display peers more prominently.
+*   **Blocking:** Users can block peers. When a peer is blocked, the application will discard any incoming packets from that peer's fingerprint at the earliest possible stage, effectively silencing them without notifying the blocked peer.

-### 6.1 Sender Outbox
+---

-Private messages without a prompt route are retained per peer (100 messages/peer, 24 h TTL) and re-sent on reconnect events until a delivery or read ack clears them, or a resend cap (8 attempts) drops them with visible failure. The outbox persists to disk sealed under a ChaChaPoly key held only in the Keychain, so queued mail survives an app kill without ever storing plaintext.
+## 5. The Noise Protocol Layer

-### 6.2 Couriers
+BitChat implements the Noise Protocol Framework to provide strong, authenticated end-to-end encryption.

-When no transport can deliver promptly, the message is sealed (§5.2) into a **courier envelope** and handed to up to 3 connected peers who may physically encounter the recipient:
+### 5.1. Protocol Name

-* **Opaque addressing.** The only routing information is a 16-byte rotating recipient tag — an HMAC of the recipient's static key and the UTC day — computable solely by parties who already know that key. Couriers learn neither sender, recipient, nor content, and tags do not correlate across days.
-* **Trust tiers.** Mutual favorites may deposit 5 envelopes each; any peer with a signature-verified announce may deposit 2, into a bounded pool (20 of 40 slots) that can never crowd out favorites' mail. Envelopes are capped at 16 KiB and 24 h; overflow evicts oldest verified-tier mail first.
-* **Deposit retry.** Queued messages are re-deposited whenever a new eligible courier connects, until 3 distinct couriers carry the message or it expires.
-* **Spray and wait.** Envelopes carry a copy budget (initially 4, capped at 8). A courier meeting another eligible courier hands over half its remaining budget, so mail diffuses through a moving crowd instead of riding one person. Budgets, spray history, and carried mail persist across app restarts (iOS file protection).
-* **Handover.** On a verified *direct* announce from the recipient, matching envelopes are delivered over the live link and removed. On a verified *relayed* announce, a copy floods toward the recipient as a directed packet while the carried original stays put, throttled to one attempt per envelope per 10 minutes.
-* Receivers dedup by message ID, so redundant copies and the retained outbox original are harmless. Couriered mail from blocked senders is dropped at decryption time.
+The specific Noise protocol implemented is:

-### 6.3 Public History (Gossip Sync)
+**`Noise_XX_25519_ChaChaPoly_SHA256`**

-Public broadcast messages are cached (1000 packets) and reconciled between peers every ~15 s using compact GCS filters: each side advertises what it holds, the other returns what is missing. Messages stay sync-able for **6 hours** and the cache persists to disk, so a device that walks between two partitions — or relaunches later — serves the room's recent history to whoever missed it. Fragments and file transfers keep a short 15-minute window.
+*   **`XX` Pattern:** This handshake pattern provides mutual authentication and forward secrecy. It does not require either party to know the other's static public key before the handshake begins. The keys are exchanged and authenticated during the three-part handshake. This is ideal for a decentralized P2P environment.
+*   **`25519`:** The Diffie-Hellman function used is Curve25519.
+*   **`ChaChaPoly`:** The AEAD (Authenticated Encryption with Associated Data) cipher is ChaCha20-Poly1305.
+*   **`SHA256`:** The hash function used for all cryptographic hashing operations is SHA-256.

-### 6.4 Nostr Mailboxes
+### 5.2. The `XX` Handshake

-Gift-wrapped messages rest on Nostr relays; clients re-subscribe with a 24-hour lookback on reconnect, covering the both-devices-offline case for mutual favorites whenever either side touches the internet.
+The `XX` handshake consists of three messages exchanged between an Initiator and a Responder to establish a shared secret and derive transport encryption keys.

-### 6.5 Delivery Metrics
+```mermaid
+sequenceDiagram
+    participant I as Initiator
+    participant R as Responder

-Bare local counters (deposits, handovers, sprays, opens, outbox flushes and drops — no identities, message IDs, or timestamps) let delivery behavior be measured on-device. They never leave the device and are cleared by the panic wipe.
+    Note over I, R: Pre-computation: h = SHA256(protocol_name)

-## 7. Application Layer
+    I->>R: -> e
+    Note right of I: I generates ephemeral key `e_i`.<br/>h = SHA256(h + e_i.pub)

-* **Public chat** — signed broadcast messages within the mesh, backed by the gossip-synced history above.
-* **Private chat** — end-to-end encrypted messages with delivery and read receipts, over mesh, courier, or Nostr.
-* **Location channels** — geohash-scoped public rooms carried over Nostr relays for regional chat beyond radio range.
-* **Favorites** — the mutual-trust relationship that unlocks Nostr delivery and the larger courier quota.
-* **Media** — files and images fragment over the mesh (1 MiB cap, explicit accept before anything touches disk); couriers carry text only.
-* **Panic wipe** — clears identity keys, favorites, carried courier mail, the sealed outbox, archived public history, and metrics.
+    R->>I: <- e, ee, s, es
+    Note left of R: R generates ephemeral key `e_r`.<br/>h = SHA256(h + e_r.pub)<br/>MixKey(DH(e_i, e_r))<br/>R sends static key `s_r`, encrypted.<br/>h = SHA256(h + ciphertext)<br/>MixKey(DH(e_i, s_r))
+
+    I->>R: -> s, se
+    Note right of I: I decrypts and verifies `s_r`.<br/>I sends static key `s_i`, encrypted.<br/>h = SHA256(h + ciphertext)<br/>MixKey(DH(s_i, e_r))
+
+    Note over I, R: Handshake complete. Transport keys derived.
+```
+
+**Handshake Flow:**
+
+1.  **Initiator -> Responder:** The initiator generates a new ephemeral key pair (`e_i`) and sends the public part to the responder.
+2.  **Responder -> Initiator:** The responder receives the initiator's ephemeral public key. It then generates its own ephemeral key pair (`e_r`), performs a DH exchange with the initiator's ephemeral key (`ee`), sends its own static public key (`s_r`) encrypted with the resulting symmetric key, and performs another DH exchange between the initiator's ephemeral key and its own static key (`es`).
+3.  **Initiator -> Responder:** The initiator receives the responder's message, decrypts the responder's static key, and authenticates it. The initiator then sends its own static key (`s_i`) encrypted and performs a final DH exchange between its static key and the responder's ephemeral key (`se`).
+
+Upon completion, both parties share a set of symmetric keys for bidirectional transport message encryption. The final handshake hash is used for channel binding.
+
+### 5.3. Session Management
+
+The `NoiseSessionManager` class manages all active Noise sessions. It handles:
+*   Creating sessions for new peers.
+*   Coordinating the handshake process to prevent race conditions.
+*   Storing the resulting transport ciphers (`sendCipher`, `receiveCipher`).
+*   Periodically checking if sessions need to be re-keyed for enhanced security.
+
+---
+
+## 6. The BitChat Session and Application Protocol
+
+Once a Noise session is established, peers exchange `BitchatPacket` structures, which are encrypted as the payload of Noise transport messages.
+
+### 6.1. Binary Packet Format (`BitchatPacket`)
+
+To minimize bandwidth, `BitchatPacket`s are serialized into a compact binary format. The structure is designed to be fixed-size where possible to resist traffic analysis.
+
+| Field           | Size (bytes) | Description                                                                                             |
+|-----------------|--------------|---------------------------------------------------------------------------------------------------------|
+| **Header**      | **13**       | **Fixed-size header**                                                                                   |
+| Version         | 1            | Protocol version (currently `1`).                                                                       |
+| Type            | 1            | Message type (e.g., `message`, `deliveryAck`, `noiseHandshakeInit`). See `MessageType` enum.            |
+| TTL             | 1            | Time-To-Live for mesh network routing. Decremented at each hop.                                         |
+| Timestamp       | 8            | `UInt64` millisecond timestamp of packet creation.                                                      |
+| Flags           | 1            | Bitmask for optional fields (`hasRecipient`, `hasSignature`, `isCompressed`).                           |
+| Payload Length  | 2            | `UInt16` length of the payload field.                                                                   |
+| **Variable**    | **...**      | **Variable-size fields**                                                                                |
+| Sender ID       | 8            | 8-byte truncated peer ID of the sender.                                                                 |
+| Recipient ID    | 8 (optional) | 8-byte truncated peer ID of the recipient. Present if `hasRecipient` flag is set. Broadcast if `0xFF..FF`. |
+| Payload         | Variable     | The actual content of the packet, as defined by the `Type` field.                                       |
+| Signature       | 64 (optional)| `Ed25519` signature of the packet. Present if `hasSignature` flag is set.                               |
+
+**Padding:** All packets are padded to the next standard block size (256, 512, 1024, or 2048 bytes) using a PKCS#7-style scheme to obscure the true message length from network observers.
+
+```mermaid
+---
+config:
+  theme: dark
+---
+---
+title: "BitchatPacket"
+---
+packet
+8: "Version"
+8: "Type"
+8: "TTL"
+64: "Timestamp"
+8: "Flags"
+16: "Payload Length"
+64: "Sender ID"
+64: "Recipient ID (optional)"
+48: "Payload (variable)"
+64: "Signature (optional)"
+```
+_A representation of the sizes of the fields in `BitchatPacket`_
+
+### 6.2. Application Message Format (`BitchatMessage`)
+
+For packets of type `message`, the payload is a binary-serialized `BitchatMessage` containing the chat content.
+
+| Field               | Size (bytes) | Description                                                              |
+|---------------------|--------------|--------------------------------------------------------------------------|
+| Flags               | 1            | Bitmask for optional fields (`isRelay`, `isPrivate`, `hasOriginalSender`). |
+| Timestamp           | 8            | `UInt64` millisecond timestamp of message creation.                      |
+| ID                  | 1 + len      | `UUID` string for the message.                                           |
+| Sender              | 1 + len      | Nickname of the sender.                                                  |
+| Content             | 2 + len      | The UTF-8 encoded message content.                                       |
+| Original Sender     | 1 + len (opt)| Nickname of the original sender if the message is a relay.               |
+| Recipient Nickname  | 1 + len (opt)| Nickname of the recipient for private messages.                          |
+
+```mermaid
+---
+config:
+  theme: dark
+---
+---
+title: "BitchatMessage"
+---
+packet
+8: "Flags"
+64: "Timestamp"
+24: "ID (variable)"
+32: "Sender (variable)"
+32: "Content (variable)"
+32: "Original Sender (variable) (optional)"
+32: "Recipient Nickname (variable) (optional)"
+```
+_A representation of the sizes of the fields in `BitchatMessage`_
+
+---
+
+## 7. Message Routing and Propagation
+
+BitChat operates as a decentralized mesh network, meaning there are no central servers to route messages. Packets are propagated through the network from peer to peer. The protocol supports several modes of message delivery.
+
+### 7.1. Direct Connection
+
+This is the simplest case. If Peer A and Peer B are directly connected, they can exchange packets after establishing a mutually authenticated Noise session. All packets are encrypted using the transport ciphers derived from the handshake.
+
+### 7.2. Efficient Gossip with Bloom Filters
+
+To send messages to peers that are not directly connected, BitChat employs a "flooding" or "gossip" protocol. When a peer receives a packet that is not destined for it, it acts as a relay. To prevent infinite routing loops and minimize memory usage, the protocol uses an `OptimizedBloomFilter` to track recently seen packet IDs.
+
+The logic is as follows:
+
+1.  A peer receives a packet.
+2.  It checks the Bloom filter to see if the packet's ID has likely been seen before. If so, the packet is discarded. Bloom filters can have false positives (though they are rare), but they guarantee no false negatives. This means that while some packets may be incorrectly discarded due to false positives, the gossip protocol's redundancy ensures these packets will eventually be received through subsequent exchanges with other peers.
+3.  If the packet is new, its ID is added to the Bloom filter.
+4.  The peer decrements the packet's Time-To-Live (TTL) field.
+5.  If the TTL is greater than zero, the peer re-broadcasts the packet to all of its connected peers, *except* for the peer from which it received the packet.
+
+This mechanism allows packets to "flood" through the network efficiently, maximizing the chance of reaching their destination while using minimal resources to prevent loops.
+
+### 7.3. Time-To-Live (TTL)
+
+Every `BitchatPacket` contains an 8-bit TTL field. This value is set by the originating peer and is decremented by one at each relay hop. If a peer receives a packet and decrements its TTL to 0, it will process the packet (if it is the recipient) but will not relay it further. This is a crucial mechanism to prevent packets from circulating endlessly in the mesh.
+
+### 7.4. Private vs. Broadcast Messages
+
+The routing logic respects the confidentiality of private messages:
+
+*   **Private Messages:** A packet with a specific `recipientID` is a private message. Relay nodes forward the entire, encrypted Noise message without being able to access the inner `BitchatPacket` or its payload. Only the final recipient, who shares the correct Noise session keys with the sender, can decrypt the packet.
+*   **Broadcast Messages:** A packet with the special broadcast `recipientID` (`0xFFFFFFFFFFFFFFFF`) is intended for all peers. Any peer that receives and decrypts a broadcast message will process its content. It will still be relayed according to the flooding algorithm to ensure it reaches the entire network.
+
+### 7.5. Message Reliability and Lifecycle
+
+To function in unreliable, lossy networks, the protocol includes features to track the lifecycle of a message and ensure its delivery.
+
+*   **Delivery Acknowledgments (`DeliveryAck`):** When a private message reaches its final destination, the recipient's device sends a `DeliveryAck` packet back to the original sender. This acknowledgment contains the ID of the original message.
+*   **Read Receipts (`ReadReceipt`):** After a message is displayed on the recipient's screen, the application can send a `ReadReceipt`, also containing the original message ID, to inform the sender that the message has been seen.
+*   **Message Retry Service:** Senders maintain a `MessageRetryService` which tracks outgoing messages. If a `DeliveryAck` is not received for a message within a certain time window, the service will automatically re-send the message, creating a more resilient user experience.
+
+### 7.6. Fragmentation
+
+Transport layers like BLE have a Maximum Transmission Unit (MTU) that limits the size of a single packet. To handle messages larger than this limit, BitChat implements a fragmentation protocol.
+
+*   **`fragmentStart`:** A packet with this type marks the beginning of a fragmented message. It contains metadata about the total size and number of fragments.
+*   **`fragmentContinue`:** These packets carry the intermediate chunks of the message data.
+*   **`fragmentEnd`:** This packet carries the final chunk of the message and signals the receiver to begin reassembly.
+
+Receiving peers collect all fragments and reassemble them in the correct order before passing the complete message up to the application layer.
+
+---

 ## 8. Security Considerations

-* **Relay nodes** cannot read private traffic; they forward padded, opaque ciphertext.
-* **Couriers** are quota-bounded mailbags. A malicious courier can drop mail (redundant copies and deposit retry mitigate this) but cannot read it, link it across days, or amplify it — copy budgets are capped and every envelope is validated against size and lifetime policy on deposit.
-* **Flooding abuse** is bounded by TTL clamps, deduplication, per-depositor quotas, connect-rate limits, and announce-rate limiting.
-* **Replay** of public broadcasts is bounded by the 6-hour acceptance window plus deduplication; private payloads are protected by Noise nonces.
-* **Metadata.** BLE proximity is inherently observable; ephemeral IDs and daily-rotating courier tags limit long-term correlation. Nostr traffic can ride Tor.
-* **No forward secrecy for sealed mail** (§5.2) is the main cryptographic trade-off of the offline path.
-
-## 9. Future Work
-
-* Prekey-based forward secrecy for courier envelopes.
-* Couriered media beyond the 16 KiB text cap.
-* Probabilistic relay and edge-of-network TTL boosting for very dense and very sparse graphs.
-* Multi-hop courier routing informed by encounter history.
+*   **Replay Attacks:** The Noise transport messages include a nonce that is incremented for each message. The `NoiseCipherState` implements a sliding window replay protection mechanism to detect and discard replayed or out-of-order messages.
+*   **Denial of Service:** The `NoiseRateLimiter` is implemented to prevent resource exhaustion from rapid, repeated handshake attempts from a single peer.
+*   **Key-Compromise Impersonation:** The `XX` pattern authenticates both parties, preventing an attacker from impersonating one party to the other.
+*   **Identity Binding:** While the Noise handshake authenticates the cryptographic keys, binding those keys to a human-readable nickname is handled at the application layer. Users must verify fingerprints out-of-band to prevent man-in-the-middle attacks.
+*   **Traffic Analysis:** The use of fixed-size padding for all packets helps to obscure the exact nature and content of the communication, making it harder for a network-level adversary to infer information based on message size.

 ---

-*This document describes the protocol as implemented in the current release. The implementation is free and unencumbered software released into the public domain.*
+## 9. Conclusion
+
+The BitChat Protocol provides a robust and secure foundation for decentralized, peer-to-peer communication. By layering a flexible application protocol on top of the well-regarded Noise Protocol Framework, it achieves strong confidentiality, authentication, and forward secrecy. The use of a compact binary format and thoughtful security considerations like rate limiting and traffic analysis resistance make it suitable for use in challenging network environments.
@@ -10,12 +10,11 @@
 		17901751FD8010AFC8E750F2 /* bitchatShareExtension.appex in Embed Foundation Extensions */ = {isa = PBXBuildFile; fileRef = 61F92EBA29C47C0FCC482F1F /* bitchatShareExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
 		3EE336D150427F736F32B56C /* P256K in Frameworks */ = {isa = PBXBuildFile; productRef = B1D9136AA0083366353BFA2F /* P256K */; };
 		885BBED78092484A5B069461 /* P256K in Frameworks */ = {isa = PBXBuildFile; productRef = 4EB6BA1B8464F1EA38F4E286 /* P256K */; };
-		A6BCF9482F80953E001CF9B9 /* BitFoundation in Frameworks */ = {isa = PBXBuildFile; productRef = A6BCF9472F80953E001CF9B9 /* BitFoundation */; };
-		A6BCF94A2F809550001CF9B9 /* BitFoundation in Frameworks */ = {isa = PBXBuildFile; productRef = A6BCF9492F809550001CF9B9 /* BitFoundation */; };
 		A6E3E5702E77036A0032EA8A /* BitLogger in Frameworks */ = {isa = PBXBuildFile; productRef = A6E3E56F2E77036A0032EA8A /* BitLogger */; };
 		A6E3E5722E7703760032EA8A /* BitLogger in Frameworks */ = {isa = PBXBuildFile; productRef = A6E3E5712E7703760032EA8A /* BitLogger */; };
 		A6E3EA7F2E7706720032EA8A /* Tor in Frameworks */ = {isa = PBXBuildFile; productRef = A6E3EA7E2E7706720032EA8A /* Tor */; };
 		A6E3EA812E7706A80032EA8A /* Tor in Frameworks */ = {isa = PBXBuildFile; productRef = A6E3EA802E7706A80032EA8A /* Tor */; };
+		A6F183FD2E948783006A9046 /* tor-nolzma.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = A6F183FC2E948783006A9046 /* tor-nolzma.xcframework */; };
 		E0A1B2C3D4E5F6012345678D /* relays/online_relays_gps.csv in Resources */ = {isa = PBXBuildFile; fileRef = E0A1B2C3D4E5F6012345678A /* relays/online_relays_gps.csv */; };
 		E0A1B2C3D4E5F6012345678E /* relays/online_relays_gps.csv in Resources */ = {isa = PBXBuildFile; fileRef = E0A1B2C3D4E5F6012345678A /* relays/online_relays_gps.csv */; };
 /* End PBXBuildFile section */
@@ -96,24 +95,6 @@
 			);
 			target = 57CA17A36A2532A6CFF367BB /* bitchatShareExtension */;
 		};
-		C5E027A52ECCDFD700BD6012 /* Exceptions for "bitchatTests" folder in "bitchatTests_macOS" target */ = {
-			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
-			membershipExceptions = (
-				Info.plist,
-				Localization/PrimaryLocalizationKeys.json,
-				README.md,
-			);
-			target = 47FF23248747DD7CB666CB91 /* bitchatTests_macOS */;
-		};
-		C5E027A82ECCDFE200BD6012 /* Exceptions for "bitchatTests" folder in "bitchatTests_iOS" target */ = {
-			isa = PBXFileSystemSynchronizedBuildFileExceptionSet;
-			membershipExceptions = (
-				Info.plist,
-				Localization/PrimaryLocalizationKeys.json,
-				README.md,
-			);
-			target = 6CB97DF2EA57234CB3E563B8 /* bitchatTests_iOS */;
-		};
 /* End PBXFileSystemSynchronizedBuildFileExceptionSet section */

 /* Begin PBXFileSystemSynchronizedRootGroup section */
@@ -137,10 +118,6 @@
 		};
 		A6E32D412E762EAE0032EA8A /* bitchatTests */ = {
 			isa = PBXFileSystemSynchronizedRootGroup;
-			exceptions = (
-				C5E027A82ECCDFE200BD6012 /* Exceptions for "bitchatTests" folder in "bitchatTests_iOS" target */,
-				C5E027A52ECCDFD700BD6012 /* Exceptions for "bitchatTests" folder in "bitchatTests_macOS" target */,
-			);
 			path = bitchatTests;
 			sourceTree = "<group>";
 		};
@@ -158,16 +135,15 @@
 				A6E3E5722E7703760032EA8A /* BitLogger in Frameworks */,
 				3EE336D150427F736F32B56C /* P256K in Frameworks */,
 				A6E3EA812E7706A80032EA8A /* Tor in Frameworks */,
-				A6BCF94A2F809550001CF9B9 /* BitFoundation in Frameworks */,
 			);
 		};
 		B5A5CC493FFB3D8966548140 /* Frameworks */ = {
 			isa = PBXFrameworksBuildPhase;
 			files = (
+				A6F183FD2E948783006A9046 /* tor-nolzma.xcframework in Frameworks */,
 				A6E3E5702E77036A0032EA8A /* BitLogger in Frameworks */,
 				885BBED78092484A5B069461 /* P256K in Frameworks */,
 				A6E3EA7F2E7706720032EA8A /* Tor in Frameworks */,
-				A6BCF9482F80953E001CF9B9 /* BitFoundation in Frameworks */,
 			);
 		};
 /* End PBXFrameworksBuildPhase section */
@@ -227,7 +203,6 @@
 				B1D9136AA0083366353BFA2F /* P256K */,
 				A6E3E5712E7703760032EA8A /* BitLogger */,
 				A6E3EA802E7706A80032EA8A /* Tor */,
-				A6BCF9492F809550001CF9B9 /* BitFoundation */,
 			);
 			productName = bitchat_macOS;
 			productReference = 8F3A7C058C2C8E1A06C8CF8B /* bitchat.app */;
@@ -238,7 +213,6 @@
 			buildConfigurationList = 1C27B5BA3DB46DDF0DBFEF62 /* Build configuration list for PBXNativeTarget "bitchatTests_macOS" */;
 			buildPhases = (
 				5C22AA7B9ACC5A861445C769 /* Sources */,
-				C5E027A42ECCDFD700BD6012 /* Resources */,
 			);
 			buildRules = (
 			);
@@ -271,7 +245,6 @@
 			buildConfigurationList = 38C4AF6313E5037F25CEF30B /* Build configuration list for PBXNativeTarget "bitchatTests_iOS" */;
 			buildPhases = (
 				865C8403EF02C089369A9FCB /* Sources */,
-				C5E027A72ECCDFE200BD6012 /* Resources */,
 			);
 			buildRules = (
 			);
@@ -308,7 +281,6 @@
 				4EB6BA1B8464F1EA38F4E286 /* P256K */,
 				A6E3E56F2E77036A0032EA8A /* BitLogger */,
 				A6E3EA7E2E7706720032EA8A /* Tor */,
-				A6BCF9472F80953E001CF9B9 /* BitFoundation */,
 			);
 			productName = bitchat_iOS;
 			productReference = 96D0D41CA19EE5A772AA8434 /* bitchat.app */;
@@ -321,7 +293,7 @@
 			isa = PBXProject;
 			attributes = {
 				BuildIndependentTargetsInParallel = YES;
-				LastUpgradeCheck = 2650;
+				LastUpgradeCheck = 1640;
 			};
 			buildConfigurationList = 3EA424CBD51200895D361189 /* Build configuration list for PBXProject "bitchat" */;
 			developmentRegion = en;
@@ -340,7 +312,6 @@
 				ne,
 				"pt-BR",
 				ru,
-				tr,
 				uk,
 				"zh-Hans",
 			);
@@ -349,8 +320,7 @@
 			packageReferences = (
 				B8C407587481BBB190741C93 /* XCRemoteSwiftPackageReference "swift-secp256k1" */,
 				A6E3E56E2E77036A0032EA8A /* XCLocalSwiftPackageReference "localPackages/BitLogger" */,
-				A6E3EA7D2E7706720032EA8A /* XCLocalSwiftPackageReference "localPackages/Arti" */,
-				A6BCF9462F80953E001CF9B9 /* XCLocalSwiftPackageReference "localPackages/BitFoundation" */,
+				A6E3EA7D2E7706720032EA8A /* XCLocalSwiftPackageReference "localPackages/Tor" */,
 			);
 			preferredProjectObjectVersion = 90;
 			projectDirPath = "";
@@ -372,16 +342,6 @@
 				E0A1B2C3D4E5F6012345678D /* relays/online_relays_gps.csv in Resources */,
 			);
 		};
-		C5E027A42ECCDFD700BD6012 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			files = (
-			);
-		};
-		C5E027A72ECCDFE200BD6012 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			files = (
-			);
-		};
 		CD6E8F32BC38357473954F97 /* Resources */ = {
 			isa = PBXResourcesBuildPhase;
 			files = (
@@ -446,6 +406,7 @@
 				CODE_SIGNING_ALLOWED = YES;
 				CODE_SIGNING_REQUIRED = YES;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatTests/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
 				LD_RUNPATH_SEARCH_PATHS = (
@@ -470,6 +431,7 @@
 				CODE_SIGNING_ALLOWED = YES;
 				CODE_SIGNING_REQUIRED = YES;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatTests/Info.plist;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
 				LD_RUNPATH_SEARCH_PATHS = (
@@ -496,6 +458,7 @@
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				COMBINE_HIDPI_IMAGES = YES;
 				DEAD_CODE_STRIPPING = YES;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatTests/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -520,6 +483,7 @@
 				CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION = YES;
 				CODE_SIGN_ENTITLEMENTS = bitchatShareExtension/bitchatShareExtension.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatShareExtension/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
@@ -528,6 +492,7 @@
 					"@executable_path/Frameworks",
 					"@executable_path/../../Frameworks",
 				);
+				MARKETING_VERSION = "$(MARKETING_VERSION)";
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER).ShareExtension";
 				SDKROOT = iphoneos;
 				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
@@ -550,7 +515,7 @@
 				CODE_SIGNING_REQUIRED = YES;
 				CODE_SIGN_ENTITLEMENTS = bitchat/bitchat.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
-				DEVELOPMENT_ASSET_PATHS = bitchat/_PreviewHelpers;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = NO;
 				INFOPLIST_FILE = bitchat/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
@@ -560,6 +525,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
+				MARKETING_VERSION = "$(MARKETING_VERSION)";
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				SDKROOT = iphoneos;
@@ -583,6 +549,7 @@
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				COMBINE_HIDPI_IMAGES = YES;
 				DEAD_CODE_STRIPPING = YES;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatTests/Info.plist;
 				LD_RUNPATH_SEARCH_PATHS = (
 					"$(inherited)",
@@ -608,7 +575,7 @@
 				CODE_SIGNING_REQUIRED = YES;
 				CODE_SIGN_ENTITLEMENTS = bitchat/bitchat.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
-				DEVELOPMENT_ASSET_PATHS = bitchat/_PreviewHelpers;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_FILE = bitchat/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
@@ -618,6 +585,7 @@
 					"$(inherited)",
 					"@executable_path/Frameworks",
 				);
+				MARKETING_VERSION = "$(MARKETING_VERSION)";
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				SDKROOT = iphoneos;
@@ -643,6 +611,7 @@
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				COMBINE_HIDPI_IMAGES = YES;
 				DEAD_CODE_STRIPPING = YES;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = YES;
 				INFOPLIST_FILE = bitchat/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
@@ -652,6 +621,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = "$(MACOSX_DEPLOYMENT_TARGET)";
+				MARKETING_VERSION = "$(MARKETING_VERSION)";
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				REGISTER_APP_GROUPS = YES;
@@ -664,7 +634,6 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
@@ -698,7 +667,6 @@
 				CURRENT_PROJECT_VERSION = "$(CURRENT_PROJECT_VERSION)";
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_NS_ASSERTIONS = NO;
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -712,10 +680,10 @@
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
 				MACOSX_DEPLOYMENT_TARGET = "$(MACOSX_DEPLOYMENT_TARGET)";
+				MARKETING_VERSION = "$(MARKETING_VERSION)";
 				MTL_ENABLE_DEBUG_INFO = NO;
 				MTL_FAST_MATH = YES;
 				PRODUCT_NAME = "$(TARGET_NAME)";
-				STRING_CATALOG_GENERATE_SYMBOLS = NO;
 				SWIFT_COMPILATION_MODE = wholemodule;
 				SWIFT_OPTIMIZATION_LEVEL = "-O";
 				SWIFT_VERSION = "$(SWIFT_VERSION)";
@@ -735,6 +703,7 @@
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
 				COMBINE_HIDPI_IMAGES = YES;
 				DEAD_CODE_STRIPPING = YES;
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_PREVIEWS = NO;
 				INFOPLIST_FILE = bitchat/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
@@ -744,6 +713,7 @@
 					"@executable_path/../Frameworks",
 				);
 				MACOSX_DEPLOYMENT_TARGET = "$(MACOSX_DEPLOYMENT_TARGET)";
+				MARKETING_VERSION = "$(MARKETING_VERSION)";
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER)";
 				PRODUCT_NAME = bitchat;
 				REGISTER_APP_GROUPS = YES;
@@ -756,7 +726,6 @@
 			isa = XCBuildConfiguration;
 			buildSettings = {
 				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_LOCALIZABILITY_NONLOCALIZED = YES;
 				CLANG_ANALYZER_NONNULL = YES;
 				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
 				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
@@ -790,7 +759,6 @@
 				CURRENT_PROJECT_VERSION = "$(CURRENT_PROJECT_VERSION)";
 				DEAD_CODE_STRIPPING = YES;
 				DEBUG_INFORMATION_FORMAT = dwarf;
-				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				ENABLE_STRICT_OBJC_MSGSEND = YES;
 				ENABLE_TESTABILITY = YES;
 				ENABLE_USER_SCRIPT_SANDBOXING = YES;
@@ -810,11 +778,11 @@
 				GCC_WARN_UNUSED_VARIABLE = YES;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
 				MACOSX_DEPLOYMENT_TARGET = "$(MACOSX_DEPLOYMENT_TARGET)";
+				MARKETING_VERSION = "$(MARKETING_VERSION)";
 				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
 				MTL_FAST_MATH = YES;
 				ONLY_ACTIVE_ARCH = YES;
 				PRODUCT_NAME = "$(TARGET_NAME)";
-				STRING_CATALOG_GENERATE_SYMBOLS = NO;
 				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
 				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
 				SWIFT_VERSION = "$(SWIFT_VERSION)";
@@ -831,6 +799,7 @@
 				CODE_SIGN_ALLOW_ENTITLEMENTS_MODIFICATION = YES;
 				CODE_SIGN_ENTITLEMENTS = bitchatShareExtension/bitchatShareExtension.entitlements;
 				CODE_SIGN_STYLE = "$(CODE_SIGN_STYLE)";
+				DEVELOPMENT_TEAM = "$(DEVELOPMENT_TEAM)";
 				INFOPLIST_FILE = bitchatShareExtension/Info.plist;
 				INFOPLIST_KEY_CFBundleDisplayName = bitchat;
 				IPHONEOS_DEPLOYMENT_TARGET = "$(IPHONEOS_DEPLOYMENT_TARGET)";
@@ -839,6 +808,7 @@
 					"@executable_path/Frameworks",
 					"@executable_path/../../Frameworks",
 				);
+				MARKETING_VERSION = "$(MARKETING_VERSION)";
 				PRODUCT_BUNDLE_IDENTIFIER = "$(PRODUCT_BUNDLE_IDENTIFIER).ShareExtension";
 				SDKROOT = iphoneos;
 				SUPPORTED_PLATFORMS = "iphoneos iphonesimulator";
@@ -904,17 +874,13 @@
 /* End XCConfigurationList section */

 /* Begin XCLocalSwiftPackageReference section */
-		A6BCF9462F80953E001CF9B9 /* XCLocalSwiftPackageReference "localPackages/BitFoundation" */ = {
-			isa = XCLocalSwiftPackageReference;
-			relativePath = localPackages/BitFoundation;
-		};
 		A6E3E56E2E77036A0032EA8A /* XCLocalSwiftPackageReference "localPackages/BitLogger" */ = {
 			isa = XCLocalSwiftPackageReference;
 			relativePath = localPackages/BitLogger;
 		};
-		A6E3EA7D2E7706720032EA8A /* XCLocalSwiftPackageReference "localPackages/Arti" */ = {
+		A6E3EA7D2E7706720032EA8A /* XCLocalSwiftPackageReference "localPackages/Tor" */ = {
 			isa = XCLocalSwiftPackageReference;
-			relativePath = localPackages/Arti;
+			relativePath = localPackages/Tor;
 		};
 /* End XCLocalSwiftPackageReference section */

