Merge 7af1ff7407b15bd2b6d24573e22d4bdb06b7d7dc into 3b53b9bdcc941d39c6cb3dd67852d57162db7001

Wear OS app: standalone bitchat client for Pixel Watch

.github/workflows/android-build.yml

@@ -15,6 +15,8 @@ jobs:
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
+      with:
+        submodules: recursive
 
     - name: Set up JDK 17
       uses: actions/setup-java@v4
@@ -25,6 +27,23 @@ jobs:
     - name: Setup Gradle
       uses: gradle/gradle-build-action@v3
 
+    - name: Set up Rust 1.95.0
+      uses: dtolnay/rust-toolchain@1.95.0
+      with:
+        targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android,i686-linux-android
+
+    - name: Set up Android NDK
+      run: sdkmanager "ndk;28.2.13676358"
+
+    - name: Install cargo-ndk
+      run: cargo install cargo-ndk --version 4.1.2 --locked
+
+    - name: Build NDR FFI from pinned source
+      run: ./app/src/main/ndr-ffi/build-android.sh
+
+    - name: Verify generated NDR binding is current
+      run: git diff --exit-code -- app/src/main/java/uniffi/ndr_ffi/ndr_ffi.kt
+
     - name: Grant execute permission for gradlew
       run: chmod +x gradlew
 
@@ -71,6 +90,8 @@ jobs:
     steps:
     - name: Checkout code
       uses: actions/checkout@v4
+      with:
+        submodules: recursive
 
     - name: Set up JDK 17
       uses: actions/setup-java@v4
@@ -81,6 +102,20 @@ jobs:
     - name: Setup Gradle
       uses: gradle/gradle-build-action@v3
 
+    - name: Set up Rust 1.95.0
+      uses: dtolnay/rust-toolchain@1.95.0
+      with:
+        targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android,i686-linux-android
+
+    - name: Set up Android NDK
+      run: sdkmanager "ndk;28.2.13676358"
+
+    - name: Install cargo-ndk
+      run: cargo install cargo-ndk --version 4.1.2 --locked
+
+    - name: Build NDR FFI from pinned source
+      run: ./app/src/main/ndr-ffi/build-android.sh
+
     - name: Grant execute permission for gradlew
       run: chmod +x gradlew
 

.github/workflows/release.yml

@@ -13,6 +13,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Set up JDK
         uses: actions/setup-java@v4
@@ -25,6 +27,23 @@ jobs:
         with:
           gradle-version: wrapper
 
+      - name: Set up Rust 1.95.0
+        uses: dtolnay/rust-toolchain@1.95.0
+        with:
+          targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android,i686-linux-android
+
+      - name: Set up Android NDK
+        run: sdkmanager "ndk;28.2.13676358"
+
+      - name: Install cargo-ndk
+        run: cargo install cargo-ndk --version 4.1.2 --locked
+
+      - name: Build NDR FFI from pinned source
+        run: ./app/src/main/ndr-ffi/build-android.sh
+
+      - name: Verify generated NDR binding is current
+        run: git diff --exit-code -- app/src/main/java/uniffi/ndr_ffi/ndr_ffi.kt
+
       - name: Cache Gradle files
         uses: actions/cache@v3
         with:

.gitignore

@@ -7,6 +7,7 @@ build/
 !*/build/intermediates/
 local.properties
 .gradle/
+.kotlin/
 captures/
 .externalNativeBuild/
 debug_keystore/
@@ -40,6 +41,11 @@ dependency-reduced-pom.xml
 # Linters
 .lint/
 
+# Python test tooling
+**/__pycache__/
+*.py[cod]
+release-gate-results/
+
 # Other
 *.log
 .cxx/
@@ -63,3 +69,9 @@ google-services.json
 # Arti build artifacts (cloned repo and Rust build cache)
 tools/arti-build/.arti-source/
 tools/arti-build/target/
+
+# Generated from the pinned nostr-double-ratchet source submodule.
+app/src/main/jniLibs/*/libndr_ffi.so
+
+# JVM heap dumps (a Gradle daemon OOM drops these in the repo root)
+*.hprof

.gitmodules

@@ -0,0 +1,4 @@
+[submodule "vendor/nostr-double-ratchet"]
+	path = vendor/nostr-double-ratchet
+	url = https://github.com/irislib/nostr-double-ratchet.git
+	shallow = true

AGENTS.md

@@ -56,6 +56,11 @@ The application follows a clean architecture pattern, heavily modularized by fea
 ### Testing
 - **Unit Tests**: Located in `app/src/test/`. Use for business logic, protocols, and utility testing.
 - **Instrumented Tests**: Located in `app/src/androidTest/`. Use for UI and permission integration testing.
+- **Device Mesh Tests (ADB test hooks)**: Two-physical-device scenarios driven over ADB, **kept separate from Gradle/CI** — run them manually when changing mesh/crypto/transfer code. A debug-only broadcast receiver (`app/src/debug/java/com/bitchat/android/testhook/`, never in release builds) exposes mesh operations (scan, connect, Noise handshake, DMs, broadcast, files, raw packet injection) via `am broadcast -a com.bitchat.droid.TEST_HOOK`; the host orchestrator is `tools/release_gate/mesh_lab.py`. Full guide: `docs/release-gate-runbook.md` appendix "mesh lab".
+  - Prereqs: `adb` on PATH, Python 3.10+, two devices with USB debugging, **both unlocked with screen on** (locked/dozing → POWER_SAVER → flaky timing).
+  - Setup: `./gradlew assembleDebug && python3 tools/release_gate/mesh_lab.py setup --serial-a <s1> --serial-b <s2> --apk app/build/outputs/apk/debug/app-arm64-v8a-debug.apk`
+  - Run: `python3 tools/release_gate/mesh_lab.py scenario all --serial-a <s1> --serial-b <s2> --out /tmp/meshlab-evidence`
+  - Scenarios: `dm`, `broadcast`, `file`, `file_oversize`, `file_private`, `raw`, `session_recovery`, `identity_reset`, `all`. Ad-hoc: `... cmd --serial <s> state`.
 - **Execution**:
   - Unit: `./gradlew test`
   - Instrumented: `./gradlew connectedAndroidTest`

CHANGELOG.md

@@ -1,178 +0,0 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-## [1.4.0] - 2025-10-15
-### Fixed
-- fix: Resolve debug settings bottom sheet crash on some devices (Issue #472)
-  - Fixed IllegalFormatConversionException in DebugSettingsSheet.kt when scrolling through debug settings
-  - Corrected string formatting for debug_target_fpr_fmt and debug_derived_p_fmt string resources
-  - Improved string resource parameter handling for numeric values
-
-## [0.7.2] - 2025-07-20
-### Fixed
-- fix: battery optimization screen content scrollable with fixed buttons
-
-## [0.7.1] - 2025-07-19
-
-### Added
-- feat(battery): add battery optimization management for background reliability
-
-### Fixed
-- fix: center align toolbar item in ChatHeader - passed modifier.fillmaxHeight so the content inside the row can actually be centered
-- fix: update sidebar text to use string resources
-- fix(chat): cursor location and enhance message input with slash command styling
-
-### Changed
-- refactor: remove context attribute at ChatViewModel.kt
-- Refactor: Migrate MainViewModel to use StateFlow
-
-### Improved
-- Use HorizontalDivider instead of deprecated Divider
-- Use contentPadding instead of padding so items remain fully visible
-
-
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [0.7]
-
-### Added
-- Location services check during app startup with educational UI
-- Message text selection functionality in chat interface
-- Enhanced RSSI tracking and unread message indicators
-- Major Bluetooth connection architecture refactoring with dedicated managers
-
-### Fixed
-- **Critical**: Android-iOS message fragmentation compatibility issues
-  - Fixed fragment size (500→150 bytes) and ID generation for cross-platform messaging
-  - Ensures Android can properly communicate with iOS devices
-- DirectMessage notifications and text copying functionality
-- Smart routing optimizations (no relay loops, targeted delivery)
-- Build system compilation issues and null pointer exceptions
-
-### Changed
-- Comprehensive dependency updates (AGP 8.10.1, Kotlin 2.2.0, Compose 2025.06.01)
-- Optimized BLE scan intervals for better battery performance
-- Reduced excessive logging output
-
-### Improved
-- Cross-platform compatibility with iOS and Rust implementations
-- Connection stability through architectural improvements
-- Battery performance via scan duty cycling
-- User onboarding with location services education
-
-## [0.6]
-
-### Added
-- Channel password management with `/pass` command for channel owners
-- Monochrome/themed launcher icon for Android 12+ dynamic theming support
-- Unit tests package with initial testing infrastructure
-- Production build optimization with code minification and shrinking
-- Native back gesture/button handling for all app views
-
-### Fixed
-- Favorite peer functionality completely restored and improved
-  - Enhanced favorite system with fallback mechanism for peers without key exchange
-  - Fixed UI state updates for favorite stars in both header and sidebar
-  - Improved favorite persistence across app sessions
-- `/w` command now displays user nicknames instead of peer IDs
-- Button styling and layout improvements across the app
-  - Enhanced back button positioning and styling
-  - Improved private chat and channel header button layouts
-  - Fixed button padding and alignment issues
-- Color scheme consistency updates
-  - Updated orange color throughout the app to match iOS version
-  - Consistent color usage for private messages and UI elements
-- App startup reliability improvements
-  - Better initialization sequence handling
-  - Fixed null pointer exceptions during startup
-  - Enhanced error handling and logging
-- Input field styling and behavior improvements
-- Sidebar user interaction enhancements
-- Permission explanation screen layout fixes with proper vertical padding
-
-### Changed
-- Updated GitHub organization references in project files
-- Improved README documentation with updated clone URLs
-- Enhanced logging throughout the application for better debugging
-
-## [0.5.1] - 2025-07-10
-
-### Added
-- Bluetooth startup check with user prompt to enable Bluetooth if disabled
-
-### Fixed
-- Improved Bluetooth initialization reliability on first app launch
-
-## [0.5] - 2025-07-10
-
-### Added
-- New user onboarding screen with permission explanations
-- Educational content explaining why each permission is required
-- Privacy assurance messaging (no tracking, no servers, local-only data)
-
-### Fixed
-- Comprehensive permission validation - ensures all required permissions are granted
-- Proper Bluetooth stack initialization on first app load
-- Eliminated need for manual app restart after installation
-- Enhanced permission request coordination and error handling
-
-### Changed
-- Improved first-time user experience with guided setup flow
-
-## [0.4] - 2025-07-10
-
-### Added
-- Push notifications for direct messages
-- Enhanced notification system with proper click handling and grouping
-
-### Improved
-- Direct message (DM) view with better user interface
-- Enhanced private messaging experience
-
-### Known Issues
-- Favorite peer functionality currently broken
-
-## [0.3] - 2025-07-09
-
-### Added
-- Battery-aware scanning policies for improved power management
-- Dynamic scan behavior based on device battery state
-
-### Fixed
-- Android-to-Android Bluetooth Low Energy connections
-- Peer discovery reliability between Android devices
-- Connection stability improvements
-
-## [0.2] - 2025-07-09
-
-### Added
-- Initial Android implementation of bitchat protocol
-- Bluetooth Low Energy mesh networking
-- End-to-end encryption for private messages
-- Channel-based messaging with password protection
-- Store-and-forward message delivery
-- IRC-style commands (/msg, /join, /clear, etc.)
-- RSSI-based signal quality indicators
-
-### Fixed
-- Various Bluetooth handling improvements
-- User interface refinements
-- Connection reliability enhancements
-
-## [0.1] - 2025-07-08
-
-### Added
-- Initial release of bitchat Android client
-- Basic mesh networking functionality
-- Core messaging features
-- Protocol compatibility with iOS bitchat client
-
-[Unreleased]: https://github.com/permissionlesstech/bitchat-android/compare/0.5.1...HEAD
-[0.5.1]: https://github.com/permissionlesstech/bitchat-android/compare/0.5...0.5.1
-[0.5]: https://github.com/permissionlesstech/bitchat-android/compare/0.4...0.5
-[0.4]: https://github.com/permissionlesstech/bitchat-android/compare/0.3...0.4
-[0.3]: https://github.com/permissionlesstech/bitchat-android/compare/0.2...0.3
-[0.2]: https://github.com/permissionlesstech/bitchat-android/compare/0.1...0.2
-[0.1]: https://github.com/permissionlesstech/bitchat-android/releases/tag/0.1

GOOGLE_PLAY.md

@@ -1 +0,0 @@
-I, callebtc, creator of bitchat for android, owner of the copyright claims, and owner of the official bitchat android repository (https://github.com/permissionlesstech/bitchat-android), hereby authorize Verse Communication PBC to publish bitchat (com.bitchat.doid) on the Google Play Store.

PRIVACY_POLICY.md

@@ -1,156 +0,0 @@
-# bitchat Privacy Policy
-
-*Last updated: January 2025*
-
-## Our Commitment
-
-bitchat is designed with privacy as its foundation. We believe private communication is a fundamental human right. This policy explains how bitchat protects your privacy.
-
-## Summary
-
-**WE DO NOT COLLECT ANY INFORMATION.**
-
-- **No personal data collection** - We don't collect names, emails, or phone numbers
-- **No location data collection** - Location is accessed only for local processing (BLE/Geohash) and is never collected or sent to us
-- **Hybrid Functionality** - bitchat offers two modes of communication:
-  - **Bluetooth Mesh Chat**: This mode is completely offline, using peer-to-peer Bluetooth connections. It does not use any servers or internet connection.
-  - **Geohash Chat**: This mode uses an internet connection to communicate with others in a specific geographic area. It relies on Nostr relays for message transport.
-- **No tracking** - We have no analytics, telemetry, or user tracking
-- **Open source** - You can verify these claims by reading our code
-
-## What Information bitchat Stores
-
-### On Your Device Only
-
-1. **Identity Key** 
-   - A cryptographic key generated on first launch
-   - Stored locally in your device's secure storage
-   - Allows you to maintain "favorite" relationships across app restarts
-   - Never leaves your device
-
-2. **Nickname**
-   - The display name you choose (or auto-generated)
-   - Stored only on your device
-   - Shared with peers you communicate with
-
-3. **Message History** (if enabled)
-   - When room owners enable retention, messages are saved locally
-   - Stored encrypted on your device
-   - You can delete this at any time
-
-4. **Favorite Peers**
-   - Public keys of peers you mark as favorites
-   - Stored only on your device
-   - Allows you to recognize these peers in future sessions
-
-### Temporary Session Data
-
-During each session, bitchat temporarily maintains:
-- Active peer connections (forgotten when app closes)
-- Routing information for message delivery
-- Cached messages for offline peers (12 hours max)
-
-## What Information is Shared
-
-### With Other bitchat Users
-
-When you use bitchat, nearby peers can see:
-- Your chosen nickname
-- Your ephemeral public key (changes each session)
-- Messages you send to public rooms or directly to them
-- Your approximate Bluetooth signal strength (for connection quality)
-
-### With Room Members
-
-When you join a password-protected room:
-- Your messages are visible to others with the password
-- Your nickname appears in the member list
-- Room owners can see you've joined
-
-## What We DON'T Do
-
-bitchat **never**:
-- Collects personal information
-- Collects location history
-- Transmits any data to us (the developers)
-- Stores data on servers
-- Shares data with third parties
-- Uses analytics or telemetry
-- Creates user profiles
-- Requires registration
-
-## Encryption
-
-All private messages use end-to-end encryption:
-- **X25519** for key exchange
-- **AES-256-GCM** for message encryption
-- **Ed25519** for digital signatures
-- **Argon2id** for password-protected rooms
-
-## Your Rights
-
-You have complete control:
-- **Delete Everything**: Triple-tap the logo to instantly wipe all data
-- **Leave Anytime**: Close the app and your presence disappears
-- **No Account**: Nothing to delete from servers because there are none
-- **Portability**: Your data never leaves your device unless you export it
-
-## Location Data & Permissions
-
-To provide the core functionality of bitchat, we access your device's location data. This access is necessary for the following specific purposes:
-
-### 1. Bluetooth Low Energy (BLE) Scanning
-- **Why we need it:** The Android operating system requires Location permission to scan for nearby Bluetooth LE devices (especially on Android 11 and lower). This is a system-level requirement because Bluetooth scans can theoretically be used to derive location.
-- **How we use it:** We use this permission strictly to discover other bitchat peers nearby for the "Bluetooth Mesh Chat" mode.
-- **Privacy protection:** We do not record or store your location during this process. The data is processed instantaneously by the Android system to facilitate the connection.
-
-### 2. Geohash Chat Functionality
-- **Why we need it:** The "Geohash Chat" mode allows you to communicate with others in your approximate geographic area.
-- **How we use it:** If you enable this mode, we access your location to calculate a "geohash" (a short alphanumeric string representing a geographic region). This geohash is used to find and subscribe to relevant channels on decentralized Nostr relays.
-- **Privacy protection:** 
-  - Your precise GPS coordinates are **never** sent to any server or peer.
-  - Only the coarse geohash (representing an area, not a pinpoint) is shared with the Nostr network.
-  - You can use the "Bluetooth Mesh Chat" mode without this feature if you prefer.
-
-**We do not collect, store, or share your location history.** Location data is processed locally on your device to enable these specific features.
-
-## Children's Privacy
-
-bitchat does not knowingly collect information from children. The app has no age verification because it collects no personal information from anyone.
-
-## Data Retention
-
-- **Messages**: Deleted from memory when app closes (unless room retention is enabled)
-- **Identity Key**: Persists until you delete the app
-- **Favorites**: Persist until you remove them or delete the app
-- **Everything Else**: Exists only during active sessions
-
-## Security Measures
-
-- All communication is encrypted
-- No data transmitted to servers (there are none)
-- Open source code for public audit
-- Regular security updates
-- Cryptographic signatures prevent tampering
-
-## Changes to This Policy
-
-If we update this policy:
-- The "Last updated" date will change
-- The updated policy will be included in the app
-- No retroactive changes can affect data (since we don't collect any)
-
-## Contact
-
-bitchat is an open source project. For privacy questions:
-- Review our code: https://github.com/yourusername/bitchat
-- Open an issue on GitHub
-- Join the discussion in public rooms
-
-## Philosophy
-
-Privacy isn't just a feature—it's the entire point. bitchat proves that modern communication doesn't require surrendering your privacy. No accounts, no servers, no surveillance. Just people talking freely.
-
----
-
-*This policy is released into the public domain under The Unlicense, just like bitchat itself.*

README.md

@@ -1,308 +1,86 @@
-<p align="center">
-    <img src="https://github.com/user-attachments/assets/188c42f8-d249-4a72-b27a-e2b4f10a00a8" alt="Bitchat Android Logo" width="480">
-</p>
+<img width="256" height="256" alt="icon_128x128@2x" src="https://github.com/user-attachments/assets/90133f83-b4f6-41c6-aab9-25d0859d2a47" />
 
-> [!WARNING]
-> This software has not received external security review and may contain vulnerabilities and may not necessarily meet its stated security goals. Do not use it for sensitive use cases, and do not rely on its security until it has been reviewed. Work in progress.
+## bitchat for Android
 
-# bitchat for Android
+A decentralized peer-to-peer messaging app with dual transport architecture: local Bluetooth mesh networks for offline communication and internet-based Nostr protocol for global reach. No accounts, no phone numbers, no central servers.
 
-A secure, decentralized, peer-to-peer messaging app that works over Bluetooth mesh networks. No internet required for mesh chats, no servers, no phone numbers - just pure encrypted communication. Bitchat also supports geohash channels, which use an internet connection to connect you with others in your geographic area.
+This is the Android implementation of bitchat, fully protocol-compatible with the [iOS version](https://github.com/permissionlesstech/bitchat) for cross-platform mesh communication.
 
-This is the **Android port** of the original [bitchat iOS app](https://github.com/jackjackbits/bitchat), maintaining 100% protocol compatibility for cross-platform communication.
+[bitchat.free](http://bitchat.free)
 
-## Install bitchat
-
-You can download the latest version of bitchat for Android from the [GitHub Releases page](https://github.com/permissionlesstech/bitchat-android/releases).
-
-Or you can:
+[GitHub Releases](https://github.com/permissionlesstech/bitchat-android/releases)
 
 [<img alt="Get it on Google Play" height="60" src="https://play.google.com/intl/en_us/badges/static/images/badges/en_badge_web_generic.png"/>](https://play.google.com/store/apps/details?id=com.bitchat.droid)
 
-**Instructions:**
-
-1.  **Download the APK:** On your Android device, navigate to the link above and download the latest `.apk` file. Open it.
-2.  **Allow Unknown Sources:** On some devices, before you can install the APK, you may need to enable "Install from unknown sources" in your device's settings. This is typically found under **Settings > Security** or **Settings > Apps & notifications > Special app access**.
-3.  **Install:** Open the downloaded `.apk` file to begin the installation.
-
 ## License
 
 This project is released into the public domain. See the [LICENSE](LICENSE.md) file for details.
 
 ## Features
 
-- **✅ Cross-Platform Compatible**: Full protocol compatibility with iOS bitchat
-- **✅ Decentralized Mesh Network**: Automatic peer discovery and multi-hop message relay over Bluetooth LE
-- **✅ End-to-End Encryption**: X25519 key exchange + AES-256-GCM for private messages
-- **✅ Channel-Based Chats**: Topic-based group messaging with optional password protection
-- **✅ Store & Forward**: Messages cached for offline peers and delivered when they reconnect
-- **✅ Privacy First**: No accounts, no phone numbers, no persistent identifiers
-- **✅ IRC-Style Commands**: Familiar `/join`, `/msg`, `/who` style interface
-- **✅ Message Retention**: Optional channel-wide message saving controlled by channel owners
-- **✅ Emergency Wipe**: Triple-tap logo to instantly clear all data
-- **✅ Modern Android UI**: Jetpack Compose with Material Design 3
-- **✅ Dark/Light Themes**: Terminal-inspired aesthetic matching iOS version
-- **✅ Battery Optimization**: Adaptive scanning and power management
-
-## Android Setup
-
-### Prerequisites
-
-- **Android Studio**: Arctic Fox (2020.3.1) or newer
-- **Android SDK**: API level 26 (Android 8.0) or higher
-- **Kotlin**: 1.8.0 or newer
-- **Gradle**: 7.0 or newer
-
-### Build Instructions
-
-1. **Clone the repository:**
-   ```bash
-   git clone https://github.com/permissionlesstech/bitchat-android.git
-   cd bitchat-android
-   ```
-
-2. **Open in Android Studio:**
-   ```bash
-   # Open Android Studio and select "Open an Existing Project"
-   # Navigate to the bitchat-android directory
-   ```
-
-3. **Build the project:**
-   ```bash
-   ./gradlew build
-   ```
-
-4. **Install on device:**
-   ```bash
-   ./gradlew installDebug
-   ```
-
-### Development Build
-
-For development builds with debugging enabled:
-
-```bash
-./gradlew assembleDebug
-adb install -r app/build/outputs/apk/debug/app-debug.apk
-```
-
-### Release Build
-
-For production releases:
-
-```bash
-./gradlew assembleRelease
-```
-
-## Android-Specific Requirements
-
-### Permissions
-
-The app requires the following permissions (automatically requested):
-
-- **Bluetooth**: Core BLE functionality
-- **Location**: Required for BLE scanning on Android
-- **Network**: Expand your mesh through public internet relays
-- **Notifications**: Message alerts and background updates
-
-### Hardware Requirements
-
-- **Bluetooth LE (BLE)**: Required for mesh networking
-- **Android 8.0+**: API level 26 minimum
-- **RAM**: 2GB recommended for optimal performance
-
-## Usage
-
-### Basic Commands
-
-- `/j #channel` - Join or create a channel
-- `/m @name message` - Send a private message
-- `/w` - List online users
-- `/channels` - Show all discovered channels
-- `/block @name` - Block a peer from messaging you
-- `/block` - List all blocked peers
-- `/unblock @name` - Unblock a peer
-- `/clear` - Clear chat messages
-- `/pass [password]` - Set/change channel password (owner only)
-- `/transfer @name` - Transfer channel ownership
-- `/save` - Toggle message retention for channel (owner only)
-
-### Getting Started
-
-1. **Install the app** on your Android device (requires Android 8.0+)
-2. **Grant permissions** for Bluetooth and location when prompted
-3. **Launch bitchat** - it will auto-start mesh networking
-4. **Set your nickname** or use the auto-generated one
-5. **Connect automatically** to nearby iOS and Android bitchat users
-6. **Join a channel** with `/j #general` or start chatting in public
-7. **Messages relay** through the mesh network to reach distant peers
-
-### Android UI Features
-
-- **Jetpack Compose UI**: Modern Material Design 3 interface
-- **Dark/Light Themes**: Terminal-inspired aesthetic matching iOS
-- **Haptic Feedback**: Vibrations for interactions and notifications
-- **Adaptive Layout**: Optimized for various Android screen sizes
-- **Message Status**: Real-time delivery and read receipts
-- **RSSI Indicators**: Signal strength colors for each peer
-
-### Channel Features
-
-- **Password Protection**: Channel owners can set passwords with `/pass`
-- **Message Retention**: Owners can enable mandatory message saving with `/save`
-- **@ Mentions**: Use `@nickname` to mention users (with autocomplete)
-- **Ownership Transfer**: Pass control to trusted users with `/transfer`
-
-## Security & Privacy
-
-### Encryption
-- **Private Messages**: X25519 key exchange + AES-256-GCM encryption
-- **Channel Messages**: Argon2id password derivation + AES-256-GCM
-- **Digital Signatures**: Ed25519 for message authenticity
-- **Forward Secrecy**: New key pairs generated each session
-
-### Privacy Features
-- **No Registration**: No accounts, emails, or phone numbers required
-- **Ephemeral by Default**: Messages exist only in device memory
-- **Cover Traffic**: Random delays and dummy messages prevent traffic analysis
-- **Emergency Wipe**: Triple-tap logo to instantly clear all data
-- **Bundled Tor Support**: Built-in Tor network integration for enhanced privacy when internet connectivity is available
-
-## Performance & Efficiency
-
-### Message Compression
-- **LZ4 Compression**: Automatic compression for messages >100 bytes
-- **30-70% bandwidth savings** on typical text messages
-- **Smart compression**: Skips already-compressed data
-
-### Battery Optimization
-- **Adaptive Power Modes**: Automatically adjusts based on battery level
-  - Performance mode: Full features when charging or >60% battery
-  - Balanced mode: Default operation (30-60% battery)
-  - Power saver: Reduced scanning when <30% battery
-  - Ultra-low power: Emergency mode when <10% battery
-- **Background efficiency**: Automatic power saving when app backgrounded
-- **Configurable scanning**: Duty cycle adapts to battery state
-
-### Network Efficiency
-- **Optimized Bloom filters**: Faster duplicate detection with less memory
-- **Message aggregation**: Batches small messages to reduce transmissions
-- **Adaptive connection limits**: Adjusts peer connections based on power mode
+- **Dual Transport Architecture**: Bluetooth LE mesh for offline messaging, Nostr relays for internet-based messaging
+- **Location-Based Channels**: Geographic chat rooms using geohash coordinates over Nostr relays
+- **Intelligent Message Routing**: Automatically chooses the best transport, with queuing and retry when a peer is unreachable
+- **End-to-End Encryption**: [Noise Protocol](https://noiseprotocol.org) (XX pattern, X25519 + ChaCha20-Poly1305) for private messages over the mesh
+- **Decentralized Mesh Network**: Automatic peer discovery and multi-hop relay over Bluetooth LE (max 7 hops)
+- **Wi-Fi Aware Transport**: Higher-bandwidth local mesh on supported devices
+- **Channel Chats**: Topic-based group messaging with optional password protection (Argon2id + AES-256-GCM)
+- **IRC-Style Commands**: Familiar `/join`, `/msg`, `/who` style interface
+- **Tor Support**: Built-in Tor (Arti) for private internet connectivity
+- **Emergency Wipe**: Triple-tap to instantly clear all data
+- **Cross-Platform**: Binary protocol compatible with bitchat on iOS and macOS
 
 ## Technical Architecture
 
-### Binary Protocol
-bitchat uses an efficient binary protocol optimized for Bluetooth LE:
-- Compact packet format with 1-byte type field
-- TTL-based message routing (max 7 hops)
-- Automatic fragmentation for large messages
-- Message deduplication via unique IDs
+### Bluetooth Mesh Network (Offline)
 
-### Mesh Networking
-- Each device acts as both client and peripheral
-- Automatic peer discovery and connection management
-- Store-and-forward for offline message delivery
-- Adaptive duty cycling for battery optimization
+- Direct peer-to-peer within Bluetooth range, multi-hop relay through nearby devices
+- Noise Protocol sessions with forward secrecy; peer identities derived from static keys
+- Compact binary packet format with fragmentation, TTL routing, and deduplication
+- Adaptive duty cycling and connection limits for battery efficiency
+- Foreground service keeps the mesh alive within Android background execution limits
 
-### Android-Specific Optimizations
-- **Coroutine Architecture**: Asynchronous operations for mesh networking
-- **Kotlin Coroutines**: Thread-safe concurrent mesh operations
-- **EncryptedSharedPreferences**: Secure storage for user settings
-- **Lifecycle-Aware**: Proper handling of Android app lifecycle
-- **Battery Optimization**: Foreground service and adaptive scanning
+### Nostr Protocol (Internet)
 
-## Android Technical Architecture
+- Global reach via public relays, geohash-based location channels
+- Private messages fall back to Nostr for mutual favorites when the mesh is unavailable
+- Ephemeral keys per geohash area
 
-### Core Components
+### Android Stack
 
-1. **BitchatApplication.kt**: Application-level initialization and dependency injection
-2. **MainActivity.kt**: Main activity handling permissions and UI hosting
-3. **ChatViewModel.kt**: MVVM pattern managing app state and business logic
-4. **BluetoothMeshService.kt**: Core BLE mesh networking (central + peripheral roles)
-5. **EncryptionService.kt**: Cryptographic operations using BouncyCastle
-6. **BinaryProtocol.kt**: Binary packet encoding/decoding matching iOS format
-7. **ChatScreen.kt**: Jetpack Compose UI with Material Design 3
+- Kotlin, Jetpack Compose (Material 3), MVVM
+- Coroutines and Flow for all networking and state
+- Core components: `MeshForegroundService` (persistent connectivity), `BluetoothMeshService` / `WifiAwareMeshService` (transports), `UnifiedMeshService` (transport selection), `NoiseSessionManager` (encryption sessions), `MessageRouter` (mesh/Nostr routing with outbox retry)
 
-### Dependencies
+## Building
 
-- **Jetpack Compose**: Modern declarative UI
-- **BouncyCastle**: Cryptographic operations (X25519, Ed25519, AES-GCM)
-- **Nordic BLE Library**: Reliable Bluetooth LE operations
-- **Kotlin Coroutines**: Asynchronous programming
-- **LZ4**: Message compression (when enabled)
-- **EncryptedSharedPreferences**: Secure local storage
+Requires Android Studio and the Android SDK (API 26+).
 
-### Binary Protocol Compatibility
+```bash
+git clone https://github.com/permissionlesstech/bitchat-android.git
+cd bitchat-android
+./gradlew assembleDebug
+```
 
-The Android implementation maintains 100% binary protocol compatibility with iOS:
-- **Header Format**: Identical 13-byte header structure
-- **Packet Types**: Same message types and routing logic
-- **Encryption**: Identical cryptographic algorithms and key exchange
-- **UUIDs**: Same Bluetooth service and characteristic identifiers
-- **Fragmentation**: Compatible message fragmentation for large content
+Install on a connected device:
 
-## Publishing to Google Play
+```bash
+adb install -r app/build/outputs/apk/debug/app-debug.apk
+```
 
-### Preparation
+The app requests Bluetooth, location (required for BLE scanning), and notification permissions at runtime.
 
-1. **Update version information:**
-   ```kotlin
-   // In app/build.gradle.kts
-   defaultConfig {
-       versionCode = 2  // Increment for each release
-       versionName = "1.1.0"  // User-visible version
-   }
-   ```
+## Testing
 
-2. **Create a signed release build:**
-   ```bash
-   ./gradlew assembleRelease
-   ```
+```bash
+# Unit tests
+./gradlew test
 
-3. **Generate app bundle (recommended for Play Store):**
-   ```bash
-   ./gradlew bundleRelease
-   ```
+# Lint
+./gradlew lint
 
-### Play Store Requirements
+# Instrumented tests (requires a device or emulator)
+./gradlew connectedAndroidTest
+```
 
-- **Target API**: Latest Android API (currently 34)
-- **Privacy Policy**: Required for apps requesting sensitive permissions
-- **App Permissions**: Justify Bluetooth and location usage
-- **Content Rating**: Complete questionnaire for age-appropriate content
-
-### Distribution
-
-- **Google Play Store**: Main distribution channel
-- **F-Droid**: For open-source distribution
-- **Direct APK**: For testing and development
-
-## Cross-Platform Communication
-
-This Android port enables seamless communication with the original iOS bitchat app:
-
-- **iPhone ↔ Android**: Full bidirectional messaging
-- **Mixed Groups**: iOS and Android users in same channels
-- **Feature Parity**: All commands and encryption work across platforms
-- **Protocol Sync**: Identical message format and routing behavior
-
-**iOS Version**: For iPhone/iPad users, get the original bitchat at [github.com/jackjackbits/bitchat](https://github.com/jackjackbits/bitchat)
-
-## Contributing
-
-Contributions are welcome! Key areas for enhancement:
-
-1. **Performance**: Battery optimization and connection reliability
-2. **UI/UX**: Additional Material Design 3 features
-3. **Security**: Enhanced cryptographic features
-4. **Testing**: Unit and integration test coverage
-5. **Documentation**: API documentation and development guides
-
-## Support & Issues
-
-- **Bug Reports**: [Create an issue](../../issues) with device info and logs
-- **Feature Requests**: [Start a discussion](https://github.com/orgs/permissionlesstech/discussions)
-- **Security Issues**: Email security concerns privately
-- **iOS Compatibility**: Cross-reference with [original iOS repo](https://github.com/jackjackbits/bitchat)
-
-For iOS-specific issues, please refer to the [original iOS bitchat repository](https://github.com/jackjackbits/bitchat).
+Note that BLE mesh behavior is difficult to emulate; protocol and session logic is covered by unit tests, while radio-level behavior needs real devices.

app/build.gradle.kts

@@ -1,10 +1,26 @@
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+
 plugins {
     alias(libs.plugins.android.application)
-    alias(libs.plugins.kotlin.android)
     alias(libs.plugins.kotlin.parcelize)
     alias(libs.plugins.kotlin.compose)
 }
 
+val githubReleaseCertSha256 = providers
+    .environmentVariable("BITCHAT_GITHUB_RELEASE_CERT_SHA256")
+    .orElse(providers.gradleProperty("BITCHAT_GITHUB_RELEASE_CERT_SHA256"))
+    .orElse("")
+val normalizedGithubReleaseCertSha256 = githubReleaseCertSha256.get()
+    .replace(":", "")
+    .trim()
+    .lowercase()
+require(
+    normalizedGithubReleaseCertSha256.isEmpty() ||
+        normalizedGithubReleaseCertSha256.matches(Regex("[a-f0-9]{64}"))
+) {
+    "BITCHAT_GITHUB_RELEASE_CERT_SHA256 must be a SHA-256 certificate fingerprint"
+}
+
 android {
     namespace = "com.bitchat.android"
     compileSdk = libs.versions.compileSdk.get().toInt()
@@ -13,8 +29,16 @@ android {
         applicationId = "com.bitchat.droid"
         minSdk = libs.versions.minSdk.get().toInt()
         targetSdk = libs.versions.targetSdk.get().toInt()
-        versionCode = 33
-        versionName = "1.7.2"
+        versionCode = 36
+        versionName = "1.7.5"
+        buildConfigField(
+            "String",
+            "GITHUB_RELEASE_CERT_SHA256",
+            "\"$normalizedGithubReleaseCertSha256\""
+        )
+        // Keep NDR dark until the Apple and Android implementations are
+        // reviewed and ready to be enabled together.
+        buildConfigField("boolean", "NDR_ROLLOUT_ENABLED", "false")
 
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
         vectorDrawables {
@@ -65,14 +89,12 @@ android {
     }
 
     compileOptions {
-        sourceCompatibility = JavaVersion.VERSION_1_8
-        targetCompatibility = JavaVersion.VERSION_1_8
-    }
-    kotlinOptions {
-        jvmTarget = "1.8"
+        sourceCompatibility = JavaVersion.VERSION_11
+        targetCompatibility = JavaVersion.VERSION_11
     }
     buildFeatures {
         compose = true
+        buildConfig = true
     }
     packaging {
         resources {
@@ -86,6 +108,12 @@ android {
     }
 }
 
+kotlin {
+    compilerOptions {
+        jvmTarget.set(JvmTarget.JVM_11)
+    }
+}
+
 dependencies {
     // Core Android dependencies
     implementation(libs.androidx.core.ktx)
@@ -129,6 +157,13 @@ dependencies {
 
     // WebSocket
     implementation(libs.okhttp)
+    implementation("net.java.dev.jna:jna:5.13.0@aar")
+
+    // WorkManager for background APK downloads
+    implementation(libs.androidx.work.runtime.ktx)
+
+    // HTTP Server for hotspot APK sharing
+    implementation(libs.nanohttpd)
 
     // Arti (Tor in Rust) Android bridge - custom build from latest source
     // Built with rustls, 16KB page size support, and onio//un service client
@@ -143,11 +178,22 @@ dependencies {
     implementation(libs.androidx.security.crypto)
     
     // EXIF orientation handling for images
-    implementation("androidx.exifinterface:exifinterface:1.3.7")
+    implementation(libs.androidx.exifinterface)
     
     // Testing
     testImplementation(libs.bundles.testing)
     androidTestImplementation(platform(libs.androidx.compose.bom))
+    androidTestImplementation(libs.androidx.test.ext.junit)
+    androidTestImplementation(libs.androidx.test.espresso.core)
     androidTestImplementation(libs.bundles.compose.testing)
     debugImplementation(libs.androidx.compose.ui.tooling)
 }
+
+// Robolectric resolves Android runtime jars itself (outside Gradle dependency resolution).
+// Its legacy repo1 endpoint rejects cold GitHub-hosted runners with HTTP 403.
+tasks.withType<org.gradle.api.tasks.testing.Test>().configureEach {
+    systemProperty(
+        "robolectric.dependency.repo.url",
+        "https://repo.maven.apache.org/maven2"
+    )
+}

app/proguard-rules.pro

@@ -17,6 +17,13 @@
 -keep class com.bitchat.android.nostr.** { *; }
 -keep class com.bitchat.android.identity.** { *; }
 
+# UniFFI's JNA backend resolves exported functions and Structure fields by
+# their generated JVM names at runtime. Preserve both sides of that reflective
+# boundary in minified release builds.
+-keep class uniffi.ndr_ffi.** { *; }
+-keep class com.sun.jna.** { *; }
+-dontwarn com.sun.jna.**
+
 # Keep Tor implementation (always included)
 -keep class com.bitchat.android.net.RealTorProvider { *; }
 

app/src/androidTest/kotlin/com/bitchat/android/nostr/PairwiseFfiInstrumentedTest.kt

@@ -0,0 +1,191 @@
+package com.bitchat.android.nostr
+
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import java.io.File
+import java.util.UUID
+import org.json.JSONArray
+import org.json.JSONObject
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertNotNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import uniffi.ndr_ffi.FfiKeyPair
+import uniffi.ndr_ffi.PairwiseAction
+import uniffi.ndr_ffi.PairwiseInvite
+import uniffi.ndr_ffi.PairwiseManager
+import uniffi.ndr_ffi.generateKeypair
+
+@RunWith(AndroidJUnit4::class)
+class PairwiseFfiInstrumentedTest {
+    @Test
+    fun directFfiHandshakeSendRestartDeduplicateExpiryAndRetirement() {
+        val context = InstrumentationRegistry.getInstrumentation().targetContext
+        val testRoot = File(
+            context.filesDir,
+            "ndr-pairwise-ffi-${UUID.randomUUID()}"
+        )
+        assertTrue(testRoot.mkdirs())
+
+        val aliceKeys = generateKeypair()
+        val bobKeys = generateKeypair()
+        val alicePath = File(testRoot, "alice")
+        val bobPath = File(testRoot, "bob")
+        var alice: PairwiseManager? = null
+        var bob: PairwiseManager? = null
+
+        try {
+            alice = manager(aliceKeys, alicePath)
+            bob = manager(bobKeys, bobPath)
+
+            val inviteJson = alice.currentInviteEventJson()
+            PairwiseInvite.fromEventJson(inviteJson).use { invite ->
+                assertEquals(aliceKeys.publicKeyHex, invite.getPeerPubkeyHex())
+            }
+            val accepted = bob.acceptInviteFromEventJson(
+                inviteJson,
+                aliceKeys.publicKeyHex
+            )
+            assertEquals(aliceKeys.publicKeyHex, accepted.peerPubkeyHex)
+            assertTrue(accepted.createdNewSession)
+
+            val handshakeActions = bob.pendingActions()
+            assertEquals(handshakeActions, bob.pendingActions())
+            val response = handshakeActions.single { it.kind == "out_of_band" }
+            val bootstrap = handshakeActions.single { it.kind == "publish" }
+            assertNotNull(response.sessionId)
+            assertEquals(response.sessionId, bootstrap.sessionId)
+            assertEquals(aliceKeys.publicKeyHex, response.peerPubkeyHex)
+            assertPairwiseWireEvent(response, expectedKind = 1059)
+            assertPairwiseWireEvent(bootstrap, expectedKind = 1060)
+
+            bob.close()
+            bob = manager(bobKeys, bobPath)
+            assertEquals(handshakeActions, bob.pendingActions())
+
+            alice.processOutOfBandResponse(
+                requireNotNull(response.eventJson),
+                bobKeys.publicKeyHex
+            )
+            val halfReady = requireNotNull(alice.sessionInfo(bobKeys.publicKeyHex))
+            assertFalse(halfReady.sendReady)
+            alice.processEvent(requireNotNull(bootstrap.eventJson))
+            assertTrue(requireNotNull(alice.sessionInfo(bobKeys.publicKeyHex)).sendReady)
+
+            bob.ackActions(handshakeActions.map(PairwiseAction::actionId))
+            bob.close()
+            bob = manager(bobKeys, bobPath)
+            assertTrue(
+                bob.pendingActions().none { pending ->
+                    pending.actionId in handshakeActions.map(PairwiseAction::actionId)
+                }
+            )
+
+            val expiresAtSeconds =
+                (System.currentTimeMillis() / 1_000L).toULong() + 3_600UL
+            val text = "bitchat1:expiring-direct-ffi"
+            val sent = alice.sendText(
+                bobKeys.publicKeyHex,
+                text,
+                expiresAtSeconds
+            )
+            val publish = alice.pendingActions().single { action ->
+                action.kind == "publish" && action.outerEventId == sent.outerEventId
+            }
+            assertPairwiseWireEvent(publish, expectedKind = 1060)
+            val publishJson = requireNotNull(publish.eventJson)
+
+            alice.close()
+            alice = manager(aliceKeys, alicePath)
+            val replayedPublish = alice.pendingActions().single { action ->
+                action.actionId == publish.actionId
+            }
+            assertEquals(publishJson, replayedPublish.eventJson)
+
+            bob.processEvent(publishJson)
+            bob.processEvent(publishJson)
+            val deliveries = bob.pendingActions().filter { it.kind == "delivery" }
+            assertEquals(1, deliveries.size)
+            val delivery = deliveries.single()
+            assertEquals(aliceKeys.publicKeyHex, delivery.peerPubkeyHex)
+            assertEquals(sent.innerEventId, delivery.innerEventId)
+            assertTrue(requireNotNull(delivery.innerEventId).matches(HEX_32))
+            assertEquals(expiresAtSeconds, delivery.expiresAtSeconds)
+
+            val innerJson = requireNotNull(delivery.innerEventJson)
+            val inner = JSONObject(innerJson)
+            assertEquals(14, inner.getInt("kind"))
+            assertEquals(aliceKeys.publicKeyHex, inner.getString("pubkey"))
+            assertEquals(text, inner.getString("content"))
+            assertTrue(
+                containsTag(
+                    inner.getJSONArray("tags"),
+                    "expiration",
+                    expiresAtSeconds.toString()
+                )
+            )
+
+            bob.close()
+            bob = manager(bobKeys, bobPath)
+            val replayedDelivery = bob.pendingActions().single { action ->
+                action.actionId == delivery.actionId
+            }
+            assertEquals(innerJson, replayedDelivery.innerEventJson)
+            bob.ackActions(listOf(delivery.actionId))
+            bob.close()
+            bob = manager(bobKeys, bobPath)
+            assertTrue(bob.pendingActions().none { it.actionId == delivery.actionId })
+
+            alice.ackActions(listOf(publish.actionId))
+            alice.close()
+            alice = manager(aliceKeys, alicePath)
+            assertTrue(alice.pendingActions().none { it.actionId == publish.actionId })
+
+            assertTrue(alice.retirePeer(bobKeys.publicKeyHex))
+            assertFalse(alice.retirePeer(bobKeys.publicKeyHex))
+            alice.close()
+            alice = manager(aliceKeys, alicePath)
+            assertFalse(alice.knownPeerPubkeys().contains(bobKeys.publicKeyHex))
+        } finally {
+            alice?.close()
+            bob?.close()
+            testRoot.deleteRecursively()
+        }
+    }
+
+    private fun manager(keys: FfiKeyPair, path: File): PairwiseManager =
+        PairwiseManager.newWithStoragePath(
+            keys.publicKeyHex,
+            keys.privateKeyHex,
+            path.absolutePath
+        )
+
+    private fun assertPairwiseWireEvent(action: PairwiseAction, expectedKind: Int) {
+        val event = JSONObject(requireNotNull(action.eventJson))
+        assertEquals(expectedKind, event.getInt("kind"))
+        assertNotEquals(37368, event.getInt("kind"))
+        if (expectedKind == 1060) {
+            assertFalse(containsTag(event.getJSONArray("tags"), "p"))
+        }
+    }
+
+    private fun containsTag(
+        tags: JSONArray,
+        name: String,
+        expectedValue: String? = null
+    ): Boolean =
+        (0 until tags.length()).any { index ->
+            val tag = tags.getJSONArray(index)
+            tag.length() > 0 &&
+                tag.getString(0) == name &&
+                (expectedValue == null ||
+                    (tag.length() > 1 && tag.getString(1) == expectedValue))
+        }
+
+    companion object {
+        private val HEX_32 = Regex("^[0-9a-f]{64}$")
+    }
+}

app/src/debug/AndroidManifest.xml

@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools">
+
+    <application>
+        <!-- Debug-only ADB test hook. Drives mesh operations (scan, connect,
+             handshake, DMs, files, broadcast, raw packets) from host scripts.
+             Exported intentionally so `adb shell am broadcast` can reach it;
+             never shipped in release builds. -->
+        <receiver
+            android:name="com.bitchat.android.testhook.TestHookReceiver"
+            android:exported="true"
+            tools:ignore="ExportedReceiver">
+            <intent-filter>
+                <action android:name="com.bitchat.droid.TEST_HOOK" />
+            </intent-filter>
+        </receiver>
+    </application>
+</manifest>

app/src/debug/java/com/bitchat/android/testhook/TestHookDriver.kt

@@ -0,0 +1,508 @@
+package com.bitchat.android.testhook
+
+import android.content.Context
+import android.content.Intent
+import android.util.Log
+import com.bitchat.android.features.file.FileUtils
+import com.bitchat.android.mesh.MeshService
+import com.bitchat.android.mesh.PrivateMediaPreparation
+import com.bitchat.android.mesh.TransferProgressManager
+import com.bitchat.android.model.BitchatFilePacket
+import com.bitchat.android.model.RoutedPacket
+import com.bitchat.android.noise.NoiseSession
+import com.bitchat.android.protocol.BitchatPacket
+import com.bitchat.android.service.MeshForegroundService
+import com.bitchat.android.service.MeshServiceHolder
+import com.bitchat.android.service.TransportBridgeService
+import com.bitchat.android.services.AppStateStore
+import com.bitchat.android.ui.DataManager
+import com.bitchat.android.ui.PrivateMediaRecipientResolver
+import com.bitchat.android.util.AppConstants
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.async
+import kotlinx.coroutines.coroutineScope
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.withContext
+import kotlinx.coroutines.withTimeout
+import kotlinx.coroutines.withTimeoutOrNull
+import org.json.JSONArray
+import org.json.JSONObject
+import java.io.File
+import java.security.MessageDigest
+
+/**
+ * Headless engine behind [TestHookReceiver]. Drives the public [MeshService] API and
+ * observes state via [AppStateStore] flows (never touches the single-slot mesh delegate).
+ */
+object TestHookDriver {
+
+    private const val TAG = TestHookReceiver.TAG
+
+    private const val DEFAULT_SCAN_TIMEOUT_MS = 30_000L
+    private const val DEFAULT_CONNECT_TIMEOUT_MS = 30_000L
+    private const val DEFAULT_HANDSHAKE_TIMEOUT_MS = 30_000L
+    private const val DEFAULT_RECV_TIMEOUT_MS = 60_000L
+    private const val DEFAULT_FILE_TIMEOUT_MS = 180_000L
+
+    suspend fun execute(context: Context, cmd: String, intent: Intent): JSONObject {
+        Log.d(TAG, "execute cmd=$cmd")
+        val result = when (cmd) {
+            "ping" -> ok(cmd).put("pong", true).put("package", context.packageName)
+            "start" -> start(context)
+            "stop" -> stop(context)
+            "whoami" -> whoami(context)
+            "set_nickname" -> setNickname(context, intent.requiredString("name"))
+            "scan" -> scan(context, intent)
+            "peers" -> peers(context)
+            "connect" -> connect(intent.requiredString("peer"), intent)
+            "handshake" -> handshake(context, intent.requiredString("peer"), intent)
+            "session" -> session(context, intent.requiredString("peer"))
+            "announce" -> announce(context)
+            "broadcast_msg" -> broadcastMsg(context, intent.requiredString("content"), intent.getStringExtra("channel"))
+            "dm_send" -> dmSend(context, intent.requiredString("peer"), intent.requiredString("content"), intent.getStringExtra("msg_id"))
+            "dm_recv" -> dmRecv(context, intent)
+            "msg_recv" -> msgRecv(context, intent)
+            "file_send" -> fileSend(context, intent)
+            "file_recv" -> fileRecv(context, intent)
+            "file_cancel" -> fileCancel(context, intent.requiredString("transfer_id"))
+            "raw_send" -> rawSend(context, intent)
+            "ble" -> setBle(intent.getBooleanExtra("enabled", true))
+            "state" -> state(context)
+            "clear_results" -> clearResults(context)
+            else -> err(cmd, "unknown command: $cmd")
+        }
+        return result.put("cmd", cmd)
+    }
+
+    // MARK: - Lifecycle
+
+    private fun start(context: Context): JSONObject {
+        MeshForegroundService.start(context)
+        val mesh = mesh(context)
+        mesh.startServices()
+        return ok("start").put("peer_id", mesh.myPeerID)
+    }
+
+    private fun stop(context: Context): JSONObject {
+        try {
+            MeshServiceHolder.unifiedMeshService?.stopServices()
+        } catch (e: Exception) {
+            Log.w(TAG, "stopServices failed: ${e.message}")
+        }
+        MeshForegroundService.stop(context)
+        return ok("stop")
+    }
+
+    // MARK: - Identity
+
+    private fun whoami(context: Context): JSONObject {
+        val mesh = mesh(context)
+        return ok("whoami")
+            .put("peer_id", mesh.myPeerID)
+            .put("identity_fingerprint", mesh.getIdentityFingerprint())
+            .put("noise_public_key", mesh.getStaticNoisePublicKey()?.toHex())
+            .put("nickname", AppStateStore.nickname.value)
+    }
+
+    private fun setNickname(context: Context, name: String): JSONObject {
+        DataManager(context).saveNickname(name)
+        AppStateStore.setNickname(name)
+        mesh(context).sendBroadcastAnnounce()
+        return ok("set_nickname").put("nickname", name)
+    }
+
+    // MARK: - Discovery / connection
+
+    private suspend fun scan(context: Context, intent: Intent): JSONObject {
+        val timeoutMs = intent.getLongExtra("timeout_ms", DEFAULT_SCAN_TIMEOUT_MS)
+        val minPeers = intent.getIntExtra("min_peers", 1)
+        val mesh = mesh(context)
+        val found = withTimeoutOrNull(timeoutMs) {
+            AppStateStore.peers.first { it.size >= minPeers }
+        }
+        val peerIds = found ?: AppStateStore.peers.value
+        return ok("scan")
+            .put("reached_min_peers", found != null)
+            .put("peers", peerInfosJson(mesh, peerIds))
+    }
+
+    private fun peers(context: Context): JSONObject {
+        val mesh = mesh(context)
+        return ok("peers").put("peers", peerInfosJson(mesh, AppStateStore.peers.value))
+    }
+
+    private suspend fun connect(peerID: String, intent: Intent): JSONObject {
+        val timeoutMs = intent.getLongExtra("timeout_ms", DEFAULT_CONNECT_TIMEOUT_MS)
+        val ble = MeshServiceHolder.meshService ?: return err("connect", "BLE service not running")
+        val address = ble.getDeviceAddressForPeer(peerID)
+            ?: return err("connect", "no device address known for peer $peerID (scan first)")
+        val accepted = ble.connectionManager.connectToAddress(address)
+        if (!accepted) return err("connect", "connectToAddress($address) rejected")
+        val direct = withTimeoutOrNull(timeoutMs) {
+            AppStateStore.directPeers.first { it.contains(peerID) }
+        }
+        return ok("connect")
+            .put("peer", peerID)
+            .put("address", address)
+            .put("direct", direct != null)
+    }
+
+    // MARK: - Noise
+
+    private suspend fun handshake(context: Context, peerID: String, intent: Intent): JSONObject {
+        val timeoutMs = intent.getLongExtra("timeout_ms", DEFAULT_HANDSHAKE_TIMEOUT_MS)
+        val mesh = mesh(context)
+        val deadline = System.currentTimeMillis() + timeoutMs
+        if (!mesh.hasEstablishedSession(peerID)) {
+            mesh.initiateNoiseHandshake(peerID)
+        }
+        var lastState: NoiseSession.NoiseSessionState = NoiseSession.NoiseSessionState.Uninitialized
+        while (System.currentTimeMillis() < deadline) {
+            lastState = mesh.getSessionState(peerID)
+            when (lastState) {
+                is NoiseSession.NoiseSessionState.Established -> {
+                    return ok("handshake")
+                        .put("peer", peerID)
+                        .put("state", lastState.toString())
+                        .put("fingerprint", mesh.getPeerFingerprint(peerID))
+                }
+                is NoiseSession.NoiseSessionState.Failed -> {
+                    return err("handshake", "session failed: $lastState").put("peer", peerID)
+                }
+                else -> delay(100)
+            }
+        }
+        return err("handshake", "timeout after ${timeoutMs}ms (last state: $lastState)").put("peer", peerID)
+    }
+
+    private fun session(context: Context, peerID: String): JSONObject {
+        val mesh = mesh(context)
+        return ok("session")
+            .put("peer", peerID)
+            .put("state", mesh.getSessionState(peerID).toString())
+            .put("established", mesh.hasEstablishedSession(peerID))
+            .put("fingerprint", mesh.getPeerFingerprint(peerID))
+    }
+
+    // MARK: - Messaging
+
+    private fun announce(context: Context): JSONObject {
+        mesh(context).sendBroadcastAnnounce()
+        return ok("announce")
+    }
+
+    private fun broadcastMsg(context: Context, content: String, channel: String?): JSONObject {
+        mesh(context).sendMessage(content, emptyList(), channel)
+        return ok("broadcast_msg").put("content", content).put("channel", channel)
+    }
+
+    private fun dmSend(context: Context, peerID: String, content: String, msgID: String?): JSONObject {
+        val mesh = mesh(context)
+        val nickname = mesh.getPeerNicknames()[peerID] ?: peerID
+        val id = msgID ?: "testhook-${System.currentTimeMillis()}"
+        mesh.sendPrivateMessage(content, peerID, nickname, id)
+        return ok("dm_send").put("peer", peerID).put("msg_id", id)
+    }
+
+    private suspend fun dmRecv(context: Context, intent: Intent): JSONObject {
+        val timeoutMs = intent.getLongExtra("timeout_ms", DEFAULT_RECV_TIMEOUT_MS)
+        val fromPeer = intent.getStringExtra("peer")
+        val contains = intent.getStringExtra("contains")
+        val startTime = System.currentTimeMillis()
+        val mesh = mesh(context)
+        val match = withTimeoutOrNull(timeoutMs) {
+            AppStateStore.privateMessages.first { conversations ->
+                conversations.values.flatten().any { msg ->
+                    msg.timestamp.time >= startTime &&
+                        msg.senderPeerID != mesh.myPeerID &&
+                        (fromPeer == null || msg.senderPeerID == fromPeer) &&
+                        (contains == null || msg.content.contains(contains))
+                }
+            }
+        } ?: return err("dm_recv", "timeout after ${timeoutMs}ms")
+        val msg = match.values.flatten().first { msg ->
+            msg.timestamp.time >= startTime &&
+                msg.senderPeerID != mesh.myPeerID &&
+                (fromPeer == null || msg.senderPeerID == fromPeer) &&
+                (contains == null || msg.content.contains(contains))
+        }
+        return ok("dm_recv")
+            .put("from", msg.senderPeerID)
+            .put("sender", msg.sender)
+            .put("content", msg.content)
+            .put("msg_id", msg.id)
+    }
+
+    private suspend fun msgRecv(context: Context, intent: Intent): JSONObject {
+        val timeoutMs = intent.getLongExtra("timeout_ms", DEFAULT_RECV_TIMEOUT_MS)
+        val contains = intent.getStringExtra("contains")
+        val channel = intent.getStringExtra("channel")
+        val startTime = System.currentTimeMillis()
+        val mesh = mesh(context)
+        val matches: (com.bitchat.android.model.BitchatMessage) -> Boolean = { msg ->
+            msg.timestamp.time >= startTime &&
+                msg.senderPeerID != mesh.myPeerID &&
+                (contains == null || msg.content.contains(contains)) &&
+                (channel == null || msg.channel == channel)
+        }
+        val found = withTimeoutOrNull(timeoutMs) {
+            if (channel != null) {
+                AppStateStore.channelMessages.first { m -> m.values.flatten().any(matches) }
+                    .values.flatten().first(matches)
+            } else {
+                AppStateStore.publicMessages.first { l -> l.any(matches) }.first(matches)
+            }
+        } ?: return err("msg_recv", "timeout after ${timeoutMs}ms")
+        return ok("msg_recv")
+            .put("from", found.senderPeerID)
+            .put("sender", found.sender)
+            .put("content", found.content)
+            .put("channel", found.channel)
+            .put("msg_id", found.id)
+    }
+
+    // MARK: - File transfer
+
+    private suspend fun fileSend(context: Context, intent: Intent): JSONObject {
+        val path = intent.requiredString("path")
+        val peerID = intent.getStringExtra("peer")
+        val timeoutMs = intent.getLongExtra("timeout_ms", DEFAULT_FILE_TIMEOUT_MS)
+        val mesh = mesh(context)
+
+        val file = File(path)
+        if (!file.isFile) return err("file_send", "file not found: $path")
+        val content = withContext(Dispatchers.IO) { file.readBytes() }
+        if (content.size.toLong() > AppConstants.Media.MAX_FILE_SIZE_BYTES) {
+            return err("file_send", "file too large: ${content.size} > ${AppConstants.Media.MAX_FILE_SIZE_BYTES}")
+        }
+        val packet = BitchatFilePacket(
+            fileName = file.name,
+            fileSize = content.size.toLong(),
+            mimeType = intent.getStringExtra("mime") ?: FileUtils.getMimeTypeFromExtension(file.name),
+            content = content
+        )
+        val encoded = packet.encode() ?: return err("file_send", "failed to TLV-encode packet")
+        val transferId = sha256Hex(encoded)
+        val recipient = peerID?.let {
+            PrivateMediaRecipientResolver.resolve(it, mesh)
+                ?: return err("file_send", "no active mesh route for private conversation: $it")
+        }
+
+        return coroutineScope {
+            // Subscribe on a background dispatcher before sending so synchronous
+            // failure events are not missed (SharedFlow has replay=0).
+            val completion = async(Dispatchers.Default) {
+                TransferProgressManager.events.first { it.transferId == transferId && it.completed }
+            }
+            delay(50)
+            val sendError = dispatchFileSend(
+                context,
+                intent,
+                mesh,
+                recipient?.meshPeerID,
+                packet,
+                transferId
+            )
+            if (sendError != null) {
+                completion.cancel()
+                return@coroutineScope sendError.put("cmd", "file_send")
+            }
+            val event = withTimeoutOrNull(timeoutMs) { completion.await() }
+                ?: return@coroutineScope err("file_send", "timeout waiting for transfer completion ($transferId)")
+            if (event.failed) {
+                return@coroutineScope err("file_send", "transfer rejected/failed before send ($transferId)")
+                    .put("transfer_id", transferId)
+            }
+            ok("file_send")
+                .put("transfer_id", transferId)
+                .put("sent", event.sent)
+                .put("total", event.total)
+                .put("bytes", content.size)
+                .put("peer", recipient?.meshPeerID)
+                .put("conversation", peerID)
+        }
+    }
+
+    private suspend fun dispatchFileSend(
+        context: Context,
+        intent: Intent,
+        mesh: MeshService,
+        peerID: String?,
+        packet: BitchatFilePacket,
+        transferId: String
+    ): JSONObject? {
+        if (peerID == null) {
+            mesh.sendFileBroadcast(packet)
+            return null
+        }
+        if (!mesh.hasEstablishedSession(peerID)) {
+            val hs = handshake(context, peerID, intent)
+            if (hs.optString("status") != "ok") return hs
+        }
+        // Peer state (capabilities/identity) can lag session establishment;
+        // retry transient preparation states before giving up.
+        val prepDeadline = System.currentTimeMillis() + 30_000
+        while (true) {
+            when (val prep = mesh.prepareFilePrivate(peerID, packet, transferId, allowLegacyFallback = false)) {
+                is PrivateMediaPreparation.Ready -> {
+                    return if (prep.transfer.commit()) null else err("file_send", "private transfer commit failed")
+                }
+                PrivateMediaPreparation.AwaitingPeerState,
+                PrivateMediaPreparation.NeedsHandshake -> {
+                    if (System.currentTimeMillis() >= prepDeadline) {
+                        return err("file_send", "private media preparation stuck at: $prep")
+                    }
+                    if (prep == PrivateMediaPreparation.NeedsHandshake) {
+                        mesh.initiateNoiseHandshake(peerID)
+                    }
+                    delay(500)
+                }
+                else -> return err("file_send", "private media preparation: $prep")
+            }
+        }
+    }
+
+    private suspend fun fileRecv(context: Context, intent: Intent): JSONObject {
+        val timeoutMs = intent.getLongExtra("timeout_ms", DEFAULT_FILE_TIMEOUT_MS)
+        val nameContains = intent.getStringExtra("name_contains")
+        val startTime = System.currentTimeMillis()
+        val dirs = listOf(
+            File(context.cacheDir, "files/incoming"),
+            File(context.cacheDir, "images/incoming")
+        )
+        val deadline = System.currentTimeMillis() + timeoutMs
+        while (System.currentTimeMillis() < deadline) {
+            val candidate = dirs
+                .flatMap { it.listFiles()?.toList() ?: emptyList() }
+                .filter { it.lastModified() >= startTime - 5_000 }
+                .filter { nameContains == null || it.name.contains(nameContains) }
+                .maxByOrNull { it.lastModified() }
+            if (candidate != null) {
+                val size1 = candidate.length()
+                delay(500)
+                if (candidate.length() == size1 && size1 > 0) {
+                    return ok("file_recv")
+                        .put("path", candidate.absolutePath)
+                        .put("name", candidate.name)
+                        .put("bytes", size1)
+                        .put("sha256", withContext(Dispatchers.IO) { sha256Hex(candidate.readBytes()) })
+                }
+            }
+            delay(250)
+        }
+        return err("file_recv", "timeout after ${timeoutMs}ms")
+    }
+
+    private fun fileCancel(context: Context, transferId: String): JSONObject {
+        val cancelled = mesh(context).cancelFileTransfer(transferId)
+        return ok("file_cancel").put("transfer_id", transferId).put("cancelled", cancelled)
+    }
+
+    // MARK: - Raw packet injection
+
+    private fun rawSend(context: Context, intent: Intent): JSONObject {
+        val payloadHex = intent.requiredString("payload_hex")
+        val typeStr = intent.requiredString("type")
+        val peerID = intent.getStringExtra("peer")
+        val ttl = intent.getIntExtra("ttl", 7)
+        val type = typeStr.toUIntOrNull(16)?.toUByte()
+            ?: return err("raw_send", "invalid type hex: $typeStr")
+        val payload = hexToBytes(payloadHex)
+            ?: return err("raw_send", "invalid payload_hex")
+        val mesh = mesh(context)
+        val packet = BitchatPacket(
+            type = type,
+            ttl = ttl.toUByte(),
+            senderID = mesh.myPeerID,
+            payload = payload
+        )
+        if (peerID != null) {
+            TransportBridgeService.sendToPeerFromLocal(peerID, packet)
+        } else {
+            TransportBridgeService.broadcastFromLocal(RoutedPacket(packet))
+        }
+        return ok("raw_send")
+            .put("type", typeStr)
+            .put("payload_bytes", payload.size)
+            .put("peer", peerID)
+    }
+
+    // MARK: - Transport / state
+
+    private fun setBle(enabled: Boolean): JSONObject {
+        val ble = MeshServiceHolder.meshService ?: return err("ble", "BLE service not running")
+        ble.setBleTransportEnabled(enabled)
+        return ok("ble").put("enabled", enabled)
+    }
+
+    private fun state(context: Context): JSONObject {
+        val mesh = mesh(context)
+        val peersJson = peerInfosJson(mesh, AppStateStore.peers.value)
+        val sessions = JSONObject()
+        AppStateStore.peers.value.forEach { peerID ->
+            sessions.put(peerID, mesh.getSessionState(peerID).toString())
+        }
+        return ok("state")
+            .put("peer_id", mesh.myPeerID)
+            .put("nickname", AppStateStore.nickname.value)
+            .put("peers", peersJson)
+            .put("direct_peers", JSONArray(AppStateStore.directPeers.value.toList()))
+            .put("sessions", sessions)
+            .put("device_map", JSONObject(mesh.getDeviceAddressToPeerMapping() as Map<*, *>))
+            .put("debug_status", mesh.getDebugStatus())
+    }
+
+    private fun clearResults(context: Context): JSONObject {
+        val dir = File(context.cacheDir, "testhook/results")
+        val count = dir.listFiles()?.count { it.delete() } ?: 0
+        return ok("clear_results").put("deleted", count)
+    }
+
+    // MARK: - Helpers
+
+    private fun mesh(context: Context): MeshService = MeshServiceHolder.getUnifiedOrCreate(context)
+
+    private fun peerInfosJson(mesh: MeshService, peerIds: List<String>): JSONArray {
+        val nicknames = mesh.getPeerNicknames()
+        val rssi = mesh.getPeerRSSI()
+        val arr = JSONArray()
+        peerIds.forEach { id ->
+            val info = mesh.getPeerInfo(id)
+            arr.put(JSONObject()
+                .put("id", id)
+                .put("nickname", nicknames[id] ?: info?.nickname)
+                .put("rssi", rssi[id])
+                .put("direct", AppStateStore.directPeers.value.contains(id))
+                .put("connected", info?.isConnected)
+                .put("last_seen", info?.lastSeen)
+                .put("session", mesh.getSessionState(id).toString())
+                .put("fingerprint", mesh.getPeerFingerprint(id)))
+        }
+        return arr
+    }
+
+    private fun ok(cmd: String) = JSONObject().put("status", "ok").put("cmd", cmd)
+    private fun err(cmd: String, message: String) =
+        JSONObject().put("status", "error").put("cmd", cmd).put("error", message)
+
+    private fun Intent.requiredString(name: String): String =
+        getStringExtra(name) ?: throw IllegalArgumentException("missing required extra: $name")
+
+    private fun sha256Hex(data: ByteArray): String =
+        MessageDigest.getInstance("SHA-256").digest(data).toHex()
+
+    private fun ByteArray.toHex(): String = joinToString("") { "%02x".format(it) }
+
+    private fun hexToBytes(hex: String): ByteArray? {
+        val clean = hex.replace(" ", "")
+        if (clean.length % 2 != 0) return null
+        return try {
+            ByteArray(clean.length / 2) { i ->
+                clean.substring(i * 2, i * 2 + 2).toInt(16).toByte()
+            }
+        } catch (e: Exception) {
+            null
+        }
+    }
+}

app/src/debug/java/com/bitchat/android/testhook/TestHookReceiver.kt

@@ -0,0 +1,65 @@
+package com.bitchat.android.testhook
+
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.util.Log
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import org.json.JSONObject
+import java.io.File
+
+/**
+ * ADB-drivable test hook (debug builds only).
+ *
+ * Usage:
+ *   adb shell am broadcast -a com.bitchat.droid.TEST_HOOK \
+ *     --es cmd <command> --es id <cmd-id> [command extras...]
+ *
+ * Result is written to cache/testhook/results/<id>.json and logged under tag TestHook:
+ *   adb shell run-as com.bitchat.droid cat cache/testhook/results/<id>.json
+ */
+class TestHookReceiver : BroadcastReceiver() {
+
+    companion object {
+        const val TAG = "TestHook"
+        const val ACTION = "com.bitchat.droid.TEST_HOOK"
+        private const val DEFAULT_OVERALL_TIMEOUT_MS = 180_000L
+    }
+
+    override fun onReceive(context: Context, intent: Intent) {
+        if (intent.action != ACTION) return
+        val cmd = intent.getStringExtra("cmd") ?: "ping"
+        val id = intent.getStringExtra("id") ?: "cmd-${System.currentTimeMillis()}"
+        val overallTimeout = intent.getLongExtra("overall_timeout_ms", DEFAULT_OVERALL_TIMEOUT_MS)
+
+        Log.i(TAG, "CMD id=$id cmd=$cmd")
+
+        val pendingResult = goAsync()
+        Thread {
+            val result = try {
+                runBlocking {
+                    withTimeout(overallTimeout) {
+                        TestHookDriver.execute(context.applicationContext, cmd, intent)
+                    }
+                }
+            } catch (e: Exception) {
+                JSONObject()
+                    .put("status", "error")
+                    .put("cmd", cmd)
+                    .put("error", "${e.javaClass.simpleName}: ${e.message}")
+            }
+            try {
+                val dir = File(context.cacheDir, "testhook/results").apply { mkdirs() }
+                File(dir, "$id.json").writeText(result.toString())
+            } catch (e: Exception) {
+                Log.e(TAG, "Failed to write result file for $id: ${e.message}")
+            }
+            Log.i(TAG, "RESULT id=$id $result")
+        }.start()
+        // Finish immediately: long-running commands continue on the worker thread and
+        // report via the result file. Holding the broadcast open past the system
+        // broadcast window would ANR the app.
+        pendingResult.finish()
+    }
+}

app/src/main/AndroidManifest.xml

@@ -5,6 +5,7 @@
     <!-- Internet permissions for Nostr relay connections -->
     <uses-permission android:name="android.permission.INTERNET" />
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
+    <uses-permission android:name="android.permission.CHANGE_NETWORK_STATE" />
     