@@ -923,8 +889,8 @@
 			isa = XCRemoteSwiftPackageReference;
 			repositoryURL = "https://github.com/21-DOT-DEV/swift-secp256k1";
 			requirement = {
-				kind = exactVersion;
-				version = 0.21.1;
+				kind = upToNextMajorVersion;
+				minimumVersion = 0.21.1;
 			};
 		};
 /* End XCRemoteSwiftPackageReference section */
@@ -935,15 +901,6 @@
 			package = B8C407587481BBB190741C93 /* XCRemoteSwiftPackageReference "swift-secp256k1" */;
 			productName = P256K;
 		};
-		A6BCF9472F80953E001CF9B9 /* BitFoundation */ = {
-			isa = XCSwiftPackageProductDependency;
-			productName = BitFoundation;
-		};
-		A6BCF9492F809550001CF9B9 /* BitFoundation */ = {
-			isa = XCSwiftPackageProductDependency;
-			package = A6BCF9462F80953E001CF9B9 /* XCLocalSwiftPackageReference "localPackages/BitFoundation" */;
-			productName = BitFoundation;
-		};
 		A6E3E56F2E77036A0032EA8A /* BitLogger */ = {
 			isa = XCSwiftPackageProductDependency;
 			productName = BitLogger;
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "2650"
+   LastUpgradeVersion = "1640"
   version = "1.3">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -98,8 +98,8 @@
      </BuildableProductRunnable>
      <EnvironmentVariables>
         <EnvironmentVariable
-            key = "BITCHAT_LOG_LEVEL"
-            value = "debug"
+            key = "-DBITCHAT_DEV_ALLOW_CLEARNET"
+            value = ""
            isEnabled = "YES">
         </EnvironmentVariable>
      </EnvironmentVariables>
@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <Scheme
-   LastUpgradeVersion = "2650"
+   LastUpgradeVersion = "1640"
   version = "1.3">
   <BuildAction
      parallelizeBuildables = "YES"
@@ -1,80 +0,0 @@
-import BitFoundation
-import Combine
-import Foundation
-
-enum SharedContentKind: String, Sendable, Equatable {
-    case text
-    case url
-}
-
-enum RuntimeScenePhase: String, Sendable, Equatable {
-    case active
-    case inactive
-    case background
-}
-
-enum TorLifecycleEvent: String, Sendable, Equatable {
-    case willStart
-    case willRestart
-    case didBecomeReady
-    case preferenceChanged
-}
-
-enum AppEvent: Sendable, Equatable {
-    case launched
-    case startupCompleted
-    case scenePhaseChanged(RuntimeScenePhase)
-    case openedURL(String)
-    case sharedContentAccepted(SharedContentKind)
-    case notificationOpened(peerID: PeerID?)
-    case deepLinkOpened(String)
-    case torLifecycleChanged(TorLifecycleEvent)
-    case nostrRelayConnectionChanged(Bool)
-    case terminationRequested
-}
-
-actor AppEventStream {
-    private var continuations: [UUID: AsyncStream<AppEvent>.Continuation] = [:]
-
-    func emit(_ event: AppEvent) {
-        for continuation in continuations.values {
-            continuation.yield(event)
-        }
-    }
-
-}
-
-/// Identity key for a direct conversation. Equality and hashing use the
-/// canonical `id` only; `routingPeerID` carries the transport-level peer ID
-/// the conversation is keyed under (see `ConversationID.directPeer`).
-struct PeerHandle: Sendable, Identifiable {
-    let id: String
-    let routingPeerID: PeerID
-}
-
-extension PeerHandle: Equatable {
-    static func == (lhs: PeerHandle, rhs: PeerHandle) -> Bool {
-        lhs.id == rhs.id
-    }
-}
-
-extension PeerHandle: Hashable {
-    func hash(into hasher: inout Hasher) {
-        hasher.combine(id)
-    }
-}
-
-enum ConversationID: Hashable, Sendable {
-    case mesh
-    case geohash(String)
-    case direct(PeerHandle)
-
-    init(channelID: ChannelID) {
-        switch channelID {
-        case .mesh:
-            self = .mesh
-        case .location(let channel):
-            self = .geohash(channel.geohash.lowercased())
-        }
-    }
-}
@@ -1,134 +0,0 @@
-import BitFoundation
-import Combine
-import CoreBluetooth
-import Foundation
-
-@MainActor
-final class AppChromeModel: ObservableObject {
-    @Published private(set) var hasUnreadPrivateMessages = false
-    @Published var nickname: String
-    @Published var showingFingerprintFor: PeerID?
-    @Published var isAppInfoPresented = false
-    @Published var isLocationChannelsSheetPresented = false
-    @Published var isNoticesSheetPresented = false
-    /// When the sheet is opened for "notes left here" (empty mesh timeline),
-    /// it should land on the geo tab instead of the channel-derived default.
-    @Published var noticesSheetPrefersGeoTab = false
-    @Published var showBluetoothAlert = false
-    @Published var bluetoothAlertMessage = ""
-    @Published var bluetoothState: CBManagerState = .unknown
-    @Published var showScreenshotPrivacyWarning = false
-
-    private let chatViewModel: ChatViewModel
-    private var cancellables = Set<AnyCancellable>()
-
-    /// Bulletin-board coordinator, created on first use of the board sheet.
-    private(set) lazy var boardManager = BoardManager(transport: chatViewModel.meshService)
-
-    init(chatViewModel: ChatViewModel, privateInboxModel: PrivateInboxModel) {
-        self.chatViewModel = chatViewModel
-        self.nickname = chatViewModel.nickname
-
-        bind(privateInboxModel: privateInboxModel)
-    }
-
-    var shouldSuppressScreenshotNotification: Bool {
-        isLocationChannelsSheetPresented || isAppInfoPresented
-    }
-
-    func setNickname(_ nickname: String) {
-        self.nickname = nickname
-        if chatViewModel.nickname != nickname {
-            chatViewModel.nickname = nickname
-        }
-    }
-
-    func validateAndSaveNickname() {
-        chatViewModel.validateAndSaveNickname()
-        if nickname != chatViewModel.nickname {
-            nickname = chatViewModel.nickname
-        }
-    }
-
-    func openMostRelevantPrivateChat() {
-        chatViewModel.openMostRelevantPrivateChat()
-    }
-
-    func showFingerprint(for peerID: PeerID) {
-        showingFingerprintFor = peerID
-    }
-
-    func clearFingerprint() {
-        showingFingerprintFor = nil
-    }
-
-    func presentAppInfo() {
-        isAppInfoPresented = true
-    }
-
-    func presentNotices(geoTab: Bool = false) {
-        noticesSheetPrefersGeoTab = geoTab
-        isNoticesSheetPresented = true
-    }
-
-    /// Builds the mesh topology map model from the transport's gossiped
-    /// graph plus the live nickname table. Unknown nodes (heard about via a
-    /// neighbor claim but never announced to us) fall back to a short ID.
-    func meshTopologyDisplayModel() -> MeshTopologyDisplayModel {
-        let mesh = chatViewModel.meshService
-        guard let snapshot = mesh.currentMeshTopology() else { return .empty }
-        let nicknames = mesh.getPeerNicknames()
-
-        let nodes = snapshot.nodes.map { peerID -> MeshTopologyDisplayModel.Node in
-            let isSelf = peerID == snapshot.localPeerID
-            let label: String
-            if isSelf {
-                label = chatViewModel.nickname
-            } else {
-                label = nicknames[peerID] ?? "\(peerID.id.prefix(8))…"
-            }
-            return MeshTopologyDisplayModel.Node(id: peerID.id, label: label, isSelf: isSelf)
-        }
-        let edges = snapshot.edges.map { ($0.a.id, $0.b.id) }
-        return MeshTopologyDisplayModel(nodes: nodes, edges: edges)
-    }
-
-    func triggerScreenshotPrivacyWarning() {
-        showScreenshotPrivacyWarning = true
-    }
-
-    func panicClearAllData() {
-        chatViewModel.panicClearAllData()
-    }
-
-    private func bind(privateInboxModel: PrivateInboxModel) {
-        privateInboxModel.$unreadPeerIDs
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] unreadPeerIDs in
-                self?.hasUnreadPrivateMessages = !unreadPeerIDs.isEmpty
-            }
-            .store(in: &cancellables)
-
-        chatViewModel.$nickname
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] nickname in
-                guard let self, self.nickname != nickname else { return }
-                self.nickname = nickname
-            }
-            .store(in: &cancellables)
-
-        chatViewModel.$showBluetoothAlert
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$showBluetoothAlert)
-
-        chatViewModel.$bluetoothAlertMessage
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$bluetoothAlertMessage)
-
-        chatViewModel.$bluetoothState
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$bluetoothState)
-
-        hasUnreadPrivateMessages = !privateInboxModel.unreadPeerIDs.isEmpty
-    }
-}
@@ -1,412 +0,0 @@
-import BitFoundation
-import Combine
-import Foundation
-import SwiftUI
-import Tor
-import UserNotifications
-#if os(iOS)
-import UIKit
-#elseif os(macOS)
-import AppKit
-#endif
-
-@MainActor
-final class AppRuntime: ObservableObject {
-    let chatViewModel: ChatViewModel
-    let events = AppEventStream()
-    /// Single source of truth for conversation message state and selection
-    /// (docs/CONVERSATION-STORE-DESIGN.md). Owned here; the feature models
-    /// and `ChatViewModel` observe and mutate it through its intent API.
-    let conversations: ConversationStore
-    let publicChatModel: PublicChatModel
-    let privateInboxModel: PrivateInboxModel
-    let privateConversationModel: PrivateConversationModel
-    let verificationModel: VerificationModel
-    let conversationUIModel: ConversationUIModel
-    let locationChannelsModel: LocationChannelsModel
-    let peerListModel: PeerListModel
-    let appChromeModel: AppChromeModel
-    let boardAlertsModel: BoardAlertsModel
-
-    private let idBridge: NostrIdentityBridge
-    private var cancellables = Set<AnyCancellable>()
-    private var started = false
-    private var lastNostrRelayConnectedState = false
-    private var didHandleInitialNostrConnection = false
-
-    #if os(iOS)
-    private var didHandleInitialActive = false
-    private var didEnterBackground = false
-    #endif
-
-    init(
-        keychain: KeychainManagerProtocol = KeychainManager.makeDefault(),
-        idBridge: NostrIdentityBridge = NostrIdentityBridge()
-    ) {
-        self.idBridge = idBridge
-        let conversations = ConversationStore()
-        let peerIdentityStore = PeerIdentityStore()
-        let locationPresenceStore = LocationPresenceStore()
-        let locationManager = LocationChannelManager.shared
-        self.conversations = conversations
-        self.chatViewModel = ChatViewModel(
-            keychain: keychain,
-            idBridge: idBridge,
-            identityManager: SecureIdentityStateManager(keychain),
-            conversations: conversations,
-            peerIdentityStore: peerIdentityStore,
-            locationPresenceStore: locationPresenceStore,
-            locationManager: locationManager
-        )
-        self.publicChatModel = PublicChatModel(conversations: conversations)
-        self.privateInboxModel = PrivateInboxModel(conversations: conversations)
-        self.locationChannelsModel = LocationChannelsModel(manager: locationManager)
-        self.privateConversationModel = PrivateConversationModel(
-            chatViewModel: self.chatViewModel,
-            conversations: conversations,
-            locationChannelsModel: self.locationChannelsModel,
-            peerIdentityStore: peerIdentityStore
-        )
-        self.verificationModel = VerificationModel(
-            chatViewModel: self.chatViewModel,
-            privateConversationModel: self.privateConversationModel,
-            peerIdentityStore: peerIdentityStore
-        )
-        self.conversationUIModel = ConversationUIModel(
-            chatViewModel: self.chatViewModel,
-            privateConversationModel: self.privateConversationModel,
-            conversations: conversations
-        )
-        self.peerListModel = PeerListModel(
-            chatViewModel: self.chatViewModel,
-            conversations: conversations,
-            locationChannelsModel: self.locationChannelsModel,
-            peerIdentityStore: peerIdentityStore,
-            locationPresenceStore: locationPresenceStore
-        )
-        self.appChromeModel = AppChromeModel(
-            chatViewModel: self.chatViewModel,
-            privateInboxModel: self.privateInboxModel
-        )
-        let chatViewModel = self.chatViewModel
-        self.boardAlertsModel = BoardAlertsModel(
-            arrivals: BoardStore.shared.postArrivals.eraseToAnyPublisher(),
-            wipes: BoardStore.shared.didWipe.eraseToAnyPublisher(),
-            dependencies: BoardAlertsModel.Dependencies(
-                isOwnPost: { post in
-                    let key = chatViewModel.meshService.noiseSigningPublicKeyData()
-                    return !key.isEmpty && key == post.authorSigningKey
-                },
-                emitSystemLine: { content, geohash in
-                    if geohash.isEmpty {
-                        chatViewModel.addMeshOnlySystemMessage(content)
-                    } else {
-                        chatViewModel.addGeohashSystemMessage(content, geohash: geohash)
-                    }
-                }
-            )
-        )
-
-        GeoRelayDirectory.shared.prefetchIfNeeded()
-        bindRuntimeObservers()
-        NotificationDelegate.shared.runtime = self
-    }
-
-    func start() {
-        guard !started else {
-            checkForSharedContent()
-            return
-        }
-
-        started = true
-        NotificationDelegate.shared.runtime = self
-        VerificationService.shared.configure(with: chatViewModel.meshService)
-        announceInitialTorStatusIfNeeded()
-
-        Task(priority: .utility) { [weak self] in
-            guard let self else { return }
-            let nickname = await MainActor.run { self.chatViewModel.nickname }
-            let npub = await MainActor.run {
-                try? self.idBridge.getCurrentNostrIdentity()?.npub
-            }
-            await MainActor.run {
-                _ = VerificationService.shared.buildMyQRString(nickname: nickname, npub: npub)
-            }
-        }
-
-        NetworkActivationService.shared.start()
-        GeohashPresenceService.shared.start()
-        checkForSharedContent()
-
-        record(.launched)
-        record(.startupCompleted)
-    }
-
-    func handleOpenURL(_ url: URL) {
-        record(.openedURL(url.absoluteString))
-
-        if url.scheme == "bitchat", url.host == "share" {
-            checkForSharedContent()
-        }
-    }
-
-    func handleDidBecomeActiveNotification() {
-        chatViewModel.handleDidBecomeActive()
-        checkForSharedContent()
-    }
-
-    #if os(macOS)
-    func handleMacDidBecomeActiveNotification() {
-        record(.scenePhaseChanged(.active))
-        chatViewModel.handleDidBecomeActive()
-        checkForSharedContent()
-    }
-    #endif
-
-    #if os(iOS)
-    func handleScenePhaseChange(_ newPhase: ScenePhase) {
-        switch newPhase {
-        case .background:
-            record(.scenePhaseChanged(.background))
-            TorManager.shared.setAppForeground(false)
-            TorManager.shared.goDormantOnBackground()
-            chatViewModel.endGeohashSampling()
-            NostrRelayManager.shared.disconnect()
-            didEnterBackground = true
-
-        case .active:
-            record(.scenePhaseChanged(.active))
-            chatViewModel.meshService.startServices()
-            TorManager.shared.setAppForeground(true)
-            let shouldRefreshNostrConnections = didHandleInitialActive && didEnterBackground
-
-            if didHandleInitialActive && didEnterBackground {
-                if TorManager.shared.isAutoStartAllowed() && !TorManager.shared.isReady {
-                    TorManager.shared.ensureRunningOnForeground()
-                }
-            } else {
-                didHandleInitialActive = true
-            }
-
-            didEnterBackground = false
-
-            if shouldRefreshNostrConnections && TorManager.shared.isAutoStartAllowed() {
-                Task.detached {
-                    let _ = await TorManager.shared.awaitReady(timeout: 60)
-                    await MainActor.run {
-                        TorURLSession.shared.rebuild()
-                        NostrRelayManager.shared.resetAllConnections()
-                    }
-                }
-            }
-
-            chatViewModel.handleDidBecomeActive()
-            checkForSharedContent()
-
-        case .inactive:
-            record(.scenePhaseChanged(.inactive))
-
-        @unknown default:
-            break
-        }
-    }
-    #endif
-
-    func applicationWillTerminate() {
-        record(.terminationRequested)
-        chatViewModel.applicationWillTerminate()
-    }
-
-    func handleNotificationResponse(
-        identifier: String,
-        actionIdentifier: String = UNNotificationDefaultActionIdentifier,
-        userInfo: [AnyHashable: Any]
-    ) {
-        if actionIdentifier == NotificationService.waveActionID {
-            chatViewModel.sendMeshWave()
-            return
-        }
-
-        if identifier.hasPrefix("private-"), let peerID = PeerID(str: userInfo["peerID"] as? String) {
-            record(.notificationOpened(peerID: peerID))
-            chatViewModel.startPrivateChat(with: peerID)
-        }
-
-        if let deepLink = userInfo["deeplink"] as? String, let url = URL(string: deepLink) {
-            record(.deepLinkOpened(deepLink))
-            openExternalURL(url)
-        }
-    }
-
-    func presentationOptions(
-        forNotificationIdentifier identifier: String,
-        userInfo: [AnyHashable: Any]
-    ) async -> UNNotificationPresentationOptions {
-        if identifier.hasPrefix("private-"), let peerID = PeerID(str: userInfo["peerID"] as? String) {
-            if conversations.selectedPrivatePeerID == peerID {
-                return []
-            }
-            return [.banner, .sound]
-        }
-
-        if identifier.hasPrefix("geo-activity-"),
-           let deepLink = userInfo["deeplink"] as? String,
-           let geohash = deepLink.components(separatedBy: "/").last,
-           case .location(let channel) = locationChannelsModel.selectedChannel,
-           channel.geohash == geohash {
-            return []
-        }
-
-        return [.banner, .sound]
-    }
-}
-
-private extension AppRuntime {
-    func bindRuntimeObservers() {
-        NostrRelayManager.shared.$isConnected
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] isConnected in
-                self?.handleNostrRelayConnectionChanged(isConnected)
-            }
-            .store(in: &cancellables)
-
-        NotificationCenter.default.publisher(for: .TorWillRestart)
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.record(.torLifecycleChanged(.willRestart))
-                self?.chatViewModel.handleTorWillRestart()
-            }
-            .store(in: &cancellables)
-
-        NotificationCenter.default.publisher(for: .TorDidBecomeReady)
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.record(.torLifecycleChanged(.didBecomeReady))
-                self?.chatViewModel.handleTorDidBecomeReady()
-            }
-            .store(in: &cancellables)
-
-        NotificationCenter.default.publisher(for: .TorWillStart)
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.record(.torLifecycleChanged(.willStart))
-                self?.chatViewModel.handleTorWillStart()
-            }
-            .store(in: &cancellables)
-
-        NotificationCenter.default.publisher(for: .TorUserPreferenceChanged)
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] notification in
-                self?.record(.torLifecycleChanged(.preferenceChanged))
-                self?.chatViewModel.handleTorPreferenceChanged(notification)
-            }
-            .store(in: &cancellables)
-
-        #if os(iOS)
-        NotificationCenter.default.publisher(for: UIApplication.userDidTakeScreenshotNotification)
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.handleScreenshotCaptured()
-            }
-            .store(in: &cancellables)
-        #endif
-    }
-
-    func checkForSharedContent() {
-        guard let userDefaults = UserDefaults(suiteName: BitchatApp.groupID),
-              let sharedContent = userDefaults.string(forKey: "sharedContent"),
-              let sharedDate = userDefaults.object(forKey: "sharedContentDate") as? Date else {
-            return
-        }
-
-        guard Date().timeIntervalSince(sharedDate) < TransportConfig.uiShareAcceptWindowSeconds else {
-            return
-        }
-
-        let contentKind = SharedContentKind(rawValue: userDefaults.string(forKey: "sharedContentType") ?? "") ?? .text
-
-        userDefaults.removeObject(forKey: "sharedContent")
-        userDefaults.removeObject(forKey: "sharedContentType")
-        userDefaults.removeObject(forKey: "sharedContentDate")
-
-        switch contentKind {
-        case .url:
-            if let data = sharedContent.data(using: .utf8),
-               let urlData = try? JSONSerialization.jsonObject(with: data) as? [String: String],
-               let url = urlData["url"] {
-                chatViewModel.sendMessage(url)
-            } else {
-                chatViewModel.sendMessage(sharedContent)
-            }
-        case .text:
-            chatViewModel.sendMessage(sharedContent)
-        }
-
-        record(.sharedContentAccepted(contentKind))
-    }
-
-    func handleNostrRelayConnectionChanged(_ isConnected: Bool) {
-        record(.nostrRelayConnectionChanged(isConnected))
-
-        let becameConnected = isConnected && !lastNostrRelayConnectedState
-        lastNostrRelayConnectedState = isConnected
-
-        guard started, becameConnected else { return }
-
-        let isInitialConnection = !didHandleInitialNostrConnection
-        didHandleInitialNostrConnection = true
-
-        if !chatViewModel.nostrHandlersSetup {
-            chatViewModel.setupNostrMessageHandling()
-            chatViewModel.nostrHandlersSetup = true
-        }
-
-        guard !isInitialConnection else { return }
-
-        chatViewModel.resubscribeCurrentGeohash()
-        chatViewModel.geoChannelCoordinator?.refreshSampling()
-    }
-
-    func announceInitialTorStatusIfNeeded() {
-        if TorManager.shared.torEnforced &&
-            !chatViewModel.torStatusAnnounced &&
-            TorManager.shared.isAutoStartAllowed() {
-            chatViewModel.torStatusAnnounced = true
-            chatViewModel.addGeohashOnlySystemMessage(
-                String(localized: "system.tor.starting", comment: "System message when Tor is starting")
-            )
-        } else if !TorManager.shared.torEnforced && !chatViewModel.torStatusAnnounced {
-            chatViewModel.torStatusAnnounced = true
-            chatViewModel.addGeohashOnlySystemMessage(
-                String(localized: "system.tor.dev_bypass", comment: "System message when Tor bypass is enabled in development")
-            )
-        }
-    }
-
-    func handleScreenshotCaptured() {
-        if appChromeModel.isLocationChannelsSheetPresented {
-            appChromeModel.triggerScreenshotPrivacyWarning()
-            return
-        }
-
-        if appChromeModel.isAppInfoPresented {
-            return
-        }
-
-        chatViewModel.handleScreenshotCaptured()
-    }
-
-    func openExternalURL(_ url: URL) {
-        #if os(iOS)
-        UIApplication.shared.open(url)
-        #else
-        NSWorkspace.shared.open(url)
-        #endif
-    }
-
-    func record(_ event: AppEvent) {
-        Task {
-            await events.emit(event)
-        }
-    }
-}
@@ -1,908 +0,0 @@
-//
-// ConversationStore.swift
-// bitchat
-//
-// Single source of truth for conversation message state (see
-// docs/CONVERSATION-STORE-DESIGN.md). One `Conversation` object per
-// `ConversationID`; all mutations flow through the store's intent API and
-// every mutation emits a `ConversationChange` after state is consistent.
-//
-// The store also owns conversation selection: the active public channel and
-// the selected private peer (the two UI selection axes) plus the derived
-// `selectedConversationID`.
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import BitFoundation
-import BitLogger
-import Combine
-import Foundation
-
-// MARK: - Conversation
-
-/// A single conversation timeline (`.mesh`, `.geohash`, or `.direct`).
-///
-/// Publishing granularity is per conversation: views observe ONE
-/// `Conversation` object, so an append to chat A never invalidates observers
-/// of chat B.
-///
-/// Mutations are `fileprivate` by design — only `ConversationStore`'s intent
-/// API may mutate a conversation, keeping the store the sole writer.
-@MainActor
-final class Conversation: ObservableObject, Identifiable {
-    let id: ConversationID
-    /// Maximum retained messages; oldest are trimmed on overflow.
-    let cap: Int
-
-    @Published private(set) var messages: [BitchatMessage] = []
-    @Published private(set) var isUnread: Bool = false
-
-    /// Incrementally-maintained message-ID → index map for O(1) dedup and
-    /// delivery-status lookup. Kept in sync on every mutation:
-    /// - tail append: single insert
-    /// - out-of-order insert: suffix reindex from the insertion point
-    /// - trim: full rebuild — `removeFirst(k)` is already O(n), so the
-    ///   rebuild does not change the asymptotics, and trim only happens once
-    ///   the cap (1337) is reached. Simple and correct beats the
-    ///   offset-tracking alternative here.
-    private var indexByMessageID: [String: Int] = [:]
-
-    fileprivate init(id: ConversationID, cap: Int) {
-        self.id = id
-        self.cap = max(1, cap)
-    }
-
-    // MARK: Reads
-
-    func containsMessage(withID messageID: String) -> Bool {
-        indexByMessageID[messageID] != nil
-    }
-
-    func message(withID messageID: String) -> BitchatMessage? {
-        guard let index = indexByMessageID[messageID] else { return nil }
-        return messages[index]
-    }
-
-    /// All message IDs currently in this conversation (unordered).
-    var messageIDs: Dictionary<String, Int>.Keys {
-        indexByMessageID.keys
-    }
-
-    // MARK: Store-internal mutations
-
-    /// Result of an ordered insert. `trimmedMessageIDs` reports messages
-    /// evicted by the cap so the store can keep its message-ID →
-    /// conversation map exact.
-    fileprivate struct InsertResult {
-        let inserted: Bool
-        let trimmedMessageIDs: [String]
-
-        static let duplicate = InsertResult(inserted: false, trimmedMessageIDs: [])
-    }
-
-    fileprivate enum UpsertOutcome {
-        case appended(trimmedMessageIDs: [String])
-        case updated
-    }
-
-    /// Inserts a message in timestamp order, deduplicating by message ID.
-    /// Fast path appends when the timestamp is >= the current tail;
-    /// otherwise a binary search finds the upper-bound insertion point so
-    /// arrival order is preserved among equal timestamps.
-    /// Reports `inserted: false` if a message with the same ID already exists.
-    fileprivate func insert(_ message: BitchatMessage) -> InsertResult {
-        guard indexByMessageID[message.id] == nil else { return .duplicate }
-
-        if let last = messages.last, message.timestamp < last.timestamp {
-            let index = insertionIndex(for: message.timestamp)
-            messages.insert(message, at: index)
-            reindex(from: index)
-        } else {
-            messages.append(message)
-            indexByMessageID[message.id] = messages.count - 1
-        }
-
-        return InsertResult(inserted: true, trimmedMessageIDs: trimIfNeeded())
-    }
-
-    /// Replace-or-append by message ID. An existing message keeps its
-    /// timeline position (in-place updates like media progress reuse the
-    /// original timestamp); a new message goes through ordered insertion.
-    fileprivate func upsert(_ message: BitchatMessage) -> UpsertOutcome {
-        if let index = indexByMessageID[message.id] {
-            messages[index] = message
-            return .updated
-        }
-        let result = insert(message)
-        return .appended(trimmedMessageIDs: result.trimmedMessageIDs)
-    }
-
-    /// Applies a delivery status keyed by message ID, honoring the
-    /// no-downgrade rule (the SOLE enforcement point — every delivery
-    /// update flows through the store): equal statuses are skipped, and
-    /// `.read` is never downgraded to `.delivered` or `.sent`.
-    /// Returns `true` when the status was applied.
-    fileprivate func applyDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool {
-        guard let index = indexByMessageID[messageID] else { return false }
-        let message = messages[index]
-        guard !Self.shouldSkipStatusUpdate(current: message.deliveryStatus, new: status) else { return false }
-
-        message.deliveryStatus = status
-        // BitchatMessage is a reference type; write back through the
-        // subscript so the @Published wrapper emits.
-        messages[index] = message
-        return true
-    }
-
-    /// Republishes a message without changing state. Used for mirrored
-    /// copies that share a BitchatMessage instance: the first conversation's
-    /// status apply mutated the shared object, so this conversation's
-    /// observers still need an @Published emission to re-render.
-    @discardableResult
-    fileprivate func republishMessage(withID messageID: String) -> Bool {
-        guard let index = indexByMessageID[messageID] else { return false }
-        messages[index] = messages[index]
-        return true
-    }
-
-    @discardableResult
-    fileprivate func setUnread(_ unread: Bool) -> Bool {
-        guard isUnread != unread else { return false }
-        isUnread = unread
-        return true
-    }
-
-    /// Removes a single message by ID. Returns the removed message, or
-    /// `nil` when no message with that ID exists.
-    fileprivate func remove(messageID: String) -> BitchatMessage? {
-        guard let index = indexByMessageID[messageID] else { return nil }
-        let removed = messages.remove(at: index)
-        indexByMessageID.removeValue(forKey: messageID)
-        reindex(from: index)
-        return removed
-    }
-
-    /// Removes every message matching `predicate`. Returns the removed
-    /// message IDs (empty when nothing matched).
-    fileprivate func removeAll(where predicate: (BitchatMessage) -> Bool) -> [String] {
-        var removedIDs: [String] = []
-        messages.removeAll { message in
-            guard predicate(message) else { return false }
-            removedIDs.append(message.id)
-            return true
-        }
-        guard !removedIDs.isEmpty else { return [] }
-        for id in removedIDs {
-            indexByMessageID.removeValue(forKey: id)
-        }
-        reindex(from: 0)
-        return removedIDs
-    }
-
-    fileprivate func clearMessages() {
-        messages.removeAll()
-        indexByMessageID.removeAll()
-    }
-
-    // MARK: Diagnostics
-
-    /// Appends human-readable invariant violations for this conversation
-    /// (empty when healthy): the ID index must be the exact inverse of the
-    /// messages array, the cap must hold, and timestamps must be
-    /// non-decreasing (equal timestamps keep arrival order, so only strict
-    /// inversions are violations). O(messages); allocates only on violation.
-    fileprivate func collectInvariantViolations(into violations: inout [String], label: String) {
-        if indexByMessageID.count != messages.count {
-            violations.append("\(label): index has \(indexByMessageID.count) entries for \(messages.count) messages")
-        }
-        if messages.count > cap {
-            violations.append("\(label): \(messages.count) messages exceeds cap \(cap)")
-        }
-        var previousTimestamp: Date?
-        for position in messages.indices {
-            let message = messages[position]
-            // Count equality + every message resolving to its own position
-            // proves the index is exactly the inverse map (no stale extras).
-            if let index = indexByMessageID[message.id] {
-                if index != position {
-                    violations.append("\(label): message \(message.id.prefix(8))… at \(position) indexed at \(index)")
-                }
-            } else {
-                violations.append("\(label): message \(message.id.prefix(8))… at \(position) missing from index")
-            }
-            if let previousTimestamp, message.timestamp < previousTimestamp {
-                violations.append("\(label): timestamp order violated at \(position)")
-            }
-            previousTimestamp = message.timestamp
-        }
-    }
-
-    // MARK: Internals
-
-    static func shouldSkipStatusUpdate(current: DeliveryStatus?, new: DeliveryStatus) -> Bool {
-        guard let current else { return false }
-        if current == new { return true }
-
-        switch (current, new) {
-        case (.read, .delivered), (.read, .sent):
-            return true
-        default:
-            return false
-        }
-    }
-
-    /// Upper-bound binary search: first index whose timestamp is strictly
-    /// greater than `timestamp`, so equal-timestamp messages keep arrival
-    /// order.
-    private func insertionIndex(for timestamp: Date) -> Int {
-        var low = 0
-        var high = messages.count
-        while low < high {
-            let mid = (low + high) / 2
-            if messages[mid].timestamp <= timestamp {
-                low = mid + 1
-            } else {
-                high = mid
-            }
-        }
-        return low
-    }
-
-    private func reindex(from start: Int) {
-        for index in start..<messages.count {
-            indexByMessageID[messages[index].id] = index
-        }
-    }
-
-    /// Trims oldest messages over the cap; returns the trimmed message IDs.
-    private func trimIfNeeded() -> [String] {
-        guard messages.count > cap else { return [] }
-        let overflow = messages.count - cap
-        let trimmedIDs = messages.prefix(overflow).map(\.id)
-        for id in trimmedIDs {
-            indexByMessageID.removeValue(forKey: id)
-        }
-        messages.removeFirst(overflow)
-        reindex(from: 0)
-        return trimmedIDs
-    }
-}
-
-// MARK: - ConversationChange
-
-/// Typed mutation events for non-UI consumers (delivery tracking,
-/// notifications, sync) that need "something changed in conversation X"
-/// without subscribing to whole message arrays. Emitted on the store's
-/// `changes` subject AFTER the corresponding state is consistent.
-enum ConversationChange {
-    case appended(ConversationID, BitchatMessage)
-    case updated(ConversationID, messageID: String)
-    case statusChanged(ConversationID, messageID: String, DeliveryStatus)
-    case messageRemoved(ConversationID, messageID: String)
-    case cleared(ConversationID)
-    case removed(ConversationID)
-    case migrated(from: ConversationID, to: ConversationID)
-    case unreadChanged(ConversationID, isUnread: Bool)
-}
-
-// MARK: - ConversationStore
-
-/// Sole writer and sole holder of conversation message state. All mutations
-/// go through the intent API below; backing collections are `private(set)`.
-/// Reads are synchronous — writers and readers share the main actor, so
-/// after an intent returns every observer sees the result.
-@MainActor
-final class ConversationStore: ObservableObject {
-    /// Conversation creation order; published so list-style consumers can
-    /// observe conversations appearing/disappearing without rebuilding from
-    /// the dictionary.
-    @Published private(set) var conversationIDs: [ConversationID] = []
-    @Published private(set) var selectedConversationID: ConversationID?
-    @Published private(set) var unreadConversations: Set<ConversationID> = []
-
-    // MARK: Selection state
-    // The two UI selection axes: which public channel is active, and which
-    // private chat (if any) is open on top of it. `selectedConversationID`
-    // is derived: the open private chat wins, otherwise the active public
-    // channel's conversation. Mutate via `setActiveChannel` /
-    // `setSelectedPrivatePeer` only.
-
-    @Published private(set) var activeChannel: ChannelID = .mesh
-    @Published private(set) var selectedPrivatePeerID: PeerID?
-
-    private(set) var conversationsByID: [ConversationID: Conversation] = [:]
-
-    /// Store-level message-ID → conversation-membership map for ID-only
-    /// lookups (delivery receipts arrive with a message ID, not a
-    /// conversation). Maintained incrementally at every mutation point —
-    /// all mutation is centralized in the intent API below, so the map is
-    /// exact, never scanned or rebuilt.
-    ///
-    /// The value is a `Set` because a private message can legitimately live
-    /// in TWO direct conversations: step 2's raw per-peer keying mirrors a
-    /// message into both the stable-key and ephemeral-peer chats
-    /// (`mirrorToEphemeralIfNeeded`). A delivery update must reach both
-    /// copies.
-    private var conversationIDsByMessageID: [String: Set<ConversationID>] = [:]
-
-    /// Monotonic count of messages inserted into any conversation (appends,
-    /// upsert-appends, migration inserts). Field-observability only: the
-    /// periodic store audit folds the delta into its heartbeat line so logs
-    /// carry throughput context. Never read on a hot path.
-    private(set) var appendCount: Int = 0
-
-    /// Sample counter for the mirrored-republish debug log in the ID-only
-    /// `setDeliveryStatus` fan-out (first + every Nth occurrence).
-    private var mirroredRepublishLogCount = 0
-
-    let changes = PassthroughSubject<ConversationChange, Never>()
-
-    // MARK: Intent API
-
-    /// Returns the conversation for `id`, creating it (with the cap policy
-    /// for its kind) on first access.
-    @discardableResult
-    func conversation(for id: ConversationID) -> Conversation {
-        if let existing = conversationsByID[id] {
-            return existing
-        }
-        let conversation = Conversation(id: id, cap: Self.cap(for: id))
-        conversationsByID[id] = conversation
-        conversationIDs.append(id)
-        return conversation
-    }
-
-    /// Appends a message in timestamp order. Returns `false` (and emits
-    /// nothing) if a message with the same ID is already present.
-    @discardableResult
-    func append(_ message: BitchatMessage, to id: ConversationID) -> Bool {
-        let conversation = conversation(for: id)
-        let result = conversation.insert(message)
-        guard result.inserted else { return false }
-        registerMessageID(message.id, in: id)
-        unregisterMessageIDs(result.trimmedMessageIDs, from: id)
-        changes.send(.appended(id, message))
-        return true
-    }
-
-    /// Replace-or-append by message ID (media progress, edits).
-    func upsertByID(_ message: BitchatMessage, in id: ConversationID) {
-        let conversation = conversation(for: id)
-        switch conversation.upsert(message) {
-        case .appended(let trimmedMessageIDs):
-            registerMessageID(message.id, in: id)
-            unregisterMessageIDs(trimmedMessageIDs, from: id)
-            changes.send(.appended(id, message))
-        case .updated:
-            changes.send(.updated(id, messageID: message.id))
-        }
-    }
-
-    /// Applies a delivery status keyed by message ID. Returns `false` when
-    /// the message is unknown or the update would downgrade the status
-    /// (read beats delivered beats sent).
-    @discardableResult
-    func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String, in id: ConversationID) -> Bool {
-        guard let conversation = conversationsByID[id],
-              conversation.applyDeliveryStatus(status, forMessageID: messageID) else {
-            return false
-        }
-        changes.send(.statusChanged(id, messageID: messageID, status))
-        return true
-    }
-
-    /// Applies a delivery status to EVERY conversation containing
-    /// `messageID` (ID-only — delivery receipts don't know conversations;
-    /// mirrored private copies live in two direct chats). Returns `false`
-    /// when the message is unknown or no copy changed (equal status or
-    /// downgrade — read beats delivered beats sent).
-    ///
-    /// `BitchatMessage` is a reference type, so mirrored copies sharing one
-    /// instance are mutated by the first conversation's apply. The skipped
-    /// conversations still hold the changed message, so they get an explicit
-    /// republish and `.statusChanged` event - otherwise a view observing the
-    /// mirrored conversation would render stale status. Distinct copies whose
-    /// update was genuinely rejected (downgrade) are left untouched, guarded
-    /// by status equality.
-    @discardableResult
-    func setDeliveryStatus(_ status: DeliveryStatus, forMessageID messageID: String) -> Bool {
-        guard let ids = conversationIDsByMessageID[messageID] else { return false }
-        var applied = false
-        var skipped: [ConversationID] = []
-        for id in ids {
-            if setDeliveryStatus(status, forMessageID: messageID, in: id) {
-                applied = true
-            } else {
-                skipped.append(id)
-            }
-        }
-        guard applied else { return false }
-        for id in skipped {
-            guard let conversation = conversationsByID[id],
-                  conversation.message(withID: messageID)?.deliveryStatus == status,
-                  conversation.republishMessage(withID: messageID) else { continue }
-            // Field proof the mirrored-copy republish path actually fires;
-            // sampled (first + every Nth) so mirrored chats can't spam logs.
-            mirroredRepublishLogCount += 1
-            if mirroredRepublishLogCount == 1
-                || mirroredRepublishLogCount.isMultiple(of: TransportConfig.conversationStoreMirroredRepublishLogInterval) {
-                SecureLogger.debug(
-                    "mirrored republish #\(mirroredRepublishLogCount) for \(messageID.prefix(8))… in \(id.auditDescription)",
-                    category: .session
-                )
-            }
-            changes.send(.statusChanged(id, messageID: messageID, status))
-        }
-        return true
-    }
-
-    /// Current delivery status of `messageID` in whichever conversation
-    /// holds it (mirrored copies share status — see `setDeliveryStatus`).
-    func deliveryStatus(forMessageID messageID: String) -> DeliveryStatus? {
-        guard let ids = conversationIDsByMessageID[messageID] else { return nil }
-        for id in ids {
-            if let status = conversationsByID[id]?.message(withID: messageID)?.deliveryStatus {
-                return status
-            }
-        }
-        return nil
-    }
-
-    /// Every conversation currently containing `messageID` (empty when the
-    /// message is unknown).
-    func conversationIDs(forMessageID messageID: String) -> Set<ConversationID> {
-        conversationIDsByMessageID[messageID] ?? []
-    }
-
-    func markRead(_ id: ConversationID) {
-        guard unreadConversations.contains(id) else { return }
-        unreadConversations.remove(id)
-        conversationsByID[id]?.setUnread(false)
-        changes.send(.unreadChanged(id, isUnread: false))
-    }
-
-    func markUnread(_ id: ConversationID) {
-        guard !unreadConversations.contains(id) else { return }
-        let conversation = conversation(for: id)
-        unreadConversations.insert(id)
-        conversation.setUnread(true)
-        changes.send(.unreadChanged(id, isUnread: true))
-    }
-
-    /// Selects a conversation (creating it if needed) or clears the
-    /// selection with `nil`.
-    func select(_ id: ConversationID?) {
-        if let id {
-            conversation(for: id)
-        }
-        guard selectedConversationID != id else { return }
-        selectedConversationID = id
-    }
-
-    /// Switches the active public channel. While no private chat is open
-    /// the selection follows the channel.
-    func setActiveChannel(_ channelID: ChannelID) {
-        if activeChannel != channelID {
-            activeChannel = channelID
-        }
-        refreshDerivedSelection()
-    }
-
-    /// Opens a private chat (`nil` closes it, returning the selection to the
-    /// active public channel's conversation).
-    func setSelectedPrivatePeer(_ peerID: PeerID?) {
-        if selectedPrivatePeerID != peerID {
-            selectedPrivatePeerID = peerID
-        }
-        refreshDerivedSelection()
-    }
-
-    private func refreshDerivedSelection() {
-        if let peerID = selectedPrivatePeerID {
-            select(.directPeer(peerID))
-        } else {
-            select(ConversationID(channelID: activeChannel))
-        }
-    }
-
-    /// Moves all messages from `source` into `destination` (the
-    /// ephemeral↔stable peer-ID handoff): dedups by message ID, preserves
-    /// timestamp order, carries unread state over, and hands off the
-    /// selection — mirroring `ChatPrivateConversationCoordinator`'s
-    /// migration semantics. The source conversation is removed. Emits a
-    /// single `.migrated(from:to:)` once the whole move is consistent.
-    func migrateConversation(from source: ConversationID, to destination: ConversationID) {
-        guard source != destination, let sourceConversation = conversationsByID[source] else { return }
-
-        let destinationConversation = conversation(for: destination)
-        for message in sourceConversation.messages {
-            let result = destinationConversation.insert(message)
-            guard result.inserted else { continue }
-            registerMessageID(message.id, in: destination)
-            unregisterMessageIDs(result.trimmedMessageIDs, from: destination)
-        }
-        for messageID in sourceConversation.messageIDs {
-            unregisterMessageID(messageID, from: source)
-        }
-
-        let wasUnread = unreadConversations.contains(source)
-        let wasSelected = selectedConversationID == source
-
-        conversationsByID.removeValue(forKey: source)
-        conversationIDs.removeAll { $0 == source }
-        unreadConversations.remove(source)
-
-        if wasUnread, !unreadConversations.contains(destination) {
-            unreadConversations.insert(destination)
-            destinationConversation.setUnread(true)
-        }
-        if wasSelected {
-            selectedConversationID = destination
-            // Keep the private-peer selection axis consistent with the
-            // handed-off selection.
-            if let peerID = selectedPrivatePeerID,
-               source == .directPeer(peerID),
-               case .direct(let destinationHandle) = destination {
-                selectedPrivatePeerID = destinationHandle.routingPeerID
-            }
-        }
-
-        changes.send(.migrated(from: source, to: destination))
-    }
-
-    /// Removes a single message by ID from a conversation. Returns the
-    /// removed message, or `nil` (emitting nothing) when the conversation or
-    /// message is unknown.
-    @discardableResult
-    func removeMessage(withID messageID: String, from id: ConversationID) -> BitchatMessage? {
-        guard let conversation = conversationsByID[id],
-              let removed = conversation.remove(messageID: messageID) else {
-            return nil
-        }
-        unregisterMessageID(messageID, from: id)
-        changes.send(.messageRemoved(id, messageID: messageID))
-        return removed
-    }
-
-    /// Removes every message matching `predicate` from a conversation,
-    /// emitting one `.messageRemoved` per removed message after the
-    /// conversation is consistent. No-op for unknown conversations.
-    func removeMessages(from id: ConversationID, where predicate: (BitchatMessage) -> Bool) {
-        guard let conversation = conversationsByID[id] else { return }
-        let removedIDs = conversation.removeAll(where: predicate)
-        unregisterMessageIDs(removedIDs, from: id)
-        for messageID in removedIDs {
-            changes.send(.messageRemoved(id, messageID: messageID))
-        }
-    }
-
-    /// Empties a conversation's timeline but keeps the conversation (and
-    /// its unread/selection state) alive.
-    func clear(_ id: ConversationID) {
-        guard let conversation = conversationsByID[id] else { return }
-        for messageID in conversation.messageIDs {
-            unregisterMessageID(messageID, from: id)
-        }
-        conversation.clearMessages()
-        changes.send(.cleared(id))
-    }
-
-    /// Removes a conversation entirely, including unread state; clears the
-    /// selection if it pointed at the removed conversation.
-    func removeConversation(_ id: ConversationID) {
-        guard let conversation = conversationsByID.removeValue(forKey: id) else { return }
-        for messageID in conversation.messageIDs {
-            unregisterMessageID(messageID, from: id)
-        }
-        conversationIDs.removeAll { $0 == id }
-        unreadConversations.remove(id)
-        if selectedConversationID == id {
-            selectedConversationID = nil
-        }
-        changes.send(.removed(id))
-    }
-
-    func clearAll() {
-        let removedIDs = conversationIDs
-        guard !removedIDs.isEmpty || selectedConversationID != nil else { return }
-
-        conversationsByID.removeAll()
-        conversationIDs.removeAll()
-        unreadConversations.removeAll()
-        conversationIDsByMessageID.removeAll()
-        if selectedConversationID != nil {
-            selectedConversationID = nil
-        }
-
-        for id in removedIDs {
-            changes.send(.removed(id))
-        }
-    }
-
-    // MARK: Diagnostics
-
-    /// Total messages across all conversations. O(#conversations) — heartbeat
-    /// logging only, never a hot path.
-    var totalMessageCount: Int {
-        conversationsByID.values.reduce(0) { $0 + $1.messages.count }
-    }
-
-    /// Number of distinct message IDs in the store-level membership map.
-    var messageIDMapCount: Int {
-        conversationIDsByMessageID.count
-    }
-
-    /// Verifies the store's correctness invariants and returns human-readable
-    /// violations (empty = healthy). Intended for a periodic field audit:
-    /// O(total messages) and allocation-free while healthy. Checks:
-    /// - the `conversationIDs` ordering array matches `conversationsByID`
-    /// - per conversation: ID index exact, cap held, timestamp order
-    ///   (see `Conversation.collectInvariantViolations`)
-    /// - the message-ID → conversation map matches reality exactly: every
-    ///   mapped membership points at a live conversation actually holding
-    ///   the message, and total memberships equal total messages (with the
-    ///   forward check, equality proves no conversation message is missing
-    ///   from the map)
-    /// - `unreadConversations` only references existing conversations
-    /// - `selectedConversationID`, when set, references an existing
-    ///   conversation (`select(_:)` creates on selection and
-    ///   `removeConversation`/`clearAll` clear it, so existence is the
-    ///   invariant for both the channel-derived and direct-peer cases)
-    func auditInvariants() -> [String] {
-        var violations: [String] = []
-
-        if conversationIDs.count != conversationsByID.count {
-            violations.append("conversationIDs lists \(conversationIDs.count) conversations but dictionary holds \(conversationsByID.count)")
-        }
-        for id in conversationIDs where conversationsByID[id] == nil {
-            violations.append("conversationIDs lists \(id.auditDescription) but no conversation exists")
-        }
-
-        var totalMessages = 0
-        for (id, conversation) in conversationsByID {
-            totalMessages += conversation.messages.count
-            conversation.collectInvariantViolations(into: &violations, label: id.auditDescription)
-        }
-
-        var totalMappedMemberships = 0
-        for (messageID, ids) in conversationIDsByMessageID {
-            totalMappedMemberships += ids.count
-            if ids.isEmpty {
-                violations.append("message map: \(messageID.prefix(8))… has an empty membership set")
-            }
-            for id in ids {
-                guard let conversation = conversationsByID[id] else {
-                    violations.append("message map: \(messageID.prefix(8))… claims unknown conversation \(id.auditDescription)")
-                    continue
-                }
-                if !conversation.containsMessage(withID: messageID) {
-                    violations.append("message map: \(messageID.prefix(8))… not present in claimed conversation \(id.auditDescription)")
-                }
-            }
-        }
-        if totalMappedMemberships != totalMessages {
-            violations.append("message map holds \(totalMappedMemberships) memberships but conversations hold \(totalMessages) messages")
-        }
-
-        for id in unreadConversations where conversationsByID[id] == nil {
-            violations.append("unreadConversations contains unknown conversation \(id.auditDescription)")
-        }
-
-        if let selected = selectedConversationID, conversationsByID[selected] == nil {
-            violations.append("selectedConversationID \(selected.auditDescription) has no conversation")
-        }
-
-        return violations
-    }
-
-    // MARK: Internals
-
-    private func registerMessageID(_ messageID: String, in id: ConversationID) {
-        conversationIDsByMessageID[messageID, default: []].insert(id)
-        // Single choke point for every successful insertion (append, upsert
-        // append, migration insert) — the audit heartbeat's throughput delta.
-        appendCount += 1
-    }
-
-    private func unregisterMessageID(_ messageID: String, from id: ConversationID) {
-        guard var ids = conversationIDsByMessageID[messageID] else { return }
-        ids.remove(id)
-        if ids.isEmpty {
-            conversationIDsByMessageID.removeValue(forKey: messageID)
-        } else {
-            conversationIDsByMessageID[messageID] = ids
-        }
-    }
-
-    private func unregisterMessageIDs(_ messageIDs: [String], from id: ConversationID) {
-        for messageID in messageIDs {
-            unregisterMessageID(messageID, from: id)
-        }
-    }
-
-    private static func cap(for id: ConversationID) -> Int {
-        switch id {
-        case .mesh:
-            return TransportConfig.meshTimelineCap
-        case .geohash:
-            return TransportConfig.geoTimelineCap
-        case .direct:
-            return TransportConfig.privateChatCap
-        }
-    }
-}
-
-// MARK: - Direct-conversation keying + derived views
-
-extension ConversationID {
-    /// Direct-conversation ID keyed by the *raw* routing peer ID.
-    ///
-    /// Direct conversations are deliberately keyed per `PeerID`, not per
-    /// resolved identity: the private-chat coordinators mirror messages into
-    /// both the ephemeral and stable peer's conversations
-    /// (`mirrorToEphemeralIfNeeded`) and consolidate/migrate between them
-    /// explicitly, so a raw lookup by whichever peer ID is selected always
-    /// finds the right timeline without an identity-resolution layer.
-    static func directPeer(_ peerID: PeerID) -> ConversationID {
-        .direct(PeerHandle(id: "peer:\(peerID.id)", routingPeerID: peerID))
-    }
-}
-
-extension ConversationStore {
-    /// All direct conversations' messages keyed by routing peer ID — the
-    /// shape `ChatViewModel.privateChats` exposes to the coordinators.
-    /// Values are the conversations' backing arrays (COW), so building this
-    /// is O(#conversations), not O(#messages).
-    func directMessagesByRoutingPeerID() -> [PeerID: [BitchatMessage]] {
-        var messagesByPeerID: [PeerID: [BitchatMessage]] = [:]
-        messagesByPeerID.reserveCapacity(conversationsByID.count)
-        for (id, conversation) in conversationsByID {
-            guard case .direct(let handle) = id else { continue }
-            messagesByPeerID[handle.routingPeerID] = conversation.messages
-        }
-        return messagesByPeerID
-    }
-
-    /// Unread direct conversations as routing peer IDs — the shape
-    /// `ChatViewModel.unreadPrivateMessages` exposes to the coordinators.
-    func unreadDirectRoutingPeerIDs() -> Set<PeerID> {
-        var peerIDs = Set<PeerID>()
-        for id in unreadConversations {
-            guard case .direct(let handle) = id else { continue }
-            peerIDs.insert(handle.routingPeerID)
-        }
-        return peerIDs
-    }
-
-    /// `true` when any direct conversation contains a message with `messageID`
-    /// (O(1) via the store-level message-ID → conversation map).
-    func directConversationsContainMessage(withID messageID: String) -> Bool {
-        conversationIDs(forMessageID: messageID).contains { id in
-            if case .direct = id { return true }
-            return false
-        }
-    }
-
-    /// Message IDs across all direct conversations (read-receipt pruning
-    /// keeps only receipts whose messages still exist).
-    func directMessageIDs() -> Set<String> {
-        var messageIDs = Set<String>()
-        for (id, conversation) in conversationsByID {
-            guard case .direct = id else { continue }
-            messageIDs.formUnion(conversation.messageIDs)
-        }
-        return messageIDs
-    }
-
-}
-
-// MARK: - Diagnostics support
-
-extension ConversationID {
-    /// Short, log-safe description for audit/diagnostic lines. Direct
-    /// conversations truncate the handle so full peer keys never hit logs.
-    fileprivate var auditDescription: String {
-        switch self {
-        case .mesh:
-            return "mesh"
-        case .geohash(let geohash):
-            return "geo:\(geohash)"
-        case .direct(let handle):
-            return "direct:\(handle.id.prefix(13))…"
-        }
-    }
-}
-
-#if DEBUG
-// Test-only corruption hooks for `auditInvariants()` tests. The store is the
-// sole writer by design — `Conversation`'s mutators are fileprivate and the
-// store's backing collections are private — so the inconsistent states the
-// audit exists to catch CANNOT be manufactured through the intent API. These
-// DEBUG-only hooks deliberately bypass that lockdown to inject exactly those
-// impossible states. Never call them outside tests.
-extension Conversation {
-    /// Points an existing message's index entry at the wrong position
-    /// (positions 0 and 1 swap their index entries). Requires >= 2 messages.
-    func _testCorruptIndexEntries() {
-        guard messages.count >= 2 else { return }
-        indexByMessageID[messages[0].id] = 1
-        indexByMessageID[messages[1].id] = 0
-    }
-
-    /// Drops a message's index entry entirely (count mismatch + missing).
-    func _testRemoveIndexEntry(forMessageID messageID: String) {
-        indexByMessageID.removeValue(forKey: messageID)
-    }
-
-    /// Swaps the first and last messages while keeping the index consistent,
-    /// so ONLY the timestamp-order invariant is violated (requires the two
-    /// messages to have distinct timestamps).
-    func _testCorruptOrderingPreservingIndex() {
-        guard messages.count >= 2 else { return }
-        messages.swapAt(0, messages.count - 1)
-        indexByMessageID[messages[0].id] = 0
-        indexByMessageID[messages[messages.count - 1].id] = messages.count - 1
-    }
-}
-
-extension ConversationStore {
-    /// Adds a map membership that the conversation does not actually hold.
-    func _testRegisterPhantomMessageID(_ messageID: String, in id: ConversationID) {
-        conversationIDsByMessageID[messageID, default: []].insert(id)
-    }
-
-    /// Drops a real map membership (conversation message missing from map).
-    func _testUnregisterMessageID(_ messageID: String, from id: ConversationID) {
-        conversationIDsByMessageID[messageID]?.remove(id)
-        if conversationIDsByMessageID[messageID]?.isEmpty == true {
-            conversationIDsByMessageID.removeValue(forKey: messageID)
-        }
-    }
-
-    /// Appends past the conversation cap, bypassing trim (map kept exact so
-    /// only the cap invariant is violated).
-    func _testAppendBypassingCap(_ message: BitchatMessage, to id: ConversationID) {
-        let conversation = conversation(for: id)
-        conversation._testAppendBypassingTrim(message)
-        conversationIDsByMessageID[message.id, default: []].insert(id)
-    }
-
-    /// Marks a nonexistent conversation unread without creating it.
-    func _testInsertUnreadConversationID(_ id: ConversationID) {
-        unreadConversations.insert(id)
-    }
-
-    /// Sets the selection directly, without `select(_:)`'s create-on-select.
-    func _testSetSelectedConversationID(_ id: ConversationID?) {
-        selectedConversationID = id
-    }
-}
-
-extension Conversation {
-    fileprivate func _testAppendBypassingTrim(_ message: BitchatMessage) {
-        messages.append(message)
-        indexByMessageID[message.id] = messages.count - 1
-    }
-}
-#endif
-
-// MARK: - Public timeline derived views
-
-extension ConversationStore {
-    /// Removes a message by ID from whichever public (mesh/geohash)
-    /// conversation contains it. Returns the removed message, if any.
-    @discardableResult
-    func removePublicMessage(withID messageID: String) -> BitchatMessage? {
-        for id in conversationIDs(forMessageID: messageID) {
-            switch id {
-            case .mesh, .geohash:
-                return removeMessage(withID: messageID, from: id)
-            case .direct:
-                continue
-            }
-        }
-        return nil
-    }
-}
@@ -1,227 +0,0 @@
-import BitFoundation
-import Combine
-import SwiftUI
-#if os(iOS)
-import UIKit
-#endif
-
-@MainActor
-final class ConversationUIModel: ObservableObject {
-    @Published private(set) var showAutocomplete = false
-    @Published private(set) var autocompleteSuggestions: [String] = []
-    @Published private(set) var currentNickname: String
-    @Published private(set) var isBatchingPublic = false
-    @Published private(set) var canSendMediaInCurrentContext = true
-    /// Who is talking live in the public mesh channel right now (floor
-    /// courtesy: the composer mic tints "busy" while someone holds the floor).
-    @Published private(set) var activeLiveVoiceTalker: String?
-
-    private let chatViewModel: ChatViewModel
-    private let privateConversationModel: PrivateConversationModel
-    private let conversations: ConversationStore
-    private var activeChannel: ChannelID
-    private var cancellables = Set<AnyCancellable>()
-
-    init(
-        chatViewModel: ChatViewModel,
-        privateConversationModel: PrivateConversationModel,
-        conversations: ConversationStore
-    ) {
-        self.chatViewModel = chatViewModel
-        self.privateConversationModel = privateConversationModel
-        self.conversations = conversations
-        self.activeChannel = conversations.activeChannel
-        self.currentNickname = chatViewModel.nickname
-        self.isBatchingPublic = chatViewModel.isBatchingPublic
-        self.showAutocomplete = chatViewModel.showAutocomplete
-        self.autocompleteSuggestions = chatViewModel.autocompleteSuggestions
-        self.canSendMediaInCurrentContext = chatViewModel.canSendMediaInCurrentContext
-
-        bind()
-    }
-
-    func setCurrentColorScheme(_ colorScheme: ColorScheme) {
-        chatViewModel.currentColorScheme = colorScheme
-    }
-
-    func setCurrentTheme(_ theme: AppTheme) {
-        chatViewModel.currentTheme = theme
-    }
-
-    func sendMessage(_ message: String) {
-        chatViewModel.sendMessage(message)
-    }
-
-    /// Resends a failed private message through the normal send path,
-    /// removing the failed original so the re-submission replaces it
-    /// instead of stacking a duplicate under the red bubble.
-    func resendFailedPrivateMessage(_ message: BitchatMessage) {
-        chatViewModel.removePrivateMessage(withID: message.id)
-        chatViewModel.sendMessage(message.content)
-    }
-
-    func clearCurrentConversation() {
-        chatViewModel.sendMessage("/clear")
-    }
-
-    func sendHug(to sender: String) {
-        chatViewModel.sendMessage("/hug @\(sender)")
-    }
-
-    func sendSlap(to sender: String) {
-        chatViewModel.sendMessage("/slap @\(sender)")
-    }
-
-    func block(peerID: PeerID?, displayName: String?) {
-        guard let displayName else { return }
-
-        if let peerID, peerID.isGeoChat,
-           let full = chatViewModel.fullNostrHex(forSenderPeerID: peerID) {
-            chatViewModel.blockGeohashUser(pubkeyHexLowercased: full, displayName: displayName)
-        } else if let peerID, !peerID.isGeoDM, !peerID.isGeoChat {
-            // Mesh: block the peer's stable Noise identity resolved from the
-            // tapped peerID rather than re-resolving a display-name string.
-            chatViewModel.blockMeshPeer(peerID: peerID, displayName: displayName)
-        } else {
-            chatViewModel.sendMessage("/block \(displayName)")
-        }
-    }
-
-    /// Mesh counterpart of `block(peerID:displayName:)`. Resolves the unblock by
-    /// the tapped peer's stable identity so the exact row is unblocked — this
-    /// also works for offline peers, which the `/unblock <displayName>` command
-    /// cannot resolve.
-    func unblock(peerID: PeerID, displayName: String) {
-        chatViewModel.unblockMeshPeer(peerID: peerID, displayName: displayName)
-    }
-
-    func updateAutocomplete(for text: String, cursorPosition: Int) {
-        chatViewModel.updateAutocomplete(for: text, cursorPosition: cursorPosition)
-    }
-
-    func completeNickname(_ nickname: String, in text: inout String) -> Int {
-        chatViewModel.completeNickname(nickname, in: &text)
-    }
-
-    func formatMessage(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme? = nil) -> AttributedString {
-        chatViewModel.formatMessageAsText(message, colorScheme: colorScheme, theme: theme)
-    }
-
-    func formatMessageHeader(_ message: BitchatMessage, colorScheme: ColorScheme, theme: AppTheme? = nil) -> AttributedString {
-        chatViewModel.formatMessageHeader(message, colorScheme: colorScheme, theme: theme)
-    }
-
-    func mediaAttachment(for message: BitchatMessage) -> BitchatMessage.Media? {
-        message.mediaAttachment(for: currentNickname)
-    }
-
-    func isSelfSender(peerID: PeerID?, displayName: String?) -> Bool {
-        chatViewModel.isSelfSender(peerID: peerID, displayName: displayName)
-    }
-
-    func isSentByCurrentUser(_ message: BitchatMessage) -> Bool {
-        message.sender == currentNickname || message.sender.hasPrefix(currentNickname + "#")
-    }
-
-    func isMediaMessageFromCurrentUser(_ message: BitchatMessage) -> Bool {
-        message.sender == currentNickname || message.senderPeerID == chatViewModel.meshService.myPeerID
-    }
-
-    func senderDisplayName(for peerID: PeerID, fallbackMessages: [BitchatMessage]) -> String? {
-        if peerID.isGeoDM || peerID.isGeoChat {
-            return chatViewModel.geohashDisplayName(for: peerID)
-        }
-        if let nickname = chatViewModel.meshService.peerNickname(peerID: peerID) {
-            return nickname
-        }
-        return fallbackMessages.last(where: { $0.senderPeerID == peerID && $0.sender != "system" })?.sender
-    }
-
-    #if os(iOS)
-    func processSelectedImage(_ image: UIImage?) {
-        chatViewModel.processThenSendImage(image)
-    }
-    #endif
-
-    func processSelectedImage(from url: URL?) {
-        #if os(macOS)
-        chatViewModel.processThenSendImage(from: url)
-        #endif
-    }
-
-    func sendVoiceNote(at url: URL) {
-        chatViewModel.sendVoiceNote(at: url)
-    }
-
-    /// Capture backend for the mic gesture: live PTT when the current DM
-    /// peer can hear it now, classic voice note otherwise.
-    func makeVoiceCaptureSession() -> VoiceCaptureSession {
-        chatViewModel.makeVoiceCaptureSession()
-    }
-
-    /// Whether this message is a live voice burst still streaming in.
-    func isLiveVoiceMessage(_ message: BitchatMessage) -> Bool {
-        chatViewModel.liveVoiceCoordinator.isLiveVoiceMessage(message)
-    }
-
-    func cancelMediaSend(messageID: String) {
-        chatViewModel.cancelMediaSend(messageID: messageID)
-    }
-
-    func deleteMediaMessage(messageID: String) {
-        chatViewModel.deleteMediaMessage(messageID: messageID)
-    }
-
-    private func bind() {
-        chatViewModel.$nickname
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$currentNickname)
-
-        chatViewModel.$showAutocomplete
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$showAutocomplete)
-
-        chatViewModel.$autocompleteSuggestions
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$autocompleteSuggestions)
-
-        chatViewModel.$isBatchingPublic
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$isBatchingPublic)
-
-        chatViewModel.$activePublicVoiceTalker
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$activeLiveVoiceTalker)
-
-        conversations.$activeChannel
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] channel in
-                self?.activeChannel = channel
-                self?.refreshComputedState()
-            }
-            .store(in: &cancellables)
-
-        privateConversationModel.$selectedPeerID
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refreshComputedState()
-            }
-            .store(in: &cancellables)
-    }
-
-    private func refreshComputedState() {
-        if let selectedPeerID = privateConversationModel.selectedPeerID {
-            // Media transfer is not wired for groups in v1; keep it off so the
-            // composer can't strand a media placeholder that never sends.
-            canSendMediaInCurrentContext = !(selectedPeerID.isGeoDM || selectedPeerID.isGeoChat || selectedPeerID.isGroup)
-            return
-        }
-
-        switch activeChannel {
-        case .mesh:
-            canSendMediaInCurrentContext = true
-        case .location:
-            canSendMediaInCurrentContext = false
-        }
-    }
-}
@@ -1,184 +0,0 @@
-import Combine
-import Foundation
-
-@MainActor
-final class LocationChannelsModel: ObservableObject {
-    @Published private(set) var permissionState: LocationChannelManager.PermissionState
-    @Published private(set) var availableChannels: [GeohashChannel]
-    @Published private(set) var selectedChannel: ChannelID
-    @Published private(set) var teleported: Bool
-    @Published private(set) var bookmarks: [String]
-    @Published private(set) var bookmarkNames: [String: String]
-    @Published private(set) var locationNames: [GeohashChannelLevel: String]
-    @Published private(set) var userTorEnabled: Bool
-    @Published private(set) var gatewayEnabled: Bool
-
-    private let manager: LocationChannelManager
-    private let network: NetworkActivationService
-    private let gateway: GatewayService
-
-    init(
-        manager: LocationChannelManager? = nil,
-        network: NetworkActivationService? = nil,
-        gateway: GatewayService? = nil
-    ) {
-        let manager = manager ?? .shared
-        let network = network ?? .shared
-        let gateway = gateway ?? .shared
-
-        self.manager = manager
-        self.network = network
-        self.gateway = gateway
-        self.gatewayEnabled = gateway.isEnabled
-        self.permissionState = manager.permissionState
-        self.availableChannels = manager.availableChannels
-        self.selectedChannel = manager.selectedChannel
-        self.teleported = manager.teleported
-        self.bookmarks = manager.bookmarks
-        self.bookmarkNames = manager.bookmarkNames
-        self.locationNames = manager.locationNames
-        self.userTorEnabled = network.userTorEnabled
-
-        bind()
-    }
-
-    var currentBuildingGeohash: String? {
-        availableChannels.first(where: { $0.level == .building })?.geohash
-    }
-
-    func isSelected(_ channel: GeohashChannel) -> Bool {
-        guard case .location(let selected) = selectedChannel else { return false }
-        return selected == channel
-    }
-
-    func isBookmarked(_ geohash: String) -> Bool {
-        manager.isBookmarked(geohash)
-    }
-
-    func enableLocationChannels() {
-        manager.enableLocationChannels()
-    }
-
-    func refreshChannels() {
-        manager.refreshChannels()
-    }
-
-    func enableAndRefresh() {
-        manager.enableLocationChannels()
-        manager.refreshChannels()
-    }
-
-    func beginLiveRefresh() {
-        manager.beginLiveRefresh()
-    }
-
-    func endLiveRefresh() {
-        manager.endLiveRefresh()
-    }
-
-    func select(_ channel: ChannelID) {
-        manager.select(channel)
-    }
-
-    func markTeleported(for geohash: String, _ flag: Bool) {
-        manager.markTeleported(for: geohash, flag)
-    }
-
-    func toggleBookmark(_ geohash: String) {
-        manager.toggleBookmark(geohash)
-    }
-
-    func resolveBookmarkNameIfNeeded(for geohash: String) {
-        manager.resolveBookmarkNameIfNeeded(for: geohash)
-    }
-
-    func locationName(for level: GeohashChannelLevel) -> String? {
-        locationNames[level]
-    }
-
-    func setUserTorEnabled(_ enabled: Bool) {
-        network.setUserTorEnabled(enabled)
-    }
-
-    func refreshMeshChannelsIfNeeded() {
-        guard case .mesh = selectedChannel,
-              permissionState == .authorized,
-              availableChannels.isEmpty else {
-            return
-        }
-        refreshChannels()
-    }
-
-    func openLocationChannel(for geohash: String) {
-        let normalized = geohash.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
-        let allowed = Set("0123456789bcdefghjkmnpqrstuvwxyz")
-        guard (2...12).contains(normalized.count),
-              normalized.allSatisfy({ allowed.contains($0) }) else {
-            return
-        }
-
-        let channel = GeohashChannel(level: level(forLength: normalized.count), geohash: normalized)
-        let isRegional = availableChannels.contains { $0.geohash == normalized }
-        if !isRegional && !availableChannels.isEmpty {
-            markTeleported(for: normalized, true)
-        }
-        select(.location(channel))
-    }
-
-    func teleport(to geohash: String) {
-        let normalized = geohash.trimmingCharacters(in: .whitespacesAndNewlines).lowercased()
-        let channel = GeohashChannel(level: level(forLength: normalized.count), geohash: normalized)
-        markTeleported(for: normalized, true)
-        select(.location(channel))
-    }
-
-    private func bind() {
-        manager.$permissionState
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$permissionState)
-
-        manager.$availableChannels
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$availableChannels)
-
-        manager.$selectedChannel
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$selectedChannel)
-
-        manager.$teleported
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$teleported)
-
-        manager.$bookmarks
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$bookmarks)
-
-        manager.$bookmarkNames
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$bookmarkNames)
-
-        manager.$locationNames
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$locationNames)
-
-        network.$userTorEnabled
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$userTorEnabled)
-
-        gateway.$isEnabled
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$gatewayEnabled)
-    }
-
-    private func level(forLength length: Int) -> GeohashChannelLevel {
-        switch length {
-        case 0...2: return .region
-        case 3...4: return .province
-        case 5: return .city
-        case 6: return .neighborhood
-        case 7: return .block
-        case 8...12: return .building
-        default: return .block
-        }
-    }
-}
@@ -1,51 +0,0 @@
-import Combine
-import Foundation
-
-@MainActor
-final class LocationPresenceStore: ObservableObject {
-    @Published private(set) var currentGeohash: String?
-    @Published private(set) var geoNicknames: [String: String] = [:]
-    @Published private(set) var teleportedGeo: Set<String> = []
-
-    func setCurrentGeohash(_ geohash: String?) {
-        currentGeohash = geohash?.lowercased()
-    }
-
-    func setNickname(_ nickname: String, for pubkeyHex: String) {
-        geoNicknames[pubkeyHex.lowercased()] = nickname
-    }
-
-    func replaceGeoNicknames(_ nicknames: [String: String]) {
-        geoNicknames = Dictionary(
-            uniqueKeysWithValues: nicknames.map { key, value in
-                (key.lowercased(), value)
-            }
-        )
-    }
-
-    func clearGeoNicknames() {
-        geoNicknames.removeAll()
-    }
-
-    func markTeleported(_ pubkeyHex: String) {
-        teleportedGeo.insert(pubkeyHex.lowercased())
-    }
-
-    func clearTeleported(_ pubkeyHex: String) {
-        teleportedGeo.remove(pubkeyHex.lowercased())
-    }
-
-    func replaceTeleportedGeo(_ pubkeys: Set<String>) {
-        teleportedGeo = Set(pubkeys.map { $0.lowercased() })
-    }
-
-    func clearTeleportedGeo() {
-        teleportedGeo.removeAll()
-    }
-
-    func reset() {
-        currentGeohash = nil
-        geoNicknames.removeAll()
-        teleportedGeo.removeAll()
-    }
-}
@@ -1,89 +0,0 @@
-//
-// NearbyNotesCounter.swift
-// bitchat
-//
-// Counts unexpired location notes left at the user's current building-level
-// geohash so the empty mesh timeline can say "📍 3 notes left here". Only
-// subscribes while a view holds it active, and only when location notes are
-// enabled and location permission is already granted (it never prompts).
-// This is free and unencumbered software released into the public domain.
-//
-
-import Combine
-import Foundation
-
-@MainActor
-final class NearbyNotesCounter: ObservableObject {
-    static let shared = NearbyNotesCounter()
-
-    @Published private(set) var noteCount = 0
-
-    private var manager: LocationNotesManager?
-    private var managerCancellable: AnyCancellable?
-    private var channelsCancellable: AnyCancellable?
-    private var settingCancellable: AnyCancellable?
-    private var activeHolders = 0
-    private let locationManager: LocationChannelManager
-
-    init(locationManager: LocationChannelManager = .shared) {
-        self.locationManager = locationManager
-    }
-
-    /// Begins (or keeps) the notes subscription for the current building
-    /// geohash. Balanced by `deactivate()`; ref-counted so multiple views can
-    /// hold it.
-    func activate() {
-        activeHolders += 1
-        guard activeHolders == 1 else { return }
-        channelsCancellable = locationManager.$availableChannels
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in self?.retarget() }
-        // The app-info kill switch must take effect immediately, not on the
-        // next location change or remount.
-        settingCancellable = NotificationCenter.default
-            .publisher(for: LocationNotesSettings.didChangeNotification)
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in self?.retarget() }
-        retarget()
-    }
-
-    func deactivate() {
-        activeHolders = max(0, activeHolders - 1)
-        guard activeHolders == 0 else { return }
-        channelsCancellable = nil
-        settingCancellable = nil
-        managerCancellable = nil
-        manager?.cancel()
-        manager = nil
-        noteCount = 0
-    }
-
-    private func retarget() {
-        guard activeHolders > 0,
-              LocationNotesSettings.enabled,
-              locationManager.permissionState == .authorized,
-              let geohash = locationManager.availableChannels
-                  .first(where: { $0.level == .building })?.geohash
-        else {
-            managerCancellable = nil
-            manager?.cancel()
-            manager = nil
-            noteCount = 0
-            return
-        }
-
-        if let manager {
-            manager.setGeohash(geohash)
-            return
-        }
-
-        let fresh = LocationNotesManager(geohash: geohash)
-        manager = fresh
-        managerCancellable = fresh.$notes
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] notes in
-                let now = Date()
-                self?.noteCount = notes.filter { $0.expiresAt.map { $0 > now } ?? true }.count
-            }
-    }
-}
@@ -1,117 +0,0 @@
-import BitFoundation
-import Combine
-import Foundation
-
-@MainActor
-final class PeerIdentityStore: ObservableObject {
-    @Published private(set) var encryptionStatuses: [PeerID: EncryptionStatus] = [:]
-    @Published private(set) var verifiedFingerprints: Set<String> = []
-
-    private(set) var peerFingerprintsByPeerID: [PeerID: String] = [:]
-    private(set) var selectedPrivateChatFingerprint: String?
-
-    private var stablePeerIDsByShortID: [PeerID: PeerID] = [:]
-    private var encryptionStatusCache: [PeerID: EncryptionStatus] = [:]
-
-    func stablePeerID(forShortID peerID: PeerID) -> PeerID? {
-        stablePeerIDsByShortID[peerID]
-    }
-
-    func shortPeerID(forStablePeerID stablePeerID: PeerID) -> PeerID? {
-        stablePeerIDsByShortID.first(where: { $0.value == stablePeerID })?.key
-    }
-
-    func setStablePeerID(_ stablePeerID: PeerID, forShortID peerID: PeerID) {
-        stablePeerIDsByShortID[peerID] = stablePeerID
-    }
-
-    func fingerprint(for peerID: PeerID) -> String? {
-        peerFingerprintsByPeerID[peerID]
-    }
-
-    func setFingerprint(_ fingerprint: String?, for peerID: PeerID) {
-        if let fingerprint {
-            peerFingerprintsByPeerID[peerID] = fingerprint
-        } else {
-            peerFingerprintsByPeerID.removeValue(forKey: peerID)
-        }
-    }
-
-    func replaceFingerprintMappings(_ mappings: [PeerID: String]) {
-        peerFingerprintsByPeerID = mappings
-    }
-
-    @discardableResult
-    func migrateFingerprintMapping(
-        from oldPeerID: PeerID,
-        to newPeerID: PeerID,
-        fallback: String? = nil
-    ) -> String? {
-        let fingerprint = peerFingerprintsByPeerID.removeValue(forKey: oldPeerID) ?? fallback
-        if let fingerprint {
-            peerFingerprintsByPeerID[newPeerID] = fingerprint
-            if selectedPrivateChatFingerprint == nil {
-                selectedPrivateChatFingerprint = fingerprint
-            }
-        }
-        return fingerprint
-    }
-
-    func setSelectedPrivateChatFingerprint(_ fingerprint: String?) {
-        selectedPrivateChatFingerprint = fingerprint
-    }
-
-    func cachedEncryptionStatus(for peerID: PeerID) -> EncryptionStatus? {
-        encryptionStatusCache[peerID]
-    }
-
-    func setCachedEncryptionStatus(_ status: EncryptionStatus, for peerID: PeerID) {
-        encryptionStatusCache[peerID] = status
-    }
-
-    func invalidateEncryptionCache(for peerID: PeerID? = nil) {
-        if let peerID {
-            encryptionStatusCache.removeValue(forKey: peerID)
-        } else {
-            encryptionStatusCache.removeAll()
-        }
-    }
-
-    func encryptionStatus(for peerID: PeerID) -> EncryptionStatus? {
-        encryptionStatuses[peerID]
-    }
-
-    func setEncryptionStatus(_ status: EncryptionStatus?, for peerID: PeerID) {
-        if let status {
-            encryptionStatuses[peerID] = status
-        } else {
-            encryptionStatuses.removeValue(forKey: peerID)
-        }
-        invalidateEncryptionCache(for: peerID)
-    }
-
-    func setVerifiedFingerprints(_ fingerprints: Set<String>) {
-        verifiedFingerprints = fingerprints
-    }
-
-    func setVerified(_ fingerprint: String, verified: Bool) {
-        if verified {
-            verifiedFingerprints.insert(fingerprint)
-        } else {
-            verifiedFingerprints.remove(fingerprint)
-        }
-    }
-
-    func isVerified(_ fingerprint: String) -> Bool {
-        verifiedFingerprints.contains(fingerprint)
-    }
-
-    func clearAll() {
-        encryptionStatuses.removeAll()
-        verifiedFingerprints.removeAll()
-        peerFingerprintsByPeerID.removeAll()
-        selectedPrivateChatFingerprint = nil
-        stablePeerIDsByShortID.removeAll()
-        encryptionStatusCache.removeAll()
-    }
-}
@@ -1,299 +0,0 @@
-import BitFoundation
-import Combine
-import SwiftUI
-
-struct MeshPeerRow: Identifiable, Equatable {
-    let peerID: PeerID
-    let displayName: String
-    let isMe: Bool
-    let hasUnread: Bool
-    let isBlocked: Bool
-    let isFavorite: Bool
-    let isConnected: Bool
-    let isReachable: Bool
-    let isMutualFavorite: Bool
-    let encryptionStatus: EncryptionStatus
-    let showsVerifiedBadgeWhenOffline: Bool
-    /// Vouched-for by someone I verified, without an explicit verification of
-    /// mine — rendered as the unfilled seal (verified gets the filled one).
-    let showsVouchedBadge: Bool
-
-    var id: String { peerID.id }
-}
-
-struct GeohashPersonRow: Identifiable, Equatable {
-    let id: String
-    let displayName: String
-    let isMe: Bool
-    let isTeleported: Bool
-    let isBlocked: Bool
-}
-
-struct GroupChatRow: Identifiable, Equatable {
-    let peerID: PeerID
-    let name: String
-    let memberCount: Int
-    let isCreator: Bool
-    let hasUnread: Bool
-
-    var id: String { peerID.id }
-}
-
-@MainActor
-final class PeerListModel: ObservableObject {
-    @Published private(set) var allPeers: [BitchatPeer] = []
-    @Published private(set) var meshRows: [MeshPeerRow] = []
-    @Published private(set) var geohashPeople: [GeohashPersonRow] = []
-    @Published private(set) var groupRows: [GroupChatRow] = []
-    @Published private(set) var reachableMeshPeerCount = 0
-    @Published private(set) var connectedMeshPeerCount = 0
-    @Published private(set) var visibleGeohashPeerCount = 0
-    @Published private(set) var renderID = ""
-
-    private let chatViewModel: ChatViewModel
-    private let conversations: ConversationStore
-    private let locationChannelsModel: LocationChannelsModel
-    private let peerIdentityStore: PeerIdentityStore
-    private let locationPresenceStore: LocationPresenceStore
-    private var cancellables = Set<AnyCancellable>()
-
-    init(
-        chatViewModel: ChatViewModel,
-        conversations: ConversationStore,
-        locationChannelsModel: LocationChannelsModel? = nil,
-        peerIdentityStore: PeerIdentityStore? = nil,
-        locationPresenceStore: LocationPresenceStore? = nil
-    ) {
-        self.chatViewModel = chatViewModel
-        self.conversations = conversations
-        self.locationChannelsModel = locationChannelsModel ?? LocationChannelsModel()
-        self.peerIdentityStore = peerIdentityStore ?? chatViewModel.peerIdentityStore
-        self.locationPresenceStore = locationPresenceStore ?? chatViewModel.locationPresenceStore
-        self.allPeers = chatViewModel.allPeers
-
-        bind()
-        refresh()
-    }
-
-    func colorForMeshPeer(id peerID: PeerID, isDark: Bool) -> Color {
-        chatViewModel.colorForMeshPeer(id: peerID, isDark: isDark)
-    }
-
-    func colorForGeohashPerson(id: String, isDark: Bool) -> Color {
-        chatViewModel.colorForNostrPubkey(id, isDark: isDark)
-    }
-
-    func participantCount(for geohash: String) -> Int {
-        chatViewModel.geohashParticipantCount(for: geohash)
-    }
-
-    func startConversation(with peerID: PeerID) {
-        chatViewModel.startPrivateChat(with: peerID)
-    }
-
-    func toggleFavorite(peerID: PeerID) {
-        chatViewModel.toggleFavorite(peerID: peerID)
-    }
-
-    func openGeohashDirectMessage(with pubkeyHex: String) {
-        chatViewModel.startGeohashDM(withPubkeyHex: pubkeyHex)
-    }
-
-    func blockGeohashUser(pubkeyHexLowercased: String, displayName: String) {
-        chatViewModel.blockGeohashUser(
-            pubkeyHexLowercased: pubkeyHexLowercased,
-            displayName: displayName
-        )
-    }
-
-    func unblockGeohashUser(pubkeyHexLowercased: String, displayName: String) {
-        chatViewModel.unblockGeohashUser(
-            pubkeyHexLowercased: pubkeyHexLowercased,
-            displayName: displayName
-        )
-    }
-
-    private func bind() {
-        chatViewModel.$allPeers
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] peers in
-                self?.allPeers = peers
-                self?.refresh()
-            }
-            .store(in: &cancellables)
-
-        chatViewModel.$nickname
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refresh()
-            }
-            .store(in: &cancellables)
-
-        locationPresenceStore.$teleportedGeo
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refresh()
-            }
-            .store(in: &cancellables)
-
-        conversations.$unreadConversations
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refresh()
-            }
-            .store(in: &cancellables)
-
-        chatViewModel.groupStore.$groups
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refresh()
-            }
-            .store(in: &cancellables)
-
-        peerIdentityStore.$encryptionStatuses
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refresh()
-            }
-            .store(in: &cancellables)
-
-        peerIdentityStore.$verifiedFingerprints
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refresh()
-            }
-            .store(in: &cancellables)
-
-        NotificationCenter.default.publisher(for: Notification.Name("peerStatusUpdated"))
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refresh()
-            }
-            .store(in: &cancellables)
-
-        chatViewModel.participantTracker.$visiblePeople
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refresh()
-            }
-            .store(in: &cancellables)
-
-        locationChannelsModel.$selectedChannel
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refresh()
-            }
-            .store(in: &cancellables)
-
-        locationChannelsModel.$teleported
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refresh()
-            }
-            .store(in: &cancellables)
-
-        locationChannelsModel.$availableChannels
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refresh()
-            }
-            .store(in: &cancellables)
-    }
-
-    private func refresh() {
-        let myPeerID = chatViewModel.meshService.myPeerID
-        let meshRows = allPeers.map { peer in
-            let isMe = peer.peerID == myPeerID
-            let fingerprint = isMe ? nil : chatViewModel.getFingerprint(for: peer.peerID)
-            let isVerifiedFingerprint = fingerprint.map { peerIdentityStore.isVerified($0) } ?? false
-            let verifiedBadge = !peer.isConnected && isVerifiedFingerprint
-            // Vouched is subordinate to verified: never show both seals.
-            let vouchedBadge = !isVerifiedFingerprint
-                && (fingerprint.map { chatViewModel.isVouchedFingerprint($0) } ?? false)
-
-            return MeshPeerRow(
-                peerID: peer.peerID,
-                displayName: isMe ? chatViewModel.nickname : peer.nickname,
-                isMe: isMe,
-                hasUnread: chatViewModel.hasUnreadMessages(for: peer.peerID),
-                isBlocked: !isMe && chatViewModel.isPeerBlocked(peer.peerID),
-                isFavorite: peer.favoriteStatus?.isFavorite ?? false,
-                isConnected: peer.isConnected,
-                isReachable: peer.isReachable,
-                isMutualFavorite: peer.isMutualFavorite,
-                encryptionStatus: chatViewModel.getEncryptionStatus(for: peer.peerID),
-                showsVerifiedBadgeWhenOffline: verifiedBadge,
-                showsVouchedBadge: vouchedBadge
-            )
-        }
-
-        let meshCounts = meshRows.reduce(into: (reachable: 0, connected: 0)) { counts, row in
-            guard !row.isMe else { return }
-            if row.isConnected {
-                counts.connected += 1
-                counts.reachable += 1
-            } else if row.isReachable {
-                counts.reachable += 1
-            }
-        }
-
-        let geohashPeople = buildGeohashPeople()
-        let groupRows = buildGroupRows()
-
-        self.meshRows = meshRows
-        reachableMeshPeerCount = meshCounts.reachable
-        connectedMeshPeerCount = meshCounts.connected
-        self.geohashPeople = geohashPeople
-        visibleGeohashPeerCount = geohashPeople.count
-        self.groupRows = groupRows
-        renderID = (
-            meshRows.map {
-                "\($0.id)-\($0.isConnected)-\($0.isReachable)-\($0.hasUnread)-\($0.isFavorite)-\($0.isBlocked)"
-            } +
-            geohashPeople.map {
-                "geo:\($0.id)-\($0.isTeleported)-\($0.isBlocked)-\($0.displayName)"
-            } +
-            groupRows.map {
-                "group:\($0.id)-\($0.name)-\($0.memberCount)-\($0.hasUnread)"
-            }
-        ).joined(separator: "|")
-    }
-
-    private func buildGroupRows() -> [GroupChatRow] {
-        let myFingerprint = chatViewModel.meshService.noiseIdentityFingerprint()
-        return chatViewModel.groupStore.groups.map { group in
-            GroupChatRow(
-                peerID: group.peerID,
-                name: group.name,
-                memberCount: group.members.count,
-                isCreator: group.creatorFingerprint == myFingerprint,
-                hasUnread: chatViewModel.hasUnreadMessages(for: group.peerID)
-            )
-        }
-    }
-
-    private func buildGeohashPeople() -> [GeohashPersonRow] {
-        let myHex = currentGeohashIdentityHex()
-        let teleportedSet = Set(locationPresenceStore.teleportedGeo.map { $0.lowercased() })
-
-        return chatViewModel.visibleGeohashPeople().map { person in
-            let isMe = person.id == myHex
-            return GeohashPersonRow(
-                id: person.id,
-                displayName: person.displayName,
-                isMe: isMe,
-                isTeleported: teleportedSet.contains(person.id.lowercased()) || (isMe && locationChannelsModel.teleported),
-                isBlocked: !isMe && chatViewModel.isGeohashUserBlocked(pubkeyHexLowercased: person.id)
-            )
-        }
-    }
-
-    private func currentGeohashIdentityHex() -> String? {
-        guard case .location(let channel) = locationChannelsModel.selectedChannel,
-              let identity = try? chatViewModel.idBridge.deriveIdentity(forGeohash: channel.geohash) else {
-            return nil
-        }
-
-        return identity.publicKeyHex.lowercased()
-    }
-}
@@ -1,362 +0,0 @@
-import BitFoundation
-import Combine
-import Foundation
-
-/// Feature model for private (direct) conversations.
-///
-/// Reads the single-writer `ConversationStore` directly: `messages(for:)`
-/// returns the peer's conversation backing array (no mirror dictionary), and
-/// the store's typed `changes` subject drives invalidation — a change in the
-/// SELECTED peer's conversation republishes this model, while appends to
-/// other private chats only surface through the unread set. Direct
-/// conversations are keyed by raw routing peer ID; the coordinators'
-/// ephemeral/stable mirroring guarantees the selected peer's key always
-/// holds the full timeline (see `ConversationID.directPeer`).
-@MainActor
-final class PrivateInboxModel: ObservableObject {
-    @Published private(set) var selectedPeerID: PeerID?
-    @Published private(set) var unreadPeerIDs: Set<PeerID> = []
-
-    private let conversations: ConversationStore
-    private var cancellables = Set<AnyCancellable>()
-
-    init(conversations: ConversationStore) {
-        self.conversations = conversations
-        self.selectedPeerID = conversations.selectedPrivatePeerID
-        self.unreadPeerIDs = conversations.unreadDirectRoutingPeerIDs()
-
-        bind()
-    }
-
-    func messages(for peerID: PeerID?) -> [BitchatMessage] {
-        guard let peerID else { return [] }
-        return conversations.conversationsByID[.directPeer(peerID)]?.messages ?? []
-    }
-
-    private func bind() {
-        conversations.$selectedPrivatePeerID
-            .dropFirst()
-            .sink { [weak self] peerID in
-                guard let self, self.selectedPeerID != peerID else { return }
-                self.selectedPeerID = peerID
-            }
-            .store(in: &cancellables)
-
-        conversations.changes
-            .sink { [weak self] change in
-                self?.apply(change)
-            }
-            .store(in: &cancellables)
-    }
-
-    private func apply(_ change: ConversationChange) {
-        switch change {
-        case .appended(let id, _),
-             .updated(let id, _),
-             .statusChanged(let id, _, _),
-             .messageRemoved(let id, _),
-             .cleared(let id):
-            republishIfSelected(id)
-
-        case .unreadChanged(let id, _):
-            guard isDirect(id) else { return }
-            refreshUnreadPeerIDs()
-
-        case .removed(let id):
-            guard isDirect(id) else { return }
-            refreshUnreadPeerIDs()
-            republishIfSelected(id)
-
-        case .migrated(let source, let destination):
-            guard isDirect(source) || isDirect(destination) else { return }
-            refreshUnreadPeerIDs()
-            republishIfSelected(source)
-            republishIfSelected(destination)
-        }
-    }
-
-    private func republishIfSelected(_ id: ConversationID) {
-        guard let selectedPeerID, id == .directPeer(selectedPeerID) else { return }
-        objectWillChange.send()
-    }
-
-    private func refreshUnreadPeerIDs() {
-        let next = conversations.unreadDirectRoutingPeerIDs()
-        guard unreadPeerIDs != next else { return }
-        unreadPeerIDs = next
-    }
-
-    private func isDirect(_ id: ConversationID) -> Bool {
-        if case .direct = id { return true }
-        return false
-    }
-}
-
-enum PrivateConversationAvailability: Equatable {
-    case bluetoothConnected
-    case meshReachable
-    case nostrAvailable
-    case offline
-}
-
-struct PrivateConversationHeaderState: Equatable {
-    let conversationPeerID: PeerID
-    let headerPeerID: PeerID
-    let displayName: String
-    let availability: PrivateConversationAvailability
-    let isFavorite: Bool
-    let encryptionStatus: EncryptionStatus?
-
-    var supportsFavoriteToggle: Bool {
-        !conversationPeerID.isGeoDM && !conversationPeerID.isGroup
-    }
-
-    /// Group chats have no single peer identity behind the header: no
-    /// fingerprint screen, no per-peer encryption badge.
-    var isGroupConversation: Bool {
-        conversationPeerID.isGroup
-    }
-}
-
-@MainActor
-final class PrivateConversationModel: ObservableObject {
-    @Published private(set) var selectedPeerID: PeerID?
-    @Published private(set) var selectedHeaderState: PrivateConversationHeaderState?
-
-    private let chatViewModel: ChatViewModel
-    private let conversations: ConversationStore
-    private let locationChannelsModel: LocationChannelsModel
-    private let peerIdentityStore: PeerIdentityStore
-    private var cancellables = Set<AnyCancellable>()
-
-    init(
-        chatViewModel: ChatViewModel,
-        conversations: ConversationStore,
-        locationChannelsModel: LocationChannelsModel? = nil,
-        peerIdentityStore: PeerIdentityStore? = nil
-    ) {
-        self.chatViewModel = chatViewModel
-        self.conversations = conversations
-        self.locationChannelsModel = locationChannelsModel ?? LocationChannelsModel()
-        self.peerIdentityStore = peerIdentityStore ?? chatViewModel.peerIdentityStore
-        let initialPeerID = conversations.selectedPrivatePeerID
-        self.selectedPeerID = initialPeerID
-        self.selectedHeaderState = initialPeerID.flatMap { peerID in
-            makeHeaderState(for: peerID)
-        }
-
-        bind()
-    }
-
-    func startConversation(with peerID: PeerID) {
-        chatViewModel.startPrivateChat(with: peerID)
-        refreshSelectedConversation()
-    }
-
-    func openConversation(for peerID: PeerID) {
-        if peerID.isGeoChat {
-            guard let full = chatViewModel.fullNostrHex(forSenderPeerID: peerID) else { return }
-            chatViewModel.startGeohashDM(withPubkeyHex: full)
-        } else {
-            chatViewModel.startPrivateChat(with: peerID)
-        }
-
-        refreshSelectedConversation()
-    }
-
-    func endConversation() {
-        chatViewModel.endPrivateChat()
-        refreshSelectedConversation()
-    }
-
-    func toggleFavorite(peerID: PeerID) {
-        chatViewModel.toggleFavorite(peerID: peerID)
-        refreshSelectedConversation()
-    }
-
-    func toggleFavoriteForSelectedConversation() {
-        guard let headerPeerID = selectedHeaderState?.headerPeerID else { return }
-        toggleFavorite(peerID: headerPeerID)
-    }
-
-    func markMessagesAsRead(from peerID: PeerID) {
-        chatViewModel.markPrivateMessagesAsRead(from: peerID)
-    }
-
-    private func bind() {
-        conversations.$selectedPrivatePeerID
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refreshSelectedConversation()
-            }
-            .store(in: &cancellables)
-
-        chatViewModel.$allPeers
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refreshSelectedConversation()
-            }
-            .store(in: &cancellables)
-
-        peerIdentityStore.$encryptionStatuses
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refreshSelectedConversation()
-            }
-            .store(in: &cancellables)
-
-        NotificationCenter.default.publisher(for: .favoriteStatusChanged)
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refreshSelectedConversation()
-            }
-            .store(in: &cancellables)
-
-        chatViewModel.groupStore.$groups
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refreshSelectedConversation()
-            }
-            .store(in: &cancellables)
-
-        NotificationCenter.default.publisher(for: Notification.Name("peerStatusUpdated"))
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refreshSelectedConversation()
-            }
-            .store(in: &cancellables)
-
-        locationChannelsModel.$selectedChannel
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.refreshSelectedConversation()
-            }
-            .store(in: &cancellables)
-    }
-
-    private func refreshSelectedConversation() {
-        selectedPeerID = conversations.selectedPrivatePeerID
-        selectedHeaderState = selectedPeerID.flatMap { peerID in
-            makeHeaderState(for: peerID)
-        }
-    }
-
-    private func makeHeaderState(for conversationPeerID: PeerID) -> PrivateConversationHeaderState {
-        // Group chats: the "peer" is the whole crew. Name + member count in
-        // the header; availability reads as mesh since group traffic floods
-        // the local mesh, and the per-peer encryption badge does not apply.
-        if conversationPeerID.isGroup {
-            let displayName: String
-            if let group = chatViewModel.groupStore.group(for: conversationPeerID) {
-                displayName = "#\(group.name) (\(group.members.count))"
-            } else {
-                displayName = String(localized: "common.unknown", comment: "Fallback label for unknown peer")
-            }
-            return PrivateConversationHeaderState(
-                conversationPeerID: conversationPeerID,
-                headerPeerID: conversationPeerID,
-                displayName: displayName,
-                availability: .meshReachable,
-                isFavorite: false,
-                encryptionStatus: nil
-            )
-        }
-
-        let headerPeerID = chatViewModel.getShortIDForNoiseKey(conversationPeerID)
-        let peer = chatViewModel.getPeer(byID: headerPeerID)
-        let displayName = resolveDisplayName(for: conversationPeerID, headerPeerID: headerPeerID, peer: peer)
-        // Geo DMs are always routed over Nostr (NIP-17); their nostr_ keys
-        // never resolve to a reachable mesh peer, so resolveAvailability would
-        // report .offline. Report .nostrAvailable so the header shows the
-        // globe instead of a misleading "offline" tag.
-        let availability = conversationPeerID.isGeoDM
-            ? .nostrAvailable
-            : resolveAvailability(for: headerPeerID, peer: peer)
-        let encryptionStatus: EncryptionStatus? = conversationPeerID.isGeoDM
-            ? nil
-            : chatViewModel.getEncryptionStatus(for: headerPeerID)
-
-        return PrivateConversationHeaderState(
-            conversationPeerID: conversationPeerID,
-            headerPeerID: headerPeerID,
-            displayName: displayName,
-            availability: availability,
-            isFavorite: chatViewModel.isFavorite(peerID: headerPeerID),
-            encryptionStatus: encryptionStatus
-        )
-    }
-
-    private func resolveDisplayName(
-        for conversationPeerID: PeerID,
-        headerPeerID: PeerID,
-        peer: BitchatPeer?
-    ) -> String {
-        if conversationPeerID.isGeoDM, case .location(let channel) = locationChannelsModel.selectedChannel {
-            return "#\(channel.geohash)/@\(chatViewModel.geohashDisplayName(for: conversationPeerID))"
-        }
-        if let displayName = peer?.displayName {
-            return displayName
-        }
-        if let nickname = chatViewModel.meshService.peerNickname(peerID: headerPeerID) {
-            return nickname
-        }
-        if let favorite = FavoritesPersistenceService.shared.getFavoriteStatus(
-            for: Data(hexString: headerPeerID.id) ?? Data()
-        ), !favorite.peerNickname.isEmpty {
-            return favorite.peerNickname
-        }
-        if headerPeerID.id.count == 16 {
-            let candidates = chatViewModel.identityManager.getCryptoIdentitiesByPeerIDPrefix(headerPeerID)
-            if let identity = candidates.first,
-               let social = chatViewModel.identityManager.getSocialIdentity(for: identity.fingerprint) {
-                if let pet = social.localPetname, !pet.isEmpty {
-                    return pet
-                }
-                if !social.claimedNickname.isEmpty {
-                    return social.claimedNickname
-                }
-            }
-        } else if let noiseKey = headerPeerID.noiseKey {
-            let fingerprint = noiseKey.sha256Fingerprint()
-            if let social = chatViewModel.identityManager.getSocialIdentity(for: fingerprint) {
-                if let pet = social.localPetname, !pet.isEmpty {
-                    return pet
-                }
-                if !social.claimedNickname.isEmpty {
-                    return social.claimedNickname
-                }
-            }
-        }
-
-        return String(localized: "common.unknown", comment: "Fallback label for unknown peer")
-    }
-
-    private func resolveAvailability(for headerPeerID: PeerID, peer: BitchatPeer?) -> PrivateConversationAvailability {
-        if let connectionState = peer?.connectionState {
-            switch connectionState {
-            case .bluetoothConnected:
-                return .bluetoothConnected
-            case .meshReachable:
-                return .meshReachable
-            case .nostrAvailable:
-                return .nostrAvailable
-            case .offline:
-                return .offline
-            }
-        }
-
-        if chatViewModel.meshService.isPeerReachable(headerPeerID) {
-            return .meshReachable
-        }
-        if let noiseKey = Data(hexString: headerPeerID.id),
-           let favoriteStatus = FavoritesPersistenceService.shared.getFavoriteStatus(for: noiseKey),
-           favoriteStatus.isMutual {
-            return .nostrAvailable
-        }
-        if chatViewModel.meshService.isPeerConnected(headerPeerID) || chatViewModel.connectedPeers.contains(headerPeerID) {
-            return .bluetoothConnected
-        }
-
-        return .offline
-    }
-}
@@ -1,77 +0,0 @@
-import BitFoundation
-import Combine
-import SwiftUI
-
-/// Feature model for the active public (mesh/geohash) timeline.
-///
-/// Observes ONE `Conversation` object in the single-writer
-/// `ConversationStore` — the active channel's — so appends to background
-/// conversations (other geohashes, private chats) never invalidate it.
-/// `messages` reads the observed conversation's backing array directly;
-/// there is no mirror copy.
-@MainActor
-final class PublicChatModel: ObservableObject {
-    @Published private(set) var activeChannel: ChannelID
-
-    /// The active public conversation's timeline.
-    var messages: [BitchatMessage] { activeConversation.messages }
-
-    private let conversations: ConversationStore
-    private var activeConversation: Conversation
-    private var activeConversationCancellable: AnyCancellable?
-    private var cancellables = Set<AnyCancellable>()
-
-    init(conversations: ConversationStore) {
-        let channel = conversations.activeChannel
-        self.conversations = conversations
-        self.activeChannel = channel
-        self.activeConversation = conversations.conversation(for: ConversationID(channelID: channel))
-
-        observeActiveConversation()
-        bind()
-    }
-
-    private func bind() {
-        conversations.$activeChannel
-            .dropFirst()
-            .sink { [weak self] channel in
-                guard let self else { return }
-                self.activeChannel = channel
-                self.retargetActiveConversation(to: channel)
-            }
-            .store(in: &cancellables)
-
-        // The store replaces a conversation's object when it is removed
-        // (panic clear); retarget to the fresh instance so the observation
-        // never goes stale.
-        conversations.changes
-            .sink { [weak self] change in
-                guard let self,
-                      case .removed(let id) = change,
-                      id == self.activeConversation.id else { return }
-                self.retargetActiveConversation(to: self.activeChannel)
-            }
-            .store(in: &cancellables)
-    }
-
-    private func retargetActiveConversation(to channel: ChannelID) {
-        let conversation = conversations.conversation(for: ConversationID(channelID: channel))
-        guard conversation !== activeConversation else {
-            // Same object (e.g. re-selected channel): keep the existing
-            // observation, but `messages` may still differ from what views
-            // last rendered, so republish.
-            objectWillChange.send()
-            return
-        }
-        objectWillChange.send()
-        activeConversation = conversation
-        observeActiveConversation()
-    }
-
-    private func observeActiveConversation() {
-        activeConversationCancellable = activeConversation.objectWillChange
-            .sink { [weak self] _ in
-                self?.objectWillChange.send()
-            }
-    }
-}
@@ -1,185 +0,0 @@
-import BitFoundation
-import Combine
-import Foundation
-
-struct FingerprintPresentationState: Equatable {
-    let peerNickname: String
-    let encryptionStatus: EncryptionStatus
-    let theirFingerprint: String?
-    let myFingerprint: String
-    let isVerified: Bool
-    /// Number of currently-valid vouches from peers the user verified
-    /// (0 when the peer is explicitly verified — the stronger badge wins).
-    let voucherCount: Int
-    /// Display names of the (verified) vouchers, where known.
-    let voucherNames: [String]
-
-    /// Vouched for by ≥1 peer the user verified (and not explicitly verified).
-    var isVouched: Bool { voucherCount > 0 }
-
-    var canToggleVerification: Bool {
-        encryptionStatus == .noiseSecured || encryptionStatus == .noiseVerified
-    }
-}
-
-enum VerificationScanOutcome: Equatable {
-    case requested(String)
-    case notFound
-    case invalid
-}
-
-@MainActor
-final class VerificationModel: ObservableObject {
-    @Published private(set) var currentNickname: String
-    @Published private(set) var selectedPeerID: PeerID?
-
-    private let chatViewModel: ChatViewModel
-    private let peerIdentityStore: PeerIdentityStore
-    private var cancellables = Set<AnyCancellable>()
-
-    init(
-        chatViewModel: ChatViewModel,
-        privateConversationModel: PrivateConversationModel,
-        peerIdentityStore: PeerIdentityStore? = nil
-    ) {
-        self.chatViewModel = chatViewModel
-        self.peerIdentityStore = peerIdentityStore ?? chatViewModel.peerIdentityStore
-        self.currentNickname = chatViewModel.nickname
-        self.selectedPeerID = privateConversationModel.selectedPeerID
-
-        bind(privateConversationModel: privateConversationModel)
-    }
-
-    func myQRString() -> String {
-        let npub = try? chatViewModel.idBridge.getCurrentNostrIdentity()?.npub
-        return VerificationService.shared.buildMyQRString(nickname: currentNickname, npub: npub) ?? ""
-    }
-
-    func verifyScannedPayload(_ payload: String) -> VerificationScanOutcome {
-        guard let qr = VerificationService.shared.verifyScannedQR(payload) else {
-            return .invalid
-        }
-
-        guard chatViewModel.beginQRVerification(with: qr) else {
-            return .notFound
-        }
-
-        return .requested(qr.nickname)
-    }
-
-    func verifyFingerprint(for peerID: PeerID) {
-        chatViewModel.verifyFingerprint(for: peerID)
-    }
-
-    func unverifyFingerprint(for peerID: PeerID) {
-        chatViewModel.unverifyFingerprint(for: peerID)
-    }
-
-    func isVerified(peerID: PeerID) -> Bool {
-        guard let fingerprint = chatViewModel.getFingerprint(for: peerID) else { return false }
-        return peerIdentityStore.isVerified(fingerprint)
-    }
-
-    func fingerprintPresentation(for peerID: PeerID) -> FingerprintPresentationState {
-        let statusPeerID = chatViewModel.getShortIDForNoiseKey(peerID)
-        let encryptionStatus = chatViewModel.getEncryptionStatus(for: statusPeerID)
-        let theirFingerprint = chatViewModel.getFingerprint(for: statusPeerID)
-        let peerNickname = resolveDisplayName(for: peerID, statusPeerID: statusPeerID)
-        let isVerified = theirFingerprint.map { peerIdentityStore.isVerified($0) } ?? false
-
-        // Vouch state is recomputed on read: only vouchers still in the
-        // verified set count, so removing a verification silently retires the
-        // vouches that peer gave.
-        let vouchers: [VouchRecord]
-        if !isVerified, let theirFingerprint {
-            vouchers = chatViewModel.identityManager.validVouchers(for: theirFingerprint)
-        } else {
-            vouchers = []
-        }
-        let voucherNames = vouchers.compactMap { record -> String? in
-            guard let social = chatViewModel.identityManager.getSocialIdentity(for: record.voucherFingerprint) else {
-                return nil
-            }
-            if let petname = social.localPetname, !petname.isEmpty { return petname }
-            return social.claimedNickname.isEmpty ? nil : social.claimedNickname
-        }
-
-        return FingerprintPresentationState(
-            peerNickname: peerNickname,
-            encryptionStatus: encryptionStatus,
-            theirFingerprint: theirFingerprint,
-            myFingerprint: chatViewModel.getMyFingerprint(),
-            isVerified: isVerified,
-            voucherCount: vouchers.count,
-            voucherNames: voucherNames
-        )
-    }
-
-    private func bind(privateConversationModel: PrivateConversationModel) {
-        chatViewModel.$nickname
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$currentNickname)
-
-        privateConversationModel.$selectedPeerID
-            .receive(on: DispatchQueue.main)
-            .assign(to: &$selectedPeerID)
-
-        peerIdentityStore.$encryptionStatuses
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.objectWillChange.send()
-            }
-            .store(in: &cancellables)
-
-        peerIdentityStore.$verifiedFingerprints
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.objectWillChange.send()
-            }
-            .store(in: &cancellables)
-
-        chatViewModel.$allPeers
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.objectWillChange.send()
-            }
-            .store(in: &cancellables)
-
-        // Vouch state changes (ChatVouchCoordinator.notifyPeerTrustChanged)
-        // are signalled via this notification rather than a published
-        // property, so an open fingerprint sheet refreshes its vouched badge
-        // live when a vouch batch is accepted.
-        NotificationCenter.default.publisher(for: Notification.Name("peerStatusUpdated"))
-            .receive(on: DispatchQueue.main)
-            .sink { [weak self] _ in
-                self?.objectWillChange.send()
-            }
-            .store(in: &cancellables)
-    }
-
-    private func resolveDisplayName(for peerID: PeerID, statusPeerID: PeerID) -> String {
-        if let peer = chatViewModel.getPeer(byID: statusPeerID) {
-            return peer.displayName
-        }
-        if let name = chatViewModel.meshService.peerNickname(peerID: statusPeerID) {
-            return name
-        }
-        if let data = peerID.noiseKey {
-            if let favorite = FavoritesPersistenceService.shared.getFavoriteStatus(for: data),
-               !favorite.peerNickname.isEmpty {
-                return favorite.peerNickname
-            }
-            let fingerprint = data.sha256Fingerprint()
-            if let social = chatViewModel.identityManager.getSocialIdentity(for: fingerprint) {
-                if let pet = social.localPetname, !pet.isEmpty {
-                    return pet
-                }
-                if !social.claimedNickname.isEmpty {
-                    return social.claimedNickname
-                }
-            }
-        }
-
-        return String(localized: "common.unknown", comment: "Label for an unknown peer")
-    }
-}
@@ -13,6 +13,7 @@
          "value" : "dark"
        }
      ],
+      "filename" : "image-1024 1.png",
      "idiom" : "universal",
      "platform" : "ios",
      "size" : "1024x1024"
@@ -24,69 +25,10 @@
          "value" : "tinted"
        }
      ],
+      "filename" : "image-1024 2.png",
      "idiom" : "universal",
      "platform" : "ios",
      "size" : "1024x1024"
-    },
-    {
-      "filename" : "mac_16x16.png",
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "16x16"
-    },
-    {
-      "filename" : "mac_16x16@2x.png",
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "16x16"
-    },
-    {
-      "filename" : "mac_32x32.png",
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "32x32"
-    },
-    {
-      "filename" : "mac_32x32@2x.png",
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "32x32"
-    },
-    {
-      "filename" : "mac_128x128.png",
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "128x128"
-    },
-    {
-      "filename" : "mac_128x128@2x.png",
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "128x128"
-    },
-    {
-      "filename" : "mac_256x256.png",
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "256x256"
-    },
-    {
-      "filename" : "mac_256x256@2x.png",
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "256x256"
-    },
-    {
-      "filename" : "mac_512x512.png",
-      "idiom" : "mac",
-      "scale" : "1x",
-      "size" : "512x512"
-    },
-    {
-      "filename" : "mac_512x512@2x.png",
-      "idiom" : "mac",
-      "scale" : "2x",
-      "size" : "512x512"
    }
  ],
  "info" : {
@@ -6,6 +6,7 @@
 // For more information, see <https://unlicense.org>
 //