     <!-- Bluetooth permissions -->
     <uses-permission android:name="android.permission.BLUETOOTH" android:maxSdkVersion="30" />
@@ -20,6 +21,19 @@
     
     <!-- Notification permissions -->
     <uses-permission android:name="android.permission.POST_NOTIFICATIONS" />
+
+    <!-- Wi‑Fi / Wi‑Fi Aware permissions (also used for hotspot APK sharing) -->
+    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE" />
+    <uses-permission android:name="android.permission.CHANGE_WIFI_STATE" />
+    <!-- Android 13+ runtime permission for Wi‑Fi operations (including Aware and Wi‑Fi P2P) -->
+    <uses-permission
+        android:name="android.permission.NEARBY_WIFI_DEVICES"
+        android:usesPermissionFlags="neverForLocation" />
+    <!-- Android 17+ gates local network access; Wi‑Fi Aware peers over link-local IPv6 -->
+    <uses-permission android:name="android.permission.ACCESS_LOCAL_NETWORK" />
+    <!-- Keep hotspot alive while sharing the APK -->
+    <uses-permission android:name="android.permission.WAKE_LOCK" />
+
     <!-- Signature permission for internal UI shutdown broadcasts -->
     <uses-permission android:name="com.bitchat.android.permission.FORCE_FINISH" />
     <!-- Foreground service and boot permissions for long-running background mesh -->
@@ -52,6 +66,8 @@
     <!-- Hardware features -->
     <uses-feature android:name="android.hardware.bluetooth_le" android:required="true" />
     <uses-feature android:name="android.hardware.bluetooth" android:required="true" />
+    <!-- Device support hint for Wi‑Fi Aware (optional) -->
+    <uses-feature android:name="android.hardware.wifi.aware" android:required="false" />
     <uses-feature android:name="android.hardware.camera" android:required="false" />
 
     <permission
@@ -131,5 +147,20 @@
                 <action android:name="android.intent.action.LOCKED_BOOT_COMPLETED" />
             </intent-filter>
         </receiver>
+
+        <!-- Hotspot Activity for offline APK sharing -->
+        <activity
+            android:name=".hotspot.HotspotActivity"
+            android:exported="false"
+            android:label="Share BitChat"
+            android:theme="@style/Theme.BitchatAndroid"
+            android:launchMode="singleTop" />
+
+        <!-- Declare the foreground service type for WorkManager's foreground
+             service so the APK download worker can run as dataSync work -->
+        <service
+            android:name="androidx.work.impl.foreground.SystemForegroundService"
+            android:foregroundServiceType="dataSync"
+            tools:node="merge" />
     </application>
 </manifest>

app/src/main/assets/design-icons/README.md

@@ -0,0 +1,6 @@
+# Design-spec icons
+
+These standalone SVGs were extracted from the supplied 393 px Figma screen exports. The matching
+Android vector resources in `res/drawable/ic_spec_*.xml` are the runtime copies used by Compose.
+Paths and stroke weights remain faithful to the exports; UI tint and opacity are applied at the
+call site so selected and disabled states remain theme-aware.

app/src/main/assets/design-icons/bookmark-filled.svg

@@ -0,0 +1,3 @@
+<svg width="16" height="16" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg">
+  <path d="M3 15L8 11.267L13 15V2.4C13 2.029 12.856 1.673 12.601 1.41C12.345 1.147 11.998 1 11.636 1H4.364C4.002 1 3.655 1.147 3.399 1.41C3.144 1.673 3 2.029 3 2.4V15Z" fill="currentColor" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

app/src/main/assets/design-icons/bookmark-outline.svg

@@ -0,0 +1,3 @@
+<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M3 15L8 11.267L13 15V2.4C13 2.029 12.856 1.673 12.601 1.41C12.345 1.147 11.998 1 11.636 1H4.364C4.002 1 3.655 1.147 3.399 1.41C3.144 1.673 3 2.029 3 2.4V15Z" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

app/src/main/assets/design-icons/chat-bubbles.svg

@@ -0,0 +1,6 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(-16 -370)" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M28.5 370.625H18.5C18.0027 370.625 17.5258 370.823 17.1742 371.174C16.8225 371.526 16.625 372.003 16.625 372.5V378.75C16.625 379.247 16.8225 379.724 17.1742 380.076C17.5258 380.427 18.0027 380.625 18.5 380.625H20.375V384.375L24.125 380.625H28.5C28.9973 380.625 29.4742 380.427 29.8258 380.076C30.1775 379.724 30.375 379.247 30.375 378.75V372.5C30.375 372.003 30.1775 371.526 29.8258 371.174C29.4742 370.823 28.9973 370.625 28.5 370.625Z"/>
+    <path d="M24.125 385.625H27.875L31.625 389.375V385.625H33.5C33.9973 385.625 34.4742 385.427 34.8258 385.076C35.1775 384.724 35.375 384.247 35.375 383.75V377.5C35.375 377.003 35.1775 376.526 34.8258 376.174C34.4742 375.823 33.9973 375.625 33.5 375.625H32.875"/>
+  </g>
+</svg>

app/src/main/assets/design-icons/command.svg

@@ -0,0 +1,6 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(-16 -407)" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M26.625 422.875H35.375"/>
+    <path d="M16.625 407.875L24.125 415.375L16.625 422.875"/>
+  </g>
+</svg>

app/src/main/assets/design-icons/eye-off.svg

@@ -0,0 +1,6 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(-16 -682)" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M16.625 692C16.625 692 20.375 685.125 26 685.125C31.625 685.125 35.375 692 35.375 692C35.375 692 31.625 698.875 26 698.875C20.375 698.875 16.625 692 16.625 692Z"/>
+    <path d="M22.25 692C22.25 689.929 23.9288 688.25 26 688.25M29.75 692C29.75 694.071 28.0712 695.75 26 695.75M17.25 700.75L34.75 683.25"/>
+  </g>
+</svg>

app/src/main/assets/design-icons/globe.svg

@@ -0,0 +1,7 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(-16 -278)" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M25.9999 297.375C28.2187 297.375 30.0174 293.178 30.0174 288C30.0174 282.822 28.2187 278.625 25.9999 278.625C23.7811 278.625 21.9824 282.822 21.9824 288C21.9824 293.178 23.7811 297.375 25.9999 297.375Z"/>
+    <path d="M16.625 288H35.375"/>
+    <path d="M26 297.375C31.1777 297.375 35.375 293.178 35.375 288C35.375 282.822 31.1777 278.625 26 278.625C20.8223 278.625 16.625 282.822 16.625 288C16.625 293.178 20.8223 297.375 26 297.375Z"/>
+  </g>
+</svg>

app/src/main/assets/design-icons/lock.svg

@@ -0,0 +1,7 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(-16 -310)" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M32.25 329.375H19.75C18.715 329.375 17.875 328.535 17.875 327.5V321.25C17.875 320.215 18.715 319.375 19.75 319.375H32.25C33.285 319.375 34.125 320.215 34.125 321.25V327.5C34.125 328.535 33.285 329.375 32.25 329.375Z"/>
+    <path d="M21.625 316.875V315C21.625 312.584 23.5838 310.625 26 310.625C28.4162 310.625 30.375 312.584 30.375 315V316.875"/>
+    <path d="M26 326.25C27.0355 326.25 27.875 325.411 27.875 324.375C27.875 323.339 27.0355 322.5 26 322.5C24.9645 322.5 24.125 323.339 24.125 324.375C24.125 325.411 24.9645 326.25 26 326.25Z"/>
+  </g>
+</svg>

app/src/main/assets/design-icons/mention.svg

@@ -0,0 +1,6 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(-16 -582)" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M29.5236 587.888V594.4C29.5236 596.41 32.5761 596.856 34.1749 594.139C35.5299 591.84 35.1974 588.334 33.5049 586.025C31.0149 582.629 25.2574 581.359 21.0736 584.166C17.2311 586.746 15.8624 591.968 17.9861 596.188C20.0874 600.364 25.0199 602.386 29.4861 600.876"/>
+    <path d="M25.8485 595.785C27.8698 595.785 29.5085 594.032 29.5085 591.87C29.5085 589.708 27.8698 587.955 25.8485 587.955C23.8271 587.955 22.1885 589.708 22.1885 591.87C22.1885 594.032 23.8271 595.785 25.8485 595.785Z"/>
+  </g>
+</svg>

app/src/main/assets/design-icons/on-location-person.svg

@@ -0,0 +1,5 @@
+<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path d="M2 15.5H14" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M8 12.5V8.5" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"/>
+  <circle cx="8" cy="4.5" r="4" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

app/src/main/assets/design-icons/panic.svg

@@ -0,0 +1,3 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path transform="translate(-16 -786)" d="M17.875 805.375H22.875M20.375 786.625V789.125M20.375 789.125L27.875 796.625M16.625 790.375L22.875 796.625M30.375 789.125L35.375 794.125M25.375 789.125L32.875 796.625M35.375 789.125H16.625V796.625H35.375V789.125ZM20.375 805.375V799.125M29.125 805.375H34.125M31.625 786.625V789.125M31.625 805.375V799.125" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

app/src/main/assets/design-icons/people.svg

@@ -0,0 +1,6 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(-16 -314)" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M28.2187 328.116L25.14 327.241C25.0239 327.208 24.9198 327.142 24.8404 327.051C24.761 326.96 24.7096 326.848 24.6925 326.729L24.4338 324.907C25.0869 324.609 25.6407 324.129 26.0291 323.525C26.4176 322.921 26.6244 322.218 26.625 321.5V319.782C26.6402 318.788 26.2704 317.826 25.593 317.098C24.9156 316.37 23.9829 315.932 22.99 315.875C22.488 315.86 21.9879 315.945 21.5196 316.127C21.0513 316.308 20.6242 316.582 20.2637 316.932C19.9032 317.282 19.6166 317.7 19.421 318.163C19.2254 318.625 19.1248 319.123 19.125 319.625V321.5C19.1256 322.218 19.3324 322.921 19.7209 323.525C20.1093 324.129 20.6631 324.609 21.3162 324.907L21.0575 326.724C21.0404 326.843 20.989 326.955 20.9096 327.046C20.8302 327.137 20.7261 327.203 20.61 327.236L17.5313 328.111C17.2702 328.186 17.0406 328.343 16.8771 328.56C16.7136 328.777 16.6251 329.041 16.625 329.312V332.125H29.125V329.317C29.1249 329.046 29.0364 328.782 28.8729 328.565C28.7094 328.348 28.4798 328.191 28.2187 328.116Z"/>
+    <path d="M31.625 332.125H35.375V328.101C35.375 327.823 35.2819 327.552 35.1104 327.332C34.939 327.113 34.6991 326.956 34.4288 326.889L30.7825 325.977C30.6618 325.947 30.5528 325.882 30.4695 325.789C30.3863 325.697 30.3324 325.582 30.315 325.459L30.0587 323.657C30.7119 323.359 31.2657 322.879 31.6541 322.275C32.0426 321.671 32.2494 320.968 32.25 320.25V318.532C32.2652 317.538 31.8954 316.576 31.218 315.848C30.5406 315.12 29.6079 314.682 28.615 314.625C27.9181 314.603 27.229 314.777 26.625 315.125"/>
+  </g>
+</svg>

app/src/main/assets/design-icons/person.svg

@@ -0,0 +1,6 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(-16 -242)" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M27.725 252.271L28.1875 255.125H31.48C32.3075 255.125 33.0375 255.669 33.2763 256.461L34.75 261.375H17.25L18.7237 256.461C18.9612 255.669 19.6912 255.125 20.52 255.125H23.8125L24.275 252.271"/>
+    <path d="M30.375 247C30.375 244.584 28.4162 242.625 26 242.625C23.5838 242.625 21.625 244.584 21.625 247V248.25C21.625 250.666 23.5838 252.625 26 252.625C28.4162 252.625 30.375 250.666 30.375 248.25V247Z"/>
+  </g>
+</svg>

app/src/main/assets/design-icons/range.svg

@@ -0,0 +1,6 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(-16 -378)" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M25.375 386.125C26.0654 386.125 26.625 385.565 26.625 384.875C26.625 384.185 26.0654 383.625 25.375 383.625C24.6846 383.625 24.125 384.185 24.125 384.875C24.125 385.565 24.6846 386.125 25.375 386.125Z"/>
+    <path d="M25.375 397.375V386.125M21.625 397.375H29.125M28.9102 388.41C29.8475 387.472 30.3741 386.201 30.3741 384.875C30.3741 383.549 29.8475 382.278 28.9102 381.34M31.5625 391.062C32.3751 390.25 33.0197 389.285 33.4595 388.224C33.8993 387.162 34.1256 386.024 34.1256 384.875C34.1256 383.726 33.8993 382.588 33.4595 381.526C33.0197 380.465 32.3751 379.5 31.5625 378.688M21.8399 388.41C20.9026 387.472 20.376 386.201 20.376 384.875C20.376 383.549 20.9026 382.278 21.8399 381.34M19.1876 391.062C18.375 390.25 17.7304 389.285 17.2907 388.224C16.8509 387.162 16.6245 386.024 16.6245 384.875C16.6245 383.726 16.8509 382.588 17.2907 381.526C17.7304 380.465 18.375 379.5 19.1876 378.688"/>
+  </g>
+</svg>

app/src/main/assets/design-icons/shuffle.svg

@@ -0,0 +1,3 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path transform="translate(-16 -734)" d="M16.625 749.625H16.88C18.3088 749.625 19.6688 749.014 20.6175 747.946L27.6338 740.053C28.5825 738.985 29.9425 738.374 31.3712 738.374H35.375M31.625 734.625L35.375 738.375L31.625 742.125M26.3477 746.5L27.6339 747.946C28.5827 749.014 29.9427 749.625 31.3714 749.625H35.3752M16.625 738.375H16.88C18.3088 738.375 19.6688 738.986 20.6175 740.054L21.9025 741.5M31.625 753.375L35.375 749.625L31.625 745.875" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

app/src/main/assets/design-icons/star-filled.svg

@@ -0,0 +1,3 @@
+<svg width="20" height="20" viewBox="0 0 20 20" xmlns="http://www.w3.org/2000/svg">
+  <path transform="translate(-16 -446)" d="M26 446.925L28.1637 453.836H35.375L29.645 458.143L31.8975 465.075L26 460.79L20.1025 465.075L22.355 458.143L16.625 453.836H23.8363L26 446.925Z" fill="currentColor" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

app/src/main/assets/design-icons/star.svg

@@ -0,0 +1,3 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <path transform="translate(-16 -446)" d="M26 446.925L28.1637 453.836H35.375L29.645 458.143L31.8975 465.075L26 460.79L20.1025 465.075L22.355 458.143L16.625 453.836H23.8363L26 446.925Z" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round"/>
+</svg>

app/src/main/assets/design-icons/teleport.svg

@@ -0,0 +1,5 @@
+<svg width="16" height="16" viewBox="0 0 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <circle cx="8" cy="8" r="7.5" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round" stroke-dasharray="3 3"/>
+  <circle cx="5" cy="6" r="1" fill="currentColor"/><circle cx="11" cy="6" r="1" fill="currentColor"/>
+  <path d="M5.5 10.5H10.5" stroke="currentColor" stroke-linecap="round"/>
+</svg>

app/src/main/assets/design-icons/waveform.svg

@@ -0,0 +1,3 @@
+<svg width="20" height="20" viewBox="0 0 20 20" xmlns="http://www.w3.org/2000/svg">
+  <path d="M0 5H2.5V12.5H0ZM2.5 2.5H5V15H2.5ZM5 0H7.5V15H5ZM7.5 0H10V17.5H7.5ZM10 0H12.5V17.5H10ZM12.5 0H15V20H12.5ZM15 2.5H17.5V15H15ZM17.5 5H20V12.5H17.5Z" fill="currentColor"/>
+</svg>

app/src/main/assets/design-icons/wifi-off.svg

@@ -0,0 +1,8 @@
+<svg width="20" height="20" viewBox="0 0 20 20" fill="none" xmlns="http://www.w3.org/2000/svg">
+  <g transform="translate(-16 -242)" stroke="currentColor" stroke-width="1.25" stroke-linecap="round" stroke-linejoin="round">
+    <path d="M21.1387 252.139C22.4278 250.851 24.1757 250.127 25.998 250.127C27.8204 250.127 29.5683 250.851 30.8574 252.139"/>
+    <path d="M27.25 255.601C27.4831 255.81 27.6603 256.073 27.7656 256.368C27.8708 256.662 27.9008 256.978 27.8527 257.287C27.8046 257.596 27.68 257.888 27.4902 258.137C27.3004 258.385 27.0514 258.582 26.766 258.71C26.4806 258.838 26.1677 258.892 25.856 258.868C25.5442 258.844 25.2433 258.743 24.9809 258.573C24.7184 258.403 24.5026 258.17 24.3531 257.895C24.2036 257.62 24.1252 257.313 24.125 257"/>
+    <path d="M17.6025 248.604C19.8294 246.378 22.8493 245.127 25.9982 245.127C29.147 245.127 32.1669 246.378 34.3938 248.604"/>
+    <path d="M34.125 243.875L19.125 258.875"/>
+  </g>
+</svg>

app/src/main/assets/nostr_relays.csv

@@ -1,441 +1,442 @@
 Relay URL,Latitude,Longitude
-nostr.bitcoiner.social:443,47.6743,-117.112
-relay-dev.satlantis.io:443,40.8302,-74.1299
-relay.lightning.pub:443,39.0438,-77.4874
-ribo.us.nostria.app:443,43.6532,-79.3832
-relay.notoshi.win,13.3622,100.983
-openrelay.ziomc.com,50.0755,14.4378
-relay.agentry.com:443,42.8864,-78.8784
-nostr-relay.xbytez.io,50.6924,3.20113
-relay.gulugulu.moe,43.6532,-79.3832
-nostr.thebiglake.org:443,32.71,-96.6745
-relay.fountain.fm,43.6532,-79.3832
-freelay.sovbit.host,60.1699,24.9384
-nostr.girino.org:443,43.6532,-79.3832
-relay.openresist.com,43.6532,-79.3832
-nas01xanthosnet.synology.me:7778,47.1285,8.74735
-relay.ohstr.com:443,43.6532,-79.3832
-nostr-pub.wellorder.net,45.5201,-122.99
-relay.nostrdice.com,-33.8688,151.209
-bbw-nostr.xyz,41.5284,-87.4237
-cs-relay.nostrdev.com:443,50.4754,12.3683
-top.testrelay.top,43.6532,-79.3832
-relay.trotters.cc,43.6532,-79.3832
-blossom.gnostr.cloud,43.6532,-79.3832
-ribo.eu.nostria.app:443,43.6532,-79.3832
-public.crostr.com,43.6532,-79.3832
-relay.nostar.org,43.6532,-79.3832
-strfry.bonsai.com:443,39.0438,-77.4874
-nostr.carroarmato0.be,50.914,3.21378
-relay.endfiat.money,59.3327,18.0656
-nostr.overmind.lol:443,43.6532,-79.3832
-nostr.myshosholoza.co.za:443,52.3913,4.66545
-relay.wellorder.net,45.5201,-122.99
-nostr.tagomago.me,42.3601,-71.0589
-relay.internationalright-wing.org,-22.5022,-48.7114
-relay.fckstate.net,59.3293,18.0686
-nostr.azzamo.net,52.2633,21.0283
-relay.0xchat.com,43.6532,-79.3832
-relayone.geektank.ai,39.1008,-94.5811
-relay.homeinhk.xyz,35.694,139.754
-nostr.nodesmap.com,59.3327,18.0656
-relay.islandbitcoin.com:443,12.8498,77.6545
-relay.mrmave.work,43.6532,-79.3832
-relay.arx-ccn.com,50.4754,12.3683
-fanfares.nostr1.com:443,40.7057,-74.0136
-wot.shaving.kiwi,43.6532,-79.3832
-relay.nearhood.co.uk,51.5072,-0.127586
-relay.fundstr.me,42.3601,-71.0589
-syb.lol:443,43.6532,-79.3832
-dm-test-strfry-discovery.samt.st:443,43.6532,-79.3832
-relay.nostx.io,43.6532,-79.3832
-no.str.cr,10.6352,-85.4378
-relay.jbnco.co,43.6532,-79.3832
-ribo.nostria.app:443,43.6532,-79.3832
-us-east.nostr.pikachat.org,39.0438,-77.4874
-nexus.libernet.app,43.6532,-79.3832
-nostr.dlcdevkit.com,40.0992,-83.1141
-nostr.debate.report,50.1109,8.68213
-str-define-contributing-jackets.trycloudflare.com,43.6532,-79.3832
-nostr2.girino.org,43.6532,-79.3832
-nostr.unkn0wn.world,46.8499,9.53287
-nostr.spicyz.io:443,43.6532,-79.3832
-relay.layer.systems:443,49.0291,8.35695
-nostr-relay.amethyst.name,39.0067,-77.4291
-slick.mjex.me,39.0418,-77.4744
-nostr.girino.org,43.6532,-79.3832
-nostr.quali.chat:443,60.1699,24.9384
-purplerelay.com:443,43.6532,-79.3832
-nostr.notribe.net,40.8302,-74.1299
-relay.plebeian.market:443,50.1109,8.68213
-relay.samt.st,40.8302,-74.1299
-relay.mitchelltribe.com:443,39.0438,-77.4874
-nostr.0x7e.xyz,47.4949,8.71954
-relayone.soundhsa.com:443,39.1008,-94.5811
-nostr.thalheim.io:443,60.1699,24.9384
-relay.getsafebox.app:443,43.6532,-79.3832
-nostr-relay.psfoundation.info,39.0438,-77.4874
-bucket.coracle.social,37.7775,-122.397
-nostr.carroarmato0.be:443,50.914,3.21378
-relay.staging.commonshub.brussels,49.4543,11.0746
-relay-dev.satlantis.io,40.8302,-74.1299
-relay.lacompagniemaximus.com:443,45.3147,-73.8785
-relay-rpi.edufeed.org,49.4521,11.0767
-nostr.computingcache.com:443,34.0356,-118.442
-relay.lanavault.space:443,60.1699,24.9384
-relay.getsafebox.app,43.6532,-79.3832
-nrs-02.darkcloudarcade.com:443,39.9526,-75.1652
-nostr.hekster.org,37.3986,-121.964
-node.kommonzenze.de,49.4521,11.0767
-0x-nostr-relay.fly.dev,37.7648,-122.432
-speakeasy.cellar.social,49.4543,11.0746
-nostr.0x7e.xyz:443,47.4949,8.71954
-nostr.vulpem.com,49.4543,11.0746
-relay5.bitransfer.org,43.6532,-79.3832
-relay.inforsupports.com,43.6532,-79.3832
-relay.plebeian.market,50.1109,8.68213
-shu02.shugur.net,21.4902,39.2246
-nostr.easycryptosend.it,43.6532,-79.3832
-nostr.spaceshell.xyz,43.6532,-79.3832
-relay.minibolt.info,43.6532,-79.3832
-nostr.pbfs.io:443,50.4754,12.3683
-nos.lol:443,50.4754,12.3683
-nostr.thebiglake.org,32.71,-96.6745
-relay.nostriot.com,41.5695,-83.9786
-strfry.shock.network:443,39.0438,-77.4874
-relay01.lnfi.network,35.6764,139.65
-r.0kb.io:443,32.789,-96.7989
-bcast.girino.org,43.6532,-79.3832
-nostr-relay.psfoundation.info:443,39.0438,-77.4874
-dm-test-strfry-discovery.samt.st,43.6532,-79.3832
-testnet.samt.st,43.6532,-79.3832
-relay.bornheimer.app,51.5072,-0.127586
-nrs-02.darkcloudarcade.com,39.9526,-75.1652
-relay.binaryrobot.com:443,43.6532,-79.3832
-nostr.computingcache.com,34.0356,-118.442
-nostr-rs-relay-qj1h.onrender.com,37.7775,-122.397
-schnorr.me,43.6532,-79.3832
-nostr.twinkle.lol,51.902,7.6657
-nostr.overmind.lol,43.6532,-79.3832
-relay.mmwaves.de:443,48.8575,2.35138
-relay2.veganostr.com,60.1699,24.9384
-nostr.mom,50.4754,12.3683
-nostr2.girino.org:443,43.6532,-79.3832
-wot.sudocarlos.com,43.6532,-79.3832
-dev.relay.stream,43.6532,-79.3832
-nostr.thalheim.io,60.1699,24.9384
-relay-dev.gulugulu.moe:443,43.6532,-79.3832
-conduitl2.fly.dev,37.7648,-122.432
-relay.bullishbounty.com,43.6532,-79.3832
-myvoiceourstory.org,37.3598,-121.981
-relay.angor.io,48.1046,11.6002
-r.0kb.io,32.789,-96.7989
-nexus.libernet.app:443,43.6532,-79.3832
-us-east.nostr.pikachat.org:443,39.0438,-77.4874
-nostr.bitcoiner.social,47.6743,-117.112
-nostrelay.circum.space:443,52.6907,4.8181
-relayone.soundhsa.com,39.1008,-94.5811
-nostr.snowbla.de,60.1699,24.9384
-relay1.orangesync.tech,44.7839,-106.941
-nostr-2.21crypto.ch:443,47.5356,8.73209
-espelho.girino.org,43.6532,-79.3832
-nostr.blankfors.se,60.1699,24.9384
-relay.sigit.io:443,50.4754,12.3683
-relay.vrtmrz.net:443,43.6532,-79.3832
-nostr.wecsats.io:443,43.6532,-79.3832
-nostrcity-club.fly.dev,37.7648,-122.432
-nostrelay.circum.space,52.6907,4.8181
-nostr-relay-1.trustlessenterprise.com,43.6532,-79.3832
-relay.edufeed.org,49.4521,11.0767
-nostr.dlcdevkit.com:443,40.0992,-83.1141
-x.kojira.io,43.6532,-79.3832
-relay.binaryrobot.com,43.6532,-79.3832
-relay.nostrhub.fr,48.1045,11.6004
-nostr.sathoarder.com,48.5734,7.75211
-prl.plus,55.7628,37.5983
-relay.cosmicbolt.net:443,37.3986,-121.964
-relay.nostu.be:443,40.4167,-3.70329
-cs-relay.nostrdev.com,50.4754,12.3683
-satsage.xyz,37.3986,-121.964
-relay.lab.rytswd.com:443,49.4543,11.0746
-rilo.nostria.app:443,43.6532,-79.3832
-portal-relay.pareto.space,49.0291,8.35696
-relay.wavlake.com:443,41.2619,-95.8608
-relay.beginningend.com,35.2227,-97.4786
-relay.openresist.com:443,43.6532,-79.3832
-bitcoiner.social:443,47.6743,-117.112
-relay.notoshi.win:443,13.3622,100.983
-dev.relay.edufeed.org:443,49.4521,11.0767
-relay.cypherflow.ai:443,48.8575,2.35138
-relay.ru.ac.th,13.7607,100.627
-shu03.shugur.net,25.2048,55.2708
-nostr.rtvslawenia.com:443,49.4543,11.0746
-relay.agorist.space:443,52.3734,4.89406
-relay02.lnfi.network,35.6764,139.65
-relay-testnet.k8s.layer3.news:443,37.3387,-121.885
-nostr.notribe.net:443,40.8302,-74.1299
-relay.ditto.pub,43.6532,-79.3832
-nostr.rikmeijer.nl,51.7111,5.36809
-blossom.gnostr.cloud:443,43.6532,-79.3832
-nostr.oxtr.dev,50.4754,12.3683
-cache.trustr.ing,43.6548,-79.3885
-nostr.bitczat.pl,60.1699,24.9384
-relay.nostrverse.net,43.6532,-79.3832
-shu04.shugur.net,25.2048,55.2708
-eu.nostr.pikachat.org:443,49.4543,11.0746
-ribo.us.nostria.app,43.6532,-79.3832
-nostr-relay.cbrx.io,43.6532,-79.3832
-nostr.bitczat.pl:443,60.1699,24.9384
-nostr-relay.corb.net:443,38.8353,-104.822
-relay.libernet.app,43.6532,-79.3832
-nostr-verified.wellorder.net,45.5201,-122.99
-relay.nostu.be,40.4167,-3.70329
-rele.speyhard.fi,51.5072,-0.127586
-relay.staging.plebeian.market,51.5072,-0.127586
-nostr.spicyz.io,43.6532,-79.3832
-nostrride.io,37.3986,-121.964
-x.kojira.io:443,43.6532,-79.3832
-relay.staging.plebeian.market:443,51.5072,-0.127586
-relay.sigit.io,50.4754,12.3683
-nostr.stakey.net:443,52.3676,4.90414
-relay.nostr.blockhenge.com,39.0438,-77.4874
-relay.comcomponent.com,43.6532,-79.3832
-wot.nostr.place,43.6532,-79.3832
-relay.mostr.pub:443,43.6532,-79.3832
-nostr-rs-relay-ishosta.phamthanh.me,43.6532,-79.3832
-no.str.cr:443,10.6352,-85.4378
-relay.chorus.community:443,48.5333,10.7
-relay.aarpia.com,37.3986,-121.964
-relay.nostrmap.net,60.1699,24.9384
-relay.snotr.nl:49999,52.0195,4.42946
-relay.bebond.net,43.6532,-79.3832
-relay.illuminodes.com,43.6532,-79.3832
-chat-relay.zap-work.com:443,43.6532,-79.3832
-testr.nymble.world,40.8054,-74.0241
-relay.underorion.se,50.1109,8.68213
-fanfares.nostr1.com,40.7057,-74.0136
-relay.damus.io,43.6532,-79.3832
-relay.nostriches.club,43.6532,-79.3832
-nostr-dev.wellorder.net,45.5201,-122.99
-relay2.angor.io,48.1046,11.6002
-relay.openfarmtools.org,60.1699,24.9384
-wot.makenomistakes.ca,43.7064,-79.3986
-relay.thecryptosquid.com,50.4754,12.3683
-test.thedude.cloud,50.1109,8.68213
-nostr.rtvslawenia.com,49.4543,11.0746
-nostr-rs-relay.dev.fedibtc.com,39.0438,-77.4874
-relay.olas.app:443,60.1699,24.9384
-strfry.bonsai.com,39.0438,-77.4874
-relayrs.notoshi.win,43.6532,-79.3832
-articles.layer3.news,37.3387,-121.885
-wot.utxo.one,43.6532,-79.3832
-relay.angor.io:443,48.1046,11.6002
-relay.dwadziesciajeden.pl,52.2297,21.0122
-soloco.nl,43.6532,-79.3832
-armada.sharegap.net,43.6532,-79.3832
-dm-test-strfry-generic.samt.st,43.6532,-79.3832
-nostr.4rs.nl,49.0291,8.35696
-nrs-01.darkcloudarcade.com,39.1008,-94.5811
-relay.beginningend.com:443,35.2227,-97.4786
-relay.nostr.place,43.6532,-79.3832
-relay.layer.systems,49.0291,8.35695
-adre.su,59.9311,30.3609
-relay.0xchat.com:443,43.6532,-79.3832
-nostr.infero.net,35.6764,139.65
-relay.typedcypher.com:443,51.5072,-0.127586
-relay.mostro.network:443,40.8302,-74.1299
-relay-fra.zombi.cloudrodion.com,48.8566,2.35222
-relay.mitchelltribe.com,39.0438,-77.4874
-relay.mostr.pub,43.6532,-79.3832
-bitcoiner.social,47.6743,-117.112
-nostr.tac.lol:443,47.4748,-122.273
-nostr.hekster.org:443,37.3986,-121.964
-relay.satmaxt.xyz:443,43.6532,-79.3832
-relay.cypherflow.ai,48.8575,2.35138
-relay.zone667.com:443,60.1699,24.9384
-relay.jeffg.fyi:443,43.6532,-79.3832
-relay.agorist.space,52.3734,4.89406
-nostr.spaceshell.xyz:443,43.6532,-79.3832
-top.testrelay.top:443,43.6532,-79.3832
-insta-relay.apps3.slidestr.net,40.4167,-3.70329
-relay.nostrian-conquest.com:443,41.223,-111.974
-relay.laantungir.net:443,-19.4692,-42.5315
-relay.islandbitcoin.com,12.8498,77.6545
-purplerelay.com,43.6532,-79.3832
-nostr.tac.lol,47.4748,-122.273
-nostr.wecsats.io,43.6532,-79.3832
-nostr.2b9t.xyz,34.0549,-118.243
-nostr.quali.chat,60.1699,24.9384
-relay.dreamith.to,43.6532,-79.3832
-nostr.islandarea.net:443,35.4669,-97.6473
-relay.primal.net,43.6532,-79.3832
-eu.nostr.pikachat.org,49.4543,11.0746
-relay.nostr.net,43.6532,-79.3832
-nostr.n7ekb.net,47.4941,-122.294
-relay.mulatta.io,37.5665,126.978
-nittom.nostr1.com,40.7057,-74.0136
-relay2.orangesync.tech,40.7128,-74.006
-relay.artx.market,43.6548,-79.3885
-relay.wavefunc.live,41.8781,-87.6298
 bitchat.nostr1.com,40.7057,-74.0136
-relay.ditto.pub:443,43.6532,-79.3832
-relay.wisp.talk,49.4543,11.0746
-nostrelites.org,41.8781,-87.6298
-relay.goodmorningbitcoin.com,43.6532,-79.3832
-dm-test-nostr-rs-42-disabled.samt.st,43.6532,-79.3832
-relay.chorus.community,48.5333,10.7
-relay.plebchain.club,43.6532,-79.3832
-nostr-relay.amethyst.name:443,39.0067,-77.4291
-relay.lanacoin-eternity.com,40.8302,-74.1299
-relay.edufeed.org:443,49.4521,11.0767
-relay.lacompagniemaximus.com,45.3147,-73.8785
-relay.dreamith.to:443,43.6532,-79.3832
-nostr.stakey.net,52.3676,4.90414
-nostr.n7ekb.net:443,47.4941,-122.294
-relay.dyne.org,49.0291,8.35705
-nostr.janx.com,43.6532,-79.3832
-relay.trustr.ing,43.6548,-79.3885
-relay.paulstephenborile.com:443,49.4543,11.0746
-relay.wisp.talk:443,49.4543,11.0746
-yabu.me,35.6092,139.73
-bcast.seutoba.com.br,43.6532,-79.3832
-nos.xmark.cc,50.6924,3.20113
-nos.lol,50.4754,12.3683
-relay.satmaxt.xyz,43.6532,-79.3832
-relay.endfiat.money:443,59.3327,18.0656
-relay.tapestry.ninja,40.8054,-74.0241
-relay.lab.rytswd.com,49.4543,11.0746
-nostr-kyomu-haskell.onrender.com,37.7775,-122.397
-relay.damus.io:443,43.6532,-79.3832
-treuzkas.branruz.com,48.8575,2.35138
-nostr-01.yakihonne.com,1.32123,103.695
-relay.nostriot.com:443,41.5695,-83.9786
-nostr-relay.nextblockvending.com,47.2343,-119.853
-nostr.aruku.ovh,1.27994,103.849
-nostr.chaima.info,50.1109,8.68213
-ynostr.yael.at,60.1699,24.9384
-ynostr.yael.at:443,60.1699,24.9384
-nostr-01.yakihonne.com:443,1.32123,103.695
-spookstr2.nostr1.com,40.7057,-74.0136
-relay.trustr.ing:443,43.6548,-79.3885
-dev.relay.edufeed.org,49.4521,11.0767
-relay2.angor.io:443,48.1046,11.6002
-nostr.azzamo.net:443,52.2633,21.0283
-offchain.bostr.online,43.6532,-79.3832
-relay.zone667.com,60.1699,24.9384
-relay.veganostr.com,60.1699,24.9384
-vault.iris.to:443,43.6532,-79.3832
-relay.artx.market:443,43.6548,-79.3885
-wot.rejecttheframe.xyz,43.6532,-79.3832
-nostr.pbfs.io,50.4754,12.3683
-relay.mostro.network,40.8302,-74.1299
-strfry.shock.network,39.0438,-77.4874
-relay.klabo.world,47.2343,-119.853
-relay.fountain.fm:443,43.6532,-79.3832
-nostrja-kari.heguro.com,43.6532,-79.3832
-relaisnostr.trivaco.fr,48.5734,7.75211
-offchain.pub,39.1585,-94.5728
-relay.degmods.com,50.4754,12.3683
-nostr-relay.xbytez.io:443,50.6924,3.20113
-relay.paulstephenborile.com,49.4543,11.0746
-nittom.nostr1.com:443,40.7057,-74.0136
-dev-relay.nostreon.com,60.1699,24.9384
-nostr-rs-relay.dev.fedibtc.com:443,39.0438,-77.4874
-relay.jeffg.fyi,43.6532,-79.3832
-relay.laantungir.net,-19.4692,-42.5315
-nostr.data.haus:443,50.4754,12.3683
-wot.codingarena.top,50.4754,12.3683
-nostr.2b9t.xyz:443,34.0549,-118.243
-relay.libernet.app:443,43.6532,-79.3832
-nostr.ps1829.com,33.8851,130.883
-wot.dergigi.com,64.1476,-21.9392
-relay.olas.app,60.1699,24.9384
-relay.lanacoin-eternity.com:443,40.8302,-74.1299
-nostr.data.haus,50.4754,12.3683
-relay-dev.gulugulu.moe,43.6532,-79.3832
-relay.ohstr.com,43.6532,-79.3832
+relay.fundstr.me,42.3601,-71.0589
+nostr.2b9t.xyz,34.0549,-118.243
+armada.sharegap.net,43.6532,-79.3832
+nostr.chaima.info,51.5072,-0.127586
+nosflare-leefcore.leefcore.workers.dev,43.6532,-79.3832
+ribo.eu.nostria.app:443,43.6532,-79.3832
 relay.lightning.pub,39.0438,-77.4874
-relay.guggero.org,46.5971,9.59652
-testnet-relay.samt.st:443,40.8302,-74.1299
-thecitadel.nostr1.com,40.7057,-74.0136
-nostr.ps1829.com:443,33.8851,130.883
-nostr-relay.corb.net,38.8353,-104.822
-relay.npubhaus.com,43.6532,-79.3832
-nostr.21crypto.ch,47.5356,8.73209
-nostr.tadryanom.me,43.6532,-79.3832
-nostr.myshosholoza.co.za,52.3913,4.66545
-relay.bitmacro.cloud,43.6532,-79.3832
-ribo.nostria.app,43.6532,-79.3832
-relay.vrtmrz.net,43.6532,-79.3832
-syb.lol,43.6532,-79.3832
-relay.bebond.net:443,43.6532,-79.3832
-relay.agentry.com,42.8864,-78.8784
-nostr-2.21crypto.ch,47.5356,8.73209
-nostrcity-club.fly.dev:443,37.7648,-122.432
-articles.layer3.news:443,37.3387,-121.885
-relay.internationalright-wing.org:443,-22.5022,-48.7114
-nostr-relay.zimage.com,34.0549,-118.243
-chat-relay.zap-work.com,43.6532,-79.3832
-relay.mwaters.net,50.9871,2.12554
-nostr.liberty.fans,36.9104,-89.5875
-spookstr2.nostr1.com:443,40.7057,-74.0136
-nostr.chaima.info:443,50.1109,8.68213
-schnorr.me:443,43.6532,-79.3832
-ribo.eu.nostria.app,43.6532,-79.3832
-nostr.bond,50.1109,8.68213
-wot.nostr.party,36.1659,-86.7844
-temp.iris.to,43.6532,-79.3832
-relay.lotek-distro.com,43.6532,-79.3832
-relay.minibolt.info:443,43.6532,-79.3832
-relay.lanavault.space,60.1699,24.9384
-relay.mmwaves.de,48.8575,2.35138
-social.amanah.eblessing.co,48.1046,11.6002
-nostr2.thalheim.io,49.4543,11.0746
-relay.typedcypher.com,51.5072,-0.127586
-relay.cosmicbolt.net,37.3986,-121.964
-relayrs.notoshi.win:443,43.6532,-79.3832
-nostr-relay-1.trustlessenterprise.com:443,43.6532,-79.3832
-nostr.islandarea.net,35.4669,-97.6473
-relay.nostrmap.net:443,60.1699,24.9384
-relay.bullishbounty.com:443,43.6532,-79.3832
-nostr.oxtr.dev:443,50.4754,12.3683
-srtrelay.c-stellar.net,43.6532,-79.3832
-relay.mccormick.cx,52.3563,4.95714
-vault.iris.to,43.6532,-79.3832
-relay.mccormick.cx:443,52.3563,4.95714
-relay.toastr.net,40.8054,-74.0241
-nostr.hifish.org,47.4244,8.57658
-speakeasy.cellar.social:443,49.4543,11.0746
-relay.wavlake.com,41.2619,-95.8608
-testnet-relay.samt.st,40.8302,-74.1299
-aeon.libretechsystems.xyz,55.486,9.86577
-mostro-p2p.tech,50.1109,8.68213
-nostr.wild-vibes.ts.net,48.8566,2.35222
-nostr.88mph.life,52.1941,-2.21905
-relay.nostrcheck.me,43.6532,-79.3832
-rilo.nostria.app,43.6532,-79.3832
-relay.bowlafterbowl.com,32.9483,-96.7299
-relay.nostr.place:443,43.6532,-79.3832
-nostr.mom:443,50.4754,12.3683
-relay.nostrian-conquest.com,41.223,-111.974
-herbstmeister.com,34.0549,-118.243
-nrs-01.darkcloudarcade.com:443,39.1008,-94.5811
-nostr.red5d.dev,43.6532,-79.3832
-nostrbtc.com,43.6532,-79.3832
-strfry.apps3.slidestr.net,40.4167,-3.70329
-relay.sharegap.net,43.6532,-79.3832
-reraw.pbla2fish.cc,43.6532,-79.3832
-relay-testnet.k8s.layer3.news,37.3387,-121.885
-nostr.sathoarder.com:443,48.5734,7.75211
-relay.veganostr.com:443,60.1699,24.9384
-relay-fra.zombi.cloudrodion.com:443,48.8566,2.35222
-premium.primal.net,43.6532,-79.3832
-relay.wavefunc.live:443,41.8781,-87.6298
-relay-rpi.edufeed.org:443,49.4521,11.0767
-kotukonostr.onrender.com,37.7775,-122.397
+relay.nostu.be,40.4167,-3.70329
+nostr.whitenode45.ddns.net,40.55,-74.4758
+nostr.carroarmato0.be:443,50.914,3.21378
+cdn.satellite.earth,40.8302,-74.1299
+relay2.veganostr.com,60.1699,24.9384
+relay.layer.systems:443,49.0291,8.35695
+relay0.gfcom.info,13.7653,100.647
+relay.mmwaves.de:443,48.8575,2.35138
+offchain.pub,39.1585,-94.5728
+bcast.girino.org,43.6532,-79.3832
+staging.yabu.me,35.6092,139.73
+nostr.overpay.com,29.7449,-95.5343
 bridge.tagomago.me,42.3601,-71.0589
-nostr.tadryanom.me:443,43.6532,-79.3832
+nostr-01.yakihonne.com,1.32123,103.695
+strfry.bonsai.com,39.0438,-77.4874
+relay.sharegap.net,43.6532,-79.3832
+nostr.islandarea.net,35.4669,-97.6473
+dm-test-strfry-generic.samt.st,43.6532,-79.3832
+treuzkas.branruz.com,48.8575,2.35138
+relay-rpi.edufeed.org:443,49.4521,11.0767
+vault.iris.to:443,43.6532,-79.3832
+node.kommonzenze.de,49.4521,11.0767
+nostr.thalheim.io:443,60.1699,24.9384
+soloco.nl,43.6532,-79.3832
+strfry.shock.network,39.0438,-77.4874
+nostr-relay.zimage.com,34.0549,-118.243
+public.crostr.com:443,43.6532,-79.3832
+nostr.sathoarder.com:443,48.5734,7.75211
+relay.angor.io,48.1046,11.6002
+relay.wellorder.net,45.5201,-122.99
+relay.mwaters.net,50.9871,2.12554
+relay.staging.commonshub.brussels,49.4543,11.0746
+nostr-verified.wellorder.net,45.5201,-122.99
+nostr-pub.wellorder.net,45.5201,-122.99
+nostr-2.21crypto.ch,47.5356,8.73209
+relay.kaleidoswap.com,50.8476,4.35717
+relay.libernet.app:443,43.6532,-79.3832
+relay.homeinhk.xyz,35.694,139.754
+relay.manneken.brussels,49.4543,11.0746
+nostr.spicyz.io:443,43.6532,-79.3832
+relay.lanacoin-eternity.com:443,40.8302,-74.1299
+ribo.us.nostria.app:443,43.6532,-79.3832
+relay.loveisbitcoin.com,43.6532,-79.3832
+relay.angor.io:443,48.1046,11.6002
+relay02.lnfi.network,35.6764,139.65
+relay.cosmicbolt.net:443,37.3986,-121.964
+nostr-rs-relay-qj1h.onrender.com,37.7775,-122.397
+nrs-01.darkcloudarcade.com,39.0997,-94.5786
+relay.endfiat.money:443,59.3327,18.0656
+relay.paulstephenborile.com,49.4543,11.0746
+rele.speyhard.fi,51.5072,-0.127586
+relay.froth.zone,60.1699,24.9384
+relay.nostr.blockhenge.com,39.0438,-77.4874
+nrl.ceskar.xyz,50.5145,16.0119
+rilo.nostria.app,43.6532,-79.3832
+nostr.overmind.lol:443,43.6532,-79.3832
+nostr.snowbla.de:443,50.4754,12.3683
+nostrrelay.taylorperron.com,45.5029,-73.5723
+chorus.pjv.me,45.5201,-122.99
+relay.nostr.place,43.6532,-79.3832
+bucket.coracle.social,37.7775,-122.397
+nostr.girino.org:443,43.6532,-79.3832
+relay.aarpia.com,37.3986,-121.964
+nostr.thalheim.io,60.1699,24.9384
+ec2.f7z.io,60.1699,24.9384
+relay.trotters.cc,43.6532,-79.3832
+relay.mccormick.cx:443,52.3563,4.95714
+relay.momostr.pink,43.6532,-79.3832
+relay.nostr.net,43.6532,-79.3832
+conduitl2.fly.dev,37.7648,-122.432
+chat-relay.zap-work.com,43.6532,-79.3832
+relay.ditto.pub,43.6532,-79.3832
+relay.veganostr.com,60.1699,24.9384
+relay.minibolt.info:443,43.6532,-79.3832
+adre.su,59.9311,30.3609
+bitcoinostr.duckdns.org,41.1976,1.11167
+nostr.computingcache.com:443,34.0356,-118.442
+relay-fra.zombi.cloudrodion.com,48.8566,2.35222
+nostr.hekster.org:443,37.3986,-121.964
+nostr.88mph.life,52.1941,-2.21905
+wot.dergigi.com,64.1476,-21.9392
+nostr.planix.org,43.6532,-79.3832
+relay.satsmarkt.club,52.6907,4.8181
+nostrcity-club.fly.dev:443,37.7648,-122.432
+aeon.libretechsystems.xyz,55.486,9.86577
+testnet.samt.st,43.6532,-79.3832
+nostr.data.haus,50.4754,12.3683
+wot.sudocarlos.com,43.6532,-79.3832
+relay-fra.zombi.cloudrodion.com:443,48.8566,2.35222
+shu01.shugur.net,21.4902,39.2246
 relay.gulugulu.moe:443,43.6532,-79.3832
+relay2.angor.io:443,48.1046,11.6002
+relay.libernet.app,43.6532,-79.3832
+directories-safe-motherboard-recipients.trycloudflare.com,43.6532,-79.3832
+wot.nostr.party,36.1659,-86.7844
+relay.zone667.com,60.1699,24.9384
+nostr.wild-vibes.ts.net,48.8566,2.35222
+relay.nostr.com,50.1109,8.68213
+nostr.iskarion.ddns.net,43.3076,-2.95421
+relay-dev.satlantis.io,39.0438,-77.4874
+relay.sovereignresonance.org,48.9006,2.25929
+relay.nostrian-conquest.com,41.223,-111.974
+relay.aidatanorge.no,43.6532,-79.3832
+strfry.apps3.slidestr.net,40.4167,-3.70329
+relay.klabo.world,47.2343,-119.853
+nostr.data.haus:443,50.4754,12.3683
+testr.nymble.world,40.8054,-74.0241
+relay.inforsupports.com,43.6532,-79.3832
+relay.nostrmap.net:443,60.1699,24.9384
+nostr.stakey.net:443,52.3676,4.90414
+dev-relay.nostreon.com,60.1699,24.9384
+nostr.islandarea.net:443,35.4669,-97.6473
+nostr.rtvslawenia.com,49.4543,11.0746
+relay.bowlafterbowl.com,32.9483,-96.7299
+nostr.quali.chat:443,60.1699,24.9384
+relay.plebeian.market,50.1109,8.68213
+relay-rpi.edufeed.org,49.4521,11.0767
+r.0kb.io,32.789,-96.7989
+nostr.notribe.net:443,40.8302,-74.1299
+relay.getsafebox.app:443,43.6532,-79.3832
+nostr.dlcdevkit.com:443,40.0992,-83.1141
+nostrelites.org,34.9582,-81.9907
+nostr.hoppe-relay.it.com,42.8864,-78.8784
+nostr.thebiglake.org,32.71,-96.6745
+nostr-kyomu-haskell.onrender.com,37.7775,-122.397
+relay.nostriot.com,41.5695,-83.9786
+nostr.christiansass.de,51.7634,7.8887
+relay.btcforplebs.com,43.6532,-79.3832
+nostr.tagomago.me,42.3601,-71.0589
+relayone.geektank.ai,39.0997,-94.5786
+relay.dreamith.to:443,43.6532,-79.3832
+nostr.liberty.fans,36.8767,-89.5879
+wot.makenomistakes.ca,43.7064,-79.3986
+relay.goodmorningbitcoin.com,43.6532,-79.3832
+relay.layer.systems,49.0291,8.35695
+relay.paulstephenborile.com:443,49.4543,11.0746
+relay.ohstr.com,43.6532,-79.3832
+nostr-relay.xbytez.io:443,50.6924,3.20113
+nostr.ac,38.958,-77.3592
+ribo.us.nostria.app,43.6532,-79.3832
+nostr.21crypto.ch,47.5356,8.73209
+relay.chorus.community:443,48.5333,10.7
+relay.cypherflow.ai,48.8575,2.35138
+relay.agorist.space:443,52.3734,4.89406
+relay.nostrian-conquest.com:443,41.223,-111.974
+relay.keykeeper.world,40.7824,-74.0711
+relay.getvia.xyz,60.1699,24.9384
+relay.nuts.cash,52.3676,4.90414
+kotukonostr.onrender.com,37.7775,-122.397
+relay.minibolt.info,43.6532,-79.3832
+relay.dwadziesciajeden.pl,52.2297,21.0122
+relay.fountain.fm:443,43.6532,-79.3832
+relay.fountain.fm,43.6532,-79.3832
+nostr-02.uid.ovh,50.9871,2.12554
+relay.lanavault.space:443,60.1699,24.9384
+nostr.carroarmato0.be,50.914,3.21378
+nexus.libernet.app:443,43.6532,-79.3832
+relay.artio.inf.unibe.ch,46.9501,7.43678
+blossom.gnostr.cloud,43.6532,-79.3832
+relay.binaryrobot.com,43.6532,-79.3832
+relay.earthly.city,34.1749,-118.54
+nostr.hifish.org,47.4244,8.57658
 offchain.pub:443,39.1585,-94.5728
+relay.bullishbounty.com:443,43.6532,-79.3832
+strfry.openhoofd.nl:443,51.5717,3.70417
+cs-relay.nostrdev.com:443,50.4754,12.3683
+strfry.ymir.cloud,43.6532,-79.3832
+nostrbtc.com,43.6532,-79.3832
 relay.directsponsor.net,42.8864,-78.8784
-nostr.snowbla.de:443,60.1699,24.9384
+nostr2.girino.org,43.6532,-79.3832
+relay.sigit.io:443,50.4754,12.3683
+relay.getsafebox.app,43.6532,-79.3832
+antiprimal.net,43.6532,-79.3832
+nostr.sathoarder.com,48.5734,7.75211
+inbox.scuba323.com,40.8218,-74.45
+nrs-01.darkcloudarcade.com:443,39.0997,-94.5786
+nostr.tac.lol,47.4748,-122.273
+nostr.davenov.com,50.1109,8.68213
+relay.trotters.cc:443,43.6532,-79.3832
+nostr.plantroon.com:443,50.1013,8.62643
+relay.nostreon.com,60.1699,24.9384
+nostr.easycryptosend.it,43.6532,-79.3832
+nostr-01.yakihonne.com:443,1.32123,103.695
+relay-testnet.k8s.layer3.news,37.3387,-121.885
+nostr.purpura.cloud,43.6532,-79.3832
+insta-relay.apps3.slidestr.net,40.4167,-3.70329
+nostr.mifen.me,43.6532,-79.3832
+testnet-relay.samt.st:443,40.8302,-74.1299
+nostr.2b9t.xyz:443,34.0549,-118.243
+relay.wavlake.com:443,41.2619,-95.8608
+relay.wisp.talk:443,49.4543,11.0746
+relay-dev.satlantis.io:443,39.0438,-77.4874
+relay.satlantis.io,39.0438,-77.4874
+relay.staging.plebeian.market,51.5072,-0.127586
+relay.openfarmtools.org,60.1699,24.9384
+relay.nostrhub.fr,48.1045,11.6004
+nostr-relay.xbytez.io,50.6924,3.20113
+relay.binaryrobot.com:443,43.6532,-79.3832
+relay.samt.st,40.8302,-74.1299
+relay.illuminodes.com,43.6532,-79.3832
+relay.liberbitworld.org,43.6532,-79.3832
+relay.olas.app:443,60.1699,24.9384
+no.str.cr,8.96171,-83.5246
+dm-test-strfry-discovery.samt.st,43.6532,-79.3832
+wot.rejecttheframe.xyz,43.6532,-79.3832
+relay.nostriot.com:443,41.5695,-83.9786
+nostr.plantroon.com,50.1013,8.62643
+nostr-01.uid.ovh,50.9871,2.12554
+relay.openresist.com:443,43.6532,-79.3832
+nostr.overmind.lol,43.6532,-79.3832
+relay.internationalright-wing.org,-22.5022,-48.7114
+nostr.myshosholoza.co.za:443,52.3676,4.90414
+nostr.pbfs.io:443,50.4754,12.3683
+21milionidinostr.duckdns.org,41.8967,12.4822
+nostr.4rs.nl,49.0291,8.35696
+relay.lanavault.space,60.1699,24.9384
+relay.mostr.pub,43.6532,-79.3832
+relay.nostar.org,43.6532,-79.3832
+nostr.mom,50.4754,12.3683
+relay.decentralia.fr,48.122,11.589
+relay.agentry.com,42.8864,-78.8784
+relay2.angor.io,48.1046,11.6002
+slick.mjex.me,39.0418,-77.4744
+relay-us.zombi.cloudrodion.com,40.7862,-74.0743
+relay.vrtmrz.net:443,43.6532,-79.3832
+relay.beginningend.com,35.2227,-97.4786
+chat-relay.zap-work.com:443,43.6532,-79.3832
+relay.underorion.se,50.1109,8.68213
+relay.mitchelltribe.com,39.0438,-77.4874
+relay.qstr.app,51.5072,-0.127586
+relay.cyberguy.fyi,52.6907,4.8181
+strfry.bonsai.com:443,39.0438,-77.4874
+relayone.soundhsa.com:443,39.0997,-94.5786
+relay.sigit.io,50.4754,12.3683
+relay.npubhaus.com,43.6532,-79.3832
+relayrs.notoshi.win,43.6532,-79.3832
+relay.mitchelltribe.com:443,39.0438,-77.4874
+relay.44billion.net,43.6532,-79.3832
+reraw.pbla2fish.cc,43.6532,-79.3832
+articles.layer3.news:443,37.3387,-121.885
+nostr.sovereignservices.xyz,43.6532,-79.3832
+relay.nostx.io,43.6532,-79.3832
+nostr-relay.amethyst.name,39.0067,-77.4291
+0x-nostr-relay.fly.dev,37.7648,-122.432
+relay.ohstr.com:443,43.6532,-79.3832
+00f2e774.relay.dev.thunderegg.us,39.0438,-77.4874
+nostr-relay.cbrx.io,43.6532,-79.3832
+relay.wavlake.com,41.2619,-95.8608
+purplerelay.com:443,43.6532,-79.3832
+nostr-pr02.redscrypt.org,52.3676,4.90414
+fanfares.nostr1.com:443,40.7057,-74.0136
+kasztanowa.bieda.it,43.6532,-79.3832
+relay.flashapp.me,43.6548,-79.3885
+relay.typedcypher.com,51.5072,-0.127586
+nostr.bond,50.1109,8.68213
+nostr.azzamo.net,52.2633,21.0283
+nexus.libernet.app,43.6532,-79.3832
+relay.cosmicbolt.net,37.3986,-121.964
+schnorr.me,43.6532,-79.3832
+relay.mostro.network:443,40.8302,-74.1299
+relay-arg.zombi.cloudrodion.com,1.35208,103.82
+relay.chorus.community,48.5333,10.7
+blossom.gnostr.cloud:443,43.6532,-79.3832
+syb.lol:443,34.0549,-118.243
+relay.dyne.org,49.0291,8.35705
+btc.klendazu.com,41.2861,1.24993
+wot.nostr.place,43.6532,-79.3832
+relay.openresist.com,43.6532,-79.3832
+rilo.nostria.app:443,43.6532,-79.3832
+no.str.cr:443,8.96171,-83.5246
+relay.mostr.pub:443,43.6532,-79.3832
+relay.edufeed.org:443,49.4521,11.0767
+nostr.debate.report,50.1109,8.68213
+relay.satmaxt.xyz:443,43.6532,-79.3832
+relay.artx.market:443,43.6548,-79.3885
+relay-dev.gulugulu.moe,43.6532,-79.3832
+relay.novospes.com,43.6532,-79.3832
+relay.nostr-check.me,43.6532,-79.3832
+nostr.computingcache.com,34.0356,-118.442
+nostr.oxtr.dev,50.4754,12.3683
+relay.fckstate.net,59.3293,18.0686
+relay.vrtmrz.net,43.6532,-79.3832
+relay.bornheimer.app,51.5072,-0.127586
+relay.guggero.org,46.5971,9.59652
+relay01.lnfi.network,35.6764,139.65
+wot.shaving.kiwi,43.6532,-79.3832
+nostr.twinkle.lol,51.902,7.6657
+relay.edufeed.org,49.4521,11.0767
+relay.lanacoin-eternity.com,40.8302,-74.1299
+relay.satmaxt.xyz,43.6532,-79.3832
+nostr.hifish.org:443,47.4244,8.57658
+relay.cypherflow.ai:443,48.8575,2.35138
+infinity-signal-relay.digitalforlifeagency.workers.dev,43.6532,-79.3832
+nostr.na.social:443,43.6532,-79.3832
+nostr.rtvslawenia.com:443,49.4543,11.0746
+relay.mypathtofire.de,42.8864,-78.8784
+public.crostr.com,43.6532,-79.3832
+relay.olas.app,60.1699,24.9384
+relay.agora.social,50.7383,15.0648
+ribo.nostria.app,43.6532,-79.3832
+relay.lab.rytswd.com,49.4543,11.0746
+relay.ditto.pub:443,43.6532,-79.3832
+porchlight.social,43.6532,-79.3832
+nostr.notribe.net,40.8302,-74.1299
+relay.endfiat.money,59.3327,18.0656
+nostr.myshosholoza.co.za,52.3676,4.90414
+relay.nearhood.co.uk,51.5134,-0.0890675
+relay.degmods.com,50.4754,12.3683
+nostr.novacisko.cz,52.2026,20.9397
+prl.plus,55.7628,37.5983
+bruh.samt.st,43.6532,-79.3832
+strfry.openhoofd.nl,51.5717,3.70417
+nostr.spicyz.io,43.6532,-79.3832
+nostr.na.social,43.6532,-79.3832
+nip85.nosfabrica.com,39.0997,-94.5786
+premium.primal.net,43.6532,-79.3832
+fanfares.nostr1.com,40.7057,-74.0136
+relay.scuba323.com,40.8218,-74.45
+nostr2.girino.org:443,43.6532,-79.3832
+relay.mmwaves.de,48.8575,2.35138
+nostr-rs-relay.dev.fedibtc.com:443,39.0438,-77.4874
+strfry.shock.network:443,39.0438,-77.4874
+nostr.snowbla.de,50.4754,12.3683
+nostr.spaceshell.xyz,43.6532,-79.3832
+nostr.quali.chat,60.1699,24.9384
+wot.utxo.one,43.6532,-79.3832
+relay.mccormick.cx,52.3563,4.95714
+mostro-p2p.tech,50.1109,8.68213
+basspistol.org,49.0291,8.35696
+ribo.nostria.app:443,43.6532,-79.3832
+chorus.mikedilger.com:444,-36.8906,174.794
+nostr.oxtr.dev:443,50.4754,12.3683
+nostr.nodesmap.com,59.3327,18.0656
+offchain.bostr.online,43.6532,-79.3832
+purplerelay.com,43.6532,-79.3832
+relayrs.notoshi.win:443,43.6532,-79.3832
+relay.wavefunc.live,41.8781,-87.6298
+relay.dreamith.to,43.6532,-79.3832
+bendernostur.duckdns.org:8443,50.1109,8.68213
+relay.nmail.li,50.9871,2.12554
+nostr-relay.corb.net,39.6478,-104.988
+relay.staging.plebeian.market:443,51.5072,-0.127586
+spamspamspamspam.rest,43.6532,-79.3832
+relay1.gfcom.info,13.9215,100.538
+schnorr.me:443,43.6532,-79.3832
+relay.lab.rytswd.com:443,49.4543,11.0746
+nostr-rs-relay.dev.fedibtc.com,39.0438,-77.4874
+dm-test-nostr-rs-42-disabled.samt.st,43.6532,-79.3832
+relay.nostrmap.net,60.1699,24.9384
+nostr.relay.hedwig.sh,60.1699,24.9384
+relay.veganostr.com:443,60.1699,24.9384
+relay.wavefunc.live:443,41.8781,-87.6298
+nostr.mikoshi.de,52.52,13.405
+syb.lol,34.0549,-118.243
+relay1.nostrchat.io,60.1699,24.9384
+nostr.wecsats.io:443,43.6532,-79.3832
+nostr.chaima.info:443,51.5072,-0.127586
+nostr.azzamo.net:443,52.2633,21.0283
+relay-can.zombi.cloudrodion.com,43.6532,-79.3832
+nostr.unkn0wn.world,46.8499,9.53287
+relayone.soundhsa.com,39.0997,-94.5786
+x.kojira.io,43.6532,-79.3832
+dm-test-strfry-discovery.samt.st:443,43.6532,-79.3832
+nostrelay.circum.space,52.6907,4.8181
+relay.primal.net,43.6532,-79.3832
+nostr.girino.org,43.6532,-79.3832
+nostr.pbfs.io,50.4754,12.3683
+relay.kalcafe.xyz,37.3986,-121.964
+relay.gulugulu.moe,43.6532,-79.3832
+top.testrelay.top,43.6532,-79.3832
+relay.kilombino.com,43.6532,-79.3832
+nos.lol:443,50.4754,12.3683
+nos.lol,50.4754,12.3683
+relay.nostr.place:443,43.6532,-79.3832
+cache.trustr.ing,43.6548,-79.3885
+relay.internationalright-wing.org:443,-22.5022,-48.7114
+relay.laantungir.net,-19.4692,-42.5315
+relay.lightning.pub:443,39.0438,-77.4874
+nostr.stakey.net,52.3676,4.90414
+articles.layer3.news,37.3387,-121.885
+relay.wisp.talk,49.4543,11.0746
+relay.pyramid.li,47.4093,8.46503
+relay.typedcypher.com:443,51.5072,-0.127586
+dev.relay.stream,43.6532,-79.3832
+relay.bullishbounty.com,43.6532,-79.3832
+nostr.mom:443,50.4754,12.3683
+relay.plebeian.market:443,50.1109,8.68213
+nostr.hekster.org,37.3986,-121.964
+nostrcity-club.fly.dev,37.7648,-122.432
+nostr.vulpem.com,49.4543,11.0746
+relay-dev.gulugulu.moe:443,43.6532,-79.3832
+weboftrust.libretechsystems.xyz,55.4724,9.87335
+nostr-relay.corb.net:443,39.6478,-104.988
+wheat.happytavern.co,43.6532,-79.3832
+relay.mappingbitcoin.com,43.6532,-79.3832
+testnet-relay.samt.st,40.8302,-74.1299
+relay.bitmacro.cloud,43.6532,-79.3832
+dev.relay.edufeed.org,49.4521,11.0767
+myvoiceourstory.org,37.3598,-121.981
+relay.stickeroo.is-cool.dev,37.3387,-121.885
+relay.agorist.space,52.3734,4.89406
+freelay.sovbit.host,60.1699,24.9384
+nostr-dev.wellorder.net,45.5201,-122.99
+nostr.middling.mydns.jp,35.8099,140.12
+cs-relay.nostrdev.com,50.4754,12.3683
+x.kojira.io:443,43.6532,-79.3832
+nostrelay.circum.space:443,52.6907,4.8181
+nostr.janx.com,43.6532,-79.3832
+relay.mrmave.work,43.6532,-79.3832
+espelho.girino.org,43.6532,-79.3832
+hol.is,43.6532,-79.3832
+ribo.eu.nostria.app,43.6532,-79.3832
+nostr.yutakobayashi.com,43.6532,-79.3832
+relay.mostro.network,40.8302,-74.1299
+communities.nos.social,40.8302,-74.1299
+relay.solife.me,43.6532,-79.3832
+yabu.me,35.6092,139.73
+relay.islandbitcoin.com,12.8498,77.6545
+nostr.wecsats.io,43.6532,-79.3832
+nostr.tac.lol:443,47.4748,-122.273
+relay.arx-ccn.com,50.4754,12.3683
+nostrride.io,37.3986,-121.964
+r.0kb.io:443,32.789,-96.7989
+herbstmeister.com,34.0549,-118.243
+relay.artx.market,43.6548,-79.3885
+vault.iris.to,43.6532,-79.3832
+relay.ru.ac.th,13.7607,100.627
+temp.iris.to,43.6532,-79.3832
+social.amanah.eblessing.co,48.1046,11.6002
+nostr-relay.nextblockvending.com,47.2343,-119.853
+wot.codingarena.top,50.4754,12.3683
+relay.sincensura.org,43.6532,-79.3832
+nostr.dlcdevkit.com,40.0992,-83.1141

app/src/main/java/com/bitchat/android/BitchatApplication.kt

@@ -13,6 +13,19 @@ class BitchatApplication : Application() {
     override fun onCreate() {
         super.onCreate()
 
+        if (!com.bitchat.android.nostr.NdrPanicStartupRecovery
+                .recoverBeforeNetwork(this)
+        ) {
+            android.util.Log.e(
+                "BitchatApplication",
+                "Network startup blocked until panic wipe retry succeeds"
+            )
+            return
+        }
+
+        // Start the single process-wide power policy before transport components are constructed.
+        com.bitchat.android.mesh.PowerManager.getInstance(this).start()
+
         // Initialize Tor first so any early network goes over Tor
         try {
             val torProvider = ArtiTorManager.getInstance()
@@ -28,6 +41,20 @@ class BitchatApplication : Application() {
         // Initialize favorites persistence early so MessageRouter/NostrTransport can use it on startup
         try {
             com.bitchat.android.favorites.FavoritesPersistenceService.initialize(this)
+            com.bitchat.android.favorites.FavoritesPersistenceService.shared
+                .setNdrPeerRetirementGuard { oldPeerPubkeyHex ->
+                    val identity =
+                        com.bitchat.android.nostr.NostrIdentityBridge
+                            .getCurrentNostrIdentity(this)
+                            ?: return@setNdrPeerRetirementGuard false
+                    val ndr = com.bitchat.android.nostr.NdrNostrService.getInstance(this)
+                    if (com.bitchat.android.model.NdrFeatureGate.isEnabled()) {
+                        ndr.configureIfNeeded(identity)
+                        ndr.retirePeer(oldPeerPubkeyHex)
+                    } else {
+                        ndr.retirePeerForMaintenance(identity, oldPeerPubkeyHex)
+                    }
+                }
         } catch (_: Exception) { }
 
         // Warm up Nostr identity to ensure npub is available for favorite notifications
@@ -41,12 +68,22 @@ class BitchatApplication : Application() {
         // Initialize debug preference manager (persists debug toggles)
         try { com.bitchat.android.ui.debug.DebugPreferenceManager.init(this) } catch (_: Exception) { }
 
+        // Initialize Wi‑Fi Aware controller with persisted default
+        try {
+            val enabled = com.bitchat.android.ui.debug.DebugPreferenceManager.getWifiAwareEnabled(false)
+            com.bitchat.android.wifiaware.WifiAwareController.initialize(this, enabled)
+        } catch (_: Exception) { }
+
         // Initialize Geohash Registries for persistence
         try {
             com.bitchat.android.nostr.GeohashAliasRegistry.initialize(this)
             com.bitchat.android.nostr.GeohashConversationRegistry.initialize(this)
         } catch (_: Exception) { }
 
+        // Own relay connectivity, selected-channel subscriptions, and presence scheduling at the
+        // process level so closing the Activity does not disconnect Nostr.
+        try { com.bitchat.android.nostr.NostrBackgroundRuntime.initialize(this) } catch (_: Exception) { }
+
         // Initialize mesh service preferences
         try { com.bitchat.android.service.MeshServicePreferences.init(this) } catch (_: Exception) { }
 

app/src/main/java/com/bitchat/android/MainActivity.kt

@@ -1,6 +1,7 @@
 package com.bitchat.android
 
 import android.content.Intent
+import android.os.Build
 import android.os.Bundle
 import android.util.Log
 import androidx.activity.OnBackPressedCallback
@@ -19,6 +20,8 @@ import androidx.lifecycle.ViewModelProvider
 import androidx.lifecycle.repeatOnLifecycle
 import androidx.lifecycle.Lifecycle
 import com.bitchat.android.mesh.BluetoothMeshService
+import com.bitchat.android.mesh.MeshService
+import com.bitchat.android.geohash.LocationChannelManager
 import com.bitchat.android.onboarding.BluetoothCheckScreen
 import com.bitchat.android.onboarding.BluetoothStatus
 import com.bitchat.android.onboarding.BluetoothStatusManager
@@ -40,6 +43,7 @@ import com.bitchat.android.ui.ChatScreen
 import com.bitchat.android.ui.ChatViewModel
 import com.bitchat.android.ui.OrientationAwareActivity
 import com.bitchat.android.ui.theme.BitchatTheme
+import com.bitchat.android.wifiaware.WifiAwareController
 import com.bitchat.android.nostr.PoWPreferenceManager
 import com.bitchat.android.services.VerificationService
 import kotlinx.coroutines.delay
@@ -55,12 +59,14 @@ class MainActivity : OrientationAwareActivity() {
     
     // Core mesh service - provided by the foreground service holder
     private lateinit var meshService: BluetoothMeshService
+    private lateinit var unifiedMeshService: MeshService
     private val mainViewModel: MainViewModel by viewModels()
+    private var pendingMeshForegroundServiceStart = false
     private val chatViewModel: ChatViewModel by viewModels { 
         object : ViewModelProvider.Factory {
             override fun <T : androidx.lifecycle.ViewModel> create(modelClass: Class<T>): T {
                 @Suppress("UNCHECKED_CAST")
-                return ChatViewModel(application, meshService) as T
+                return ChatViewModel(application, meshService, unifiedMeshService) as T
             }
         }
     }
@@ -76,7 +82,21 @@ class MainActivity : OrientationAwareActivity() {
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
-        
+        if (!com.bitchat.android.nostr.NdrPanicStartupRecovery
+                .isNetworkStartupAllowed()
+        ) {
+            finishAndRemoveTask()
+            return
+        }
+        if (com.bitchat.android.service.AppShutdownCoordinator
+                .isShutdownCommitted()
+        ) {
+            finishAndRemoveTask()
+            return
+        }
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+            this.setRecentsScreenshotEnabled(false)
+        }
         // Register receiver for force finish signal from shutdown coordinator
         val filter = android.content.IntentFilter(com.bitchat.android.util.AppConstants.UI.ACTION_FORCE_FINISH)
         if (android.os.Build.VERSION.SDK_INT >= 33) {
@@ -104,16 +124,18 @@ class MainActivity : OrientationAwareActivity() {
             return
         }
 
-        com.bitchat.android.service.AppShutdownCoordinator.cancelPendingShutdown()
-        
         // Enable edge-to-edge display for modern Android look
         enableEdgeToEdge()
 
         // Initialize permission management
         permissionManager = PermissionManager(this)
-        // Ensure foreground service is running and get mesh instance from holder
-        try { com.bitchat.android.service.MeshForegroundService.start(applicationContext) } catch (_: Exception) { }
+        // Start the foreground service when allowed, then get mesh instances from the holder.
+        startMeshForegroundServiceBestEffort()
         meshService = com.bitchat.android.service.MeshServiceHolder.getOrCreate(applicationContext)
+        unifiedMeshService = com.bitchat.android.service.MeshServiceHolder.getUnifiedOrCreate(applicationContext)
+        // Expose BLE mesh to Wi‑Fi Aware controller for cross-transport relays - DEPRECATED
+        // Bridging is now handled by TransportBridgeService automatically
+        
         bluetoothStatusManager = BluetoothStatusManager(
             activity = this,
             context = this,
@@ -164,6 +186,17 @@ class MainActivity : OrientationAwareActivity() {
                 }
             }
         }
+
+        // Keep the unified mesh delegate attached when Wi-Fi Aware starts after the UI.
+        lifecycleScope.launch {
+            repeatOnLifecycle(Lifecycle.State.STARTED) {
+                WifiAwareController.running.collect { running ->
+                    if (running && lifecycle.currentState.isAtLeast(Lifecycle.State.RESUMED)) {
+                        unifiedMeshService.delegate = chatViewModel
+                    }
+                }
+            }
+        }
         
         // Only start onboarding process if we're in the initial CHECKING state
         // This prevents restarting onboarding on configuration changes
@@ -199,7 +232,6 @@ class MainActivity : OrientationAwareActivity() {
             onDispose {
                 try {
                     context.unregisterReceiver(receiver)
-                    Log.d("BluetoothStatusUI", "BroadcastReceiver unregistered")
                 } catch (e: IllegalStateException) {
                     Log.w("BluetoothStatusUI", "Receiver was not registered")
                 }
@@ -222,6 +254,10 @@ class MainActivity : OrientationAwareActivity() {
                     onRetry = {
                         checkBluetoothAndProceed()
                     },
+                    onSkip = {
+                        mainViewModel.skipBluetoothCheck()
+                        checkLocationAndProceed()
+                    },
                     isLoading = isBluetoothLoading
                 )
             }
@@ -328,7 +364,7 @@ class MainActivity : OrientationAwareActivity() {
         when (state) {
             OnboardingState.COMPLETE -> {
                 // App is fully initialized, mesh service is running
-                android.util.Log.d("MainActivity", "Onboarding completed - app ready")
+                android.util.Log.i("MainActivity", "Onboarding completed - app ready")
             }
             OnboardingState.ERROR -> {
                 android.util.Log.e("MainActivity", "Onboarding error state reached")
@@ -338,8 +374,6 @@ class MainActivity : OrientationAwareActivity() {
     }
     
     private fun checkOnboardingStatus() {
-        Log.d("MainActivity", "Checking onboarding status")
-        
         lifecycleScope.launch {
             // Small delay to show the checking state
             delay(500)
@@ -353,12 +387,15 @@ class MainActivity : OrientationAwareActivity() {
      * Check Bluetooth status and proceed with onboarding flow
      */
     private fun checkBluetoothAndProceed() {
-        // Log.d("MainActivity", "Checking Bluetooth status")
-        
+        // Check if user has skipped Bluetooth check for this session
+        if (mainViewModel.isBluetoothCheckSkipped.value) {
+            checkLocationAndProceed()
+            return
+        }
+
         // For first-time users, skip Bluetooth check and go straight to permissions
         // We'll check Bluetooth after permissions are granted
         if (permissionManager.isFirstTimeLaunch()) {
-            Log.d("MainActivity", "First-time launch, skipping Bluetooth check - will check after permissions")
             proceedWithPermissionCheck()
             return
         }
@@ -367,6 +404,12 @@ class MainActivity : OrientationAwareActivity() {
         bluetoothStatusManager.logBluetoothStatus()
         mainViewModel.updateBluetoothStatus(bluetoothStatusManager.checkBluetoothStatus())
         
+        val bleRequired = try { com.bitchat.android.ui.debug.DebugPreferenceManager.getBleEnabled(true) } catch (_: Exception) { true }
+        if (!bleRequired) {
+            // Skip BLE checks entirely when BLE is disabled in debug settings
+            checkLocationAndProceed()
+            return
+        }
         when (mainViewModel.bluetoothStatus.value) {
             BluetoothStatus.ENABLED -> {
                 // Bluetooth is enabled, check location services next
@@ -374,7 +417,6 @@ class MainActivity : OrientationAwareActivity() {
             }
             BluetoothStatus.DISABLED -> {
                 // Show Bluetooth enable screen (should have permissions as existing user)
-                Log.d("MainActivity", "Bluetooth disabled, showing enable screen")
                 mainViewModel.updateOnboardingState(OnboardingState.BLUETOOTH_CHECK)
                 mainViewModel.updateBluetoothLoading(false)
             }
@@ -391,16 +433,12 @@ class MainActivity : OrientationAwareActivity() {
      * Proceed with permission checking 
      */
     private fun proceedWithPermissionCheck() {
-        Log.d("MainActivity", "Proceeding with permission check")
-        
         lifecycleScope.launch {
             delay(200) // Small delay for smooth transition
-            
+
             if (permissionManager.isFirstTimeLaunch()) {
-                Log.d("MainActivity", "First time launch, showing permission explanation")
                 mainViewModel.updateOnboardingState(OnboardingState.PERMISSION_EXPLANATION)
             } else if (permissionManager.areRequiredPermissionsGranted()) {
-                Log.d("MainActivity", "Existing user with required permissions")
                 if (permissionManager.needsBackgroundLocationPermission() &&
                     !permissionManager.isBackgroundLocationGranted() &&
                     !com.bitchat.android.onboarding.BackgroundLocationPreferenceManager.isSkipped(this@MainActivity)
@@ -411,7 +449,6 @@ class MainActivity : OrientationAwareActivity() {
                     initializeApp()
                 }
             } else {
-                Log.d("MainActivity", "Existing user missing permissions, showing explanation")
                 mainViewModel.updateOnboardingState(OnboardingState.PERMISSION_EXPLANATION)
             }
         }
@@ -421,7 +458,6 @@ class MainActivity : OrientationAwareActivity() {
      * Handle Bluetooth enabled callback
      */
     private fun handleBluetoothEnabled() {
-        Log.d("MainActivity", "Bluetooth enabled by user")
         mainViewModel.updateBluetoothLoading(false)
         mainViewModel.updateBluetoothStatus(BluetoothStatus.ENABLED)
         checkLocationAndProceed()
@@ -431,12 +467,9 @@ class MainActivity : OrientationAwareActivity() {
      * Check Location services status and proceed with onboarding flow
      */
     private fun checkLocationAndProceed() {
-        Log.d("MainActivity", "Checking location services status")
-        
         // For first-time users, skip location check and go straight to permissions
         // We'll check location after permissions are granted
         if (permissionManager.isFirstTimeLaunch()) {
-            Log.d("MainActivity", "First-time launch, skipping location check - will check after permissions")
             proceedWithPermissionCheck()
             return
         }
@@ -452,7 +485,6 @@ class MainActivity : OrientationAwareActivity() {
             }
             LocationStatus.DISABLED -> {
                 // Show location enable screen (should have permissions as existing user)
-                Log.d("MainActivity", "Location services disabled, showing enable screen")
                 mainViewModel.updateOnboardingState(OnboardingState.LOCATION_CHECK)
                 mainViewModel.updateLocationLoading(false)
             }
@@ -469,9 +501,10 @@ class MainActivity : OrientationAwareActivity() {
      * Handle Location enabled callback
      */
     private fun handleLocationEnabled() {
-        Log.d("MainActivity", "Location services enabled by user")
         mainViewModel.updateLocationLoading(false)
         mainViewModel.updateLocationStatus(LocationStatus.ENABLED)
+        // Ensure Wi-Fi Aware starts now that location is enabled
+        com.bitchat.android.wifiaware.WifiAwareController.startIfPossible()
         checkBatteryOptimizationAndProceed()
     }
 
@@ -513,12 +546,10 @@ class MainActivity : OrientationAwareActivity() {
             message.contains("Permission") && permissionManager.isFirstTimeLaunch() -> {
                 // During first-time onboarding, if Bluetooth enable fails due to permissions,
                 // proceed to permission explanation screen where user will grant permissions first
-                Log.d("MainActivity", "Bluetooth enable requires permissions, proceeding to permission explanation")
                 proceedWithPermissionCheck()
             }
             message.contains("Permission") -> {
                 // For existing users, redirect to permission explanation to grant missing permissions
-                Log.d("MainActivity", "Bluetooth enable requires permissions, showing permission explanation")
                 mainViewModel.updateOnboardingState(OnboardingState.PERMISSION_EXPLANATION)
             }
             else -> {
@@ -529,8 +560,6 @@ class MainActivity : OrientationAwareActivity() {
     }
     
     private fun handleOnboardingComplete() {
-        Log.d("MainActivity", "Onboarding completed, checking Bluetooth and Location before initializing app")
-        
         // After permissions are granted, re-check Bluetooth, Location, and Battery Optimization status
         val currentBluetoothStatus = bluetoothStatusManager.checkBluetoothStatus()
         val currentLocationStatus = locationStatusManager.checkLocationStatus()
@@ -540,31 +569,28 @@ class MainActivity : OrientationAwareActivity() {
             else -> BatteryOptimizationStatus.ENABLED
         }
         
+        val bleRequired2 = try { com.bitchat.android.ui.debug.DebugPreferenceManager.getBleEnabled(true) } catch (_: Exception) { true }
         when {
-            currentBluetoothStatus != BluetoothStatus.ENABLED -> {
+            bleRequired2 && currentBluetoothStatus != BluetoothStatus.ENABLED -> {
                 // Bluetooth still disabled, but now we have permissions to enable it
-                Log.d("MainActivity", "Permissions granted, but Bluetooth still disabled. Showing Bluetooth enable screen.")
                 mainViewModel.updateBluetoothStatus(currentBluetoothStatus)
                 mainViewModel.updateOnboardingState(OnboardingState.BLUETOOTH_CHECK)
                 mainViewModel.updateBluetoothLoading(false)
             }
             currentLocationStatus != LocationStatus.ENABLED -> {
                 // Location services still disabled, but now we have permissions to enable it
-                Log.d("MainActivity", "Permissions granted, but Location services still disabled. Showing Location enable screen.")
                 mainViewModel.updateLocationStatus(currentLocationStatus)
                 mainViewModel.updateOnboardingState(OnboardingState.LOCATION_CHECK)
                 mainViewModel.updateLocationLoading(false)
             }
             currentBatteryOptimizationStatus == BatteryOptimizationStatus.ENABLED -> {
                 // Battery optimization still enabled, show battery optimization screen
-                android.util.Log.d("MainActivity", "Permissions granted, but battery optimization still enabled. Showing battery optimization screen.")
                 mainViewModel.updateBatteryOptimizationStatus(currentBatteryOptimizationStatus)
                 mainViewModel.updateOnboardingState(OnboardingState.BATTERY_OPTIMIZATION_CHECK)
                 mainViewModel.updateBatteryOptimizationLoading(false)
             }
             else -> {
                 // Both are enabled, proceed to app initialization
-                Log.d("MainActivity", "Both Bluetooth and Location services are enabled, proceeding to initialization")
                 mainViewModel.updateOnboardingState(OnboardingState.INITIALIZING)
                 initializeApp()
             }
@@ -576,24 +602,36 @@ class MainActivity : OrientationAwareActivity() {
         mainViewModel.updateErrorMessage(message)
         mainViewModel.updateOnboardingState(OnboardingState.ERROR)
     }
+
+    private fun startMeshForegroundServiceBestEffort() {
+        if (!lifecycle.currentState.isAtLeast(Lifecycle.State.STARTED)) {
+            pendingMeshForegroundServiceStart = true
+            Log.i("MainActivity", "Deferring foreground mesh service start until activity is started")
+            return
+        }
+
+        try {
+            com.bitchat.android.service.MeshForegroundService.start(applicationContext)
+            pendingMeshForegroundServiceStart = false
+        } catch (e: Exception) {
+            pendingMeshForegroundServiceStart = true
+            Log.w("MainActivity", "Unable to start foreground mesh service; will retry when activity is started", e)
+        }
+    }
     
     /**
      * Check Battery Optimization status and proceed with onboarding flow
      */
     private fun checkBatteryOptimizationAndProceed() {
-        android.util.Log.d("MainActivity", "Checking battery optimization status")
-        
         // For first-time users, skip battery optimization check and go straight to permissions
         // We'll check battery optimization after permissions are granted
         if (permissionManager.isFirstTimeLaunch()) {
-            android.util.Log.d("MainActivity", "First-time launch, skipping battery optimization check - will check after permissions")
             proceedWithPermissionCheck()
             return
         }
-        
+
         // Check if user has previously skipped battery optimization
         if (BatteryOptimizationPreferenceManager.isSkipped(this)) {
-            android.util.Log.d("MainActivity", "User previously skipped battery optimization, proceeding to permissions")
             proceedWithPermissionCheck()
             return
         }
@@ -614,7 +652,6 @@ class MainActivity : OrientationAwareActivity() {
             }
             BatteryOptimizationStatus.ENABLED -> {
                 // Show battery optimization disable screen
-                android.util.Log.d("MainActivity", "Battery optimization enabled, showing disable screen")
                 mainViewModel.updateOnboardingState(OnboardingState.BATTERY_OPTIMIZATION_CHECK)
                 mainViewModel.updateBatteryOptimizationLoading(false)
             }
@@ -625,7 +662,6 @@ class MainActivity : OrientationAwareActivity() {
      * Handle Battery Optimization disabled callback
      */
     private fun handleBatteryOptimizationDisabled() {
-        android.util.Log.d("MainActivity", "Battery optimization disabled by user")
         mainViewModel.updateBatteryOptimizationLoading(false)
         mainViewModel.updateBatteryOptimizationStatus(BatteryOptimizationStatus.DISABLED)
         proceedWithPermissionCheck()
@@ -649,19 +685,14 @@ class MainActivity : OrientationAwareActivity() {
     }
     
     private fun initializeApp() {
-        Log.d("MainActivity", "Starting app initialization")
-        
         lifecycleScope.launch {
             try {
                 // Initialize the app with a proper delay to ensure Bluetooth stack is ready
                 // This solves the issue where app needs restart to work on first install
                 delay(1000) // Give the system time to process permission grants
-                
-                Log.d("MainActivity", "Permissions verified, initializing chat system")
-                
+
                 // Initialize PoW preferences early in the initialization process
                 PoWPreferenceManager.init(this@MainActivity)
-                Log.d("MainActivity", "PoW preferences initialized")
                 
                 // Initialize Location Notes Manager (extracted to separate file)
                 com.bitchat.android.nostr.LocationNotesInitializer.initialize(this@MainActivity)
@@ -674,19 +705,18 @@ class MainActivity : OrientationAwareActivity() {
                     return@launch
                 }
 
-                // Set up mesh service delegate and start services
-                meshService.delegate = chatViewModel
-                meshService.startServices()
-                
-                Log.d("MainActivity", "Mesh service started successfully")
-                
+                // Set up unified mesh delegate and start enabled transports
+                unifiedMeshService.delegate = chatViewModel
+                unifiedMeshService.startServices()
+                startMeshForegroundServiceBestEffort()
+
                 // Handle any notification intent
                 handleNotificationIntent(intent)
                 handleVerificationIntent(intent)
-                
+
                 // Small delay to ensure mesh service is fully initialized
                 delay(500)
-                Log.d("MainActivity", "App initialization complete")
+                Log.i("MainActivity", "App initialization complete")
                 mainViewModel.updateOnboardingState(OnboardingState.COMPLETE)
             } catch (e: Exception) {
                 Log.e("MainActivity", "Failed to initialize app", e)
@@ -698,6 +728,13 @@ class MainActivity : OrientationAwareActivity() {
     override fun onNewIntent(intent: Intent) {
         super.onNewIntent(intent)
         setIntent(intent)
+
+        if (com.bitchat.android.service.AppShutdownCoordinator
+                .isShutdownCommitted()
+        ) {
+            finishAndRemoveTask()
+            return
+        }
         
         // Check if this is a quit request from the notification
         if (intent.getBooleanExtra("ACTION_QUIT_APP", false)) {
@@ -706,25 +743,34 @@ class MainActivity : OrientationAwareActivity() {
             return
         }
 
-        com.bitchat.android.service.AppShutdownCoordinator.cancelPendingShutdown()
-        
         // Handle notification intents when app is already running
         if (mainViewModel.onboardingState.value == OnboardingState.COMPLETE) {
             handleNotificationIntent(intent)
             handleVerificationIntent(intent)
         }
     }
+
+    override fun onStart() {
+        super.onStart()
+        if (pendingMeshForegroundServiceStart) {
+            startMeshForegroundServiceBestEffort()
+        }
+    }
     
     override fun onResume() {
         super.onResume()
+        // Revoke stale live-location work before any resumed UI can use cached channels.
+        LocationChannelManager.getInstance(applicationContext).syncPermissionState()
+
         // Check Bluetooth and Location status on resume and handle accordingly
         if (mainViewModel.onboardingState.value == OnboardingState.COMPLETE) {
             // Reattach mesh delegate to new ChatViewModel instance after Activity recreation
-            try { meshService.delegate = chatViewModel } catch (_: Exception) { }
+            try { unifiedMeshService.delegate = chatViewModel } catch (_: Exception) { }
 
             // Check if Bluetooth was disabled while app was backgrounded
             val currentBluetoothStatus = bluetoothStatusManager.checkBluetoothStatus()
-            if (currentBluetoothStatus != BluetoothStatus.ENABLED) {
+            val bleRequired = try { com.bitchat.android.ui.debug.DebugPreferenceManager.getBleEnabled(true) } catch (_: Exception) { true }
+            if (bleRequired && currentBluetoothStatus != BluetoothStatus.ENABLED && !mainViewModel.isBluetoothCheckSkipped.value) {
                 Log.w("MainActivity", "Bluetooth disabled while app was backgrounded")
                 mainViewModel.updateBluetoothStatus(currentBluetoothStatus)
                 mainViewModel.updateOnboardingState(OnboardingState.BLUETOOTH_CHECK)
@@ -739,6 +785,9 @@ class MainActivity : OrientationAwareActivity() {
                 mainViewModel.updateLocationStatus(currentLocationStatus)
                 mainViewModel.updateOnboardingState(OnboardingState.LOCATION_CHECK)
                 mainViewModel.updateLocationLoading(false)
+            } else {
+                // If location is enabled, ensure Wi-Fi Aware starts if it was blocked by location earlier
+                com.bitchat.android.wifiaware.WifiAwareController.startIfPossible()
             }
         }
     }
@@ -748,7 +797,7 @@ class MainActivity : OrientationAwareActivity() {
         // Only set background state if app is fully initialized
         if (mainViewModel.onboardingState.value == OnboardingState.COMPLETE) {
             // Detach UI delegate so the foreground service can own DM notifications while UI is closed
-            try { meshService.delegate = null } catch (_: Exception) { }
+            try { unifiedMeshService.delegate = null } catch (_: Exception) { }
         }
     }
     
@@ -787,7 +836,7 @@ class MainActivity : OrientationAwareActivity() {
                 val geohash = intent.getStringExtra(com.bitchat.android.ui.NotificationManager.EXTRA_GEOHASH)
                 
                 if (geohash != null) {
-                    Log.d("MainActivity", "Opening geohash chat #$geohash from notification")
+                    Log.d("MainActivity", "Opening geohash chat from notification")
                     
                     // Switch to the geohash channel - create appropriate geohash channel level
                     val level = when (geohash.length) {
@@ -832,7 +881,6 @@ class MainActivity : OrientationAwareActivity() {
         // Cleanup location status manager
         try {
             locationStatusManager.cleanup()
-            Log.d("MainActivity", "Location status manager cleaned up successfully")
         } catch (e: Exception) {
             Log.w("MainActivity", "Error cleaning up location status manager: ${e.message}")
         }

app/src/main/java/com/bitchat/android/MainViewModel.kt

@@ -35,6 +35,9 @@ class MainViewModel : ViewModel() {
     private val _isBatteryOptimizationLoading = MutableStateFlow(false)
     val isBatteryOptimizationLoading: StateFlow<Boolean> = _isBatteryOptimizationLoading.asStateFlow()
 
+    private val _isBluetoothCheckSkipped = MutableStateFlow(false)
+    val isBluetoothCheckSkipped: StateFlow<Boolean> = _isBluetoothCheckSkipped.asStateFlow()
+
     // Public update functions for MainActivity
     fun updateOnboardingState(state: OnboardingState) {
         _onboardingState.value = state
@@ -67,4 +70,8 @@ class MainViewModel : ViewModel() {
     fun updateBatteryOptimizationLoading(loading: Boolean) {
         _isBatteryOptimizationLoading.value = loading
     }
+
+    fun skipBluetoothCheck() {
+        _isBluetoothCheckSkipped.value = true
+    }
 }

app/src/main/java/com/bitchat/android/core/ui/component/button/BitChatBrandButton.kt

@@ -0,0 +1,92 @@
+package com.bitchat.android.core.ui.component.button
+
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.interaction.MutableInteractionSource
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.material3.Icon
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableIntStateOf
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.rememberUpdatedState
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.draw.scale
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.unit.Dp
+import androidx.compose.ui.unit.dp
+import com.bitchat.android.core.ui.icon.BitChatIcon
+import com.bitchat.android.ui.rememberPressScale
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+import kotlin.time.Duration.Companion.milliseconds
+
+private val MultiClickThreshold = 300.milliseconds
+
+@Composable
+fun BitChatBrandButton(
+    onClick: () -> Unit,
+    onTripleClick: () -> Unit,
+    contentDescription: String,
+    modifier: Modifier = Modifier,
+    tint: Color = MaterialTheme.colorScheme.primary,
+    iconSize: Dp = 22.dp,
+) {
+    var tapCount by remember { mutableIntStateOf(0) }
+    var resetJob by remember { mutableStateOf<Job?>(null) }
+    val coroutineScope = rememberCoroutineScope()
+    val currentOnClick by rememberUpdatedState(onClick)
+    val currentOnTripleClick by rememberUpdatedState(onTripleClick)
+
+    val interactionSource = remember { MutableInteractionSource() }
+    val pressScale = rememberPressScale(interactionSource)
+
+    // A plain Box rather than an IconButton: IconButton insists on drawing a ripple, which was the
+    // only press background left in the header once every other control moved to scale-only
+    // feedback.
+    Box(
+        modifier = modifier
+            .clip(CircleShape)
+            .clickable(
+                interactionSource = interactionSource,
+                indication = null,
+                onClickLabel = contentDescription
+            ) {
+                tapCount += 1
+                resetJob?.cancel()
+
+                if (tapCount == 3) {
+                    tapCount = 0
+                    resetJob = null
+                    currentOnTripleClick()
+                } else {
+                    resetJob = coroutineScope.launch {
+                        delay(MultiClickThreshold)
+                        if (tapCount == 1) {
+                            currentOnClick()
+                        }
+                        tapCount = 0
+                        resetJob = null
+                    }
+                }
+            },
+        contentAlignment = Alignment.Center
+    ) {
+        Icon(
+            imageVector = BitChatIcon,
+            contentDescription = contentDescription,
+            tint = tint,
+            modifier = Modifier
+                .size(iconSize)
+                .scale(pressScale),
+        )
+    }
+}

app/src/main/java/com/bitchat/android/core/ui/component/button/CloseButton.kt

@@ -1,34 +1,38 @@
 package com.bitchat.android.core.ui.component.button
 
-import androidx.compose.foundation.layout.size
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.filled.Close
+import androidx.compose.foundation.layout.size
 import androidx.compose.material3.Icon
 import androidx.compose.material3.IconButton
 import androidx.compose.material3.IconButtonDefaults
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.unit.dp
+import com.bitchat.android.R
 
 @Composable
 fun CloseButton(
     onClick: () -> Unit,
-    modifier: Modifier = Modifier.Companion
+    modifier: Modifier = Modifier
 ) {
+    val colorScheme = MaterialTheme.colorScheme
     IconButton(
         onClick = onClick,
-        modifier = modifier
-            .size(32.dp),
+        // 44.dp to match every other tap target in the app's chrome.
+        modifier = modifier.size(44.dp),
         colors = IconButtonDefaults.iconButtonColors(
-            contentColor = MaterialTheme.colorScheme.onBackground.copy(alpha = 0.6f),
-            containerColor = MaterialTheme.colorScheme.onBackground.copy(alpha = 0.1f)
+            contentColor = colorScheme.primary,
+            containerColor = Color.Transparent
         )
     ) {
         Icon(
             imageVector = Icons.Default.Close,
-            contentDescription = "Close",
-            modifier = Modifier.Companion.size(18.dp)
+            contentDescription = stringResource(R.string.close_plain),
+            modifier = Modifier.size(18.dp)
         )
     }
-}
+}

app/src/main/java/com/bitchat/android/core/ui/component/sheet/BitchatBottomSheet.kt

@@ -9,8 +9,26 @@ import androidx.compose.material3.ModalBottomSheet
 import androidx.compose.material3.SheetState
 import androidx.compose.material3.rememberModalBottomSheetState
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.CompositionLocalProvider
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.staticCompositionLocalOf
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.dp
+import kotlinx.coroutines.launch
+
+/**
+ * Dismisses the enclosing [BitchatBottomSheet], playing the slide-down first.
+ *
+ * `ModalBottomSheet` only animates itself out when *it* initiates the dismissal — a swipe or a tap
+ * on the scrim. Anything that closes a sheet programmatically (a close button, picking an item from
+ * a list) previously flipped the caller's `isPresented` flag straight to false, which yanks the
+ * composable out of the tree and makes the sheet vanish instantly.
+ *
+ * Anything inside a sheet that wants to close it should prefer this over calling its own
+ * `onDismiss` directly.
+ */
+val LocalSheetDismiss = staticCompositionLocalOf<(() -> Unit)?> { null }
 
 @OptIn(ExperimentalMaterial3Api::class)
 @Composable
@@ -20,6 +38,20 @@ fun BitchatBottomSheet(
     onDismissRequest: () -> Unit,
     content: @Composable (ColumnScope.() -> Unit),
 ) {
+    val scope = rememberCoroutineScope()
+
+    // Runs the hide animation to completion, then tells the caller to drop the sheet. `hide()`
+    // throws if the sheet is already on its way out (two rapid taps on a close button), which is
+    // benign — the dismissal still has to go through.
+    val animatedDismiss: () -> Unit = remember(sheetState, onDismissRequest) {
+        {
+            scope.launch {
+                runCatching { sheetState.hide() }
+                onDismissRequest()
+            }
+        }
+    }
+
     ModalBottomSheet(
         modifier = modifier.statusBarsPadding(),
         onDismissRequest = onDismissRequest,
@@ -27,6 +59,9 @@ fun BitchatBottomSheet(
         dragHandle = null,
         shape = RoundedCornerShape(topStart = 28.dp, topEnd = 28.dp),
         containerColor = MaterialTheme.colorScheme.background,
-        content = content,
-    )
-}
+    ) {
+        CompositionLocalProvider(LocalSheetDismiss provides animatedDismiss) {
+            content()
+        }
+    }
+}

app/src/main/java/com/bitchat/android/core/ui/component/sheet/BitchatSheetTopBar.kt

@@ -10,9 +10,10 @@ import androidx.compose.material3.TopAppBar
 import androidx.compose.material3.TopAppBarDefaults
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Modifier
-import androidx.compose.ui.text.font.FontFamily
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.unit.dp
+import androidx.compose.runtime.CompositionLocalProvider
+import com.bitchat.android.ui.theme.BitchatFontFamily
 import com.bitchat.android.core.ui.component.button.CloseButton
 
 @OptIn(ExperimentalMaterial3Api::class)
@@ -30,8 +31,9 @@ fun BitchatSheetTopBar(
         navigationIcon = { navigationIcon?.invoke() },
         actions = {
             actions()
+            val dismiss = LocalSheetDismiss.current
             CloseButton(
-                onClick = onClose,
+                onClick = { dismiss?.invoke() ?: onClose() },
                 modifier = Modifier.padding(horizontal = 16.dp)
             )
         },
@@ -59,8 +61,9 @@ fun BitchatSheetCenterTopBar(
         navigationIcon = { navigationIcon?.invoke() },
         actions = {
             actions()
+            val dismiss = LocalSheetDismiss.current
             CloseButton(
-                onClick = onClose,
+                onClick = { dismiss?.invoke() ?: onClose() },
                 modifier = Modifier.padding(horizontal = 16.dp)
             )
         },
@@ -80,7 +83,7 @@ fun BitchatSheetTitle(text: String) {
         text = text,
         style = MaterialTheme.typography.titleMedium.copy(
             fontWeight = FontWeight.Bold,
-            fontFamily = FontFamily.Monospace
+            fontFamily = BitchatFontFamily
         )
     )
 }

app/src/main/java/com/bitchat/android/core/ui/component/text/AnnotatedClickableText.kt

@@ -0,0 +1,96 @@
+package com.bitchat.android.core.ui.component.text
+
+import androidx.compose.foundation.ExperimentalFoundationApi
+import androidx.compose.foundation.gestures.detectTapGestures
+import androidx.compose.material3.LocalTextStyle
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberUpdatedState
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.input.pointer.pointerInput
+import androidx.compose.ui.text.AnnotatedString
+import androidx.compose.ui.text.TextLayoutResult
+import androidx.compose.ui.text.TextStyle
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.text.style.TextOverflow
+
+internal data class ClickedAnnotation(
+    val tag: String,
+    val item: String,
+)
+
+internal fun findAnnotationAt(
+    text: AnnotatedString,
+    offset: Int,
+    annotationTags: List<String>,
+): ClickedAnnotation? {
+    for (tag in annotationTags) {
+        text.getStringAnnotations(tag = tag, start = offset, end = offset)
+            .firstOrNull()
+            ?.let { annotation ->
+                return ClickedAnnotation(tag = tag, item = annotation.item)
+            }
+    }
+    return null
+}
+
+@OptIn(ExperimentalFoundationApi::class)
+@Composable
+fun AnnotatedClickableText(
+    text: AnnotatedString,
+    annotationTags: List<String>,
+    onAnnotationClick: (tag: String, item: String) -> Boolean,
+    modifier: Modifier = Modifier,
+    onLongPress: (() -> Unit)? = null,
+    color: Color = Color.Unspecified,
+    fontFamily: FontFamily? = null,
+    softWrap: Boolean = true,
+    overflow: TextOverflow = TextOverflow.Clip,
+    style: TextStyle = LocalTextStyle.current,
+) {
+    var layoutResult by remember { mutableStateOf<TextLayoutResult?>(null) }
+    val currentOnAnnotationClick by rememberUpdatedState(onAnnotationClick)
+    val currentOnLongPress by rememberUpdatedState(onLongPress)
+
+    Text(
+        text = text,
+        modifier = modifier.pointerInput(text, annotationTags, onLongPress != null) {
+            detectTapGestures(
+                onTap = { position ->
+                    val offset = layoutResult
+                        ?.getOffsetForPosition(position)
+                        ?: return@detectTapGestures
+
+                    var remainingTags = annotationTags
+                    while (remainingTags.isNotEmpty()) {
+                        val annotation = findAnnotationAt(
+                            text = text,
+                            offset = offset,
+                            annotationTags = remainingTags,
+                        ) ?: break
+                        if (currentOnAnnotationClick(annotation.tag, annotation.item)) {
+                            return@detectTapGestures
+                        }
+                        remainingTags = remainingTags.drop(
+                            remainingTags.indexOf(annotation.tag) + 1
+                        )
+                    }
+                },
+                onLongPress = currentOnLongPress?.let { callback ->
+                    { callback() }
+                },
+            )
+        },
+        color = color,
+        fontFamily = fontFamily,
+        softWrap = softWrap,
+        overflow = overflow,
+        style = style,
+        onTextLayout = { layoutResult = it },
+    )
+}

app/src/main/java/com/bitchat/android/core/ui/icon/BitChatIcon.kt

@@ -0,0 +1,48 @@
+package com.bitchat.android.core.ui.icon
+
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.SolidColor
+import androidx.compose.ui.graphics.vector.ImageVector
+import androidx.compose.ui.graphics.vector.path
+import androidx.compose.ui.unit.dp
+
+val BitChatIcon: ImageVector
+    get() {
+        _BitChatIcon?.let { return it }
+
+        return ImageVector.Builder(
+            name = "BitChatIcon",
+            defaultWidth = 24.dp,
+            defaultHeight = 24.dp,
+            viewportWidth = 8f,
+            viewportHeight = 8f,
+        ).apply {
+            path(fill = SolidColor(Color.Black)) {
+                moveTo(2f, 0f)
+                lineTo(6f, 0f)
+                lineTo(6f, 1f)
+                lineTo(7f, 1f)
+                lineTo(7f, 2f)
+                lineTo(8f, 2f)
+                lineTo(8f, 5f)
+                lineTo(7f, 5f)
+                lineTo(7f, 6f)
+                lineTo(6f, 6f)
+                lineTo(6f, 8f)
+                lineTo(5f, 8f)
+                lineTo(5f, 7f)
+                lineTo(3f, 7f)
+                lineTo(3f, 6f)
+                lineTo(1f, 6f)
+                lineTo(1f, 5f)
+                lineTo(0f, 5f)
+                lineTo(0f, 2f)
+                lineTo(1f, 2f)
+                lineTo(1f, 1f)
+                lineTo(2f, 1f)
+                close()
+            }
+        }.build().also { _BitChatIcon = it }
+    }
+
+private var _BitChatIcon: ImageVector? = null

app/src/main/java/com/bitchat/android/core/ui/utils/ModifierExt.kt

@@ -1,57 +0,0 @@
-package com.bitchat.android.core.ui.utils
-
-import androidx.compose.foundation.clickable
-import androidx.compose.runtime.*
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.composed
-import kotlinx.coroutines.delay
-import kotlinx.coroutines.launch
-
-fun Modifier.singleOrTripleClickable(
-    onSingleClick: () -> Unit,
-    onTripleClick: () -> Unit,
-    clickTimeThreshold: Long = 300L
-): Modifier = composed {
-    var tapCount by remember { mutableIntStateOf(0) }
-    var lastTapTime by remember { mutableLongStateOf(0L) }
-    var singleClickJob by remember { mutableStateOf<kotlinx.coroutines.Job?>(null) }
-    val coroutineScope = rememberCoroutineScope()
-
-    this.clickable {
-        val currentTime = System.currentTimeMillis()
-
-        if (currentTime - lastTapTime < clickTimeThreshold) {
-            tapCount++
-        } else {
-            tapCount = 1
-        }
-
-        lastTapTime = currentTime
-
-        // Cancel any pending single click action
-        singleClickJob?.cancel()
-        singleClickJob = null
-
-        when (tapCount) {
-            1 -> {
-                // Wait to see if more taps come
-                singleClickJob = coroutineScope.launch {
-                    delay(clickTimeThreshold)
-                    if (tapCount == 1) {
-                        onSingleClick()
-                    }
-                }
-            }
-            3 -> {
-                // Triple click detected - execute immediately
-                onTripleClick()
-                tapCount = 0
-            }
-        }
-
-        // Reset after threshold if no triple click
-        if (tapCount > 3) {
-            tapCount = 0
-        }
-    }
-}

app/src/main/java/com/bitchat/android/crypto/EncryptionService.kt

@@ -7,6 +7,9 @@ import android.util.Log
 import androidx.security.crypto.EncryptedSharedPreferences
 import androidx.security.crypto.MasterKey
 import com.bitchat.android.noise.NoiseEncryptionService
+import com.bitchat.android.noise.NoiseHandshakeProcessingResult
+import com.bitchat.android.noise.AuthenticatedNoiseSession
+import com.bitchat.android.noise.NoiseDecryptionResult
 import org.bouncycastle.crypto.AsymmetricCipherKeyPair
 import org.bouncycastle.crypto.generators.Ed25519KeyPairGenerator
 import org.bouncycastle.crypto.params.Ed25519KeyGenerationParameters
@@ -190,6 +193,13 @@ open class EncryptionService(private val context: Context) {
         }
         return encrypted
     }
+
+    @Throws(Exception::class)
+    fun encryptForSession(
+        data: ByteArray,
+        peerID: String,
+        expectedSession: AuthenticatedNoiseSession
+    ): ByteArray = noiseService.encryptForSession(data, peerID, expectedSession)
     
     /**
      * Decrypt data from a specific peer using Noise transport encryption
@@ -202,6 +212,12 @@ open class EncryptionService(private val context: Context) {
         }
         return decrypted
     }
+
+    @Throws(Exception::class)
+    fun decryptWithSession(data: ByteArray, peerID: String): NoiseDecryptionResult {
+        return noiseService.decryptWithSession(data, peerID)
+            ?: throw Exception("Failed generation-bound decryption from $peerID")
+    }
     
     /**
      * Sign data using our static identity key
@@ -254,6 +270,25 @@ open class EncryptionService(private val context: Context) {
     fun getPeerFingerprint(peerID: String): String? {
         return noiseService.getPeerFingerprint(peerID)
     }
+
+    /**
+     * Return the remote static key authenticated by the live Noise handshake.
+     * This deliberately bypasses announcement and PeerFingerprintManager
+     * caches; callers making downgrade decisions must bind to live channel
+     * authentication, not a self-certified identity payload.
+     */
+    fun getAuthenticatedRemoteStaticKey(peerID: String): ByteArray? {
+        return getAuthenticatedSession(peerID)?.remoteStaticKey?.copyOf()
+    }
+
+    fun getAuthenticatedSession(peerID: String): AuthenticatedNoiseSession? =
+        noiseService.getAuthenticatedSession(peerID)
+
+    fun withAuthenticatedSession(
+        peerID: String,
+        expectedSession: AuthenticatedNoiseSession,
+        action: () -> Boolean
+    ): Boolean = noiseService.withAuthenticatedSession(peerID, expectedSession, action)
     
     /**
      * Get current peer ID for a fingerprint (for peer ID rotation)
@@ -265,9 +300,9 @@ open class EncryptionService(private val context: Context) {
     /**
      * Initiate a Noise handshake with a peer
      */
-    fun initiateHandshake(peerID: String): ByteArray? {
+    fun initiateHandshake(peerID: String, replaceEstablished: Boolean = false): ByteArray? {
         Log.d(TAG, "🤝 Initiating Noise handshake with $peerID")
-        return noiseService.initiateHandshake(peerID)
+        return noiseService.initiateHandshake(peerID, replaceEstablished)
     }
     
     /**
@@ -277,11 +312,24 @@ open class EncryptionService(private val context: Context) {
         Log.d(TAG, "🤝 Processing handshake message from $peerID")
         return noiseService.processHandshakeMessage(data, peerID)
     }
+
+    /**
+     * Process one Noise handshake frame while preserving whether this exact call authenticated a
+     * new session. Unlike the response-only compatibility API, binding failures are propagated.
+     */
+    @Throws(Exception::class)
+    open fun processHandshakeMessageWithResult(
+        data: ByteArray,
+        peerID: String
+    ): NoiseHandshakeProcessingResult {
+        Log.d(TAG, "🤝 Processing typed handshake message from $peerID")
+        return noiseService.processHandshakeMessageWithResult(data, peerID)
+    }
     
     /**
      * Remove a peer session (called when peer disconnects)
      */
-    fun removePeer(peerID: String) {
+    open fun removePeer(peerID: String) {
         establishedSessions.remove(peerID)
         noiseService.removePeer(peerID)
         onSessionLost?.invoke(peerID)

app/src/main/java/com/bitchat/android/favorites/FavoriteControlMessage.kt

@@ -0,0 +1,33 @@
+package com.bitchat.android.favorites
+
+import com.bitchat.android.services.ContactIdentityResolver
+
+data class FavoriteControlMessage(
+    val isFavorite: Boolean,
+    val npub: String?
+) {
+    companion object {
+        private const val FAVORITED = "[FAVORITED]"
+        private const val UNFAVORITED = "[UNFAVORITED]"
+
+        fun parse(content: String): FavoriteControlMessage? {
+            val trimmed = content.trim()
+            val isFavorite = when {
+                trimmed.startsWith(FAVORITED) -> true
+                trimmed.startsWith(UNFAVORITED) -> false
+                else -> return null
+            }
+            val encodedKey = trimmed.substringAfter(":", "").trim()
+            val npub = encodedKey
+                .takeIf { it.isNotEmpty() }
+                ?.let { ContactIdentityResolver.nostrPubkeyHex(it) }
+                ?.let { ContactIdentityResolver.npubFromHex(it) }
+            return FavoriteControlMessage(isFavorite = isFavorite, npub = npub)
+        }
+
+        fun encode(isFavorite: Boolean, npub: String?): String {
+            val prefix = if (isFavorite) FAVORITED else UNFAVORITED
+            return "$prefix:${npub.orEmpty()}"
+        }
+    }
+}

app/src/main/java/com/bitchat/android/features/file/FileUtils.kt

@@ -8,6 +8,8 @@ import androidx.core.content.FileProvider
 import java.io.File
 import java.io.FileOutputStream
 import java.io.InputStream
+import java.nio.file.Files
+import java.nio.file.StandardCopyOption
 import java.text.SimpleDateFormat
 import java.util.*
 
@@ -193,7 +195,8 @@ object FileUtils {
      */
     fun saveIncomingFile(
         context: Context,
-        file: com.bitchat.android.model.BitchatFilePacket
+        file: com.bitchat.android.model.BitchatFilePacket,
+        stableId: String? = null
     ): String {
         val lowerMime = file.mimeType.lowercase()
         val isImage = lowerMime.startsWith("image/")
@@ -217,6 +220,17 @@ object FileUtils {
             ?: (if (isImage) "img" else "file"))
             .replace(Regex("[^A-Za-z0-9._-]"), "_")
         val ext = extFromMime(lowerMime)
+        if (stableId != null) {
+            require(stableId.matches(Regex("^[0-9a-fA-F]{64}$"))) {
+                "Stable incoming file ID must be a 32-byte hex event ID"
+            }
+            val transmittedName = (file.fileName.takeIf { it.isNotBlank() }
+                ?: if (isImage) "image$ext" else "file$ext")
+                .replace(Regex("[^A-Za-z0-9._-]"), "_")
+                .take(80)
+            val stableName = "ndr_${stableId.lowercase()}_$transmittedName"
+            return saveIncomingFileAtomically(dir, stableName, file.content)
+        }
         var safeName = if (baseName.contains('.')) baseName else baseName + ext
         var idx = 1
         while (java.io.File(dir, safeName).exists() && idx < 1000) {
@@ -262,6 +276,37 @@ object FileUtils {
         }
     }
 
+    private fun saveIncomingFileAtomically(
+        directory: File,
+        fileName: String,
+        content: ByteArray
+    ): String {
+        val target = File(directory, fileName)
+        if (target.isFile &&
+            target.length() == content.size.toLong() &&
+            runCatching { target.readBytes().contentEquals(content) }.getOrDefault(false)
+        ) {
+            return target.absolutePath
+        }
+
+        val temporary = File(directory, ".$fileName.${UUID.randomUUID()}.tmp")
+        try {
+            FileOutputStream(temporary).use { output ->
+                output.write(content)
+                output.fd.sync()
+            }
+            Files.move(
+                temporary.toPath(),
+                target.toPath(),
+                StandardCopyOption.ATOMIC_MOVE,
+                StandardCopyOption.REPLACE_EXISTING
+            )
+            return target.absolutePath
+        } finally {
+            temporary.delete()
+        }
+    }
+
     /**
      * Classify BitchatMessageType from MIME string used in file messages.
      */

app/src/main/java/com/bitchat/android/geohash/AndroidGeocoderProvider.kt

@@ -14,27 +14,53 @@ class AndroidGeocoderProvider(context: Context) : GeocoderProvider {
     private val geocoder = Geocoder(context, Locale.getDefault())
     private val TAG = "AndroidGeocoderProvider"
 
-    override suspend fun getFromLocation(latitude: Double, longitude: Double, maxResults: Int): List<Address> {
+    override suspend fun getFromLocation(
+        latitude: Double,
+        longitude: Double,
+        maxResults: Int,
+        liveLocationToken: Long?
+    ): List<Address> {
         return if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
             suspendCancellableCoroutine { cont ->
                 try {
-                    geocoder.getFromLocation(
-                        latitude,
-                        longitude,
-                        maxResults,
-                        object : Geocoder.GeocodeListener {
-                            override fun onGeocode(addresses: MutableList<Address>) {
-                                if (cont.isActive) cont.resume(addresses)
-                            }
+                    val startRequest = {
+                        geocoder.getFromLocation(
+                            latitude,
+                            longitude,
+                            maxResults,
+                            object : Geocoder.GeocodeListener {
+                                override fun onGeocode(addresses: MutableList<Address>) {
+                                    if (cont.isActive) {
+                                        val result = if (liveLocationToken == null ||
+                                            LiveLocationPrivacyGate.accepts(liveLocationToken)
+                                        ) {
+                                            addresses
+                                        } else {
+                                            emptyList()
+                                        }
+                                        cont.resume(result)
+                                    }
+                                }
 
-                            override fun onError(errorMessage: String?) {
-                                if (cont.isActive) {
-                                    Log.e(TAG, "Geocode error: $errorMessage")
-                                    cont.resume(emptyList())
+                                override fun onError(errorMessage: String?) {
+                                    if (cont.isActive) {
+                                        Log.e(TAG, "Geocode error")
+                                        cont.resume(emptyList())
+                                    }
                                 }
                             }
-                        }
-                    )
+                        )
+                    }
+                    val started = if (liveLocationToken == null) {
+                        startRequest()
+                        true
+                    } else {
+                        LiveLocationPrivacyGate.runIfAllowed(
+                            liveLocationToken,
+                            startRequest
+                        )
+                    }
+                    if (!started && cont.isActive) cont.resume(emptyList())
                 } catch (e: Exception) {
                     if (cont.isActive) cont.resumeWithException(e)
                 }
@@ -42,9 +68,27 @@ class AndroidGeocoderProvider(context: Context) : GeocoderProvider {
         } else {
             @Suppress("DEPRECATION")
             try {
-                geocoder.getFromLocation(latitude, longitude, maxResults) ?: emptyList()
+                if (liveLocationToken != null &&
+                    !LiveLocationPrivacyGate.accepts(liveLocationToken)
+                ) return emptyList()
+
+                // This legacy API blocks and cannot be cancelled. Never hold the privacy
+                // gate's read lock across the call: revocation must remain immediate.
+                val addresses = geocoder.getFromLocation(
+                    latitude,
+                    longitude,
+                    maxResults
+                ) ?: emptyList()
+
+                if (liveLocationToken == null ||
+                    LiveLocationPrivacyGate.accepts(liveLocationToken)
+                ) {
+                    addresses
+                } else {
+                    emptyList()
+                }
             } catch (e: Exception) {
-                Log.e(TAG, "Geocode failed", e)
+                Log.e(TAG, "Geocode failed")
                 emptyList()
             }
         }

app/src/main/java/com/bitchat/android/geohash/FusedLocationProvider.kt

@@ -9,8 +9,9 @@ import android.os.Looper
 import android.util.Log
 import androidx.core.app.ActivityCompat
 import com.google.android.gms.location.*
+import com.google.android.gms.tasks.CancellationTokenSource
 
-class FusedLocationProvider(private val context: Context) : LocationProvider {
+internal class FusedLocationProvider(private val context: Context) : LocationProvider {
 
     companion object {
         private const val TAG = "FusedLocationProvider"
@@ -20,10 +21,13 @@ class FusedLocationProvider(private val context: Context) : LocationProvider {
     
     // Map to keep track of callbacks to remove them later
     private val activeCallbacks = mutableMapOf<(Location) -> Unit, LocationCallback>()
+    private val activeCurrentLocationRequests = mutableSetOf<CancellationTokenSource>()
 
     private fun hasLocationPermission(): Boolean {
-        return ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) == PackageManager.PERMISSION_GRANTED ||
+        return LiveLocationPrivacyGate.isEnabled &&
+            (ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) == PackageManager.PERMISSION_GRANTED ||
                 ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_COARSE_LOCATION) == PackageManager.PERMISSION_GRANTED
+            )
     }
 