+import Tor
 import SwiftUI
 import UserNotifications

@@ -13,51 +14,112 @@ import UserNotifications
 struct BitchatApp: App {
    static let bundleID = Bundle.main.bundleIdentifier ?? "chat.bitchat"
    static let groupID = "group.\(bundleID)"
-
-    @StateObject private var runtime: AppRuntime
-    @AppStorage(AppTheme.storageKey) private var appThemeRawValue = AppTheme.matrix.rawValue
+    
+    @StateObject private var chatViewModel: ChatViewModel
    #if os(iOS)
    @Environment(\.scenePhase) var scenePhase
    @UIApplicationDelegateAdaptor(AppDelegate.self) var appDelegate
+    // Skip the very first .active-triggered Tor restart on cold launch
+    @State private var didHandleInitialActive: Bool = false
+    @State private var didEnterBackground: Bool = false
    #elseif os(macOS)
    @NSApplicationDelegateAdaptor(MacAppDelegate.self) var appDelegate
    #endif
-
+    
    init() {
-        _runtime = StateObject(wrappedValue: AppRuntime())
+        let keychain = KeychainManager()
+        _chatViewModel = StateObject(
+            wrappedValue: ChatViewModel(
+                keychain: keychain,
+                identityManager: SecureIdentityStateManager(keychain)
+            )
+        )
+        
        UNUserNotificationCenter.current().delegate = NotificationDelegate.shared
+        // Warm up georelay directory and refresh if stale (once/day)
+        GeoRelayDirectory.shared.prefetchIfNeeded()
    }
-
+    
    var body: some Scene {
        WindowGroup {
            ContentView()
-                .environment(\.appTheme, AppTheme(rawValue: appThemeRawValue) ?? .matrix)
-                .environmentObject(runtime.publicChatModel)
-                .environmentObject(runtime.privateInboxModel)
-                .environmentObject(runtime.privateConversationModel)
-                .environmentObject(runtime.verificationModel)
-                .environmentObject(runtime.conversationUIModel)
-                .environmentObject(runtime.locationChannelsModel)
-                .environmentObject(runtime.peerListModel)
-                .environmentObject(runtime.appChromeModel)
-                .environmentObject(runtime.boardAlertsModel)
+                .environmentObject(chatViewModel)
                .onAppear {
-                    appDelegate.runtime = runtime
-                    runtime.start()
+                    NotificationDelegate.shared.chatViewModel = chatViewModel
+                    // Inject live Noise service into VerificationService to avoid creating new BLE instances
+                    VerificationService.shared.configure(with: chatViewModel.meshService.getNoiseService())
+                    // Prewarm Nostr identity and QR to make first VERIFY sheet fast
+                    DispatchQueue.global(qos: .utility).async {
+                        let npub = try? NostrIdentityBridge.getCurrentNostrIdentity()?.npub
+                        _ = VerificationService.shared.buildMyQRString(nickname: chatViewModel.nickname, npub: npub)
+                    }
+                    #if os(iOS)
+                    appDelegate.chatViewModel = chatViewModel
+                    #elseif os(macOS)
+                    appDelegate.chatViewModel = chatViewModel
+                    #endif
+                    // Initialize network activation policy; will start Tor/Nostr only when allowed
+                    NetworkActivationService.shared.start()
+                    // Check for shared content
+                    checkForSharedContent()
                }
                .onOpenURL { url in
-                    runtime.handleOpenURL(url)
+                    handleURL(url)
                }
                #if os(iOS)
                .onChange(of: scenePhase) { newPhase in
-                    runtime.handleScenePhaseChange(newPhase)
+                    switch newPhase {
+                    case .background:
+                        // Keep BLE mesh running in background; BLEService adapts scanning automatically
+                        // Always send Tor to dormant on background for a clean restart later.
+                        TorManager.shared.setAppForeground(false)
+                        TorManager.shared.goDormantOnBackground()
+                        // Stop geohash sampling while backgrounded
+                        Task { @MainActor in
+                            chatViewModel.endGeohashSampling()
+                        }
+                        // Proactively disconnect Nostr to avoid spurious socket errors while Tor is down
+                        NostrRelayManager.shared.disconnect()
+                        didEnterBackground = true
+                    case .active:
+                        // Restart services when becoming active
+                        chatViewModel.meshService.startServices()
+                        TorManager.shared.setAppForeground(true)
+                        // On initial cold launch, Tor was just started in onAppear.
+                        // Skip the deterministic restart the first time we become active.
+                        if didHandleInitialActive && didEnterBackground {
+                            if TorManager.shared.isAutoStartAllowed() && !TorManager.shared.isReady {
+                                TorManager.shared.ensureRunningOnForeground()
+                            }
+                        } else {
+                            didHandleInitialActive = true
+                        }
+                        didEnterBackground = false
+                        if TorManager.shared.isAutoStartAllowed() {
+                            Task.detached {
+                                let _ = await TorManager.shared.awaitReady(timeout: 60)
+                                await MainActor.run {
+                                    // Rebuild proxied sessions to bind to the live Tor after readiness
+                                    TorURLSession.shared.rebuild()
+                                    // Reconnect Nostr via fresh sessions; will gate until Tor 100%
+                                    NostrRelayManager.shared.resetAllConnections()
+                                }
+                            }
+                        }
+                        checkForSharedContent()
+                    case .inactive:
+                        break
+                    @unknown default:
+                        break
+                    }
                }
                .onReceive(NotificationCenter.default.publisher(for: UIApplication.didBecomeActiveNotification)) { _ in
-                    runtime.handleDidBecomeActiveNotification()
+                    // Check for shared content when app becomes active
+                    checkForSharedContent()
                }
                #elseif os(macOS)
                .onReceive(NotificationCenter.default.publisher(for: NSApplication.didBecomeActiveNotification)) { _ in
-                    runtime.handleMacDidBecomeActiveNotification()
+                    // App became active
                }
                #endif
        }
@@ -66,18 +128,62 @@ struct BitchatApp: App {
        .windowResizability(.contentSize)
        #endif
    }
+    
+    private func handleURL(_ url: URL) {
+        if url.scheme == "bitchat" && url.host == "share" {
+            // Handle shared content
+            checkForSharedContent()
+        }
+    }
+    
+    private func checkForSharedContent() {
+        // Check app group for shared content from extension
+        guard let userDefaults = UserDefaults(suiteName: BitchatApp.groupID) else {
+            return
+        }
+        
+        guard let sharedContent = userDefaults.string(forKey: "sharedContent"),
+              let sharedDate = userDefaults.object(forKey: "sharedContentDate") as? Date else {
+            return
+        }
+        
+        // Only process if shared within configured window
+        if Date().timeIntervalSince(sharedDate) < TransportConfig.uiShareAcceptWindowSeconds {
+            let contentType = userDefaults.string(forKey: "sharedContentType") ?? "text"
+            
+            // Clear the shared content
+            userDefaults.removeObject(forKey: "sharedContent")
+            userDefaults.removeObject(forKey: "sharedContentType")
+            userDefaults.removeObject(forKey: "sharedContentDate")
+            // No need to force synchronize here
+            
+            // Send the shared content immediately on the main queue
+            DispatchQueue.main.async {
+                if contentType == "url" {
+                    // Try to parse as JSON first
+                    if let data = sharedContent.data(using: .utf8),
+                       let urlData = try? JSONSerialization.jsonObject(with: data) as? [String: String],
+                       let url = urlData["url"] {
+                        // Send plain URL
+                        self.chatViewModel.sendMessage(url)
+                    } else {
+                        // Fallback to simple URL
+                        self.chatViewModel.sendMessage(sharedContent)
+                    }
+                } else {
+                    self.chatViewModel.sendMessage(sharedContent)
+                }
+            }
+        }
+    }
 }

 #if os(iOS)
 final class AppDelegate: NSObject, UIApplicationDelegate {
-    weak var runtime: AppRuntime?
-
-    func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]? = nil) -> Bool {
-        true
-    }
-
-    func applicationWillTerminate(_ application: UIApplication) {
-        runtime?.applicationWillTerminate()
+    weak var chatViewModel: ChatViewModel?
+    
+    func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey : Any]? = nil) -> Bool {
+        return true
    }
 }
 #endif
@@ -86,50 +192,79 @@ final class AppDelegate: NSObject, UIApplicationDelegate {
 import AppKit

 final class MacAppDelegate: NSObject, NSApplicationDelegate {
-    weak var runtime: AppRuntime?
-
+    weak var chatViewModel: ChatViewModel?
+    
    func applicationWillTerminate(_ notification: Notification) {
-        runtime?.applicationWillTerminate()
+        chatViewModel?.applicationWillTerminate()
    }
-
+    
    func applicationShouldTerminateAfterLastWindowClosed(_ sender: NSApplication) -> Bool {
-        true
+        return true
    }
 }
 #endif