     @SuppressLint("MissingPermission")
@@ -36,14 +40,14 @@ class FusedLocationProvider(private val context: Context) : LocationProvider {
         try {
             fusedLocationClient.lastLocation
                 .addOnSuccessListener { location ->
-                    callback(location)
+                    callback(location.takeIf { LiveLocationPrivacyGate.isEnabled })
                 }
                 .addOnFailureListener { e ->
-                    Log.e(TAG, "Error getting last known fused location: ${e.message}")
+                    Log.e(TAG, "Error getting last-known fused location")
                     callback(null)
                 }
         } catch (e: Exception) {
-            Log.e(TAG, "Exception getting last known fused location: ${e.message}")
+            Log.e(TAG, "Exception getting last-known fused location")
             callback(null)
         }
     }
@@ -60,17 +64,27 @@ class FusedLocationProvider(private val context: Context) : LocationProvider {
                 .setPriority(Priority.PRIORITY_HIGH_ACCURACY)
                 .setDurationMillis(30000)
                 .build()
+            val cancellation = CancellationTokenSource()
 
-            fusedLocationClient.getCurrentLocation(request, null)
+            synchronized(activeCurrentLocationRequests) {
+                activeCurrentLocationRequests.add(cancellation)
+            }
+
+            fusedLocationClient.getCurrentLocation(request, cancellation.token)
                 .addOnSuccessListener { location ->
-                    callback(location)
+                    callback(location.takeIf { LiveLocationPrivacyGate.isEnabled })
                 }
                 .addOnFailureListener { e ->
-                    Log.e(TAG, "Error getting fresh fused location: ${e.message}")
+                    Log.e(TAG, "Error getting fresh fused location")
                     callback(null)
                 }
+                .addOnCompleteListener {
+                    synchronized(activeCurrentLocationRequests) {
+                        activeCurrentLocationRequests.remove(cancellation)
+                    }
+                }
         } catch (e: Exception) {
-            Log.e(TAG, "Exception getting fresh fused location: ${e.message}")
+            Log.e(TAG, "Exception getting fresh fused location")
             callback(null)
         }
     }
@@ -91,7 +105,9 @@ class FusedLocationProvider(private val context: Context) : LocationProvider {
 
             val locationCallback = object : LocationCallback() {
                 override fun onLocationResult(result: LocationResult) {
-                    result.lastLocation?.let { callback(it) }
+                    if (LiveLocationPrivacyGate.isEnabled) {
+                        result.lastLocation?.let { callback(it) }
+                    }
                 }
             }
 
@@ -107,7 +123,7 @@ class FusedLocationProvider(private val context: Context) : LocationProvider {
             Log.d(TAG, "Registered fused updates")
 
         } catch (e: Exception) {
-            Log.e(TAG, "Error requesting fused updates: ${e.message}")
+            Log.e(TAG, "Error requesting fused updates")
         }
     }
 
@@ -122,21 +138,25 @@ class FusedLocationProvider(private val context: Context) : LocationProvider {
                 Log.d(TAG, "Removed fused updates")
             }
         } catch (e: Exception) {
-            Log.e(TAG, "Error removing fused updates: ${e.message}")
+            Log.e(TAG, "Error removing fused updates")
         }
     }
 
     override fun cancel() {
         try {
             synchronized(activeCallbacks) {
-                for ((callback, locationCallback) in activeCallbacks) {
+                for ((_, locationCallback) in activeCallbacks) {
                     fusedLocationClient.removeLocationUpdates(locationCallback)
                 }
                 activeCallbacks.clear()
             }
+            synchronized(activeCurrentLocationRequests) {
+                activeCurrentLocationRequests.forEach { it.cancel() }
+                activeCurrentLocationRequests.clear()
+            }
             Log.d(TAG, "Cancelled all fused updates")
         } catch (e: Exception) {
-            Log.e(TAG, "Error cancelling fused provider: ${e.message}")
+            Log.e(TAG, "Error cancelling fused provider")
         }
     }
 }

app/src/main/java/com/bitchat/android/geohash/GeocoderProvider.kt

@@ -9,5 +9,10 @@ interface GeocoderProvider {
     /**
      * Get a list of Address objects from latitude and longitude.
      */
-    suspend fun getFromLocation(latitude: Double, longitude: Double, maxResults: Int): List<Address>
+    suspend fun getFromLocation(
+        latitude: Double,
+        longitude: Double,
+        maxResults: Int,
+        liveLocationToken: Long? = null
+    ): List<Address>
 }

app/src/main/java/com/bitchat/android/geohash/GeohashBookmarksStore.kt

@@ -112,7 +112,7 @@ class GeohashBookmarksStore private constructor(private val context: Context) {
                 _bookmarks.value = ordered
             }
         } catch (e: Exception) {
-            Log.e(TAG, "Failed to load bookmarks: ${e.message}")
+            Log.e(TAG, "Failed to load bookmarks")
         }
         try {
             val namesJson = prefs.getString(NAMES_STORE_KEY, null)
@@ -122,7 +122,7 @@ class GeohashBookmarksStore private constructor(private val context: Context) {
                 _bookmarkNames.value = dict
             }
         } catch (e: Exception) {
-            Log.e(TAG, "Failed to load bookmark names: ${e.message}")
+            Log.e(TAG, "Failed to load bookmark names")
         }
     }
 
@@ -155,7 +155,7 @@ class GeohashBookmarksStore private constructor(private val context: Context) {
             resolving.clear()
             Log.i(TAG, "Cleared all geohash bookmarks and names")
         } catch (e: Exception) {
-            Log.e(TAG, "Failed to clear geohash bookmarks: ${e.message}")
+            Log.e(TAG, "Failed to clear geohash bookmarks")
         }
     }
 
@@ -213,7 +213,7 @@ class GeohashBookmarksStore private constructor(private val context: Context) {
                     persistNames(current)
                 }
             } catch (e: Exception) {
-                Log.w(TAG, "Name resolution failed for #$gh: ${e.message}")
+                Log.w(TAG, "Bookmark name resolution failed")
             } finally {
                 resolving.remove(gh)
             }

app/src/main/java/com/bitchat/android/geohash/GeohashNostrPrivacyPolicy.kt

@@ -0,0 +1,24 @@
+package com.bitchat.android.geohash
+
+internal object GeohashNostrPrivacyPolicy {
+    fun livePresenceTargets(
+        availableChannels: Collection<GeohashChannel>,
+        liveLocationEnabled: Boolean,
+    ): Set<String> {
+        if (!liveLocationEnabled) return emptySet()
+        return availableChannels
+            .asSequence()
+            .filter { it.level.precision <= GeohashChannelLevel.CITY.precision }
+            .map { it.geohash }
+            .toSet()
+    }
+
+    fun samplingTargets(
+        liveLocationGeohashes: Collection<String>,
+        userSelectedGeohashes: Collection<String>,
+        liveLocationEnabled: Boolean,
+    ): Set<String> = buildSet {
+        addAll(userSelectedGeohashes)
+        if (liveLocationEnabled) addAll(liveLocationGeohashes)
+    }
+}

app/src/main/java/com/bitchat/android/geohash/LiveLocationPrivacyGate.kt

@@ -0,0 +1,119 @@
+package com.bitchat.android.geohash
+
+import java.util.concurrent.CopyOnWriteArraySet
+import java.util.concurrent.atomic.AtomicLong
+import java.util.concurrent.locks.ReentrantReadWriteLock
+import kotlin.concurrent.read
+import kotlin.concurrent.write
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+
+/**
+ * Process-wide, fail-closed consent gate for accessing live device location.
+ *
+ * A generation token prevents callbacks that were started under an older consent
+ * state from being accepted after location access is disabled or re-enabled.
+ */
+internal class LiveLocationAccessPolicy(
+    initialEnabled: Boolean = DEFAULT_LIVE_LOCATION_ENABLED,
+) {
+    private val accessLock = ReentrantReadWriteLock()
+    private val generation = AtomicLong(0L)
+    private val _enabled = MutableStateFlow(initialEnabled)
+    private var accessAvailable = initialEnabled
+
+    val enabled: StateFlow<Boolean> = _enabled.asStateFlow()
+    val isEnabled: Boolean
+        get() = _enabled.value
+
+    fun update(enabled: Boolean) {
+        accessLock.write {
+            generation.incrementAndGet()
+            _enabled.value = enabled
+            accessAvailable = enabled
+        }
+    }
+
+    fun invalidate() {
+        accessLock.write {
+            generation.incrementAndGet()
+            accessAvailable = false
+        }
+    }
+
+    fun resumeAccess() {
+        accessLock.write {
+            if (_enabled.value && !accessAvailable) {
+                generation.incrementAndGet()
+                accessAvailable = true
+            }
+        }
+    }
+
+    fun captureToken(): Long? =
+        accessLock.read {
+            val capturedGeneration = generation.get()
+            capturedGeneration.takeIf {
+                _enabled.value &&
+                    accessAvailable &&
+                    generation.get() == capturedGeneration
+            }
+        }
+
+    fun accepts(token: Long): Boolean =
+        accessLock.read {
+            _enabled.value && accessAvailable && generation.get() == token
+        }
+
+    fun runIfAllowed(token: Long, action: () -> Unit): Boolean =
+        accessLock.read {
+            if (!_enabled.value || !accessAvailable || generation.get() != token) {
+                false
+            } else {
+                action()
+                true
+            }
+        }
+}
+
+internal const val DEFAULT_LIVE_LOCATION_ENABLED = false
+
+internal object LiveLocationPrivacyGate {
+    private val policy = LiveLocationAccessPolicy()
+    private val revocationListeners = CopyOnWriteArraySet<() -> Unit>()
+
+    val enabled: StateFlow<Boolean> = policy.enabled
+    val isEnabled: Boolean
+        get() = policy.isEnabled
+
+    fun update(enabled: Boolean) {
+        policy.update(enabled)
+        notifyRevoked()
+    }
+
+    fun invalidate() {
+        policy.invalidate()
+        notifyRevoked()
+    }
+
+    fun captureToken(): Long? = policy.captureToken()
+    fun resumeAccess() = policy.resumeAccess()
+    fun accepts(token: Long): Boolean = policy.accepts(token)
+    fun runIfAllowed(token: Long, action: () -> Unit): Boolean =
+        policy.runIfAllowed(token, action)
+
+    fun addRevocationListener(listener: () -> Unit) {
+        revocationListeners.add(listener)
+    }
+
+    fun removeRevocationListener(listener: () -> Unit) {
+        revocationListeners.remove(listener)
+    }
+
+    private fun notifyRevoked() {
+        revocationListeners.forEach { listener ->
+            runCatching(listener)
+        }
+    }
+}

app/src/main/java/com/bitchat/android/geohash/LocationChannelManager.kt

@@ -4,16 +4,14 @@ import android.Manifest
 import android.content.Context
 import android.content.IntentFilter
 import android.content.pm.PackageManager
-import android.location.Geocoder
 import android.location.Location
 import android.location.LocationManager
-import android.os.Bundle
 import android.util.Log
 import androidx.core.app.ActivityCompat
 import com.google.android.gms.common.ConnectionResult
 import com.google.android.gms.common.GoogleApiAvailability
+import com.bitchat.android.nostr.NostrIdentityBridge
 import kotlinx.coroutines.*
-import java.util.*
 import com.google.gson.Gson
 import com.google.gson.JsonSyntaxException
 import kotlinx.coroutines.flow.MutableStateFlow
@@ -47,13 +45,19 @@ class LocationChannelManager private constructor(private val context: Context) {
         AUTHORIZED
     }
 
+    enum class LocationSelectionSource {
+        NEARBY,
+        MANUAL
+    }
+
     private val locationManager: LocationManager = context.getSystemService(Context.LOCATION_SERVICE) as LocationManager
     private val locationProvider: LocationProvider
     private val geocoderProvider: GeocoderProvider = GeocoderFactory.get(context)
-    private var lastLocation: Location? = null
     private var geocodingJob: Job? = null
     private val gson = Gson()
     private var dataManager: com.bitchat.android.ui.DataManager? = null
+    private var selectedLocationSource: LocationSelectionSource? = null
+    private var activeLocationUpdateCallback: ((Location) -> Unit)? = null
 
     private fun checkSystemLocationEnabled(): Boolean {
         return try {
@@ -70,14 +74,13 @@ class LocationChannelManager private constructor(private val context: Context) {
                 val isEnabled = checkSystemLocationEnabled()
                 Log.d(TAG, "System location state changed: $isEnabled")
                 _systemLocationEnabled.value = isEnabled
+                if (!isEnabled) {
+                    clearLiveLocationState()
+                }
             }
         }
     }
 
-    private val locationUpdateCallback: (Location) -> Unit = { location ->
-        onLocationUpdated(location)
-    }
-
     // Published state for UI bindings (matching iOS @Published properties)
     private val scope = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate)
 
@@ -99,8 +102,7 @@ class LocationChannelManager private constructor(private val context: Context) {
     private val _isLoadingLocation = MutableStateFlow(false)
     val isLoadingLocation: StateFlow<Boolean> = _isLoadingLocation
     
-    private val _locationServicesEnabled = MutableStateFlow(false)
-    val locationServicesEnabled: StateFlow<Boolean> = _locationServicesEnabled
+    val locationServicesEnabled: StateFlow<Boolean> = LiveLocationPrivacyGate.enabled
 
     private val _systemLocationEnabled = MutableStateFlow(checkSystemLocationEnabled())
     val systemLocationEnabled: StateFlow<Boolean> = _systemLocationEnabled
@@ -127,12 +129,14 @@ class LocationChannelManager private constructor(private val context: Context) {
             Log.i(TAG, "Using SystemLocationProvider (Native LocationManager)")
             SystemLocationProvider(context)
         }
+        LiveLocationPrivacyGate.addRevocationListener(::cancelLiveLocationWork)
 
-        checkAndSyncPermission()
         // Initialize DataManager and load persisted settings
         dataManager = com.bitchat.android.ui.DataManager(context)
-        loadPersistedChannelSelection()
         loadLocationServicesState()
+        syncPermissionState()
+        if (!_systemLocationEnabled.value) clearLiveLocationState()
+        loadPersistedChannelSelection()
 
         // Register for system location changes
         context.registerReceiver(locationStateReceiver, IntentFilter(LocationManager.PROVIDERS_CHANGED_ACTION))
@@ -145,21 +149,13 @@ class LocationChannelManager private constructor(private val context: Context) {
      * UNIFIED: Only requests location if location services are enabled by user
      */
     fun enableLocationChannels() {
-        Log.d(TAG, "enableLocationChannels() called")
-        
-        if (!_locationServicesEnabled.value || !_systemLocationEnabled.value) {
+        if (!LiveLocationPrivacyGate.isEnabled || !_systemLocationEnabled.value) {
             Log.w(TAG, "Location services disabled (app or system) - not requesting location")
             return
         }
-        
 
-        if (getCurrentPermissionStatus() == PermissionState.AUTHORIZED) {
-            Log.d(TAG, "Permission authorized - requesting location")
-            _permissionState.value = PermissionState.AUTHORIZED
+        if (syncPermissionState() == PermissionState.AUTHORIZED) {
             requestOneShotLocation()
-        } else {
-            Log.d(TAG, "Permission not granted")
-            _permissionState.value = PermissionState.DENIED
         }
     }
 
@@ -167,7 +163,7 @@ class LocationChannelManager private constructor(private val context: Context) {
      * Refresh available channels from current location
      */
     fun refreshChannels() {
-        if (_permissionState.value == PermissionState.AUTHORIZED && isLocationServicesEnabled()) {
+        if (syncPermissionState() == PermissionState.AUTHORIZED && isLocationServicesEnabled()) {
             requestOneShotLocation()
         }
     }
@@ -177,9 +173,7 @@ class LocationChannelManager private constructor(private val context: Context) {
      * Uses requestLocationUpdates for continuous updates, plus a one-shot to prime state immediately
      */
     fun beginLiveRefresh(interval: Long = 5000L) {
-        Log.d(TAG, "Beginning live refresh (continuous updates)")
-
-        if (_permissionState.value != PermissionState.AUTHORIZED) {
+        if (syncPermissionState() != PermissionState.AUTHORIZED) {
             Log.w(TAG, "Cannot start live refresh - permission not authorized")
             return
         }
@@ -189,12 +183,28 @@ class LocationChannelManager private constructor(private val context: Context) {
             return
         }
 
+        endLiveRefresh()
+        LiveLocationPrivacyGate.resumeAccess()
+        val token = LiveLocationPrivacyGate.captureToken() ?: return
+        val callback: (Location) -> Unit = { location ->
+            if (canUseLiveLocation(token)) {
+                onLocationUpdated(location, token)
+            }
+        }
+        activeLocationUpdateCallback = callback
+
         // Register for continuous updates from available provider
-        locationProvider.requestLocationUpdates(
-            intervalMs = interval,
-            minDistanceMeters = 5f,
-            callback = locationUpdateCallback
-        )
+        val started = LiveLocationPrivacyGate.runIfAllowed(token) {
+            locationProvider.requestLocationUpdates(
+                intervalMs = interval,
+                minDistanceMeters = 5f,
+                callback = callback
+            )
+        }
+        if (!started) {
+            activeLocationUpdateCallback = null
+            return
+        }
         
         // Prime state immediately with last known / current location
         requestOneShotLocation()
@@ -204,57 +214,56 @@ class LocationChannelManager private constructor(private val context: Context) {
      * Stop periodic refreshes when selector UI is dismissed
      */
     fun endLiveRefresh() {
-        Log.d(TAG, "Ending live refresh")
-        locationProvider.removeLocationUpdates(locationUpdateCallback)
+        activeLocationUpdateCallback?.let(locationProvider::removeLocationUpdates)
+        activeLocationUpdateCallback = null
     }
 
     /**
-     * Select a channel
+     * Generic selection is intentionally treated as manual. GPS-derived selections must use
+     * [selectNearby] so their provenance can be revoked when live location is disabled.
      */
     fun select(channel: ChannelID) {
-        Log.d(TAG, "Selected channel: ${channel.displayName}")
-        // Use synchronous set to avoid race with background recomputation
-        _selectedChannel.value = channel
-        saveChannelSelection(channel)
-
-        // Immediately recompute teleported status against the latest known location
-        lastLocation?.let { location ->
-            when (channel) {
-                is ChannelID.Mesh -> {
-                    _teleported.value = false
-                }
-                is ChannelID.Location -> {
-                    val currentGeohash = Geohash.encode(
-                        latitude = location.latitude,
-                        longitude = location.longitude,
-                        precision = channel.channel.level.precision
-                    )
-                    val isTeleportedNow = currentGeohash != channel.channel.geohash
-                    _teleported.value = isTeleportedNow
-                    Log.d(TAG, "Teleported (immediate recompute): $isTeleportedNow (current: $currentGeohash, selected: ${channel.channel.geohash})")
-                }
-            }
+        when (channel) {
+            ChannelID.Mesh -> selectInternal(ChannelID.Mesh, source = null, teleported = false)
+            is ChannelID.Location -> selectManual(channel.channel)
         }
     }
-    
-    /**
-     * Set teleported status (for manual geohash teleportation)
-     */
-    fun setTeleported(teleported: Boolean) {
-        Log.d(TAG, "Setting teleported status: $teleported")
-        _teleported.value = teleported
+
+    fun selectNearby(channel: GeohashChannel): Boolean {
+        val isCurrentNearbyChannel = _availableChannels.value.contains(channel)
+        if (!isCurrentNearbyChannel || !isLocationServicesEnabled() ||
+            syncPermissionState() != PermissionState.AUTHORIZED
+        ) {
+            Log.w(TAG, "Blocked nearby channel selection without live-location access")
+            return false
+        }
+        selectInternal(
+            ChannelID.Location(channel),
+            source = LocationSelectionSource.NEARBY,
+            teleported = false
+        )
+        return true
+    }
+
+    fun selectManual(channel: GeohashChannel, teleported: Boolean = true) {
+        selectInternal(
+            ChannelID.Location(channel),
+            source = LocationSelectionSource.MANUAL,
+            teleported = teleported || !LiveLocationPrivacyGate.isEnabled
+        )
     }
 
     /**
      * Enable location services (user-controlled toggle)
      */
     fun enableLocationServices() {
-        Log.d(TAG, "enableLocationServices() called by user")
-        _locationServicesEnabled.value = true
-        saveLocationServicesState(true)
+        if (!LiveLocationPrivacyGate.isEnabled) {
+            LiveLocationPrivacyGate.update(true)
+            saveLocationServicesState(true)
+        }
         
         // If we have permission and system location is on, start location operations
-        if (_permissionState.value == PermissionState.AUTHORIZED && systemLocationEnabled.value) {
+        if (syncPermissionState() == PermissionState.AUTHORIZED && systemLocationEnabled.value) {
             requestOneShotLocation()
         }
     }
@@ -263,21 +272,9 @@ class LocationChannelManager private constructor(private val context: Context) {
      * Disable location services (user-controlled toggle)
      */
     fun disableLocationServices() {
-        Log.d(TAG, "disableLocationServices() called by user")
-        _locationServicesEnabled.value = false
+        LiveLocationPrivacyGate.update(false)
         saveLocationServicesState(false)
-        
-        // Stop any ongoing location operations
-        endLiveRefresh()
-        
-        // Clear available channels when location is disabled
-        _availableChannels.value = emptyList()
-        _locationNames.value = emptyMap()
-        
-        // If user had a location channel selected, switch back to mesh
-        if (_selectedChannel.value is ChannelID.Location) {
-            select(ChannelID.Mesh)
-        }
+        clearLiveLocationState(invalidateAccess = false)
     }
 
     /**
@@ -287,80 +284,166 @@ class LocationChannelManager private constructor(private val context: Context) {
      * Check if both the app toggle and system location are enabled
      */
     fun isLocationServicesEnabled(): Boolean {
-        return _locationServicesEnabled.value && _systemLocationEnabled.value
+        return LiveLocationPrivacyGate.isEnabled && _systemLocationEnabled.value
+    }
+
+    fun canUseSelectedLocationChannel(channel: GeohashChannel): Boolean {
+        if (_selectedChannel.value != ChannelID.Location(channel)) return false
+        return selectedLocationSource == LocationSelectionSource.MANUAL ||
+            LiveLocationPrivacyGate.captureToken() != null
+    }
+
+    fun isSelectedChannelLiveDerived(channel: GeohashChannel): Boolean =
+        _selectedChannel.value == ChannelID.Location(channel) &&
+            selectedLocationSource == LocationSelectionSource.NEARBY
+
+    fun liveLocationTokenForSelectedChannel(channel: GeohashChannel): Long? {
+        if (!isSelectedChannelLiveDerived(channel)) return null
+        return LiveLocationPrivacyGate.captureToken()
+    }
+
+    private fun selectInternal(
+        channel: ChannelID,
+        source: LocationSelectionSource?,
+        teleported: Boolean
+    ) {
+        selectedLocationSource = source
+        _teleported.value = when (channel) {
+            ChannelID.Mesh -> false
+            is ChannelID.Location -> teleported
+        }
+        _selectedChannel.value = channel
+        saveChannelSelection(channel, source)
+    }
+
+    /**
+     * Revokes all GPS-derived in-memory state and pending work. This deliberately does not
+     * change the persisted soft setting when Android's hard permission or system provider is
+     * temporarily unavailable.
+     */
+    private fun clearLiveLocationState(invalidateAccess: Boolean = true) {
+        if (invalidateAccess) LiveLocationPrivacyGate.invalidate()
+        cancelLiveLocationWork()
+        _isLoadingLocation.value = false
+        NostrIdentityBridge.clearGeohashIdentityCache(
+            _availableChannels.value.map { it.geohash }
+        )
+        _availableChannels.value = emptyList()
+        _locationNames.value = emptyMap()
+
+        when {
+            _selectedChannel.value is ChannelID.Location &&
+                selectedLocationSource == LocationSelectionSource.NEARBY -> {
+                selectInternal(ChannelID.Mesh, source = null, teleported = false)
+            }
+            _selectedChannel.value is ChannelID.Location -> {
+                // Manual channels remain usable for teleports, bookmarks, and DMs. Never use
+                // a previously retained GPS fix to classify them while live access is off.
+                selectedLocationSource = LocationSelectionSource.MANUAL
+                _teleported.value = true
+                saveChannelSelection(_selectedChannel.value, selectedLocationSource)
+            }
+        }
+    }
+
+    private fun cancelLiveLocationWork() {
+        locationProvider.cancel()
+        activeLocationUpdateCallback = null
+        geocodingJob?.cancel()
+        geocodingJob = null
     }
 
     // MARK: - Location Operations
 
     private fun requestOneShotLocation() {
-        if (!checkAndSyncPermission()) {
+        if (!isLocationServicesEnabled() ||
+            syncPermissionState() != PermissionState.AUTHORIZED
+        ) {
             Log.w(TAG, "No location permission for one-shot request")
             return
         }
 
-        Log.d(TAG, "Requesting one-shot location")
-        // Set loading state initially
+        LiveLocationPrivacyGate.resumeAccess()
+        val token = LiveLocationPrivacyGate.captureToken() ?: return
         _isLoadingLocation.value = true
-        
-        locationProvider.getLastKnownLocation { cached ->
-            // If we have a cached location and it's reasonably recent (e.g. < 5 mins), use it
-            // For now, we just use it if it exists, similar to previous logic
-            if (cached != null) {
-                Log.d(TAG, "Using last known location: ${cached.latitude}, ${cached.longitude}")
-                onLocationUpdated(cached)
-            } else {
-                Log.d(TAG, "No last known location available, requesting fresh...")
-                locationProvider.requestFreshLocation { fresh ->
-                    if (fresh != null) {
-                        Log.d(TAG, "Fresh location received: ${fresh.latitude}, ${fresh.longitude}")
-                        onLocationUpdated(fresh)
-                    } else {
-                        Log.w(TAG, "Failed to get fresh location")
-                        _isLoadingLocation.value = false
+
+        val started = LiveLocationPrivacyGate.runIfAllowed(token) {
+            locationProvider.getLastKnownLocation { cached ->
+                if (!canUseLiveLocation(token)) return@getLastKnownLocation
+
+                if (cached != null) {
+                    onLocationUpdated(cached, token)
+                } else {
+                    LiveLocationPrivacyGate.runIfAllowed(token) {
+                        locationProvider.requestFreshLocation { fresh ->
+                            if (!canUseLiveLocation(token)) return@requestFreshLocation
+
+                            if (fresh != null) {
+                                onLocationUpdated(fresh, token)
+                            } else {
+                                Log.w(TAG, "Failed to get fresh location")
+                                _isLoadingLocation.value = false
+                            }
+                        }
                     }
                 }
             }
         }
+        if (!started) _isLoadingLocation.value = false
     }
 
-    private fun onLocationUpdated(location: Location) {
-        lastLocation = location
-        _isLoadingLocation.value = false
-        computeChannels(location)
-        reverseGeocodeIfNeeded(location)
+    private fun onLocationUpdated(location: Location, token: Long) {
+        LiveLocationPrivacyGate.runIfAllowed(token) {
+            if (!_systemLocationEnabled.value || !hasRuntimeLocationPermission()) return@runIfAllowed
+            _isLoadingLocation.value = false
+            computeChannels(location, token)
+            reverseGeocodeIfNeeded(location, token)
+        }
     }
 
 
     // MARK: - Helpers
 
-    private fun getCurrentPermissionStatus(): PermissionState {
-        return if (checkAndSyncPermission()) {
+    private fun hasRuntimeLocationPermission(): Boolean {
+        return ActivityCompat.checkSelfPermission(
+            context,
+            Manifest.permission.ACCESS_FINE_LOCATION
+        ) == PackageManager.PERMISSION_GRANTED ||
+            ActivityCompat.checkSelfPermission(
+                context,
+                Manifest.permission.ACCESS_COARSE_LOCATION
+            ) == PackageManager.PERMISSION_GRANTED
+    }
+
+    fun syncPermissionState(): PermissionState {
+        val newState = if (hasRuntimeLocationPermission()) {
             PermissionState.AUTHORIZED
         } else {
             PermissionState.DENIED
         }
-    }
-
-    private fun checkAndSyncPermission(): Boolean {
-        val hasPermission = ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) == PackageManager.PERMISSION_GRANTED ||
-               ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_COARSE_LOCATION) == PackageManager.PERMISSION_GRANTED
-
-        val newState = if (hasPermission) PermissionState.AUTHORIZED else PermissionState.DENIED
 
         if (_permissionState.value != newState) {
-            Log.d(TAG, "Permission state updated to: $newState")
             _permissionState.value = newState
         }
 
-        return hasPermission
+        if (newState == PermissionState.DENIED) {
+            clearLiveLocationState()
+        }
+        return newState
     }
 
-    private fun computeChannels(location: Location) {
-        Log.d(TAG, "Computing channels for location: ${location.latitude}, ${location.longitude}")
-        
+    private fun canUseLiveLocation(token: Long): Boolean {
+        return LiveLocationPrivacyGate.accepts(token) &&
+            _systemLocationEnabled.value &&
+            hasRuntimeLocationPermission()
+    }
+
+    private fun computeChannels(location: Location, token: Long) {
+        if (!canUseLiveLocation(token)) return
+
         val levels = GeohashChannelLevel.allCases()
         val result = mutableListOf<GeohashChannel>()
-        
+
         for (level in levels) {
             val geohash = Geohash.encode(
                 latitude = location.latitude,
@@ -368,54 +451,56 @@ class LocationChannelManager private constructor(private val context: Context) {
                 precision = level.precision
             )
             result.add(GeohashChannel(level = level, geohash = geohash))
-            
-            Log.v(TAG, "Generated ${level.displayName}: $geohash")
         }
-        
+
+        if (!canUseLiveLocation(token)) return
         _availableChannels.value = result
         
-        // Recompute teleported status based on current location vs selected channel
         val selectedChannelValue = _selectedChannel.value
-        when (selectedChannelValue) {
-            is ChannelID.Mesh -> {
-                _teleported.value = false
-            }
-            is ChannelID.Location -> {
-                val currentGeohash = Geohash.encode(
-                    latitude = location.latitude,
-                    longitude = location.longitude,
-                    precision = selectedChannelValue.channel.level.precision
-                )
-                val isTeleported = currentGeohash != selectedChannelValue.channel.geohash
-                _teleported.value = isTeleported
-                Log.d(TAG, "Teleported status: $isTeleported (current: $currentGeohash, selected: ${selectedChannelValue.channel.geohash})")
-            }
+        if (selectedChannelValue is ChannelID.Location &&
+            selectedLocationSource == LocationSelectionSource.NEARBY
+        ) {
+            val currentGeohash = Geohash.encode(
+                latitude = location.latitude,
+                longitude = location.longitude,
+                precision = selectedChannelValue.channel.level.precision
+            )
+            _teleported.value = currentGeohash != selectedChannelValue.channel.geohash
+        } else if (selectedChannelValue is ChannelID.Mesh) {
+            _teleported.value = false
         }
     }
 
-    private fun reverseGeocodeIfNeeded(location: Location) {
-        // Cancel any pending geocoding job to avoid race conditions
+    private fun reverseGeocodeIfNeeded(location: Location, token: Long) {
+        if (!canUseLiveLocation(token)) return
         geocodingJob?.cancel()
 
         geocodingJob = scope.launch(Dispatchers.IO) {
             try {
-                Log.d(TAG, "Starting reverse geocoding")
-                
-                val addresses = geocoderProvider.getFromLocation(location.latitude, location.longitude, 1)
+                if (!canUseLiveLocation(token)) return@launch
+                val addresses = geocoderProvider.getFromLocation(
+                    location.latitude,
+                    location.longitude,
+                    1,
+                    liveLocationToken = token
+                )
 
-                if (!isActive) return@launch
+                if (!isActive || !canUseLiveLocation(token)) return@launch
 
                 if (addresses.isNotEmpty()) {
                     val address = addresses[0]
                     val names = namesByLevel(address)
-                    Log.d(TAG, "Reverse geocoding result: $names")
-                    _locationNames.value = names
+                    LiveLocationPrivacyGate.runIfAllowed(token) {
+                        if (_systemLocationEnabled.value && hasRuntimeLocationPermission()) {
+                            _locationNames.value = names
+                        }
+                    }
                 } else {
                     Log.w(TAG, "No reverse geocoding results")
                 }
             } catch (e: Exception) {
                 if (e !is CancellationException) {
-                    Log.e(TAG, "Reverse geocoding failed: ${e.message}")
+                    Log.e(TAG, "Reverse geocoding failed")
                 }
             }
         }
@@ -469,7 +554,10 @@ class LocationChannelManager private constructor(private val context: Context) {
     /**
      * Save current channel selection to persistent storage
      */
-    private fun saveChannelSelection(channel: ChannelID) {
+    private fun saveChannelSelection(
+        channel: ChannelID,
+        source: LocationSelectionSource?
+    ) {
         try {
             val channelData = when (channel) {
                 is ChannelID.Mesh -> gson.toJson(PersistedChannel(mesh = true))
@@ -477,14 +565,14 @@ class LocationChannelManager private constructor(private val context: Context) {
                     PersistedChannel(
                         mesh = false,
                         level = channel.channel.level.name,
-                        geohash = channel.channel.geohash
+                        geohash = channel.channel.geohash,
+                        source = source?.name
                     )
                 )
             }
             dataManager?.saveLastGeohashChannel(channelData)
-            Log.d(TAG, "Saved channel selection: ${channel.displayName}")
         } catch (e: Exception) {
-            Log.e(TAG, "Failed to save channel selection: ${e.message}")
+            Log.e(TAG, "Failed to save channel selection")
         }
     }
     
@@ -497,30 +585,44 @@ class LocationChannelManager private constructor(private val context: Context) {
             if (!channelData.isNullOrBlank()) {
                 val persisted = gson.fromJson(channelData, PersistedChannel::class.java)
                 val channel = persisted?.toChannel()
-                if (channel != null) {
+                val source = persisted?.selectionSource()
+                val canRestore = channel !is ChannelID.Location ||
+                    source == LocationSelectionSource.MANUAL ||
+                    (LiveLocationPrivacyGate.isEnabled &&
+                        _systemLocationEnabled.value &&
+                        _permissionState.value == PermissionState.AUTHORIZED)
+
+                if (channel != null && canRestore) {
                     _selectedChannel.value = channel
-                    Log.d(TAG, "Restored persisted channel: ${channel.displayName}")
+                    selectedLocationSource = if (channel is ChannelID.Location) source else null
+                    _teleported.value = channel is ChannelID.Location &&
+                        source == LocationSelectionSource.MANUAL
                 } else {
-                    Log.d(TAG, "Could not restore persisted channel, defaulting to Mesh")
                     _selectedChannel.value = ChannelID.Mesh
+                    selectedLocationSource = null
+                    _teleported.value = false
+                    saveChannelSelection(ChannelID.Mesh, source = null)
                 }
             } else {
-                Log.d(TAG, "No persisted channel found, defaulting to Mesh")
                 _selectedChannel.value = ChannelID.Mesh
+                selectedLocationSource = null
             }
         } catch (e: JsonSyntaxException) {
-            Log.e(TAG, "Failed to parse persisted channel data: ${e.message}")
+            Log.e(TAG, "Failed to parse persisted channel data")
             _selectedChannel.value = ChannelID.Mesh
+            selectedLocationSource = null
         } catch (e: Exception) {
-            Log.e(TAG, "Failed to load persisted channel: ${e.message}")
+            Log.e(TAG, "Failed to load persisted channel")
             _selectedChannel.value = ChannelID.Mesh
+            selectedLocationSource = null
         }
     }
 
     data class PersistedChannel(
         val mesh: Boolean,
         val level: String? = null,
-        val geohash: String? = null
+        val geohash: String? = null,
+        val source: String? = null
     ) {
         fun toChannel(): ChannelID? {
             return if (mesh) {
@@ -531,6 +633,13 @@ class LocationChannelManager private constructor(private val context: Context) {
                 ChannelID.Location.fromPersisted(levelName, gh)
             }
         }
+
+        fun selectionSource(): LocationSelectionSource? {
+            if (mesh) return null
+            return source?.let {
+                runCatching { LocationSelectionSource.valueOf(it) }.getOrNull()
+            } ?: LocationSelectionSource.NEARBY
+        }
     }
 
     /**
@@ -539,7 +648,8 @@ class LocationChannelManager private constructor(private val context: Context) {
     fun clearPersistedChannel() {
         dataManager?.clearLastGeohashChannel()
         _selectedChannel.value = ChannelID.Mesh
-        Log.d(TAG, "Cleared persisted channel selection")
+        selectedLocationSource = null
+        _teleported.value = false
     }
 
     // MARK: - Location Services State Persistence
@@ -550,9 +660,8 @@ class LocationChannelManager private constructor(private val context: Context) {
     private fun saveLocationServicesState(enabled: Boolean) {
         try {
             dataManager?.saveLocationServicesEnabled(enabled)
-            Log.d(TAG, "Saved location services state: $enabled")
         } catch (e: Exception) {
-            Log.e(TAG, "Failed to save location services state: ${e.message}")
+            Log.e(TAG, "Failed to save location services state")
         }
     }
 
@@ -562,11 +671,10 @@ class LocationChannelManager private constructor(private val context: Context) {
     private fun loadLocationServicesState() {
         try {
             val enabled = dataManager?.isLocationServicesEnabled() ?: false
-            _locationServicesEnabled.value = enabled
-            Log.d(TAG, "Loaded location services state: $enabled")
+            LiveLocationPrivacyGate.update(enabled)
         } catch (e: Exception) {
-            Log.e(TAG, "Failed to load location services state: ${e.message}")
-            _locationServicesEnabled.value = false
+            Log.e(TAG, "Failed to load location services state")
+            LiveLocationPrivacyGate.update(false)
         }
     }
 
@@ -574,7 +682,6 @@ class LocationChannelManager private constructor(private val context: Context) {
      * Cleanup resources
      */
     fun cleanup() {
-        Log.d(TAG, "Cleaning up LocationChannelManager")
         endLiveRefresh()
         locationProvider.cancel()
         

app/src/main/java/com/bitchat/android/geohash/LocationProvider.kt

@@ -6,7 +6,7 @@ import android.location.Location
  * Abstraction for location providers to support both
  * System (LocationManager) and Google Play Services (FusedLocationProvider).
  */
-interface LocationProvider {
+internal interface LocationProvider {
     /**
      * Get the last known location from cache.
      * @param callback Called with the location or null if not found/error.

app/src/main/java/com/bitchat/android/geohash/OpenStreetMapGeocoderProvider.kt

@@ -4,53 +4,79 @@ import android.location.Address
 import android.util.Log
 import com.bitchat.android.net.OkHttpProvider
 import com.google.gson.Gson
+import java.io.IOException
+import kotlinx.coroutines.suspendCancellableCoroutine
+import okhttp3.Call
+import okhttp3.Callback
 import okhttp3.Request
+import okhttp3.Response
 import java.util.Locale
-import kotlinx.coroutines.Dispatchers
-import kotlinx.coroutines.withContext
+import kotlin.coroutines.resume
 
 class OpenStreetMapGeocoderProvider : GeocoderProvider {
     private val TAG = "OSMGeocoderProvider"
     private val gson = Gson()
     private val userAgent = "Bitchat-Android/1.0"
 
-    override suspend fun getFromLocation(latitude: Double, longitude: Double, maxResults: Int): List<Address> {
-        return withContext(Dispatchers.IO) {
+    override suspend fun getFromLocation(
+        latitude: Double,
+        longitude: Double,
+        maxResults: Int,
+        liveLocationToken: Long?
+    ): List<Address> {
+        return suspendCancellableCoroutine { continuation ->
             val lang = Locale.getDefault().toLanguageTag()
-            // Using format=jsonv2 for structured address breakdown
             val url = "https://nominatim.openstreetmap.org/reverse?format=jsonv2&lat=$latitude&lon=$longitude&zoom=18&addressdetails=1&accept-language=$lang"
+            val request = Request.Builder()
+                .url(url)
+                .header("User-Agent", userAgent)
+                .build()
+            val call = OkHttpProvider.httpClient().newCall(request)
 
-            try {
-                val request = Request.Builder()
-                    .url(url)
-                    .header("User-Agent", userAgent)
-                    .build()
-
-                val response = OkHttpProvider.httpClient().newCall(request).execute()
-                if (!response.isSuccessful) {
-                    Log.e(TAG, "OSM Request failed: ${response.code}")
-                    response.close()
-                    return@withContext emptyList<Address>()
+            continuation.invokeOnCancellation { call.cancel() }
+            val enqueueRequest = {
+                call.enqueue(object : Callback {
+                override fun onFailure(call: Call, e: IOException) {
+                    if (continuation.isActive) {
+                        Log.w(TAG, "OSM geocoding request failed")
+                        continuation.resume(emptyList())
+                    }
                 }
 
-                val body = response.body?.string()
-                response.close()
+                override fun onResponse(call: Call, response: Response) {
+                    val addresses = response.use {
+                        if (!it.isSuccessful) {
+                            Log.w(TAG, "OSM geocoding request returned ${it.code}")
+                            return@use emptyList()
+                        }
 
-                if (body.isNullOrEmpty()) return@withContext emptyList<Address>()
+                        val body = it.body?.string()
+                        if (body.isNullOrEmpty()) return@use emptyList()
 
-                try {
-                    val osmResponse = gson.fromJson(body, OsmResponse::class.java)
-                    if (osmResponse?.address == null) return@withContext emptyList<Address>()
-                    
-                    val address = mapToAddress(osmResponse, latitude, longitude)
-                    listOf(address)
-                } catch (e: Exception) {
-                     Log.e(TAG, "OSM Parse failed: ${e.message}")
-                     emptyList<Address>()
+                        runCatching {
+                            val osmResponse = gson.fromJson(body, OsmResponse::class.java)
+                            if (osmResponse?.address == null) emptyList()
+                            else listOf(mapToAddress(osmResponse, latitude, longitude))
+                        }.getOrElse {
+                            Log.w(TAG, "OSM geocoding response could not be parsed")
+                            emptyList()
+                        }
+                    }
+                    if (continuation.isActive) continuation.resume(addresses)
                 }
-            } catch (e: Exception) {
-                Log.e(TAG, "OSM Geocoding failed", e)
-                emptyList<Address>()
+                })
+            }
+            val started = if (liveLocationToken == null) {
+                enqueueRequest()
+                true
+            } else {
+                LiveLocationPrivacyGate.runIfAllowed(
+                    liveLocationToken,
+                    enqueueRequest
+                )
+            }
+            if (!started && continuation.isActive) {
+                continuation.resume(emptyList())
             }
         }
     }

app/src/main/java/com/bitchat/android/geohash/SystemLocationProvider.kt

@@ -9,10 +9,11 @@ import android.location.LocationListener
 import android.location.LocationManager
 import android.os.Build
 import android.os.Bundle
+import android.os.CancellationSignal
 import android.util.Log
 import androidx.core.app.ActivityCompat
 
-class SystemLocationProvider(private val context: Context) : LocationProvider {
+internal class SystemLocationProvider(private val context: Context) : LocationProvider {
 
     companion object {
         private const val TAG = "SystemLocationProvider"
@@ -25,10 +26,13 @@ class SystemLocationProvider(private val context: Context) : LocationProvider {
     private val activeListeners = mutableMapOf<(Location) -> Unit, LocationListener>()
     private val activeOneShotListeners = mutableMapOf<(Location?) -> Unit, LocationListener>()
     private val activeOneShotRunnables = mutableMapOf<(Location?) -> Unit, Runnable>()
+    private val activeOneShotCancellationSignals = mutableMapOf<(Location?) -> Unit, CancellationSignal>()
 
     private fun hasLocationPermission(): Boolean {
-        return ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) == PackageManager.PERMISSION_GRANTED ||
+        return LiveLocationPrivacyGate.isEnabled &&
+            (ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_FINE_LOCATION) == PackageManager.PERMISSION_GRANTED ||
                 ActivityCompat.checkSelfPermission(context, Manifest.permission.ACCESS_COARSE_LOCATION) == PackageManager.PERMISSION_GRANTED
+            )
     }
 
     @SuppressLint("MissingPermission")
@@ -49,9 +53,9 @@ class SystemLocationProvider(private val context: Context) : LocationProvider {
                     }
                 }
             }
-            callback(bestLocation)
+            callback(bestLocation.takeIf { LiveLocationPrivacyGate.isEnabled })
         } catch (e: Exception) {
-            Log.e(TAG, "Error getting last known location: ${e.message}")
+            Log.e(TAG, "Error getting last-known location")
             callback(null)
         }
     }
@@ -76,12 +80,27 @@ class SystemLocationProvider(private val context: Context) : LocationProvider {
                     Log.d(TAG, "Requesting fresh location from $provider")
                     
                     if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
-                        locationManager.getCurrentLocation(
-                            provider,
-                            null,
-                            context.mainExecutor
-                        ) { location ->
-                            callback(location)
+                        val cancellationSignal = CancellationSignal()
+                        synchronized(activeOneShotCancellationSignals) {
+                            activeOneShotCancellationSignals[callback] = cancellationSignal
+                        }
+                        try {
+                            locationManager.getCurrentLocation(
+                                provider,
+                                cancellationSignal,
+                                context.mainExecutor
+                            ) { location ->
+                                synchronized(activeOneShotCancellationSignals) {
+                                    activeOneShotCancellationSignals.remove(callback)
+                                }
+                                callback(location.takeIf { LiveLocationPrivacyGate.isEnabled })
+                            }
+                        } catch (e: Exception) {
+                            synchronized(activeOneShotCancellationSignals) {
+                                activeOneShotCancellationSignals.remove(callback)
+                            }
+                            cancellationSignal.cancel()
+                            throw e
                         }
                     } else {
                         // For older versions, use requestSingleUpdate with timeout mechanism
@@ -94,7 +113,7 @@ class SystemLocationProvider(private val context: Context) : LocationProvider {
                                     try {
                                         locationManager.removeUpdates(listener)
                                     } catch (e: Exception) {
-                                        Log.e(TAG, "Error removing timed out listener: ${e.message}")
+                                        Log.e(TAG, "Error removing timed-out listener")
                                     }
                                 }
                             }
@@ -113,9 +132,9 @@ class SystemLocationProvider(private val context: Context) : LocationProvider {
                                 try {
                                     locationManager.removeUpdates(this)
                                 } catch (e: Exception) {
-                                    Log.e(TAG, "Error removing updates in callback: ${e.message}")
+                                    Log.e(TAG, "Error removing updates in callback")
                                 }
-                                callback(location)
+                                callback(location.takeIf { LiveLocationPrivacyGate.isEnabled })
                             }
                             override fun onStatusChanged(provider: String?, status: Int, extras: Bundle?) {}
                             override fun onProviderEnabled(provider: String) {}
@@ -140,7 +159,7 @@ class SystemLocationProvider(private val context: Context) : LocationProvider {
                 callback(null)
             }
         } catch (e: Exception) {
-            Log.e(TAG, "Error requesting fresh location: ${e.message}")
+            Log.e(TAG, "Error requesting fresh location")
             callback(null)
         }
     }
@@ -156,7 +175,7 @@ class SystemLocationProvider(private val context: Context) : LocationProvider {
         try {
             val listener = object : LocationListener {
                 override fun onLocationChanged(location: Location) {
-                    callback(location)
+                    if (LiveLocationPrivacyGate.isEnabled) callback(location)
                 }
                 override fun onStatusChanged(provider: String?, status: Int, extras: Bundle?) {}
                 override fun onProviderEnabled(provider: String) {}
@@ -189,7 +208,7 @@ class SystemLocationProvider(private val context: Context) : LocationProvider {
             }
 
         } catch (e: Exception) {
-            Log.e(TAG, "Error requesting location updates: ${e.message}")
+            Log.e(TAG, "Error requesting location updates")
         }
     }
 
@@ -204,7 +223,7 @@ class SystemLocationProvider(private val context: Context) : LocationProvider {
                 Log.d(TAG, "Removed location updates")
             }
         } catch (e: Exception) {
-            Log.e(TAG, "Error removing updates: ${e.message}")
+            Log.e(TAG, "Error removing updates")
         }
     }
 
@@ -230,9 +249,13 @@ class SystemLocationProvider(private val context: Context) : LocationProvider {
                 }
                 activeOneShotRunnables.clear()
             }
+            synchronized(activeOneShotCancellationSignals) {
+                activeOneShotCancellationSignals.values.forEach { it.cancel() }
+                activeOneShotCancellationSignals.clear()
+            }
             Log.d(TAG, "Cancelled all system location requests")
         } catch (e: Exception) {
-            Log.e(TAG, "Error cancelling system provider: ${e.message}")
+            Log.e(TAG, "Error cancelling system provider")
         }
     }
 }

app/src/main/java/com/bitchat/android/hotspot/ApkWebServer.kt

@@ -0,0 +1,323 @@
+package com.bitchat.android.hotspot
+
+import android.content.Context
+import android.util.Log
+import fi.iki.elonen.NanoHTTPD
+import java.io.File
+import java.io.FileInputStream
+
+/**
+ * Lightweight HTTP server for serving the universal APK over Wi-Fi P2P hotspot.
+ * Based on NanoHTTPD.
+ */
+class ApkWebServer(
+    private val context: Context,
+    private val apkFile: File,
+    private val port: Int = DEFAULT_PORT
+) : NanoHTTPD(port) {
+
+    companion object {
+        private const val TAG = "ApkWebServer"
+        const val DEFAULT_PORT = 9999
+    }
+
+    private val appVersion: String by lazy {
+        try {
+            context.packageManager
+                .getPackageArchiveInfo(apkFile.absolutePath, 0)
+                ?.versionName
+                ?: "Unknown"
+        } catch (e: Exception) {
+            "Unknown"
+        }
+    }
+
+    // Cache the HTML landing page (generated once, reused for all requests)
+    private val cachedHtml: String by lazy {
+        generateLandingPageHtml()
+    }
+
+    override fun serve(session: IHTTPSession): Response {
+        val uri = session.uri ?: "/"
+
+        Log.d(TAG, "Request: ${session.method} $uri from ${session.remoteIpAddress}")
+
+        return when {
+            uri == "/bitchat.apk" -> {
+                serveApk()
+            }
+            uri == "/favicon.ico" -> {
+                newFixedLengthResponse(Response.Status.NOT_FOUND, "text/plain", "Not found")
+            }
+            else -> {
+                serveLandingPage()
+            }
+        }
+    }
+
+    /**
+     * Serve the APK file.
+     */
+    private fun serveApk(): Response {
+        return try {
+            if (!apkFile.exists()) {
+                Log.e(TAG, "APK file not found: ${apkFile.path}")
+                return newFixedLengthResponse(
+                    Response.Status.NOT_FOUND,
+                    "text/plain",
+                    "APK file not found"
+                )
+            }
+
+            Log.d(TAG, "Serving APK: ${apkFile.name} (${apkFile.length() / 1024 / 1024}MB)")
+
+            val inputStream = FileInputStream(apkFile)
+            val response = newFixedLengthResponse(
+                Response.Status.OK,
+                "application/vnd.android.package-archive",
+                inputStream,
+                apkFile.length()
+            )
+
+            response.addHeader("Content-Disposition", "attachment; filename=\"bitchat-${appVersion}.apk\"")
+            response.addHeader("Accept-Ranges", "bytes")
+
+            response
+        } catch (e: Exception) {
+            Log.e(TAG, "Error serving APK", e)
+            newFixedLengthResponse(
+                Response.Status.INTERNAL_ERROR,
+                "text/plain",
+                "Error serving APK: ${e.message}"
+            )
+        }
+    }
+
+    /**
+     * Serve the HTML landing page.
+     */
+    private fun serveLandingPage(): Response {
+        return newFixedLengthResponse(
+            Response.Status.OK,
+            "text/html",
+            cachedHtml
+        )
+    }
+
+    /**
+     * Generate HTML landing page.
+     */
+    private fun generateLandingPageHtml(): String {
+        val apkSizeMb = apkFile.length() / 1024 / 1024
+
+        return """
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=no">
+    <title>Download BitChat</title>
+    <style>
+        * {
+            margin: 0;
+            padding: 0;
+            box-sizing: border-box;
+        }
+
+        body {
+            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Arial, sans-serif;
+            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+            min-height: 100vh;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            padding: 20px;
+            color: #333;
+        }
+
+        .container {
+            background: white;
+            border-radius: 20px;
+            padding: 40px 30px;
+            max-width: 500px;
+            width: 100%;
+            box-shadow: 0 20px 60px rgba(0, 0, 0, 0.3);
+            text-align: center;
+        }
+
+        .logo {
+            font-size: 64px;
+            margin-bottom: 20px;
+        }
+
+        h1 {
+            font-size: 32px;
+            margin-bottom: 10px;
+            color: #667eea;
+        }
+
+        .subtitle {
+            font-size: 16px;
+            color: #666;
+            margin-bottom: 30px;
+        }
+
+        .info-grid {
+            display: grid;
+            grid-template-columns: 1fr 1fr;
+            gap: 15px;
+            margin-bottom: 30px;
+        }
+
+        .info-box {
+            background: #f5f7fa;
+            padding: 15px;
+            border-radius: 10px;
+        }
+
+        .info-label {
+            font-size: 12px;
+            color: #888;
+            text-transform: uppercase;
+            font-weight: 600;
+            margin-bottom: 5px;
+        }
+
+        .info-value {
+            font-size: 18px;
+            font-weight: bold;
+            color: #333;
+        }
+
+        .download-button {
+            display: inline-block;
+            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
+            color: white;
+            padding: 18px 40px;
+            border-radius: 50px;
+            text-decoration: none;
+            font-size: 18px;
+            font-weight: 600;
+            margin-bottom: 30px;
+            transition: transform 0.2s, box-shadow 0.2s;
+            box-shadow: 0 4px 15px rgba(102, 126, 234, 0.4);
+        }
+
+        .download-button:hover {
+            transform: translateY(-2px);
+            box-shadow: 0 6px 20px rgba(102, 126, 234, 0.5);
+        }
+
+        .download-button:active {
+            transform: translateY(0);
+        }
+
+        .instructions {
+            text-align: left;
+            background: #f5f7fa;
+            padding: 20px;
+            border-radius: 10px;
+            margin-top: 20px;
+        }
+
+        .instructions h3 {
+            font-size: 16px;
+            margin-bottom: 15px;
+            color: #667eea;
+        }
+
+        .instructions ol {
+            margin-left: 20px;
+        }
+
+        .instructions li {
+            margin-bottom: 10px;
+            line-height: 1.6;
+            font-size: 14px;
+            color: #555;
+        }
+
+        .warning {
+            background: #fff3cd;
+            border: 1px solid #ffc107;
+            padding: 15px;
+            border-radius: 10px;
+            margin-top: 20px;
+            font-size: 13px;
+            color: #856404;
+            text-align: left;
+        }
+
+        .warning strong {
+            display: block;
+            margin-bottom: 5px;
+        }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <div class="logo">🔒</div>
+        <h1>BitChat</h1>
+        <p class="subtitle">Secure Mesh Messaging</p>
+
+        <div class="info-grid">
+            <div class="info-box">
+                <div class="info-label">Version</div>
+                <div class="info-value">$appVersion</div>
+            </div>
+            <div class="info-box">
+                <div class="info-label">Size</div>
+                <div class="info-value">${apkSizeMb} MB</div>
+            </div>
+        </div>
+
+        <a href="/bitchat.apk" class="download-button">
+            📥 Download BitChat
+        </a>
+
+        <div class="instructions">
+            <h3>📱 Installation Instructions</h3>
+            <ol>
+                <li>Tap the download button above</li>
+                <li>Wait for the download to complete</li>
+                <li>Open the downloaded APK file</li>
+                <li>If prompted, enable "Install from unknown sources" for your browser</li>
+                <li>Follow the installation prompts</li>
+            </ol>
+        </div>
+
+        <div class="warning">
+            <strong>⚠️ Note:</strong>
+            If you already have BitChat installed, you may need to uninstall it first before installing this version. Make sure to backup your data if needed.
+        </div>
+    </div>
+</body>
+</html>
+        """.trimIndent()
+    }
+
+    /**
+     * Start the server.
+     */
+    fun startServer() {
+        try {
+            start(NanoHTTPD.SOCKET_READ_TIMEOUT, false)
+            Log.d(TAG, "Web server started on port $port")
+        } catch (e: Exception) {
+            Log.e(TAG, "Failed to start web server", e)
+            throw e
+        }
+    }
+
+    /**
+     * Stop the server.
+     */
+    fun stopServer() {
+        try {
+            stop()
+            Log.d(TAG, "Web server stopped")
+        } catch (e: Exception) {
+            Log.e(TAG, "Error stopping web server", e)
+        }
+    }
+}

app/src/main/java/com/bitchat/android/hotspot/HotspotActivity.kt

@@ -0,0 +1,676 @@
+package com.bitchat.android.hotspot
+
+import android.content.Intent
+import android.graphics.Bitmap
+import android.os.Build
+import android.os.Bundle
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.activity.viewModels
+import androidx.compose.animation.Crossfade
+import androidx.compose.foundation.Image
+import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.*
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material.icons.filled.ContentCopy
+import androidx.compose.material.icons.filled.Wifi
+import androidx.compose.material3.*
+import androidx.compose.runtime.*
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.asImageBitmap
+import androidx.compose.ui.platform.LocalClipboardManager
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.platform.LocalDensity
+import androidx.compose.ui.text.AnnotatedString
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.bitchat.android.ui.theme.BitchatFontFamily
+import com.bitchat.android.ui.theme.BitchatTheme
+import com.bitchat.android.util.UniversalApkManager
+import com.google.accompanist.permissions.ExperimentalPermissionsApi
+import com.google.accompanist.permissions.rememberMultiplePermissionsState
+import java.io.File
+
+/**
+ * Activity for managing Wi-Fi P2P hotspot for offline APK sharing.
+ * Pure Compose implementation, no fragments.
+ */
+class HotspotActivity : ComponentActivity() {
+
+    companion object {
+        const val EXTRA_APK_PATH = "apk_path"
+        private const val TAG = "HotspotActivity"
+    }
+
+    private val viewModel: HotspotViewModel by viewModels()
+
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+
+        // Get APK path from intent
+        val apkPath = intent.getStringExtra(EXTRA_APK_PATH)
+        val apkFile = if (apkPath != null) {
+            File(apkPath)
+        } else {
+            // Fallback: Try to get cached APK
+            UniversalApkManager(this).getCachedApk()
+        }
+
+        if (apkFile == null || !apkFile.exists()) {
+            // No APK available, show error and finish
+            finish()
+            return
+        }
+
+        setContent {
+            BitchatTheme {
+                HotspotScreen(
+                    viewModel = viewModel,
+                    apkFile = apkFile,
+                    onClose = { finish() }
+                )
+            }
+        }
+    }
+
+    override fun onNewIntent(intent: Intent) {
+        super.onNewIntent(intent)
+        // Handle notification action to stop hotspot
+        if (intent.action == "STOP_HOTSPOT") {
+            viewModel.stopHotspot()
+            finish()
+        }
+    }
+
+}
+
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun HotspotScreen(
+    viewModel: HotspotViewModel,
+    apkFile: File,
+    onClose: () -> Unit
+) {
+    val state by viewModel.state.collectAsStateWithLifecycle()
+
+    Scaffold(
+        topBar = {
+            TopAppBar(
+                title = {
+                    Text(
+                        text = "Share BitChat",
+                        fontFamily = BitchatFontFamily
+                    )
+                },
+                navigationIcon = {
+                    IconButton(onClick = onClose) {
+                        Icon(Icons.Default.Close, contentDescription = "Close")
+                    }
+                },
+                colors = TopAppBarDefaults.topAppBarColors(
+                    containerColor = MaterialTheme.colorScheme.surface
+                )
+            )
+        }
+    ) { padding ->
+        Crossfade(
+            targetState = state,
+            label = "HotspotStateCrossfade",
+            modifier = Modifier.padding(padding)
+        ) { currentState ->
+            when (currentState) {
+                is HotspotViewModel.HotspotState.Intro -> {
+                    IntroScreen(
+                        onStartHotspot = { viewModel.startHotspot(apkFile) }
+                    )
+                }
+                is HotspotViewModel.HotspotState.Starting -> {
+                    LoadingScreen()
+                }
+                is HotspotViewModel.HotspotState.Active -> {
+                    ActiveHotspotScreen(state = currentState)
+                }
+                is HotspotViewModel.HotspotState.Error -> {
+                    ErrorScreen(
+                        message = currentState.message,
+                        onRetry = { viewModel.resetToIntro() },
+                        onClose = onClose
+                    )
+                }
+            }
+        }
+    }
+}
+
+@OptIn(ExperimentalPermissionsApi::class)
+@Composable
+fun IntroScreen(onStartHotspot: () -> Unit) {
+    val requiredPermissions = remember { HotspotPermissions.requiredForSdk() }
+    val permissionState = rememberMultiplePermissionsState(requiredPermissions) { results ->
+        if (requiredPermissions.all { results[it] == true }) {
+            onStartHotspot()
+        }
+    }
+
+    Column(
+        modifier = Modifier
+            .fillMaxSize()
+            .padding(24.dp)
+            .verticalScroll(rememberScrollState()),
+        horizontalAlignment = Alignment.CenterHorizontally,
+        verticalArrangement = Arrangement.spacedBy(24.dp)
+    ) {
+        Spacer(modifier = Modifier.height(32.dp))
+
+        Icon(
+            imageVector = Icons.Default.Wifi,
+            contentDescription = null,
+            modifier = Modifier.size(80.dp),
+            tint = MaterialTheme.colorScheme.primary
+        )
+
+        Text(
+            text = "Offline App Sharing",
+            style = MaterialTheme.typography.headlineMedium,
+            fontWeight = FontWeight.Bold
+        )
+
+        Card(
+            modifier = Modifier.fillMaxWidth(),
+            colors = CardDefaults.cardColors(
+                containerColor = MaterialTheme.colorScheme.surfaceVariant
+            )
+        ) {
+            Column(
+                modifier = Modifier.padding(20.dp),
+                verticalArrangement = Arrangement.spacedBy(12.dp)
+            ) {
+                Text(
+                    text = "How it works:",
+                    style = MaterialTheme.typography.titleMedium,
+                    fontWeight = FontWeight.Bold
+                )
+                InfoItem("1. Your device creates a Wi-Fi hotspot")
+                InfoItem("2. Others connect to your hotspot")
+                InfoItem("3. They scan a QR code or enter a URL")
+                InfoItem("4. BitChat downloads directly to their device")
+            }
+        }
+
+        // Permission rationale (if needed)
+        if (!permissionState.allPermissionsGranted && permissionState.shouldShowRationale) {
+            Card(
+                modifier = Modifier.fillMaxWidth(),
+                colors = CardDefaults.cardColors(
+                    containerColor = MaterialTheme.colorScheme.primaryContainer
+                )
+            ) {
+                Column(
+                    modifier = Modifier.padding(16.dp),
+                    verticalArrangement = Arrangement.spacedBy(8.dp)
+                ) {
+                    Text(
+                        text = "ℹ️ Permission Required",
+                        style = MaterialTheme.typography.titleSmall,
+                        fontWeight = FontWeight.Bold,
+                        color = MaterialTheme.colorScheme.onPrimaryContainer
+                    )
+                    Text(
+                        text = when {
+                            Build.VERSION.SDK_INT >= HotspotPermissions.ANDROID_17_API_LEVEL ->
+                                "BitChat needs nearby devices and local network access to create a Wi-Fi hotspot and serve the app to connected devices."
+                            Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU ->
+                                "BitChat needs nearby devices permission to create a Wi-Fi hotspot for sharing the app offline."
+                            else ->
+                                "BitChat needs location permission to create a Wi-Fi hotspot. This is required by Android for Wi-Fi scanning, but no location data is collected."
+                        },
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onPrimaryContainer.copy(alpha = 0.8f)
+                    )
+                }
+            }
+        }
+
+        Card(
+            modifier = Modifier.fillMaxWidth(),
+            colors = CardDefaults.cardColors(
+                containerColor = MaterialTheme.colorScheme.errorContainer.copy(alpha = 0.3f)
+            )
+        ) {
+            Column(
+                modifier = Modifier.padding(16.dp),
+                verticalArrangement = Arrangement.spacedBy(8.dp)
+            ) {
+                Text(
+                    text = "⚠️ Note",
+                    style = MaterialTheme.typography.titleSmall,
+                    fontWeight = FontWeight.Bold,
+                    color = MaterialTheme.colorScheme.error
+                )
+                Text(
+                    text = "This will create a Wi-Fi hotspot on your device. Your current Wi-Fi connection may be interrupted.",
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurface.copy(alpha = 0.7f)
+                )
+            }
+        }
+
+        Spacer(modifier = Modifier.weight(1f))
+
+        Button(
+            onClick = {
+                // Check permission before starting hotspot
+                if (permissionState.allPermissionsGranted) {
+                    // No permission needed or already granted
+                    onStartHotspot()
+                } else {
+                    // Request permission (auto-start handled by onPermissionResult callback)
+                    permissionState.launchMultiplePermissionRequest()
+                }
+            },
+            modifier = Modifier
+                .fillMaxWidth()
+                .height(56.dp),
+            shape = RoundedCornerShape(16.dp)
+        ) {
+            Text(
+                // Starting the hotspot is the user's action. Android will ask
+                // for the required permission only when it has not already
+                // been granted.
+                text = "Start Hotspot",
+                style = MaterialTheme.typography.titleMedium,
+                fontWeight = FontWeight.Bold
+            )
+        }
+    }
+}
+
+@Composable
+fun InfoItem(text: String) {
+    Row(
+        horizontalArrangement = Arrangement.spacedBy(8.dp),
+        verticalAlignment = Alignment.Top
+    ) {
+        Text(
+            text = "•",
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.primary
+        )
+        Text(
+            text = text,
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurface.copy(alpha = 0.8f)
+        )
+    }
+}
+
+@Composable
+fun LoadingScreen() {
+    Box(
+        modifier = Modifier.fillMaxSize(),
+        contentAlignment = Alignment.Center
+    ) {
+        Column(
+            horizontalAlignment = Alignment.CenterHorizontally,
+            verticalArrangement = Arrangement.spacedBy(16.dp)
+        ) {
+            CircularProgressIndicator(
+                modifier = Modifier.size(48.dp)
+            )
+            Text(
+                text = "Starting hotspot...",
+                style = MaterialTheme.typography.bodyLarge,
+                color = MaterialTheme.colorScheme.onSurface.copy(alpha = 0.6f)
+            )
+        }
+    }
+}
+
+@Composable
+fun ActiveHotspotScreen(state: HotspotViewModel.HotspotState.Active) {
+    var selectedTab by remember { mutableStateOf(0) }
+    val tabs = listOf("Wi-Fi", "Website")
+
+    Column(
+        modifier = Modifier.fillMaxSize()
+    ) {
+        // Status banner
+        Surface(
+            color = MaterialTheme.colorScheme.primaryContainer,
+            modifier = Modifier.fillMaxWidth()
+        ) {
+            Row(
+                modifier = Modifier
+                    .padding(16.dp),
+                horizontalArrangement = Arrangement.SpaceBetween,
+                verticalAlignment = Alignment.CenterVertically
+            ) {
+                Column {
+                    Text(
+                        text = "Hotspot Active",
+                        style = MaterialTheme.typography.titleMedium,
+                        fontWeight = FontWeight.Bold,
+                        color = MaterialTheme.colorScheme.onPrimaryContainer
+                    )
+                    Text(
+                        text = "${state.connectedPeers} device(s) connected",
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onPrimaryContainer.copy(alpha = 0.7f)
+                    )
+                }
+                Icon(
+                    imageVector = Icons.Default.Wifi,
+                    contentDescription = null,
+                    tint = MaterialTheme.colorScheme.primary,
+                    modifier = Modifier.size(32.dp)
+                )
+            }
+        }
+
+        // Tabs
+        TabRow(
+            selectedTabIndex = selectedTab,
+            containerColor = MaterialTheme.colorScheme.surface,
+            contentColor = MaterialTheme.colorScheme.primary
+        ) {
+            tabs.forEachIndexed { index, title ->
+                Tab(
+                    selected = selectedTab == index,
+                    onClick = { selectedTab = index },
+                    text = {
+                        Text(
+                            text = title,
+                            fontFamily = BitchatFontFamily,
+                            fontWeight = if (selectedTab == index) FontWeight.Bold else FontWeight.Normal
+                        )
+                    }
+                )
+            }
+        }
+
+        // Tab content
+        when (selectedTab) {
+            0 -> WifiTabContent(
+                ssid = state.ssid,
+                password = state.password
+            )
+            1 -> WebsiteTabContent(
+                ipAddress = state.ipAddress,
+                port = state.port
+            )
+        }
+    }
+}
+
+@Composable
+fun WifiTabContent(ssid: String, password: String) {
+    val clipboardManager = LocalClipboardManager.current
+    val context = LocalContext.current
+
+    Column(
+        modifier = Modifier
+            .fillMaxSize()
+            .verticalScroll(rememberScrollState())
+            .padding(24.dp),
+        horizontalAlignment = Alignment.CenterHorizontally,
+        verticalArrangement = Arrangement.spacedBy(24.dp)
+    ) {
+        Text(
+            text = "Step 1: Connect to Wi-Fi",
+            style = MaterialTheme.typography.titleLarge,
+            fontWeight = FontWeight.Bold,
+            textAlign = TextAlign.Center
+        )
+
+        Text(
+            text = "Have others scan this QR code to connect:",
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurface.copy(alpha = 0.7f),
+            textAlign = TextAlign.Center
+        )
+
+        // QR Code
+        val qrSize = with(LocalDensity.current) { 280.dp.toPx().toInt() }
+        val wifiQr = remember(ssid, password, qrSize) {
+            QrCodeGenerator.generateWifiQr(ssid, password, qrSize)
+        }
+
+        if (wifiQr != null) {
+            Box(
+                modifier = Modifier
+                    .clip(RoundedCornerShape(16.dp))
+                    .background(Color.White)
+                    .padding(16.dp)
+            ) {
+                Image(
+                    bitmap = wifiQr.asImageBitmap(),
+                    contentDescription = "Wi-Fi QR Code",
+                    modifier = Modifier.size(280.dp)
+                )
+            }
+        }
+
+        Text(
+            text = "Or enter manually:",
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurface.copy(alpha = 0.7f)
+        )
+
+        // SSID
+        CredentialCard(
+            label = "Network Name (SSID)",
+            value = ssid,
+            onCopy = {
+                clipboardManager.setText(AnnotatedString(ssid))
+            }
+        )
+
+        // Password
+        CredentialCard(
+            label = "Password",
+            value = password,
+            onCopy = {
+                clipboardManager.setText(AnnotatedString(password))
+            }
+        )
+    }
+}
+
+@Composable
+fun WebsiteTabContent(ipAddress: String, port: Int) {
+    val url = "http://$ipAddress:$port"
+    val clipboardManager = LocalClipboardManager.current
+
+    Column(
+        modifier = Modifier
+            .fillMaxSize()
+            .verticalScroll(rememberScrollState())
+            .padding(24.dp),
+        horizontalAlignment = Alignment.CenterHorizontally,
+        verticalArrangement = Arrangement.spacedBy(24.dp)
+    ) {
+        Text(
+            text = "Step 2: Download BitChat",
+            style = MaterialTheme.typography.titleLarge,
+            fontWeight = FontWeight.Bold,
+            textAlign = TextAlign.Center
+        )
+
+        Text(
+            text = "After connecting to the Wi-Fi, scan this QR code:",
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurface.copy(alpha = 0.7f),
+            textAlign = TextAlign.Center
+        )
+
+        // QR Code
+        val qrSize = with(LocalDensity.current) { 280.dp.toPx().toInt() }
+        val urlQr = remember(url, qrSize) {
+            QrCodeGenerator.generateUrlQr(url, qrSize)
+        }
+
+        if (urlQr != null) {
+            Box(
+                modifier = Modifier
+                    .clip(RoundedCornerShape(16.dp))
+                    .background(Color.White)
+                    .padding(16.dp)
+            ) {
+                Image(
+                    bitmap = urlQr.asImageBitmap(),
+                    contentDescription = "Website URL QR Code",
+                    modifier = Modifier.size(280.dp)
+                )
+            }
+        }
+
+        Text(
+            text = "Or open in browser:",
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurface.copy(alpha = 0.7f)
+        )
+
+        // URL
+        CredentialCard(
+            label = "Website URL",
+            value = url,
+            onCopy = {
+                clipboardManager.setText(AnnotatedString(url))
+            }
+        )
+
+        Card(
+            modifier = Modifier.fillMaxWidth(),
+            colors = CardDefaults.cardColors(
+                containerColor = MaterialTheme.colorScheme.surfaceVariant
+            )
+        ) {
+            Column(
+                modifier = Modifier.padding(16.dp),
+                verticalArrangement = Arrangement.spacedBy(8.dp)
+            ) {
+                Text(
+                    text = "📱 Instructions",
+                    style = MaterialTheme.typography.titleSmall,
+                    fontWeight = FontWeight.Bold
+                )
+                Text(
+                    text = "1. Make sure you're connected to the Wi-Fi network above\n" +
+                            "2. Open a web browser on your device\n" +
+                            "3. Visit the URL above or scan the QR code\n" +
+                            "4. Tap 'Download BitChat'\n" +
+                            "5. Install the downloaded APK",
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurface.copy(alpha = 0.7f)
+                )
+            }
+        }
+    }
+}
+
+@Composable
+fun CredentialCard(
+    label: String,
+    value: String,
+    onCopy: () -> Unit
+) {
+    Card(
+        modifier = Modifier.fillMaxWidth(),
+        colors = CardDefaults.cardColors(
+            containerColor = MaterialTheme.colorScheme.secondaryContainer
+        )
+    ) {
+        Row(
+            modifier = Modifier
+                .fillMaxWidth()
+                .padding(16.dp),
+            horizontalArrangement = Arrangement.SpaceBetween,
+            verticalAlignment = Alignment.CenterVertically
+        ) {
+            Column(modifier = Modifier.weight(1f)) {
+                Text(
+                    text = label,
+                    style = MaterialTheme.typography.labelSmall,
+                    color = MaterialTheme.colorScheme.onSecondaryContainer.copy(alpha = 0.7f)
+                )
+                Spacer(modifier = Modifier.height(4.dp))
+                Text(
+                    text = value,
+                    style = MaterialTheme.typography.bodyLarge,
+                    fontFamily = BitchatFontFamily,
+                    fontWeight = FontWeight.Bold,
+                    color = MaterialTheme.colorScheme.onSecondaryContainer
+                )
+            }
+            IconButton(onClick = onCopy) {
+                Icon(
+                    imageVector = Icons.Default.ContentCopy,
+                    contentDescription = "Copy",
+                    tint = MaterialTheme.colorScheme.onSecondaryContainer
+                )
+            }
+        }
+    }
+}
+
+@Composable
+fun ErrorScreen(
+    message: String,
+    onRetry: () -> Unit,
+    onClose: () -> Unit
+) {
+    Column(
+        modifier = Modifier
+            .fillMaxSize()
+            .padding(24.dp),
+        horizontalAlignment = Alignment.CenterHorizontally,
+        verticalArrangement = Arrangement.Center
+    ) {
+        Text(
+            text = "❌",
+            fontSize = 64.sp
+        )
+
+        Spacer(modifier = Modifier.height(16.dp))
+
+        Text(
+            text = "Error",
+            style = MaterialTheme.typography.headlineMedium,
+            fontWeight = FontWeight.Bold
+        )
+
+        Spacer(modifier = Modifier.height(8.dp))
+
+        Text(
+            text = message,
+            style = MaterialTheme.typography.bodyMedium,
+            textAlign = TextAlign.Center,
+            color = MaterialTheme.colorScheme.onSurface.copy(alpha = 0.7f)
+        )
+
+        Spacer(modifier = Modifier.height(32.dp))
+
+        Button(
+            onClick = onRetry,
+            modifier = Modifier.fillMaxWidth()
+        ) {
+            Text("Try Again")
+        }
+
+        Spacer(modifier = Modifier.height(8.dp))
+
+        TextButton(onClick = onClose) {
+            Text("Close")
+        }
+    }
+}

app/src/main/java/com/bitchat/android/hotspot/HotspotManager.kt

@@ -0,0 +1,494 @@
+package com.bitchat.android.hotspot
+
+import android.Manifest
+import android.annotation.SuppressLint
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
+import android.net.wifi.p2p.WifiP2pConfig
+import android.net.wifi.p2p.WifiP2pGroup
+import android.net.wifi.p2p.WifiP2pManager
+import android.net.wifi.p2p.WifiP2pManager.*
+import android.os.Build
+import android.os.Handler
+import android.os.Looper
+import android.os.PowerManager
+import android.util.Log
+import java.net.NetworkInterface
+import java.security.SecureRandom
+import kotlin.random.Random
+
+/**
+ * Manages Wi-Fi P2P (Wi-Fi Direct) hotspot for offline APK sharing.
+ * Based on Briar's implementation.
+ */
+class HotspotManager(private val context: Context) {
+
+    companion object {
+        private const val TAG = "HotspotMgr"
+
+        // Retry configuration
+        private const val MAX_FRAMEWORK_ATTEMPTS = 5
+        private const val RETRY_DELAY_MILLIS = 1000L
+
+        // Group info polling interval
+        private const val GROUP_INFO_POLL_INTERVAL_MILLIS = 1000L
+
+        // Give up if the group never forms within this window after creation succeeded
+        private const val GROUP_FORMATION_TIMEOUT_MILLIS = 15_000L
+
+        // SSID and password configuration
+        private const val SSID_PREFIX = "DIRECT-BC-" // BC for BitChat
+        private const val SSID_SUFFIX_LENGTH = 8
+        private const val PASSWORD_LENGTH = 16
+
+        // Characters to use for random generation (excluding confusing ones)
+        private const val RANDOM_CHARS = "ABCDEFGHJKLMNPQRTUVWXY34679" // No 0,O,5,S,1,l,I
+    }
+
+    private val wifiP2pManager: WifiP2pManager? =
+        context.getSystemService(Context.WIFI_P2P_SERVICE) as? WifiP2pManager
+
+    private var channel: Channel? = null
+    private var wakeLock: PowerManager.WakeLock? = null
+    private var wifiLock: android.net.wifi.WifiManager.WifiLock? = null
+
+    private val handler = Handler(Looper.getMainLooper())
+    private val random = SecureRandom()
+
+    private var currentGroup: WifiP2pGroup? = null
+    private var callback: HotspotCallback? = null
+    private var isStarting = false
+    private var hasNotifiedStarted = false // Track if we've notified the callback
+    private var isReceiverRegistered = false // Track receiver registration to prevent leaks
+
+    // Saved credentials for reconnection
+    private var savedSsid: String? = null
+    private var savedPassword: String? = null
+
+    // Broadcast receiver for Wi-Fi P2P events
+    private val broadcastReceiver = object : BroadcastReceiver() {
+        override fun onReceive(context: Context, intent: Intent) {
+            when (intent.action) {
+                WifiP2pManager.WIFI_P2P_STATE_CHANGED_ACTION -> {
+                    val state = intent.getIntExtra(WifiP2pManager.EXTRA_WIFI_STATE, -1)
+                    Log.d(TAG, "Wi-Fi P2P state changed: $state")
+                }
+                WifiP2pManager.WIFI_P2P_CONNECTION_CHANGED_ACTION -> {
+                    Log.d(TAG, "Wi-Fi P2P connection changed")
+                    requestGroupInfo()
+                }
+            }
+        }
+    }
+
+    /**
+     * Start the Wi-Fi P2P hotspot.
+     */
+    fun startHotspot(callback: HotspotCallback) {
+        if (isStarting) {
+            Log.w(TAG, "Hotspot already starting")
+            return
+        }
+
+        if (wifiP2pManager == null) {
+            Log.e(TAG, "Wi-Fi P2P not available on this device")
+            callback.onError("Wi-Fi Direct not supported on this device")
+            return
+        }
+
+        val missingPermissions = HotspotPermissions.missingFrom(context)
+        if (missingPermissions.isNotEmpty()) {
+            Log.w(TAG, "Cannot start hotspot; missing required permissions: $missingPermissions")
+            val message = if (Manifest.permission.ACCESS_LOCAL_NETWORK in missingPermissions) {
+                "Local network permission is required to share the app over the hotspot"
+            } else {
+                "Nearby Wi-Fi permission is required to start the hotspot"
+            }
+            callback.onError(message)
+            return
+        }
+
+        this.callback = callback
+        isStarting = true
+
+        Log.d(TAG, "Starting Wi-Fi P2P hotspot")
+
+        // Register broadcast receiver (only if not already registered)
+        if (!isReceiverRegistered) {
+            val intentFilter = IntentFilter().apply {
+                addAction(WIFI_P2P_STATE_CHANGED_ACTION)
+                addAction(WIFI_P2P_CONNECTION_CHANGED_ACTION)
+            }
+            context.registerReceiver(broadcastReceiver, intentFilter)
+            isReceiverRegistered = true
+            Log.d(TAG, "Broadcast receiver registered")
+        }
+
+        // Acquire locks
+        acquireLocks()
+
+        // Load or generate credentials
+        if (savedSsid == null || savedPassword == null) {
+            savedSsid = generateSsid()
+            savedPassword = generatePassword()
+            Log.d(TAG, "Generated new credentials: SSID=$savedSsid")
+        } else {
+            Log.d(TAG, "Using saved credentials: SSID=$savedSsid")
+        }
+
+        // Start P2P framework with retries
+        startWifiP2pFramework(1)
+    }
+
+    /**
+     * Stop the hotspot.
+     */
+    fun stopHotspot() {
+        Log.d(TAG, "Stopping hotspot")
+
+        isStarting = false
+        hasNotifiedStarted = false
+
+        // Stop group info polling
+        handler.removeCallbacksAndMessages(null)
+
+        // Remove group
+        channel?.let { ch ->
+            wifiP2pManager?.removeGroup(ch, object : ActionListener {
+                override fun onSuccess() {
+                    Log.d(TAG, "Group removed successfully")
+                }
+                override fun onFailure(reason: Int) {
+                    Log.w(TAG, "Failed to remove group: $reason")
+                }
+            })
+        }
+
+        // Release locks
+        releaseLocks()
+
+        // Unregister receiver (only if registered)
+        if (isReceiverRegistered) {
+            try {
+                context.unregisterReceiver(broadcastReceiver)
+                isReceiverRegistered = false
+                Log.d(TAG, "Broadcast receiver unregistered")
+            } catch (e: IllegalArgumentException) {
+                Log.w(TAG, "Receiver was not registered", e)
+                isReceiverRegistered = false
+            }
+        }
+
+        currentGroup = null
+        channel = null
+        callback = null
+    }
+
+    /**
+     * Get current connection information.
+     */
+    fun getConnectionInfo(): ConnectionInfo? {
+        val group = currentGroup ?: return null
+        val ipAddress = getAccessPointAddress()
+
+        return ConnectionInfo(
+            ssid = group.networkName ?: savedSsid ?: "",
+            password = group.passphrase ?: savedPassword ?: "",
+            ipAddress = ipAddress ?: "192.168.49.1", // Fallback to standard P2P IP
+            connectedPeers = group.clientList?.size ?: 0
+        )
+    }
+
+    /**
+     * Start Wi-Fi P2P framework with retry logic.
+     */
+    private fun startWifiP2pFramework(attempt: Int) {
+        if (attempt > MAX_FRAMEWORK_ATTEMPTS) {
+            Log.e(TAG, "Failed to start P2P framework after $MAX_FRAMEWORK_ATTEMPTS attempts")
+            failStartup("Failed to start hotspot. Please try again.")
+            return
+        }
+
+        Log.d(TAG, "Starting P2P framework (attempt $attempt/$MAX_FRAMEWORK_ATTEMPTS)")
+
+        channel = wifiP2pManager?.initialize(context, Looper.getMainLooper(), null)
+
+        if (channel == null) {
+            Log.e(TAG, "Failed to initialize P2P channel")
+            handler.postDelayed({
+                startWifiP2pFramework(attempt + 1)
+            }, RETRY_DELAY_MILLIS)
+            return
+        }
+
+        createGroup(attempt)
+    }
+
+    /**
+     * Create Wi-Fi P2P group.
+     */
+    @SuppressLint("MissingPermission")
+    private fun createGroup(attempt: Int) {
+        val ch = channel ?: return
+
+        try {
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                // Android 10+: Custom SSID and password
+                val config = WifiP2pConfig.Builder()
+                    .setNetworkName(savedSsid!!)
+                    .setPassphrase(savedPassword!!)
+                    .setGroupOperatingBand(WifiP2pConfig.GROUP_OWNER_BAND_2GHZ) // Force 2.4GHz for compatibility
+                    .build()
+
+                wifiP2pManager?.createGroup(ch, config, groupActionListener(attempt, ch))
+            } else {
+                // Android 9 and below: System-generated SSID/password
+                wifiP2pManager?.createGroup(ch, groupActionListener(attempt, ch))
+            }
+        } catch (e: SecurityException) {
+            Log.e(TAG, "Wi-Fi permission was revoked while creating the group", e)
+            failStartup("A required Wi-Fi or local network permission was revoked. Grant it and try again.")
+        }
+    }
+
+    private fun groupActionListener(attempt: Int, requestChannel: Channel) = object : ActionListener {
+        override fun onSuccess() {
+            if (channel !== requestChannel) {
+                Log.w(TAG, "Removing group created after hotspot was stopped")
+                wifiP2pManager?.removeGroup(requestChannel, null)
+                return
+            }
+            Log.d(TAG, "P2P group created successfully")
+            isStarting = false
+            // Don't call onHotspotStarted() yet - wait for group info
+            startGroupInfoPolling()
+        }
+
+        override fun onFailure(reason: Int) {
+            if (channel != null) {
+                handleGroupCreationFailure(reason, attempt)
+            }
+        }
+    }
+
+    /**
+     * Handle group creation failure with retry logic.
+     */
+    private fun handleGroupCreationFailure(reason: Int, attempt: Int) {
+        val reasonStr = when (reason) {
+            ERROR -> "ERROR"
+            P2P_UNSUPPORTED -> "P2P_UNSUPPORTED"
+            BUSY -> "BUSY"
+            else -> "UNKNOWN($reason)"
+        }
+
+        Log.w(TAG, "Failed to create group: $reasonStr")
+
+        if (reason == BUSY && attempt < MAX_FRAMEWORK_ATTEMPTS) {
+            // Framework is busy, retry
+            Log.d(TAG, "P2P framework busy, retrying...")
+            handler.postDelayed({
+                startWifiP2pFramework(attempt + 1)
+            }, RETRY_DELAY_MILLIS)
+        } else {
+            failStartup("Failed to create hotspot: $reasonStr")
+        }
+    }
+
+    /**
+     * Terminal startup failure: release all resources (locks, receiver, handler
+     * callbacks) before notifying the callback, so a failed attempt doesn't leak
+     * and block subsequent attempts.
+     */
+    private fun failStartup(message: String) {
+        val cb = callback
+        stopHotspot()
+        cb?.onError(message)
+    }
+
+    /**
+     * Start polling for group info to track connected clients.
+     */
+    private fun startGroupInfoPolling() {
+        requestGroupInfo()
+
+        // Keep polling even while the group info is still null — the first
+        // requestGroupInfo() after createGroup() can legitimately return null
+        // while the group is forming. Give up only after a timeout.
+        var elapsedMillis = 0L
+        handler.postDelayed(object : Runnable {
+            override fun run() {
+                if (channel == null) return
+
+                elapsedMillis += GROUP_INFO_POLL_INTERVAL_MILLIS
+                if (currentGroup == null && !hasNotifiedStarted &&
+                    elapsedMillis >= GROUP_FORMATION_TIMEOUT_MILLIS
+                ) {
+                    Log.e(TAG, "Group never formed within ${GROUP_FORMATION_TIMEOUT_MILLIS}ms")
+                    failStartup("Hotspot failed to start. Please try again.")
+                    return
+                }
+
+                requestGroupInfo()
+                handler.postDelayed(this, GROUP_INFO_POLL_INTERVAL_MILLIS)
+            }
+        }, GROUP_INFO_POLL_INTERVAL_MILLIS)
+    }
+
+    /**
+     * Request current group information.
+     */
+    @SuppressLint("MissingPermission")
+    private fun requestGroupInfo() {
+        val ch = channel ?: return
+
+        try {
+            wifiP2pManager?.requestGroupInfo(ch) { group ->
+                if (group != null) {
+                    currentGroup = group
+
+                    // Update saved credentials if using system-generated ones
+                    if (Build.VERSION.SDK_INT < Build.VERSION_CODES.Q) {
+                        savedSsid = group.networkName
+                        savedPassword = group.passphrase
+                    }
+
+                    // Notify callback on FIRST successful group info retrieval
+                    if (!hasNotifiedStarted) {
+                        hasNotifiedStarted = true
+                        Log.d(TAG, "Group info received, notifying callback")
+                        callback?.onHotspotStarted()
+                    } else {
+                        // Subsequent updates
+                        callback?.onConnectionInfoUpdated(getConnectionInfo())
+                    }
+                } else {
+                    Log.w(TAG, "requestGroupInfo returned null group")
+                }
+            }
+        } catch (e: SecurityException) {
+            Log.e(TAG, "Wi-Fi permission was revoked while reading group info", e)
+            failStartup("A required Wi-Fi or local network permission was revoked. Grant it and try again.")
+        }
+    }
+
+    /**
+     * Acquire WakeLock and WifiLock to keep hotspot active.
+     */
+    private fun acquireLocks() {
+        try {
+            val powerManager = context.getSystemService(Context.POWER_SERVICE) as PowerManager
+            wakeLock = powerManager.newWakeLock(
+                PowerManager.PARTIAL_WAKE_LOCK,
+                "BitChat:HotspotWakeLock"
+            )
+            wakeLock?.acquire(30 * 60 * 1000L)
+
+            val wifiManager = context.getSystemService(Context.WIFI_SERVICE) as android.net.wifi.WifiManager
+            val lockType = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+                android.net.wifi.WifiManager.WIFI_MODE_FULL_HIGH_PERF
+            } else {
+                android.net.wifi.WifiManager.WIFI_MODE_FULL
+            }
+            wifiLock = wifiManager.createWifiLock(lockType, "BitChat:HotspotWifiLock")
+            wifiLock?.acquire()
+
+            Log.d(TAG, "Acquired WakeLock and WifiLock")
+        } catch (e: Exception) {
+            Log.e(TAG, "Error acquiring locks", e)
+        }
+    }
+
+    /**
+     * Release WakeLock and WifiLock.
+     */
+    private fun releaseLocks() {
+        try {
+            wakeLock?.let {
+                if (it.isHeld) {
+                    it.release()
+                }
+            }
+            wakeLock = null
+
+            wifiLock?.let {
+                if (it.isHeld) {
+                    it.release()
+                }
+            }
+            wifiLock = null
+
+            Log.d(TAG, "Released WakeLock and WifiLock")
+        } catch (e: Exception) {
+            Log.e(TAG, "Error releasing locks", e)
+        }
+    }
+
+    /**
+     * Get the IP address of the P2P access point.
+     * Looks for network interface starting with "p2p".
+     */
+    private fun getAccessPointAddress(): String? {
+        try {
+            val interfaces = NetworkInterface.getNetworkInterfaces()
+            while (interfaces.hasMoreElements()) {
+                val iface = interfaces.nextElement()
+                if (iface.name.startsWith("p2p")) {
+                    val addresses = iface.interfaceAddresses
+                    for (addr in addresses) {
+                        val address = addr.address
+                        // IPv4 only (4 bytes)
+                        if (address.address.size == 4) {
+                            return address.hostAddress
+                        }
+                    }
+                }
+            }
+        } catch (e: Exception) {
+            Log.e(TAG, "Error getting access point address", e)
+        }
+        return null
+    }
+
+    /**
+     * Generate random SSID.
+     * Format: DIRECT-BC-XXXXXXXX
+     */
+    private fun generateSsid(): String {
+        val suffix = (1..SSID_SUFFIX_LENGTH)
+            .map { RANDOM_CHARS[random.nextInt(RANDOM_CHARS.length)] }
+            .joinToString("")
+        return "$SSID_PREFIX$suffix"
+    }
+
+    /**
+     * Generate random password.
+     * 16 characters, excluding confusing characters.
+     */
+    private fun generatePassword(): String {
+        return (1..PASSWORD_LENGTH)
+            .map { RANDOM_CHARS[random.nextInt(RANDOM_CHARS.length)] }
+            .joinToString("")
+    }
+
+    /**
+     * Connection information for the hotspot.
+     */
+    data class ConnectionInfo(
+        val ssid: String,
+        val password: String,
+        val ipAddress: String,
+        val connectedPeers: Int
+    )
+
+    /**
+     * Callback interface for hotspot events.
+     */
+    interface HotspotCallback {
+        fun onHotspotStarted()
+        fun onConnectionInfoUpdated(info: ConnectionInfo?)
+        fun onError(message: String)
+    }
+}

app/src/main/java/com/bitchat/android/hotspot/HotspotPermissions.kt

@@ -0,0 +1,35 @@
+package com.bitchat.android.hotspot
+
+import android.Manifest
+import android.annotation.SuppressLint
+import android.content.Context
+import android.content.pm.PackageManager
+import android.os.Build
+import androidx.core.content.ContextCompat
+
+internal object HotspotPermissions {
+    const val ANDROID_17_API_LEVEL = 37
+
+    @SuppressLint("InlinedApi")
+    fun requiredForSdk(sdkInt: Int = Build.VERSION.SDK_INT): List<String> {
+        return when {
+            sdkInt >= ANDROID_17_API_LEVEL -> listOf(
+                Manifest.permission.NEARBY_WIFI_DEVICES,
+                Manifest.permission.ACCESS_LOCAL_NETWORK
+            )
+            sdkInt >= Build.VERSION_CODES.TIRAMISU -> listOf(
+                Manifest.permission.NEARBY_WIFI_DEVICES
+            )
+            sdkInt >= Build.VERSION_CODES.Q -> listOf(
+                Manifest.permission.ACCESS_FINE_LOCATION
+            )
+            else -> emptyList()
+        }
+    }
+
+    fun missingFrom(context: Context): List<String> {
+        return requiredForSdk().filter { permission ->
+            ContextCompat.checkSelfPermission(context, permission) != PackageManager.PERMISSION_GRANTED
+        }
+    }
+}

app/src/main/java/com/bitchat/android/hotspot/HotspotViewModel.kt

@@ -0,0 +1,154 @@
+package com.bitchat.android.hotspot
+
+import android.app.Application
+import android.util.Log
+import androidx.lifecycle.AndroidViewModel
+import androidx.lifecycle.viewModelScope
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.launch
+import java.io.File
+
+/**
+ * ViewModel for managing hotspot state and lifecycle.
+ */
+class HotspotViewModel(application: Application) : AndroidViewModel(application) {
+
+    companion object {
+        private const val TAG = "HotspotViewModel"
+    }
+
+    private val _state = MutableStateFlow<HotspotState>(HotspotState.Intro)
+    val state: StateFlow<HotspotState> = _state.asStateFlow()
+
+    private var hotspotManager: HotspotManager? = null
+    private var webServer: ApkWebServer? = null
+    private val context = application.applicationContext
+
+    /**
+     * Start the hotspot with the provided APK file.
+     */
+    fun startHotspot(apkFile: File) {
+        if (_state.value is HotspotState.Starting || _state.value is HotspotState.Active) {
+            Log.w(TAG, "Hotspot already starting or active")
+            return
+        }
+
+        Log.d(TAG, "Starting hotspot with APK: ${apkFile.name}")
+        _state.value = HotspotState.Starting
+
+        viewModelScope.launch {
+            try {
+                // Start hotspot
+                val manager = HotspotManager(context)
+                hotspotManager = manager
+
+                manager.startHotspot(object : HotspotManager.HotspotCallback {
+                    override fun onHotspotStarted() {
+                        viewModelScope.launch {
+                            Log.d(TAG, "Hotspot started successfully")
+
+                            // Get connection info
+                            val info = manager.getConnectionInfo()
+                            if (info == null) {
+                                manager.stopHotspot()
+                                _state.value = HotspotState.Error("Failed to get hotspot connection info")
+                                return@launch
+                            }
+
+                            // Start web server
+                            try {
+                                val server = ApkWebServer(context, apkFile)
+                                server.startServer()
+                                webServer = server
+
+                                Log.d(TAG, "Web server started on port ${ApkWebServer.DEFAULT_PORT}")
+
+                                // Update state with connection info
+                                _state.value = HotspotState.Active(
+                                    ssid = info.ssid,
+                                    password = info.password,
+                                    ipAddress = info.ipAddress,
+                                    port = ApkWebServer.DEFAULT_PORT,
+                                    connectedPeers = info.connectedPeers
+                                )
+                            } catch (e: Exception) {
+                                Log.e(TAG, "Failed to start web server", e)
+                                manager.stopHotspot()
+                                _state.value = HotspotState.Error("Failed to start web server: ${e.message}")
+                            }
+                        }
+                    }
+
+                    override fun onConnectionInfoUpdated(info: HotspotManager.ConnectionInfo?) {
+                        viewModelScope.launch {
+                            // Update peer count if we're active
+                            val currentState = _state.value
+                            if (currentState is HotspotState.Active && info != null) {
+                                _state.value = currentState.copy(connectedPeers = info.connectedPeers)
+                            }
+                        }
+                    }
+
+                    override fun onError(message: String) {
+                        viewModelScope.launch {
+                            Log.e(TAG, "Hotspot error: $message")
+                            _state.value = HotspotState.Error(message)
+                        }
+                    }
+                })
+
+            } catch (e: Exception) {
+                Log.e(TAG, "Error starting hotspot", e)
+                hotspotManager?.stopHotspot()
+                _state.value = HotspotState.Error(e.message ?: "Unknown error")
+            }
+        }
+    }
+
+    /**
+     * Stop the hotspot and web server.
+     */
+    fun stopHotspot() {
+        Log.d(TAG, "Stopping hotspot")
+
+        webServer?.stopServer()
+        webServer = null
+
+        hotspotManager?.stopHotspot()
+        hotspotManager = null
+
+        _state.value = HotspotState.Intro
+    }
+
+    /**
+     * Reset to intro state (for retry after error).
+     */
+    fun resetToIntro() {
+        stopHotspot()
+        _state.value = HotspotState.Intro
+    }
+
+    override fun onCleared() {
+        super.onCleared()
+        Log.d(TAG, "ViewModel cleared, stopping hotspot")
+        stopHotspot()
+    }
+
+    /**
+     * Hotspot state sealed class.
+     */
+    sealed class HotspotState {
+        object Intro : HotspotState()
+        object Starting : HotspotState()
+        data class Active(
+            val ssid: String,
+            val password: String,
+            val ipAddress: String,
+            val port: Int,
+            val connectedPeers: Int
+        ) : HotspotState()
+        data class Error(val message: String) : HotspotState()
+    }
+}

app/src/main/java/com/bitchat/android/hotspot/QrCodeGenerator.kt

@@ -0,0 +1,126 @@
+package com.bitchat.android.hotspot
+
+import android.graphics.Bitmap
+import android.util.Log
+import androidx.core.graphics.createBitmap
+import androidx.core.graphics.set
+import com.google.zxing.BarcodeFormat
+import com.google.zxing.common.BitMatrix
+import com.google.zxing.qrcode.QRCodeWriter
+
+/**
+ * Utility for generating QR codes for Wi-Fi connection and URL.
+ */
+object QrCodeGenerator {
+
+    private const val TAG = "QrCodeGenerator"
+
+    /**
+     * Generate QR code for Wi-Fi connection.
+     * Format: WIFI:S:{SSID};T:WPA;P:{PASSWORD};;
+     *
+     * This format is recognized by most Android/iOS devices for instant Wi-Fi connection.
+     *
+     * @param ssid Wi-Fi network name
+     * @param password Wi-Fi password
+     * @param sizePx Size of the QR code in pixels
+     * @return Bitmap of the QR code, or null on error
+     */
+    fun generateWifiQr(ssid: String, password: String, sizePx: Int): Bitmap? {
+        if (ssid.isBlank() || password.isBlank()) {
+            Log.w(TAG, "SSID or password is blank")
+            return null
+        }
+
+        // Escape special characters
+        val escapedSsid = escapeWifiString(ssid)
+        val escapedPassword = escapeWifiString(password)
+
+        // Format: WIFI:S:{SSID};T:WPA;P:{PASSWORD};;
+        val wifiString = "WIFI:S:$escapedSsid;T:WPA;P:$escapedPassword;;"
+
+        Log.d(TAG, "Generating Wi-Fi QR code for SSID: $ssid")
+
+        return generateQrBitmap(wifiString, sizePx)
+    }
+
+    /**
+     * Generate QR code for URL.
+     *
+     * @param url Website URL (e.g., "http://192.168.49.1:9999")
+     * @param sizePx Size of the QR code in pixels
+     * @return Bitmap of the QR code, or null on error
+     */
+    fun generateUrlQr(url: String, sizePx: Int): Bitmap? {
+        if (url.isBlank()) {
+            Log.w(TAG, "URL is blank")
+            return null
+        }
+
+        Log.d(TAG, "Generating URL QR code: $url")
+
+        return generateQrBitmap(url, sizePx)
+    }
+
+    /**
+     * Generate QR code bitmap from string data.
+     *
+     * @param data String data to encode
+     * @param sizePx Size of the QR code in pixels
+     * @return Bitmap of the QR code, or null on error
+     */
+    private fun generateQrBitmap(data: String, sizePx: Int): Bitmap? {
+        if (data.isBlank() || sizePx <= 0) {
+            Log.w(TAG, "Invalid data or size: data.length=${data.length}, sizePx=$sizePx")
+            return null
+        }
+
+        return try {
+            val matrix = QRCodeWriter().encode(
+                data,
+                BarcodeFormat.QR_CODE,
+                sizePx,
+                sizePx
+            )
+            bitmapFromMatrix(matrix)
+        } catch (e: Exception) {
+            Log.e(TAG, "Error generating QR code", e)
+            null
+        }
+    }
+
+    /**
+     * Convert BitMatrix to Bitmap.
+     * Pattern from VerificationSheet.kt.
+     */
+    private fun bitmapFromMatrix(matrix: BitMatrix): Bitmap {
+        val width = matrix.width
+        val height = matrix.height
+        val bitmap = createBitmap(width, height)
+
+        for (x in 0 until width) {
+            for (y in 0 until height) {
+                bitmap[x, y] = if (matrix[x, y]) {
+                    android.graphics.Color.BLACK
+                } else {
+                    android.graphics.Color.WHITE
+                }
+            }
+        }
+
+        return bitmap
+    }
+
+    /**
+     * Escape special characters in Wi-Fi SSID/password for QR code format.
+     * Special characters that need escaping: \ ; , " :
+     */
+    private fun escapeWifiString(input: String): String {
+        return input
+            .replace("\\", "\\\\")  // Backslash must be escaped first
+            .replace(";", "\\;")
+            .replace(",", "\\,")
+            .replace("\"", "\\\"")
+            .replace(":", "\\:")
+    }
+}

app/src/main/java/com/bitchat/android/identity/SecureIdentityStateManager.kt

@@ -1,5 +1,6 @@
 package com.bitchat.android.identity
 
+import android.annotation.SuppressLint
 import android.content.Context
 import android.content.SharedPreferences
 import androidx.security.crypto.EncryptedSharedPreferences
@@ -7,6 +8,8 @@ import androidx.security.crypto.MasterKey
 import java.security.MessageDigest
 import android.util.Base64
 import android.util.Log
+import com.bitchat.android.model.AuthenticatedPeerState
+import com.bitchat.android.model.PeerCapabilities
 import com.bitchat.android.util.hexEncodedString
 import androidx.core.content.edit
 
@@ -18,7 +21,7 @@ import androidx.core.content.edit
  * - Secure storage using Android EncryptedSharedPreferences
  * - Fingerprint calculation and identity validation
  */
-class SecureIdentityStateManager(private val context: Context) {
+class SecureIdentityStateManager {
     
     companion object {
         private const val TAG = "SecureIdentityStateManager"
@@ -32,12 +35,30 @@ class SecureIdentityStateManager(private val context: Context) {
         private const val KEY_CACHED_PEER_NOISE_KEYS = "cached_peer_noise_keys"
         private const val KEY_CACHED_NOISE_FINGERPRINTS = "cached_noise_fingerprints"
         private const val KEY_CACHED_FINGERPRINT_NICKNAMES = "cached_fingerprint_nicknames"
+        private const val KEY_PRIVATE_MEDIA_CAPABILITY_PINS = "private_media_capability_pins_v1"
+        private const val KEY_AUTHENTICATED_PEER_STATES = "authenticated_peer_states_v1"
+        private val NDR_PROTECTION_KEYS = setOf(
+            "favorite_relationships",
+            "favorite_peerid_index",
+            "favorite_ndr_rebind_v1"
+        )
+
+        // BLE, Wi-Fi Aware, and Noise services each hold their own manager
+        // instance over the same encrypted preferences. Serialize pin updates
+        // process-wide so concurrent promotions cannot lose one another or
+        // race a panic wipe.
+        private val privateMediaPinsLock = Any()
+        private var privateMediaPinsEpoch = 0L
     }
     
     private val prefs: SharedPreferences
     private val lock = Any()
-    
-    init {
+    private var privateMediaPinsEpochAtCreation: Long
+
+    constructor(context: Context) {
+        privateMediaPinsEpochAtCreation = synchronized(privateMediaPinsLock) {
+            privateMediaPinsEpoch
+        }
         // Create master key for encryption
         val masterKey = MasterKey.Builder(context, MasterKey.DEFAULT_MASTER_KEY_ALIAS)
             .setKeyScheme(MasterKey.KeyScheme.AES256_GCM)
@@ -52,6 +73,15 @@ class SecureIdentityStateManager(private val context: Context) {
             EncryptedSharedPreferences.PrefValueEncryptionScheme.AES256_GCM
         )
     }
+
+    /** Test-only storage injection; production always uses encrypted prefs. */
+    internal constructor(prefs: SharedPreferences, testOnly: Boolean) {
+        require(testOnly) { "Plain SharedPreferences are test-only" }
+        privateMediaPinsEpochAtCreation = synchronized(privateMediaPinsLock) {
+            privateMediaPinsEpoch
+        }
+        this.prefs = prefs
+    }
     
     // MARK: - Static Key Management
     
@@ -293,6 +323,78 @@ class SecureIdentityStateManager(private val context: Context) {
             prefs.edit { putStringSet(KEY_CACHED_FINGERPRINT_NICKNAMES, current) }
         }
     }
+
+    // MARK: - Authenticated private-media capability pins
+
+    fun isPrivateMediaCapable(fingerprint: String): Boolean {
+        if (!isValidFingerprint(fingerprint)) return false
+        return synchronized(privateMediaPinsLock) {
+            if (privateMediaPinsEpochAtCreation != privateMediaPinsEpoch) {
+                return@synchronized false
+            }
+            prefs.getStringSet(KEY_PRIVATE_MEDIA_CAPABILITY_PINS, emptySet())
+                ?.any { it.equals(fingerprint, ignoreCase = true) } == true
+        }
+    }
+
+    /** Persist capabilities and Ed25519 key from a decoded Noise 0x21 proof in one edit. */
+    @SuppressLint("UseKtx")
+    fun storeAuthenticatedPeerState(
+        fingerprint: String,
+        state: AuthenticatedPeerState,
+        onCommitted: () -> Unit = {}
+    ): Boolean {
+        if (!isValidFingerprint(fingerprint) || state.signingPublicKey.size != 32) return false
+        val normalizedFingerprint = fingerprint.lowercase()
+        return synchronized(privateMediaPinsLock) {
+            // A controller that survived panic must not republish pre-wipe proof state.
+            if (privateMediaPinsEpochAtCreation != privateMediaPinsEpoch) return@synchronized false
+            val records = prefs.getStringSet(KEY_AUTHENTICATED_PEER_STATES, emptySet())
+                ?.toMutableSet() ?: mutableSetOf()
+            records.removeAll { it.startsWith("$normalizedFingerprint:") }
+            val capabilitiesHex = java.lang.Long.toUnsignedString(state.capabilities.rawValue, 16)
+            records.add(
+                "$normalizedFingerprint:$capabilitiesHex:${state.signingPublicKey.hexEncodedString()}"
+            )
+
+            val editor = prefs.edit().putStringSet(KEY_AUTHENTICATED_PEER_STATES, records)
+            if (state.capabilities.contains(PeerCapabilities.PRIVATE_MEDIA)) {
+                val pins = prefs.getStringSet(KEY_PRIVATE_MEDIA_CAPABILITY_PINS, emptySet())
+                    ?.mapTo(mutableSetOf()) { it.lowercase() } ?: mutableSetOf()
+                pins.add(normalizedFingerprint)
+                editor.putStringSet(KEY_PRIVATE_MEDIA_CAPABILITY_PINS, pins)
+            }
+            // This result is a security boundary: do not publish the Ed key in memory unless the
+            // encrypted identity record and its HSTS pin were durably committed together.
+            editor.commit().also { committed ->
+                if (committed) onCommitted()
+            }
+        }
+    }
+
+    fun getAuthenticatedPeerState(fingerprint: String): AuthenticatedPeerState? {
+        if (!isValidFingerprint(fingerprint)) return null
+        return synchronized(privateMediaPinsLock) {
+            if (privateMediaPinsEpochAtCreation != privateMediaPinsEpoch) return@synchronized null
+            val prefix = "${fingerprint.lowercase()}:"
+            val record = prefs.getStringSet(KEY_AUTHENTICATED_PEER_STATES, emptySet())
+                ?.firstOrNull { it.startsWith(prefix) } ?: return@synchronized null
+            val fields = record.split(':', limit = 3)
+            if (fields.size != 3) return@synchronized null
+            val capabilities = runCatching {
+                PeerCapabilities(java.lang.Long.parseUnsignedLong(fields[1], 16))
+            }.getOrNull() ?: return@synchronized null
+            val signingKeyHex = fields[2]
+            if (!signingKeyHex.matches(Regex("^[0-9a-f]{64}$"))) return@synchronized null
+            val signingKey = runCatching {
+                signingKeyHex.chunked(2).map { it.toInt(16).toByte() }.toByteArray()
+            }.getOrNull() ?: return@synchronized null
+            AuthenticatedPeerState(capabilities, signingKey)
+        }
+    }
+
+    fun getAuthenticatedSigningKey(fingerprint: String): ByteArray? =
+        getAuthenticatedPeerState(fingerprint)?.signingPublicKey?.copyOf()
     
     // MARK: - Peer ID Rotation Management (removed)
     // Android now derives peer ID from the persisted Noise identity fingerprint.
@@ -368,12 +470,39 @@ class SecureIdentityStateManager(private val context: Context) {
     /**
      * Clear all identity data (for panic mode)
      */
-    fun clearIdentityData() {
-        try {
-            prefs.edit().clear().apply()
-            Log.w(TAG, "All identity data cleared")
+    @SuppressLint("UseKtx")
+    fun clearIdentityData(): Boolean {
+        return try {
+            val cleared = synchronized(privateMediaPinsLock) {
+                privateMediaPinsEpoch += 1
+                privateMediaPinsEpochAtCreation = privateMediaPinsEpoch
+                synchronized(lock) {
+                    val protectedValues = NDR_PROTECTION_KEYS.mapNotNull { key ->
+                        prefs.getString(key, null)?.let { value -> key to value }
+                    }.toMap()
+                    val editor = prefs.edit().clear()
+                    protectedValues.forEach { (key, value) ->
+                        editor.putString(key, value)
+                    }
+                    val committed = editor.commit()
+                    val storedValues = prefs.all
+                    val wipeVerified =
+                        storedValues.keys == protectedValues.keys &&
+                            protectedValues.all { (key, value) ->
+                                storedValues[key] == value
+                            }
+                    committed && wipeVerified
+                }
+            }
+            if (cleared) {
+                Log.w(TAG, "All identity data cleared")
+            } else {
+                Log.e(TAG, "Identity preference wipe could not be committed safely")
+            }
+            cleared
         } catch (e: Exception) {
             Log.e(TAG, "Failed to clear identity data: ${e.message}")
+            false
         }
     }
     
@@ -392,6 +521,29 @@ class SecureIdentityStateManager(private val context: Context) {
     fun storeSecureValue(key: String, value: String) {
         prefs.edit().putString(key, value).apply()
     }
+
+    /**
+     * Durably store a value before acknowledging an external operation.
+     */
+    fun storeSecureValueSynchronously(key: String, value: String): Boolean {
+        return commitSecureValuesSynchronously(mapOf(key to value))
+    }
+
+    /**
+     * Atomically commit and read back a set of secure string mutations.
+     */
+    fun commitSecureValuesSynchronously(
+        values: Map<String, String> = emptyMap(),
+        removals: Set<String> = emptySet()
+    ): Boolean = synchronized(lock) {
+        if (values.keys.any { it in removals }) return@synchronized false
+        val editor = prefs.edit()
+        values.forEach { (key, value) -> editor.putString(key, value) }
+        removals.forEach(editor::remove)
+        if (!editor.commit()) return@synchronized false
+        values.all { (key, value) -> prefs.getString(key, null) == value } &&
+            removals.none(prefs::contains)
+    }
     
     /**
      * Retrieve a string value from secure preferences

app/src/main/java/com/bitchat/android/mesh/AnnouncementIdentityValidator.kt

@@ -0,0 +1,37 @@
+package com.bitchat.android.mesh
+
+import com.bitchat.android.model.IdentityAnnouncement
+import com.bitchat.android.noise.NoisePeerIdentity
+import com.bitchat.android.protocol.BitchatPacket
+import com.bitchat.android.protocol.MessageType
+import com.bitchat.android.util.toHexString
+
+/** Canonical, side-effect-free preflight for a self-signed mesh announcement. */
+object AnnouncementIdentityValidator {
+    private const val MAX_CLOCK_SKEW_MS = 10 * 60 * 1_000L
+
+    fun verify(
+        packet: BitchatPacket,
+        claimedPeerID: String,
+        nowMs: Long = System.currentTimeMillis(),
+        verifyEd25519: (signature: ByteArray, data: ByteArray, publicKey: ByteArray) -> Boolean
+    ): IdentityAnnouncement? {
+        if (packet.type != MessageType.ANNOUNCE.value) return null
+        val now = nowMs.coerceAtLeast(0).toULong()
+        val skew = if (packet.timestamp >= now) packet.timestamp - now else now - packet.timestamp
+        if (skew > MAX_CLOCK_SKEW_MS.toULong()) return null
+        val announcement = IdentityAnnouncement.decode(packet.payload) ?: return null
+        if (announcement.signingPublicKey.size != 32) return null
+
+        val derivedPeerID = NoisePeerIdentity.derivePeerID(announcement.noisePublicKey) ?: return null
+        if (packet.senderID.toHexString() != derivedPeerID || claimedPeerID != derivedPeerID) return null
+
+        val signature = packet.signature ?: return null
+        val canonicalData = packet.toBinaryDataForSigning() ?: return null
+        return if (verifyEd25519(signature, canonicalData, announcement.signingPublicKey)) {
+            announcement
+        } else {
+            null
+        }
+    }
+}

app/src/main/java/com/bitchat/android/mesh/AuthenticatedPeerStateCoordinator.kt

@@ -0,0 +1,235 @@
+package com.bitchat.android.mesh
+
+import android.content.Context
+import com.bitchat.android.identity.SecureIdentityStateManager
+import com.bitchat.android.model.AuthenticatedPeerState
+import com.bitchat.android.noise.AuthenticatedNoiseSession
+import com.bitchat.android.noise.NoisePeerIdentity
+import java.security.MessageDigest
+import java.util.concurrent.ConcurrentHashMap
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+
+internal interface AuthenticatedPeerStateStore {
+    fun load(fingerprint: String): AuthenticatedPeerState?
+    fun persist(
+        fingerprint: String,
+        state: AuthenticatedPeerState,
+        onCommitted: () -> Unit
+    ): Boolean
+    fun isPrivateMediaPinned(fingerprint: String): Boolean
+}
+
+internal class SecureAuthenticatedPeerStateStore(context: Context) : AuthenticatedPeerStateStore {
+    private val identityState = SecureIdentityStateManager(context.applicationContext)
+
+    override fun load(fingerprint: String): AuthenticatedPeerState? =
+        identityState.getAuthenticatedPeerState(fingerprint)
+
+    override fun persist(
+        fingerprint: String,
+        state: AuthenticatedPeerState,
+        onCommitted: () -> Unit
+    ): Boolean = identityState.storeAuthenticatedPeerState(fingerprint, state, onCommitted)
+
+    override fun isPrivateMediaPinned(fingerprint: String): Boolean =
+        identityState.isPrivateMediaCapable(fingerprint)
+}
+
+internal sealed interface AuthenticatedPeerStateStatus {
+    data object Missing : AuthenticatedPeerStateStatus
+    data object Awaiting : AuthenticatedPeerStateStatus
+    data object TimedOut : AuthenticatedPeerStateStatus
+    data class Proven(val state: AuthenticatedPeerState) : AuthenticatedPeerStateStatus
+}
+
+/** Fresh, generation-scoped authenticated peer-state exchange for Noise payload 0x21. */
+internal class AuthenticatedPeerStateCoordinator(
+    private val scope: CoroutineScope,
+    private val authenticatedSessionProvider: (String) -> AuthenticatedNoiseSession?,
+    private val withAuthenticatedSession: (
+        String,
+        AuthenticatedNoiseSession,
+        () -> Boolean
+    ) -> Boolean,
+    private val store: AuthenticatedPeerStateStore,
+    private val localStateProvider: () -> AuthenticatedPeerState,
+    private val applyAuthenticatedState: (String, ByteArray, AuthenticatedPeerState) -> Unit,
+    private val sendState: (String, AuthenticatedPeerState, AuthenticatedNoiseSession) -> Boolean,
+    private val onResolution: (String) -> Unit,
+    private val proofTimeoutMs: Long = 5_000L
+) {
+    private data class SessionState(
+        val authenticatedSession: AuthenticatedNoiseSession,
+        val fingerprint: String,
+        var status: AuthenticatedPeerStateStatus,
+        var echoSent: Boolean,
+        var timeoutJob: Job? = null
+    )
+
+    private val lock = Any()
+    private val sessions = ConcurrentHashMap<String, SessionState>()
+
+    fun onSessionAuthenticated(
+        peerID: String,
+        authenticatedRemoteStatic: ByteArray,
+        authenticatedSessionToken: ByteArray
+    ) {
+        if (!NoisePeerIdentity.matchesClaimedPeerID(peerID, authenticatedRemoteStatic)) return
+        if (authenticatedSessionToken.size != 32 ||
+            authenticatedSessionToken.all { it == 0.toByte() }
+        ) return
+        val authenticatedSession = AuthenticatedNoiseSession(
+            authenticatedRemoteStatic.copyOf(),
+            authenticatedSessionToken.copyOf()
+        )
+        ensureSession(peerID, authenticatedSession)
+    }
+
+    /** Install one watchdog/exchange for this exact live generation, without resetting it. */
+    private fun ensureSession(
+        peerID: String,
+        authenticatedSession: AuthenticatedNoiseSession
+    ): SessionState? {
+        val authenticatedRemoteStatic = authenticatedSession.remoteStaticKey
+        if (!NoisePeerIdentity.matchesClaimedPeerID(peerID, authenticatedRemoteStatic)) return null
+        if (authenticatedSession.sessionToken.size != 32 ||
+            authenticatedSession.sessionToken.all { it == 0.toByte() }
+        ) return null
+        // Ignore a delayed callback or policy snapshot if a later generation is already active.
+        if (authenticatedSessionProvider(peerID) != authenticatedSession) return null
+        val session = SessionState(
+            authenticatedSession = authenticatedSession,
+            fingerprint = fingerprint(authenticatedRemoteStatic),
+            status = AuthenticatedPeerStateStatus.Awaiting,
+            echoSent = false
+        )
+        val installed = withAuthenticatedSession(peerID, authenticatedSession) {
+            synchronized(lock) {
+                val existing = sessions[peerID]
+                if (existing?.authenticatedSession == authenticatedSession) {
+                    return@synchronized false
+                }
+                sessions.put(peerID, session)?.timeoutJob?.cancel()
+                true
+            }
+        }
+        if (!installed) return synchronized(lock) { sessions[peerID] }
+
+        // Emit for every authenticated generation/rekey. Failure does not relax the watchdog.
+        runCatching { sendState(peerID, localStateProvider(), authenticatedSession) }
+
+        val timeout = scope.launch {
+            delay(proofTimeoutMs)
+            val resolved = synchronized(lock) {
+                val current = sessions[peerID]
+                if (current !== session || current.status !is AuthenticatedPeerStateStatus.Awaiting) {
+                    false
+                } else {
+                    current.status = AuthenticatedPeerStateStatus.TimedOut
+                    true
+                }
+            }
+            if (resolved) onResolution(peerID)
+        }
+        synchronized(lock) {
+            if (sessions[peerID] === session && session.status is AuthenticatedPeerStateStatus.Awaiting) {
+                session.timeoutJob = timeout
+            } else {
+                timeout.cancel()
+            }
+        }
+        return session
+    }
+
+    /** Accept the first valid proof for this generation; repeated equal proofs are idempotent. */
+    fun receive(
+        peerID: String,
+        state: AuthenticatedPeerState,
+        decryptedSession: AuthenticatedNoiseSession
+    ): Boolean {
+        val remoteStatic = decryptedSession.remoteStaticKey
+        if (!NoisePeerIdentity.matchesClaimedPeerID(peerID, remoteStatic)) return false
+        if (decryptedSession.sessionToken.size != 32 ||
+            decryptedSession.sessionToken.all { it == 0.toByte() }
+        ) return false
+        val currentFingerprint = fingerprint(remoteStatic)
+
+        var shouldEcho = false
+        var echoSession: AuthenticatedNoiseSession? = null
+        val accepted = withAuthenticatedSession(peerID, decryptedSession) {
+            synchronized(lock) {
+                val current = sessions[peerID] ?: return@synchronized false
+                if (current.fingerprint != currentFingerprint ||
+                    current.authenticatedSession != decryptedSession
+                ) return@synchronized false
+                val proven = current.status as? AuthenticatedPeerStateStatus.Proven
+                if (proven != null) return@synchronized proven.state == state
+                try {
+                    // Persist before publishing the replacement Ed key in memory, so a restart
+                    // cannot reopen copied-static first-announce poisoning. The Noise manager
+                    // lease prevents this generation from being replaced during the transition.
+                    if (!store.persist(currentFingerprint, state) {
+                            // Publish while the persistence epoch lock is still held. A panic wipe
+                            // can therefore happen before both operations or after both, never between.
+                            applyAuthenticatedState(peerID, remoteStatic, state)
+                        }
+                    ) return@synchronized false
+                    current.timeoutJob?.cancel()
+                    current.status = AuthenticatedPeerStateStatus.Proven(state)
+                    if (!current.echoSent) {
+                        current.echoSent = true
+                        shouldEcho = true
+                        echoSession = current.authenticatedSession
+                    }
+                    true
+                } catch (_: Exception) {
+                    false
+                }
+            }
+        }
+        if (!accepted) return false
+        if (shouldEcho) {
+            val exactSession = echoSession ?: return false
+            runCatching { sendState(peerID, localStateProvider(), exactSession) }
+        }
+        onResolution(peerID)
+        return true
+    }
+
+    fun status(
+        peerID: String,
+        authenticatedSession: AuthenticatedNoiseSession
+    ): AuthenticatedPeerStateStatus {
+        ensureSession(peerID, authenticatedSession)
+        val currentFingerprint = fingerprint(authenticatedSession.remoteStaticKey)
+        return synchronized(lock) {
+            sessions[peerID]?.takeIf {
+                it.fingerprint == currentFingerprint &&
+                    it.authenticatedSession == authenticatedSession
+            }?.status
+                ?: AuthenticatedPeerStateStatus.Missing
+        }
+    }
+
+    fun persistedSigningKeyFor(noisePublicKey: ByteArray): ByteArray? {
+        if (noisePublicKey.size != 32) return null
+        return store.load(fingerprint(noisePublicKey))?.signingPublicKey?.copyOf()
+    }
+
+    fun isPrivateMediaPinned(peerID: String): Boolean {
+        val authenticatedSession = authenticatedSessionProvider(peerID) ?: return false
+        return store.isPrivateMediaPinned(fingerprint(authenticatedSession.remoteStaticKey))
+    }
+
+    fun clear(peerID: String) {
+        synchronized(lock) { sessions.remove(peerID)?.timeoutJob?.cancel() }
+    }
+
+    private fun fingerprint(publicKey: ByteArray): String =
+        MessageDigest.getInstance("SHA-256")
+            .digest(publicKey)
+            .joinToString("") { "%02x".format(it) }
+}

app/src/main/java/com/bitchat/android/mesh/BLEPacketPaddingPolicy.kt

@@ -0,0 +1,18 @@
+package com.bitchat.android.mesh
+
+import com.bitchat.android.protocol.MessageType
+
+/**
+ * iOS-compatible BLE padding policy.
+ *
+ * Keep this aligned with iOS BLEOutboundPacketPolicy.padsBLEFrame(for:):
+ * only Noise frames are padded over BLE.
+ */
+object BLEPacketPaddingPolicy {
+    fun shouldPadForBLE(type: UByte): Boolean {
+        return when (MessageType.fromValue(type)) {
+            MessageType.NOISE_ENCRYPTED, MessageType.NOISE_HANDSHAKE -> true
+            else -> false
+        }
+    }
+}

app/src/main/java/com/bitchat/android/mesh/BluetoothConnectionManager.kt

@@ -18,7 +18,7 @@ class BluetoothConnectionManager(
     private val context: Context, 
     private val myPeerID: String,
     private val fragmentManager: FragmentManager? = null
-) : PowerManagerDelegate {
+) {
     
     companion object {
         private const val TAG = "BluetoothConnectionManager"
@@ -30,7 +30,7 @@ class BluetoothConnectionManager(
     private val bluetoothAdapter: BluetoothAdapter? = bluetoothManager.adapter
     
     // Power management
-    private val powerManager = PowerManager(context.applicationContext)
+    private val powerManager = PowerManager.getInstance(context.applicationContext)
     
     // Coroutines
     private val connectionScope = CoroutineScope(Dispatchers.IO + SupervisorJob())
@@ -42,8 +42,12 @@ class BluetoothConnectionManager(
     
     // Delegate for component managers to call back to main manager
     private val componentDelegate = object : BluetoothConnectionManagerDelegate {
-        override fun onPacketReceived(packet: BitchatPacket, peerID: String, device: BluetoothDevice?) {
-            Log.d(TAG, "onPacketReceived: Packet received from ${device?.address} ($peerID)")
+        override fun onPacketReceived(
+            packet: BitchatPacket,
+            peerID: String,
+            device: BluetoothDevice?,
+            ingressLinkID: String
+        ) {
             device?.let { bluetoothDevice ->
                 // Get current RSSI for this device and update if available
                 val currentRSSI = connectionTracker.getBestRSSI(bluetoothDevice.address)
@@ -54,7 +58,7 @@ class BluetoothConnectionManager(
 
             if (peerID == myPeerID) return // Ignore messages from self
 
-            delegate?.onPacketReceived(packet, peerID, device)
+            delegate?.onPacketReceived(packet, peerID, device, ingressLinkID)
         }
         
         override fun onDeviceConnected(device: BluetoothDevice) {
@@ -63,8 +67,8 @@ class BluetoothConnectionManager(
             delegate?.onDeviceConnected(device)
         }
 
-        override fun onDeviceDisconnected(device: BluetoothDevice) {
-            delegate?.onDeviceDisconnected(device)
+        override fun onDeviceDisconnected(device: BluetoothDevice, linkID: String?, peerID: String?) {
+            delegate?.onDeviceDisconnected(device, linkID, peerID)
         }
         
         override fun onRSSIUpdated(deviceAddress: String, rssi: Int) {
@@ -88,22 +92,79 @@ class BluetoothConnectionManager(
     // Public property for address-peer mapping
     val addressPeerMap get() = connectionTracker.addressPeerMap
 