 final class NotificationDelegate: NSObject, UNUserNotificationCenterDelegate {
    static let shared = NotificationDelegate()
-    weak var runtime: AppRuntime?
-
+    weak var chatViewModel: ChatViewModel?
+    
    func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse, withCompletionHandler completionHandler: @escaping () -> Void) {
        let identifier = response.notification.request.identifier
-        let actionIdentifier = response.actionIdentifier
        let userInfo = response.notification.request.content.userInfo
-
-        // Complete only after the response is handled: for a background
-        // action (👋 wave) the system may suspend the app the moment the
-        // completion handler runs, which would drop the queued send.
-        Task { @MainActor in
-            self.runtime?.handleNotificationResponse(
-                identifier: identifier,
-                actionIdentifier: actionIdentifier,
-                userInfo: userInfo
-            )
-            completionHandler()
+        
+        // Check if this is a private message notification
+        if identifier.hasPrefix("private-") {
+            // Get peer ID from userInfo
+            if let peerID = userInfo["peerID"] as? String {
+                DispatchQueue.main.async {
+                    self.chatViewModel?.startPrivateChat(with: peerID)
+                }
+            }
        }
+        // Handle deeplink (e.g., geohash activity)
+        if let deep = userInfo["deeplink"] as? String, let url = URL(string: deep) {
+            #if os(iOS)
+            DispatchQueue.main.async { UIApplication.shared.open(url) }
+            #else
+            DispatchQueue.main.async { NSWorkspace.shared.open(url) }
+            #endif
+        }
+        
+        completionHandler()
    }
-
+    
    func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) {
        let identifier = notification.request.identifier
        let userInfo = notification.request.content.userInfo
-
-        Task {
-            let options = await self.runtime?.presentationOptions(
-                forNotificationIdentifier: identifier,
-                userInfo: userInfo
-            ) ?? [.banner, .sound]
-            completionHandler(options)
+        
+        // Check if this is a private message notification
+        if identifier.hasPrefix("private-") {
+            // Get peer ID from userInfo
+            if let peerID = userInfo["peerID"] as? String {
+                // Don't show notification if the private chat is already open
+                if chatViewModel?.selectedPrivateChatPeer == peerID {
+                    completionHandler([])
+                    return
+                }
+            }
        }
+        // Suppress geohash activity notification if we're already in that geohash channel
+        if identifier.hasPrefix("geo-activity-"),
+           let deep = userInfo["deeplink"] as? String,
+           let gh = deep.components(separatedBy: "/").last {
+            if case .location(let ch) = LocationChannelManager.shared.selectedChannel, ch.geohash == gh {
+                completionHandler([])
+                return
+            }
+        }
+        
+        // Show notification in all other cases
+        completionHandler([.banner, .sound])
+    }
+}
+
+extension String {
+    var nilIfEmpty: String? {
+        self.isEmpty ? nil : self
    }
 }
@@ -1,217 +0,0 @@
-import Foundation
-import ImageIO
-import UniformTypeIdentifiers
-#if os(iOS)
-import UIKit
-#else
-import AppKit
-#endif
-
-enum ImageUtilsError: Error {
-    case invalidImage
-    case encodingFailed
-}
-
-enum ImageUtils {
-    private static let compressionQuality: CGFloat = 0.82
-    private static let targetImageBytes: Int = 45_000
-    private static let maxSourceImageBytes: Int = 10 * 1024 * 1024
-
-    static func processImage(at url: URL, maxDimension: CGFloat = 448, outputDirectory: URL? = nil) throws -> URL {
-        try validateImageSource(at: url)
-
-        let data = try Data(contentsOf: url)
-        #if os(iOS)
-        guard let image = UIImage(data: data) else { throw ImageUtilsError.invalidImage }
-        return try processImage(image, maxDimension: maxDimension, outputDirectory: outputDirectory)
-        #else
-        guard let image = NSImage(data: data) else { throw ImageUtilsError.invalidImage }
-        return try processImage(image, maxDimension: maxDimension, outputDirectory: outputDirectory)
-        #endif
-    }
-
-    static func validateImageSource(at url: URL) throws {
-        // Security H1: Check file size BEFORE reading into memory.
-        let attrs = try FileManager.default.attributesOfItem(atPath: url.path)
-        guard let fileSize = attrs[.size] as? Int,
-              fileSize > 0,
-              fileSize <= maxSourceImageBytes else {
-            throw ImageUtilsError.invalidImage
-        }
-
-        let options = [kCGImageSourceShouldCache: false] as CFDictionary
-        guard let source = CGImageSourceCreateWithURL(url as CFURL, options),
-              CGImageSourceGetType(source) != nil else {
-            throw ImageUtilsError.invalidImage
-        }
-    }
-
-    #if os(iOS)
-    static func processImage(_ image: UIImage, maxDimension: CGFloat = 448, outputDirectory: URL? = nil) throws -> URL {
-        return try autoreleasepool {
-            // Scale the image first
-            let scaled = scaledImage(image, maxDimension: maxDimension)
-
-            // Get CGImage from UIImage - this is the key to stripping metadata
-            guard let cgImage = scaled.cgImage else {
-                throw ImageUtilsError.encodingFailed
-            }
-
-            // Use CGImageDestination to encode without metadata (same as macOS)
-            var quality = compressionQuality
-            guard var jpegData = encodeJPEG(from: cgImage, quality: quality) else {
-                throw ImageUtilsError.encodingFailed
-            }
-
-            // Compress to target size
-            while jpegData.count > targetImageBytes && quality > 0.3 {
-                quality -= 0.1
-                autoreleasepool {
-                    if let next = encodeJPEG(from: cgImage, quality: quality) {
-                        jpegData = next
-                    }
-                }
-            }
-
-            let outputURL = try makeOutputURL(outputDirectory: outputDirectory)
-            try jpegData.write(to: outputURL, options: .atomic)
-            return outputURL
-        }
-    }
-
-    private static func scaledImage(_ image: UIImage, maxDimension: CGFloat) -> UIImage {
-        let size = image.size
-        let maxSide = max(size.width, size.height)
-        guard maxSide > maxDimension else { return image }
-        let scale = maxDimension / maxSide
-        let newSize = CGSize(width: size.width * scale, height: size.height * scale)
-
-        // Draw into a new context to get a clean CGImage without metadata
-        UIGraphicsBeginImageContextWithOptions(newSize, true, 1.0)
-        image.draw(in: CGRect(origin: .zero, size: newSize))
-        let rendered = UIGraphicsGetImageFromCurrentImageContext()
-        UIGraphicsEndImageContext()
-        return rendered ?? image
-    }
-
-    // Shared EXIF-stripping JPEG encoder for both iOS and macOS
-    private static func encodeJPEG(from cgImage: CGImage, quality: CGFloat) -> Data? {
-        guard let data = CFDataCreateMutable(nil, 0) else {
-            return nil
-        }
-        guard let destination = CGImageDestinationCreateWithData(data, UTType.jpeg.identifier as CFString, 1, nil) else {
-            return nil
-        }
-        // Security: Strip ALL metadata (EXIF, GPS, TIFF, IPTC, XMP)
-        // By only specifying compression quality and no metadata keys,
-        // we ensure a clean JPEG with no privacy-leaking information
-        let options: [CFString: Any] = [
-            kCGImageDestinationLossyCompressionQuality: quality
-        ]
-        CGImageDestinationAddImage(destination, cgImage, options as CFDictionary)
-        guard CGImageDestinationFinalize(destination) else {
-            return nil
-        }
-        return data as Data
-    }
-    #else
-    static func processImage(_ image: NSImage, maxDimension: CGFloat = 448, outputDirectory: URL? = nil) throws -> URL {
-        return try autoreleasepool {
-            let scaled = scaledImage(image, maxDimension: maxDimension)
-            guard let inputCG = scaled.cgImage(forProposedRect: nil, context: nil, hints: nil) else {
-                throw ImageUtilsError.encodingFailed
-            }
-            let width = inputCG.width
-            let height = inputCG.height
-            let colorSpace = CGColorSpace(name: CGColorSpace.sRGB) ?? CGColorSpaceCreateDeviceRGB()
-            guard let context = CGContext(
-                data: nil,
-                width: width,
-                height: height,
-                bitsPerComponent: 8,
-                bytesPerRow: 0,
-                space: colorSpace,
-                bitmapInfo: CGImageAlphaInfo.premultipliedLast.rawValue
-            ) else {
-                throw ImageUtilsError.encodingFailed
-            }
-            context.draw(inputCG, in: CGRect(x: 0, y: 0, width: width, height: height))
-            guard let cgImage = context.makeImage() else {
-                throw ImageUtilsError.encodingFailed
-            }
-            var quality = compressionQuality
-            guard var jpegData = encodeJPEG(from: cgImage, quality: quality) else {
-                throw ImageUtilsError.encodingFailed
-            }
-            while jpegData.count > targetImageBytes && quality > 0.3 {
-                quality -= 0.1
-                autoreleasepool {
-                    if let next = encodeJPEG(from: cgImage, quality: quality) {
-                        jpegData = next
-                    }
-                }
-            }
-            let outputURL = try makeOutputURL(outputDirectory: outputDirectory)
-            try jpegData.write(to: outputURL, options: .atomic)
-            return outputURL
-        }
-    }
-
-    private static func scaledImage(_ image: NSImage, maxDimension: CGFloat) -> NSImage {
-        let size = image.size
-        let maxSide = max(size.width, size.height)
-        guard maxSide > maxDimension else { return image }
-        let scale = maxDimension / maxSide
-        let newSize = NSSize(width: size.width * scale, height: size.height * scale)
-        let scaledImage = NSImage(size: newSize)
-        scaledImage.lockFocus()
-        image.draw(in: NSRect(origin: .zero, size: newSize),
-                   from: NSRect(origin: .zero, size: size),
-                   operation: .copy,
-                   fraction: 1.0)
-        scaledImage.unlockFocus()
-        return scaledImage
-    }
-
-    // Shared EXIF-stripping JPEG encoder for both iOS and macOS
-    private static func encodeJPEG(from cgImage: CGImage, quality: CGFloat) -> Data? {
-        guard let data = CFDataCreateMutable(nil, 0) else {
-            return nil
-        }
-        guard let destination = CGImageDestinationCreateWithData(data, UTType.jpeg.identifier as CFString, 1, nil) else {
-            return nil
-        }
-        // Security: Strip ALL metadata (EXIF, GPS, TIFF, IPTC, XMP)
-        // By only specifying compression quality and no metadata keys,
-        // we ensure a clean JPEG with no privacy-leaking information
-        let options: [CFString: Any] = [
-            kCGImageDestinationLossyCompressionQuality: quality
-        ]
-        CGImageDestinationAddImage(destination, cgImage, options as CFDictionary)
-        guard CGImageDestinationFinalize(destination) else {
-            return nil
-        }
-        return data as Data
-    }
-    #endif
-
-    private static func makeOutputURL(outputDirectory: URL? = nil) throws -> URL {
-        let formatter = DateFormatter()
-        formatter.dateFormat = "yyyyMMdd_HHmmss"
-        let fileName = "img_\(formatter.string(from: Date()))_\(UUID().uuidString).jpg"
-
-        let directory: URL
-        if let outputDirectory {
-            directory = outputDirectory
-        } else {
-            directory = try applicationFilesDirectory().appendingPathComponent("images/outgoing", isDirectory: true)
-        }
-        try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true, attributes: nil)
-        return directory.appendingPathComponent(fileName)
-    }
-
-    private static func applicationFilesDirectory() throws -> URL {
-        let base = try FileManager.default.url(for: .applicationSupportDirectory, in: .userDomainMask, appropriateFor: nil, create: true)
-        return base.appendingPathComponent("files", isDirectory: true)
-    }
-}
@@ -1,175 +0,0 @@
-//
-// PTTAudioCodec.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import AVFoundation
-import BitLogger
-import Foundation
-
-/// Streaming PCM -> AAC-LC encoder for live voice. Stateful (the AAC encoder
-/// carries a bit reservoir across frames); one instance per burst.
-/// Not thread-safe — confine to one queue.
-final class PTTFrameEncoder {
-    private let converter: AVAudioConverter
-    private var pendingInput: [AVAudioPCMBuffer] = []
-
-    init?() {
-        guard let pcm = PTTAudioFormat.pcmFormat,
-              let aac = PTTAudioFormat.aacFormat,
-              let converter = AVAudioConverter(from: pcm, to: aac)
-        else { return nil }
-        converter.bitRate = PTTAudioFormat.bitRate
-        self.converter = converter
-    }
-
-    /// Feeds PCM (16 kHz mono float) and returns every complete AAC frame the
-    /// encoder produced. Frames come out ~130 bytes each at 16 kbps.
-    func encode(_ buffer: AVAudioPCMBuffer) -> [Data] {
-        pendingInput.append(buffer)
-        return drainConverter()
-    }
-
-    private func drainConverter() -> [Data] {
-        var frames: [Data] = []
-        while true {
-            let output = AVAudioCompressedBuffer(
-                format: converter.outputFormat,
-                packetCapacity: 8,
-                maximumPacketSize: max(converter.maximumOutputPacketSize, 1)
-            )
-            var error: NSError?
-            let status = converter.convert(to: output, error: &error) { [weak self] _, outStatus in
-                guard let self, let next = self.pendingInput.first else {
-                    outStatus.pointee = .noDataNow
-                    return nil
-                }
-                self.pendingInput.removeFirst()
-                outStatus.pointee = .haveData
-                return next
-            }
-            if status == .error {
-                SecureLogger.error("PTT encode failed: \(error?.localizedDescription ?? "unknown")", category: .session)
-                return frames
-            }
-            frames.append(contentsOf: Self.extractPackets(from: output))
-            // .haveData means the output buffer filled and more may be ready;
-            // anything else means the converter wants more input.
-            if status != .haveData { return frames }
-        }
-    }
-
-    private static func extractPackets(from buffer: AVAudioCompressedBuffer) -> [Data] {
-        guard buffer.packetCount > 0, let descriptions = buffer.packetDescriptions else { return [] }
-        var frames: [Data] = []
-        frames.reserveCapacity(Int(buffer.packetCount))
-        for index in 0..<Int(buffer.packetCount) {
-            let description = descriptions[index]
-            guard description.mDataByteSize > 0 else { continue }
-            let start = buffer.data.advanced(by: Int(description.mStartOffset))
-            frames.append(Data(bytes: start, count: Int(description.mDataByteSize)))
-        }
-        return frames
-    }
-}
-
-/// Streaming AAC-LC -> PCM decoder for live voice. Stateful; one instance per
-/// inbound burst. Not thread-safe — confine to one queue/actor.
-final class PTTFrameDecoder {
-    private let converter: AVAudioConverter
-    private let pcmFormat: AVAudioFormat
-    private let aacFormat: AVAudioFormat
-
-    init?() {
-        guard let pcm = PTTAudioFormat.pcmFormat,
-              let aac = PTTAudioFormat.aacFormat,
-              let converter = AVAudioConverter(from: aac, to: pcm)
-        else { return nil }
-        self.converter = converter
-        self.pcmFormat = pcm
-        self.aacFormat = aac
-    }
-
-    /// Decodes one raw AAC frame to PCM. Returns nil for malformed input or
-    /// while the decoder is still priming (the first frame of a stream).
-    func decode(_ frame: Data) -> AVAudioPCMBuffer? {
-        guard !frame.isEmpty, frame.count <= 8 * 1024 else { return nil }
-
-        let input = AVAudioCompressedBuffer(format: aacFormat, packetCapacity: 1, maximumPacketSize: frame.count)
-        frame.withUnsafeBytes { raw in
-            guard let base = raw.baseAddress else { return }
-            input.data.copyMemory(from: base, byteCount: frame.count)
-        }
-        input.byteLength = UInt32(frame.count)
-        input.packetCount = 1
-        input.packetDescriptions?.pointee = AudioStreamPacketDescription(
-            mStartOffset: 0,
-            mVariableFramesInPacket: 0,
-            mDataByteSize: UInt32(frame.count)
-        )
-
-        guard let output = AVAudioPCMBuffer(
-            pcmFormat: pcmFormat,
-            frameCapacity: PTTAudioFormat.samplesPerFrame * 2
-        ) else { return nil }
-
-        var consumed = false
-        var error: NSError?
-        let status = converter.convert(to: output, error: &error) { _, outStatus in
-            if consumed {
-                outStatus.pointee = .noDataNow
-                return nil
-            }
-            consumed = true
-            outStatus.pointee = .haveData
-            return input
-        }
-        guard status != .error else {
-            SecureLogger.debug("PTT decode failed: \(error?.localizedDescription ?? "unknown")", category: .session)
-            return nil
-        }
-        return output.frameLength > 0 ? output : nil
-    }
-}
-
-/// Sample-rate/channel converter from the microphone's native format to the
-/// 16 kHz mono processing format. Stateful; not thread-safe.
-final class PTTInputResampler {
-    private let converter: AVAudioConverter
-    private let outputFormat: AVAudioFormat
-    private let ratio: Double
-
-    init?(inputFormat: AVAudioFormat) {
-        guard let pcm = PTTAudioFormat.pcmFormat,
-              let converter = AVAudioConverter(from: inputFormat, to: pcm)
-        else { return nil }
-        self.converter = converter
-        self.outputFormat = pcm
-        self.ratio = PTTAudioFormat.sampleRate / inputFormat.sampleRate
-    }
-
-    func resample(_ buffer: AVAudioPCMBuffer) -> AVAudioPCMBuffer? {
-        let capacity = AVAudioFrameCount(Double(buffer.frameLength) * ratio) + 64
-        guard let output = AVAudioPCMBuffer(pcmFormat: outputFormat, frameCapacity: capacity) else { return nil }
-
-        var consumed = false
-        var error: NSError?
-        let status = converter.convert(to: output, error: &error) { _, outStatus in
-            if consumed {
-                outStatus.pointee = .noDataNow
-                return nil
-            }
-            consumed = true
-            outStatus.pointee = .haveData
-            return buffer
-        }
-        guard status != .error else {
-            SecureLogger.debug("PTT resample failed: \(error?.localizedDescription ?? "unknown")", category: .session)
-            return nil
-        }
-        return output.frameLength > 0 ? output : nil
-    }
-}
@@ -1,84 +0,0 @@
-//
-// PTTAudioFormat.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import AVFoundation
-import Foundation
-
-/// Shared audio parameters for live push-to-talk: AAC-LC, 16 kHz, mono,
-/// ~16 kbps — deliberately identical to `VoiceRecorder`'s voice-note settings
-/// so a burst's finalized `.m4a` and its live frames sound the same.
-enum PTTAudioFormat {
-    static let sampleRate: Double = 16_000
-    static let channelCount: AVAudioChannelCount = 1
-    static let bitRate = 16_000
-    /// AAC-LC frame size is fixed by the codec: 1024 samples = 64 ms at 16 kHz.
-    static let samplesPerFrame: AVAudioFrameCount = 1024
-    static var frameDuration: TimeInterval { Double(samplesPerFrame) / sampleRate }
-
-    /// Uncompressed processing format (deinterleaved float PCM).
-    static var pcmFormat: AVAudioFormat? {
-        AVAudioFormat(standardFormatWithSampleRate: sampleRate, channels: channelCount)
-    }
-
-    /// Compressed wire format.
-    static var aacFormat: AVAudioFormat? {
-        var description = AudioStreamBasicDescription(
-            mSampleRate: sampleRate,
-            mFormatID: kAudioFormatMPEG4AAC,
-            mFormatFlags: 0,
-            mBytesPerPacket: 0,
-            mFramesPerPacket: samplesPerFrame,
-            mBytesPerFrame: 0,
-            mChannelsPerFrame: channelCount,
-            mBitsPerChannel: 0,
-            mReserved: 0
-        )
-        return AVAudioFormat(streamDescription: &description)
-    }
-
-    /// Voice-note container settings for the finalized `.m4a`, mirroring
-    /// `VoiceRecorder.startRecording()`.
-    static var voiceNoteFileSettings: [String: Any] {
-        [
-            AVFormatIDKey: kAudioFormatMPEG4AAC,
-            AVSampleRateKey: sampleRate,
-            AVNumberOfChannelsKey: Int(channelCount),
-            AVEncoderBitRateKey: bitRate
-        ]
-    }
-}
-
-/// Builds ADTS-framed AAC so a receiver can persist a burst progressively:
-/// unlike `.m4a` (whose moov atom only exists after close), an ADTS `.aac`
-/// stream is playable at any prefix — a partially received burst is still a
-/// replayable voice note.
-enum ADTSFramer {
-    private static let headerSize = 7
-    /// MPEG-4 sampling frequency index for 16 kHz.
-    private static let samplingFrequencyIndex: UInt8 = 8
-    private static let channelConfiguration: UInt8 = 1
-
-    /// Wraps one raw AAC-LC frame in an ADTS header.
-    static func frame(_ aacFrame: Data) -> Data {
-        let frameLength = aacFrame.count + headerSize
-        var data = Data(capacity: frameLength)
-        // Syncword 0xFFF, MPEG-4, layer 00, no CRC.
-        data.append(0xFF)
-        data.append(0xF1)
-        // Profile AAC-LC (audio object type 2 -> bits 01), frequency index,
-        // private bit 0, channel config high bit.
-        data.append((0b01 << 6) | (samplingFrequencyIndex << 2) | ((channelConfiguration >> 2) & 0x1))
-        data.append(((channelConfiguration & 0x3) << 6) | UInt8((frameLength >> 11) & 0x3))
-        data.append(UInt8((frameLength >> 3) & 0xFF))
-        data.append(UInt8((frameLength & 0x7) << 5) | 0x1F)
-        // Buffer fullness 0x7FF (VBR), one AAC frame per ADTS frame.
-        data.append(0xFC)
-        data.append(aacFrame)
-        return data
-    }
-}
@@ -1,144 +0,0 @@
-//
-// PTTBurstPlayer.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import AVFoundation
-import BitLogger
-import Foundation
-
-/// Plays one inbound live voice burst with a small jitter buffer.
-///
-/// Frames are decoded and scheduled back-to-back on an `AVAudioPlayerNode`;
-/// an underrun (missing/late packets) simply pauses output until the next
-/// buffer arrives, which self-heals timing without explicit silence
-/// insertion. Playback starts once `TransportConfig.pttJitterBufferSeconds`
-/// of audio is queued or `pttJitterDeadlineSeconds` has elapsed.
-@MainActor
-final class PTTBurstPlayer {
-    private let engine = AVAudioEngine()
-    private let node = AVAudioPlayerNode()
-    private let decoder: PTTFrameDecoder
-
-    private var queuedBuffers: [AVAudioPCMBuffer] = []
-    private var queuedDuration: TimeInterval = 0
-    private var scheduledCount = 0
-    private var engineStarted = false
-    private var finished = false
-    private var stopped = false
-    private var deadlineTask: Task<Void, Never>?
-
-    private(set) var isPlaying = false
-
-    init?() {
-        guard let format = PTTAudioFormat.pcmFormat, let decoder = PTTFrameDecoder() else { return nil }
-        self.decoder = decoder
-        engine.attach(node)
-        engine.connect(node, to: engine.mainMixerNode, format: format)
-
-        deadlineTask = Task { [weak self] in
-            try? await Task.sleep(nanoseconds: UInt64(TransportConfig.pttJitterDeadlineSeconds * 1_000_000_000))
-            self?.startIfReady(force: true)
-        }
-    }
-
-    /// Decodes and queues frames (in burst order). Starts playback when the
-    /// jitter buffer fills.
-    func enqueue(_ frames: [Data]) {
-        guard !stopped else { return }
-        for frame in frames {
-            guard let pcm = decoder.decode(frame) else { continue }
-            if engineStarted {
-                schedule(pcm)
-            } else {
-                queuedBuffers.append(pcm)
-                queuedDuration += Double(pcm.frameLength) / PTTAudioFormat.sampleRate
-            }
-        }
-        startIfReady(force: false)
-    }
-
-    /// The burst ended: stop once everything scheduled has played out.
-    func finishAfterDrain() {
-        finished = true
-        stopIfDrained()
-    }
-
-    /// Immediate stop (cancel, another playback taking over, teardown).
-    func stop() {
-        guard !stopped else { return }
-        stopped = true
-        deadlineTask?.cancel()
-        queuedBuffers = []
-        if engineStarted {
-            node.stop()
-            engine.stop()
-        }
-        isPlaying = false
-        VoiceNotePlaybackCoordinator.shared.deactivate(self)
-    }
-
-    private func startIfReady(force: Bool) {
-        guard !engineStarted, !stopped, !queuedBuffers.isEmpty else { return }
-        guard force || queuedDuration >= TransportConfig.pttJitterBufferSeconds else { return }
-
-        #if os(iOS)
-        do {
-            let session = AVAudioSession.sharedInstance()
-            try session.setCategory(.playback, mode: .spokenAudio, options: [.mixWithOthers])
-            try session.setActive(true, options: [])
-        } catch {
-            SecureLogger.error("PTT playback session activation failed: \(error)", category: .session)
-        }
-        #endif
-
-        engine.prepare()
-        do {
-            try engine.start()
-        } catch {
-            SecureLogger.error("PTT playback engine failed to start: \(error)", category: .session)
-            stopped = true
-            return
-        }
-        engineStarted = true
-        isPlaying = true
-        VoiceNotePlaybackCoordinator.shared.activate(self)
-        node.play()
-
-        let buffered = queuedBuffers
-        queuedBuffers = []
-        queuedDuration = 0
-        for buffer in buffered {
-            schedule(buffer)
-        }
-    }
-
-    private func schedule(_ buffer: AVAudioPCMBuffer) {
-        scheduledCount += 1
-        node.scheduleBuffer(buffer) { [weak self] in
-            Task { @MainActor [weak self] in
-                guard let self else { return }
-                self.scheduledCount -= 1
-                self.stopIfDrained()
-            }
-        }
-    }
-
-    private func stopIfDrained() {
-        guard finished, scheduledCount <= 0 else { return }
-        stop()
-    }
-}
-
-extension PTTBurstPlayer: ExclusivePlayback {
-    /// A live stream can't meaningfully pause; yielding the floor stops it.
-    /// The burst keeps assembling to file, so nothing is lost.
-    nonisolated func pauseForExclusivity() {
-        Task { @MainActor [weak self] in
-            self?.stop()
-        }
-    }
-}
@@ -1,183 +0,0 @@
-//
-// PTTCaptureEngine.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import AVFoundation
-import BitLogger
-import Foundation
-
-/// Captures microphone audio for a live push-to-talk burst, producing both:
-/// - live AAC frames via `onFrames` (called on the capture queue), and
-/// - a finalized `.m4a` voice note on `stop()` — the same artifact
-///   `VoiceRecorder` produces, so the existing voice-note send pipeline
-///   handles delivery to receivers that missed the live stream.
-final class PTTCaptureEngine {
-    /// Hard cap matching `VoiceRecorder.maxRecordingDuration`: past it the
-    /// engine keeps running (the UI owns the gesture) but stops encoding.
-    private static let maxCaptureDuration: TimeInterval = 120
-
-    /// Recreated on every `start()`: an engine whose input unit was
-    /// instantiated against an earlier (playback-only or inactive) audio
-    /// session keeps reporting a dead 0 Hz / 2 ch input format and fails to
-    /// enable the mic (AURemoteIO -10851, observed on iPhone field tests).
-    private var engine = AVAudioEngine()
-    private let queue = DispatchQueue(label: "chat.bitchat.ptt.capture", qos: .userInitiated)
-
-    // Capture-queue-confined state.
-    private var resampler: PTTInputResampler?
-    private var encoder: PTTFrameEncoder?
-    private var file: AVAudioFile?
-    private var fileURL: URL?
-    private var encodedFrameCount = 0
-    private var running = false
-    private var captureStart = Date()
-    /// Whether `engine.start()` succeeded for the current capture (main-actor
-    /// callers only; see `stopEngineIfStarted`).
-    private var engineStarted = false
-
-    /// Called on the capture queue with each batch of encoded AAC frames.
-    var onFrames: (([Data]) -> Void)?
-
-    enum CaptureError: Error {
-        case inputUnavailable
-        case audioSetupFailed
-    }
-
-    func start(outputURL: URL) throws {
-        #if os(iOS)
-        try Self.configureAudioSession()
-        #endif
-
-        // Fresh engine per capture so its input unit binds to the session
-        // that is active *now* (see `engine` doc comment).
-        engine = AVAudioEngine()
-        let inputFormat = engine.inputNode.outputFormat(forBus: 0)
-        guard inputFormat.sampleRate > 0, inputFormat.channelCount > 0 else {
-            SecureLogger.error("PTT: capture input unavailable (input reports \(Int(inputFormat.sampleRate)) Hz, \(inputFormat.channelCount) ch)", category: .session)
-            throw CaptureError.inputUnavailable
-        }
-        guard let resampler = PTTInputResampler(inputFormat: inputFormat),
-              let encoder = PTTFrameEncoder(),
-              let pcmFormat = PTTAudioFormat.pcmFormat
-        else { throw CaptureError.audioSetupFailed }
-
-        let file = try AVAudioFile(
-            forWriting: outputURL,
-            settings: PTTAudioFormat.voiceNoteFileSettings,
-            commonFormat: pcmFormat.commonFormat,
-            interleaved: pcmFormat.isInterleaved
-        )
-
-        queue.sync {
-            self.resampler = resampler
-            self.encoder = encoder
-            self.file = file
-            self.fileURL = outputURL
-            self.encodedFrameCount = 0
-            self.captureStart = Date()
-            self.running = true
-        }
-
-        engine.inputNode.installTap(onBus: 0, bufferSize: 4096, format: inputFormat) { [weak self] buffer, _ in
-            self?.queue.async { self?.process(buffer) }
-        }
-        engine.prepare()
-        do {
-            try engine.start()
-        } catch {
-            SecureLogger.error("PTT: capture engine failed to start (input: \(Int(inputFormat.sampleRate)) Hz, \(inputFormat.channelCount) ch): \(error)", category: .session)
-            engine.inputNode.removeTap(onBus: 0)
-            queue.sync { self.teardown(deleteFile: true) }
-            throw error
-        }
-        engineStarted = true
-        SecureLogger.info("PTT: capture engine running (input: \(Int(inputFormat.sampleRate)) Hz, \(inputFormat.channelCount) ch)", category: .session)
-    }
-
-    /// Stops capture and finalizes the `.m4a`. Returns the file URL and the
-    /// number of encoded AAC frames (each `PTTAudioFormat.frameDuration` long).
-    func stop() -> (url: URL?, encodedFrames: Int) {
-        stopEngineIfStarted()
-        let result: (URL?, Int) = queue.sync {
-            let url = fileURL
-            let frames = encodedFrameCount
-            teardown(deleteFile: false)
-            return (url, frames)
-        }
-        #if os(iOS)
-        Self.deactivateAudioSession()
-        #endif
-        return result
-    }
-
-    func cancel() {
-        stopEngineIfStarted()
-        queue.sync { teardown(deleteFile: true) }
-        #if os(iOS)
-        Self.deactivateAudioSession()
-        #endif
-    }
-
-    /// Touching `inputNode` on an engine that never started instantiates its
-    /// input unit against whatever session is active and spams AURemoteIO
-    /// errors — a canceled-before-start hold must not touch the engine.
-    private func stopEngineIfStarted() {
-        guard engineStarted else { return }
-        engineStarted = false
-        engine.inputNode.removeTap(onBus: 0)
-        engine.stop()
-    }
-
-    // MARK: - Capture queue
-
-    private func process(_ buffer: AVAudioPCMBuffer) {
-        guard running,
-              Date().timeIntervalSince(captureStart) < Self.maxCaptureDuration,
-              let resampled = resampler?.resample(buffer)
-        else { return }
-
-        do {
-            try file?.write(from: resampled)
-        } catch {
-            SecureLogger.error("PTT capture file write failed: \(error)", category: .session)
-        }
-
-        guard let frames = encoder?.encode(resampled), !frames.isEmpty else { return }
-        encodedFrameCount += frames.count
-        onFrames?(frames)
-    }
-
-    private func teardown(deleteFile: Bool) {
-        running = false
-        // Releasing the AVAudioFile finalizes the .m4a container.
-        file = nil
-        encoder = nil
-        resampler = nil
-        if deleteFile, let url = fileURL {
-            try? FileManager.default.removeItem(at: url)
-        }
-        fileURL = nil
-    }
-
-    // MARK: - Audio session (iOS)
-
-    #if os(iOS)
-    private static func configureAudioSession() throws {
-        let session = AVAudioSession.sharedInstance()
-        #if targetEnvironment(simulator)
-        try session.setCategory(.playAndRecord, mode: .default, options: [.defaultToSpeaker, .allowBluetoothA2DP])
-        #else
-        try session.setCategory(.playAndRecord, mode: .default, options: [.defaultToSpeaker, .allowBluetoothA2DP, .allowBluetoothHFP])
-        #endif
-        try session.setActive(true, options: .notifyOthersOnDeactivation)
-    }
-
-    private static func deactivateAudioSession() {
-        try? AVAudioSession.sharedInstance().setActive(false, options: .notifyOthersOnDeactivation)
-    }
-    #endif
-}
@@ -1,39 +0,0 @@
-//
-// PTTSettings.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import Foundation
-#if os(iOS)
-import UIKit
-#elseif os(macOS)
-import AppKit
-#endif
-
-/// User preference for live push-to-talk voice. One switch controls both
-/// directions: streaming your holds live, and auto-playing inbound bursts.
-/// Off means voice messages behave exactly like classic voice notes.
-enum PTTSettings {
-    private static let liveVoiceEnabledKey = "ptt.liveVoiceEnabled"
-
-    static var liveVoiceEnabled: Bool {
-        get { UserDefaults.standard.object(forKey: liveVoiceEnabledKey) as? Bool ?? true }
-        set { UserDefaults.standard.set(newValue, forKey: liveVoiceEnabledKey) }
-    }
-
-    /// Autoplay is foreground-only: audio must never start from the
-    /// background.
-    @MainActor
-    static var isAppActive: Bool {
-        #if os(iOS)
-        return UIApplication.shared.applicationState == .active
-        #elseif os(macOS)
-        return NSApplication.shared.isActive
-        #else
-        return true
-        #endif
-    }
-}
@@ -1,183 +0,0 @@
-//
-// VoiceCaptureSession.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import BitFoundation
-import BitLogger
-import Foundation
-
-/// Capture backend behind the composer's hold-to-record gesture.
-/// `VoiceRecordingViewModel` drives one session per press; the concrete type
-/// decides *how* audio leaves the device: `VoiceNoteCaptureSession` records a
-/// note delivered on release (today's behavior), `PTTLiveVoiceSession`
-/// additionally streams frames live while the button is held.
-@MainActor
-protocol VoiceCaptureSession: AnyObject {
-    /// Whether audio is leaving the device in real time while recording —
-    /// drives the composer's LIVE treatment.
-    var isLive: Bool { get }
-    func requestPermission() async -> Bool
-    func start() async throws
-    /// Stops capture and returns the finalized voice-note file, or nil when
-    /// nothing valid was captured.
-    func finish() async -> URL?
-    func cancel() async
-}
-
-/// The classic record-then-send backend, wrapping the shared `VoiceRecorder`.
-@MainActor
-final class VoiceNoteCaptureSession: VoiceCaptureSession {
-    var isLive: Bool { false }
-
-    func requestPermission() async -> Bool {
-        await VoiceRecorder.shared.requestPermission()
-    }
-
-    func start() async throws {
-        try await VoiceRecorder.shared.startRecording()
-    }
-
-    func finish() async -> URL? {
-        await VoiceRecorder.shared.stopRecording()
-    }
-
-    func cancel() async {
-        await VoiceRecorder.shared.cancelRecording()
-    }
-}
-
-/// Live push-to-talk backend: streams `VoiceBurstPacket`s to one peer while
-/// recording, then finalizes the same audio as a standard voice note whose
-/// file name carries the burst ID (`voice_<burstID>.m4a`) so receivers that
-/// heard the live stream absorb the note silently instead of seeing a
-/// duplicate.
-@MainActor
-final class PTTLiveVoiceSession: VoiceCaptureSession {
-    let burstID: Data
-
-    private let sendPacket: (Data) -> Void
-    private let capture = PTTCaptureEngine()
-    /// Capture-queue-confined stream state: packetizes frames and lazily
-    /// emits START so packet order is guaranteed by queue serialization.
-    private final class StreamState {
-        var packetizer: VoiceBurstPacketizer
-        var sentStart = false
-        init(burstID: Data) {
-            packetizer = VoiceBurstPacketizer(burstID: burstID)
-        }
-    }
-    private let stream: StreamState
-    private var startDate: Date?
-    private var completed = false
-
-    var isLive: Bool { true }
-
-    /// - Parameter sendPacket: delivers one encoded `VoiceBurstPacket` to the
-    ///   target peer; must be safe to call from any queue (BLEService hops to
-    ///   its own message queue internally).
-    init(sendPacket: @escaping (Data) -> Void) {
-        self.burstID = VoiceBurstPacket.makeBurstID()
-        self.sendPacket = sendPacket
-        self.stream = StreamState(burstID: burstID)
-    }
-
-    func requestPermission() async -> Bool {
-        await VoiceRecorder.shared.requestPermission()
-    }
-
-    func start() async throws {
-        let outputURL = try Self.makeOutputURL(burstID: burstID)
-        let sendPacket = sendPacket
-        let stream = stream
-        capture.onFrames = { frames in
-            if !stream.sentStart {
-                stream.sentStart = true
-                if let start = VoiceBurstPacket(
-                    burstID: stream.packetizer.burstID,
-                    seq: 0,
-                    kind: .start(codec: .aacLC16kMono)
-                ) {
-                    sendPacket(start.encode())
-                }
-            }
-            for frame in frames {
-                for packet in stream.packetizer.add(frame) {
-                    sendPacket(packet)
-                }
-            }
-            // Flush per callback batch: at ~130-byte frames the budget fits
-            // one frame per packet anyway, and holding residue would add
-            // ~100 ms of avoidable latency.
-            for packet in stream.packetizer.flush() {
-                sendPacket(packet)
-            }
-        }
-        do {
-            try capture.start(outputURL: outputURL)
-        } catch {
-            // The HAL can briefly report a dead input right after the audio
-            // session (re)activates while the route settles; one retry after
-            // a short pause covers it (observed on iPhone field tests).
-            SecureLogger.warning("PTT: capture start failed (\(error)) — retrying once after route settle", category: .session)
-            try? await Task.sleep(nanoseconds: 150_000_000)
-            try capture.start(outputURL: outputURL)
-        }
-        startDate = Date()
-        SecureLogger.info("PTT: live burst \(burstID.hexEncodedString()) capture started", category: .session)
-    }
-
-    func finish() async -> URL? {
-        guard !completed else { return nil }
-        completed = true
-
-        let elapsed = startDate.map { Date().timeIntervalSince($0) } ?? 0
-        let (url, encodedFrames) = capture.stop()
-        // stop() drained the capture queue, so touching `stream` is safe now.
-
-        guard elapsed >= VoiceRecorder.minRecordingDuration, let url else {
-            sendControlPacket(.canceled)
-            if let url {
-                try? FileManager.default.removeItem(at: url)
-            }
-            return nil
-        }
-
-        for packet in stream.packetizer.flush() {
-            sendPacket(packet)
-        }
-        let durationMs = UInt32((Double(encodedFrames) * PTTAudioFormat.frameDuration * 1000).rounded())
-        sendControlPacket(.end(totalDataPackets: stream.packetizer.dataPacketCount, durationMs: durationMs))
-        SecureLogger.info("PTT: live burst \(burstID.hexEncodedString()) finished — \(stream.packetizer.dataPacketCount) data packets, \(encodedFrames) frames, \(durationMs) ms", category: .session)
-        return url
-    }
-
-    func cancel() async {
-        guard !completed else { return }
-        completed = true
-        capture.cancel()
-        sendControlPacket(.canceled)
-    }
-
-    private func sendControlPacket(_ kind: VoiceBurstPacket.Kind) {
-        guard let packet = VoiceBurstPacket(burstID: burstID, seq: stream.packetizer.nextSeq, kind: kind) else { return }
-        sendPacket(packet.encode())
-    }
-
-    private static func makeOutputURL(burstID: Data) throws -> URL {
-        let base = try FileManager.default.url(
-            for: .applicationSupportDirectory,
-            in: .userDomainMask,
-            appropriateFor: nil,
-            create: true
-        )
-        let directory = base
-            .appendingPathComponent("files", isDirectory: true)
-            .appendingPathComponent("voicenotes/outgoing", isDirectory: true)
-        try FileManager.default.createDirectory(at: directory, withIntermediateDirectories: true, attributes: nil)
-        return directory.appendingPathComponent("voice_\(burstID.hexEncodedString()).m4a")
-    }
-}
@@ -1,217 +0,0 @@
-import Foundation
-import AVFoundation
-import BitLogger
-
-/// Controls playback for a single voice note and coordinates exclusive playback across the app.
-final class VoiceNotePlaybackController: NSObject, ObservableObject, AVAudioPlayerDelegate {
-    @Published private(set) var isPlaying: Bool = false
-    @Published private(set) var currentTime: TimeInterval = 0
-    @Published private(set) var duration: TimeInterval = 0
-    @Published private(set) var progress: Double = 0
-
-    /// rounded so 4.9s shows "00:05"
-    var roundedDuration: Int {
-        guard duration.isFinite else { return 0 }
-        return Int(duration.rounded())
-    }
-
-    /// ceil so "00:01" stays visible until playback ends, capped to rounded duration
-    var remainingSeconds: Int {
-        let remaining = max(0, duration - currentTime)
-        return min(roundedDuration, Int(ceil(remaining)))
-    }
-
-    private var player: AVAudioPlayer?
-    private var timer: Timer?
-    private var url: URL
-
-    init(url: URL) {
-        self.url = url
-        super.init()
-        // Don't load anything eagerly - wait until user interaction or view is fully displayed
-    }
-
-    func loadDuration() {
-        guard duration == 0 else { return }
-
-        DispatchQueue.global(qos: .utility).async { [weak self] in
-            guard let self = self else { return }
-            do {
-                let player = try AVAudioPlayer(contentsOf: self.url)
-                let loadedDuration = player.duration
-                DispatchQueue.main.async { [weak self] in
-                    guard let self = self, self.duration == 0 else { return }
-                    self.duration = loadedDuration
-                }
-            } catch {
-                SecureLogger.error("Failed to load audio duration: \(error)", category: .session)
-            }
-        }
-    }
-
-    deinit {
-        timer?.invalidate()
-    }
-
-    func replaceURL(_ url: URL) {
-        guard url != self.url else { return }
-        stop()
-        self.url = url
-        player = nil
-        duration = 0
-        // Duration will be loaded on demand when needed
-    }
-
-    func togglePlayback() {
-        isPlaying ? pause() : play()
-    }
-
-    func play() {
-        guard ensurePlayerReady() else { return }
-        VoiceNotePlaybackCoordinator.shared.activate(self)
-        player?.play()
-        startTimer()
-        updateProgress()
-        isPlaying = true
-    }
-
-    func pause() {
-        player?.pause()
-        stopTimer()
-        updateProgress()
-        isPlaying = false
-    }
-
-    func stop() {
-        player?.stop()
-        player?.currentTime = 0
-        stopTimer()
-        updateProgress()
-        isPlaying = false
-        VoiceNotePlaybackCoordinator.shared.deactivate(self)
-    }
-
-    func seek(to fraction: Double) {
-        guard ensurePlayerReady() else { return }
-        let clamped = max(0, min(1, fraction))
-        if let player = player {
-            player.currentTime = clamped * player.duration
-            if isPlaying {
-                player.play()
-            }
-            updateProgress()
-        }
-    }
-
-    // MARK: - AVAudioPlayerDelegate
-
-    func audioPlayerDidFinishPlaying(_ player: AVAudioPlayer, successfully flag: Bool) {
-        // Delegate callback may be on background thread - ensure main thread for UI updates
-        DispatchQueue.main.async { [weak self] in
-            guard let self = self else { return }
-            self.stopTimer()
-            self.updateProgress()
-            self.isPlaying = false
-            VoiceNotePlaybackCoordinator.shared.deactivate(self)
-        }
-    }
-
-    // MARK: - Private Helpers
-
-    private func preparePlayer(for url: URL) {
-        // Prepare player synchronously (only called when playback is requested)
-        do {
-            let player = try AVAudioPlayer(contentsOf: url)
-            player.delegate = self
-            player.prepareToPlay()
-            self.player = player
-            duration = player.duration
-            currentTime = player.currentTime
-            progress = duration > 0 ? currentTime / duration : 0
-        } catch {
-            SecureLogger.error("Voice note playback failed for \(url.lastPathComponent): \(error)", category: .session)
-            player = nil
-            duration = 0
-            currentTime = 0
-            progress = 0
-        }
-    }
-
-    private func ensurePlayerReady() -> Bool {
-        if player == nil {
-            preparePlayer(for: url)
-        }
-        #if os(iOS)
-        let session = AVAudioSession.sharedInstance()
-        do {
-            try session.setCategory(.playback, mode: .spokenAudio, options: [.mixWithOthers])
-            try session.setActive(true, options: [])
-        } catch {
-            SecureLogger.error("Failed to activate audio session: \(error)", category: .session)
-        }
-        #endif
-        return player != nil
-    }
-
-    private func startTimer() {
-        if timer != nil { return }
-        timer = Timer.scheduledTimer(withTimeInterval: 0.05, repeats: true) { [weak self] _ in
-            self?.updateProgress()
-        }
-        if let timer = timer {
-            RunLoop.main.add(timer, forMode: .common)
-        }
-    }
-
-    private func stopTimer() {
-        timer?.invalidate()
-        timer = nil
-    }
-
-    private func updateProgress() {
-        guard let player = player else {
-            currentTime = 0
-            duration = 0
-            progress = 0
-            return
-        }
-        currentTime = player.currentTime
-        duration = player.duration
-        progress = duration > 0 ? currentTime / duration : 0
-    }
-}
-
-/// Something that can hold the app's single audio-playback slot and yield it
-/// when another playback starts (voice notes pause; live bursts stop).
-protocol ExclusivePlayback: AnyObject {
-    func pauseForExclusivity()
-}
-
-extension VoiceNotePlaybackController: ExclusivePlayback {
-    func pauseForExclusivity() {
-        pause()
-    }
-}
-
-/// Ensures only one voice playback (note or live burst) runs at a time.
-final class VoiceNotePlaybackCoordinator {
-    static let shared = VoiceNotePlaybackCoordinator()
-
-    private weak var activeController: (any ExclusivePlayback)?
-
-    private init() {}
-
-    func activate(_ controller: any ExclusivePlayback) {
-        if activeController === controller {
-            return
-        }
-        activeController?.pauseForExclusivity()
-        activeController = controller
-    }
-
-    func deactivate(_ controller: any ExclusivePlayback) {
-        if activeController === controller {
-            activeController = nil
-        }
-    }
-}
@@ -1,154 +0,0 @@
-import Foundation
-import AVFoundation
-
-/// Manages audio capture for mesh voice notes with predictable encoding settings.
-actor VoiceRecorder {
-    enum RecorderError: Error {
-        case microphoneAccessDenied
-        case recordingInProgress
-    }
-
-    static let shared = VoiceRecorder()
-
-    private let paddingInterval: TimeInterval = 0.5
-    private let maxRecordingDuration: TimeInterval = 120
-    static let minRecordingDuration: TimeInterval = 1
-
-    private var recorder: AVAudioRecorder?
-    private var currentURL: URL?
-
-    // MARK: - Permissions
-
-    nonisolated
-    func requestPermission() async -> Bool {
-        #if os(iOS)
-        return await withCheckedContinuation { continuation in
-            AVAudioSession.sharedInstance().requestRecordPermission { granted in
-                continuation.resume(returning: granted)
-            }
-        }
-        #elseif os(macOS)
-        return await withCheckedContinuation { continuation in
-            AVCaptureDevice.requestAccess(for: .audio) { granted in
-                continuation.resume(returning: granted)
-            }
-        }
-        #else
-        return true
-        #endif
-    }
-
-    // MARK: - Recording Lifecycle
-
-    @discardableResult
-    func startRecording() throws -> URL {
-        if recorder?.isRecording == true {
-            throw RecorderError.recordingInProgress
-        }
-
-        #if os(iOS)
-        let session = AVAudioSession.sharedInstance()
-        guard session.recordPermission == .granted else {
-            throw RecorderError.microphoneAccessDenied
-        }
-        #if targetEnvironment(simulator)
-        // allowBluetoothHFP is not available on iOS Simulator
-        try session.setCategory(
-            .playAndRecord,
-            mode: .default,
-            options: [.defaultToSpeaker, .allowBluetoothA2DP]
-        )
-        #else
-        try session.setCategory(
-            .playAndRecord,
-            mode: .default,
-            options: [.defaultToSpeaker, .allowBluetoothA2DP, .allowBluetoothHFP]
-        )
-        #endif
-        try session.setActive(true, options: .notifyOthersOnDeactivation)
-        #endif
-        #if os(macOS)
-        guard AVCaptureDevice.authorizationStatus(for: .audio) == .authorized else {
-            throw RecorderError.microphoneAccessDenied
-        }
-        #endif
-
-        let outputURL = try makeOutputURL()
-        let settings: [String: Any] = [
-            AVFormatIDKey: kAudioFormatMPEG4AAC,
-            AVSampleRateKey: 16_000,
-            AVNumberOfChannelsKey: 1,
-            AVEncoderBitRateKey: 16_000
-        ]
-
-        let audioRecorder = try AVAudioRecorder(url: outputURL, settings: settings)
-        audioRecorder.isMeteringEnabled = true
-        audioRecorder.prepareToRecord()
-        audioRecorder.record(forDuration: maxRecordingDuration)
-
-        recorder = audioRecorder
-        currentURL = outputURL
-        return outputURL
-    }
-
-    func stopRecording() async -> URL? {
-        guard let recorder, recorder.isRecording else {
-            return currentURL
-        }
-
-        let sessionURL = currentURL
-
-        try? await Task.sleep(nanoseconds: UInt64(paddingInterval * 1_000_000_000))
-
-        recorder.stop()
-
-        // A new session may have started during the sleep — don't touch its state
-        if self.recorder === recorder {
-            cleanupSession()
-            self.recorder = nil
-            currentURL = nil
-        }
-
-        return sessionURL
-    }
-
-    func cancelRecording() {
-        if let recorder, recorder.isRecording {
-            recorder.stop()
-        }
-        cleanupSession()
-        if let currentURL {
-            try? FileManager.default.removeItem(at: currentURL)
-        }
-        recorder = nil
-        currentURL = nil
-    }
-
-    // MARK: - Helpers
-
-    private func makeOutputURL() throws -> URL {
-        let formatter = DateFormatter()
-        formatter.dateFormat = "yyyyMMdd_HHmmss"
-        let fileName = "voice_\(formatter.string(from: Date())).m4a"
-
-        let baseDirectory = try applicationFilesDirectory().appendingPathComponent("voicenotes/outgoing", isDirectory: true)
-        try FileManager.default.createDirectory(at: baseDirectory, withIntermediateDirectories: true, attributes: nil)
-        return baseDirectory.appendingPathComponent(fileName)
-    }
-
-    private func applicationFilesDirectory() throws -> URL {
-        #if os(iOS)
-        return try FileManager.default.url(for: .applicationSupportDirectory, in: .userDomainMask, appropriateFor: nil, create: true)
-            .appendingPathComponent("files", isDirectory: true)
-        #else
-        let base = try FileManager.default.url(for: .applicationSupportDirectory, in: .userDomainMask, appropriateFor: nil, create: true)
-        return base.appendingPathComponent("files", isDirectory: true)
-        #endif
-    }
-
-    private func cleanupSession() {
-        #if os(iOS)
-        try? AVAudioSession.sharedInstance().setActive(false, options: .notifyOthersOnDeactivation)
-        #endif
-    }
-}
@@ -1,107 +0,0 @@
-import AVFoundation
-import Foundation
-import BitLogger
-
-/// Generates and caches downsampled waveforms for audio files so UI rendering is cheap.
-final class WaveformCache {
-    static let shared = WaveformCache()
-
-    private let queue = DispatchQueue(label: "com.bitchat.waveform-cache", attributes: .concurrent)
-    private var cache: [URL: (waveform: [Float], lastAccess: Date)] = [:]
-    private let maxCacheSize = 20  // Limit cache to prevent unbounded memory growth
-
-    private init() {}
-
-    func cachedWaveform(for url: URL) -> [Float]? {
-        queue.sync {
-            guard let entry = cache[url] else { return nil }
-            return entry.waveform
-        }
-    }
-
-    func waveform(for url: URL, bins: Int = 120, completion: @escaping ([Float]) -> Void) {
-        queue.async { [weak self] in
-            guard let self = self else { return }
-
-            // Check cache (read-only, no update needed on cache hit for performance)
-            if let entry = self.cache[url] {
-                DispatchQueue.main.async { completion(entry.waveform) }
-                return
-            }
-
-            guard let computed = self.computeWaveform(url: url, bins: bins) else {
-                DispatchQueue.main.async { completion([]) }
-                return
-            }
-
-            self.queue.async(flags: .barrier) { [weak self] in
-                guard let self = self else { return }
-
-                // Evict oldest entry if cache is full
-                if self.cache.count >= self.maxCacheSize {
-                    if let oldest = self.cache.min(by: { $0.value.lastAccess < $1.value.lastAccess }) {
-                        self.cache.removeValue(forKey: oldest.key)
-                    }
-                }
-
-                self.cache[url] = (computed, Date())
-            }
-            DispatchQueue.main.async { completion(computed) }
-        }
-    }
-
-    func purge(url: URL) {
-        queue.async(flags: .barrier) { [weak self] in
-            self?.cache.removeValue(forKey: url)
-        }
-    }
-
-    private func computeWaveform(url: URL, bins: Int) -> [Float]? {
-        guard bins > 0 else { return nil }
-        // Use autoreleasepool to manage memory from audio buffer allocations
-        return autoreleasepool {
-            do {
-                let audioFile = try AVAudioFile(forReading: url)
-                let length = Int(audioFile.length)
-                guard length > 0 else { return nil }
-
-                guard let buffer = AVAudioPCMBuffer(pcmFormat: audioFile.processingFormat, frameCapacity: AVAudioFrameCount(length)) else {
-                    return nil
-                }
-                try audioFile.read(into: buffer, frameCount: AVAudioFrameCount(length))
-                guard let channelData = buffer.floatChannelData else { return nil }
-
-                let channelCount = Int(audioFile.processingFormat.channelCount)
-                let frameLength = Int(buffer.frameLength)
-                let samplesPerBin = max(1, frameLength / bins)
-
-                var magnitudes: [Float] = Array(repeating: 0, count: bins)
-                for bin in 0..<bins {
-                    let start = bin * samplesPerBin
-                    let end = min(frameLength, start + samplesPerBin)
-                    if start >= end { break }
-
-                    var sum: Float = 0
-                    var sampleCount = 0
-                    for frame in start..<end {
-                        var sampleValue: Float = 0
-                        for channel in 0..<channelCount {
-                            sampleValue += fabsf(channelData[channel][frame])
-                        }
-                        sum += sampleValue / Float(channelCount)
-                        sampleCount += 1
-                    }
-                    magnitudes[bin] = sampleCount > 0 ? sum / Float(sampleCount) : 0
-                }
-
-                if let maxMagnitude = magnitudes.max(), maxMagnitude > 0 {
-                    magnitudes = magnitudes.map { min($0 / maxMagnitude, 1.0) }
-                }
-                return magnitudes
-            } catch {
-                SecureLogger.error("Waveform extraction failed for \(url.lastPathComponent): \(error)", category: .session)
-                return nil
-            }
-        }
-    }
-}
@@ -81,13 +81,14 @@
 ///

 import Foundation
-import BitFoundation

 // MARK: - Three-Layer Identity Model

 /// Represents the ephemeral layer of identity - short-lived peer IDs that provide network privacy.
 /// These IDs rotate periodically to prevent tracking while maintaining cryptographic relationships.
 struct EphemeralIdentity {
+    let peerID: PeerID          // 8 random bytes
+    let sessionStart: Date
    var handshakeState: HandshakeState
 }

@@ -96,6 +97,7 @@ enum HandshakeState {
    case initiated
    case inProgress
    case completed(fingerprint: String)
+    case failed(reason: String)
 }

 /// Represents the cryptographic layer of identity - the stable Noise Protocol static key pair.
@@ -107,6 +109,7 @@ struct CryptographicIdentity: Codable {
    // Optional Ed25519 signing public key (used to authenticate public messages)
    var signingPublicKey: Data? = nil
    let firstSeen: Date
+    let lastHandshake: Date?
 }