+    fun observePeerIfCurrent(deviceAddress: String, linkID: String, peerID: String): Boolean =
+        connectionTracker.observePeerIfCurrent(deviceAddress, linkID, peerID)
+
+    fun getCurrentLinkID(deviceAddress: String): String? =
+        connectionTracker.getCurrentLinkID(deviceAddress)
+
+    fun currentNdrTransportTarget(peerID: String): NdrTransportTarget? {
+        val deviceAddress = connectionTracker.addressPeerMap.entries
+            .firstOrNull { it.value == peerID }
+            ?.key
+            ?: return null
+        val linkID = connectionTracker.getCurrentLinkID(deviceAddress) ?: return null
+        return NdrTransportTarget(
+            endpointId = deviceAddress,
+            generationToken = linkID
+        )
+    }
+
+    private fun isBleTransportEnabled(): Boolean {
+        return try {
+            com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().bleEnabled.value
+        } catch (_: Exception) {
+            try { com.bitchat.android.ui.debug.DebugPreferenceManager.getBleEnabled(true) } catch (_: Exception) { true }
+        }
+    }
+
+    private fun isGattServerEnabled(): Boolean {
+        return isBleTransportEnabled() &&
+            (try { com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattServerEnabled.value } catch (_: Exception) { true })
+    }
+
+    private fun isGattClientEnabled(): Boolean {
+        return isBleTransportEnabled() &&
+            (try { com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattClientEnabled.value } catch (_: Exception) { true })
+    }
+
     init {
-        powerManager.delegate = this
+        connectionScope.launch {
+            var previousMode: PowerManager.PowerMode? = null
+            powerManager.profile.collect { profile ->
+                val modeChanged = previousMode != null && previousMode != profile.mode
+                previousMode = profile.mode
+                if (!isActive || !isBleTransportEnabled()) return@collect
+
+                if (modeChanged && isGattServerEnabled()) {
+                    serverManager.restartAdvertising()
+                }
+                clientManager.applyPowerProfile(profile)
+            }
+        }
         // Observe debug settings to enforce role state while active
         try {
             val dbg = com.bitchat.android.ui.debug.DebugSettingsManager.getInstance()
+            // Master transport enable/disable
+            connectionScope.launch {
+                dbg.bleEnabled.collect { enabled ->
+                    if (enabled) return@collect
+                    if (isActive) {
+                        disableTransport()
+                    }
+                }
+            }
             // Role enable/disable
             connectionScope.launch {
                 dbg.gattServerEnabled.collect { enabled ->
                     if (!isActive) return@collect
-                    if (enabled) startServer() else stopServer()
+                    if (enabled && isBleTransportEnabled()) startServer() else stopServer()
                 }
             }
             connectionScope.launch {
                 dbg.gattClientEnabled.collect { enabled ->
                     if (!isActive) return@collect
-                    if (enabled) startClient() else stopClient()
+                    if (enabled && isBleTransportEnabled()) startClient() else stopClient()
                 }
             }
             
@@ -145,10 +206,8 @@ class BluetoothConnectionManager(
                 
                 toEvict.forEach { conn ->
                     if (conn.isClient) {
-                        Log.d(TAG, "Evicting client ${conn.device.address}")
                         try { conn.gatt?.disconnect() } catch (_: Exception) { }
                     } else {
-                        Log.d(TAG, "Evicting server ${conn.device.address}")
                         serverManager.disconnectDevice(conn.device)
                     }
                 }
@@ -162,7 +221,11 @@ class BluetoothConnectionManager(
      * Start all Bluetooth services with power optimization
      */
     fun startServices(): Boolean {
-        Log.i(TAG, "Starting power-optimized Bluetooth services...")
+        if (!isBleTransportEnabled()) {
+            Log.i(TAG, "BLE transport disabled by debug settings; not starting Bluetooth services")
+            disableTransport()
+            return false
+        }
         
         if (!permissionManager.hasBluetoothPermissions()) {
             Log.e(TAG, "Missing Bluetooth permissions")
@@ -176,7 +239,6 @@ class BluetoothConnectionManager(
         
         try {
             isActive = true
-            Log.d(TAG, "ConnectionManager activated (permissions and adapter OK)")
 
         // set the adapter's name to our 8-character peerID for iOS privacy, TODO: Make this configurable
         // try {
@@ -197,9 +259,8 @@ class BluetoothConnectionManager(
                 powerManager.start()
                 
                 // Start server/client based on debug settings
-                val dbg = try { com.bitchat.android.ui.debug.DebugSettingsManager.getInstance() } catch (_: Exception) { null }
-                val startServer = dbg?.gattServerEnabled?.value != false
-                val startClient = dbg?.gattClientEnabled?.value != false
+                val startServer = isGattServerEnabled()
+                val startClient = isGattClientEnabled()
 
                 if (startServer) {
                     if (!serverManager.start()) {
@@ -207,7 +268,6 @@ class BluetoothConnectionManager(
                         this@BluetoothConnectionManager.isActive = false
                         return@launch
                     }
-                    Log.d(TAG, "GATT Server started")
                 } else {
                     Log.i(TAG, "GATT Server disabled by debug settings; not starting")
                 }
@@ -218,7 +278,6 @@ class BluetoothConnectionManager(
                         this@BluetoothConnectionManager.isActive = false
                         return@launch
                     }
-                    Log.d(TAG, "GATT Client started")
                 } else {
                     Log.i(TAG, "GATT Client disabled by debug settings; not starting")
                 }
@@ -234,24 +293,31 @@ class BluetoothConnectionManager(
             return false
         }
     }
+
+    /**
+     * Disable BLE without cancelling this manager's coroutine scope, so it can be re-enabled.
+     */
+    fun disableTransport() {
+        Log.i(TAG, "Disabling BLE transport")
+        isActive = false
+        connectionScope.launch {
+            clientManager.stop()
+            serverManager.stop()
+            connectionTracker.stop()
+        }
+    }
     
     /**
      * Stop all Bluetooth services with proper cleanup
      */
     fun stopServices() {
-        Log.i(TAG, "Stopping power-optimized Bluetooth services")
-        
         isActive = false
-        
+
         connectionScope.launch {
-            Log.d(TAG, "Stopping client/server and power components...")
             // Stop component managers
             clientManager.stop()
             serverManager.stop()
             
-            // Stop power manager
-            powerManager.stop()
-            
             // Stop connection tracker
             connectionTracker.stop()
             
@@ -267,21 +333,27 @@ class BluetoothConnectionManager(
      * Returns false if its coroutine scope has been cancelled.
      */
     fun isReusable(): Boolean {
-        val active = connectionScope.isActive
-        if (!active) {
-            Log.d(TAG, "BluetoothConnectionManager isReusable=false (scope cancelled)")
-        }
-        return active
+        return connectionScope.isActive
     }
     
     /**
      * Broadcast packet to connected devices with connection limit enforcement
      * Automatically fragments large packets to fit within BLE MTU limits
      */
-    fun broadcastPacket(routed: RoutedPacket) {
-        if (!isActive) return
-        
-        packetBroadcaster.broadcastPacket(
+    fun broadcastPacket(routed: RoutedPacket): Boolean {
+        if (!isActive || !isBleTransportEnabled()) return false
+
+        return packetBroadcaster.broadcastPacket(
+            routed,
+            serverManager.getGattServer(),
+            serverManager.getCharacteristic()
+        )
+    }
+
+    suspend fun broadcastControlPacketAndAwaitAcceptance(routed: RoutedPacket): Boolean {
+        if (!isActive || !isBleTransportEnabled()) return false
+
+        return packetBroadcaster.broadcastControlPacketAndAwaitAcceptance(
             routed,
             serverManager.getGattServer(),
             serverManager.getCharacteristic()
@@ -289,7 +361,7 @@ class BluetoothConnectionManager(
     }
 
     fun sendToPeer(peerID: String, routed: RoutedPacket): Boolean {
-        if (!isActive) return false
+        if (!isActive || !isBleTransportEnabled()) return false
         return packetBroadcaster.sendToPeer(
             peerID,
             routed,
@@ -306,7 +378,7 @@ class BluetoothConnectionManager(
      * Send a packet directly to a specific peer, without broadcasting to others.
      */
     fun sendPacketToPeer(peerID: String, packet: BitchatPacket): Boolean {
-        if (!isActive) return false
+        if (!isActive || !isBleTransportEnabled()) return false
         return packetBroadcaster.sendPacketToPeer(
             RoutedPacket(packet),
             peerID,
@@ -314,12 +386,51 @@ class BluetoothConnectionManager(
             serverManager.getCharacteristic()
         )
     }
+
+    fun sendPacketToLink(deviceAddress: String, linkID: String, packet: BitchatPacket): Boolean {
+        if (!isActive || !isBleTransportEnabled()) return false
+        return packetBroadcaster.sendPacketToLink(
+            RoutedPacket(packet),
+            deviceAddress,
+            linkID,
+            serverManager.getGattServer(),
+            serverManager.getCharacteristic()
+        )
+    }
+
+    fun sendPacketToNdrTargetConfirmed(
+        target: NdrTransportTarget,
+        routed: RoutedPacket,
+        preflight: () -> Boolean,
+        completion: (Boolean) -> Unit
+    ) {
+        val linkID = target.generationToken as? String
+        if (!isActive || !isBleTransportEnabled() || linkID == null) {
+            completion(false)
+            return
+        }
+        packetBroadcaster.sendPacketToLinkConfirmed(
+            routed = routed,
+            deviceAddress = target.endpointId,
+            linkID = linkID,
+            gattServer = serverManager.getGattServer(),
+            characteristic = serverManager.getCharacteristic(),
+            preflight = preflight,
+            completion = completion
+        )
+    }
     
 
     // Expose role controls for debug UI
-    fun startServer() { connectionScope.launch { serverManager.start() } }
+    fun startServer() {
+        if (!isActive || !isBleTransportEnabled()) return
+        connectionScope.launch { if (isGattServerEnabled()) serverManager.start() }
+    }
     fun stopServer() { connectionScope.launch { serverManager.stop() } }
-    fun startClient() { connectionScope.launch { clientManager.start() } }
+    fun startClient() {
+        if (!isActive || !isBleTransportEnabled()) return
+        connectionScope.launch { if (isGattClientEnabled()) clientManager.start() }
+    }
     fun stopClient() { connectionScope.launch { clientManager.stop() } }
 
     // Inject nickname resolver for broadcaster logs
@@ -347,7 +458,10 @@ class BluetoothConnectionManager(
     /**
      * Public: connect/disconnect helpers for debug UI
      */
-    fun connectToAddress(address: String): Boolean = clientManager.connectToAddress(address)
+    fun connectToAddress(address: String): Boolean {
+        if (!isActive || !isBleTransportEnabled()) return false
+        return clientManager.connectToAddress(address)
+    }
     fun disconnectAddress(address: String) { connectionTracker.disconnectDevice(address) }
 
 
@@ -358,10 +472,10 @@ class BluetoothConnectionManager(
             clientManager.stop()
             serverManager.stop()
             delay(200)
-            if (isActive) {
+            if (isActive && isBleTransportEnabled()) {
                 // Restart managers if service is active
-                serverManager.start()
-                clientManager.start()
+                if (isGattServerEnabled()) serverManager.start()
+                if (isGattClientEnabled()) clientManager.start()
             }
         }
     }
@@ -390,55 +504,19 @@ class BluetoothConnectionManager(
         }
     }
     
-    // MARK: - PowerManagerDelegate Implementation
-    
-    override fun onPowerModeChanged(newMode: PowerManager.PowerMode) {
-        Log.i(TAG, "Power mode changed to: $newMode")
-        
-        connectionScope.launch {
-            // Avoid rapid scan restarts by checking if we need to change scan behavior
-            val wasUsingDutyCycle = powerManager.shouldUseDutyCycle()
-            
-            // Update advertising with new power settings if server enabled
-            val serverEnabled = try { com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattServerEnabled.value } catch (_: Exception) { true }
-            if (serverEnabled) {
-                serverManager.restartAdvertising()
-            } else {
-                serverManager.stop()
-            }
-            
-            // Only restart scanning if the duty cycle behavior changed
-            val nowUsingDutyCycle = powerManager.shouldUseDutyCycle()
-            if (wasUsingDutyCycle != nowUsingDutyCycle) {
-                Log.d(TAG, "Duty cycle behavior changed (${wasUsingDutyCycle} -> ${nowUsingDutyCycle}), restarting scan")
-                val clientEnabled = try { com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattClientEnabled.value } catch (_: Exception) { true }
-                if (clientEnabled) {
-                    clientManager.restartScanning()
-                } else {
-                    clientManager.stop()
-                }
-            } else {
-                Log.d(TAG, "Duty cycle behavior unchanged, keeping existing scan state")
-            }
-            
-            // Enforce connection limits
-            enforceStrictLimits()
-        }
-    }
-    
-    override fun onScanStateChanged(shouldScan: Boolean) {
-        clientManager.onScanStateChanged(shouldScan)
-    }
-    
-    // MARK: - Private Implementation - All moved to component managers
 }
 
 /**
  * Delegate interface for Bluetooth connection manager callbacks
  */
 interface BluetoothConnectionManagerDelegate {
-    fun onPacketReceived(packet: BitchatPacket, peerID: String, device: BluetoothDevice?)
+    fun onPacketReceived(
+        packet: BitchatPacket,
+        peerID: String,
+        device: BluetoothDevice?,
+        ingressLinkID: String
+    )
     fun onDeviceConnected(device: BluetoothDevice)
-    fun onDeviceDisconnected(device: BluetoothDevice)
+    fun onDeviceDisconnected(device: BluetoothDevice, linkID: String?, peerID: String?)
     fun onRSSIUpdated(deviceAddress: String, rssi: Int)
 }

app/src/main/java/com/bitchat/android/mesh/BluetoothConnectionTracker.kt

@@ -9,6 +9,7 @@ import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.CopyOnWriteArrayList
+import java.util.UUID
 
 /**
  * Tracks all Bluetooth connections and handles cleanup
@@ -16,28 +17,22 @@ import java.util.concurrent.CopyOnWriteArrayList
 class BluetoothConnectionTracker(
     private val connectionScope: CoroutineScope,
     private val powerManager: PowerManager
-) {
+) : MeshConnectionTracker(connectionScope, TAG) {
     
     companion object {
         private const val TAG = "BluetoothConnectionTracker"
-        private const val CONNECTION_RETRY_DELAY = com.bitchat.android.util.AppConstants.Mesh.CONNECTION_RETRY_DELAY_MS
-        private const val MAX_CONNECTION_ATTEMPTS = com.bitchat.android.util.AppConstants.Mesh.MAX_CONNECTION_ATTEMPTS
         private const val CLEANUP_DELAY = com.bitchat.android.util.AppConstants.Mesh.CONNECTION_CLEANUP_DELAY_MS
-        private const val CLEANUP_INTERVAL = com.bitchat.android.util.AppConstants.Mesh.CONNECTION_CLEANUP_INTERVAL_MS // 30 seconds
     }
     
     // Connection tracking - reduced memory footprint
     private val connectedDevices = ConcurrentHashMap<String, DeviceConnection>()
     private val subscribedDevices = CopyOnWriteArrayList<BluetoothDevice>()
     val addressPeerMap = ConcurrentHashMap<String, String>()
+    // Track whether we have seen the first ANNOUNCE on a given device connection
+    private val firstAnnounceSeen = ConcurrentHashMap<String, Boolean>()
     // RSSI tracking from scan results (for devices we discover but may connect as servers)
     private val scanRSSI = ConcurrentHashMap<String, Int>()
-    
-    // Connection attempt tracking with automatic cleanup
-    private val pendingConnections = ConcurrentHashMap<String, ConnectionAttempt>()
-    
-    // State management
-    private var isActive = false
+    private val connectionStateLock = Any()
     
     /**
      * Consolidated device connection information
@@ -49,55 +44,67 @@ class BluetoothConnectionTracker(
         val rssi: Int = Int.MIN_VALUE,
         val isClient: Boolean = false,
         val connectedAt: Long = System.currentTimeMillis(),
-        val peerID: String? = null
+        val peerID: String? = null,
+        /** Unique to this GATT connection, even when Android reuses the device address. */
+        val linkID: String = UUID.randomUUID().toString()
     )
     
-    /**
-     * Connection attempt tracking with automatic expiry
-     */
-    data class ConnectionAttempt(
-        val attempts: Int,
-        val lastAttempt: Long = System.currentTimeMillis()
-    ) {
-        fun isExpired(): Boolean = 
-            System.currentTimeMillis() - lastAttempt > CONNECTION_RETRY_DELAY * 2
-        
-        fun shouldRetry(): Boolean = 
-            attempts < MAX_CONNECTION_ATTEMPTS && 
-            System.currentTimeMillis() - lastAttempt > CONNECTION_RETRY_DELAY
+    override fun start() {
+        super.start()
     }
     
-    /**
-     * Start the connection tracker
-     */
-    fun start() {
-        isActive = true
-        startPeriodicCleanup()
-    }
-    
-    /**
-     * Stop the connection tracker
-     */
-    fun stop() {
-        isActive = false
+    override fun stop() {
+        super.stop()
         cleanupAllConnections()
         clearAllConnections()
     }
+
+    // Abstract implementations
+    override fun isConnected(id: String): Boolean = connectedDevices.containsKey(id)
+    
+    override fun disconnect(id: String) {
+        connectedDevices[id]?.gatt?.let {
+            try { it.disconnect() } catch (_: Exception) { }
+        }
+        cleanupDeviceConnection(id)
+        Log.d(TAG, "Requested disconnect for $id")
+    }
+
+    override fun getConnectionCount(): Int = connectedDevices.size
     
     /**
      * Add a device connection
      */
     fun addDeviceConnection(deviceAddress: String, deviceConn: DeviceConnection) {
         Log.d(TAG, "Tracker: Adding device connection for $deviceAddress (isClient: ${deviceConn.isClient}")
-        connectedDevices[deviceAddress] = deviceConn
-        pendingConnections.remove(deviceAddress)
+        synchronized(connectionStateLock) {
+            connectedDevices[deviceAddress] = deviceConn
+            // A route observation belongs to this GATT generation, not its reusable address.
+            addressPeerMap.remove(deviceAddress)
+        }
+        removePendingConnection(deviceAddress)
+        // Mark as awaiting first ANNOUNCE on this connection
+        firstAnnounceSeen[deviceAddress] = false
     }
     
     /**
      * Update a device connection
      */
     fun updateDeviceConnection(deviceAddress: String, deviceConn: DeviceConnection) {
-        connectedDevices[deviceAddress] = deviceConn
+        synchronized(connectionStateLock) {
+            connectedDevices[deviceAddress] = deviceConn
+        }
+    }
+
+    fun updateDeviceConnectionIfCurrent(
+        deviceAddress: String,
+        linkID: String,
+        update: (DeviceConnection) -> DeviceConnection
+    ): Boolean = synchronized(connectionStateLock) {
+        val current = connectedDevices[deviceAddress] ?: return@synchronized false
+        if (current.linkID != linkID) return@synchronized false
+        connectedDevices[deviceAddress] = update(current)
+        true
     }
     
     /**
@@ -106,6 +113,23 @@ class BluetoothConnectionTracker(
     fun getDeviceConnection(deviceAddress: String): DeviceConnection? {
         return connectedDevices[deviceAddress]
     }
+
+    fun getCurrentLinkID(deviceAddress: String): String? =
+        connectedDevices[deviceAddress]?.linkID
+
+    /**
+     * Records that the current link delivered a validated, non-relayed ANNOUNCE for [peerID].
+     *
+     * A peer may be reachable over more than one link, so observing one link must not discard the
+     * other observations. The link generation check prevents a late packet from an old GATT
+     * connection from being applied to a replacement connection that reused the same address.
+     */
+    fun observePeerIfCurrent(deviceAddress: String, linkID: String, peerID: String): Boolean =
+        synchronized(connectionStateLock) {
+            if (connectedDevices[deviceAddress]?.linkID != linkID) return@synchronized false
+            addressPeerMap[deviceAddress] = peerID
+            true
+        }
     
     /**
      * Get all connected devices
@@ -163,9 +187,7 @@ class BluetoothConnectionTracker(
     /**
      * Check if device is already connected
      */
-    fun isDeviceConnected(deviceAddress: String): Boolean {
-        return connectedDevices.containsKey(deviceAddress)
-    }
+    fun isDeviceConnected(deviceAddress: String): Boolean = isConnected(deviceAddress)
 
     /**
      * Check if a peer is already connected (by PeerID)
@@ -175,63 +197,15 @@ class BluetoothConnectionTracker(
         return connectedDevices.values.any { it.peerID == peerID }
     }
     
-    /**
-     * Check if connection attempt is allowed
-     */
-    fun isConnectionAttemptAllowed(deviceAddress: String): Boolean {
-        val existingAttempt = pendingConnections[deviceAddress]
-        return existingAttempt?.let { 
-            it.isExpired() || it.shouldRetry() 
-        } ?: true
-    }
-    
-    /**
-     * Add a pending connection attempt
-     */
-    fun addPendingConnection(deviceAddress: String): Boolean {
-        Log.d(TAG, "Tracker: Adding pending connection for $deviceAddress")
-        synchronized(pendingConnections) {
-            // Double-check inside synchronized block
-            val currentAttempt = pendingConnections[deviceAddress]
-            if (currentAttempt != null && !currentAttempt.isExpired() && !currentAttempt.shouldRetry()) {
-                Log.d(TAG, "Tracker: Connection attempt already in progress for $deviceAddress")
-                return false
-            }
-            if (currentAttempt != null) {
-                Log.d(TAG, "Tracker: current attempt: $currentAttempt")
-            }
-            
-            // Update connection attempt atomically
-            // If the previous attempt window expired, reset backoff to 1; otherwise increment
-            val attempts = if (currentAttempt?.isExpired() == true) 1 else (currentAttempt?.attempts ?: 0) + 1
-            pendingConnections[deviceAddress] = ConnectionAttempt(attempts)
-            Log.d(TAG, "Tracker: Added pending connection for $deviceAddress (attempts: $attempts)")
-            return true
-        }
-    }
-    
     /**
      * Disconnect a specific device (by MAC address)
      */
-    fun disconnectDevice(deviceAddress: String) {
-        connectedDevices[deviceAddress]?.gatt?.let {
-            try { it.disconnect() } catch (_: Exception) { }
-        }
-        cleanupDeviceConnection(deviceAddress)
-        Log.d(TAG, "Requested disconnect for $deviceAddress")
-    }
-
-    /**
-     * Remove a pending connection
-     */
-    fun removePendingConnection(deviceAddress: String) {
-        pendingConnections.remove(deviceAddress)
-    }
+    fun disconnectDevice(deviceAddress: String) = disconnect(deviceAddress)
     
     /**
      * Get connected device count
      */
-    fun getConnectedDeviceCount(): Int = connectedDevices.size
+    fun getConnectedDeviceCount(): Int = getConnectionCount()
     
     /**
      * Check if connection limit is reached
@@ -297,12 +271,33 @@ class BluetoothConnectionTracker(
      * Clean up a specific device connection
      */
     fun cleanupDeviceConnection(deviceAddress: String) {
-        connectedDevices.remove(deviceAddress)?.let { deviceConn ->
+        synchronized(connectionStateLock) {
+            connectedDevices.remove(deviceAddress)
             subscribedDevices.removeAll { it.address == deviceAddress }
             addressPeerMap.remove(deviceAddress)
+            firstAnnounceSeen.remove(deviceAddress)
         }
         Log.d(TAG, "Cleaned up device connection for $deviceAddress")
     }
+
+    fun cleanupDeviceConnectionIfCurrent(
+        deviceAddress: String,
+        expectedLinkID: String
+    ): Boolean = synchronized(connectionStateLock) {
+        val current = connectedDevices[deviceAddress] ?: return@synchronized false
+        if (current.linkID != expectedLinkID) {
+            return@synchronized false
+        }
+        if (connectedDevices.remove(deviceAddress, current)) {
+            subscribedDevices.removeAll { it.address == deviceAddress }
+            addressPeerMap.remove(deviceAddress)
+            firstAnnounceSeen.remove(deviceAddress)
+            Log.d(TAG, "Cleaned up device connection for $deviceAddress")
+            true
+        } else {
+            false
+        }
+    }
     
     /**
      * Clean up all connections
@@ -334,36 +329,21 @@ class BluetoothConnectionTracker(
         addressPeerMap.clear()
         pendingConnections.clear()
         scanRSSI.clear()
+        firstAnnounceSeen.clear()
     }
 
     /**
-     * Start periodic cleanup of expired connections
+     * Mark that we have received the first ANNOUNCE over this device connection.
      */
-    private fun startPeriodicCleanup() {
-        connectionScope.launch {
-            while (isActive) {
-                delay(CLEANUP_INTERVAL)
-                
-                if (!isActive) break
-                
-                try {
-                    // Clean up expired pending connections
-                    val expiredConnections = pendingConnections.filter { it.value.isExpired() }
-                    expiredConnections.keys.forEach { pendingConnections.remove(it) }
-                    
-                    // Log cleanup if any
-                    if (expiredConnections.isNotEmpty()) {
-                        Log.d(TAG, "Cleaned up ${expiredConnections.size} expired connection attempts")
-                    }
-                    
-                    // Log current state
-                    Log.d(TAG, "Periodic cleanup: ${connectedDevices.size} connections, ${pendingConnections.size} pending")
-                    
-                } catch (e: Exception) {
-                    Log.w(TAG, "Error in periodic cleanup: ${e.message}")
-                }
-            }
-        }
+    fun noteAnnounceReceived(deviceAddress: String) {
+        firstAnnounceSeen[deviceAddress] = true
+    }
+
+    /**
+     * Check whether the first ANNOUNCE has been seen for a device connection.
+     */
+    fun hasSeenFirstAnnounce(deviceAddress: String): Boolean {
+        return firstAnnounceSeen[deviceAddress] == true
     }
     
     /**

app/src/main/java/com/bitchat/android/mesh/BluetoothGattClientManager.kt

@@ -32,6 +32,11 @@ class BluetoothGattClientManager(
     
     companion object {
         private const val TAG = "BluetoothGattClientManager"
+        // Self-healing scan recovery tuning
+        private const val SCAN_RETRY_BASE_MS = 3_000L          // base backoff for transient scan failures
+        private const val SCAN_MAX_RETRY_DELAY_MS = 30_000L    // cap on backoff delay
+        private const val SCAN_WATCHDOG_INTERVAL_MS = 30_000L  // how often to verify the scanner is alive
+        private const val SCAN_STALE_RESULT_MS = 120_000L      // force a scan restart if no results for this long
     }
     
     // Core Bluetooth components
@@ -39,11 +44,28 @@ class BluetoothGattClientManager(
         context.getSystemService(Context.BLUETOOTH_SERVICE) as BluetoothManager
     private val bluetoothAdapter: BluetoothAdapter? = bluetoothManager.adapter
     private val bleScanner: BluetoothLeScanner? = bluetoothAdapter?.bluetoothLeScanner
+
+    private fun isBleTransportEnabled(): Boolean {
+        return try {
+            com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().bleEnabled.value
+        } catch (_: Exception) {
+            try { com.bitchat.android.ui.debug.DebugPreferenceManager.getBleEnabled(true) } catch (_: Exception) { true }
+        }
+    }
+
+    private fun isClientRoleEnabled(): Boolean {
+        return isBleTransportEnabled() &&
+            (try { com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattClientEnabled.value } catch (_: Exception) { true })
+    }
     
     /**
      * Public: Connect to a device by MAC address (for debug UI)
      */
     fun connectToAddress(deviceAddress: String): Boolean {
+        if (!isClientRoleEnabled()) {
+            Log.d(TAG, "connectToAddress skipped: BLE client disabled")
+            return false
+        }
         val device = bluetoothAdapter?.getRemoteDevice(deviceAddress)
         return if (device != null) {
             val rssi = connectionTracker.getBestRSSI(deviceAddress) ?: -50
@@ -61,8 +83,17 @@ class BluetoothGattClientManager(
     // Scan rate limiting to prevent "scanning too frequently" errors
     private var lastScanStartTime = 0L
     private var lastScanStopTime = 0L
-    private var isCurrentlyScanning = false
+    @Volatile private var isCurrentlyScanning = false
     private val scanRateLimit = 5000L // Minimum 5 seconds between scan start attempts
+
+    // Self-healing scan state.
+    // scanningDesired distinguishes "we want to be scanning but it isn't running" (a fault to recover
+    // from) from "scanning is intentionally off" (e.g. duty-cycle OFF window or client disabled).
+    @Volatile private var scanningDesired = false
+    @Volatile private var lastScanResultTime = 0L
+    private var scanRetryCount = 0
+    private var scanWatchdogJob: Job? = null
+    private var scanDutyCycleJob: Job? = null
     
     // RSSI monitoring state
     private var rssiMonitoringJob: Job? = null
@@ -75,15 +106,12 @@ class BluetoothGattClientManager(
      */
     fun start(): Boolean {
         // Respect debug setting
-        try {
-            if (!com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattClientEnabled.value) {
-                Log.i(TAG, "Client start skipped: GATT Client disabled in debug settings")
-                return false
-            }
-        } catch (_: Exception) { }
+        if (!isClientRoleEnabled()) {
+            Log.i(TAG, "Client start skipped: BLE/GATT Client disabled in debug settings")
+            return false
+        }
 
         if (isActive) {
-            Log.d(TAG, "GATT client already active; start is a no-op")
             return true
         }
         if (!permissionManager.hasBluetoothPermissions()) {
@@ -104,12 +132,7 @@ class BluetoothGattClientManager(
         isActive = true
         
         connectionScope.launch {
-            if (powerManager.shouldUseDutyCycle()) {
-                Log.i(TAG, "Using power-aware duty cycling")
-            } else {
-                startScanning()
-            }
-            
+            applyPowerProfile(powerManager.profile.value)
             // Start RSSI monitoring
             startRSSIMonitoring()
         }
@@ -121,11 +144,14 @@ class BluetoothGattClientManager(
      * Stop client manager
      */
     fun stop() {
+        scanningDesired = false
+        scanDutyCycleJob?.cancel()
+        scanDutyCycleJob = null
+        stopScanWatchdog()
         if (!isActive) {
             // Idempotent stop
             stopScanning()
             stopRSSIMonitoring()
-            Log.i(TAG, "GATT client manager stopped (already inactive)")
             return
         }
 
@@ -150,7 +176,8 @@ class BluetoothGattClientManager(
      * Handle scan state changes from power manager
      */
     fun onScanStateChanged(shouldScan: Boolean) {
-        val enabled = try { com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattClientEnabled.value } catch (_: Exception) { true }
+        val enabled = isClientRoleEnabled()
+        scanningDesired = shouldScan && enabled
         if (shouldScan && enabled) {
             startScanning()
         } else {
@@ -170,16 +197,15 @@ class BluetoothGattClientManager(
                     val connectedDevices = connectionTracker.getConnectedDevices()
                     connectedDevices.values.filter { it.isClient && it.gatt != null }.forEach { deviceConn ->
                         try {
-                            Log.d(TAG, "Requesting RSSI from ${deviceConn.device.address}")
                             deviceConn.gatt?.readRemoteRssi()
                         } catch (e: Exception) {
-                            Log.w(TAG, "Failed to request RSSI from ${deviceConn.device.address}: ${e.message}")
+                            Log.d(TAG, "Failed to request RSSI from ${deviceConn.device.address}: ${e.message}")
                         }
                     }
-                    delay(AppConstants.Mesh.RSSI_UPDATE_INTERVAL_MS)
+                    delay(powerManager.profile.value.ble.rssiPollIntervalMs)
                 } catch (e: Exception) {
                     Log.w(TAG, "Error in RSSI monitoring: ${e.message}")
-                    delay(AppConstants.Mesh.RSSI_UPDATE_INTERVAL_MS)
+                    delay(powerManager.profile.value.ble.rssiPollIntervalMs)
                 }
             }
         }
@@ -199,25 +225,24 @@ class BluetoothGattClientManager(
     @Suppress("DEPRECATION")
     private fun startScanning() {
         // Respect debug setting
-        val enabled = try { com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattClientEnabled.value } catch (_: Exception) { true }
+        val enabled = isClientRoleEnabled()
         if (!permissionManager.hasBluetoothPermissions() || bleScanner == null || !isActive || !enabled) return
         
         // Rate limit scan starts to prevent "scanning too frequently" errors
         val currentTime = System.currentTimeMillis()
         if (isCurrentlyScanning) {
-            Log.d(TAG, "Scan already in progress, skipping start request")
             return
         }
-        
+
         val timeSinceLastStart = currentTime - lastScanStartTime
         if (timeSinceLastStart < scanRateLimit) {
             val remainingWait = scanRateLimit - timeSinceLastStart
-            Log.w(TAG, "Scan rate limited: need to wait ${remainingWait}ms before starting scan")
+            Log.d(TAG, "Scan rate limited: waiting ${remainingWait}ms before starting scan")
             
             // Schedule delayed scan start
             connectionScope.launch {
                 delay(remainingWait)
-                if (isActive && !isCurrentlyScanning) {
+                if (isActive && !isCurrentlyScanning && isClientRoleEnabled()) {
                     startScanning()
                 }
             }
@@ -228,46 +253,52 @@ class BluetoothGattClientManager(
             .setServiceUuid(ParcelUuid(AppConstants.Mesh.Gatt.SERVICE_UUID))
             .build()
         
-        val scanFilters = listOf(scanFilter) 
-        
-        Log.d(TAG, "Starting BLE scan with target service UUID: ${AppConstants.Mesh.Gatt.SERVICE_UUID}")
-        
+        val scanFilters = listOf(scanFilter)
+
         scanCallback = object : ScanCallback() {
             override fun onScanResult(callbackType: Int, result: ScanResult) {
-                // Log.d(TAG, "Scan result received: ${result.device.address}")
                 handleScanResult(result)
             }
-            
+
             override fun onBatchScanResults(results: MutableList<ScanResult>) {
-                Log.d(TAG, "Batch scan results received: ${results.size} devices")
                 results.forEach { result ->
                     handleScanResult(result)
                 }
             }
-            
+
             override fun onScanFailed(errorCode: Int) {
-                Log.e(TAG, "Scan failed: $errorCode")
                 isCurrentlyScanning = false
                 lastScanStopTime = System.currentTimeMillis()
-                
+
                 when (errorCode) {
-                    1 -> Log.e(TAG, "SCAN_FAILED_ALREADY_STARTED")
-                    2 -> Log.e(TAG, "SCAN_FAILED_APPLICATION_REGISTRATION_FAILED") 
-                    3 -> Log.e(TAG, "SCAN_FAILED_INTERNAL_ERROR")
-                    4 -> Log.e(TAG, "SCAN_FAILED_FEATURE_UNSUPPORTED")
-                    5 -> Log.e(TAG, "SCAN_FAILED_OUT_OF_HARDWARE_RESOURCES")
-                    6 -> {
-                        Log.e(TAG, "SCAN_FAILED_SCANNING_TOO_FREQUENTLY")
-                        Log.w(TAG, "Scan failed due to rate limiting - will retry after delay")
-                        connectionScope.launch {
-                            delay(10000) // Wait 10 seconds before retrying
-                            if (isActive) {
-                                startScanning()
-                            }
-                        }
+                    1 -> {
+                        // Already started: the stack thinks a scan is running. Re-arm from a clean
+                        // state so we don't stay wedged (stop then restart with backoff).
+                        stopScanning()
+                        scheduleScanRestart("already-started", SCAN_RETRY_BASE_MS)
+                    }
+                    2 -> {
+                        // App registration failed: common transient stack fault. Previously had NO
+                        // retry, which left discovery dead until a manual BLE toggle.
+                        scheduleScanRestart("registration-failed", SCAN_RETRY_BASE_MS)
+                    }
+                    3 -> {
+                        scheduleScanRestart("internal-error", SCAN_RETRY_BASE_MS)
+                    }
+                    4 -> Unit // permanent: don't retry
+                    5 -> {
+                        // Out of hardware resources: back off longer so other scanners/connections
+                        // can free up before we try again.
+                        scheduleScanRestart("out-of-resources", SCAN_RETRY_BASE_MS * 3)
+                    }
+                    6 -> {
+                        scheduleScanRestart("too-frequently", 10_000L)
+                    }
+                    else -> {
+                        scheduleScanRestart("unknown-$errorCode", SCAN_RETRY_BASE_MS)
                     }
-                    else -> Log.e(TAG, "Unknown scan failure code: $errorCode")
                 }
+                Log.e(TAG, "Scan failed: $errorCode")
             }
         }
         
@@ -276,7 +307,7 @@ class BluetoothGattClientManager(
             isCurrentlyScanning = true
             
             bleScanner.startScan(scanFilters, powerManager.getScanSettings(), scanCallback)
-            Log.d(TAG, "BLE scan started successfully")
+            Log.i(TAG, "BLE scan started")
         } catch (e: Exception) {
             Log.e(TAG, "Exception starting scan: ${e.message}")
             isCurrentlyScanning = false
@@ -292,9 +323,9 @@ class BluetoothGattClientManager(
         
         if (isCurrentlyScanning) {
             try {
-                scanCallback?.let { 
+                scanCallback?.let {
                     bleScanner.stopScan(it)
-                    Log.d(TAG, "BLE scan stopped successfully")
+                    Log.i(TAG, "BLE scan stopped")
                 }
             } catch (e: Exception) {
                 Log.w(TAG, "Error stopping scan: ${e.message}")
@@ -304,6 +335,76 @@ class BluetoothGattClientManager(
             lastScanStopTime = System.currentTimeMillis()
         }
     }
+
+    /**
+     * Schedule a scan restart with incremental backoff. Used to recover from transient scan
+     * failures that previously had no retry path (codes 2/3/5), leaving discovery dead until a
+     * manual BLE toggle.
+     */
+    private fun scheduleScanRestart(reason: String, baseDelayMs: Long) {
+        scanRetryCount++
+        val delayMs = (baseDelayMs * scanRetryCount).coerceAtMost(SCAN_MAX_RETRY_DELAY_MS)
+        Log.w(TAG, "Scheduling scan restart in ${delayMs}ms (attempt $scanRetryCount, reason=$reason)")
+        connectionScope.launch {
+            delay(delayMs)
+            if (isActive && scanningDesired && isClientRoleEnabled() && !isCurrentlyScanning) {
+                startScanning()
+            }
+        }
+    }
+
+    /**
+     * Periodic watchdog that self-heals the scanner. Android can stop a scan without ever invoking
+     * onScanFailed (internal stack reset, Doze, background throttling), which leaves the app
+     * believing it is scanning while it is not. This re-arms the scanner in those cases.
+     */
+    private fun startScanWatchdog() {
+        scanWatchdogJob?.cancel()
+        scanWatchdogJob = connectionScope.launch {
+            while (isActive) {
+                delay(SCAN_WATCHDOG_INTERVAL_MS)
+                try {
+                    // Only act when we are supposed to be scanning. Honors duty-cycle OFF windows
+                    // and the client-disabled state via scanningDesired.
+                    if (!isActive || !scanningDesired || !isClientRoleEnabled()) continue
+                    if (!permissionManager.hasBluetoothPermissions() || bluetoothAdapter?.isEnabled != true) continue
+
+                    val now = System.currentTimeMillis()
+                    if (!isCurrentlyScanning) {
+                        Log.w(TAG, "Watchdog: scan desired but not running -> restarting scan")
+                        startScanning()
+                    } else if (lastScanResultTime > 0L &&
+                        now - lastScanResultTime > SCAN_STALE_RESULT_MS &&
+                        now - lastScanStartTime > SCAN_STALE_RESULT_MS) {
+                        // We think we're scanning but haven't seen anything for a long time. The scan
+                        // may have silently died (flag wedged true). Force a clean re-arm.
+                        Log.w(TAG, "Watchdog: no scan results for ${(now - lastScanResultTime) / 1000}s -> forcing scan restart")
+                        forceRestartScan()
+                    }
+                } catch (e: Exception) {
+                    Log.w(TAG, "Scan watchdog error: ${e.message}")
+                }
+            }
+        }
+    }
+
+    private fun stopScanWatchdog() {
+        scanWatchdogJob?.cancel()
+        scanWatchdogJob = null
+    }
+
+    /**
+     * Force a clean scan restart, clearing a possibly-wedged isCurrentlyScanning flag.
+     */
+    private fun forceRestartScan() {
+        stopScanning()
+        connectionScope.launch {
+            delay(500)
+            if (isActive && scanningDesired && isClientRoleEnabled() && !isCurrentlyScanning) {
+                startScanning()
+            }
+        }
+    }
     
     /**
      * Handle scan result and initiate connection if appropriate
@@ -320,6 +421,10 @@ class BluetoothGattClientManager(
             return
         }
 
+        // Proof the scanner is alive and finding our network: refresh liveness and clear backoff.
+        lastScanResultTime = System.currentTimeMillis()
+        scanRetryCount = 0
+
         // Try to extract peerID from Service Data (if available) for stable identity
         val serviceData = scanRecord?.getServiceData(ParcelUuid(AppConstants.Mesh.Gatt.SERVICE_UUID))
         val peerID = if (serviceData != null && serviceData.size >= 8) {
@@ -329,15 +434,11 @@ class BluetoothGattClientManager(
         }
 
         if (peerID != null) {
-            // Log.v(TAG, "Found peerID $peerID in scan record for $deviceAddress")
             if (connectionTracker.isPeerConnected(peerID)) {
-                 Log.d(TAG, "Deduplication: Peer $peerID is already connected (ignoring $deviceAddress)")
                  return
             }
         }
 
-        // Log.d(TAG, "Received scan result from $deviceAddress - already connected: ${connectionTracker.isDeviceConnected(deviceAddress)}")
-        
         // Store RSSI from scan results for later use (especially for server connections)
         connectionTracker.updateScanRSSI(deviceAddress, rssi)
 
@@ -355,7 +456,6 @@ class BluetoothGattClientManager(
         
         // Power-aware RSSI filtering
         if (rssi < powerManager.getRSSIThreshold()) {
-            Log.d(TAG, "Skipping device $deviceAddress due to weak signal: $rssi < ${powerManager.getRSSIThreshold()}")
             // Even if we skip connecting, still publish scan result to debug UI
             try {
                 DebugSettingsManager.getInstance().addScanResult(
@@ -377,7 +477,6 @@ class BluetoothGattClientManager(
         
         // Check if connection attempt is allowed
         if (!connectionTracker.isConnectionAttemptAllowed(deviceAddress)) {
-            Log.d(TAG, "Connection to $deviceAddress not allowed due to recent attempts")
             return
         }
         
@@ -387,7 +486,6 @@ class BluetoothGattClientManager(
         val maxClient = dbg?.maxClientConnections?.value ?: maxOverall
 
         if (!connectionTracker.canConnectAsClient(maxOverall, maxClient)) {
-            Log.d(TAG, "Client connection limit reached (overall: $maxOverall, client: $maxClient)")
             return
         }
         
@@ -402,17 +500,16 @@ class BluetoothGattClientManager(
      */
     @Suppress("DEPRECATION")
     private fun connectToDevice(device: BluetoothDevice, rssi: Int, peerID: String? = null) {
+        if (!isClientRoleEnabled()) return
         if (!permissionManager.hasBluetoothPermissions()) return
 
         val deviceAddress = device.address
-        Log.i(TAG, "Connecting to bitchat device: $deviceAddress (peerID: $peerID)")
-        
+        val linkID = UUID.randomUUID().toString()
+        Log.d(TAG, "Connecting to bitchat device: $deviceAddress (peerID: $peerID)")
+
         val gattCallback = object : BluetoothGattCallback() {
             override fun onConnectionStateChange(gatt: BluetoothGatt, status: Int, newState: Int) {
-                Log.d(TAG, "Client: Connection state change - Device: $deviceAddress, Status: $status, NewState: $newState")
-
                 if (newState == BluetoothProfile.STATE_CONNECTED && status == BluetoothGatt.GATT_SUCCESS) {
-                    Log.i(TAG, "Client: Successfully connected to $deviceAddress. Requesting MTU...")
                     // Request a larger MTU. Must be done before any data transfer.
                     connectionScope.launch {
                         delay(200) // A small delay can improve reliability of MTU request.
@@ -420,17 +517,16 @@ class BluetoothGattClientManager(
                     }
                 } else if (newState == BluetoothProfile.STATE_DISCONNECTED) {
                     if (status != BluetoothGatt.GATT_SUCCESS) {
-                        Log.w(TAG, "Client: Disconnected from $deviceAddress with error status $status")
-                        if (status == 147) {
-                            Log.e(TAG, "Client: Connection establishment failed (status 147) for $deviceAddress")
-                        }
+                        Log.w(TAG, "Disconnected from $deviceAddress with error status $status (client)")
                     } else {
-                        Log.d(TAG, "Client: Cleanly disconnected from $deviceAddress")
-                        connectionTracker.cleanupDeviceConnection(deviceAddress)
+                        Log.i(TAG, "Disconnected from $deviceAddress (client)")
                     }
+                    // Capture the observed peer before cleanup drops the address mapping.
+                    val disconnectedPeerID = connectionTracker.addressPeerMap[deviceAddress]
+                    connectionTracker.cleanupDeviceConnectionIfCurrent(deviceAddress, linkID)
 
                     // Notify higher layers about device disconnection to update direct flags
-                    delegate?.onDeviceDisconnected(gatt.device)
+                    delegate?.onDeviceDisconnected(gatt.device, linkID, disconnectedPeerID)
 
                     connectionScope.launch {
                         delay(500) // CLEANUP_DELAY
@@ -445,18 +541,16 @@ class BluetoothGattClientManager(
             
             override fun onMtuChanged(gatt: BluetoothGatt, mtu: Int, status: Int) {
                 val deviceAddress = gatt.device.address
-                Log.i(TAG, "Client: MTU changed for $deviceAddress to $mtu with status $status")
 
                 if (status == BluetoothGatt.GATT_SUCCESS) {
-                    Log.i(TAG, "MTU successfully negotiated for $deviceAddress. Discovering services.")
-                    
                     // Now that MTU is set, connection is fully ready.
                     val deviceConn = BluetoothConnectionTracker.DeviceConnection(
                         device = gatt.device,
                         gatt = gatt,
                         rssi = rssi,
                         isClient = true,
-                        peerID = peerID // Store the peerID discovered during scan
+                        peerID = peerID, // Store the peerID discovered during scan
+                        linkID = linkID
                     )
                     connectionTracker.addDeviceConnection(deviceAddress, deviceConn)
                     
@@ -475,10 +569,12 @@ class BluetoothGattClientManager(
                     if (service != null) {
                         val characteristic = service.getCharacteristic(AppConstants.Mesh.Gatt.CHARACTERISTIC_UUID)
                         if (characteristic != null) {
-                            connectionTracker.getDeviceConnection(deviceAddress)?.let { deviceConn ->
-                                val updatedConn = deviceConn.copy(characteristic = characteristic)
-                                connectionTracker.updateDeviceConnection(deviceAddress, updatedConn)
-                                Log.d(TAG, "Client: Updated device connection with characteristic for $deviceAddress")
+                            if (connectionTracker.updateDeviceConnectionIfCurrent(
+                                    deviceAddress,
+                                    linkID
+                                ) { it.copy(characteristic = characteristic) }
+                            ) {
+                                // Characteristic stored on the current device connection
                             }
                             
                             gatt.setCharacteristicNotification(characteristic, true)
@@ -489,7 +585,7 @@ class BluetoothGattClientManager(
                                 
                                 connectionScope.launch {
                                     delay(200)
-                                    Log.i(TAG, "Client: Connection setup complete for $deviceAddress")
+                                    Log.i(TAG, "Connected to $deviceAddress (client)")
                                     delegate?.onDeviceConnected(device)
                                 }
                             } else {
@@ -512,43 +608,34 @@ class BluetoothGattClientManager(
             
             override fun onCharacteristicChanged(gatt: BluetoothGatt, characteristic: BluetoothGattCharacteristic) {
                 val value = characteristic.value
-                Log.i(TAG, "Client: Received packet from ${gatt.device.address}, size: ${value.size} bytes")
                 val packet = BitchatPacket.fromBinaryData(value)
                 if (packet != null) {
                     val peerID = packet.senderID.take(8).toByteArray().joinToString("") { "%02x".format(it) }
-                    Log.d(TAG, "Client: Parsed packet type ${packet.type} from $peerID")
-                    delegate?.onPacketReceived(packet, peerID, gatt.device)
+                    delegate?.onPacketReceived(packet, peerID, gatt.device, linkID)
                 } else {
-                    Log.w(TAG, "Client: Failed to parse packet from ${gatt.device.address}, size: ${value.size} bytes")
-                    Log.w(TAG, "Client: Packet data: ${value.joinToString(" ") { "%02x".format(it) }}")
+                    Log.d(TAG, "Failed to parse packet from ${gatt.device.address}, size: ${value.size} bytes")
                 }
             }
             
             override fun onReadRemoteRssi(gatt: BluetoothGatt, rssi: Int, status: Int) {
                 val deviceAddress = gatt.device.address
                 if (status == BluetoothGatt.GATT_SUCCESS) {
-                    Log.d(TAG, "Client: RSSI updated for $deviceAddress: $rssi dBm")
-                    
                     // Update the connection tracker with new RSSI value
-                    connectionTracker.getDeviceConnection(deviceAddress)?.let { deviceConn ->
-                        val updatedConn = deviceConn.copy(rssi = rssi)
-                        connectionTracker.updateDeviceConnection(deviceAddress, updatedConn)
+                    connectionTracker.updateDeviceConnectionIfCurrent(deviceAddress, linkID) {
+                        it.copy(rssi = rssi)
                     }
                 } else {
-                    Log.w(TAG, "Client: Failed to read RSSI for $deviceAddress, status: $status")
+                    Log.d(TAG, "Failed to read RSSI for $deviceAddress, status: $status")
                 }
             }
         }
         
         try {
-            Log.d(TAG, "Client: Attempting GATT connection to $deviceAddress with autoConnect=false")
             val gatt = device.connectGatt(context, false, gattCallback, BluetoothDevice.TRANSPORT_LE)
             if (gatt == null) {
                 Log.e(TAG, "connectGatt returned null for $deviceAddress")
                 // keep the pending connection so we can avoid too many reconnections attempts, TODO: needs testing
                 // connectionTracker.removePendingConnection(deviceAddress)
-            } else {
-                Log.d(TAG, "Client: GATT connection initiated successfully for $deviceAddress")
             }
         } catch (e: Exception) {
             Log.e(TAG, "Client: Exception connecting to $deviceAddress: ${e.message}")
@@ -562,19 +649,43 @@ class BluetoothGattClientManager(
      */
     fun restartScanning() {
         // Respect debug setting
-        val enabled = try { com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattClientEnabled.value } catch (_: Exception) { true }
+        val enabled = isClientRoleEnabled()
         if (!isActive || !enabled) return
         
         connectionScope.launch {
             stopScanning()
             delay(1000) // Extra delay to avoid rate limiting
-            
-            if (powerManager.shouldUseDutyCycle()) {
-                Log.i(TAG, "Switching to duty cycle scanning mode")
-                // Duty cycle will handle scanning
-            } else {
-                Log.i(TAG, "Switching to continuous scanning mode")
-                startScanning()
+            applyPowerProfile(powerManager.profile.value)
+        }
+    }
+
+    /**
+     * Apply the current process-wide profile without ever disabling background discovery.
+     */
+    fun applyPowerProfile(profile: PowerManager.RuntimePerformanceProfile) {
+        scanDutyCycleJob?.cancel()
+        scanDutyCycleJob = null
+        if (!isActive || !isClientRoleEnabled()) {
+            onScanStateChanged(false)
+            return
+        }
+
+        if (profile.ble.continuousScan) {
+            startScanWatchdog()
+            onScanStateChanged(true)
+            return
+        }
+
+        // Duty-cycled scans are re-armed every window, so the continuous-scan watchdog would only
+        // create background wakeups during intentional OFF periods.
+        stopScanWatchdog()
+        scanDutyCycleJob = connectionScope.launch {
+            while (isActive && isClientRoleEnabled()) {
+                onScanStateChanged(true)
+                delay(profile.ble.scanOnMs)
+                if (!isActive || !isClientRoleEnabled()) break
+                onScanStateChanged(false)
+                delay(profile.ble.scanOffMs)
             }
         }
     }

app/src/main/java/com/bitchat/android/mesh/BluetoothGattServerManager.kt

@@ -14,6 +14,7 @@ import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
 import java.util.*
+import java.util.concurrent.ConcurrentHashMap
 
 /**
  * Manages GATT server operations, advertising, and server-side connections
@@ -30,6 +31,9 @@ class BluetoothGattServerManager(
     
     companion object {
         private const val TAG = "BluetoothGattServerManager"
+        // Self-healing advertising recovery tuning
+        private const val ADVERTISE_RETRY_BASE_MS = 3_000L      // base backoff for transient advertise failures
+        private const val ADVERTISE_MAX_RETRY_DELAY_MS = 30_000L // cap on backoff delay
     }
     
     // Core Bluetooth components
@@ -40,12 +44,27 @@ class BluetoothGattServerManager(
     
     // GATT server for peripheral mode
     private var gattServer: BluetoothGattServer? = null
+    private val serverLinkIDs = ConcurrentHashMap<String, String>()
     private var characteristic: BluetoothGattCharacteristic? = null
     private var advertiseCallback: AdvertiseCallback? = null
+    private var advertiseRetryCount = 0
     
     // State management
     private var isActive = false
 
+    private fun isBleTransportEnabled(): Boolean {
+        return try {
+            com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().bleEnabled.value
+        } catch (_: Exception) {
+            try { com.bitchat.android.ui.debug.DebugPreferenceManager.getBleEnabled(true) } catch (_: Exception) { true }
+        }
+    }
+
+    private fun isServerRoleEnabled(): Boolean {
+        return isBleTransportEnabled() &&
+            (try { com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattServerEnabled.value } catch (_: Exception) { true })
+    }
+
     /**
      * Disconnect a specific device (used by ConnectionManager to enforce overall limits)
      */
@@ -62,15 +81,12 @@ class BluetoothGattServerManager(
      */
     fun start(): Boolean {
         // Respect debug setting
-        try {
-            if (!com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattServerEnabled.value) {
-                Log.i(TAG, "Server start skipped: GATT Server disabled in debug settings")
-                return false
-            }
-        } catch (_: Exception) { }
+        if (!isServerRoleEnabled()) {
+            Log.i(TAG, "Server start skipped: BLE/GATT Server disabled in debug settings")
+            return false
+        }
 
         if (isActive) {
-            Log.d(TAG, "GATT server already active; start is a no-op")
             return true
         }
         if (!permissionManager.hasBluetoothPermissions()) {
@@ -109,7 +125,7 @@ class BluetoothGattServerManager(
             // Ensure server is closed if present
             gattServer?.close()
             gattServer = null
-            Log.i(TAG, "GATT server stopped (already inactive)")
+            serverLinkIDs.clear()
             return
         }
 
@@ -130,6 +146,7 @@ class BluetoothGattServerManager(
             // Close GATT server
             gattServer?.close()
             gattServer = null
+            serverLinkIDs.clear()
             
             Log.i(TAG, "GATT server stopped")
         }
@@ -156,13 +173,14 @@ class BluetoothGattServerManager(
             override fun onConnectionStateChange(device: BluetoothDevice, status: Int, newState: Int) {
                 // Guard against callbacks after service shutdown
                 if (!isActive) {
-                    Log.d(TAG, "Server: Ignoring connection state change after shutdown")
                     return
                 }
-                
+
                 when (newState) {
                     BluetoothProfile.STATE_CONNECTED -> {
-                        Log.i(TAG, "Server: Device connected ${device.address}")
+                        Log.i(TAG, "Connected to ${device.address} (server)")
+                        val linkID = UUID.randomUUID().toString()
+                        serverLinkIDs[device.address] = linkID
                         
                         // Get best available RSSI (scan RSSI for server connections)
                         val rssi = connectionTracker.getBestRSSI(device.address) ?: Int.MIN_VALUE
@@ -170,7 +188,8 @@ class BluetoothGattServerManager(
                         val deviceConn = BluetoothConnectionTracker.DeviceConnection(
                             device = device,
                             rssi = rssi,
-                            isClient = false
+                            isClient = false,
+                            linkID = linkID
                         )
                         connectionTracker.addDeviceConnection(device.address, deviceConn)
 
@@ -182,10 +201,15 @@ class BluetoothGattServerManager(
                         }
                     }
                     BluetoothProfile.STATE_DISCONNECTED -> {
-                        Log.i(TAG, "Server: Device disconnected ${device.address}")
-                        connectionTracker.cleanupDeviceConnection(device.address)
+                        Log.i(TAG, "Disconnected from ${device.address} (server)")
+                        val linkID = serverLinkIDs.remove(device.address)
+                        // Capture the observed peer before cleanup drops the address mapping.
+                        val disconnectedPeerID = connectionTracker.addressPeerMap[device.address]
+                        if (linkID != null) {
+                            connectionTracker.cleanupDeviceConnectionIfCurrent(device.address, linkID)
+                        }
                         // Notify delegate about device disconnection so higher layers can update direct flags
-                        delegate?.onDeviceDisconnected(device)
+                        delegate?.onDeviceDisconnected(device, linkID, disconnectedPeerID)
                     }
                 }
             }
@@ -193,13 +217,10 @@ class BluetoothGattServerManager(
             override fun onServiceAdded(status: Int, service: BluetoothGattService) {
                 // Guard against callbacks after service shutdown
                 if (!isActive) {
-                    Log.d(TAG, "Server: Ignoring service added callback after shutdown")
                     return
                 }
-                
-                if (status == BluetoothGatt.GATT_SUCCESS) {
-                    Log.d(TAG, "Server: Service added successfully: ${service.uuid}")
-                } else {
+
+                if (status != BluetoothGatt.GATT_SUCCESS) {
                     Log.e(TAG, "Server: Failed to add service: ${service.uuid}, status: $status")
                 }
             }
@@ -215,20 +236,30 @@ class BluetoothGattServerManager(
             ) {
                 // Guard against callbacks after service shutdown
                 if (!isActive) {
-                    Log.d(TAG, "Server: Ignoring characteristic write after shutdown")
                     return
                 }
-                
+
                 if (characteristic.uuid == AppConstants.Mesh.Gatt.CHARACTERISTIC_UUID) {
-                    Log.i(TAG, "Server: Received packet from ${device.address}, size: ${value.size} bytes")
+                    val linkID = serverLinkIDs[device.address]
+                    if (linkID == null) {
+                        Log.d(TAG, "Server: Dropping packet from stale connection ${device.address}")
+                        if (responseNeeded) {
+                            gattServer?.sendResponse(
+                                device,
+                                requestId,
+                                BluetoothGatt.GATT_FAILURE,
+                                0,
+                                null
+                            )
+                        }
+                        return
+                    }
                     val packet = BitchatPacket.fromBinaryData(value)
                     if (packet != null) {
                         val peerID = packet.senderID.take(8).toByteArray().joinToString("") { "%02x".format(it) }
-                        Log.d(TAG, "Server: Parsed packet type ${packet.type} from $peerID")
-                        delegate?.onPacketReceived(packet, peerID, device)
+                        delegate?.onPacketReceived(packet, peerID, device, linkID)
                     } else {
-                        Log.w(TAG, "Server: Failed to parse packet from ${device.address}, size: ${value.size} bytes")
-                        Log.w(TAG, "Server: Packet data: ${value.joinToString(" ") { "%02x".format(it) }}")
+                        Log.d(TAG, "Server: Failed to parse packet from ${device.address}, size: ${value.size} bytes")
                     }
                     
                     if (responseNeeded) {
@@ -248,14 +279,12 @@ class BluetoothGattServerManager(
             ) {
                 // Guard against callbacks after service shutdown
                 if (!isActive) {
-                    Log.d(TAG, "Server: Ignoring descriptor write after shutdown")
                     return
                 }
-                
+
                 if (BluetoothGattDescriptor.ENABLE_NOTIFICATION_VALUE.contentEquals(value)) {
                     connectionTracker.addSubscribedDevice(device)
 
-                    Log.d(TAG, "Server: Connection setup complete for ${device.address}")
                     connectionScope.launch {
                         delay(100)
                         if (isActive) { // Check if still active
@@ -272,19 +301,17 @@ class BluetoothGattServerManager(
         
         // Proper cleanup sequencing to prevent race conditions
         gattServer?.let { server ->
-            Log.d(TAG, "Cleaning up existing GATT server")
             try {
                 server.close()
             } catch (e: Exception) {
                 Log.w(TAG, "Error closing existing GATT server: ${e.message}")
             }
         }
-        
+
         // Small delay to ensure cleanup is complete
         Thread.sleep(100)
-        
+
         if (!isActive) {
-            Log.d(TAG, "Service inactive, skipping GATT server creation")
             return
         }
         
@@ -322,7 +349,7 @@ class BluetoothGattServerManager(
     @Suppress("DEPRECATION")
     private fun startAdvertising() {
         // Respect debug setting
-        val enabled = try { com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattServerEnabled.value } catch (_: Exception) { true }
+        val enabled = isServerRoleEnabled()
 
         // Guard conditions – never throw here to avoid crashing the app from a background coroutine
         if (!permissionManager.hasBluetoothPermissions()) {
@@ -334,11 +361,10 @@ class BluetoothGattServerManager(
             return
         }
         if (!isActive) {
-            Log.d(TAG, "Not starting advertising: manager not active")
             return
         }
         if (!enabled) {
-            Log.i(TAG, "Not starting advertising: GATT Server disabled via debug settings")
+            Log.d(TAG, "Not starting advertising: GATT Server disabled via debug settings")
             return
         }
         if (bleAdvertiser == null) {
@@ -374,14 +400,31 @@ class BluetoothGattServerManager(
         
         advertiseCallback = object : AdvertiseCallback() {
             override fun onStartSuccess(settingsInEffect: AdvertiseSettings) {
+                advertiseRetryCount = 0
                 val mode = try {
                     powerManager.getPowerInfo().split("Current Mode: ")[1].split("\n")[0]
                 } catch (_: Exception) { "unknown" }
-                Log.i(TAG, "Advertising started (power mode: $mode) with stable ID: ${peerIDBytes.joinToString("") { "%02x".format(it) }}")
+                Log.i(TAG, "Advertising started (power mode: $mode)")
             }
-            
+
             override fun onStartFailure(errorCode: Int) {
                 Log.e(TAG, "Advertising failed: $errorCode")
+                // Previously this only logged, so if advertising failed this device became
+                // undiscoverable until a manual BLE toggle. Retry transient failures with backoff.
+                when (errorCode) {
+                    ADVERTISE_FAILED_ALREADY_STARTED -> Unit // already advertising, no retry
+                    ADVERTISE_FAILED_DATA_TOO_LARGE -> Unit // config issue, not retrying
+                    ADVERTISE_FAILED_FEATURE_UNSUPPORTED -> Unit // unsupported, not retrying
+                    ADVERTISE_FAILED_TOO_MANY_ADVERTISERS -> {
+                        scheduleAdvertiseRestart("too-many-advertisers")
+                    }
+                    ADVERTISE_FAILED_INTERNAL_ERROR -> {
+                        scheduleAdvertiseRestart("internal-error")
+                    }
+                    else -> {
+                        scheduleAdvertiseRestart("unknown-$errorCode")
+                    }
+                }
             }
         }
         
@@ -407,12 +450,29 @@ class BluetoothGattServerManager(
         }
     }
     
+    /**
+     * Schedule an advertising restart with incremental backoff after a transient failure.
+     */
+    private fun scheduleAdvertiseRestart(reason: String) {
+        advertiseRetryCount++
+        val delayMs = (ADVERTISE_RETRY_BASE_MS * advertiseRetryCount).coerceAtMost(ADVERTISE_MAX_RETRY_DELAY_MS)
+        Log.w(TAG, "Scheduling advertising restart in ${delayMs}ms (attempt $advertiseRetryCount, reason=$reason)")
+        connectionScope.launch {
+            delay(delayMs)
+            if (isActive && isServerRoleEnabled()) {
+                stopAdvertising()
+                delay(100)
+                startAdvertising()
+            }
+        }
+    }
+
     /**
      * Restart advertising (for power mode changes)
      */
     fun restartAdvertising() {
         // Respect debug setting
-        val enabled = try { com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().gattServerEnabled.value } catch (_: Exception) { true }
+        val enabled = isServerRoleEnabled()
         if (!isActive || !enabled) {
             stopAdvertising()
             return

app/src/main/java/com/bitchat/android/mesh/BluetoothPacketBroadcaster.kt

@@ -10,6 +10,8 @@ import com.bitchat.android.protocol.SpecialRecipients
 import com.bitchat.android.model.RoutedPacket
 import com.bitchat.android.protocol.MessageType
 import com.bitchat.android.util.toHexString
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CompletableDeferred
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
@@ -18,8 +20,6 @@ import kotlinx.coroutines.delay
 import kotlinx.coroutines.isActive
 import kotlinx.coroutines.launch
 import kotlinx.coroutines.channels.Channel
-import kotlinx.coroutines.Job
-import java.util.concurrent.ConcurrentHashMap
 import kotlinx.coroutines.channels.actor
 
 /**
@@ -112,25 +112,31 @@ class BluetoothPacketBroadcaster(
     private data class BroadcastRequest(
         val routed: RoutedPacket,
         val gattServer: BluetoothGattServer?,
-        val characteristic: BluetoothGattCharacteristic?
+        val characteristic: BluetoothGattCharacteristic?,
+        val accepted: CompletableDeferred<Boolean>? = null
     )
     
     // Actor scope for the broadcaster
     private val broadcasterScope = CoroutineScope(Dispatchers.IO + SupervisorJob())
-    private val transferJobs = ConcurrentHashMap<String, Job>()
+    private val fragmentingSender = FragmentingPacketSender(connectionScope, fragmentManager, TAG)
     
     // SERIALIZATION: Actor to serialize all broadcast operations
     @OptIn(kotlinx.coroutines.ObsoleteCoroutinesApi::class)
     private val broadcasterActor = broadcasterScope.actor<BroadcastRequest>(
         capacity = Channel.UNLIMITED
     ) {
-        Log.d(TAG, "🎭 Created packet broadcaster actor")
-        try {
-            for (request in channel) {
-                broadcastSinglePacketInternal(request.routed, request.gattServer, request.characteristic)
+        for (request in channel) {
+            val accepted = try {
+                broadcastSinglePacketInternal(
+                    request.routed,
+                    request.gattServer,
+                    request.characteristic
+                )
+            } catch (e: Exception) {
+                Log.w(TAG, "Broadcast request failed: ${e.message}")
+                false
             }
-        } finally {
-            Log.d(TAG, "🎭 Packet broadcaster actor terminated")
+            request.accepted?.complete(accepted)
         }
     }
     
@@ -138,72 +144,15 @@ class BluetoothPacketBroadcaster(
         routed: RoutedPacket,
         gattServer: BluetoothGattServer?,
         characteristic: BluetoothGattCharacteristic?
-    ) {
-        val packet = routed.packet
-        val isFile = packet.type == MessageType.FILE_TRANSFER.value
-        if (isFile) {
-            Log.d(TAG, "📤 Broadcasting FILE_TRANSFER: ${packet.payload.size} bytes")
-        }
-        // Prefer caller-provided transferId (e.g., for encrypted media), else derive for FILE_TRANSFER
-        val transferId = routed.transferId ?: (if (isFile) sha256Hex(packet.payload) else null)
-        // Check if we need to fragment
-        if (fragmentManager != null) {
-            val fragments = try {
-                fragmentManager.createFragments(packet)
-            } catch (e: Exception) {
-                Log.e(TAG, "❌ Fragment creation failed: ${e.message}", e)
-                if (isFile) {
-                    Log.e(TAG, "❌ File fragmentation failed for ${packet.payload.size} byte file")
-                }
-                return
-            }
-            if (fragments.size > 1) {
-                if (isFile) {
-                    Log.d(TAG, "🔀 File needs ${fragments.size} fragments")
-                }
-                Log.d(TAG, "Fragmenting packet into ${fragments.size} fragments")
-                if (transferId != null) {
-                    TransferProgressManager.start(transferId, fragments.size)
-                }
-                val job = connectionScope.launch {
-                    var sent = 0
-                    fragments.forEach { fragment ->
-                        if (!isActive) return@launch
-                        // If cancelled, stop sending remaining fragments
-                        if (transferId != null && transferJobs[transferId]?.isCancelled == true) return@launch
-                        broadcastSinglePacket(RoutedPacket(fragment, transferId = transferId), gattServer, characteristic)
-                        // 20ms delay between fragments
-                        delay(20)
-                        if (transferId != null) {
-                            sent += 1
-                            TransferProgressManager.progress(transferId, sent, fragments.size)
-                            if (sent == fragments.size) TransferProgressManager.complete(transferId, fragments.size)
-                        }
-                    }
-                }
-                if (transferId != null) {
-                    transferJobs[transferId] = job
-                    job.invokeOnCompletion { transferJobs.remove(transferId) }
-                }
-                return
-            }
-        }
-        
-        // Send single packet if no fragmentation needed
-        if (transferId != null) {
-            TransferProgressManager.start(transferId, 1)
-        }
-        broadcastSinglePacket(routed, gattServer, characteristic)
-        if (transferId != null) {
-            TransferProgressManager.progress(transferId, 1, 1)
-            TransferProgressManager.complete(transferId, 1)
+    ): Boolean {
+        return fragmentingSender.send(routed, "BLE broadcast") { packet ->
+            broadcastSinglePacket(packet, gattServer, characteristic)
+            true
         }
     }
 
     fun cancelTransfer(transferId: String): Boolean {
-        val job = transferJobs.remove(transferId) ?: return false
-        job.cancel()
-        return true
+        return fragmentingSender.cancelTransfer(transferId)
     }
 
     /**
@@ -215,18 +164,77 @@ class BluetoothPacketBroadcaster(
         targetPeerID: String,
         gattServer: BluetoothGattServer?,
         characteristic: BluetoothGattCharacteristic?
+    ): Boolean {
+        if (!hasPeerConnection(targetPeerID)) return false
+        return fragmentingSender.send(routed, "BLE peer ${targetPeerID.take(8)}") { packet ->
+            sendSinglePacketToPeer(packet, targetPeerID, gattServer, characteristic)
+        }
+    }
+
+    fun sendPacketToLink(
+        routed: RoutedPacket,
+        deviceAddress: String,
+        linkID: String,
+        gattServer: BluetoothGattServer?,
+        characteristic: BluetoothGattCharacteristic?
+    ): Boolean = fragmentingSender.send(routed, "BLE link $deviceAddress") { packet ->
+        val data = packet.packet.toBinaryData(
+            padding = BLEPacketPaddingPolicy.shouldPadForBLE(packet.packet.type)
+        ) ?: return@send false
+        val currentLink = connectionTracker.getDeviceConnection(deviceAddress)
+            ?.takeIf { it.linkID == linkID }
+            ?: return@send false
+        if (currentLink.isClient) {
+            return@send writeToDeviceConn(currentLink, data)
+        }
+        val serverTarget = connectionTracker.getSubscribedDevices()
+            .firstOrNull { it.address == deviceAddress }
+            ?: return@send false
+        notifyDevice(serverTarget, data, gattServer, characteristic)
+    }
+
+    fun sendPacketToLinkConfirmed(
+        routed: RoutedPacket,
+        deviceAddress: String,
+        linkID: String,
+        gattServer: BluetoothGattServer?,
+        characteristic: BluetoothGattCharacteristic?,
+        preflight: () -> Boolean,
+        completion: (Boolean) -> Unit
+    ) {
+        fragmentingSender.sendConfirmed(
+            routed = routed,
+            description = "BLE link $deviceAddress",
+            preflight = preflight,
+            sendSingle = sendSingle@{ single ->
+                val data = single.packet.toBinaryData(
+                    padding = BLEPacketPaddingPolicy.shouldPadForBLE(single.packet.type)
+                ) ?: return@sendSingle false
+                val currentLink = connectionTracker.getDeviceConnection(deviceAddress)
+                    ?.takeIf { it.linkID == linkID }
+                    ?: return@sendSingle false
+                if (currentLink.isClient) {
+                    return@sendSingle writeToDeviceConn(currentLink, data)
+                }
+                val serverTarget = connectionTracker.getSubscribedDevices()
+                    .firstOrNull { it.address == deviceAddress }
+                    ?: return@sendSingle false
+                notifyDevice(serverTarget, data, gattServer, characteristic)
+            },
+            completion = completion
+        )
+    }
+
+    private fun sendSinglePacketToPeer(
+        routed: RoutedPacket,
+        targetPeerID: String,
+        gattServer: BluetoothGattServer?,
+        characteristic: BluetoothGattCharacteristic?
     ): Boolean {
         val packet = routed.packet
-        val data = packet.toBinaryData() ?: return false
-        val isFile = packet.type == MessageType.FILE_TRANSFER.value
-        if (isFile) {
-            Log.d(TAG, "📤 Broadcasting FILE_TRANSFER: ${packet.payload.size} bytes")
-        }
-        // Prefer caller-provided transferId (e.g., for encrypted media), else derive for FILE_TRANSFER
-        val transferId = routed.transferId ?: (if (isFile) sha256Hex(packet.payload) else null)
-        if (transferId != null) {
-            TransferProgressManager.start(transferId, 1)
-        }
+        // iOS-compatible: Use selective padding policy for BLE
+        val padForBLE = BLEPacketPaddingPolicy.shouldPadForBLE(packet.type)
+        val data = packet.toBinaryData(padding = padForBLE) ?: return false
         val typeName = MessageType.fromValue(packet.type)?.name ?: packet.type.toString()
         val senderPeerID = routed.peerID ?: packet.senderID.toHexString()
         val incomingAddr = routed.relayAddress
@@ -241,10 +249,6 @@ class BluetoothPacketBroadcaster(
         if (serverTarget != null) {
             if (notifyDevice(serverTarget, data, gattServer, characteristic)) {
                 logPacketRelay(typeName, senderPeerID, senderNick, incomingPeer, incomingAddr, targetPeerID, serverTarget.address, packet.ttl, packet.version, routeInfo)
-                if (transferId != null) {
-                    TransferProgressManager.progress(transferId, 1, 1)
-                    TransferProgressManager.complete(transferId, 1)
-                }
                 return true
             }
         }
@@ -255,10 +259,6 @@ class BluetoothPacketBroadcaster(
         if (clientTarget != null) {
             if (writeToDeviceConn(clientTarget, data)) {
                 logPacketRelay(typeName, senderPeerID, senderNick, incomingPeer, incomingAddr, targetPeerID, clientTarget.device.address, packet.ttl, packet.version, routeInfo)
-                if (transferId != null) {
-                    TransferProgressManager.progress(transferId, 1, 1)
-                    TransferProgressManager.complete(transferId, 1)
-                }
                 return true
             }
         }
@@ -266,12 +266,6 @@ class BluetoothPacketBroadcaster(
         return false
     }
 
-    private fun sha256Hex(bytes: ByteArray): String = try {
-        val md = java.security.MessageDigest.getInstance("SHA-256")
-        md.update(bytes)
-        md.digest().joinToString("") { "%02x".format(it) }
-    } catch (_: Exception) { bytes.size.toString(16) }
-
     
     /**
      * Public entry point for broadcasting - submits request to actor for serialization
@@ -293,6 +287,29 @@ class BluetoothPacketBroadcaster(
         }
     }
 
+    /**
+     * Serializes a small control packet with normal BLE traffic and waits for the platform write
+     * API to accept at least one notification/write.
+     */
+    suspend fun broadcastControlPacketAndAwaitAcceptance(
+        routed: RoutedPacket,
+        gattServer: BluetoothGattServer?,
+        characteristic: BluetoothGattCharacteristic?
+    ): Boolean {
+        val accepted = CompletableDeferred<Boolean>()
+        return try {
+            broadcasterActor.send(
+                BroadcastRequest(routed, gattServer, characteristic, accepted)
+            )
+            accepted.await()
+        } catch (e: CancellationException) {
+            throw e
+        } catch (e: Exception) {
+            Log.w(TAG, "Failed to queue control packet: ${e.message}")
+            broadcastSinglePacketInternal(routed, gattServer, characteristic)
+        }
+    }
+
     /**
      * Targeted send to a specific peer (by peerID) if directly connected.
      * Returns true if sent to at least one matching connection.
@@ -303,34 +320,19 @@ class BluetoothPacketBroadcaster(
         gattServer: BluetoothGattServer?,
         characteristic: BluetoothGattCharacteristic?
     ): Boolean {
-        val packet = routed.packet
-        val data = packet.toBinaryData() ?: return false
-        val typeName = MessageType.fromValue(packet.type)?.name ?: packet.type.toString()
-        val senderPeerID = routed.peerID ?: packet.senderID.toHexString()
-        val incomingAddr = routed.relayAddress
-        val incomingPeer = incomingAddr?.let { connectionTracker.addressPeerMap[it] }
-        val senderNick = senderPeerID.let { pid -> nicknameResolver?.invoke(pid) }
-
-        // Try server-side connections first
-        val targetDevice = connectionTracker.getSubscribedDevices()
-            .firstOrNull { connectionTracker.addressPeerMap[it.address] == targetPeerID }
-        if (targetDevice != null) {
-            if (notifyDevice(targetDevice, data, gattServer, characteristic)) {
-                logPacketRelay(typeName, senderPeerID, senderNick, incomingPeer, incomingAddr, targetPeerID, targetDevice.address, packet.ttl)
-                return true
-            }
+        if (!hasPeerConnection(targetPeerID)) return false
+        return fragmentingSender.send(routed, "BLE peer ${targetPeerID.take(8)}") { packet ->
+            sendSinglePacketToPeer(packet, targetPeerID, gattServer, characteristic)
         }
+    }
 
-        // Try client-side connections next
-        val targetConn = connectionTracker.getConnectedDevices().values
-            .firstOrNull { connectionTracker.addressPeerMap[it.device.address] == targetPeerID }
-        if (targetConn != null) {
-            if (writeToDeviceConn(targetConn, data)) {
-                logPacketRelay(typeName, senderPeerID, senderNick, incomingPeer, incomingAddr, targetPeerID, targetConn.device.address, packet.ttl)
-                return true
-            }
-        }
-        return false
+    private fun hasPeerConnection(targetPeerID: String): Boolean {
+        val hasServerTarget = connectionTracker.getSubscribedDevices()
+            .any { connectionTracker.addressPeerMap[it.address] == targetPeerID }
+        if (hasServerTarget) return true
+
+        return connectionTracker.getConnectedDevices().values
+            .any { connectionTracker.addressPeerMap[it.device.address] == targetPeerID }
     }
     
     /**
@@ -340,9 +342,11 @@ class BluetoothPacketBroadcaster(
         routed: RoutedPacket,
         gattServer: BluetoothGattServer?,
         characteristic: BluetoothGattCharacteristic?
-    ) {
+    ): Boolean {
         val packet = routed.packet
-        val data = packet.toBinaryData() ?: return
+        // iOS-compatible: Use selective padding policy for BLE
+        val padForBLE = BLEPacketPaddingPolicy.shouldPadForBLE(packet.type)
+        val data = packet.toBinaryData(padding = padForBLE) ?: return false
         val typeName = MessageType.fromValue(packet.type)?.name ?: packet.type.toString()
         val senderPeerID = routed.peerID ?: packet.senderID.toHexString()
         val incomingAddr = routed.relayAddress
@@ -355,16 +359,14 @@ class BluetoothPacketBroadcaster(
         // If we are the sender and a source route is defined, we must send ONLY to the first hop.
         if (packet.senderID.toHexString() == myPeerID && !packet.route.isNullOrEmpty()) {
             val firstHop = packet.route!![0].toHexString()
-            Log.d(TAG, "Source Routing: Packet has explicit route, attempting to send to first hop: $firstHop")
 
             var sent = false
 
             // Try to find first hop in server connections (subscribedDevices)
             val serverTarget = connectionTracker.getSubscribedDevices()
                 .firstOrNull { connectionTracker.addressPeerMap[it.address] == firstHop }
-            
+
             if (serverTarget != null) {
-                Log.d(TAG, "Source Routing: sending directly to first hop (server conn) $firstHop: ${serverTarget.address}")
                 if (notifyDevice(serverTarget, data, gattServer, characteristic)) {
                     val toPeer = connectionTracker.addressPeerMap[serverTarget.address]
                     logPacketRelay(typeName, senderPeerID, senderNick, incomingPeer, incomingAddr, toPeer, serverTarget.address, packet.ttl, packet.version, routeInfo)
@@ -378,7 +380,6 @@ class BluetoothPacketBroadcaster(
                     .firstOrNull { connectionTracker.addressPeerMap[it.device.address] == firstHop }
                 
                 if (clientTarget != null) {
-                    Log.d(TAG, "Source Routing: sending directly to first hop (client conn) $firstHop: ${clientTarget.device.address}")
                     if (writeToDeviceConn(clientTarget, data)) {
                         val toPeer = connectionTracker.addressPeerMap[clientTarget.device.address]
                         logPacketRelay(typeName, senderPeerID, senderNick, incomingPeer, incomingAddr, toPeer, clientTarget.device.address, packet.ttl, packet.version, routeInfo)
@@ -387,9 +388,9 @@ class BluetoothPacketBroadcaster(
                 }
             }
 
-            if (sent) return
-            
-            Log.w(TAG, "Source Routing: First hop $firstHop not connected. Falling back to standard broadcast logic.")
+            if (sent) return true
+
+            Log.d(TAG, "Source Routing: First hop $firstHop not connected. Falling back to standard broadcast logic.")
         }
         
         if (packet.recipientID != SpecialRecipients.BROADCAST) {
@@ -401,11 +402,10 @@ class BluetoothPacketBroadcaster(
             
             // If found, send directly
             if (targetDevice != null) {
-                Log.d(TAG, "Send packet type ${packet.type} directly to target device for recipient $recipientID: ${targetDevice.address}")
                 if (notifyDevice(targetDevice, data, gattServer, characteristic)) {
                     val toPeer = connectionTracker.addressPeerMap[targetDevice.address]
                     logPacketRelay(typeName, senderPeerID, senderNick, incomingPeer, incomingAddr, toPeer, targetDevice.address, packet.ttl, packet.version, routeInfo)
-                    return  // Sent, no need to continue
+                    return true
                 }
             }
 
@@ -415,11 +415,10 @@ class BluetoothPacketBroadcaster(
             
             // If found, send directly
             if (targetDeviceConn != null) {
-                Log.d(TAG, "Send packet type ${packet.type} directly to target client connection for recipient $recipientID: ${targetDeviceConn.device.address}")
                 if (writeToDeviceConn(targetDeviceConn, data)) {
                     val toPeer = connectionTracker.addressPeerMap[targetDeviceConn.device.address]
                     logPacketRelay(typeName, senderPeerID, senderNick, incomingPeer, incomingAddr, toPeer, targetDeviceConn.device.address, packet.ttl, packet.version, routeInfo)
-                    return  // Sent, no need to continue
+                    return true
                 }
             }
         }
@@ -427,23 +426,21 @@ class BluetoothPacketBroadcaster(
         // Else, continue with broadcasting to all devices
         val subscribedDevices = connectionTracker.getSubscribedDevices()
         val connectedDevices = connectionTracker.getConnectedDevices()
-        
-        Log.i(TAG, "Broadcasting packet v${packet.version} type ${packet.type} to ${subscribedDevices.size} server + ${connectedDevices.size} client connections")
 
         val senderID = packet.senderID.toHexString()
-        
+        var accepted = false
+
         // Send to server connections (devices connected to our GATT server)
         subscribedDevices.forEach { device ->
             if (device.address == routed.relayAddress) {
-                Log.d(TAG, "Skipping broadcast to client back to relayer: ${device.address}")
                 return@forEach
             }
             if (connectionTracker.addressPeerMap[device.address] == senderID) {
-                Log.d(TAG, "Skipping broadcast to client back to sender: ${device.address}")
                 return@forEach
             }
             val sent = notifyDevice(device, data, gattServer, characteristic)
             if (sent) {
+                accepted = true
                 val toPeer = connectionTracker.addressPeerMap[device.address]
                 logPacketRelay(typeName, senderPeerID, senderNick, incomingPeer, incomingAddr, toPeer, device.address, packet.ttl, packet.version, routeInfo)
             }
@@ -453,20 +450,20 @@ class BluetoothPacketBroadcaster(
         connectedDevices.values.forEach { deviceConn ->
             if (deviceConn.isClient && deviceConn.gatt != null && deviceConn.characteristic != null) {
                 if (deviceConn.device.address == routed.relayAddress) {
-                    Log.d(TAG, "Skipping broadcast to server back to relayer: ${deviceConn.device.address}")
                     return@forEach
                 }
                 if (connectionTracker.addressPeerMap[deviceConn.device.address] == senderID) {
-                    Log.d(TAG, "Skipping roadcast to server back to sender: ${deviceConn.device.address}")
                     return@forEach
                 }
                 val sent = writeToDeviceConn(deviceConn, data)
                 if (sent) {
+                    accepted = true
                     val toPeer = connectionTracker.addressPeerMap[deviceConn.device.address]
                     logPacketRelay(typeName, senderPeerID, senderNick, incomingPeer, incomingAddr, toPeer, deviceConn.device.address, packet.ttl, packet.version, routeInfo)
                 }
             }
         }
+        return accepted
     }
     
     /**
@@ -534,14 +531,10 @@ class BluetoothPacketBroadcaster(
      * Shutdown the broadcaster actor gracefully
      */
     fun shutdown() {
-        Log.d(TAG, "Shutting down BluetoothPacketBroadcaster actor")
-        
         // Close the actor gracefully
         broadcasterActor.close()
-        
+
         // Cancel the broadcaster scope
         broadcasterScope.cancel()
-        
-        Log.d(TAG, "BluetoothPacketBroadcaster shutdown complete")
     }
 } 

app/src/main/java/com/bitchat/android/mesh/DirectLinkAnnouncementPolicy.kt

@@ -0,0 +1,26 @@
+package com.bitchat.android.mesh
+
+import com.bitchat.android.model.RoutedPacket
+
+/**
+ * Describes transport reachability learned from an already-validated ANNOUNCE.
+ *
+ * This is deliberately only a routing observation. Noise authenticates the peer independently and
+ * must not be restarted merely to associate the current transport link with that peer.
+ */
+internal object DirectLinkAnnouncementPolicy {
+    data class Observation(
+        val peerID: String,
+        val relayAddress: String,
+        val ingressLinkID: String
+    )
+
+    fun observationFor(routed: RoutedPacket, maxTtl: UByte): Observation? {
+        if (routed.packet.ttl != maxTtl) return null
+        return Observation(
+            peerID = routed.peerID ?: return null,
+            relayAddress = routed.relayAddress ?: return null,
+            ingressLinkID = routed.ingressLinkID ?: return null
+        )
+    }
+}

app/src/main/java/com/bitchat/android/mesh/FragmentManager.kt

@@ -51,101 +51,114 @@ class FragmentManager {
      * Create fragments from a large packet - 100% iOS Compatible
      * Matches iOS sendFragmentedPacket() implementation exactly
      */
-    fun createFragments(packet: BitchatPacket): List<BitchatPacket> {
+    /** Generic/public packets retain the full UInt16 fragment-count range. */
+    fun createFragments(packet: BitchatPacket): List<BitchatPacket> =
+        createFragments(packet, 0xFFFF)
+
+    /**
+     * Create a fragment plan with a caller-selected bound. Private media uses
+     * 256 for cross-platform admission; generic/public traffic retains the
+     * UInt16 wire limit.
+     */
+    fun createFragments(packet: BitchatPacket, maxFragments: Int): List<BitchatPacket> {
         try {
-            Log.d(TAG, "🔀 Creating fragments for packet type ${packet.type}, payload: ${packet.payload.size} bytes")
-        val encoded = packet.toBinaryData()
-            if (encoded == null) {
-                Log.e(TAG, "❌ Failed to encode packet to binary data")
+            if (maxFragments !in 1..0xFFFF) {
+                Log.w(TAG, "Rejecting invalid outbound fragment limit: $maxFragments")
                 return emptyList()
             }
-            Log.d(TAG, "📦 Encoded to ${encoded.size} bytes")
-        
-        // Fragment the unpadded frame; each fragment will be encoded (and padded) independently - iOS fix
-        val fullData = try {
+            val encoded = packet.toBinaryData()
+            if (encoded == null) {
+                Log.e(TAG, "Failed to encode packet to binary data")
+                return emptyList()
+            }
+
+            // Fragment the unpadded frame; each fragment will be encoded (and padded) independently - iOS fix
+            val fullData = try {
                 MessagePadding.unpad(encoded)
             } catch (e: Exception) {
-                Log.e(TAG, "❌ Failed to unpad data: ${e.message}", e)
+                Log.e(TAG, "Failed to unpad data: ${e.message}", e)
                 return emptyList()
             }
-            Log.d(TAG, "📏 Unpadded to ${fullData.size} bytes")
-        
-        // iOS logic: if data.count > 512 && packet.type != MessageType.fragment.rawValue
-        if (fullData.size <= FRAGMENT_SIZE_THRESHOLD) {
-            return listOf(packet) // No fragmentation needed
-        }
-        
-        val fragments = mutableListOf<BitchatPacket>()
-        
-        // iOS: let fragmentID = Data((0..<8).map { _ in UInt8.random(in: 0...255) })
-        val fragmentID = FragmentPayload.generateFragmentID()
-        
-        // iOS: stride(from: 0, to: fullData.count, by: maxFragmentSize)
-        // Calculate dynamic fragment size to fit in MTU (512)
-        // Packet = Header + Sender + Recipient + Route + FragmentHeader + Payload + PaddingBuffer
-        val hasRoute = packet.route != null
-        val version = if (hasRoute) 2 else 1
-        val headerSize = if (version == 2) 15 else 13
-        val senderSize = 8
-        val recipientSize = if (packet.recipientID != null) 8 else 0
-        // Route: 1 byte count + 8 bytes per hop
-        val routeSize = if (hasRoute) (1 + (packet.route?.size ?: 0) * 8) else 0
-        val fragmentHeaderSize = 13 // FragmentPayload header
-        val paddingBuffer = 16 // MessagePadding.optimalBlockSize adds 16 bytes overhead
 
-        // 512 - Overhead
-        val packetOverhead = headerSize + senderSize + recipientSize + routeSize + fragmentHeaderSize + paddingBuffer
-        val maxDataSize = (512 - packetOverhead).coerceAtMost(MAX_FRAGMENT_SIZE)
-        
-        if (maxDataSize <= 0) {
-            Log.e(TAG, "❌ Calculated maxDataSize is non-positive ($maxDataSize). Route too large?")
-            return emptyList()
-        }
+            // iOS logic: if data.count > 512 && packet.type != MessageType.fragment.rawValue
+            if (fullData.size <= FRAGMENT_SIZE_THRESHOLD) {
+                return listOf(packet) // No fragmentation needed
+            }
 
-        Log.d(TAG, "📏 Dynamic fragment size: $maxDataSize (MAX: $MAX_FRAGMENT_SIZE, Overhead: $packetOverhead)")
+            val fragments = mutableListOf<BitchatPacket>()
+
+            // iOS: let fragmentID = Data((0..<8).map { _ in UInt8.random(in: 0...255) })
+            val fragmentID = FragmentPayload.generateFragmentID()
+
+            // iOS: stride(from: 0, to: fullData.count, by: maxFragmentSize)
+            // Calculate dynamic fragment size to fit in MTU (512)
+            // Packet = Header + Sender + Recipient + Route + FragmentHeader + Payload + PaddingBuffer
+            val hasRoute = packet.route != null
+            val version = if (hasRoute) 2 else 1
+            val headerSize = if (version == 2) 15 else 13
+            val senderSize = 8
+            val recipientSize = if (packet.recipientID != null) 8 else 0
+            // Route: 1 byte count + 8 bytes per hop
+            val routeSize = if (hasRoute) (1 + (packet.route?.size ?: 0) * 8) else 0
+            val fragmentHeaderSize = 13 // FragmentPayload header
+            val paddingBuffer = 16 // MessagePadding.optimalBlockSize adds 16 bytes overhead
+
+            // 512 - Overhead
+            val packetOverhead = headerSize + senderSize + recipientSize + routeSize + fragmentHeaderSize + paddingBuffer
+            val maxDataSize = (512 - packetOverhead).coerceAtMost(MAX_FRAGMENT_SIZE)
+
+            if (maxDataSize <= 0) {
+                Log.e(TAG, "Calculated maxDataSize is non-positive ($maxDataSize). Route too large?")
+                return emptyList()
+            }
+
+            val requiredFragments = (
+                (fullData.size.toLong() + maxDataSize.toLong() - 1L) / maxDataSize.toLong()
+            ).toInt()
+            if (requiredFragments > maxFragments) {
+                Log.w(TAG, "Rejecting outbound packet requiring $requiredFragments fragments (caller cap: $maxFragments)")
+                return emptyList()
+            }
+
+            // Do not allocate chunk copies until the plan passes the hard bound.
+            val fragmentChunks = stride(0, fullData.size, maxDataSize) { offset ->
+                val endOffset = minOf(offset + maxDataSize, fullData.size)
+                fullData.sliceArray(offset..<endOffset)
+            }
+
+            // iOS: for (index, fragment) in fragments.enumerated()
+            for (index in fragmentChunks.indices) {
+                val fragmentData = fragmentChunks[index]
+
+                // Create iOS-compatible fragment payload
+                val fragmentPayload = FragmentPayload(
+                    fragmentID = fragmentID,
+                    index = index,
+                    total = fragmentChunks.size,
+                    originalType = packet.type,
+                    data = fragmentData
+                )
+
+                // iOS: MessageType.fragment.rawValue (single fragment type)
+                // Fix: Fragments must inherit source route and use v2 if routed
+                val fragmentPacket = BitchatPacket(
+                    version = if (packet.route != null) 2u else 1u,
+                    type = MessageType.FRAGMENT.value,
+                    ttl = packet.ttl,
+                    senderID = packet.senderID,
+                    recipientID = packet.recipientID,
+                    timestamp = packet.timestamp,
+                    payload = fragmentPayload.encode(),
+                    route = packet.route,
+                    signature = null // iOS: signature: nil
+                )
+
+                fragments.add(fragmentPacket)
+            }
 
-        val fragmentChunks = stride(0, fullData.size, maxDataSize) { offset ->
-            val endOffset = minOf(offset + maxDataSize, fullData.size)
-            fullData.sliceArray(offset..<endOffset)
-        }
-        
-        Log.d(TAG, "Creating ${fragmentChunks.size} fragments for ${fullData.size} byte packet (iOS compatible)")
-        
-        // iOS: for (index, fragment) in fragments.enumerated()
-        for (index in fragmentChunks.indices) {
-            val fragmentData = fragmentChunks[index]
-            
-            // Create iOS-compatible fragment payload
-            val fragmentPayload = FragmentPayload(
-                fragmentID = fragmentID,
-                index = index,
-                total = fragmentChunks.size,
-                originalType = packet.type,
-                data = fragmentData
-            )
-            
-            // iOS: MessageType.fragment.rawValue (single fragment type)
-            // Fix: Fragments must inherit source route and use v2 if routed
-            val fragmentPacket = BitchatPacket(
-                version = if (packet.route != null) 2u else 1u,
-                type = MessageType.FRAGMENT.value,
-                ttl = packet.ttl,
-                senderID = packet.senderID,
-                recipientID = packet.recipientID,
-                timestamp = packet.timestamp,
-                payload = fragmentPayload.encode(),
-                route = packet.route,
-                signature = null // iOS: signature: nil
-            )
-            
-            fragments.add(fragmentPacket)
-        }
-        
-        Log.d(TAG, "✅ Created ${fragments.size} fragments successfully")
             return fragments
         } catch (e: Exception) {
-            Log.e(TAG, "❌ Fragment creation failed: ${e.message}", e)
-            Log.e(TAG, "❌ Packet type: ${packet.type}, payload: ${packet.payload.size} bytes")
+            Log.e(TAG, "Fragment creation failed (type=${packet.type}, payload=${packet.payload.size} bytes): ${e.message}", e)
             return emptyList()
         }
     }
@@ -157,7 +170,7 @@ class FragmentManager {
     fun handleFragment(packet: BitchatPacket): BitchatPacket? {
         // iOS: guard packet.payload.count > 13 else { return }
         if (packet.payload.size < FragmentPayload.HEADER_SIZE) {
-            Log.w(TAG, "Fragment packet too small: ${packet.payload.size}")
+            Log.d(TAG, "Fragment packet too small: ${packet.payload.size}")
             return null
         }
         
@@ -168,14 +181,12 @@ class FragmentManager {
             // Use FragmentPayload for type-safe decoding
             val fragmentPayload = FragmentPayload.decode(packet.payload)
             if (fragmentPayload == null || !fragmentPayload.isValid()) {
-                Log.w(TAG, "Invalid fragment payload")
+                Log.d(TAG, "Invalid fragment payload")
                 return null
             }
-            
+
             // iOS: let fragmentID = packet.payload[0..<8].map { String(format: "%02x", $0) }.joined()
             val fragmentIDString = fragmentPayload.getFragmentIDString()
-            
-            Log.d(TAG, "Received fragment ${fragmentPayload.index}/${fragmentPayload.total} for fragmentID: $fragmentIDString, originalType: ${fragmentPayload.originalType}")
 
             val maxFragments = com.bitchat.android.util.AppConstants.Fragmentation.MAX_FRAGMENTS_PER_ID
             if (fragmentPayload.total > maxFragments) {
@@ -186,11 +197,7 @@ class FragmentManager {
             synchronized(fragmentStateLock) {
                 fragmentMetadata[fragmentIDString]?.let { (expectedType, expectedTotal, _) ->
                     if (expectedTotal != fragmentPayload.total || expectedType != fragmentPayload.originalType) {
-                        Log.w(
-                            TAG,
-                            "Rejecting fragment for $fragmentIDString: inconsistent metadata " +
-                                "(expected type=$expectedType total=$expectedTotal, got type=${fragmentPayload.originalType} total=${fragmentPayload.total})"
-                        )
+                        Log.w(TAG, "Rejecting fragment for $fragmentIDString: inconsistent metadata")
                         removeFragmentSetLocked(fragmentIDString)
                         return null
                     }
@@ -239,10 +246,7 @@ class FragmentManager {
                 val delta = (fragmentPayload.data.size - oldEntrySize).toLong()
                 val maxGlobalBytes = com.bitchat.android.util.AppConstants.Fragmentation.MAX_GLOBAL_FRAGMENT_TOTAL_BYTES
                 if (globalBufferedBytes + delta > maxGlobalBytes) {
-                    Log.w(
-                        TAG,
-                        "Rejecting fragment for $fragmentIDString: global buffered bytes ${(globalBufferedBytes + delta)} exceeds cap $maxGlobalBytes"
-                    )
+                    Log.w(TAG, "Rejecting fragment for $fragmentIDString: global buffered bytes exceed cap $maxGlobalBytes")
                     if (isNewSet) {
                         removeFragmentSetLocked(fragmentIDString)
                     }
@@ -255,8 +259,6 @@ class FragmentManager {
 
                 val expectedTotal = fragmentMetadata[fragmentIDString]?.second ?: fragmentPayload.total
                 if (fragmentMap.size == expectedTotal) {
-                    Log.d(TAG, "All fragments received for $fragmentIDString, reassembling...")
-
                     // iOS reassembly logic: for i in 0..<total { if let fragment = fragments[i] { reassembled.append(fragment) } }
                     val reassembledData = mutableListOf<Byte>()
                     for (i in 0 until expectedTotal) {
@@ -270,15 +272,11 @@ class FragmentManager {
                         removeFragmentSetLocked(fragmentIDString)
 
                         val suppressedTtlPacket = originalPacket.copy(ttl = 0u.toUByte())
-                        Log.d(TAG, "Successfully reassembled original (${reassembledData.size} bytes); set TTL=0 to suppress relay")
                         return suppressedTtlPacket
                     } else {
                         val metadata = fragmentMetadata[fragmentIDString]
                         Log.e(TAG, "Failed to decode reassembled packet (type=${metadata?.first}, total=${metadata?.second})")
                     }
-                } else {
-                    val received = fragmentMap.size
-                    Log.d(TAG, "Fragment ${fragmentPayload.index} stored, have $received/$expectedTotal fragments for $fragmentIDString")
                 }
             }
             
@@ -327,10 +325,6 @@ class FragmentManager {
             for (fragmentID in oldFragments) {
                 removeFragmentSetLocked(fragmentID)
             }
-
-            if (oldFragments.isNotEmpty()) {
-                Log.d(TAG, "Cleaned up ${oldFragments.size} old fragment sets (iOS compatible)")
-            }
         }
     }
     

app/src/main/java/com/bitchat/android/mesh/FragmentingPacketSender.kt

@@ -0,0 +1,245 @@
+package com.bitchat.android.mesh
+
+import android.util.Log
+import com.bitchat.android.model.RoutedPacket
+import com.bitchat.android.protocol.BitchatPacket
+import com.bitchat.android.protocol.MessageType
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.CoroutineStart
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.launch
+import java.security.MessageDigest
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.atomic.AtomicBoolean
+
+/**
+ * Shared transport send wrapper that applies bitchat packet fragmentation and
+ * transfer progress before a transport writes packets to its concrete medium.
+ */
+class FragmentingPacketSender(
+    private val scope: CoroutineScope,
+    private val fragmentManager: FragmentManager?,
+    private val logTag: String,
+    private val interFragmentDelayMs: Long = 20L
+) {
+    private val transferJobs = ConcurrentHashMap<String, Job>()
+
+    fun send(
+        routed: RoutedPacket,
+        description: String,
+        sendSingle: (RoutedPacket) -> Boolean
+    ): Boolean {
+        val transferId = transferIdFor(routed)
+        val packets = packetsForTransport(routed)
+        if (packets == null) {
+            if (transferId != null) {
+                TransferProgressManager.fail(transferId)
+            }
+            return false
+        }
+        val total = packets.size
+
+        if (total <= 1) {
+            if (transferId != null) {
+                TransferProgressManager.start(transferId, 1)
+            }
+            val sent = sendSingle(
+                routed.copy(
+                    packet = packets.first(),
+                    transferId = transferId,
+                    preparedPackets = null
+                )
+            )
+            if (transferId != null) {
+                if (sent) {
+                    TransferProgressManager.progress(transferId, 1, 1)
+                    TransferProgressManager.complete(transferId, 1)
+                } else {
+                    TransferProgressManager.fail(transferId)
+                }
+            }
+            return sent
+        }
+
+        Log.d(logTag, "Fragmenting packet type ${routed.packet.type} into $total fragments for $description")
+        if (transferId != null) {
+            TransferProgressManager.start(transferId, total)
+        }
+
+        val job = scope.launch(start = CoroutineStart.LAZY) {
+            var sent = 0
+            for (packet in packets) {
+                if (!isActive) return@launch
+                if (transferId != null && transferJobs[transferId]?.isCancelled == true) return@launch
+
+                val fragment = routed.copy(
+                    packet = packet,
+                    transferId = transferId,
+                    preparedPackets = null
+                )
+                val delivered = try {
+                    sendSingle(fragment)
+                } catch (e: Exception) {
+                    Log.e(logTag, "Fragment send failed for $description: ${e.message}", e)
+                    false
+                }
+
+                if (!delivered) {
+                    Log.w(logTag, "Stopping fragmented send for $description after $sent/$total fragments")
+                    return@launch
+                }
+
+                sent += 1
+                if (transferId != null) {
+                    TransferProgressManager.progress(transferId, sent, total)
+                }
+                if (sent < total) {
+                    delay(interFragmentDelayMs)
+                }
+            }
+
+            if (transferId != null) {
+                TransferProgressManager.complete(transferId, total)
+            }
+        }
+
+        if (transferId != null) {
+            transferJobs[transferId] = job
+            job.invokeOnCompletion { transferJobs.remove(transferId, job) }
+        }
+        job.start()
+        return true
+    }
+
+    /**
+     * Completes successfully only after every fragment has been admitted by
+     * the exact transport target. [preflight] is re-run for every fragment so
+     * a replaced session, revoked favorite, or disconnected link stops the
+     * transfer without acknowledging its durable caller.
+     */
+    fun sendConfirmed(
+        routed: RoutedPacket,
+        description: String,
+        preflight: () -> Boolean,
+        sendSingle: (RoutedPacket) -> Boolean,
+        completion: (Boolean) -> Unit
+    ) {
+        val completionDelivered = AtomicBoolean(false)
+        fun complete(admitted: Boolean) {
+            if (completionDelivered.compareAndSet(false, true)) {
+                completion(admitted)
+            }
+        }
+
+        val transferId = transferIdFor(routed)
+        val packets = packetsForTransport(routed)
+        if (packets == null) {
+            complete(false)
+            return
+        }
+        val total = packets.size
+        val job = scope.launch(start = CoroutineStart.LAZY) {
+            var sent = 0
+            try {
+                if (transferId != null) {
+                    TransferProgressManager.start(transferId, total)
+                }
+                for (packet in packets) {
+                    if (!isActive || !preflight()) return@launch
+                    val fragment = routed.copy(
+                        packet = packet,
+                        transferId = transferId,
+                        preparedPackets = null
+                    )
+                    if (!sendSingle(fragment)) return@launch
+                    sent += 1
+                    if (transferId != null) {
+                        TransferProgressManager.progress(transferId, sent, total)
+                    }
+                    if (sent < total) {
+                        delay(interFragmentDelayMs)
+                    }
+                }
+                if (transferId != null) {
+                    TransferProgressManager.complete(transferId, total)
+                }
+                complete(true)
+            } catch (e: Exception) {
+                Log.e(logTag, "Confirmed fragment send failed for $description: ${e.message}", e)
+            } finally {
+                complete(false)
+            }
+        }
+        if (transferId != null) {
+            transferJobs[transferId] = job
+            job.invokeOnCompletion {
+                transferJobs.remove(transferId, job)
+                complete(false)
+            }
+        } else {
+            job.invokeOnCompletion { complete(false) }
+        }
+        job.start()
+    }
+
+    fun cancelTransfer(transferId: String): Boolean {
+        val job = transferJobs.remove(transferId) ?: return false
+        job.cancel()
+        return true
+    }
+
+    private fun packetsForTransport(routed: RoutedPacket): List<BitchatPacket>? {
+        routed.preparedPackets?.let { prepared ->
+            if (prepared.isEmpty() ||
+                prepared.size > com.bitchat.android.util.AppConstants.Fragmentation.MAX_FRAGMENTS_PER_ID) {
+                Log.e(logTag, "Rejected invalid prepared fragment plan (${prepared.size} packets)")
+                return null
+            }
+            return prepared
+        }
+
+        val packet = routed.packet
+        if (packet.type == MessageType.FRAGMENT.value) {
+            return listOf(packet)
+        }
+
+        val manager = fragmentManager ?: return listOf(packet)
+        return try {
+            // Receivers hard-cap reassembly at MAX_FRAGMENTS_PER_ID; sending more
+            // fragments would be undeliverable, so reject here instead.
+            val fragments = manager.createFragments(
+                packet,
+                com.bitchat.android.util.AppConstants.Fragmentation.MAX_FRAGMENTS_PER_ID
+            )
+            if (fragments.isEmpty()) {
+                Log.e(logTag, "Fragment manager returned no packets for packet type ${packet.type}")
+                null
+            } else {
+                fragments
+            }
+        } catch (e: Exception) {
+            Log.e(logTag, "Fragment creation failed for packet type ${packet.type}: ${e.message}", e)
+            null
+        }
+    }
+
+    private fun transferIdFor(routed: RoutedPacket): String? {
+        routed.transferId?.let { return it }
+        val packet = routed.packet
+        return if (packet.type == MessageType.FILE_TRANSFER.value) {
+            sha256Hex(packet.payload)
+        } else {
+            null
+        }
+    }
+
+    private fun sha256Hex(bytes: ByteArray): String = try {
+        val md = MessageDigest.getInstance("SHA-256")
+        md.update(bytes)
+        md.digest().joinToString("") { "%02x".format(it) }
+    } catch (_: Exception) {
+        bytes.size.toString(16)
+    }
+}

app/src/main/java/com/bitchat/android/mesh/MeshConnectionTracker.kt

@@ -0,0 +1,143 @@
+package com.bitchat.android.mesh
+
+import android.util.Log
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
+import java.util.concurrent.ConcurrentHashMap
+
+/**
+ * Abstract base tracker for mesh connections (BLE, Wi-Fi Aware, etc.)
+ * Encapsulates common state machine logic:
+ * - Connection attempt tracking (retries, backoff)
+ * - Pending connection management
+ * - Automatic cleanup of expired attempts
+ */
+abstract class MeshConnectionTracker(
+    private val scope: CoroutineScope,
+    protected val tag: String
+) {
+    companion object {
+        const val CONNECTION_RETRY_DELAY = 5_000L
+        const val MAX_CONNECTION_ATTEMPTS = 3
+        const val CLEANUP_INTERVAL = 30_000L
+    }
+
+    /**
+     * Connection attempt tracking with automatic expiry
+     */
+    protected data class ConnectionAttempt(
+        val attempts: Int,
+        val lastAttempt: Long = System.currentTimeMillis()
+    ) {
+        fun isExpired(): Boolean =
+            System.currentTimeMillis() - lastAttempt > CONNECTION_RETRY_DELAY * 2
+
+        fun shouldRetry(): Boolean =
+            attempts < MAX_CONNECTION_ATTEMPTS &&
+                    System.currentTimeMillis() - lastAttempt > CONNECTION_RETRY_DELAY
+    }
+
+    // Tracks in-progress or failed attempts
+    protected val pendingConnections = ConcurrentHashMap<String, ConnectionAttempt>()
+
+    private var isActive = false
+
+    /**
+     * Start the tracker and its cleanup loop
+     */
+    open fun start() {
+        isActive = true
+        startPeriodicCleanup()
+    }
+
+    /**
+     * Stop the tracker
+     */
+    open fun stop() {
+        isActive = false
+        pendingConnections.clear()
+    }
+
+    /**
+     * Check if a connection attempt is allowed for this peer/address
+     */
+    fun isConnectionAttemptAllowed(id: String): Boolean {
+        // If already connected, usually no need to retry (subclasses can override logic if needed,
+        // but typically the caller checks isConnected() first).
+        
+        val existingAttempt = pendingConnections[id]
+        return existingAttempt?.let {
+            it.isExpired() || it.shouldRetry()
+        } ?: true
+    }
+
+    /**
+     * Record a new connection attempt.
+     * Returns true if the attempt was recorded (allowed), false if skipped.
+     */
+    fun addPendingConnection(id: String): Boolean {
+        synchronized(pendingConnections) {
+            val currentAttempt = pendingConnections[id]
+            
+            // If strictly not allowed right now, reject
+            if (currentAttempt != null && !currentAttempt.isExpired() && !currentAttempt.shouldRetry()) {
+                Log.d(tag, "Connection attempt already in progress for $id")
+                return false
+            }
+
+            // Update attempt count
+            // Reset to 1 if expired, otherwise increment
+            val attempts = if (currentAttempt?.isExpired() == true) 1 else (currentAttempt?.attempts ?: 0) + 1
+            pendingConnections[id] = ConnectionAttempt(attempts)
+            Log.d(tag, "Added pending connection for $id (attempts: $attempts)")
+            return true
+        }
+    }
+
+    /**
+     * Remove a pending attempt (e.g., on success or fatal error)
+     */
+    fun removePendingConnection(id: String) {
+        pendingConnections.remove(id)
+    }
+
+    /**
+     * Abstract: Subclasses must define what "connected" means
+     */
+    abstract fun isConnected(id: String): Boolean
+
+    /**
+     * Abstract: Subclasses must implement disconnect logic
+     */
+    abstract fun disconnect(id: String)
+
+    /**
+     * Abstract: Subclasses report their active connection count
+     */
+    abstract fun getConnectionCount(): Int
+
+    private fun startPeriodicCleanup() {
+        scope.launch {
+            while (isActive) {
+                try {
+                    delay(CLEANUP_INTERVAL)
+                    if (!isActive) break
+
+                    // Clean up expired pending connections
+                    val expired = pendingConnections.filter { it.value.isExpired() }
+                    expired.keys.forEach { pendingConnections.remove(it) }
+
+                    if (expired.isNotEmpty()) {
+                        Log.d(tag, "Cleaned up ${expired.size} expired connection attempts")
+                    }
+                } catch (e: CancellationException) {
+                    break
+                } catch (e: Exception) {
+                    Log.w(tag, "Error in periodic cleanup: ${e.message}")
+                }
+            }
+        }
+    }
+}

app/src/main/java/com/bitchat/android/mesh/MeshDelegate.kt

@@ -0,0 +1,22 @@
+package com.bitchat.android.mesh
+
+import com.bitchat.android.model.BitchatMessage
+
+/**
+ * Shared mesh delegate interface for transport-agnostic callbacks.
+ */
+interface MeshDelegate {
+    fun didReceiveMessage(message: BitchatMessage)
+    fun didUpdatePeerList(peers: List<String>)
+    fun didReceiveChannelLeave(channel: String, fromPeer: String)
+    fun didReceiveDeliveryAck(messageID: String, recipientPeerID: String)
+    fun didReceiveReadReceipt(messageID: String, recipientPeerID: String)
+    fun didReceiveVerifyChallenge(peerID: String, payload: ByteArray, timestampMs: Long) {}
+    fun didReceiveVerifyResponse(peerID: String, payload: ByteArray, timestampMs: Long) {}
+    fun didReceiveNdrEvent(route: NdrMeshRoute, payload: ByteArray, timestampMs: Long) {}
+    /** Current Noise generation either proved peer state or exhausted its 5-second watchdog. */
+    fun didResolvePrivateMediaPolicy(peerID: String) {}
+    fun decryptChannelMessage(encryptedContent: ByteArray, channel: String): String?
+    fun getNickname(): String?
+    fun isFavorite(peerID: String): Boolean
+}

app/src/main/java/com/bitchat/android/mesh/MeshPacketUtils.kt

@@ -0,0 +1,37 @@
+package com.bitchat.android.mesh
+
+/**
+ * Shared helpers for mesh packet handling.
+ */
+object MeshPacketUtils {
+    /**
+     * Convert hex string peer ID to binary data (8 bytes), matching iOS behavior.
+     */
+    fun hexStringToByteArray(hexString: String): ByteArray {
+        val result = ByteArray(8) { 0 }
+        var tempID = hexString
+        var index = 0
+
+        while (tempID.length >= 2 && index < 8) {
+            val hexByte = tempID.substring(0, 2)
+            val byte = hexByte.toIntOrNull(16)?.toByte()
+            if (byte != null) {
+                result[index] = byte
+            }
+            tempID = tempID.substring(2)
+            index++
+        }
+        return result
+    }
+
+    /**
+     * Hash payloads to a stable hex ID for transfer tracking.
+     */
+    fun sha256Hex(bytes: ByteArray): String = try {
+        val md = java.security.MessageDigest.getInstance("SHA-256")
+        md.update(bytes)
+        md.digest().joinToString("") { "%02x".format(it) }
+    } catch (_: Exception) {
+        bytes.size.toString(16)
+    }
+}

app/src/main/java/com/bitchat/android/mesh/MeshService.kt

@@ -0,0 +1,94 @@
+package com.bitchat.android.mesh
+
+import com.bitchat.android.model.BitchatFilePacket
+import com.bitchat.android.noise.AuthenticatedNoiseSession
+
+data class NdrTransportTarget(
+    val endpointId: String,
+    val generationToken: Any
+)
+
+/**
+ * One exact authenticated Noise generation on one transport.
+ *
+ * NDR OOB responses must never be routed through a reusable peer alias:
+ * replacing the Noise session invalidates this token.
+ */
+data class NdrMeshRoute(
+    val transportId: String,
+    val peerID: String,
+    val authenticatedSession: AuthenticatedNoiseSession,
+    val transportTarget: NdrTransportTarget
+)
+
+/**
+ * Transport-agnostic mesh service API for UI and routing layers.
+ */
+interface MeshService {
+    val myPeerID: String
+    var delegate: MeshDelegate?
+
+    fun startServices()
+    fun stopServices()
+
+    fun sendMessage(content: String, mentions: List<String> = emptyList(), channel: String? = null)
+    fun sendPrivateMessage(content: String, recipientPeerID: String, recipientNickname: String, messageID: String? = null)
+    fun sendReadReceipt(messageID: String, recipientPeerID: String, readerNickname: String)
+    fun sendDeliveryAck(messageID: String, recipientPeerID: String) {}
+    fun sendFavoriteNotification(peerID: String, isFavorite: Boolean) {}
+    fun sendVerifyChallenge(peerID: String, noiseKeyHex: String, nonceA: ByteArray)
+    fun sendVerifyResponse(peerID: String, noiseKeyHex: String, nonceA: ByteArray)
+    fun currentNdrRoute(peerID: String, transportId: String? = null): NdrMeshRoute? = null
+    fun sendNdrEvent(
+        route: NdrMeshRoute,
+        payload: String,
+        isStillAuthorized: () -> Boolean,
+        completion: (admitted: Boolean) -> Unit
+    ) {
+        completion(false)
+    }
+    fun sendFileBroadcast(file: BitchatFilePacket)
+    fun sendFilePrivate(recipientPeerID: String, file: BitchatFilePacket)
+    fun prepareFilePrivate(
+        recipientPeerID: String,
+        file: BitchatFilePacket,
+        transferId: String,
+        allowLegacyFallback: Boolean
+    ): PrivateMediaPreparation
+    fun cancelFileTransfer(transferId: String): Boolean
+
+    fun sendBroadcastAnnounce()
+    fun sendAnnouncementToPeer(peerID: String)
+
+    fun getPeerNicknames(): Map<String, String>
+    fun getPeerRSSI(): Map<String, Int>
+    fun getActivePeerCount(): Int
+    fun hasEstablishedSession(peerID: String): Boolean
+    fun getSessionState(peerID: String): com.bitchat.android.noise.NoiseSession.NoiseSessionState
+    fun initiateNoiseHandshake(peerID: String)
+    fun getPeerFingerprint(peerID: String): String?
+    fun getPeerInfo(peerID: String): PeerInfo?
+    fun peerSupportsAuthenticatedCapability(
+        peerID: String,
+        capability: com.bitchat.android.model.PeerCapabilities
+    ): Boolean
+    fun updatePeerInfo(
+        peerID: String,
+        nickname: String,
+        noisePublicKey: ByteArray,
+        signingPublicKey: ByteArray,
+        isVerified: Boolean
+    ): Boolean
+    fun getIdentityFingerprint(): String
+    fun getStaticNoisePublicKey(): ByteArray?
+    fun shouldShowEncryptionIcon(peerID: String): Boolean
+    fun getEncryptedPeers(): List<String>
+
+    fun getDeviceAddressForPeer(peerID: String): String?
+    fun getDeviceAddressToPeerMapping(): Map<String, String>
+    fun printDeviceAddressesForPeers(): String
+    fun getDebugStatus(): String
+
+    fun clearAllInternalData()
+    fun clearAllEncryptionData()
+}

app/src/main/java/com/bitchat/android/mesh/MeshTransport.kt

@@ -0,0 +1,48 @@
+package com.bitchat.android.mesh
+
+import com.bitchat.android.model.RoutedPacket
+import com.bitchat.android.protocol.BitchatPacket
+
+/**
+ * Transport abstraction used by MeshCore to send packets via a specific medium.
+ */
+interface MeshTransport {
+    val id: String
+
+    /**
+     * Broadcasts a packet and reports whether at least one concrete transport write was accepted.
+     */
+    fun broadcastPacket(routed: RoutedPacket): Boolean
+
+    fun sendPacketToPeer(peerID: String, packet: BitchatPacket): Boolean
+
+    fun currentNdrTransportTarget(peerID: String): NdrTransportTarget? = null
+
+    fun sendPacketToNdrTargetConfirmed(
+        peerID: String,
+        target: NdrTransportTarget,
+        routed: RoutedPacket,
+        preflight: () -> Boolean,
+        completion: (Boolean) -> Unit
+    ) {
+        completion(false)
+    }
+
+    /**
+     * Send through an exact transport generation rather than a reusable peer alias.
+     * Transports that cannot prove the link identity must decline the operation.
+     */
+    fun sendPacketToLink(
+        relayAddress: String,
+        ingressLinkID: String,
+        packet: BitchatPacket
+    ): Boolean = false
+
+    fun cancelTransfer(transferId: String): Boolean = false
+
+    fun getDeviceAddressForPeer(peerID: String): String? = null
+
+    fun getDeviceAddressToPeerMapping(): Map<String, String> = emptyMap()
+
+    fun getTransportDebugInfo(): String = ""
+}

app/src/main/java/com/bitchat/android/mesh/MessageHandler.kt

@@ -1,9 +1,11 @@
 package com.bitchat.android.mesh
 
 import android.util.Log
+import com.bitchat.android.favorites.FavoriteControlMessage
 import com.bitchat.android.model.BitchatMessage
 import com.bitchat.android.model.BitchatMessageType
-import com.bitchat.android.model.IdentityAnnouncement
+import com.bitchat.android.model.AuthenticatedPeerState
+import com.bitchat.android.model.NdrFeatureGate
 import com.bitchat.android.model.RoutedPacket
 import com.bitchat.android.protocol.BitchatPacket
 import com.bitchat.android.protocol.MessageType
@@ -11,7 +13,11 @@ import com.bitchat.android.sync.PacketIdUtil
 import com.bitchat.android.util.toHexString
 import kotlinx.coroutines.*
 import java.util.*
-import kotlin.random.Random
+
+sealed class AnnounceHandlingResult {
+    data class Accepted(val isFirst: Boolean) : AnnounceHandlingResult()
+    object Rejected : AnnounceHandlingResult()
+}
 
 /**
  * Handles processing of different message types
@@ -21,73 +27,77 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
     
     companion object {
         private const val TAG = "MessageHandler"
+        private const val ANNOUNCE_CLOCK_SKEW_TOLERANCE_MS = 10 * 60 * 1000L
+        private const val MAX_CONSECUTIVE_DECRYPT_FAILURES = 3
     }
-    
+
     // Delegate for callbacks
     var delegate: MessageHandlerDelegate? = null
-    
+
     // Reference to PacketProcessor for recursive packet handling
     var packetProcessor: PacketProcessor? = null
-    
+
     // Coroutines
     private val handlerScope = CoroutineScope(Dispatchers.IO + SupervisorJob())
-    
+
+    // Consecutive decrypt failures per peer; only signature-verified packets reach this path,
+    // so repeated failures mean the established session is stale (peer re-handshaked elsewhere).
+    private val consecutiveDecryptFailures = java.util.concurrent.ConcurrentHashMap<String, Int>()
+
     /**
      * Handle Noise encrypted transport message - SIMPLIFIED iOS-compatible version
      * Uses NoisePayloadType system exactly like iOS SimplifiedBluetoothService
+     *
+     * Returns false when the payload could not be decrypted, so callers can treat the
+     * packet as not liveness-proving (no lastSeen refresh, no relay).
      */
-    suspend fun handleNoiseEncrypted(routed: RoutedPacket) {
+    suspend fun handleNoiseEncrypted(routed: RoutedPacket): Boolean {
         val packet = routed.packet
         val peerID = routed.peerID ?: "unknown"
-        
-        Log.d(TAG, "Processing Noise encrypted message from $peerID (${packet.payload.size} bytes)")
-        
+
         // Skip our own messages
-        if (peerID == myPeerID) return
-        
+        if (peerID == myPeerID) return true
+
         // Check if this message is for us
         val recipientID = packet.recipientID?.toHexString()
         if (recipientID != myPeerID) {
-            Log.d(TAG, "🔐 Encrypted message not for me (for $recipientID, I am $myPeerID)")
-            return
+            return true
         }
-        
+
         try {
             // Decrypt the message using the Noise service
-            val decryptedData = delegate?.decryptFromPeer(packet.payload, peerID)
-            if (decryptedData == null) {
+            val decryption = delegate?.decryptFromPeer(packet.payload, peerID)
+            if (decryption == null) {
                 Log.w(TAG, "Failed to decrypt Noise message from $peerID - may need handshake")
-                return
+                registerDecryptFailure(peerID)
+                return false
             }
-            
+            consecutiveDecryptFailures.remove(peerID)
+            val decryptedData = decryption.plaintext
+
             if (decryptedData.isEmpty()) {
                 Log.w(TAG, "Decrypted data is empty from $peerID")
-                return
+                return true
             }
-            
-            // NEW: Use NoisePayload system exactly like iOS
+
             val noisePayload = com.bitchat.android.model.NoisePayload.decode(decryptedData)
             if (noisePayload == null) {
                 Log.w(TAG, "Failed to parse NoisePayload from $peerID")
-                return
+                return true
             }
             
-            Log.d(TAG, "🔓 Decrypted NoisePayload type ${noisePayload.type} from $peerID")
-            
             when (noisePayload.type) {
                 com.bitchat.android.model.NoisePayloadType.PRIVATE_MESSAGE -> {
                     // Decode TLV private message exactly like iOS
                     val privateMessage = com.bitchat.android.model.PrivateMessagePacket.decode(noisePayload.data)
                     if (privateMessage != null) {
-                        Log.d(TAG, "🔓 Decrypted TLV PM from $peerID: ${privateMessage.content.take(30)}...")
-
                         // Handle favorite/unfavorite notifications embedded as PMs
                         val pmContent = privateMessage.content
-                        if (pmContent.startsWith("[FAVORITED]") || pmContent.startsWith("[UNFAVORITED]")) {
+                        if (FavoriteControlMessage.parse(pmContent) != null) {
                             handleFavoriteNotificationFromMesh(pmContent, peerID)
                             // Acknowledge delivery for UX parity
                             sendDeliveryAck(privateMessage.messageID, peerID)
-                            return
+                            return true
                         }
                         
                         // Create BitchatMessage - preserve source packet timestamp
@@ -101,7 +111,7 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
                             isPrivate = true,
                             recipientNickname = delegate?.getMyNickname(),
                             senderPeerID = peerID,
-                            mentions = null // TODO: Parse mentions if needed
+                            mentions = null
                         )
                         
                         // Notify delegate
@@ -116,7 +126,7 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
                     // Handle encrypted file transfer; generate unique message ID
                     val file = com.bitchat.android.model.BitchatFilePacket.decode(noisePayload.data)
                     if (file != null) {
-                        Log.d(TAG, "🔓 Decrypted encrypted file from $peerID: name='${file.fileName}', size=${file.fileSize}, mime='${file.mimeType}'")
+                        Log.d(TAG, "Encrypted file from $peerID: ${file.fileSize} bytes")
                         val uniqueMsgId = java.util.UUID.randomUUID().toString().uppercase()
                         val savedPath = com.bitchat.android.features.file.FileUtils.saveIncomingFile(appContext, file)
                         val message = BitchatMessage(
@@ -131,20 +141,32 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
                             senderPeerID = peerID
                         )
 
-                        Log.d(TAG, "📄 Saved encrypted incoming file to $savedPath (msgId=$uniqueMsgId)")
                         delegate?.onMessageReceived(message)
 
                         // Send delivery ACK with generated message ID
                         sendDeliveryAck(uniqueMsgId, peerID)
                     } else {
-                        Log.w(TAG, "⚠️ Failed to decode encrypted file transfer from $peerID")
+                        Log.w(TAG, "Failed to decode encrypted file transfer from $peerID")
+                    }
+                }
+
+                com.bitchat.android.model.NoisePayloadType.PEER_STATE -> {
+                    val authenticatedState = AuthenticatedPeerState.decode(noisePayload.data)
+                    if (authenticatedState == null) {
+                        Log.w(TAG, "Dropping malformed authenticated peer state from ${peerID.take(8)}")
+                    } else {
+                        delegate?.onAuthenticatedPeerStateReceived(
+                            peerID,
+                            authenticatedState,
+                            decryption.authenticatedSession
+                        )
                     }
                 }
                 
                 com.bitchat.android.model.NoisePayloadType.DELIVERED -> {
                     // Handle delivery ACK exactly like iOS
                     val messageID = String(noisePayload.data, Charsets.UTF_8)
-                    Log.d(TAG, "📬 Delivery ACK received from $peerID for message $messageID")
+                    Log.d(TAG, "Delivery ACK from $peerID for $messageID")
                     