 /// Represents the social layer of identity - user-assigned names and trust relationships.
@@ -122,35 +125,11 @@ struct SocialIdentity: Codable {
    var notes: String?
 }

-/// Trust ladder: unknown → casual → vouched → trusted → verified.
-///
-/// Persistence compatibility: `TrustLevel` is stored by its *String* raw
-/// value ("unknown", "casual", …), not by ordinal position, so inserting
-/// `vouched` mid-ladder cannot corrupt previously persisted values — every
-/// pre-existing case keeps the exact raw value it was written with. The
-/// `vouched` tier is additionally never persisted into `SocialIdentity`
-/// (it's recomputed on read from stored vouches), so downgraded builds never
-/// encounter the unfamiliar raw value.
 enum TrustLevel: String, Codable {
-    case unknown
-    case casual
-    /// Transitively trusted: vouched for by at least one peer *I* verified.
-    /// Derived at read time — never written to persistent storage.
-    case vouched
-    case trusted
-    case verified
-}
-
-// MARK: - Vouching (transitive verification)
-
-/// One accepted vouch: a peer I verified (the voucher) attested that they
-/// verified the vouchee. Validity is recomputed on read — a record only
-/// counts while its voucher remains in `verifiedFingerprints` and its
-/// timestamp is within `VouchAttestation.maxAge` — so unverifying a voucher
-/// silently invalidates the vouches they gave without a cascade delete.
-struct VouchRecord: Codable, Equatable {
-    let voucherFingerprint: String
-    let timestamp: Date
+    case unknown = "unknown"
+    case casual = "casual"
+    case trusted = "trusted"
+    case verified = "verified"
 }

 // MARK: - Identity Cache
@@ -174,21 +153,9 @@ struct IdentityCache: Codable {
    
    // Blocked Nostr pubkeys (lowercased hex) for geohash chats
    var blockedNostrPubkeys: Set<String> = []
-
-    // Vouching (transitive verification). All three fields are Optional so
-    // caches persisted before this feature decode cleanly — the synthesized
-    // decoder uses decodeIfPresent for optionals, and a missing key must not
-    // trip the "unreadable cache" recovery path that discards everything.
-
-    // Vouchee fingerprint -> accepted vouches (capped per vouchee)
-    var vouchesByVouchee: [String: [VouchRecord]]? = nil
-
-    // Peer fingerprint -> when we last sent them a vouch batch (rate limit)
-    var vouchBatchSentAt: [String: Date]? = nil
-
-    // Fingerprint -> when we verified it (orders outgoing vouch batches;
-    // entries verified before this field exists sort as oldest)
-    var verifiedAt: [String: Date]? = nil
+    
+    // Schema version for future migrations
+    var version: Int = 1
 }

 //
@@ -91,7 +91,6 @@
 ///

 import BitLogger
-import BitFoundation
 import Foundation
 import CryptoKit

@@ -108,6 +107,8 @@ protocol SecureIdentityStateManagerProtocol {
    func updateSocialIdentity(_ identity: SocialIdentity)
    
    // MARK: Favorites Management
+    func getFavorites() -> Set<String>
+    func setFavorite(_ fingerprint: String, isFavorite: Bool)
    func isFavorite(fingerprint: String) -> Bool
    
    // MARK: Blocked Users Management
@@ -121,7 +122,8 @@ protocol SecureIdentityStateManagerProtocol {
    
    // MARK: Ephemeral Session Management
    func registerEphemeralSession(peerID: PeerID, handshakeState: HandshakeState)
-
+    func updateHandshakeState(peerID: PeerID, state: HandshakeState)
+    
    // MARK: Cleanup
    func clearAllIdentityData()
    func removeEphemeralSession(peerID: PeerID)
@@ -130,16 +132,6 @@ protocol SecureIdentityStateManagerProtocol {
    func setVerified(fingerprint: String, verified: Bool)
    func isVerified(fingerprint: String) -> Bool
    func getVerifiedFingerprints() -> Set<String>
-
-    // MARK: Vouching (transitive verification)
-    @discardableResult
-    func recordVouch(voucheeFingerprint: String, voucherFingerprint: String, timestamp: Date) -> Bool
-    func validVouchers(for fingerprint: String) -> [VouchRecord]
-    func isVouched(fingerprint: String) -> Bool
-    func lastVouchBatchSent(to fingerprint: String) -> Date?
-    func markVouchBatchSent(to fingerprint: String, at date: Date)
-    func signingPublicKey(forFingerprint fingerprint: String) -> Data?
-    func mostRecentlyVerifiedFingerprints(limit: Int, excluding fingerprint: String) -> [String]
 }

 /// Singleton manager for secure identity state persistence and retrieval.
@@ -158,68 +150,38 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
    // Thread safety
    private let queue = DispatchQueue(label: "bitchat.identity.state", attributes: .concurrent)
    
-    // Pending-save coalescing flag. Reads/writes are serialized on `queue`.
-    // Persistence is done with a fire-and-forget `queue.async(.barrier)` rather
-    // than a retained DispatchSourceTimer: a lingering, never-cancelled timer
-    // keeps the dispatch machinery alive and prevents the unit-test process from
-    // exiting. (The original code used Timer.scheduledTimer on a GCD queue with
-    // no run loop, so saves never actually fired.)
+    // Debouncing for keychain saves
+    private var saveTimer: Timer?
+    private let saveDebounceInterval: TimeInterval = 2.0  // Save at most once every 2 seconds
    private var pendingSave = false
-
+    
    // Encryption key
    private let encryptionKey: SymmetricKey
-    /// True when `encryptionKey` is a throwaway generated this session because the
-    /// persisted key could not be read (device locked / access denied). In that
-    /// state we must NOT persist (it would overwrite the real cache with data the
-    /// next launch can't decrypt) and must NOT delete the existing cache.
-    private let encryptionKeyIsEphemeral: Bool
    
    init(_ keychain: KeychainManagerProtocol) {
        self.keychain = keychain
-
-        // Retrieve (or, only on genuine first run, generate) the cache
-        // encryption key. We MUST distinguish "key doesn't exist yet" from a
-        // transient failure (device locked / access denied): the legacy
-        // getIdentityKey(forKey:) collapses both to nil, and generating+saving a
-        // new key deletes the existing one first — permanently orphaning the
-        // encrypted cache on a launch that merely couldn't read the key.
+        
+        // Generate or retrieve encryption key from keychain
        let loadedKey: SymmetricKey
-        let keyIsEphemeral: Bool
-
-        switch keychain.getIdentityKeyWithResult(forKey: encryptionKeyName) {
-        case .success(let keyData):
+        
+        // Try to load from keychain
+        if let keyData = keychain.getIdentityKey(forKey: encryptionKeyName) {
            loadedKey = SymmetricKey(data: keyData)
-            keyIsEphemeral = false
            SecureLogger.logKeyOperation(.load, keyType: "identity cache encryption key", success: true)
-
-        case .itemNotFound:
-            // Genuine first run: generate and persist a new key.
-            let newKey = SymmetricKey(size: .bits256)
-            let keyData = newKey.withUnsafeBytes { Data($0) }
-            let saved = keychain.saveIdentityKey(keyData, forKey: encryptionKeyName)
-            loadedKey = newKey
-            // If even the save failed, treat the key as ephemeral so we don't
-            // later try to persist a cache the next launch can't read.
-            keyIsEphemeral = !saved
-            SecureLogger.logKeyOperation(.generate, keyType: "identity cache encryption key", success: saved)
-
-        case .deviceLocked, .authenticationFailed, .accessDenied, .otherError:
-            // Transient/critical read failure. Do NOT overwrite the persisted
-            // key. Use a session-only ephemeral key; the real key and cache are
-            // left intact for a healthy launch.
-            SecureLogger.warning("Identity cache key unavailable; using ephemeral key for this session (not persisting)", category: .security)
+        }
+        // Generate new key if needed
+        else {
            loadedKey = SymmetricKey(size: .bits256)
-            keyIsEphemeral = true
+            let keyData = loadedKey.withUnsafeBytes { Data($0) }
+            // Save to keychain
+            let saved = keychain.saveIdentityKey(keyData, forKey: encryptionKeyName)
+            SecureLogger.logKeyOperation(.generate, keyType: "identity cache encryption key", success: saved)
        }
-
+        
        self.encryptionKey = loadedKey
-        self.encryptionKeyIsEphemeral = keyIsEphemeral
-
-        // Only read the persisted cache when we hold the real key; with an
-        // ephemeral key the decrypt would fail and discard the real cache.
-        if !keyIsEphemeral {
-            loadIdentityCache()
-        }
+        
+        // Load identity cache on init
+        loadIdentityCache()
    }
    
    deinit {
@@ -239,37 +201,28 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
            let decryptedData = try AES.GCM.open(sealedBox, using: encryptionKey)
            cache = try JSONDecoder().decode(IdentityCache.self, from: decryptedData)
        } catch {
-            cache = IdentityCache()
-            let deleted = keychain.deleteIdentityKey(forKey: cacheKey)
-            SecureLogger.warning(
-                "Discarded unreadable identity cache; starting fresh (deleted=\(deleted), error=\(error.localizedDescription))",
-                category: .security
-            )
+            // Log error but continue with empty cache
+            SecureLogger.error(error, context: "Failed to load identity cache", category: .security)
        }
    }
    
-    /// Persists the cache. Always invoked on `queue` under a barrier (its callers
-    /// run inside `queue.async(.barrier)`), so it simply marks the cache dirty
-    /// and persists it on the same serialized context — no timer, nothing left
-    /// scheduled to keep the process alive.
    private func saveIdentityCache() {
+        // Mark that we need to save
        pendingSave = true
-        performSave()
+        
+        // Cancel any existing timer
+        saveTimer?.invalidate()
+        
+        // Schedule a new save after the debounce interval
+        saveTimer = Timer.scheduledTimer(withTimeInterval: saveDebounceInterval, repeats: false) { [weak self] _ in
+            self?.performSave()
+        }
    }
-
-    /// Writes the cache to the keychain. Must run on `queue` with exclusive
-    /// (barrier) access.
+    
    private func performSave() {
        guard pendingSave else { return }
        pendingSave = false
-
-        // Never persist under an ephemeral key — it would overwrite the real
-        // cache with data the next launch cannot decrypt.
-        guard !encryptionKeyIsEphemeral else {
-            SecureLogger.debug("Skipping identity cache save (ephemeral key this session)", category: .security)
-            return
-        }
-
+        
        do {
            let data = try JSONEncoder().encode(cache)
            let sealedBox = try AES.GCM.seal(data, using: encryptionKey)
@@ -281,14 +234,10 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
            SecureLogger.error(error, context: "Failed to save identity cache", category: .security)
        }
    }
-
-    // Force immediate save (for app termination / lifecycle events). Mutations
-    // already persist synchronously via saveIdentityCache, so this is normally a
-    // no-op (performSave early-returns when nothing is pending). Runs directly on
-    // the caller's thread — deliberately NOT a `queue.sync(barrier)`, which is
-    // reachable from `deinit` and from async tests on the swift-concurrency
-    // cooperative pool where a blocking barrier-sync can starve/deadlock it.
+    
+    // Force immediate save (for app termination)
    func forceSave() {
+        saveTimer?.invalidate()
        performSave()
    }
    
@@ -318,13 +267,21 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
                        fingerprint: fingerprint,
                        publicKey: noisePublicKey,
                        signingPublicKey: signingPublicKey ?? existing.signingPublicKey,
-                        firstSeen: existing.firstSeen
+                        firstSeen: existing.firstSeen,
+                        lastHandshake: now
                    )
                    self.cryptographicIdentities[fingerprint] = existing
                } else {
-                    // Update signing key
+                    // Update signing key and lastHandshake
                    existing.signingPublicKey = signingPublicKey ?? existing.signingPublicKey
-                    self.cryptographicIdentities[fingerprint] = existing
+                    let updated = CryptographicIdentity(
+                        fingerprint: existing.fingerprint,
+                        publicKey: existing.publicKey,
+                        signingPublicKey: existing.signingPublicKey,
+                        firstSeen: existing.firstSeen,
+                        lastHandshake: now
+                    )
+                    self.cryptographicIdentities[fingerprint] = updated
                }
                // Persist updated state (already assigned in branches above)
            } else {
@@ -333,7 +290,8 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
                    fingerprint: fingerprint,
                    publicKey: noisePublicKey,
                    signingPublicKey: signingPublicKey,
-                    firstSeen: now
+                    firstSeen: now,
+                    lastHandshake: now
                )
                self.cryptographicIdentities[fingerprint] = entry
            }
@@ -373,15 +331,16 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
    
    func updateSocialIdentity(_ identity: SocialIdentity) {
        queue.async(flags: .barrier) {
-            let previousClaimedNickname = self.cache.socialIdentities[identity.fingerprint]?.claimedNickname
            self.cache.socialIdentities[identity.fingerprint] = identity
            
            // Update nickname index
-            if let previousClaimedNickname,
-               previousClaimedNickname != identity.claimedNickname {
-                self.cache.nicknameIndex[previousClaimedNickname]?.remove(identity.fingerprint)
-                if self.cache.nicknameIndex[previousClaimedNickname]?.isEmpty == true {
-                    self.cache.nicknameIndex.removeValue(forKey: previousClaimedNickname)
+            if let existingIdentity = self.cache.socialIdentities[identity.fingerprint] {
+                // Remove old nickname from index if changed
+                if existingIdentity.claimedNickname != identity.claimedNickname {
+                    self.cache.nicknameIndex[existingIdentity.claimedNickname]?.remove(identity.fingerprint)
+                    if self.cache.nicknameIndex[existingIdentity.claimedNickname]?.isEmpty == true {
+                        self.cache.nicknameIndex.removeValue(forKey: existingIdentity.claimedNickname)
+                    }
                }
            }
            
@@ -498,7 +457,11 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
    
    func registerEphemeralSession(peerID: PeerID, handshakeState: HandshakeState = .none) {
        queue.async(flags: .barrier) {
-            self.ephemeralSessions[peerID] = EphemeralIdentity(handshakeState: handshakeState)
+            self.ephemeralSessions[peerID] = EphemeralIdentity(
+                peerID: peerID,
+                sessionStart: Date(),
+                handshakeState: handshakeState
+            )
        }
    }
    
@@ -544,20 +507,16 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
        queue.async(flags: .barrier) {
            if verified {
                self.cache.verifiedFingerprints.insert(fingerprint)
-                var verifiedAt = self.cache.verifiedAt ?? [:]
-                verifiedAt[fingerprint] = Date()
-                self.cache.verifiedAt = verifiedAt
            } else {
                self.cache.verifiedFingerprints.remove(fingerprint)
-                self.cache.verifiedAt?.removeValue(forKey: fingerprint)
            }
-
+            
            // Update trust level if social identity exists
            if var identity = self.cache.socialIdentities[fingerprint] {
                identity.trustLevel = verified ? .verified : .casual
                self.cache.socialIdentities[fingerprint] = identity
            }
-
+            
            self.saveIdentityCache()
        }
    }
@@ -573,169 +532,4 @@ final class SecureIdentityStateManager: SecureIdentityStateManagerProtocol {
            return cache.verifiedFingerprints
        }
    }
-
-    // MARK: - Vouching (transitive verification)
-
-    /// Maximum vouchers retained per vouchee (most recent kept).
-    static let maxVouchersPerVouchee = 8
-
-    /// Records an accepted vouch, enforcing every accept-policy gate that can
-    /// be evaluated against stored state (signature verification is the
-    /// caller's job — it needs the sender's announce-bound signing key):
-    /// - the voucher must be a fingerprint *I* verified
-    /// - self-vouches are ignored
-    /// - vouches for peers I already verified are ignored (nothing to add)
-    /// - attestations outside the validity window are ignored
-    /// - at most `maxVouchersPerVouchee` vouchers are kept per vouchee
-    ///
-    /// Returns true when the vouch was stored (or refreshed).
-    @discardableResult
-    func recordVouch(voucheeFingerprint: String, voucherFingerprint: String, timestamp: Date) -> Bool {
-        recordVouch(
-            voucheeFingerprint: voucheeFingerprint,
-            voucherFingerprint: voucherFingerprint,
-            timestamp: timestamp,
-            now: Date()
-        )
-    }
-
-    @discardableResult
-    func recordVouch(voucheeFingerprint: String, voucherFingerprint: String, timestamp: Date, now: Date) -> Bool {
-        queue.sync(flags: .barrier) {
-            guard voucheeFingerprint != voucherFingerprint,
-                  self.cache.verifiedFingerprints.contains(voucherFingerprint),
-                  !self.cache.verifiedFingerprints.contains(voucheeFingerprint) else {
-                return false
-            }
-            let age = now.timeIntervalSince(timestamp)
-            guard age <= VouchAttestation.maxAge, age >= -VouchAttestation.maxClockSkew else {
-                return false
-            }
-
-            var records = self.cache.vouchesByVouchee?[voucheeFingerprint] ?? []
-            if let index = records.firstIndex(where: { $0.voucherFingerprint == voucherFingerprint }) {
-                let newest = max(records[index].timestamp, timestamp)
-                records[index] = VouchRecord(voucherFingerprint: voucherFingerprint, timestamp: newest)
-            } else {
-                records.append(VouchRecord(voucherFingerprint: voucherFingerprint, timestamp: timestamp))
-            }
-            // Keep the most recent vouchers up to the cap.
-            records.sort { $0.timestamp > $1.timestamp }
-            let capped = Array(records.prefix(Self.maxVouchersPerVouchee))
-            guard capped.contains(where: { $0.voucherFingerprint == voucherFingerprint }) else {
-                return false // Full of fresher vouches; nothing changed.
-            }
-
-            var vouches = self.cache.vouchesByVouchee ?? [:]
-            vouches[voucheeFingerprint] = capped
-            self.cache.vouchesByVouchee = vouches
-            self.saveIdentityCache()
-            return true
-        }
-    }
-
-    /// The vouches that currently count for `fingerprint`. Validity is
-    /// recomputed here rather than maintained by cascade deletes: a record
-    /// only counts while its voucher is still verified-by-me and its
-    /// timestamp is within the expiry window.
-    func validVouchers(for fingerprint: String) -> [VouchRecord] {
-        validVouchers(for: fingerprint, now: Date())
-    }
-
-    func validVouchers(for fingerprint: String, now: Date) -> [VouchRecord] {
-        queue.sync {
-            self.validVouchersLocked(for: fingerprint, now: now)
-        }
-    }
-
-    /// Requires `queue`.
-    private func validVouchersLocked(for fingerprint: String, now: Date) -> [VouchRecord] {
-        guard let records = cache.vouchesByVouchee?[fingerprint] else { return [] }
-        return records.filter { record in
-            record.voucherFingerprint != fingerprint
-                && cache.verifiedFingerprints.contains(record.voucherFingerprint)
-                && now.timeIntervalSince(record.timestamp) <= VouchAttestation.maxAge
-        }
-    }
-
-    /// True when the peer has at least one valid vouch and no explicit
-    /// verification of ours.
-    func isVouched(fingerprint: String) -> Bool {
-        isVouched(fingerprint: fingerprint, now: Date())
-    }
-
-    func isVouched(fingerprint: String, now: Date) -> Bool {
-        queue.sync {
-            guard !self.cache.verifiedFingerprints.contains(fingerprint) else { return false }
-            return !self.validVouchersLocked(for: fingerprint, now: now).isEmpty
-        }
-    }
-
-    /// The trust level to display: explicit verification wins, then the
-    /// persisted level, with `vouched` layered in (derived, never persisted)
-    /// between `casual` and `trusted`.
-    func effectiveTrustLevel(for fingerprint: String) -> TrustLevel {
-        effectiveTrustLevel(for: fingerprint, now: Date())
-    }
-
-    func effectiveTrustLevel(for fingerprint: String, now: Date) -> TrustLevel {
-        queue.sync {
-            if self.cache.verifiedFingerprints.contains(fingerprint) { return .verified }
-            let stored = self.cache.socialIdentities[fingerprint]?.trustLevel ?? .unknown
-            let vouched = !self.validVouchersLocked(for: fingerprint, now: now).isEmpty
-            switch stored {
-            case .verified, .trusted:
-                return stored
-            case .vouched, .casual, .unknown:
-                if vouched { return .vouched }
-                // `.vouched` should never be persisted; degrade defensively.
-                return stored == .vouched ? .casual : stored
-            }
-        }
-    }
-
-    func lastVouchBatchSent(to fingerprint: String) -> Date? {
-        queue.sync { cache.vouchBatchSentAt?[fingerprint] }
-    }
-
-    func markVouchBatchSent(to fingerprint: String, at date: Date) {
-        queue.async(flags: .barrier) {
-            var sentAt = self.cache.vouchBatchSentAt ?? [:]
-            sentAt[fingerprint] = date
-            self.cache.vouchBatchSentAt = sentAt
-            self.saveIdentityCache()
-        }
-    }
-
-    /// The peer's announce-bound Ed25519 signing key, if seen this session.
-    func signingPublicKey(forFingerprint fingerprint: String) -> Data? {
-        queue.sync { cryptographicIdentities[fingerprint]?.signingPublicKey }
-    }
-
-    /// Verified fingerprints ordered most recently verified first (entries
-    /// without a recorded verification time sort last), excluding the given
-    /// fingerprint. Feeds the outgoing vouch batch.
-    func mostRecentlyVerifiedFingerprints(limit: Int, excluding fingerprint: String) -> [String] {
-        queue.sync {
-            let verifiedAt = cache.verifiedAt ?? [:]
-            let ordered = cache.verifiedFingerprints
-                .filter { $0 != fingerprint }
-                .sorted {
-                    (verifiedAt[$0] ?? .distantPast, $0) > (verifiedAt[$1] ?? .distantPast, $1)
-                }
-            return Array(ordered.prefix(limit))
-        }
-    }
-
-    var debugNicknameIndex: [String: Set<String>] {
-        queue.sync { cache.nicknameIndex }
-    }
-
-    func debugEphemeralSession(for peerID: PeerID) -> EphemeralIdentity? {
-        queue.sync { ephemeralSessions[peerID] }
-    }
-
-    func debugLastInteraction(for fingerprint: String) -> Date? {
-        queue.sync { cache.lastInteractions[fingerprint] }
-    }
 }
@@ -2,8 +2,6 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>AppGroupID</key>
-	<string>$(APP_GROUP_ID)</string>
 	<key>CFBundleDevelopmentRegion</key>
 	<string>$(DEVELOPMENT_LANGUAGE)</string>
 	<key>CFBundleDisplayName</key>
@@ -41,10 +39,6 @@
 	<string>bitchat uses the camera to scan QR codes to verify peers.</string>
 	<key>NSLocationWhenInUseUsageDescription</key>
 	<string>bitchat uses your approximate location to compute local geohash channels for optional public chats. Exact GPS is never shared.</string>
-	<key>NSMicrophoneUsageDescription</key>
-	<string>bitchat uses the microphone to record voice notes that relay across the mesh.</string>
-	<key>NSPhotoLibraryUsageDescription</key>
-	<string>bitchat lets you pick images from your photo library to share with nearby peers.</string>
 	<key>UIBackgroundModes</key>
 	<array>
 		<string>bluetooth-central</string>
@@ -1,62 +0,0 @@
-//
-// BitchatMessage+Media.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import BitFoundation
-import Foundation
-
-extension BitchatMessage {
-    enum Media {
-        case voice(URL)
-        case image(URL)
-    }
-
-    // Cache the directory lookup to avoid repeated FileManager calls during view rendering
-    private struct Cache {
-        let filesDir: URL?
-
-        static let shared = Cache()
-        private init() {
-            do {
-                let base = try FileManager.default.url(for: .applicationSupportDirectory, in: .userDomainMask, appropriateFor: nil, create: true)
-                let filesDir = base.appendingPathComponent("files", isDirectory: true)
-                try FileManager.default.createDirectory(at: filesDir, withIntermediateDirectories: true, attributes: nil)
-                self.filesDir = filesDir
-            } catch {
-                filesDir = nil
-            }
-        }
-    }
-
-    func mediaAttachment(for nickname: String) -> Media? {
-        guard let baseDirectory = Cache.shared.filesDir else { return nil }
-
-        func url(for category: MimeType.Category) -> URL? {
-            guard content.hasPrefix(category.messagePrefix),
-                  let filename = String(content.dropFirst(category.messagePrefix.count)).trimmedOrNilIfEmpty
-            else {
-                return nil
-            }
-
-            // Check outgoing first for sent messages, incoming for received
-            let subdir = sender == nickname ? "\(category.mediaDir)/outgoing" : "\(category.mediaDir)/incoming"
-
-            // Construct URL directly without fileExists check (avoids blocking disk I/O in view body)
-            // Files are checked during playback/display, so missing files fail gracefully
-            let directory = baseDirectory.appendingPathComponent(subdir, isDirectory: true)
-            return directory.appendingPathComponent(filename)
-        }
-
-        if let url = url(for: .audio) {
-            return .voice(url)
-        }
-        if let url = url(for: .image) {
-            return .image(url)
-        }
-        return nil
-    }
-}
@@ -6,70 +6,43 @@
 // For more information, see <https://unlicense.org>
 //

-import class Foundation.DateFormatter
-
-import struct Foundation.AttributedString
-import struct Foundation.Data
-import struct Foundation.Date
-import struct Foundation.TimeInterval
-import struct Foundation.UUID
+import Foundation

 /// Represents a user-visible message in the BitChat system.
 /// Handles both broadcast messages and private encrypted messages,
 /// with support for mentions, replies, and delivery tracking.
 /// - Note: This is the primary data model for chat messages
-public final class BitchatMessage: Codable {
-    public let id: String
-    public let sender: String
-    public let content: String
-    public let timestamp: Date
-    public let isRelay: Bool
-    public let originalSender: String?
-    public let isPrivate: Bool
-    public let recipientNickname: String?
-    public let senderPeerID: PeerID?
-    public let mentions: [String]?  // Array of mentioned nicknames
-    public var deliveryStatus: DeliveryStatus? // Delivery tracking
-    /// True when this message reached us across a mesh bridge (signed by its
-    /// author for an internet rendezvous) rather than over local radio.
-    public let isBridged: Bool
-
+final class BitchatMessage: Codable {
+    let id: String
+    let sender: String
+    let content: String
+    let timestamp: Date
+    let isRelay: Bool
+    let originalSender: String?
+    let isPrivate: Bool
+    let recipientNickname: String?
+    let senderPeerID: PeerID?
+    let mentions: [String]?  // Array of mentioned nicknames
+    var deliveryStatus: DeliveryStatus? // Delivery tracking
+    
    // Cached formatted text (not included in Codable)
    private var _cachedFormattedText: [String: AttributedString] = [:]
    
-    public func getCachedFormattedText(isDark: Bool, isSelf: Bool, variant: String = "") -> AttributedString? {
-        return _cachedFormattedText["\(variant)\(isDark)-\(isSelf)"]
+    func getCachedFormattedText(isDark: Bool, isSelf: Bool) -> AttributedString? {
+        return _cachedFormattedText["\(isDark)-\(isSelf)"]
    }
-
-    public func setCachedFormattedText(_ text: AttributedString, isDark: Bool, isSelf: Bool, variant: String = "") {
-        _cachedFormattedText["\(variant)\(isDark)-\(isSelf)"] = text
+    
+    func setCachedFormattedText(_ text: AttributedString, isDark: Bool, isSelf: Bool) {
+        _cachedFormattedText["\(isDark)-\(isSelf)"] = text
    }
    
    // Codable implementation
    enum CodingKeys: String, CodingKey {
        case id, sender, content, timestamp, isRelay, originalSender
        case isPrivate, recipientNickname, senderPeerID, mentions, deliveryStatus
-        case isBridged
    }
-
-    public init(from decoder: any Decoder) throws {
-        let container = try decoder.container(keyedBy: CodingKeys.self)
-        id = try container.decode(String.self, forKey: .id)
-        sender = try container.decode(String.self, forKey: .sender)
-        content = try container.decode(String.self, forKey: .content)
-        timestamp = try container.decode(Date.self, forKey: .timestamp)
-        isRelay = try container.decode(Bool.self, forKey: .isRelay)
-        originalSender = try container.decodeIfPresent(String.self, forKey: .originalSender)
-        isPrivate = try container.decode(Bool.self, forKey: .isPrivate)
-        recipientNickname = try container.decodeIfPresent(String.self, forKey: .recipientNickname)
-        senderPeerID = try container.decodeIfPresent(PeerID.self, forKey: .senderPeerID)
-        mentions = try container.decodeIfPresent([String].self, forKey: .mentions)
-        deliveryStatus = try container.decodeIfPresent(DeliveryStatus.self, forKey: .deliveryStatus)
-        // Absent in archives written before bridging existed.
-        isBridged = try container.decodeIfPresent(Bool.self, forKey: .isBridged) ?? false
-    }
-
-    public init(
+    
+    init(
        id: String? = nil,
        sender: String,
        content: String,
@@ -80,8 +53,7 @@ public final class BitchatMessage: Codable {
        recipientNickname: String? = nil,
        senderPeerID: PeerID? = nil,
        mentions: [String]? = nil,
-        deliveryStatus: DeliveryStatus? = nil,
-        isBridged: Bool = false
+        deliveryStatus: DeliveryStatus? = nil
    ) {
        self.id = id ?? UUID().uuidString
        self.sender = sender
@@ -94,14 +66,13 @@ public final class BitchatMessage: Codable {
        self.senderPeerID = senderPeerID
        self.mentions = mentions
        self.deliveryStatus = deliveryStatus ?? (isPrivate ? .sending : nil)
-        self.isBridged = isBridged
    }
 }

 // MARK: - Equatable Conformance

 extension BitchatMessage: Equatable {
-    public static func == (lhs: BitchatMessage, rhs: BitchatMessage) -> Bool {
+    static func == (lhs: BitchatMessage, rhs: BitchatMessage) -> Bool {
        return lhs.id == rhs.id &&
               lhs.sender == rhs.sender &&
               lhs.content == rhs.content &&
@@ -112,8 +83,7 @@ extension BitchatMessage: Equatable {
               lhs.recipientNickname == rhs.recipientNickname &&
               lhs.senderPeerID == rhs.senderPeerID &&
               lhs.mentions == rhs.mentions &&
-               lhs.deliveryStatus == rhs.deliveryStatus &&
-               lhs.isBridged == rhs.isBridged
+               lhs.deliveryStatus == rhs.deliveryStatus
    }
 }

@@ -145,7 +115,6 @@ extension BitchatMessage {
        if recipientNickname != nil { flags |= 0x08 }
        if senderPeerID != nil { flags |= 0x10 }
        if mentions != nil && !mentions!.isEmpty { flags |= 0x20 }
-        if isBridged { flags |= 0x40 }
        
        data.append(flags)
        
@@ -238,7 +207,6 @@ extension BitchatMessage {
        let hasRecipientNickname = (flags & 0x08) != 0
        let hasSenderPeerID = (flags & 0x10) != 0
        let hasMentions = (flags & 0x20) != 0
-        let isBridged = (flags & 0x40) != 0
        
        // Timestamp
        guard offset + 8 <= dataCopy.count else {
@@ -347,8 +315,7 @@ extension BitchatMessage {
            isPrivate: isPrivate,
            recipientNickname: recipientNickname,
            senderPeerID: senderPeerID,
-            mentions: mentions,
-            isBridged: isBridged
+            mentions: mentions
        )
    }
 }
@@ -363,8 +330,40 @@ extension BitchatMessage {
        return formatter
    }()
    
-    public var formattedTimestamp: String {
+    var formattedTimestamp: String {
        Self.timestampFormatter.string(from: timestamp)
    }
 }

+// MARK: - System Message Factory
+
+extension BitchatMessage {
+    /// Creates a system message with default values
+    static func system(_ content: String, timestamp: Date = Date()) -> BitchatMessage {
+        return BitchatMessage(
+            sender: "system",
+            content: content,
+            timestamp: timestamp,
+            isRelay: false
+        )
+    }
+}
+
+extension Array where Element == BitchatMessage {
+    /// Filters out empty ones and deduplicate by ID while preserving order (from oldest to newest)
+    func cleanedAndDeduped() -> [Element] {
+        let arr = filter { $0.content.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty == false }
+        guard arr.count > 1 else {
+            return arr
+        }
+        var seen = Set<String>()
+        var dedup: [BitchatMessage] = []
+        for m in arr.sorted(by: { $0.timestamp < $1.timestamp }) {
+            if !seen.contains(m.id) {
+                dedup.append(m)
+                seen.insert(m.id)
+            }
+        }
+        return dedup
+    }
+}
@@ -6,26 +6,24 @@
 // For more information, see <https://unlicense.org>
 //

-import struct Foundation.Data
+import Foundation

 /// The core packet structure for all BitChat protocol messages.
 /// Encapsulates all data needed for routing through the mesh network,
 /// including TTL for hop limiting and optional encryption.
 /// - Note: Packets larger than BLE MTU (512 bytes) are automatically fragmented
-public struct BitchatPacket: Codable {
-    public let version: UInt8
-    public let type: UInt8
-    public let senderID: Data
-    public let recipientID: Data?
-    public let timestamp: UInt64
-    public let payload: Data
-    public var signature: Data?
-    public var ttl: UInt8
-    public var route: [Data]?
-    public var isRSR: Bool
+struct BitchatPacket: Codable {
+    let version: UInt8
+    let type: UInt8
+    let senderID: Data
+    let recipientID: Data?
+    let timestamp: UInt64
+    let payload: Data
+    var signature: Data?
+    var ttl: UInt8
    
-    public init(type: UInt8, senderID: Data, recipientID: Data?, timestamp: UInt64, payload: Data, signature: Data?, ttl: UInt8, version: UInt8 = 1, route: [Data]? = nil, isRSR: Bool = false) {
-        self.version = version
+    init(type: UInt8, senderID: Data, recipientID: Data?, timestamp: UInt64, payload: Data, signature: Data?, ttl: UInt8) {
+        self.version = 1
        self.type = type
        self.senderID = senderID
        self.recipientID = recipientID
@@ -33,22 +31,46 @@ public struct BitchatPacket: Codable {
        self.payload = payload
        self.signature = signature
        self.ttl = ttl
-        self.route = route
-        self.isRSR = isRSR
    }
-
-    public func toBinaryData(padding: Bool = true) -> Data? {
+    
+    // Convenience initializer for new binary format
+    init(type: UInt8, ttl: UInt8, senderID: PeerID, payload: Data) {
+        self.version = 1
+        self.type = type
+        // Convert hex string peer ID to binary data (8 bytes)
+        var senderData = Data()
+        var tempID = senderID.id
+        while tempID.count >= 2 {
+            let hexByte = String(tempID.prefix(2))
+            if let byte = UInt8(hexByte, radix: 16) {
+                senderData.append(byte)
+            }
+            tempID = String(tempID.dropFirst(2))
+        }
+        self.senderID = senderData
+        self.recipientID = nil
+        self.timestamp = UInt64(Date().timeIntervalSince1970 * 1000) // milliseconds
+        self.payload = payload
+        self.signature = nil
+        self.ttl = ttl
+    }
+    
+    var data: Data? {
+        BinaryProtocol.encode(self)
+    }
+    
+    func toBinaryData(padding: Bool = true) -> Data? {
        BinaryProtocol.encode(self, padding: padding)
    }

    // Backward-compatible helper (defaults to padded encoding)
-    public func toBinaryData() -> Data? {
+    func toBinaryData() -> Data? {
        toBinaryData(padding: true)
    }
    
    /// Create binary representation for signing (without signature and TTL fields)
    /// TTL is excluded because it changes during packet relay operations
-    public func toBinaryDataForSigning() -> Data? {
+    func toBinaryDataForSigning() -> Data? {
        // Create a copy without signature and with fixed TTL for signing
        // TTL must be excluded because it changes during relay
        let unsignedPacket = BitchatPacket(
@@ -58,15 +80,12 @@ public struct BitchatPacket: Codable {
            timestamp: timestamp,
            payload: payload,
            signature: nil, // Remove signature for signing
-            ttl: 0, // Use fixed TTL=0 for signing to ensure relay compatibility
-            version: version,
-            route: route,
-            isRSR: false // RSR flag is mutable and not part of the signature
+            ttl: 0 // Use fixed TTL=0 for signing to ensure relay compatibility
        )
        return BinaryProtocol.encode(unsignedPacket)
    }
    
-    public static func from(_ data: Data) -> BitchatPacket? {
+    static func from(_ data: Data) -> BitchatPacket? {
        BinaryProtocol.decode(data)
    }
 }
@@ -1,12 +1,12 @@
 import Foundation
 import CoreBluetooth
-import BitFoundation

 /// Represents a peer in the BitChat network with all associated metadata
 struct BitchatPeer: Equatable {
    let peerID: PeerID // Hex-encoded peer ID
    let noisePublicKey: Data
    let nickname: String
+    let lastSeen: Date
    let isConnected: Bool
    let isReachable: Bool
    
@@ -76,13 +76,14 @@ struct BitchatPeer: Equatable {
        peerID: PeerID,
        noisePublicKey: Data,
        nickname: String,
-        lastSeen _: Date = Date(),
+        lastSeen: Date = Date(),
        isConnected: Bool = false,
        isReachable: Bool = false
    ) {
        self.peerID = peerID
        self.noisePublicKey = noisePublicKey
        self.nickname = nickname
+        self.lastSeen = lastSeen
        self.isConnected = isConnected
        self.isReachable = isReachable
        
@@ -1,88 +0,0 @@
-//
-// CommandsInfo.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import Foundation
-
-// MARK: - CommandInfo Enum
-
-enum CommandInfo: String, Identifiable {
-    // Raw values must match the aliases CommandProcessor actually accepts —
-    // the suggestion panel is the app's only command-discovery surface, and
-    // suggesting a spelling the processor rejects teaches users dead ends.
-    case block
-    case clear
-    case group
-    case help
-    case hug
-    case message = "msg"
-    case slap
-    case pay
-    case unblock
-    case who
-    case favorite = "fav"
-    case unfavorite = "unfav"
-    case ping
-    case trace
-    case drop
-
-    var id: String { rawValue }
-
-    var alias: String { "/" + rawValue }
-
-    var placeholder: String? {
-        switch self {
-        case .block, .hug, .message, .slap, .unblock, .favorite, .unfavorite, .ping, .trace:
-            return "<" + String(localized: "content.input.nickname_placeholder") + ">"
-        case .group:
-            return "<" + String(localized: "content.input.group_placeholder") + ">"
-        case .pay:
-            return "<" + String(localized: "content.input.token_placeholder") + ">"
-        case .drop:
-            return "<" + String(localized: "content.input.note_placeholder") + ">"
-        case .clear, .help, .who:
-            return nil
-        }
-    }
-
-    var description: String {
-        switch self {
-        case .block:        String(localized: "content.commands.block")
-        case .clear:        String(localized: "content.commands.clear")
-        case .group:        String(localized: "content.commands.group")
-        case .help:         String(localized: "content.commands.help")
-        case .hug:          String(localized: "content.commands.hug")
-        case .message:      String(localized: "content.commands.message")
-        case .pay:          String(localized: "content.commands.pay")
-        case .slap:         String(localized: "content.commands.slap")
-        case .unblock:      String(localized: "content.commands.unblock")
-        case .who:          String(localized: "content.commands.who")
-        case .favorite:     String(localized: "content.commands.favorite")
-        case .unfavorite:   String(localized: "content.commands.unfavorite")
-        case .ping:         String(localized: "content.commands.ping")
-        case .trace:        String(localized: "content.commands.trace")
-        case .drop:         String(localized: "content.commands.drop")
-        }
-    }
-
-    static func all(isGeoPublic: Bool, isGeoDM: Bool) -> [CommandInfo] {
-        var commands: [CommandInfo] = [.block, .unblock, .clear, .drop, .help, .hug, .message, .slap, .who]
-        // Cashu tokens are bearer instruments: in a public geohash any nearby
-        // stranger can redeem one, so don't *suggest* /pay there (the
-        // processor still allows it behind an explicit "public" confirm).
-        // Payments make sense in every DM and in mesh public.
-        if !isGeoPublic {
-            commands.append(.pay)
-        }
-        // The processor rejects favorites, groups, and mesh diagnostics in
-        // geohash contexts, so only suggest them where they work: mesh.
-        if isGeoPublic || isGeoDM {
-            return commands
-        }
-        return commands + [.favorite, .unfavorite, .ping, .trace, .group]
-    }
-}
@@ -0,0 +1,16 @@
+//
+// GeoPerson.swift
+// bitchat
+//
+// Model representing a participant in a geohash channel
+// This is free and unencumbered software released into the public domain.
+//
+
+import Foundation
+
+/// Represents a person participating in a geohash-based location channel
+struct GeoPerson: Identifiable, Equatable {
+    let id: String        // pubkey hex (lowercased)
+    let displayName: String
+    let lastSeen: Date
+}
@@ -6,7 +6,7 @@
 // For more information, see <https://unlicense.org>
 //

-import struct Foundation.Data
+import Foundation

 /// Provides privacy-preserving message padding to obscure actual content length.
 /// Uses PKCS#7-style padding with random bytes to prevent traffic analysis.
@@ -1,27 +1,15 @@
 //
 // PeerID.swift
-// BitFoundation
+// bitchat
 //
 // This is free and unencumbered software released into the public domain.
 // For more information, see <https://unlicense.org>
 //

-import struct Foundation.Data
-import struct Foundation.CharacterSet
+import Foundation

-public struct PeerID: Equatable, Hashable, Sendable {
-    enum Constants {
-        /// 16
-        static let nostrConvKeyPrefixLength = 16
-        /// 8
-        static let nostrShortKeyDisplayLength = 8
-        /// 64
-        fileprivate static let maxIDLength = 64
-        /// 16
-        fileprivate static let hexIDLength = 16 // 8 bytes = 16 hex chars
-    }
-
-    public enum Prefix: String, CaseIterable, Sendable {
+struct PeerID: Equatable, Hashable {
+    enum Prefix: String, CaseIterable {
        /// When no prefix is provided
        case empty = ""
        /// `"mesh:"`
@@ -34,49 +22,36 @@ public struct PeerID: Equatable, Hashable, Sendable {
        case geoDM = "nostr_"
        /// `"nostr:"` (+ 8 characters hex)
        case geoChat = "nostr:"
-        /// `"group_"` (+ 32 characters hex) — virtual conversation ID for a
-        /// private group (16-byte group ID). Never routed to a single peer.
-        case group = "group_"
-        /// `"bridge:"` (+ 16 characters hex) — a sender reached across a mesh
-        /// bridge, identified by their rendezvous Nostr pubkey. Not a
-        /// routable mesh peer.
-        case bridge = "bridge:"
    }
-
-    public let prefix: Prefix
-
+    
+    let prefix: Prefix
+    
    /// Returns the actual value without any prefix
-    public let bare: String
-
+    let bare: String
+    
    /// Returns the full `id` value by combining `(prefix + bare)`
-    public var id: String { prefix.rawValue + bare }
-
+    var id: String { prefix.rawValue + bare }
+    
    // Private so the callers have to go through a convenience init
    private init(prefix: Prefix, bare: any StringProtocol) {
        self.prefix = prefix
-        self.bare = String(bare).lowercased()
+        self.bare = String(bare)
    }
 }

 // MARK: - Convenience Inits

-public extension PeerID {
+extension PeerID {
    /// Convenience init to create GeoDM PeerID by appending `"nostr_"` to the first 16 characters of `pubKey`
    init(nostr_ pubKey: String) {
-        self.init(prefix: .geoDM, bare: pubKey.prefix(Constants.nostrConvKeyPrefixLength))
+        self.init(prefix: .geoDM, bare: pubKey.prefix(TransportConfig.nostrConvKeyPrefixLength))
    }
-
+    
    /// Convenience init to create GeoChat PeerID by appending `"nostr:"` to the first 8 characters of `pubKey`
    init(nostr pubKey: String) {
-        self.init(prefix: .geoChat, bare: pubKey.prefix(Constants.nostrShortKeyDisplayLength))
+        self.init(prefix: .geoChat, bare: pubKey.prefix(TransportConfig.nostrShortKeyDisplayLength))
    }
-
-    /// Convenience init to create a bridged-sender PeerID by appending
-    /// `"bridge:"` to the first 16 characters of the rendezvous Nostr pubkey.
-    init(bridge pubKey: String) {
-        self.init(prefix: .bridge, bare: pubKey.prefix(Constants.nostrConvKeyPrefixLength))
-    }
-
+    
    /// Convenience init to create PeerID from String/Substring by splitting it into prefix and bare parts
    init(str: any StringProtocol) {
        if let prefix = Prefix.allCases.first(where: { $0 != .empty && str.hasPrefix($0.rawValue) }) {
@@ -85,54 +60,32 @@ public extension PeerID {
            self.init(prefix: .empty, bare: str)
        }
    }
-
+    
    /// Convenience init to handle `Optional<String>`
    init?(str: (any StringProtocol)?) {
        guard let str else { return nil }
        self.init(str: str)
    }
-
+    
    /// Convenience init to create PeerID by converting Data to String
    init?(data: Data) {
        self.init(str: String(data: data, encoding: .utf8))
    }
-
+    
    /// Convenience init to "hide" hex-encoding implementation detail
    init(hexData: Data) {
        self.init(str: hexData.hexEncodedString())
    }
-
-    /// Convenience init to "hide" hex-encoding implementation detail
-    init?(hexData: Data?) {
-        guard let hexData else { return nil }
-        self.init(hexData: hexData)
-    }
-}
-
-// MARK: - Group Conversation Helpers
-
-public extension PeerID {
-    /// Convenience init to create a virtual group conversation PeerID from a
-    /// 16-byte group ID ("group_" + 32 hex characters).
-    init(groupID: Data) {
-        self.init(str: Prefix.group.rawValue + groupID.hexEncodedString())
-    }
-
-    /// The 16-byte group ID behind a "group_" PeerID, if this is one.
-    var groupIDData: Data? {
-        guard isGroup, bare.count == 32 else { return nil }
-        return Data(hexString: bare)
-    }
 }

 // MARK: - Noise Public Key Helpers

-public extension PeerID {
+extension PeerID {
    /// Derive the stable 16-hex peer ID from a Noise static public key
    init(publicKey: Data) {
        self.init(str: publicKey.sha256Fingerprint().prefix(16))
    }
-
+    
    /// Returns a 16-hex short peer ID derived from a 64-hex Noise public key if needed
    func toShort() -> PeerID {
        if let noiseKey {
@@ -145,11 +98,11 @@ public extension PeerID {
 // MARK: - Codable

 extension PeerID: Codable {
-    public init(from decoder: any Decoder) throws {
+    init(from decoder: any Decoder) throws {
        self.init(str: try decoder.singleValueContainer().decode(String.self))
    }
-
-    public func encode(to encoder: any Encoder) throws {
+    
+    func encode(to encoder: any Encoder) throws {
        var container = encoder.singleValueContainer()
        try container.encode(id)
    }
@@ -157,91 +110,67 @@ extension PeerID: Codable {

 // MARK: - Helpers

-public extension PeerID {
+extension PeerID {
    var isEmpty: Bool {
        id.isEmpty
    }
-
+    
    /// Returns true if `id` starts with "`nostr:`"
    var isGeoChat: Bool {
        prefix == .geoChat
    }
-
+    
    /// Returns true if `id` starts with "`nostr_`"
    var isGeoDM: Bool {
        prefix == .geoDM
    }
-
-    /// Returns true if `id` starts with "`group_`"
-    var isGroup: Bool {
-        prefix == .group
-    }
-
-    /// Returns true if `id` starts with "`bridge:`"
-    var isBridge: Bool {
-        prefix == .bridge
-    }
-
+    
    func toPercentEncoded() -> String {
        id.addingPercentEncoding(withAllowedCharacters: .urlPathAllowed) ?? id
    }
 }

-public extension PeerID {
-    var routingData: Data? {
-        if let direct = Data(hexString: id), direct.count == 8 { return direct }
-        if let bareData = Data(hexString: bare), bareData.count == 8 { return bareData }
-        let short = toShort()
-        return Data(hexString: short.id)
-    }
-
-    init?(routingData: Data) {
-        guard routingData.count == 8 else { return nil }
-        self.init(hexData: routingData)
-    }
-}
-
 // MARK: - Validation

-public extension PeerID {
+extension PeerID {
+    private enum Constants {
+        static let maxIDLength = 64
+        static let hexIDLength = 16 // 8 bytes = 16 hex chars
+    }
+    
    /// Validates a peer ID from any source (short 16-hex, full 64-hex, or internal alnum/-/_ up to 64)
    var isValid: Bool {
        if prefix != .empty {
            return PeerID(str: bare).isValid
        }
-
+        
        // Accept short routing IDs (exact 16-hex) or Full Noise key hex (exact 64-hex)
        if isShort || isNoiseKeyHex {
            return true
        }
-
+        
        // If length equals short or full but isn't valid hex, reject
        if id.count == Constants.hexIDLength || id.count == Constants.maxIDLength {
            return false
        }
-
+        
        // Internal format: alphanumeric + dash/underscore up to 63 (not 16 or 64)
        let validCharset = CharacterSet.alphanumerics.union(CharacterSet(charactersIn: "-_"))
        return !id.isEmpty &&
                id.count < Constants.maxIDLength &&
                id.rangeOfCharacter(from: validCharset.inverted) == nil
    }
-
-    /// Returns true if the `bare` id is all hex
-    var isHex: Bool {
-        bare.allSatisfy { $0.isHexDigit }
-    }
-
+    
    /// Short routing IDs (exact 16-hex)
    var isShort: Bool {
-        bare.count == Constants.hexIDLength && isHex
+        bare.count == Constants.hexIDLength && Data(hexString: bare) != nil
    }
-
+    
    /// Full Noise key hex (exact 64-hex)
    var isNoiseKeyHex: Bool {
        noiseKey != nil
    }
-
+    
    /// Full Noise key (exact 64-hex) as Data
    var noiseKey: Data? {
        guard bare.count == Constants.maxIDLength else { return nil }
@@ -252,16 +181,32 @@ public extension PeerID {
 // MARK: - Comparable

 extension PeerID: Comparable {
-    public static func < (lhs: PeerID, rhs: PeerID) -> Bool {
+    static func < (lhs: PeerID, rhs: PeerID) -> Bool {
        lhs.id < rhs.id
    }
 }

-// MARK: - CustomStringConvertible
+// MARK: - String Interop Helpers
+
+// MARK: CustomStringConvertible

 extension PeerID: CustomStringConvertible {
    /// So it returns the actual `id` like before even inside another String
-    public var description: String {
+    var description: String {
        id
    }
 }
+
+// MARK: Custom Equatable w/ String & Optionality
+
+// PeerID <> String
+extension Optional where Wrapped == PeerID {
+    static func ==(lhs: Optional<Wrapped>, rhs: Optional<String>) -> Bool   { lhs?.id == rhs }
+    static func !=(lhs: Optional<Wrapped>, rhs: Optional<String>) -> Bool   { lhs?.id != rhs }
+}
+
+// String <> PeerID
+extension Optional where Wrapped == String {
+    static func ==(lhs: Optional<Wrapped>, rhs: Optional<PeerID>) -> Bool   { lhs == rhs?.id }
+    static func !=(lhs: Optional<Wrapped>, rhs: Optional<PeerID>) -> Bool   { lhs != rhs?.id }
+}
@@ -7,16 +7,15 @@
 //

 import Foundation
-import BitFoundation

 struct ReadReceipt: Codable {
    let originalMessageID: String
    let receiptID: String
-    var readerID: PeerID  // Who read it
+    var readerID: String  // Who read it
    let readerNickname: String
    let timestamp: Date
    
-    init(originalMessageID: String, readerID: PeerID, readerNickname: String) {
+    init(originalMessageID: String, readerID: String, readerNickname: String) {
        self.originalMessageID = originalMessageID
        self.receiptID = UUID().uuidString
        self.readerID = readerID
@@ -25,7 +24,7 @@ struct ReadReceipt: Codable {
    }
    
    // For binary decoding
-    private init(originalMessageID: String, receiptID: String, readerID: PeerID, readerNickname: String, timestamp: Date) {
+    private init(originalMessageID: String, receiptID: String, readerID: String, readerNickname: String, timestamp: Date) {
        self.originalMessageID = originalMessageID
        self.receiptID = receiptID
        self.readerID = readerID
@@ -49,7 +48,7 @@ struct ReadReceipt: Codable {
        data.appendUUID(receiptID)
        // ReaderID as 8-byte hex string
        var readerData = Data()
-        var tempID = readerID.id
+        var tempID = readerID
        while tempID.count >= 2 && readerData.count < 8 {
            let hexByte = String(tempID.prefix(2))
            if let byte = UInt8(hexByte, radix: 16) {
@@ -79,8 +78,8 @@ struct ReadReceipt: Codable {
              let receiptID = dataCopy.readUUID(at: &offset) else { return nil }
        
        guard let readerIDData = dataCopy.readFixedBytes(at: &offset, count: 8) else { return nil }
-        let readerID = PeerID(hexData: readerIDData)
-        guard readerID.isValid else { return nil }
+        let readerID = readerIDData.hexEncodedString()
+        guard PeerID(str: readerID).isValid else { return nil }
        
        guard let timestamp = dataCopy.readDate(at: &offset),
              InputValidator.validateTimestamp(timestamp),
@@ -1,59 +1,13 @@
-import BitFoundation
 import Foundation

 // REQUEST_SYNC payload TLV (type, length16, value)
 //  - 0x01: P (uint8) — Golomb-Rice parameter
 //  - 0x02: M (uint32, big-endian) — hash range (N * 2^P)
 //  - 0x03: data (opaque) — GR bitstream bytes (MSB-first)
-//  - 0x04: types (SyncTypeFlags) — packet types the filter covers
-//  - 0x05: sinceTimestamp (uint64, big-endian) — filter coverage cursor
-//  - 0x06: fragmentIdFilter (UTF-8) — comma-separated 16-hex-char (8-byte)
-//          fragment stream IDs; restricts the fragment diff to exactly those
-//          streams (targeted resync for stalled reassemblies)
 struct RequestSyncPacket {
-    /// Maximum fragment IDs one 0x06 filter may carry. Each ID encodes as
-    /// 16 hex chars plus a comma separator, so the largest encoded value is
-    /// 60 * 17 - 1 = 1019 bytes, which fits the 1024-byte decoder cap.
-    static let maxFragmentIdFilterCount = 60
-
    let p: Int
    let m: UInt32
    let data: Data
-    let types: SyncTypeFlags?
-    let sinceTimestamp: UInt64?
-    let fragmentIdFilter: String?
-
-    /// Encodes 8-byte fragment stream IDs as the 0x06 filter string,
-    /// dropping malformed IDs and capping at `maxFragmentIdFilterCount`.
-    static func encodeFragmentIdFilter(_ fragmentIDs: [Data]) -> String? {
-        let tokens = fragmentIDs
-            .filter { $0.count == 8 }
-            .prefix(maxFragmentIdFilterCount)
-            .map { $0.hexEncodedString() }
-        guard !tokens.isEmpty else { return nil }
-        return tokens.joined(separator: ",")
-    }
-
-    /// Decodes a 0x06 filter string back into 8-byte fragment stream IDs,
-    /// ignoring malformed tokens and capping at `maxFragmentIdFilterCount`.
-    static func decodeFragmentIdFilter(_ filter: String?) -> Set<Data>? {
-        guard let filter else { return nil }
-        var ids: Set<Data> = []
-        for token in filter.split(separator: ",").prefix(maxFragmentIdFilterCount) {
-            guard token.count == 16, let id = Data(hexString: String(token)) else { continue }
-            ids.insert(id)
-        }
-        return ids.isEmpty ? nil : ids
-    }
-
-    init(p: Int, m: UInt32, data: Data, types: SyncTypeFlags? = nil, sinceTimestamp: UInt64? = nil, fragmentIdFilter: String? = nil) {
-        self.p = p
-        self.m = m
-        self.data = data
-        self.types = types
-        self.sinceTimestamp = sinceTimestamp
-        self.fragmentIdFilter = fragmentIdFilter
-    }

    func encode() -> Data {
        var out = Data()
@@ -71,27 +25,14 @@ struct RequestSyncPacket {
        putTLV(0x02, withUnsafeBytes(of: &mBE) { Data($0) })
        // data
        putTLV(0x03, data)
-        if let typesData = types?.toData() {
-            putTLV(0x04, typesData)
-        }
-        if let ts = sinceTimestamp {
-            var tsBE = ts.bigEndian
-            putTLV(0x05, withUnsafeBytes(of: &tsBE) { Data($0) })
-        }
-        if let fid = fragmentIdFilter, let fidData = fid.data(using: .utf8) {
-            putTLV(0x06, fidData)
-        }
        return out
    }
-    
+
    static func decode(from data: Data, maxAcceptBytes: Int = 1024) -> RequestSyncPacket? {
        var off = 0
        var p: Int? = nil
        var m: UInt32? = nil
        var payload: Data? = nil
-        var types: SyncTypeFlags? = nil
-        var sinceTimestamp: UInt64? = nil
-        var fragmentIdFilter: String? = nil

        while off + 3 <= data.count {
            let t = Int(data[off]); off += 1
@@ -111,28 +52,12 @@ struct RequestSyncPacket {
            case 0x03:
                if v.count > maxAcceptBytes { return nil }
                payload = v
-            case 0x04:
-                if let decoded = SyncTypeFlags.decode(v) {
-                    types = decoded
-                }
-            case 0x05:
-                if v.count == 8 {
-                    var ts: UInt64 = 0
-                    for b in v { ts = (ts << 8) | UInt64(b) }
-                    sinceTimestamp = ts
-                }
-            case 0x06:
-                // Same acceptance cap as the GCS payload; an oversized filter
-                // is ignored rather than failing the whole request.
-                if v.count <= maxAcceptBytes, let fid = String(data: v, encoding: .utf8) {
-                    fragmentIdFilter = fid
-                }
            default:
                break // forward compatible; ignore unknown TLVs
            }
        }

-        guard let pp = p, let mm = m, let dd = payload, pp >= 1, pp <= GCSFilter.maxP, mm > 0 else { return nil }
-        return RequestSyncPacket(p: pp, m: mm, data: dd, types: types, sinceTimestamp: sinceTimestamp, fragmentIdFilter: fragmentIdFilter)
+        guard let pp = p, let mm = m, let dd = payload, pp >= 1, mm > 0 else { return nil }
+        return RequestSyncPacket(p: pp, m: mm, data: dd)
    }
 }
@@ -78,7 +78,6 @@
 ///

 import BitLogger
-import BitFoundation
 import Foundation
 import CryptoKit

@@ -93,7 +92,6 @@ enum NoisePattern {
    case XX  // Most versatile, mutual authentication
    case IK  // Initiator knows responder's static key
    case NK  // Anonymous initiator
-    case X   // One-way: single message to a known static key (no response)
 }

 enum NoiseRole {
@@ -167,23 +165,19 @@ final class NoiseCipherState {
    // MARK: - Sliding Window Replay Protection
    
    /// Check if nonce is valid for replay protection
-    /// BCH-01-010: Use safe arithmetic to prevent integer overflow
    private func isValidNonce(_ receivedNonce: UInt64) -> Bool {
-        // Safe overflow check: instead of (receivedNonce + WINDOW_SIZE <= highest)
-        // use (highest >= WINDOW_SIZE && receivedNonce <= highest - WINDOW_SIZE)
-        let windowSize = UInt64(Self.REPLAY_WINDOW_SIZE)
-        if highestReceivedNonce >= windowSize && receivedNonce <= highestReceivedNonce - windowSize {
+        if receivedNonce + UInt64(Self.REPLAY_WINDOW_SIZE) <= highestReceivedNonce {
            return false  // Too old, outside window
        }
-
+        
        if receivedNonce > highestReceivedNonce {
            return true  // Always accept newer nonces
        }
-
+        
        let offset = Int(highestReceivedNonce - receivedNonce)
        let byteIndex = offset / 8
        let bitIndex = offset % 8
-
+        
        return (replayWindow[byteIndex] & (1 << bitIndex)) == 0  // Not yet seen
    }
    
@@ -228,7 +222,7 @@ final class NoiseCipherState {
        guard combinedPayload.count >= Self.NONCE_SIZE_BYTES else {
            return nil
        }
-        
+
        // Extract 4-byte nonce (big-endian)
        let nonceData = combinedPayload.prefix(Self.NONCE_SIZE_BYTES)
        let extractedNonce = nonceData.withUnsafeBytes { (bytes: UnsafeRawBufferPointer) -> UInt64 in
@@ -239,18 +233,18 @@ final class NoiseCipherState {
            }
            return result
        }
-        
+
        // Extract ciphertext (remaining bytes)
        let ciphertext = combinedPayload.dropFirst(Self.NONCE_SIZE_BYTES)
-        
+
        return (nonce: extractedNonce, ciphertext: Data(ciphertext))
    }
-    
+
    /// Convert nonce to 4-byte array (big-endian)
    private func nonceToBytes(_ nonce: UInt64) -> Data {
        var bytes = Data(count: Self.NONCE_SIZE_BYTES)
        withUnsafeBytes(of: nonce.bigEndian) { ptr in
-            // Copy only the last 4 bytes from the 8-byte UInt64
+            // Copy only the last 4 bytes from the 8-byte UInt64 
            let sourceBytes = ptr.bindMemory(to: UInt8.self)
            bytes.replaceSubrange(0..<Self.NONCE_SIZE_BYTES, with: sourceBytes.suffix(Self.NONCE_SIZE_BYTES))
        }
@@ -279,7 +273,7 @@ final class NoiseCipherState {
        let sealedBox = try ChaChaPoly.seal(plaintext, using: key, nonce: ChaChaPoly.Nonce(data: nonceData), authenticating: associatedData)
        // increment local nonce
        nonce += 1
-        
+               
        // Create combined payload: <nonce><ciphertext>
        let combinedPayload: Data
        if (useExtractedNonce) {
@@ -293,7 +287,7 @@ final class NoiseCipherState {
        if currentNonce > Self.HIGH_NONCE_WARNING_THRESHOLD {
            SecureLogger.warning("High nonce value detected: \(currentNonce) - consider rekeying", category: .encryption)
        }
-        
+                
        return combinedPayload
    }
    
@@ -322,14 +316,7 @@ final class NoiseCipherState {
                SecureLogger.debug("Replay attack detected: nonce \(extractedNonce) rejected")
                throw NoiseError.replayDetected
            }
-            
-            // The 4-byte nonce prefix has been stripped, so the remaining bytes
-            // must still hold at least the 16-byte Poly1305 tag. The up-front
-            // `ciphertext.count >= 16` guard is not sufficient here (it counts
-            // the nonce), and `prefix(count - 16)` would trap on a short payload.
-            guard actualCiphertext.count >= 16 else {
-                throw NoiseError.invalidCiphertext
-            }
+
            // Split ciphertext and tag
            encryptedData = actualCiphertext.prefix(actualCiphertext.count - 16)
            tag = actualCiphertext.suffix(16)
@@ -360,20 +347,16 @@ final class NoiseCipherState {
        
        do {
            let plaintext = try ChaChaPoly.open(sealedBox, using: key, authenticating: associatedData)
-
-            // BCH-01-010: Atomic nonce state update
-            // Both replay window marking and nonce increment must complete together
-            // to prevent state desynchronization. We perform both after successful
-            // decryption only, ensuring state consistency on any failure path.
+            
            if useExtractedNonce {
+                // Mark nonce as seen after successful decryption
                markNonceAsSeen(decryptionNonce)
            }
            nonce += 1
-
            return plaintext
        } catch {
-            // Decryption failed - nonce state remains unchanged (atomic rollback)
            SecureLogger.debug("Decrypt failed: \(error) for nonce \(decryptionNonce)")
+            // Log authentication failures with nonce info
            SecureLogger.error("Decryption failed at nonce \(decryptionNonce)", category: .encryption)
            throw error
        }
@@ -393,16 +376,6 @@ final class NoiseCipherState {
            replayWindow[i] = 0
        }
    }
-
-    #if DEBUG
-    func setNonceForTesting(_ nonce: UInt64) {
-        self.nonce = nonce
-    }
-
-    func extractNonceFromCiphertextPayloadForTesting(_ combinedPayload: Data) throws -> (nonce: UInt64, ciphertext: Data)? {
-        try extractNonceFromCiphertextPayload(combinedPayload)
-    }
-    #endif
 }

 // MARK: - Symmetric State
@@ -478,40 +451,17 @@ final class NoiseSymmetricState {
        }
    }
    
-    func split(useExtractedNonce: Bool) -> (NoiseCipherState, NoiseCipherState) {
+    func split() -> (NoiseCipherState, NoiseCipherState) {
        let output = hkdf(chainingKey: chainingKey, inputKeyMaterial: Data(), numOutputs: 2)
        let tempKey1 = SymmetricKey(data: output[0])
        let tempKey2 = SymmetricKey(data: output[1])
-
-        let c1 = NoiseCipherState(key: tempKey1, useExtractedNonce: useExtractedNonce)
-        let c2 = NoiseCipherState(key: tempKey2, useExtractedNonce: useExtractedNonce)
-
-        // BCH-01-010: Clear symmetric state after split per Noise spec
-        // The chaining key and hash should not be retained after handshake completes
-        clearSensitiveData()
-
+        
+        let c1 = NoiseCipherState(key: tempKey1, useExtractedNonce: true)
+        let c2 = NoiseCipherState(key: tempKey2, useExtractedNonce: true)
+        
        return (c1, c2)
    }
-
-    /// BCH-01-010: Securely clear sensitive cryptographic state
-    /// Called after split() to clear chaining key and hash per Noise spec
-    func clearSensitiveData() {
-        // Clear chaining key by overwriting with zeros
-        let chainingKeyCount = chainingKey.count
-        chainingKey = Data(repeating: 0, count: chainingKeyCount)
-
-        // Clear hash by overwriting with zeros
-        let hashCount = hash.count
-        hash = Data(repeating: 0, count: hashCount)
-
-        // Clear the internal cipher state
-        cipherState.clearSensitiveData()
-    }
-
-    deinit {
-        clearSensitiveData()
-    }
-
+    
    // HKDF implementation
    private func hkdf(chainingKey: Data, inputKeyMaterial: Data, numOutputs: Int) -> [Data] {
        let tempKey = HMAC<SHA256>.authenticationCode(for: inputKeyMaterial, using: SymmetricKey(data: chainingKey))
@@ -557,24 +507,16 @@ final class NoiseHandshakeState {
    private var messagePatterns: [[NoiseMessagePattern]] = []
    private var currentPattern = 0
    
-    // Test support: predetermined ephemeral keys for test vectors
-    private var predeterminedEphemeralKey: Curve25519.KeyAgreement.PrivateKey?
-    private var prologueData: Data
-    
    init(
        role: NoiseRole,
        pattern: NoisePattern,
        keychain: KeychainManagerProtocol,
        localStaticKey: Curve25519.KeyAgreement.PrivateKey? = nil,
-        remoteStaticKey: Curve25519.KeyAgreement.PublicKey? = nil,
-        prologue: Data = Data(),
-        predeterminedEphemeralKey: Curve25519.KeyAgreement.PrivateKey? = nil
+        remoteStaticKey: Curve25519.KeyAgreement.PublicKey? = nil
    ) {
        self.role = role
        self.pattern = pattern
        self.keychain = keychain
-        self.prologueData = prologue
-        self.predeterminedEphemeralKey = predeterminedEphemeralKey
        
        // Initialize static keys
        if let localKey = localStaticKey {
@@ -595,18 +537,17 @@ final class NoiseHandshakeState {
    }
    
    private func mixPreMessageKeys() {
-        // Mix prologue
-        symmetricState.mixHash(self.prologueData)
+        // Mix prologue (empty for XX pattern normally)
+        symmetricState.mixHash(Data()) // Empty prologue for XX pattern
        // For XX pattern, no pre-message keys
        // For IK/NK patterns, we'd mix the responder's static key here
        switch pattern {
        case .XX:
            break // No pre-message keys
-        case .IK, .NK, .X:
+        case .IK, .NK:
            if role == .initiator, let remoteStatic = remoteStaticPublic {
+                _ = symmetricState.getHandshakeHash()
                symmetricState.mixHash(remoteStatic.rawRepresentation)
-            } else if role == .responder, let localStatic = localStaticPublic {
-                symmetricState.mixHash(localStatic.rawRepresentation)
            }
        }
    }
@@ -615,20 +556,15 @@ final class NoiseHandshakeState {
        guard currentPattern < messagePatterns.count else {
            throw NoiseError.handshakeComplete
        }
-        
+                
        var messageBuffer = Data()
        let patterns = messagePatterns[currentPattern]
        
        for pattern in patterns {
            switch pattern {
            case .e:
-                // Generate ephemeral key (or use predetermined key for tests)
-                if let predetermined = predeterminedEphemeralKey {
-                    localEphemeralPrivate = predetermined
-                    predeterminedEphemeralKey = nil
-                } else {
-                    localEphemeralPrivate = Curve25519.KeyAgreement.PrivateKey()
-                }
+                // Generate ephemeral key
+                localEphemeralPrivate = Curve25519.KeyAgreement.PrivateKey()
                localEphemeralPublic = localEphemeralPrivate!.publicKey
                messageBuffer.append(localEphemeralPublic!.rawRepresentation)
                symmetricState.mixHash(localEphemeralPublic!.rawRepresentation)
@@ -661,20 +597,14 @@ final class NoiseHandshakeState {
                        throw NoiseError.missingKeys
                    }
                    let shared = try localEphemeral.sharedSecretFromKeyAgreement(with: remoteStatic)
-                    var sharedData = shared.withUnsafeBytes { Data($0) }
-                    symmetricState.mixKey(sharedData)
-                    // Clear sensitive shared secret
-                    keychain.secureClear(&sharedData)
+                    symmetricState.mixKey(shared.withUnsafeBytes { Data($0) })
                } else {
                    guard let localStatic = localStaticPrivate,
                          let remoteEphemeral = remoteEphemeralPublic else {
                        throw NoiseError.missingKeys
                    }
                    let shared = try localStatic.sharedSecretFromKeyAgreement(with: remoteEphemeral)
-                    var sharedData = shared.withUnsafeBytes { Data($0) }
-                    symmetricState.mixKey(sharedData)
-                    // Clear sensitive shared secret
-                    keychain.secureClear(&sharedData)
+                    symmetricState.mixKey(shared.withUnsafeBytes { Data($0) })
                }
                
            case .se:
@@ -685,20 +615,14 @@ final class NoiseHandshakeState {
                        throw NoiseError.missingKeys
                    }
                    let shared = try localStatic.sharedSecretFromKeyAgreement(with: remoteEphemeral)
-                    var sharedData = shared.withUnsafeBytes { Data($0) }
-                    symmetricState.mixKey(sharedData)
-                    // Clear sensitive shared secret
-                    keychain.secureClear(&sharedData)
+                    symmetricState.mixKey(shared.withUnsafeBytes { Data($0) })
                } else {
                    guard let localEphemeral = localEphemeralPrivate,
                          let remoteStatic = remoteStaticPublic else {
                        throw NoiseError.missingKeys
                    }
                    let shared = try localEphemeral.sharedSecretFromKeyAgreement(with: remoteStatic)
-                    var sharedData = shared.withUnsafeBytes { Data($0) }
-                    symmetricState.mixKey(sharedData)
-                    // Clear sensitive shared secret
-                    keychain.secureClear(&sharedData)
+                    symmetricState.mixKey(shared.withUnsafeBytes { Data($0) })
                }
                
            case .ss:
@@ -723,12 +647,12 @@ final class NoiseHandshakeState {
        return messageBuffer
    }
    
-    func readMessage(_ message: Data, expectedPayloadLength _: Int = 0) throws -> Data {
+    func readMessage(_ message: Data, expectedPayloadLength: Int = 0) throws -> Data {
        
        guard currentPattern < messagePatterns.count else {
            throw NoiseError.handshakeComplete
        }
-        
+                
        var buffer = message
        let patterns = messagePatterns[currentPattern]
        
@@ -787,11 +711,8 @@ final class NoiseHandshakeState {
                throw NoiseError.missingKeys
            }
            let shared = try localEphemeral.sharedSecretFromKeyAgreement(with: remoteEphemeral)
-            var sharedData = shared.withUnsafeBytes { Data($0) }
-            symmetricState.mixKey(sharedData)
-            // Clear sensitive shared secret
-            keychain.secureClear(&sharedData)
-
+            symmetricState.mixKey(shared.withUnsafeBytes { Data($0) })
+            
        case .es:
            if role == .initiator {
                guard let localEphemeral = localEphemeralPrivate,
@@ -844,12 +765,9 @@ final class NoiseHandshakeState {
                throw NoiseError.missingKeys
            }
            let shared = try localStatic.sharedSecretFromKeyAgreement(with: remoteStatic)
-            var sharedData = shared.withUnsafeBytes { Data($0) }
-            symmetricState.mixKey(sharedData)
-            // Clear sensitive shared secret
-            keychain.secureClear(&sharedData)
-
-        case .e, .s:
+            symmetricState.mixKey(shared.withUnsafeBytes { Data($0) })
+            
+        default:
            break
        }
    }
@@ -858,20 +776,16 @@ final class NoiseHandshakeState {
        return currentPattern >= messagePatterns.count
    }
    
-    func getTransportCiphers(useExtractedNonce: Bool) throws -> (send: NoiseCipherState, receive: NoiseCipherState, handshakeHash: Data) {
+    func getTransportCiphers() throws -> (send: NoiseCipherState, receive: NoiseCipherState) {
        guard isHandshakeComplete() else {
            throw NoiseError.handshakeNotComplete
        }
-
-        // BCH-01-010: Capture handshake hash BEFORE split() clears symmetric state
-        let finalHandshakeHash = symmetricState.getHandshakeHash()
-
-        let (c1, c2) = symmetricState.split(useExtractedNonce: useExtractedNonce)
-
+        
+        let (c1, c2) = symmetricState.split()
+        
        // Initiator uses c1 for sending, c2 for receiving
        // Responder uses c2 for sending, c1 for receiving
-        let ciphers = role == .initiator ? (c1, c2) : (c2, c1)
-        return (send: ciphers.0, receive: ciphers.1, handshakeHash: finalHandshakeHash)
+        return role == .initiator ? (c1, c2) : (c2, c1)
    }
    
    func getRemoteStaticPublicKey() -> Curve25519.KeyAgreement.PublicKey? {
@@ -881,20 +795,6 @@ final class NoiseHandshakeState {
    func getHandshakeHash() -> Data {
        return symmetricState.getHandshakeHash()
    }
-
-    #if DEBUG
-    func performDHOperationForTesting(_ pattern: NoiseMessagePattern) throws {
-        try performDHOperation(pattern)
-    }
-
-    func setCurrentPatternForTesting(_ currentPattern: Int) {
-        self.currentPattern = currentPattern
-    }
-
-    func setRemoteEphemeralPublicKeyForTesting(_ key: Curve25519.KeyAgreement.PublicKey?) {
-        self.remoteEphemeralPublic = key
-    }
-    #endif
 }

 // MARK: - Pattern Extensions
@@ -905,7 +805,6 @@ extension NoisePattern {
        case .XX: return "XX"
        case .IK: return "IK"
        case .NK: return "NK"
-        case .X: return "X"
        }
    }
    
@@ -927,10 +826,6 @@ extension NoisePattern {
                [.e, .es],      // -> e, es
                [.e, .ee]       // <- e, ee
            ]
-        case .X:
-            return [
-                [.e, .es, .s, .ss] // -> e, es, s, ss (single one-way message)
-            ]
        }
    }
 }
@@ -951,47 +846,22 @@ enum NoiseError: Error {
    case nonceExceeded
 }

-// MARK: - Constant-Time Operations
-
-/// BCH-01-010: Constant-time comparison to prevent timing side-channel attacks
-/// This function compares two Data objects in constant time, preventing
-/// information leakage via timing analysis.
-private func constantTimeCompare(_ a: Data, _ b: Data) -> Bool {
-    guard a.count == b.count else { return false }
-
-    var result: UInt8 = 0
-    for i in 0..<a.count {
-        result |= a[a.startIndex.advanced(by: i)] ^ b[b.startIndex.advanced(by: i)]
-    }
-    return result == 0
-}
-
-/// BCH-01-010: Constant-time check if all bytes are zero
-private func constantTimeIsZero(_ data: Data) -> Bool {
-    var result: UInt8 = 0
-    for byte in data {
-        result |= byte
-    }
-    return result == 0
-}
-
 // MARK: - Key Validation

 extension NoiseHandshakeState {
    /// Validate a Curve25519 public key
    /// Checks for weak/invalid keys that could compromise security
-    /// BCH-01-010: Uses constant-time operations to prevent timing side-channels
    static func validatePublicKey(_ keyData: Data) throws -> Curve25519.KeyAgreement.PublicKey {
        // Check key length
        guard keyData.count == 32 else {
            throw NoiseError.invalidPublicKey
        }
-
-        // BCH-01-010: Constant-time check for all-zero key (point at infinity)
-        if constantTimeIsZero(keyData) {
+        
+        // Check for all-zero key (point at infinity)
+        if keyData.allSatisfy({ $0 == 0 }) {
            throw NoiseError.invalidPublicKey
        }
-
+        
        // Check for low-order points that could enable small subgroup attacks
        // These are the known bad points for Curve25519
        let lowOrderPoints: [Data] = [
@@ -1012,21 +882,13 @@ extension NoiseHandshakeState {
                  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
                  0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff])  // Another bad point
        ]
-
-        // BCH-01-010: Constant-time check against known bad points
-        // We check all points and accumulate matches to avoid early exit timing leaks
-        var foundBadPoint = false
-        for badPoint in lowOrderPoints {
-            if constantTimeCompare(keyData, badPoint) {
-                foundBadPoint = true
-            }
-        }
-
-        if foundBadPoint {
+        
+        // Check against known bad points
+        if lowOrderPoints.contains(keyData) {
            SecureLogger.warning("Low-order point detected", category: .security)
            throw NoiseError.invalidPublicKey
        }
-
+        
        // Try to create the key - CryptoKit will validate curve points internally
        do {
            let publicKey = try Curve25519.KeyAgreement.PublicKey(rawRepresentation: keyData)
@@ -1,96 +0,0 @@
-//
-// NoiseRateLimiter.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import BitLogger
-import BitFoundation
-import Foundation
-
-final class NoiseRateLimiter {
-    private var handshakeTimestamps: [PeerID: [Date]] = [:]
-    private var messageTimestamps: [PeerID: [Date]] = [:]
-    
-    // Global rate limiting
-    private var globalHandshakeTimestamps: [Date] = []
-    private var globalMessageTimestamps: [Date] = []
-    
-    private let queue = DispatchQueue(label: "chat.bitchat.noise.ratelimit", attributes: .concurrent)
-    
-    func allowHandshake(from peerID: PeerID) -> Bool {
-        return queue.sync(flags: .barrier) {
-            let now = Date()
-            let oneMinuteAgo = now.addingTimeInterval(-60)
-            
-            // Check global rate limit first
-            globalHandshakeTimestamps = globalHandshakeTimestamps.filter { $0 > oneMinuteAgo }
-            if globalHandshakeTimestamps.count >= NoiseSecurityConstants.maxGlobalHandshakesPerMinute {
-                SecureLogger.warning("Global handshake rate limit exceeded: \(globalHandshakeTimestamps.count)/\(NoiseSecurityConstants.maxGlobalHandshakesPerMinute) per minute", category: .security)
-                return false
-            }
-            
-            // Check per-peer rate limit
-            var timestamps = handshakeTimestamps[peerID] ?? []
-            timestamps = timestamps.filter { $0 > oneMinuteAgo }
-            
-            if timestamps.count >= NoiseSecurityConstants.maxHandshakesPerMinute {
-                SecureLogger.warning("Per-peer handshake rate limit exceeded for \(peerID): \(timestamps.count)/\(NoiseSecurityConstants.maxHandshakesPerMinute) per minute", category: .security)
-                return false
-            }
-            
-            // Record new handshake
-            timestamps.append(now)
-            handshakeTimestamps[peerID] = timestamps
-            globalHandshakeTimestamps.append(now)
-            return true
-        }
-    }
-    
-    func allowMessage(from peerID: PeerID) -> Bool {
-        return queue.sync(flags: .barrier) {
-            let now = Date()
-            let oneSecondAgo = now.addingTimeInterval(-1)
-            
-            // Check global rate limit first
-            globalMessageTimestamps = globalMessageTimestamps.filter { $0 > oneSecondAgo }
-            if globalMessageTimestamps.count >= NoiseSecurityConstants.maxGlobalMessagesPerSecond {
-                SecureLogger.warning("Global message rate limit exceeded: \(globalMessageTimestamps.count)/\(NoiseSecurityConstants.maxGlobalMessagesPerSecond) per second", category: .security)
-                return false
-            }
-            
-            // Check per-peer rate limit
-            var timestamps = messageTimestamps[peerID] ?? []
-            timestamps = timestamps.filter { $0 > oneSecondAgo }
-            
-            if timestamps.count >= NoiseSecurityConstants.maxMessagesPerSecond {
-                SecureLogger.warning("Per-peer message rate limit exceeded for \(peerID): \(timestamps.count)/\(NoiseSecurityConstants.maxMessagesPerSecond) per second", category: .security)
-                return false
-            }
-            
-            // Record new message
-            timestamps.append(now)
-            messageTimestamps[peerID] = timestamps
-            globalMessageTimestamps.append(now)
-            return true
-        }
-    }
-    
-    func reset(for peerID: PeerID) {
-        queue.async(flags: .barrier) {
-            self.handshakeTimestamps.removeValue(forKey: peerID)
-            self.messageTimestamps.removeValue(forKey: peerID)
-        }
-    }
-
-    func resetAll() {
-        queue.async(flags: .barrier) {
-            self.handshakeTimestamps.removeAll()
-            self.messageTimestamps.removeAll()
-            self.globalHandshakeTimestamps.removeAll()
-            self.globalMessageTimestamps.removeAll()
-        }
-    }
-}
@@ -0,0 +1,227 @@
+//
+// NoiseSecurityConsiderations.swift
+// bitchat
+//
+// This is free and unencumbered software released into the public domain.
+// For more information, see <https://unlicense.org>
+//
+
+import BitLogger
+import Foundation
+
+// MARK: - Security Constants
+
+enum NoiseSecurityConstants {
+    // Maximum message size to prevent memory exhaustion
+    static let maxMessageSize = 65535 // 64KB as per Noise spec
+    
+    // Maximum handshake message size
+    static let maxHandshakeMessageSize = 2048 // 2KB to accommodate XX pattern
+    
+    // Session timeout - sessions older than this should be renegotiated
+    static let sessionTimeout: TimeInterval = 86400 // 24 hours
+    
+    // Maximum number of messages before rekey (2^64 - 1 is the nonce limit)
+    static let maxMessagesPerSession: UInt64 = 1_000_000_000 // 1 billion messages
+    
+    // Handshake timeout - abandon incomplete handshakes
+    static let handshakeTimeout: TimeInterval = 60 // 1 minute
+    
+    // Maximum concurrent sessions per peer
+    static let maxSessionsPerPeer = 3
+    
+    // Rate limiting
+    static let maxHandshakesPerMinute = 10
+    static let maxMessagesPerSecond = 100
+    
+    // Global rate limiting (across all peers)
+    static let maxGlobalHandshakesPerMinute = 30
+    static let maxGlobalMessagesPerSecond = 500
+}
+
+// MARK: - Security Validations
+
+struct NoiseSecurityValidator {
+    
+    /// Validate message size
+    static func validateMessageSize(_ data: Data) -> Bool {
+        return data.count <= NoiseSecurityConstants.maxMessageSize
+    }
+    
+    /// Validate handshake message size
+    static func validateHandshakeMessageSize(_ data: Data) -> Bool {
+        return data.count <= NoiseSecurityConstants.maxHandshakeMessageSize
+    }
+}
+
+// MARK: - Enhanced Noise Session with Security
+
+final class SecureNoiseSession: NoiseSession {
+    private(set) var messageCount: UInt64 = 0
+    private let sessionStartTime = Date()
+    private(set) var lastActivityTime = Date()
+    
+    override func encrypt(_ plaintext: Data) throws -> Data {
+        // Check session age
+        if Date().timeIntervalSince(sessionStartTime) > NoiseSecurityConstants.sessionTimeout {
+            throw NoiseSecurityError.sessionExpired
+        }
+        
+        // Check message count
+        if messageCount >= NoiseSecurityConstants.maxMessagesPerSession {
+            throw NoiseSecurityError.sessionExhausted
+        }
+        
+        // Validate message size
+        guard NoiseSecurityValidator.validateMessageSize(plaintext) else {
+            throw NoiseSecurityError.messageTooLarge
+        }
+        
+        let encrypted = try super.encrypt(plaintext)
+        messageCount += 1
+        lastActivityTime = Date()
+        
+        return encrypted
+    }
+    
+    override func decrypt(_ ciphertext: Data) throws -> Data {
+        // Check session age
+        if Date().timeIntervalSince(sessionStartTime) > NoiseSecurityConstants.sessionTimeout {
+            throw NoiseSecurityError.sessionExpired
+        }
+        
+        // Validate message size
+        guard NoiseSecurityValidator.validateMessageSize(ciphertext) else {
+            throw NoiseSecurityError.messageTooLarge
+        }
+        
+        let decrypted = try super.decrypt(ciphertext)
+        lastActivityTime = Date()
+        
+        return decrypted
+    }
+    
+    func needsRenegotiation() -> Bool {
+        // Check if we've used more than 90% of message limit
+        let messageThreshold = UInt64(Double(NoiseSecurityConstants.maxMessagesPerSession) * 0.9)
+        if messageCount >= messageThreshold {
+            return true
+        }
+        
+        // Check if last activity was more than 30 minutes ago
+        if Date().timeIntervalSince(lastActivityTime) > NoiseSecurityConstants.sessionTimeout {
+            return true
+        }
+        
+        return false
+    }
+    
+    // MARK: - Testing Support
+    #if DEBUG
+    func setLastActivityTimeForTesting(_ date: Date) {
+        lastActivityTime = date
+    }
+    
+    func setMessageCountForTesting(_ count: UInt64) {
+        messageCount = count
+    }
+    #endif
+}
+
+// MARK: - Rate Limiter
+
+final class NoiseRateLimiter {
+    private var handshakeTimestamps: [PeerID: [Date]] = [:]
+    private var messageTimestamps: [PeerID: [Date]] = [:]
+    
+    // Global rate limiting
+    private var globalHandshakeTimestamps: [Date] = []
+    private var globalMessageTimestamps: [Date] = []
+    
+    private let queue = DispatchQueue(label: "chat.bitchat.noise.ratelimit", attributes: .concurrent)
+    
+    func allowHandshake(from peerID: PeerID) -> Bool {
+        return queue.sync(flags: .barrier) {
+            let now = Date()
+            let oneMinuteAgo = now.addingTimeInterval(-60)
+            
+            // Check global rate limit first
+            globalHandshakeTimestamps = globalHandshakeTimestamps.filter { $0 > oneMinuteAgo }
+            if globalHandshakeTimestamps.count >= NoiseSecurityConstants.maxGlobalHandshakesPerMinute {
+                SecureLogger.warning("Global handshake rate limit exceeded: \(globalHandshakeTimestamps.count)/\(NoiseSecurityConstants.maxGlobalHandshakesPerMinute) per minute", category: .security)
+                return false
+            }
+            
+            // Check per-peer rate limit
+            var timestamps = handshakeTimestamps[peerID] ?? []
+            timestamps = timestamps.filter { $0 > oneMinuteAgo }
+            
+            if timestamps.count >= NoiseSecurityConstants.maxHandshakesPerMinute {
+                SecureLogger.warning("Per-peer handshake rate limit exceeded for \(peerID): \(timestamps.count)/\(NoiseSecurityConstants.maxHandshakesPerMinute) per minute", category: .security)
+                return false
+            }
+            
+            // Record new handshake
+            timestamps.append(now)
+            handshakeTimestamps[peerID] = timestamps
+            globalHandshakeTimestamps.append(now)
+            return true
+        }
+    }
+    
+    func allowMessage(from peerID: PeerID) -> Bool {
+        return queue.sync(flags: .barrier) {
+            let now = Date()
+            let oneSecondAgo = now.addingTimeInterval(-1)
+            
+            // Check global rate limit first
+            globalMessageTimestamps = globalMessageTimestamps.filter { $0 > oneSecondAgo }
+            if globalMessageTimestamps.count >= NoiseSecurityConstants.maxGlobalMessagesPerSecond {
+                SecureLogger.warning("Global message rate limit exceeded: \(globalMessageTimestamps.count)/\(NoiseSecurityConstants.maxGlobalMessagesPerSecond) per second", category: .security)
+                return false
+            }
+            
+            // Check per-peer rate limit
+            var timestamps = messageTimestamps[peerID] ?? []
+            timestamps = timestamps.filter { $0 > oneSecondAgo }
+            
+            if timestamps.count >= NoiseSecurityConstants.maxMessagesPerSecond {
+                SecureLogger.warning("Per-peer message rate limit exceeded for \(peerID): \(timestamps.count)/\(NoiseSecurityConstants.maxMessagesPerSecond) per second", category: .security)
+                return false
+            }
+            
+            // Record new message
+            timestamps.append(now)
+            messageTimestamps[peerID] = timestamps
+            globalMessageTimestamps.append(now)
+            return true
+        }
+    }
+    
+    func reset(for peerID: PeerID) {
+        queue.async(flags: .barrier) {
+            self.handshakeTimestamps.removeValue(forKey: peerID)
+            self.messageTimestamps.removeValue(forKey: peerID)
+        }
+    }
+
+    func resetAll() {
+        queue.async(flags: .barrier) {
+            self.handshakeTimestamps.removeAll()
+            self.messageTimestamps.removeAll()
+            self.globalHandshakeTimestamps.removeAll()
+            self.globalMessageTimestamps.removeAll()
+        }
+    }
+}
+
+// MARK: - Security Errors
+
+enum NoiseSecurityError: Error {
+    case sessionExpired
+    case sessionExhausted
+    case messageTooLarge
+    case invalidPeerID
+    case rateLimitExceeded
+    case handshakeTimeout
+}
@@ -1,31 +0,0 @@
-//
-// NoiseSecurityConstants.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import Foundation
-
-enum NoiseSecurityConstants {
-    // Maximum message size to prevent memory exhaustion
-    static let maxMessageSize = 65535 // 64KB as per Noise spec
-    
-    // Maximum handshake message size
-    static let maxHandshakeMessageSize = 2048 // 2KB to accommodate XX pattern
-    
-    // Session timeout - sessions older than this should be renegotiated
-    static let sessionTimeout: TimeInterval = 86400 // 24 hours
-    
-    // Maximum number of messages before rekey (2^64 - 1 is the nonce limit)
-    static let maxMessagesPerSession: UInt64 = 1_000_000_000 // 1 billion messages
-    
-    // Rate limiting
-    static let maxHandshakesPerMinute = 10
-    static let maxMessagesPerSecond = 100
-    
-    // Global rate limiting (across all peers)
-    static let maxGlobalHandshakesPerMinute = 30
-    static let maxGlobalMessagesPerSecond = 500
-}
@@ -1,17 +0,0 @@
-//
-// NoiseSecurityError.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import Foundation
-
-enum NoiseSecurityError: Error {
-    case sessionExpired
-    case sessionExhausted
-    case messageTooLarge
-    case invalidPeerID
-    case rateLimitExceeded
-}
@@ -1,22 +0,0 @@
-//
-// NoiseSecurityValidator.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import Foundation
-
-struct NoiseSecurityValidator {
-    
-    /// Validate message size
-    static func validateMessageSize(_ data: Data) -> Bool {
-        return data.count <= NoiseSecurityConstants.maxMessageSize
-    }
-    
-    /// Validate handshake message size
-    static func validateHandshakeMessageSize(_ data: Data) -> Bool {
-        return data.count <= NoiseSecurityConstants.maxHandshakeMessageSize
-    }
-}
@@ -9,7 +9,6 @@
 import BitLogger
 import Foundation
 import CryptoKit
-import BitFoundation

 class NoiseSession {
    let peerID: PeerID
@@ -103,23 +102,23 @@ class NoiseSession {
            
            // Check if handshake is complete
            if handshake.isHandshakeComplete() {
-                // Get transport ciphers and handshake hash (hash captured before split clears state)
-                let (send, receive, hash) = try handshake.getTransportCiphers(useExtractedNonce: true)
+                // Get transport ciphers
+                let (send, receive) = try handshake.getTransportCiphers()
                sendCipher = send
                receiveCipher = receive
-
+                
                // Store remote static key
                remoteStaticPublicKey = handshake.getRemoteStaticPublicKey()
-
+                
                // Store handshake hash for channel binding
-                handshakeHash = hash
-
+                handshakeHash = handshake.getHandshakeHash()
+                
                state = .established
                handshakeState = nil // Clear handshake state
-
+                
                SecureLogger.debug("NoiseSession[\(peerID)]: Handshake complete (no response needed), transitioning to established")
                SecureLogger.info(.handshakeCompleted(peerID: peerID.id))
-
+                
                return nil
            } else {
                // Generate response
@@ -129,20 +128,20 @@ class NoiseSession {
                
                // Check if handshake is complete after writing
                if handshake.isHandshakeComplete() {
-                    // Get transport ciphers and handshake hash (hash captured before split clears state)
-                    let (send, receive, hash) = try handshake.getTransportCiphers(useExtractedNonce: true)
+                    // Get transport ciphers
+                    let (send, receive) = try handshake.getTransportCiphers()
                    sendCipher = send
                    receiveCipher = receive
-
+                    
                    // Store remote static key
                    remoteStaticPublicKey = handshake.getRemoteStaticPublicKey()
-
+                    
                    // Store handshake hash for channel binding
-                    handshakeHash = hash
-
+                    handshakeHash = handshake.getHandshakeHash()
+                    
                    state = .established
                    handshakeState = nil // Clear handshake state
-
+                    
                    SecureLogger.debug("NoiseSession[\(peerID)]: Handshake complete after writing response, transitioning to established")
                    SecureLogger.info(.handshakeCompleted(peerID: peerID.id))
                }
@@ -197,6 +196,12 @@ class NoiseSession {
        }
    }
    
+    func getHandshakeHash() -> Data? {
+        return sessionQueue.sync {
+            return handshakeHash
+        }
+    }
+    
    func reset() {
        sessionQueue.sync(flags: .barrier) {
            let wasEstablished = state == .established
@@ -6,9 +6,10 @@
 // For more information, see <https://unlicense.org>
 //

-enum NoiseSessionError: Error, Equatable {
+enum NoiseSessionError: Error {
    case invalidState
    case notEstablished
    case sessionNotFound
+    case handshakeFailed(Error)
    case alreadyEstablished
 }
@@ -9,11 +9,11 @@
 import BitLogger
 import CryptoKit
 import Foundation
-import BitFoundation

 final class NoiseSessionManager {
    private var sessions: [PeerID: NoiseSession] = [:]
-    private let sessionFactory: (PeerID, NoiseRole) -> NoiseSession
+    private let localStaticKey: Curve25519.KeyAgreement.PrivateKey
+    private let keychain: KeychainManagerProtocol
    private let managerQueue = DispatchQueue(label: "chat.bitchat.noise.manager", attributes: .concurrent)
    
    // Callbacks
@@ -21,27 +21,24 @@ final class NoiseSessionManager {
    var onSessionFailed: ((PeerID, Error) -> Void)?
    
    init(localStaticKey: Curve25519.KeyAgreement.PrivateKey, keychain: KeychainManagerProtocol) {
-        self.sessionFactory = { peerID, role in
-            SecureNoiseSession(
+        self.localStaticKey = localStaticKey
+        self.keychain = keychain
+    }
+    
+    // MARK: - Session Management
+    
+    func createSession(for peerID: PeerID, role: NoiseRole) -> NoiseSession {
+        return managerQueue.sync(flags: .barrier) {
+            let session = SecureNoiseSession(
                peerID: peerID,
                role: role,
                keychain: keychain,
                localStaticKey: localStaticKey
            )
+            sessions[peerID] = session
+            return session
        }
    }
-
-    #if DEBUG
-    init(
-        localStaticKey _: Curve25519.KeyAgreement.PrivateKey,
-        keychain _: KeychainManagerProtocol,
-        sessionFactory: @escaping (PeerID, NoiseRole) -> NoiseSession
-    ) {
-        self.sessionFactory = sessionFactory
-    }
-    #endif
-    
-    // MARK: - Session Management
    
    func getSession(for peerID: PeerID) -> NoiseSession? {
        return managerQueue.sync {
@@ -51,9 +48,14 @@ final class NoiseSessionManager {
    
    func removeSession(for peerID: PeerID) {
        managerQueue.sync(flags: .barrier) {
-            if let session = sessions.removeValue(forKey: peerID) {
-                session.reset() // Clear sensitive data before removing
+            if let session = sessions[peerID] {
+                if session.isEstablished() {
+                    SecureLogger.info(.sessionExpired(peerID: peerID.id))
+                }
+                // Clear sensitive data before removing
+                session.reset()
            }
+            _ = sessions.removeValue(forKey: peerID)
        }
    }

@@ -66,6 +68,12 @@ final class NoiseSessionManager {
        }
    }
    
+    func getEstablishedSessions() -> [PeerID: NoiseSession] {
+        return managerQueue.sync {
+            return sessions.filter { $0.value.isEstablished() }
+        }
+    }
+    
    // MARK: - Handshake Helpers
    
    func initiateHandshake(with peerID: PeerID) throws -> Data {
@@ -82,7 +90,12 @@ final class NoiseSessionManager {
            }
            
            // Create new initiator session
-            let session = sessionFactory(peerID, .initiator)
+            let session = SecureNoiseSession(
+                peerID: peerID,
+                role: .initiator,
+                keychain: keychain,
+                localStaticKey: localStaticKey
+            )
            sessions[peerID] = session
            
            do {
@@ -128,7 +141,12 @@ final class NoiseSessionManager {
            // Get or create session
            let session: NoiseSession
            if shouldCreateNew {
-                let newSession = sessionFactory(peerID, .responder)
+                let newSession = SecureNoiseSession(
+                    peerID: peerID,
+                    role: .responder,
+                    keychain: keychain,
+                    localStaticKey: localStaticKey
+                )
                sessions[peerID] = newSession
                session = newSession
            } else {
@@ -189,6 +207,10 @@ final class NoiseSessionManager {
        return getSession(for: peerID)?.getRemoteStaticPublicKey()
    }
    
+    func getHandshakeHash(for peerID: PeerID) -> Data? {
+        return getSession(for: peerID)?.getHandshakeHash()
+    }
+    
    // MARK: - Session Rekeying
    
    func getSessionsNeedingRekey() -> [(peerID: PeerID, needsRekey: Bool)] {
@@ -1,85 +0,0 @@
-//
-// SecureNoiseSession.swift
-// bitchat
-//
-// This is free and unencumbered software released into the public domain.
-// For more information, see <https://unlicense.org>
-//
-
-import Foundation
-
-final class SecureNoiseSession: NoiseSession {
-    private(set) var messageCount: UInt64 = 0
-    private var sessionStartTime = Date()
-    private(set) var lastActivityTime = Date()
-    
-    override func encrypt(_ plaintext: Data) throws -> Data {
-        // Check session age
-        if Date().timeIntervalSince(sessionStartTime) > NoiseSecurityConstants.sessionTimeout {
-            throw NoiseSecurityError.sessionExpired
-        }
-        
-        // Check message count
-        if messageCount >= NoiseSecurityConstants.maxMessagesPerSession {
-            throw NoiseSecurityError.sessionExhausted
-        }
-        
-        // Validate message size
-        guard NoiseSecurityValidator.validateMessageSize(plaintext) else {
-            throw NoiseSecurityError.messageTooLarge
-        }
-        
-        let encrypted = try super.encrypt(plaintext)
-        messageCount += 1
-        lastActivityTime = Date()
-        
-        return encrypted
-    }
-    
-    override func decrypt(_ ciphertext: Data) throws -> Data {
-        // Check session age
-        if Date().timeIntervalSince(sessionStartTime) > NoiseSecurityConstants.sessionTimeout {
-            throw NoiseSecurityError.sessionExpired
-        }
-        
-        // Validate message size
-        guard NoiseSecurityValidator.validateMessageSize(ciphertext) else {
-            throw NoiseSecurityError.messageTooLarge
-        }
-        
-        let decrypted = try super.decrypt(ciphertext)
-        lastActivityTime = Date()
-        
-        return decrypted
-    }
-    
-    func needsRenegotiation() -> Bool {
-        // Check if we've used more than 90% of message limit
-        let messageThreshold = UInt64(Double(NoiseSecurityConstants.maxMessagesPerSession) * 0.9)
-        if messageCount >= messageThreshold {
-            return true
-        }
-        
-        // Check if last activity was more than 30 minutes ago
-        if Date().timeIntervalSince(lastActivityTime) > NoiseSecurityConstants.sessionTimeout {
-            return true
-        }
-        
-        return false
-    }
-    
-    // MARK: - Testing Support
-    #if DEBUG
-    func setLastActivityTimeForTesting(_ date: Date) {
-        lastActivityTime = date
-    }
-    
-    func setMessageCountForTesting(_ count: UInt64) {
-        messageCount = count
-    }
-
-    func setSessionStartTimeForTesting(_ date: Date) {
-        sessionStartTime = date
-    }
-    #endif
-}
@@ -1,22 +0,0 @@
-import Foundation
-
-enum Base64URLCoding {
-    static func encode(_ data: Data) -> String {
-        data.base64EncodedString()
-            .replacingOccurrences(of: "+", with: "-")
-            .replacingOccurrences(of: "/", with: "_")
-            .replacingOccurrences(of: "=", with: "")
-    }
-
-    static func decode(_ string: String) -> Data? {
-        var base64 = string
-        let padding = (4 - (base64.count % 4)) % 4
-        if padding > 0 {
-            base64 += String(repeating: "=", count: padding)
-        }
-        base64 = base64
-            .replacingOccurrences(of: "-", with: "+")
-            .replacingOccurrences(of: "_", with: "/")
-        return Data(base64Encoded: base64)
-    }
-}
@@ -1,135 +0,0 @@
-import Foundation
-
-/// Bech32 encoding for Nostr (minimal implementation)
-enum Bech32 {
-    private static let charset = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
-    private static let generator = [0x3b6a57b2, 0x26508e6d, 0x1ea119fa, 0x3d4233dd, 0x2a1462b3]
-    
-    static func encode(hrp: String, data: Data) throws -> String {
-        let values = convertBits(from: 8, to: 5, pad: true, data: Array(data))
-        let checksum = createChecksum(hrp: hrp, values: values)
-        let combined = values + checksum
-        
-        return hrp + "1" + combined.map { 
-            let index = charset.index(charset.startIndex, offsetBy: Int($0))
-            return String(charset[index])
-        }.joined()
-    }
-    
-    static func decode(_ bech32String: String) throws -> (hrp: String, data: Data) {
-        // Find the last occurrence of '1'
-        guard let separatorIndex = bech32String.lastIndex(of: "1") else {
-            throw Bech32Error.invalidFormat
-        }
-        
-        let hrp = String(bech32String[..<separatorIndex])
-        
-        // Validate HRP contains only ASCII characters
-        for char in hrp {
-            guard char.asciiValue != nil else {
-                throw Bech32Error.invalidCharacter
-            }
-        }
-        
-        let dataString = String(bech32String[bech32String.index(after: separatorIndex)...])
-        
-        // Convert characters to values
-        var values = [UInt8]()
-        for char in dataString {
-            guard let index = charset.firstIndex(of: char) else {
-                throw Bech32Error.invalidCharacter
-            }
-            values.append(UInt8(charset.distance(from: charset.startIndex, to: index)))
-        }
-        
-        // Verify checksum
-        guard values.count >= 6 else {
-            throw Bech32Error.invalidChecksum
-        }
-        
-        let payloadValues = Array(values.dropLast(6))
-        let checksum = Array(values.suffix(6))
-        let expectedChecksum = createChecksum(hrp: hrp, values: payloadValues)
-        
-        guard checksum == expectedChecksum else {
-            throw Bech32Error.invalidChecksum
-        }
-        
-        // Convert back to bytes
-        let bytes = convertBits(from: 5, to: 8, pad: false, data: payloadValues)
-        return (hrp: hrp, data: Data(bytes))
-    }
-    
-    enum Bech32Error: Error {
-        case invalidFormat
-        case invalidCharacter
-        case invalidChecksum
-    }
-    
-    private static func convertBits(from: Int, to: Int, pad: Bool, data: [UInt8]) -> [UInt8] {
-        var acc = 0
-        var bits = 0
-        var result = [UInt8]()
-        let maxv = (1 << to) - 1
-        
-        for value in data {
-            acc = (acc << from) | Int(value)
-            bits += from
-            
-            while bits >= to {
-                bits -= to
-                result.append(UInt8((acc >> bits) & maxv))
-            }
-        }
-        
-        if pad && bits > 0 {
-            result.append(UInt8((acc << (to - bits)) & maxv))
-        }
-        
-        return result
-    }
-    
-    private static func createChecksum(hrp: String, values: [UInt8]) -> [UInt8] {
-        let checksumValues = hrpExpand(hrp) + values + [0, 0, 0, 0, 0, 0]
-        let polymod = polymod(checksumValues) ^ 1
-        var checksum = [UInt8]()
-        
-        for i in 0..<6 {
-            checksum.append(UInt8((polymod >> (5 * (5 - i))) & 31))
-        }
-        
-        return checksum
-    }
-    
-    private static func hrpExpand(_ hrp: String) -> [UInt8] {
-        var result = [UInt8]()
-        for c in hrp {
-            guard let asciiValue = c.asciiValue else {
-                return [] // Return empty array for invalid input
-            }
-            result.append(UInt8(asciiValue >> 5))
-        }
-        result.append(0)
-        for c in hrp {
-            guard let asciiValue = c.asciiValue else {
-                return [] // Return empty array for invalid input
-            }
-            result.append(UInt8(asciiValue & 31))
-        }
-        return result
-    }
-    
-    private static func polymod(_ values: [UInt8]) -> Int {
-        var chk = 1
-        for value in values {
-            let b = chk >> 25
-            chk = (chk & 0x1ffffff) << 5 ^ Int(value)
-            for i in 0..<5 {
-                if (b >> i) & 1 == 1 {
-                    chk ^= generator[i]
-                }
-            }
-        }
-        return chk
-    }
-}
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
jack	41c297b889	Delete SpamFilterService - remove 184 lines of unused code SpamFilterService was disabled on Oct 7 because rate limits broke normal conversation (3 msg capacity, 0.5/sec refill = 1 msg per 2 seconds). Only the near-duplicate detection was being used, so: - Deleted SpamFilterService.swift (222 lines) - Moved near-dup LRU cache inline to ChatViewModel (40 lines) - Removed unused rate limiter config constants (6 lines) Net: -184 lines, clearer code, same functionality Services: 6 → 5 (SpamFilter removed) Build time: 6.10s (was 6.21s) Tests: 23/23 passing	2025-10-09 17:56:34 +02:00
jack	45fec95af2	Address PR #775 review feedback - Remove AI-generated documentation files (REFACTORING_COMPLETE.md, plans/.md) - Update minimum iOS version from 16 to 17 (enables @Observable in future) - Convert SystemMessagingService to BitchatMessage.system() factory method Removes method overload ambiguity * Cleaner API as suggested in review * Deleted SystemMessagingService.swift - Clean up deinit comments (remove unnecessary removeAll() calls) - Remove conditional OS checks in GeohashBookmarksStore (iOS/macOS only) All tests passing (23/23)	2025-10-09 17:09:51 +02:00
jackandIslam	1a569cfb80	Add proper architecture vision document	2025-10-07 22:21:27 +01:00
jackandIslam	3ad9cbe48f	Disable spam filter - limits too aggressive for normal chat CRITICAL FIX: Spam filter was breaking geohash conversation PROBLEM ======= Spam filter uses TWO token buckets that BOTH must pass: 1. Per-sender: 5 capacity, 1/sec refill 2. Per-content: 3 capacity, 0.5/sec refill ← BREAKS CHAT Content bucket allows only 3 messages, then limits to 1 message every 2 seconds. This completely breaks normal conversation. Example: Message 1-3: ✅ OK Message 4+: ❌ BLOCKED (must wait 2 sec between each) SOLUTION ======== Disabled spam filter entirely with TODO to re-enable with appropriate limits. Geohash channels have natural spam protection: - Location-scoped - User blocking available - Small audience per geohash Alternative approaches for future: - Much higher limits (50+ capacity, 10/sec refill) - Only filter unknown senders - Remove content bucket - Adaptive limits IMPACT ====== ✅ Geohash chat works normally ✅ Tests passing (23/23) SpamFilterService remains in codebase for future use.	2025-10-07 22:21:27 +01:00
jackandIslam	4f62364bf4	Fix spam filter blocking legitimate mesh messages CRITICAL BUG FIX: Spam filter was blocking Bluetooth mesh messages PROBLEM ======= SpamFilterService was being applied to ALL public messages including local Bluetooth mesh messages. This caused legitimate back-and-forth chat to be rate-limited and dropped. Logs showed: Rate limited message from mesh:... (sender:false content:true) The sender token bucket (capacity: 5, refill: 1/sec) was exhausted during normal conversation, blocking messages. ROOT CAUSE ========== When extracting SpamFilterService, the spam filter was applied to both: - Geohash/Nostr messages (from internet - spam risk HIGH) - Mesh/Bluetooth messages (local trusted peers - spam risk LOW) Mesh messages should NOT be aggressively rate-limited since they come from local trusted peers over Bluetooth. SOLUTION ======== Changed spam filter to ONLY apply to geohash messages: Before: if !spamFilter.shouldAllow(message) { return } After: if isGeo && !spamFilter.shouldAllow(message) { return } Now mesh messages bypass spam filter entirely, while geohash messages from internet still get rate-limited protection. IMPACT ====== ✅ Mesh messages now flow freely (no artificial rate limiting) ✅ Geohash messages still protected from spam ✅ Normal back-and-forth chat works correctly ✅ Tests still passing This fix is critical for usability - mesh chat is the core feature.	2025-10-07 22:21:27 +01:00
jackandIslam	fb003ba25e	Extract DeliveryTrackingService and SystemMessagingService (-37 lines) Continues god object decomposition with 2 more focused services. WHAT WAS EXTRACTED ================== 1. DeliveryTrackingService (73 lines) - updateMessageDeliveryStatus() logic - Prevents status downgrades (read → delivered) - Updates messages in both public and private chats - Triggers UI notifications 2. SystemMessagingService (42 lines) - createSystemMessage() factory methods - Consistent system message creation - Timestamp management From ChatViewModel (37 net lines reduced): - Delivery status update logic (54 lines) → thin wrapper - System message creation (inline code) → delegates to service - Message routing logic stays in ViewModel (needs channel access) NEW SERVICES =========== 1. bitchat/Services/DeliveryTrackingService.swift (73 lines) API: - updateStatus(messageID:status:messages:privateChats:notifyChange:) Features: - Prevents delivery status downgrades - Updates across all message stores - Clean separation of tracking logic 2. bitchat/Services/SystemMessagingService.swift (42 lines) API: - createSystemMessage(content:timestamp:) - createSystemMessage(content:timestamp:isRelay:originalSender:) Features: - Consistent system message factory - Reusable message creation - Timestamp management INTEGRATION =========== ChatViewModel changes: - Added deliveryTracking service - Added systemMessaging service - didReceiveReadReceipt() → delegates to deliveryTracking - didUpdateMessageDeliveryStatus() → delegates to deliveryTracking - updateMessageDeliveryStatus() → thin wrapper over deliveryTracking - addSystemMessage() → uses systemMessaging.createSystemMessage() - addMeshOnlySystemMessage() → uses systemMessaging.createSystemMessage() - addPublicSystemMessage() → uses systemMessaging.createSystemMessage() IMPACT ====== ChatViewModel: 5,394 → 5,357 lines (-0.7% this commit, -13.5% cumulative) Services added: +115 lines (2 new services) Tests: ✅ All 23 passing Build: ✅ Clean (6.21s) Cumulative god object reduction: -838 lines (13.5% total) Services extracted: 6 total 1. SpamFilterService (222) 2. ColorPaletteService (328) 3. MessageFormattingService (618) 4. GeohashParticipantsService (180) 5. DeliveryTrackingService (73) 6. SystemMessagingService (42) Total service lines: 1,463 Progress toward next milestone: Current: 5,357 lines Target: < 5,000 lines Remaining: 357 lines to extract TEST RESULTS ============ ✔ All 23 tests passing ✔ Build completes successfully ✔ Zero regressions ✔ Delivery tracking still works correctly ✔ System messages still display properly	2025-10-07 22:21:27 +01:00
jackandIslam	52c51c9be6	Add refactoring completion summary	2025-10-07 22:21:27 +01:00
jackandIslam	96a580491a	Extract GeohashParticipantsService from ChatViewModel (-66 lines) Continues god object decomposition by extracting geohash participant tracking. WHAT WAS EXTRACTED ================== Moved to GeohashParticipantsService (66 net lines reduced): - geoParticipants state dictionary - geohashPeople @Published property (now computed) - geoParticipantsTimer management - recordGeoParticipant() implementations → thin wrappers - refreshGeohashPeople() → no-op (service auto-refreshes) - startGeoParticipantsTimer() → no-op (service auto-starts) - stopGeoParticipantsTimer() → no-op (service auto-stops) - visibleGeohashPeople() → delegates to service - geohashParticipantCount() → delegates to service NEW SERVICE =========== bitchat/Services/GeohashParticipantsService.swift (180 lines) Features: - Tracks participants per geohash with lastSeen timestamps - Automatic 5-minute activity window pruning - Timer-based periodic refresh (30s) - Filters blocked users automatically - currentGeohash tracking with auto timer start/stop - ObservableObject for SwiftUI integration API: - setCurrentGeohash() - Set active geohash, auto-manages timer - recordParticipant() - Record participant activity - visiblePeople() - Get current participant list - participantCount() - Get count for specific geohash - removeParticipant() - Remove when blocked - reset() - Clear all state INTEGRATION =========== ChatViewModel changes: - geohashPeople is now computed property (delegates to service) - All participant tracking delegated to service - currentGeohash changes now sync with service via setCurrentGeohash() - Added @MainActor to handleNostrEvent() and subscribeNostrEvent() for proper actor isolation Backward compatibility: - All existing method signatures maintained - recordGeoParticipant() kept as thin wrappers - Timer start/stop kept as no-ops (service manages automatically) IMPACT ====== ChatViewModel: 5,418 → 5,394 lines (-0.4% this commit, -12.9% cumulative) New service: +180 lines (focused, testable) Tests: ✅ All 23 passing Build: ✅ Clean (5.60s, improved from 6.52s) Cumulative god object reduction: -801 lines (12.9% total) Services extracted: 4 (Spam, ColorPalette, MessageFormatting, GeohashParticipants) QUALITY IMPROVEMENTS ==================== - Participant lifecycle logic isolated - Timer management automatic (no manual start/stop needed) - Clearer separation of geohash vs mesh logic - Easier to test participant tracking - State properly encapsulated TEST RESULTS ============ ✔ All 23 tests passing ✔ Build completes successfully (5.60s - fastest yet!) ✔ Zero regressions ✔ Participant tracking still works correctly	2025-10-07 22:21:27 +01:00
jackandIslam	fec5769fd2	Extract MessageFormattingService from ChatViewModel (-445 lines) Continues god object decomposition by extracting complex message formatting logic. WHAT WAS EXTRACTED ================== Removed from ChatViewModel (445 lines): - Regexes enum with 8 precompiled patterns (29 lines) - formatMessageAsText() - complex formatter (348 lines) • Hashtag detection and styling • @mention detection with suffix handling • URL detection and linking • Cashu token detection and chip rendering • Lightning payment detection (BOLT11, LNURL) • Message caching integration • Self/other message styling • Relay attribution formatting - formatMessage() - simpler formatter (96 lines) - GeoPerson struct moved to Models/ (5 lines) NEW FILES ========= 1. bitchat/Services/MessageFormattingService.swift (618 lines) - Complete message formatting logic - Syntax highlighting for mentions, hashtags, links - Payment token detection and styling - Channel-aware formatting - Uses ColorPaletteService for consistent colors 2. bitchat/Models/GeoPerson.swift (16 lines) - Shared model for geohash participants - Used by both ChatViewModel and MessageFormattingService - Eliminates type duplication INTEGRATION =========== ChatViewModel now delegates formatting: - formatMessageAsText() → messageFormatter.formatMessageAsText() - formatMessage() → messageFormatter.formatMessage() Thin wrapper functions maintain API compatibility with views. IMPACT ====== ChatViewModel: 5,863 → 5,418 lines (-7.6% this commit, -12.5% cumulative) New service: +618 lines (focused, testable) New model: +16 lines Tests: ✅ All 23 passing Build: ✅ Clean (6.52s) 🎉 MILESTONE ACHIEVED: ChatViewModel < 5,500 lines! Cumulative god object reduction: -777 lines (12.5% total) Services extracted: 3 (Spam, ColorPalette, MessageFormatting) QUALITY IMPROVEMENTS ==================== - Complex regex logic isolated in dedicated service - Message formatting now unit-testable - Clearer separation between formatting and business logic - GeoPerson properly modeled in Models/ - Reduced ChatViewModel cognitive complexity TEST RESULTS ============ ✔ All 23 tests passing ✔ Build completes successfully (6.52s) ✔ Zero regressions ✔ All message formatting still works correctly Next recommended extraction: GeohashParticipantsService (~80 lines)	2025-10-07 22:21:27 +01:00
jackandIslam	12d3e91182	Extract ColorPaletteService from ChatViewModel (-248 lines) Continues god object decomposition by extracting peer color assignment logic. WHAT WAS EXTRACTED ================== Removed from ChatViewModel (248 net lines): - Peer palette dictionaries and state (6 dictionaries) - peerColor() function (20 lines) - getPeerPaletteColor() function (17 lines) - getNostrPaletteColor() function (20 lines) - rebuildPeerPaletteIfNeeded() function (69 lines) - rebuildNostrPaletteIfNeeded() function (96 lines) - meshSeed() helper (6 lines) - Minimal-distance color assignment algorithm (140 lines) NEW SERVICE =========== bitchat/Services/ColorPaletteService.swift (330 lines) Features: - Minimal-distance hue assignment algorithm - Separate palettes for mesh/Nostr peers - Light/dark mode support - Deterministic color assignment with stability - Fallback to seed-based colors API: - colorForMeshPeer() - Get color for mesh peer - colorForNostrPubkey() - Get color for Nostr participant - peerColor() - Auto-detect type and assign color - reset() - Clear state for testing INTEGRATION =========== Updated ChatViewModel wrapper functions: - colorForNostrPubkey() - now delegates to ColorPaletteService - colorForMeshPeer() - now delegates to ColorPaletteService - formatMessageAsText() - uses colorPalette.peerColor() Removed duplicate Color(peerSeed:isDark:) extension from ColorPaletteService (already exists in Utils/Color+Peer.swift with caching). IMPACT ====== ChatViewModel: 6,111 → 5,863 lines (-4.1% this commit, -5.4% cumulative) New service: +330 lines (focused, testable) Tests: ✅ All 23 passing Build: ✅ Clean (5.96s) Cumulative god object reduction: -384 lines (6.2% total) Services extracted: 2 (SpamFilterService, ColorPaletteService)	2025-10-07 22:21:27 +01:00
jackandIslam	cf6d169337	Fix top 3 critical issues: memory leaks, god object, threading This commit addresses the three highest-impact issues identified in the codebase analysis (plans/codebase-issues-and-optimizations.md). ISSUE #2: Memory Leaks (Impact: 9/10) - FIXED ============================================== Added comprehensive deinit cleanup to all 9 ObservableObject classes: - ChatViewModel: cleanup 17 NotificationCenter observers + 3 timers - NostrRelayManager: close WebSockets + cancel reconnection timers - LocationNotesManager: subscription cleanup - LocationNotesCounter: subscription cleanup - FavoritesPersistenceService: clear Combine subscriptions - GeohashBookmarksStore: cancel CLGeocoder operations - UnifiedPeerService: remove observers + clear subscriptions - NetworkActivationService: clear Combine subscriptions - PrivateChatManager: clear state dictionaries Impact: Prevents memory leaks, improves stability, enables proper cleanup. ISSUE #1: God Objects (Impact: 10/10) - PROOF OF CONCEPT ========================================================= Extracted SpamFilterService from ChatViewModel as demonstration: - New file: bitchat/Services/SpamFilterService.swift (223 lines) - Removed ~150 lines of spam filtering code from ChatViewModel - Created clean, testable API: shouldAllow(), isNearDuplicate() - Demonstrates pattern for future service extractions Impact: Reduces ChatViewModel by 2.4%, creates reusable service, demonstrates decomposition approach. ISSUE #3: Threading (Impact: 9/10) - DOCUMENTED ================================================ Created comprehensive analysis and migration plan: - Documented current threading complexity (9 queues, 127 @MainActor) - Recommended Swift Concurrency migration strategy - 4-phase action plan with timeline - Quick wins section (~1 day of work) Impact: Provides roadmap, documents current state, prevents new issues. TEST RESULTS ============ ✔ All 23 tests passing ✔ Build completes successfully (6.31s) ✔ No compiler warnings ✔ Zero regressions METRICS ======= Memory safety: 9/9 deinits (was 5/9) = +80% improvement ChatViewModel: -136 lines (6,195 → 6,059) New service: SpamFilterService (+223 lines, testable) Test stability: 23/23 tests passing See plans/refactoring-progress-report.md for complete details.	2025-10-07 22:21:27 +01:00
				`@@ -1 +0,0 @@`
				{"v1":{"usrs":["param-buf-arti_bootstrap_summary(_:_:)-s:3Tor22arti_bootstrap_summary33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSpys4Int8VG_AEtF","param-dataDir-arti_start(_:_:)-s:3Tor10arti_start33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSPys4Int8VG_s6UInt16VtF","param-len-arti_bootstrap_summary(_:_:)-s:3Tor22arti_bootstrap_summary33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSpys4Int8VG_AEtF","param-socksPort-arti_start(_:_:)-s:3Tor10arti_start33_954FD7701B4E47ABB5F166D1CF862DC9LLys5Int32VSPys4Int8VG_s6UInt16VtF","s:13BitFoundation16PeerCapabilitiesV8wifiBulkACvpZ","s:13BitFoundation18KeychainReadResultO18isRecoverableErrorSbvp","s:13BitFoundation23KeychainManagerProtocolP11secureClearyySSzF","s:18bitchatTests_macOS12MockKeychainC11secureClearyySSzF","s:18bitchatTests_macOS20TrackingMockKeychainC11resetCountsyyF","s:18bitchatTests_macOS20TrackingMockKeychainC11secureClearyySSzF","s:18bitchatTests_macOS20TrackingMockKeychainC25totalSecureClearCallCountSivp","s:18bitchatTests_macOS20TrackingMockKeychainC26secureClearStringCallCountSivp","s:18bitchatTests_macOS20TrackingMockKeychainC27_secureClearStringCallCount06_AB6D1M24FD239F2969C82F4108818260LLSivp","s:18bitchatTests_macOS24FailingCacheSaveKeychain33_22380C7A11A569A0B83FA83F34C498A7LLC11secureClearyySSzF","s:18bitchatTests_macOS24MockGeohashPresenceTimer33_483587EFB96650EE130EFB09BBA2A1AALLC7handleryycvp","s:3Tor0A7ManagerC21goDormantOnBackgroundyyF","s:7bitchat10AppRuntimeC24handleScreenshotCaptured33_C8B369AD8BC1D9963A50CEDA77A4332ALLyyF","s:7bitchat10AppRuntimeC33handleDidBecomeActiveNotificationyyF","s:7bitchat10BLEServiceC18logBluetoothStatus33_69191C53E68500C17D98DBCF2BDA7100LLyySSF","s:7bitchat10BLEServiceC20centralRestorationID33_69191C53E68500C17D98DBCF2BDA7100LLSSvpZ","s:7bitchat10BLEServiceC22captureBluetoothStatus33_69191C53E68500C17D98DBCF2BDA7100LL7contextySS_tF","s:7bitchat10BLEServiceC23peripheralRestorationID33_69191C53E68500C17D98DBCF2BDA7100LLSSvpZ","s:7bitchat10BLEServiceC29scheduleBluetoothStatusSample33_69191C53E68500C17D98DBCF2BDA7100LL5after7contextySd_SStF","s:7bitchat10QRScanViewV8isActiveSbvp","s:7bitchat15BLEPeerRegistryV5countSivp","s:7bitchat15KeychainManagerC11secureClearyySSzF","s:7bitchat15PaymentChipViewV7openURL33_10AC50641B1EBCD52E5092A2E521D236LL7SwiftUI13OpenURLActionVvp","s:7bitchat15TransportConfigO29uiBatchDispatchStaggerSecondsSdvpZ","s:7bitchat15TransportConfigO35uiShareExtensionDismissDelaySecondsSdvpZ","s:7bitchat15TransportConfigO38bleBackgroundPendingConnectSlotReserveSivpZ","s:7bitchat17GossipSyncManagerC10persistNowyyF","s:7bitchat17NostrRelayManagerC15InboundEventKey33_E4160FE8A9A2C9D6308EAAD5A8B5CB07LLV7eventIDSSvp","s:7bitchat17PrekeyBundleStoreC12StoredBundleV8noiseKey10Foundation4DataVvp","s:7bitchat25LocationNotesDependenciesV3now10Foundation4DateVycvp","s:7bitchat25NWPathReachabilityMonitorC7monitor33_84633C9DBCAF57538179C1E04DB8E015LL7Network0bD0CSgvp"]}}