                     // Simplified: Call delegate with messageID and peerID directly
                     delegate?.onDeliveryAckReceived(messageID, peerID)
@@ -153,24 +175,57 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
                 com.bitchat.android.model.NoisePayloadType.READ_RECEIPT -> {
                     // Handle read receipt exactly like iOS
                     val messageID = String(noisePayload.data, Charsets.UTF_8)
-                    Log.d(TAG, "👁️ Read receipt received from $peerID for message $messageID")
+                    Log.d(TAG, "Read receipt from $peerID for $messageID")
                     
                     // Simplified: Call delegate with messageID and peerID directly
                     delegate?.onReadReceiptReceived(messageID, peerID)
                 }
                 com.bitchat.android.model.NoisePayloadType.VERIFY_CHALLENGE -> {
-                    Log.d(TAG, "🔐 Verify challenge received from $peerID (${noisePayload.data.size} bytes)")
                     delegate?.onVerifyChallengeReceived(peerID, noisePayload.data, packet.timestamp.toLong())
                 }
                 com.bitchat.android.model.NoisePayloadType.VERIFY_RESPONSE -> {
-                    Log.d(TAG, "🔐 Verify response received from $peerID (${noisePayload.data.size} bytes)")
                     delegate?.onVerifyResponseReceived(peerID, noisePayload.data, packet.timestamp.toLong())
                 }
+                com.bitchat.android.model.NoisePayloadType.NDR_EVENT -> {
+                    if (NdrFeatureGate.isEnabled()) {
+                        delegate?.onNdrEventReceived(
+                            peerID,
+                            noisePayload.data,
+                            packet.timestamp.toLong(),
+                            decryption.authenticatedSession
+                        )
+                    }
+                }
             }
             
         } catch (e: Exception) {
             Log.e(TAG, "Error processing Noise encrypted message from $peerID: ${e.message}")
         }
+        return true
+    }
+
+    /**
+     * Count consecutive decrypt failures from a signature-verified peer that we still hold an
+     * established session for. After repeated failures the session is stale (the peer completed
+     * a new handshake elsewhere), so destroy it and start a fresh handshake; the peer's side
+     * will finish via the responder-candidate path and evict its own stale session.
+     */
+    private fun registerDecryptFailure(peerID: String) {
+        if (peerID == "unknown" || peerID == myPeerID) return
+        if (delegate?.hasNoiseSession(peerID) != true) return
+        val failures = (consecutiveDecryptFailures[peerID] ?: 0) + 1
+        if (failures >= MAX_CONSECUTIVE_DECRYPT_FAILURES) {
+            consecutiveDecryptFailures.remove(peerID)
+            Log.w(TAG, "Noise session with $peerID stale after $failures decrypt failures; resetting and re-handshaking")
+            try { delegate?.removeNoiseSession(peerID) } catch (e: Exception) {
+                Log.w(TAG, "Failed to reset Noise session for $peerID: ${e.message}")
+            }
+            try { delegate?.initiateNoiseHandshake(peerID) } catch (e: Exception) {
+                Log.w(TAG, "Failed to re-initiate handshake with $peerID: ${e.message}")
+            }
+        } else {
+            consecutiveDecryptFailures[peerID] = failures
+        }
     }
     
     /**
@@ -204,7 +259,6 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
                 )
             
             delegate?.sendPacket(packet)
-            Log.d(TAG, "📤 Sent delivery ACK to $senderPeerID for message $messageID")
             
         } catch (e: Exception) {
             Log.e(TAG, "Failed to send delivery ACK to $senderPeerID: ${e.message}")
@@ -215,78 +269,82 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
      * Handle announce message with TLV decoding and signature verification - exactly like iOS
      */
     suspend fun handleAnnounce(routed: RoutedPacket): Boolean {
+        return (handleAnnounceWithResult(routed) as? AnnounceHandlingResult.Accepted)?.isFirst ?: false
+    }
+
+    suspend fun handleAnnounceWithResult(routed: RoutedPacket): AnnounceHandlingResult {
         val packet = routed.packet
         val peerID = routed.peerID ?: "unknown"
 
-        if (peerID == myPeerID) return false
+        if (peerID == myPeerID) return AnnounceHandlingResult.Rejected
 
-        // Ignore stale announcements older than STALE_PEER_TIMEOUT
+        // Peers use wall-clock packet timestamps; tolerate moderate device clock skew
+        // during identity learning, or later signed messages cannot be verified.
         val now = System.currentTimeMillis()
-        val age = now - packet.timestamp.toLong()
-        if (age > com.bitchat.android.util.AppConstants.Mesh.STALE_PEER_TIMEOUT_MS) {
-            Log.w(TAG, "Ignoring stale ANNOUNCE from ${peerID.take(8)} (age=${age}ms > ${com.bitchat.android.util.AppConstants.Mesh.STALE_PEER_TIMEOUT_MS}ms)")
-            return false
+        val clockSkewMs = kotlin.math.abs(now - packet.timestamp.toLong())
+        if (clockSkewMs > ANNOUNCE_CLOCK_SKEW_TOLERANCE_MS) {
+            Log.w(TAG, "Ignoring ANNOUNCE from ${peerID.take(8)} with excessive clock skew (${clockSkewMs}ms > ${ANNOUNCE_CLOCK_SKEW_TOLERANCE_MS}ms)")
+            return AnnounceHandlingResult.Rejected
         }
         
-        // Try to decode as iOS-compatible IdentityAnnouncement with TLV format
-        val announcement = IdentityAnnouncement.decode(packet.payload)
+        val announcement = AnnouncementIdentityValidator.verify(packet, peerID) { signature, data, key ->
+            delegate?.verifyEd25519Signature(signature, data, key) ?: false
+        }
         if (announcement == null) {
-            Log.w(TAG, "Failed to decode announce from $peerID as iOS-compatible TLV format")
-            return false
+            Log.w(TAG, "Rejecting malformed, unbound, or invalidly signed ANNOUNCE from ${peerID.take(8)}")
+            return AnnounceHandlingResult.Rejected
         }
-        
-        // Verify packet signature using the announced signing public key
-        var verified = false
-        if (packet.signature != null) {
-            // Verify that the packet was signed by the signing private key corresponding to the announced signing public key
-            verified = delegate?.verifyEd25519Signature(packet.signature!!, packet.toBinaryDataForSigning()!!, announcement.signingPublicKey) ?: false
-            if (!verified) {
-                Log.w(TAG, "⚠️ Signature verification for announce failed ${peerID.take(8)}")
-            }
+
+        val persistedSigningKey = delegate?.getAuthenticatedSigningKey(announcement.noisePublicKey)
+        if (persistedSigningKey != null &&
+            !persistedSigningKey.contentEquals(announcement.signingPublicKey)
+        ) {
+            Log.w(TAG, "Rejecting ANNOUNCE Ed key that conflicts with authenticated peer state")
+            return AnnounceHandlingResult.Rejected
         }
 
+        var verified = true
+
         // Check for existing peer with different noise public key
         // If existing peer has a different noise public key, do not consider this verified
         val existingPeer = delegate?.getPeerInfo(peerID)
         
         if (existingPeer != null && existingPeer.noisePublicKey != null && !existingPeer.noisePublicKey!!.contentEquals(announcement.noisePublicKey)) {
-            Log.w(TAG, "⚠️ Announce key mismatch for ${peerID.take(8)}... — keeping unverified")
+            Log.w(TAG, "Announce key mismatch for ${peerID.take(8)} - keeping unverified")
+            verified = false
+        }
+
+        if (
+            existingPeer?.signingPublicKey != null &&
+            !existingPeer.signingPublicKey!!.contentEquals(announcement.signingPublicKey)
+        ) {
+            Log.w(
+                TAG,
+                "Rejecting signing-key replacement for ${peerID.take(8)} without authenticated peer-state proof"
+            )
             verified = false
         }
 
         // Require verified announce; ignore otherwise (no backward compatibility)
         if (!verified) {
-            Log.w(TAG, "❌ Ignoring unverified announce from ${peerID.take(8)}...")
-            return false
+            return AnnounceHandlingResult.Rejected
         }
         
-        // Successfully decoded TLV format exactly like iOS
-        Log.d(TAG, "✅ Verified announce from $peerID: nickname=${announcement.nickname}, " +
-                "noisePublicKey=${announcement.noisePublicKey.joinToString("") { "%02x".format(it) }.take(16)}..., " +
-                "signingPublicKey=${announcement.signingPublicKey.joinToString("") { "%02x".format(it) }.take(16)}...")
-        
         // Extract nickname and public keys from TLV data
         val nickname = announcement.nickname
         val noisePublicKey = announcement.noisePublicKey
         val signingPublicKey = announcement.signingPublicKey
         
         // Update peer info with verification status through new method
-        val isFirstAnnounce = delegate?.updatePeerInfo(
+        val isFirstAnnounce = delegate?.updatePeerInfoFromVerifiedAnnouncement(
             peerID = peerID,
             nickname = nickname,
             noisePublicKey = noisePublicKey,
             signingPublicKey = signingPublicKey,
-            isVerified = true
+            isVerified = true,
+            capabilities = announcement.capabilities
         ) ?: false
 
-        // Update peer ID binding with noise public key for identity management
-        delegate?.updatePeerIDBinding(
-            newPeerID = peerID,
-            nickname = nickname,
-            publicKey = noisePublicKey,
-            previousPeerID = null
-        )
-        
         // Update mesh graph from gossip neighbors (only if TLV present)
         try {
             val neighborsOrNull = com.bitchat.android.services.meshgraph.GossipTLV.decodeNeighborsFromAnnouncementPayload(packet.payload)
@@ -294,8 +352,8 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
                 .updateFromAnnouncement(peerID, nickname, neighborsOrNull, packet.timestamp)
         } catch (_: Exception) { }
 
-        Log.d(TAG, "✅ Processed verified TLV announce: stored identity for $peerID")
-        return isFirstAnnounce
+        Log.d(TAG, "Verified announce from $peerID (${announcement.nickname})")
+        return AnnounceHandlingResult.Accepted(isFirstAnnounce)
     }
     
     /**
@@ -306,15 +364,12 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
         val packet = routed.packet
         val peerID = routed.peerID ?: "unknown"
         
-        Log.d(TAG, "Processing Noise handshake from $peerID (${packet.payload.size} bytes)")
-        
         // Skip our own handshake messages
         if (peerID == myPeerID) return
         
         // Check if handshake is addressed to us
         val recipientID = packet.recipientID?.toHexString()
         if (recipientID != myPeerID) {
-            Log.d(TAG, "Handshake not for me (for $recipientID, I am $myPeerID)")
             return
         }
         
@@ -323,8 +378,6 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
             val response = delegate?.processNoiseHandshakeMessage(packet.payload, peerID)
             
             if (response != null) {
-                Log.d(TAG, "Generated handshake response for $peerID (${response.size} bytes)")
-                
                 // Send response using same packet type (simplified iOS approach)
                 val responsePacket = BitchatPacket(
                     version = 1u,
@@ -338,13 +391,6 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
                 )
                 
                 delegate?.sendPacket(responsePacket)
-                Log.d(TAG, "📤 Sent handshake response to $peerID")
-            }
-            
-            // Check if session is now established
-            val hasSession = delegate?.hasNoiseSession(peerID) ?: false
-            if (hasSession) {
-                Log.d(TAG, "✅ Noise session established with $peerID")
             }
             
         } catch (e: Exception) {
@@ -387,7 +433,7 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
         // Enforce: only accept public messages from verified peers we know
         val peerInfo = delegate?.getPeerInfo(peerID)
         if (peerInfo == null || !peerInfo.isVerifiedNickname) {
-            Log.w(TAG, "🚫 Dropping public message from unverified or unknown peer ${peerID.take(8)}...")
+            Log.w(TAG, "Dropping public message from unverified peer ${peerID.take(8)}")
             return
         }
         
@@ -396,9 +442,7 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
             val isFileTransfer = com.bitchat.android.protocol.MessageType.fromValue(packet.type) == com.bitchat.android.protocol.MessageType.FILE_TRANSFER
             val file = com.bitchat.android.model.BitchatFilePacket.decode(packet.payload)
             if (file != null) {
-                if (isFileTransfer) {
-                    Log.d(TAG, "📥 FILE_TRANSFER decode success (broadcast): name='${file.fileName}', size=${file.fileSize}, mime='${file.mimeType}', from=${peerID.take(8)}")
-                }
+
                 val savedPath = com.bitchat.android.features.file.FileUtils.saveIncomingFile(appContext, file)
                 val message = BitchatMessage(
                     id = PacketIdUtil.computeIdHex(packet).uppercase(),
@@ -408,11 +452,10 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
                     senderPeerID = peerID,
                     timestamp = Date(packet.timestamp.toLong())
                 )
-                Log.d(TAG, "📄 Saved incoming file to $savedPath")
                 delegate?.onMessageReceived(message)
                 return
             } else if (isFileTransfer) {
-                Log.w(TAG, "⚠️ FILE_TRANSFER decode failed (broadcast) from ${peerID.take(8)} payloadSize=${packet.payload.size}")
+                Log.w(TAG, "FILE_TRANSFER decode failed (broadcast) from ${peerID.take(8)}")
             }
 
             // Fallback: plain text
@@ -434,19 +477,29 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
      */
     private suspend fun handlePrivateMessage(packet: BitchatPacket, peerID: String) {
         try {
-            // Verify signature if present
-            if (packet.signature != null && !delegate?.verifySignature(packet, peerID)!!) {
+            val isFileTransfer = com.bitchat.android.protocol.MessageType.fromValue(packet.type) ==
+                com.bitchat.android.protocol.MessageType.FILE_TRANSFER
+            val signatureIsValid = packet.signature != null &&
+                delegate?.verifySignature(packet, peerID) == true
+
+            // Migration fallback is visible to relays, so sender authenticity
+            // is mandatory. Never accept an unsigned directed raw file.
+            if (isFileTransfer && !signatureIsValid) {
+                Log.w(TAG, "Unsigned or invalid signed private file from $peerID")
+                return
+            }
+
+            // Preserve prior behavior for other directed packet types: verify
+            // a signature whenever one is present.
+            if (!isFileTransfer && packet.signature != null && !signatureIsValid) {
                 Log.w(TAG, "Invalid signature for private message from $peerID")
                 return
             }
 
             // Try file packet first (voice, image, etc.) and log outcome for FILE_TRANSFER
-            val isFileTransfer = com.bitchat.android.protocol.MessageType.fromValue(packet.type) == com.bitchat.android.protocol.MessageType.FILE_TRANSFER
             val file = com.bitchat.android.model.BitchatFilePacket.decode(packet.payload)
             if (file != null) {
-                if (isFileTransfer) {
-                    Log.d(TAG, "📥 FILE_TRANSFER decode success (private): name='${file.fileName}', size=${file.fileSize}, mime='${file.mimeType}', from=${peerID.take(8)}")
-                }
+
                 val savedPath = com.bitchat.android.features.file.FileUtils.saveIncomingFile(appContext, file)
                 val message = BitchatMessage(
                     id = java.util.UUID.randomUUID().toString().uppercase(),
@@ -545,24 +598,19 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
      */
     private fun handleFavoriteNotificationFromMesh(content: String, fromPeerID: String) {
         try {
-            val isFavorite = content.startsWith("[FAVORITED]")
-            val npub = content.substringAfter(":", "").trim().takeIf { it.startsWith("npub1") }
+            val control = FavoriteControlMessage.parse(content) ?: return
 
-            // Update mutual favorite status in persistence
-            // Resolve full Noise key if available via delegate peer info
             val peerInfo = delegate?.getPeerInfo(fromPeerID)
             val noiseKey = peerInfo?.noisePublicKey
             if (noiseKey != null) {
-                com.bitchat.android.favorites.FavoritesPersistenceService.shared.updatePeerFavoritedUs(noiseKey, isFavorite)
-                if (npub != null) {
-                    // Index by noise key and current mesh peerID for fast Nostr routing
-                    com.bitchat.android.favorites.FavoritesPersistenceService.shared.updateNostrPublicKey(noiseKey, npub)
-                    com.bitchat.android.favorites.FavoritesPersistenceService.shared.updateNostrPublicKeyForPeerID(fromPeerID, npub)
+                com.bitchat.android.favorites.FavoritesPersistenceService.shared.updatePeerFavoritedUs(noiseKey, control.isFavorite)
+                if (control.npub != null) {
+                    com.bitchat.android.favorites.FavoritesPersistenceService.shared.updateNostrPublicKey(noiseKey, control.npub)
+                    com.bitchat.android.favorites.FavoritesPersistenceService.shared.updateNostrPublicKeyForPeerID(fromPeerID, control.npub)
                 }
 
-                // Determine iOS-style guidance text
                 val rel = com.bitchat.android.favorites.FavoritesPersistenceService.shared.getFavoriteStatus(noiseKey)
-                val guidance = if (isFavorite) {
+                val guidance = if (control.isFavorite) {
                     if (rel?.isFavorite == true) {
                         " — mutual! You can continue DMs via Nostr when out of mesh."
                     } else {
@@ -572,15 +620,32 @@ class MessageHandler(private val myPeerID: String, private val appContext: andro
                     ". DMs over Nostr will pause unless you both favorite again."
                 }
 
-                // Emit system message via delegate callback
-                val action = if (isFavorite) "favorited" else "unfavorited"
+                val action = if (control.isFavorite) "favorited" else "unfavorited"
+                val notice = "${peerInfo.nickname} $action you$guidance"
                 val sys = com.bitchat.android.model.BitchatMessage(
                     sender = "system",
-                    content = "${peerInfo.nickname} $action you$guidance",
+                    content = notice,
                     timestamp = java.util.Date(),
                     isRelay = false
                 )
                 delegate?.onMessageReceived(sys)
+
+                // Mirror the notice into the private conversation so it's visible while chatting
+                try {
+                    val conversationID = com.bitchat.android.services.ContactDirectory
+                        .canonicalConversationId(fromPeerID)
+                    val sysPrivate = com.bitchat.android.model.BitchatMessage(
+                        sender = "system",
+                        content = notice,
+                        timestamp = java.util.Date(),
+                        isRelay = false,
+                        isPrivate = true,
+                        senderPeerID = conversationID
+                    )
+                    delegate?.onMessageReceived(sysPrivate)
+                } catch (_: Exception) {
+                    // Best-effort; public notice already delivered
+                }
             }
         } catch (_: Exception) {
             // Best-effort; ignore errors
@@ -600,7 +665,14 @@ interface MessageHandlerDelegate {
     fun getNetworkSize(): Int
     fun getMyNickname(): String?
     fun getPeerInfo(peerID: String): PeerInfo?
-    fun updatePeerInfo(peerID: String, nickname: String, noisePublicKey: ByteArray, signingPublicKey: ByteArray, isVerified: Boolean): Boolean
+    fun updatePeerInfoFromVerifiedAnnouncement(
+        peerID: String,
+        nickname: String,
+        noisePublicKey: ByteArray,
+        signingPublicKey: ByteArray,
+        isVerified: Boolean,
+        capabilities: com.bitchat.android.model.PeerCapabilities? = null
+    ): Boolean
     
     // Packet operations
     fun sendPacket(packet: BitchatPacket)
@@ -610,15 +682,23 @@ interface MessageHandlerDelegate {
     // Cryptographic operations
     fun verifySignature(packet: BitchatPacket, peerID: String): Boolean
     fun encryptForPeer(data: ByteArray, recipientPeerID: String): ByteArray?
-    fun decryptFromPeer(encryptedData: ByteArray, senderPeerID: String): ByteArray?
+    fun decryptFromPeer(
+        encryptedData: ByteArray,
+        senderPeerID: String
+    ): com.bitchat.android.noise.NoiseDecryptionResult?
     fun verifyEd25519Signature(signature: ByteArray, data: ByteArray, publicKey: ByteArray): Boolean
+    fun getAuthenticatedSigningKey(noisePublicKey: ByteArray): ByteArray? = null
     
     // Noise protocol operations
     fun hasNoiseSession(peerID: String): Boolean
     fun initiateNoiseHandshake(peerID: String)
+    fun removeNoiseSession(peerID: String) {}
     fun processNoiseHandshakeMessage(payload: ByteArray, peerID: String): ByteArray?
-    fun updatePeerIDBinding(newPeerID: String, nickname: String,
-                           publicKey: ByteArray, previousPeerID: String?)
+    fun onAuthenticatedPeerStateReceived(
+        peerID: String,
+        state: AuthenticatedPeerState,
+        authenticatedSession: com.bitchat.android.noise.AuthenticatedNoiseSession
+    ) {}
     
     // Message operations
     fun decryptChannelMessage(encryptedContent: ByteArray, channel: String): String?
@@ -630,4 +710,10 @@ interface MessageHandlerDelegate {
     fun onReadReceiptReceived(messageID: String, peerID: String)
     fun onVerifyChallengeReceived(peerID: String, payload: ByteArray, timestampMs: Long)
     fun onVerifyResponseReceived(peerID: String, payload: ByteArray, timestampMs: Long)
+    fun onNdrEventReceived(
+        peerID: String,
+        payload: ByteArray,
+        timestampMs: Long,
+        authenticatedSession: com.bitchat.android.noise.AuthenticatedNoiseSession
+    )
 }

app/src/main/java/com/bitchat/android/mesh/PacketProcessor.kt

@@ -46,15 +46,8 @@ class PacketProcessor(private val myPeerID: String) {
     private fun getOrCreateActorForPeer(peerID: String) = processorScope.actor<RoutedPacket>(
         capacity = Channel.UNLIMITED
     ) {
-        Log.d(TAG, "🎭 Created packet actor for peer: ${formatPeerForLog(peerID)}")
-        try {
-            for (packet in channel) {
-                Log.d(TAG, "📦 Processing packet type ${packet.packet.type} from ${formatPeerForLog(peerID)} (serialized)")
-                handleReceivedPacket(packet)
-                Log.d(TAG, "Completed packet type ${packet.packet.type} from ${formatPeerForLog(peerID)}")
-            }
-        } finally {
-            Log.d(TAG, "🎭 Packet actor for ${formatPeerForLog(peerID)} terminated")
+        for (packet in channel) {
+            handleReceivedPacket(packet)
         }
     }
     
@@ -71,7 +64,6 @@ class PacketProcessor(private val myPeerID: String) {
      * SURGICAL FIX: Route to per-peer actor for serialized processing
      */
     fun processPacket(routed: RoutedPacket) {
-        Log.d(TAG, "processPacket ${routed.packet.type}")
         val peerID = routed.peerID
 
         if (peerID == null) {
@@ -125,13 +117,11 @@ class PacketProcessor(private val myPeerID: String) {
 
         // Basic validation and security checks
         if (!delegate?.validatePacketSecurity(packet, peerID)!!) {
-            Log.d(TAG, "Packet failed security validation from ${formatPeerForLog(peerID)}")
             return
         }
 
         var validPacket = true
         val messageType = MessageType.fromValue(packet.type)
-        Log.d(TAG, "Processing packet type ${messageType} from ${formatPeerForLog(peerID)}")
         // Verbose logging to debug manager (and chat via ChatViewModel observer)
         try {
             val mt = messageType?.name ?: packet.type.toString()
@@ -143,7 +133,7 @@ class PacketProcessor(private val myPeerID: String) {
         
         // Handle public packet types (no address check needed)
         when (messageType) {
-            MessageType.ANNOUNCE -> handleAnnounce(routed)
+            MessageType.ANNOUNCE -> validPacket = handleAnnounce(routed)
             MessageType.MESSAGE -> handleMessage(routed)
             MessageType.FILE_TRANSFER -> handleMessage(routed) // treat same routing path; parsing happens in handler
             MessageType.LEAVE -> handleLeave(routed)
@@ -153,8 +143,8 @@ class PacketProcessor(private val myPeerID: String) {
                 // Handle private packet types (address check required)
                 if (packetRelayManager.isPacketAddressedToMe(packet)) {
                     when (messageType) {
-                        MessageType.NOISE_HANDSHAKE -> handleNoiseHandshake(routed)
-                        MessageType.NOISE_ENCRYPTED -> handleNoiseEncrypted(routed)
+                        MessageType.NOISE_HANDSHAKE -> validPacket = handleNoiseHandshake(routed)
+                        MessageType.NOISE_ENCRYPTED -> validPacket = handleNoiseEncrypted(routed)
                         MessageType.FILE_TRANSFER -> handleMessage(routed)
                         else -> {
                             validPacket = false
@@ -162,7 +152,7 @@ class PacketProcessor(private val myPeerID: String) {
                         }
                     }
                 } else {
-                    Log.d(TAG, "Private packet type ${messageType} not addressed to us (from: ${formatPeerForLog(peerID)} to ${packet.recipientID?.let { it.joinToString("") { b -> "%02x".format(b) } }}), skipping")
+                    // Not addressed to us; only relay handling below applies
                 }
             }
         }
@@ -179,36 +169,29 @@ class PacketProcessor(private val myPeerID: String) {
     /**
      * Handle Noise handshake message - SIMPLIFIED iOS-compatible version
      */
-    private suspend fun handleNoiseHandshake(routed: RoutedPacket) {
-        val peerID = routed.peerID ?: "unknown"
-        Log.d(TAG, "Processing Noise handshake from ${formatPeerForLog(peerID)}")
-        delegate?.handleNoiseHandshake(routed)
+    private suspend fun handleNoiseHandshake(routed: RoutedPacket): Boolean {
+        return delegate?.handleNoiseHandshake(routed) ?: false
     }
     
     /**
      * Handle Noise encrypted transport message
+     * Returns false when decryption fails so undecryptable packets do not prove liveness.
      */
-    private suspend fun handleNoiseEncrypted(routed: RoutedPacket) {
-        val peerID = routed.peerID ?: "unknown"
-        Log.d(TAG, "Processing Noise encrypted message from ${formatPeerForLog(peerID)}")
-        delegate?.handleNoiseEncrypted(routed)
+    private suspend fun handleNoiseEncrypted(routed: RoutedPacket): Boolean {
+        return delegate?.handleNoiseEncrypted(routed) ?: false
     }
     
     /**
      * Handle announce message
      */
-    private suspend fun handleAnnounce(routed: RoutedPacket) {
-        val peerID = routed.peerID ?: "unknown"
-        Log.d(TAG, "Processing announce from ${formatPeerForLog(peerID)}")
-        delegate?.handleAnnounce(routed)
+    private suspend fun handleAnnounce(routed: RoutedPacket): Boolean {
+        return delegate?.handleAnnounce(routed) ?: false
     }
     
     /**
      * Handle regular message
      */
     private suspend fun handleMessage(routed: RoutedPacket) {
-        val peerID = routed.peerID ?: "unknown"
-        Log.d(TAG, "Processing message from ${formatPeerForLog(peerID)}")
         delegate?.handleMessage(routed)
     }
     
@@ -216,8 +199,6 @@ class PacketProcessor(private val myPeerID: String) {
      * Handle leave message
      */
     private suspend fun handleLeave(routed: RoutedPacket) {
-        val peerID = routed.peerID ?: "unknown"
-        Log.d(TAG, "Processing leave from ${formatPeerForLog(peerID)}")
         delegate?.handleLeave(routed)
     }
     
@@ -225,13 +206,16 @@ class PacketProcessor(private val myPeerID: String) {
      * Handle message fragments
      */
     private suspend fun handleFragment(routed: RoutedPacket) {
-        val peerID = routed.peerID ?: "unknown"
-        Log.d(TAG, "Processing fragment from ${formatPeerForLog(peerID)}")
-        
         val reassembledPacket = delegate?.handleFragment(routed.packet)
         if (reassembledPacket != null) {
-            Log.d(TAG, "Fragment reassembled, processing complete message")
-            handleReceivedPacket(RoutedPacket(reassembledPacket, routed.peerID, routed.relayAddress))
+            handleReceivedPacket(
+                RoutedPacket(
+                    packet = reassembledPacket,
+                    peerID = routed.peerID,
+                    relayAddress = routed.relayAddress,
+                    ingressLinkID = routed.ingressLinkID
+                )
+            )
         }
         
         // Fragment relay is now handled by centralized PacketRelayManager
@@ -241,8 +225,6 @@ class PacketProcessor(private val myPeerID: String) {
      * Handle REQUEST_SYNC packets (public, TTL=1)
      */
     private suspend fun handleRequestSync(routed: RoutedPacket) {
-        val peerID = routed.peerID ?: "unknown"
-        Log.d(TAG, "Processing REQUEST_SYNC from ${formatPeerForLog(peerID)}")
         delegate?.handleRequestSync(routed)
     }
     
@@ -291,8 +273,6 @@ class PacketProcessor(private val myPeerID: String) {
         
         // Cancel the main scope
         processorScope.cancel()
-        
-        Log.d(TAG, "PacketProcessor shutdown complete")
     }
 }
 
@@ -313,8 +293,8 @@ interface PacketProcessorDelegate {
     
     // Message type handlers
     fun handleNoiseHandshake(routed: RoutedPacket): Boolean
-    fun handleNoiseEncrypted(routed: RoutedPacket)
-    fun handleAnnounce(routed: RoutedPacket)
+    fun handleNoiseEncrypted(routed: RoutedPacket): Boolean
+    suspend fun handleAnnounce(routed: RoutedPacket): Boolean
     fun handleMessage(routed: RoutedPacket)
     fun handleLeave(routed: RoutedPacket)
     fun handleFragment(packet: BitchatPacket): BitchatPacket?

app/src/main/java/com/bitchat/android/mesh/PeerManager.kt

@@ -1,6 +1,8 @@
 package com.bitchat.android.mesh
 
 import android.util.Log
+import com.bitchat.android.model.AuthenticatedPeerState
+import com.bitchat.android.model.PeerCapabilities
 import kotlinx.coroutines.*
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.CopyOnWriteArrayList
@@ -17,7 +19,11 @@ data class PeerInfo(
     var noisePublicKey: ByteArray?,
     var signingPublicKey: ByteArray?,      // NEW: Ed25519 public key for verification
     var isVerifiedNickname: Boolean,       // NEW: Verification status flag
-    var lastSeen: Long  // Using Long instead of Date for simplicity
+    var lastSeen: Long,  // Using Long instead of Date for simplicity
+    var capabilities: PeerCapabilities? = null, // null means a signed old-client announce omitted TLV 0x05
+    var hasVerifiedAnnouncement: Boolean = false,
+    /** Noise key that the preserved capability state was actually signed alongside. */
+    var verifiedAnnouncementNoisePublicKey: ByteArray? = null
 ) {
     override fun equals(other: Any?): Boolean {
         if (this === other) return true
@@ -39,6 +45,14 @@ data class PeerInfo(
         } else if (other.signingPublicKey != null) return false
         if (isVerifiedNickname != other.isVerifiedNickname) return false
         if (lastSeen != other.lastSeen) return false
+        if (capabilities != other.capabilities) return false
+        if (hasVerifiedAnnouncement != other.hasVerifiedAnnouncement) return false
+        val thisVerifiedAnnouncementKey = verifiedAnnouncementNoisePublicKey
+        val otherVerifiedAnnouncementKey = other.verifiedAnnouncementNoisePublicKey
+        if (thisVerifiedAnnouncementKey != null) {
+            if (otherVerifiedAnnouncementKey == null) return false
+            if (!thisVerifiedAnnouncementKey.contentEquals(otherVerifiedAnnouncementKey)) return false
+        } else if (otherVerifiedAnnouncementKey != null) return false
         
         return true
     }
@@ -52,6 +66,9 @@ data class PeerInfo(
         result = 31 * result + (signingPublicKey?.contentHashCode() ?: 0)
         result = 31 * result + isVerifiedNickname.hashCode()
         result = 31 * result + lastSeen.hashCode()
+        result = 31 * result + (capabilities?.hashCode() ?: 0)
+        result = 31 * result + hasVerifiedAnnouncement.hashCode()
+        result = 31 * result + (verifiedAnnouncementNoisePublicKey?.contentHashCode() ?: 0)
         return result
     }
 }
@@ -108,12 +125,104 @@ class PeerManager {
         noisePublicKey: ByteArray,
         signingPublicKey: ByteArray,
         isVerified: Boolean
+    ): Boolean {
+        val existing = peers[peerID]
+        return updatePeerInfoInternal(
+            peerID = peerID,
+            nickname = nickname,
+            noisePublicKey = noisePublicKey,
+            signingPublicKey = signingPublicKey,
+            isVerified = isVerified,
+            capabilities = existing?.capabilities,
+            hasVerifiedAnnouncement = existing?.hasVerifiedAnnouncement == true,
+            verifiedAnnouncementNoisePublicKey = existing?.verifiedAnnouncementNoisePublicKey
+        )
+    }
+
+    /**
+     * Apply the exact capability state from a signature-verified announce.
+     * A null value is meaningful: the peer signed an old-format announce that
+     * omitted TLV 0x05. Normal peer refreshes use [updatePeerInfo] and retain
+     * the last signed capability state instead of accidentally erasing it.
+     */
+    fun updatePeerInfoFromVerifiedAnnouncement(
+        peerID: String,
+        nickname: String,
+        noisePublicKey: ByteArray,
+        signingPublicKey: ByteArray,
+        isVerified: Boolean,
+        capabilities: PeerCapabilities?
+    ): Boolean = updatePeerInfoInternal(
+        peerID = peerID,
+        nickname = nickname,
+        noisePublicKey = noisePublicKey,
+        signingPublicKey = signingPublicKey,
+        isVerified = isVerified,
+        capabilities = capabilities,
+        hasVerifiedAnnouncement = true,
+        verifiedAnnouncementNoisePublicKey = noisePublicKey.copyOf()
+    )
+
+    /** Replace capability/Ed identity from Noise 0x21 in one peer-map mutation. */
+    @Synchronized
+    fun applyAuthenticatedPeerState(
+        peerID: String,
+        authenticatedNoisePublicKey: ByteArray,
+        state: AuthenticatedPeerState
+    ) {
+        val existing = peers[peerID]
+        val announcementMatchesAuthenticatedState = existing?.hasVerifiedAnnouncement == true &&
+            existing.verifiedAnnouncementNoisePublicKey?.contentEquals(authenticatedNoisePublicKey) == true &&
+            existing.signingPublicKey?.contentEquals(state.signingPublicKey) == true
+        val replacement = PeerInfo(
+            id = peerID,
+            // A copied-static preannouncement cannot retain its attacker-chosen display name once
+            // authenticated peer state proves a different Ed key.
+            nickname = existing?.nickname?.takeIf { announcementMatchesAuthenticatedState } ?: peerID,
+            isConnected = true,
+            isDirectConnection = existing?.isDirectConnection ?: false,
+            noisePublicKey = authenticatedNoisePublicKey.copyOf(),
+            signingPublicKey = state.signingPublicKey.copyOf(),
+            isVerifiedNickname = existing?.isVerifiedNickname == true && announcementMatchesAuthenticatedState,
+            lastSeen = System.currentTimeMillis(),
+            capabilities = state.capabilities,
+            hasVerifiedAnnouncement = announcementMatchesAuthenticatedState,
+            verifiedAnnouncementNoisePublicKey = authenticatedNoisePublicKey.copyOf()
+                .takeIf { announcementMatchesAuthenticatedState }
+        )
+        peers[peerID] = replacement
+        if (existing == null || existing != replacement) notifyPeerListUpdate()
+    }
+
+    private fun updatePeerInfoInternal(
+        peerID: String,
+        nickname: String,
+        noisePublicKey: ByteArray,
+        signingPublicKey: ByteArray,
+        isVerified: Boolean,
+        capabilities: PeerCapabilities?,
+        hasVerifiedAnnouncement: Boolean,
+        verifiedAnnouncementNoisePublicKey: ByteArray?
     ): Boolean {
         if (peerID == "unknown") return false
+
+        fun keysMatch(a: ByteArray?, b: ByteArray?): Boolean {
+            if (a == null && b == null) return true
+            if (a == null || b == null) return false
+            return a.contentEquals(b)
+        }
         
         val now = System.currentTimeMillis()
         val existingPeer = peers[peerID]
         val isNewPeer = existingPeer == null
+        val wasVerified = existingPeer?.isVerifiedNickname == true
+        val nicknameChanged = existingPeer != null && existingPeer.nickname != nickname
+        val noiseKeyChanged = existingPeer != null && !keysMatch(existingPeer.noisePublicKey, noisePublicKey)
+        val signingKeyChanged = existingPeer != null && !keysMatch(existingPeer.signingPublicKey, signingPublicKey)
+        val connectedChanged = existingPeer != null && existingPeer.isConnected != true
+        val capabilitiesChanged = existingPeer != null && existingPeer.capabilities != capabilities
+        val announcementStateChanged = existingPeer != null &&
+            existingPeer.hasVerifiedAnnouncement != hasVerifiedAnnouncement
         
         // Update or create peer info
         val peerInfo = PeerInfo(
@@ -124,7 +233,10 @@ class PeerManager {
             noisePublicKey = noisePublicKey,
             signingPublicKey = signingPublicKey,
             isVerifiedNickname = isVerified,
-            lastSeen = now
+            lastSeen = now,
+            capabilities = capabilities,
+            hasVerifiedAnnouncement = hasVerifiedAnnouncement,
+            verifiedAnnouncementNoisePublicKey = verifiedAnnouncementNoisePublicKey?.copyOf()
         )
         
         peers[peerID] = peerInfo
@@ -133,18 +245,28 @@ class PeerManager {
         // No legacy maps; peers map is the single source of truth
         // Maintain announcedPeers for first-time announce semantics
         
+        val shouldNotify = when {
+            isNewPeer && isVerified -> true
+            wasVerified != isVerified -> true
+            nicknameChanged || noiseKeyChanged || signingKeyChanged || connectedChanged ||
+                capabilitiesChanged || announcementStateChanged -> true
+            else -> false
+        }
+
         if (isNewPeer && isVerified) {
             announcedPeers.add(peerID)
-            notifyPeerListUpdate()
             Log.d(TAG, "🆕 New verified peer: $nickname ($peerID)")
-            return true
         } else if (isVerified) {
             Log.d(TAG, "🔄 Updated verified peer: $nickname ($peerID)")
         } else {
             Log.d(TAG, "⚠️ Unverified peer announcement from: $nickname ($peerID)")
         }
+
+        if (shouldNotify) {
+            notifyPeerListUpdate()
+        }
         
-        return false
+        return isNewPeer && isVerified
     }
 
     /**
@@ -179,14 +301,6 @@ class PeerManager {
         }
     }
 
-    /**
-     * Force a peer list update notification.
-     * Call this when connection state changes to refresh UI badges.
-     */
-    fun refreshPeerList() {
-        notifyPeerListUpdate()
-    }
-
     // MARK: - Legacy Methods (maintained for compatibility)
 
     /**
@@ -414,6 +528,10 @@ class PeerManager {
         val peerList = getActivePeerIDs()
         delegate?.onPeerListUpdated(peerList)
     }
+
+    fun refreshPeerList() {
+        notifyPeerListUpdate()
+    }
     
     /**
      * Start periodic cleanup of stale peers

app/src/main/java/com/bitchat/android/mesh/PowerManager.kt

@@ -14,327 +14,261 @@ import androidx.lifecycle.Lifecycle
 import androidx.lifecycle.LifecycleEventObserver
 import androidx.lifecycle.LifecycleOwner
 import androidx.lifecycle.ProcessLifecycleOwner
-import kotlinx.coroutines.*
-import kotlin.math.max
+import com.bitchat.android.services.AppStateStore
+import com.bitchat.android.util.AppConstants
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.launch
 
 /**
- * Power-aware Bluetooth management for bitchat
- * Adjusts scanning, advertising, and connection behavior based on battery state
+ * Process-wide source of truth for background and battery-aware scheduling.
+ *
+ * The manager deliberately exposes policy only. Consumers retain ownership of their hardware and
+ * network jobs, so changing profile never implies disconnecting a transport or suspending Tor.
  */
-class PowerManager(private val context: Context) : LifecycleEventObserver {
-    
+class PowerManager private constructor(context: Context) : LifecycleEventObserver {
+
+    enum class PowerMode {
+        PERFORMANCE,
+        BALANCED,
+        POWER_SAVER,
+        ULTRA_LOW_POWER
+    }
+
+    enum class BatteryBand { NORMAL, LOW, CRITICAL }
+
+    data class BleSchedule(
+        val scanOnMs: Long,
+        val scanOffMs: Long,
+        val continuousScan: Boolean,
+        val rssiPollIntervalMs: Long,
+        val maxConnections: Int = 8
+    )
+
+    data class WifiAwareSchedule(
+        val tcpKeepAliveMs: Long,
+        val discoveryKeepAliveMs: Long,
+        val connectionMaintenanceMs: Long,
+        val discoveryIdleRefreshMs: Long,
+        val discoverySessionRefreshMinMs: Long,
+        val discoveryStaleMs: Long
+    )
+
+    data class NostrSchedule(
+        val presenceHeartbeatMinMs: Long,
+        val presenceHeartbeatMaxMs: Long,
+        val subscriptionValidationMs: Long
+    )
+
+    data class RuntimePerformanceProfile(
+        val mode: PowerMode,
+        val batteryBand: BatteryBand,
+        val isBackground: Boolean,
+        val isCharging: Boolean,
+        val hasDirectPeers: Boolean,
+        val ble: BleSchedule,
+        val meshAnnouncementIntervalMs: Long,
+        val wifiAware: WifiAwareSchedule,
+        val nostr: NostrSchedule
+    )
+
     companion object {
         private const val TAG = "PowerManager"
-        
-        // Battery thresholds
-        private const val CRITICAL_BATTERY = com.bitchat.android.util.AppConstants.Power.CRITICAL_BATTERY_PERCENT
-        private const val LOW_BATTERY = com.bitchat.android.util.AppConstants.Power.LOW_BATTERY_PERCENT
-        private const val MEDIUM_BATTERY = com.bitchat.android.util.AppConstants.Power.MEDIUM_BATTERY_PERCENT
-        
-        // Scan duty cycle periods (ms)
-        private const val SCAN_ON_DURATION_NORMAL = com.bitchat.android.util.AppConstants.Power.SCAN_ON_DURATION_NORMAL_MS    // 8 seconds on
-        private const val SCAN_OFF_DURATION_NORMAL = com.bitchat.android.util.AppConstants.Power.SCAN_OFF_DURATION_NORMAL_MS   // 2 seconds off
-        private const val SCAN_ON_DURATION_POWER_SAVE = com.bitchat.android.util.AppConstants.Power.SCAN_ON_DURATION_POWER_SAVE_MS    // 2 seconds on
-        private const val SCAN_OFF_DURATION_POWER_SAVE = com.bitchat.android.util.AppConstants.Power.SCAN_OFF_DURATION_POWER_SAVE_MS  // 8 seconds off
-        private const val SCAN_ON_DURATION_ULTRA_LOW = com.bitchat.android.util.AppConstants.Power.SCAN_ON_DURATION_ULTRA_LOW_MS      // 1 second on
-        private const val SCAN_OFF_DURATION_ULTRA_LOW = com.bitchat.android.util.AppConstants.Power.SCAN_OFF_DURATION_ULTRA_LOW_MS   // 10 seconds off
-        
-        // Connection limits
-        private const val MAX_CONNECTIONS_NORMAL = com.bitchat.android.util.AppConstants.Power.MAX_CONNECTIONS_NORMAL
-        private const val MAX_CONNECTIONS_POWER_SAVE = com.bitchat.android.util.AppConstants.Power.MAX_CONNECTIONS_POWER_SAVE
-        private const val MAX_CONNECTIONS_ULTRA_LOW = com.bitchat.android.util.AppConstants.Power.MAX_CONNECTIONS_ULTRA_LOW
+
+        @Volatile
+        private var INSTANCE: PowerManager? = null
+
+        fun getInstance(context: Context): PowerManager =
+            INSTANCE ?: synchronized(this) {
+                INSTANCE ?: PowerManager(context.applicationContext).also { INSTANCE = it }
+            }
     }
-    
-    enum class PowerMode {
-        PERFORMANCE,    // Full power, no restrictions
-        BALANCED,       // Moderate power saving
-        POWER_SAVER,    // Aggressive power saving
-        ULTRA_LOW_POWER // Minimal operations only
-    }
-    
-    private var currentMode = PowerMode.BALANCED
-    private var isCharging = false
-    private var batteryLevel = 100
-    private var isAppInBackground = true
-    
-    private val powerScope = CoroutineScope(Dispatchers.IO + SupervisorJob())
-    private var dutyCycleJob: Job? = null
-    
-    var delegate: PowerManagerDelegate? = null
-    
-    // Battery monitoring
+
+    private val appContext = context.applicationContext
+    private val scope = CoroutineScope(Dispatchers.Default + SupervisorJob())
+
+    @Volatile private var batteryLevel = 100
+    @Volatile private var isCharging = false
+    @Volatile private var isAppInBackground = true
+    @Volatile private var hasDirectPeers = false
+    @Volatile private var shutdown = false
+
+    private val _profile = MutableStateFlow(
+        PowerProfileResolver.resolve(
+            batteryLevel = batteryLevel,
+            isCharging = isCharging,
+            isBackground = isAppInBackground,
+            hasDirectPeers = hasDirectPeers
+        )
+    )
+    val profile: StateFlow<RuntimePerformanceProfile> = _profile.asStateFlow()
+
     private val batteryReceiver = object : BroadcastReceiver() {
         override fun onReceive(context: Context?, intent: Intent?) {
             when (intent?.action) {
                 Intent.ACTION_BATTERY_CHANGED -> {
                     val level = intent.getIntExtra(BatteryManager.EXTRA_LEVEL, -1)
                     val scale = intent.getIntExtra(BatteryManager.EXTRA_SCALE, -1)
-                    if (level != -1 && scale != -1) {
-                        batteryLevel = (level * 100) / scale
-                    }
-                    
+                    if (level >= 0 && scale > 0) batteryLevel = (level * 100) / scale
+
                     val status = intent.getIntExtra(BatteryManager.EXTRA_STATUS, -1)
                     isCharging = status == BatteryManager.BATTERY_STATUS_CHARGING ||
-                                status == BatteryManager.BATTERY_STATUS_FULL
-                    
-                    updatePowerMode()
+                        status == BatteryManager.BATTERY_STATUS_FULL
+                    refreshProfile()
                 }
                 Intent.ACTION_POWER_CONNECTED -> {
                     isCharging = true
-                    updatePowerMode()
+                    refreshProfile()
                 }
                 Intent.ACTION_POWER_DISCONNECTED -> {
                     isCharging = false
-                    updatePowerMode()
+                    refreshProfile()
                 }
             }
         }
     }
-    
+
     init {
         registerBatteryReceiver()
-        
-        // Register for process lifecycle events on the main thread
         Handler(Looper.getMainLooper()).post {
             try {
                 ProcessLifecycleOwner.get().lifecycle.addObserver(this)
+                isAppInBackground = !ProcessLifecycleOwner.get().lifecycle.currentState
+                    .isAtLeast(Lifecycle.State.STARTED)
+                refreshProfile()
             } catch (e: Exception) {
-                Log.e(TAG, "Failed to register lifecycle observer: ${e.message}")
+                Log.e(TAG, "Failed to register process lifecycle observer: ${e.message}")
             }
         }
-        
-        updatePowerMode()
+        scope.launch {
+            AppStateStore.directPeers
+                .collect { peers ->
+                    hasDirectPeers = peers.isNotEmpty()
+                    refreshProfile()
+                }
+        }
     }
-    
-    fun start() {
-        Log.i(TAG, "Starting power management")
-        startDutyCycle()
-    }
-    
-    fun stop() {
-        Log.i(TAG, "Stopping power management")
-        powerScope.cancel()
-        unregisterBatteryReceiver()
-        
-        // Unregister lifecycle observer
+
+    /** Kept for existing callers; initialization is eager and idempotent. */
+    fun start() = Unit
+
+    /**
+     * Process-level teardown for explicit full application shutdown only.
+     * Transport stop/restart paths must not call this.
+     */
+    fun shutdown() {
+        if (shutdown) return
+        shutdown = true
+        scope.cancel()
+        try { appContext.unregisterReceiver(batteryReceiver) } catch (_: Exception) { }
         Handler(Looper.getMainLooper()).post {
-            try {
-                ProcessLifecycleOwner.get().lifecycle.removeObserver(this)
-            } catch (e: Exception) {
-                 Log.e(TAG, "Failed to remove lifecycle observer: ${e.message}")
-            }
+            try { ProcessLifecycleOwner.get().lifecycle.removeObserver(this) } catch (_: Exception) { }
         }
     }
-    
+
     override fun onStateChanged(source: LifecycleOwner, event: Lifecycle.Event) {
         when (event) {
             Lifecycle.Event.ON_START -> {
-                Log.d(TAG, "Process lifecycle: ON_START (App coming to foreground)")
                 isAppInBackground = false
-                updatePowerMode()
+                refreshProfile()
             }
             Lifecycle.Event.ON_STOP -> {
-                Log.d(TAG, "Process lifecycle: ON_STOP (App going to background)")
                 isAppInBackground = true
-                updatePowerMode()
+                refreshProfile()
             }
-            else -> {}
+            else -> Unit
         }
     }
-    
-    /**
-     * Get scan settings optimized for current power mode
-     */
+
     fun getScanSettings(): ScanSettings {
+        val current = profile.value
         val builder = ScanSettings.Builder()
             .setCallbackType(ScanSettings.CALLBACK_TYPE_ALL_MATCHES)
 
-        when (currentMode) {
+        when (current.mode) {
             PowerMode.PERFORMANCE -> builder
                 .setScanMode(ScanSettings.SCAN_MODE_LOW_LATENCY)
                 .setMatchMode(ScanSettings.MATCH_MODE_AGGRESSIVE)
                 .setNumOfMatches(ScanSettings.MATCH_NUM_MAX_ADVERTISEMENT)
-
             PowerMode.BALANCED -> builder
                 .setScanMode(ScanSettings.SCAN_MODE_BALANCED)
                 .setMatchMode(ScanSettings.MATCH_MODE_AGGRESSIVE)
                 .setNumOfMatches(ScanSettings.MATCH_NUM_ONE_ADVERTISEMENT)
-
-            PowerMode.POWER_SAVER -> builder
-                .setScanMode(ScanSettings.SCAN_MODE_LOW_POWER)
-                .setMatchMode(ScanSettings.MATCH_MODE_STICKY)
-                .setNumOfMatches(ScanSettings.MATCH_NUM_ONE_ADVERTISEMENT)
-
+            PowerMode.POWER_SAVER,
             PowerMode.ULTRA_LOW_POWER -> builder
                 .setScanMode(ScanSettings.SCAN_MODE_LOW_POWER)
                 .setMatchMode(ScanSettings.MATCH_MODE_STICKY)
                 .setNumOfMatches(ScanSettings.MATCH_NUM_ONE_ADVERTISEMENT)
         }
-
         return builder.setReportDelay(0).build()
     }
-    
-    /**
-     * Get advertising settings optimized for current power mode
-     */
-    fun getAdvertiseSettings(): AdvertiseSettings {
-        return when (currentMode) {
-            PowerMode.PERFORMANCE -> AdvertiseSettings.Builder()
-                .setAdvertiseMode(AdvertiseSettings.ADVERTISE_MODE_LOW_LATENCY)
-                .setTxPowerLevel(AdvertiseSettings.ADVERTISE_TX_POWER_HIGH)
-                .setConnectable(true)
-                .setTimeout(0)
-                .build()
-                
-            PowerMode.BALANCED -> AdvertiseSettings.Builder()
-                .setAdvertiseMode(AdvertiseSettings.ADVERTISE_MODE_BALANCED)
-                .setTxPowerLevel(AdvertiseSettings.ADVERTISE_TX_POWER_MEDIUM)
-                .setConnectable(true)
-                .setTimeout(0)
-                .build()
-                
-            PowerMode.POWER_SAVER -> AdvertiseSettings.Builder()
-                .setAdvertiseMode(AdvertiseSettings.ADVERTISE_MODE_LOW_POWER)
-                .setTxPowerLevel(AdvertiseSettings.ADVERTISE_TX_POWER_LOW)
-                .setConnectable(true)
-                .setTimeout(0)
-                .build()
-                
-            PowerMode.ULTRA_LOW_POWER -> AdvertiseSettings.Builder()
-                .setAdvertiseMode(AdvertiseSettings.ADVERTISE_MODE_LOW_POWER)
-                .setTxPowerLevel(AdvertiseSettings.ADVERTISE_TX_POWER_ULTRA_LOW)
-                .setConnectable(true)
-                .setTimeout(0)
-                .build()
-        }
+
+    fun getAdvertiseSettings(): AdvertiseSettings = when (profile.value.mode) {
+        PowerMode.PERFORMANCE -> AdvertiseSettings.Builder()
+            .setAdvertiseMode(AdvertiseSettings.ADVERTISE_MODE_LOW_LATENCY)
+            .setTxPowerLevel(AdvertiseSettings.ADVERTISE_TX_POWER_HIGH)
+            .setConnectable(true).setTimeout(0).build()
+        PowerMode.BALANCED -> AdvertiseSettings.Builder()
+            .setAdvertiseMode(AdvertiseSettings.ADVERTISE_MODE_BALANCED)
+            .setTxPowerLevel(AdvertiseSettings.ADVERTISE_TX_POWER_MEDIUM)
+            .setConnectable(true).setTimeout(0).build()
+        PowerMode.POWER_SAVER -> AdvertiseSettings.Builder()
+            .setAdvertiseMode(AdvertiseSettings.ADVERTISE_MODE_LOW_POWER)
+            .setTxPowerLevel(AdvertiseSettings.ADVERTISE_TX_POWER_LOW)
+            .setConnectable(true).setTimeout(0).build()
+        PowerMode.ULTRA_LOW_POWER -> AdvertiseSettings.Builder()
+            .setAdvertiseMode(AdvertiseSettings.ADVERTISE_MODE_LOW_POWER)
+            .setTxPowerLevel(AdvertiseSettings.ADVERTISE_TX_POWER_ULTRA_LOW)
+            .setConnectable(true).setTimeout(0).build()
     }
-    
-    /**
-     * Get maximum allowed connections for current power mode
-     */
-    fun getMaxConnections(): Int {
-        return when (currentMode) {
-            PowerMode.PERFORMANCE -> MAX_CONNECTIONS_NORMAL
-            PowerMode.BALANCED -> MAX_CONNECTIONS_NORMAL
-            PowerMode.POWER_SAVER -> MAX_CONNECTIONS_POWER_SAVE
-            PowerMode.ULTRA_LOW_POWER -> MAX_CONNECTIONS_ULTRA_LOW
-        }
+
+    fun getMaxConnections(): Int = profile.value.ble.maxConnections
+
+    fun getRSSIThreshold(): Int = when (profile.value.mode) {
+        PowerMode.PERFORMANCE -> -95
+        PowerMode.BALANCED -> -85
+        PowerMode.POWER_SAVER -> -75
+        PowerMode.ULTRA_LOW_POWER -> -65
     }
-    
-    /**
-     * Get RSSI filter threshold for current power mode
-     */
-    fun getRSSIThreshold(): Int {
-        return when (currentMode) {
-            PowerMode.PERFORMANCE -> -95
-            PowerMode.BALANCED -> -85
-            PowerMode.POWER_SAVER -> -75
-            PowerMode.ULTRA_LOW_POWER -> -65
-        }
-    }
-    
-    /**
-     * Check if duty cycling should be used
-     */
-    fun shouldUseDutyCycle(): Boolean {
-        return currentMode != PowerMode.PERFORMANCE
-    }
-    
-    /**
-     * Get current power mode information
-     */
-    fun getPowerInfo(): String {
-        return buildString {
+
+    fun shouldUseDutyCycle(): Boolean = !profile.value.ble.continuousScan
+
+    fun getPowerInfo(): String = profile.value.let { current ->
+        buildString {
             appendLine("=== Power Manager Status ===")
-            appendLine("Current Mode: $currentMode")
-            appendLine("Battery Level: $batteryLevel%")
-            appendLine("Is Charging: $isCharging")
-            appendLine("App In Background: $isAppInBackground")
-            appendLine("Max Connections: ${getMaxConnections()}")
-            appendLine("RSSI Threshold: ${getRSSIThreshold()} dBm")
-            appendLine("Use Duty Cycle: ${shouldUseDutyCycle()}")
+            appendLine("Current Mode: ${current.mode}")
+            appendLine("Battery Band: ${current.batteryBand} ($batteryLevel%)")
+            appendLine("Is Charging: ${current.isCharging}")
+            appendLine("App In Background: ${current.isBackground}")
+            appendLine("Has Direct Peers: ${current.hasDirectPeers}")
+            appendLine("BLE Scan: ${current.ble.scanOnMs}ms ON / ${current.ble.scanOffMs}ms OFF")
+            appendLine("Max Connections: ${current.ble.maxConnections}")
         }
     }
-    
-    private fun updatePowerMode() {
-        // Determine the base mode from battery/charging state only
-        val baseMode = when {
-            // Charging in foreground may use performance
-            isCharging && !isAppInBackground -> PowerMode.PERFORMANCE
 
-            // Critical battery - force ultra low power regardless of foreground/background
-            batteryLevel <= CRITICAL_BATTERY -> PowerMode.ULTRA_LOW_POWER
-
-            // Low battery - prefer power saver
-            batteryLevel <= LOW_BATTERY -> PowerMode.POWER_SAVER
-
-            // Otherwise balanced
-            else -> PowerMode.BALANCED
-        }
-
-        // If app is in background (including when running as a foreground service),
-        // cap the power mode to at least POWER_SAVER. Preserve ULTRA_LOW_POWER.
-        val newMode = if (isAppInBackground) {
-            if (baseMode == PowerMode.ULTRA_LOW_POWER) PowerMode.ULTRA_LOW_POWER else PowerMode.POWER_SAVER
-        } else {
-            baseMode
-        }
-
-        if (newMode != currentMode) {
-            val oldMode = currentMode
-            currentMode = newMode
-            Log.i(TAG, "Power mode changed: $oldMode → $newMode (battery: $batteryLevel%, charging: $isCharging, background: $isAppInBackground)")
-            
-            delegate?.onPowerModeChanged(currentMode)
-            
-            // Restart duty cycle with new parameters
-            if (shouldUseDutyCycle()) {
-                startDutyCycle()
-            } else {
-                stopDutyCycle()
-            }
+    private fun refreshProfile() {
+        if (shutdown) return
+        val next = PowerProfileResolver.resolve(
+            batteryLevel = batteryLevel,
+            isCharging = isCharging,
+            isBackground = isAppInBackground,
+            hasDirectPeers = hasDirectPeers
+        )
+        if (_profile.value != next) {
+            Log.i(
+                TAG,
+                "Profile changed: mode=${next.mode}, battery=${next.batteryBand}, " +
+                    "background=${next.isBackground}, directPeers=${next.hasDirectPeers}"
+            )
+            _profile.value = next
         }
     }
-    
-    private fun startDutyCycle() {
-        stopDutyCycle()
-        
-        if (!shouldUseDutyCycle()) {
-            delegate?.onScanStateChanged(true) // Always scan in performance mode
-            return
-        }
-        
-        val (onDuration, offDuration) = when (currentMode) {
-            PowerMode.BALANCED -> SCAN_ON_DURATION_NORMAL to SCAN_OFF_DURATION_NORMAL
-            PowerMode.POWER_SAVER -> SCAN_ON_DURATION_POWER_SAVE to SCAN_OFF_DURATION_POWER_SAVE
-            PowerMode.ULTRA_LOW_POWER -> SCAN_ON_DURATION_ULTRA_LOW to SCAN_OFF_DURATION_ULTRA_LOW
-            PowerMode.PERFORMANCE -> return // No duty cycle
-        }
-        
-        dutyCycleJob = powerScope.launch {
-            while (isActive && shouldUseDutyCycle()) {
-                // Scan ON period
-                Log.d(TAG, "Duty cycle: Scan ON for ${onDuration}ms")
-                delegate?.onScanStateChanged(true)
-                delay(onDuration)
-                
-                // Scan OFF period (keep advertising active)
-                if (isActive && shouldUseDutyCycle()) {
-                    Log.d(TAG, "Duty cycle: Scan OFF for ${offDuration}ms")
-                    delegate?.onScanStateChanged(false)
-                    delay(offDuration)
-                }
-            }
-        }
-        
-        Log.i(TAG, "Started duty cycle: ${onDuration}ms ON, ${offDuration}ms OFF")
-    }
-    
-    private fun stopDutyCycle() {
-        dutyCycleJob?.cancel()
-        dutyCycleJob = null
-    }
-    
+
     private fun registerBatteryReceiver() {
         try {
             val filter = IntentFilter().apply {
@@ -342,25 +276,141 @@ class PowerManager(private val context: Context) : LifecycleEventObserver {
                 addAction(Intent.ACTION_POWER_CONNECTED)
                 addAction(Intent.ACTION_POWER_DISCONNECTED)
             }
-            context.registerReceiver(batteryReceiver, filter)
+            appContext.registerReceiver(batteryReceiver, filter)
         } catch (e: Exception) {
             Log.w(TAG, "Failed to register battery receiver: ${e.message}")
         }
     }
-    
-    private fun unregisterBatteryReceiver() {
-        try {
-            context.unregisterReceiver(batteryReceiver)
-        } catch (e: Exception) {
-            Log.w(TAG, "Failed to unregister battery receiver: ${e.message}")
-        }
-    }
 }
 
 /**
- * Delegate interface for power management callbacks
+ * Pure policy resolver so cadence and battery-boundary behavior can be tested without Android.
  */
-interface PowerManagerDelegate {
-    fun onPowerModeChanged(newMode: PowerManager.PowerMode)
-    fun onScanStateChanged(shouldScan: Boolean)
+internal object PowerProfileResolver {
+    fun resolve(
+        batteryLevel: Int,
+        isCharging: Boolean,
+        isBackground: Boolean,
+        hasDirectPeers: Boolean
+    ): PowerManager.RuntimePerformanceProfile {
+        val batteryBand = when {
+            batteryLevel <= AppConstants.Power.CRITICAL_BATTERY_PERCENT ->
+                PowerManager.BatteryBand.CRITICAL
+            batteryLevel <= AppConstants.Power.LOW_BATTERY_PERCENT ->
+                PowerManager.BatteryBand.LOW
+            else -> PowerManager.BatteryBand.NORMAL
+        }
+
+        val mode = when {
+            isBackground && batteryBand == PowerManager.BatteryBand.CRITICAL ->
+                PowerManager.PowerMode.ULTRA_LOW_POWER
+            isBackground -> PowerManager.PowerMode.POWER_SAVER
+            isCharging -> PowerManager.PowerMode.PERFORMANCE
+            batteryBand == PowerManager.BatteryBand.CRITICAL ->
+                PowerManager.PowerMode.ULTRA_LOW_POWER
+            batteryBand == PowerManager.BatteryBand.LOW ->
+                PowerManager.PowerMode.POWER_SAVER
+            else -> PowerManager.PowerMode.BALANCED
+        }
+
+        val ble = when {
+            isBackground && hasDirectPeers ->
+                PowerManager.BleSchedule(
+                    scanOnMs = 1_000L,
+                    scanOffMs = 29_000L,
+                    continuousScan = false,
+                    rssiPollIntervalMs = backgroundRssiInterval(batteryBand)
+                )
+            isBackground ->
+                PowerManager.BleSchedule(
+                    scanOnMs = 1_000L,
+                    scanOffMs = 59_000L,
+                    continuousScan = false,
+                    rssiPollIntervalMs = backgroundRssiInterval(batteryBand)
+                )
+            mode == PowerManager.PowerMode.PERFORMANCE ->
+                PowerManager.BleSchedule(Long.MAX_VALUE, 0L, true, 5_000L)
+            mode == PowerManager.PowerMode.BALANCED ->
+                PowerManager.BleSchedule(8_000L, 2_000L, false, 10_000L)
+            mode == PowerManager.PowerMode.POWER_SAVER ->
+                PowerManager.BleSchedule(2_000L, 28_000L, false, 30_000L)
+            else ->
+                PowerManager.BleSchedule(1_000L, 29_000L, false, 60_000L)
+        }
+
+        val announcementInterval = when {
+            isBackground && batteryBand == PowerManager.BatteryBand.NORMAL -> 60_000L
+            isBackground && batteryBand == PowerManager.BatteryBand.LOW -> 120_000L
+            isBackground -> 300_000L
+            mode == PowerManager.PowerMode.POWER_SAVER -> 60_000L
+            mode == PowerManager.PowerMode.ULTRA_LOW_POWER -> 120_000L
+            else -> 30_000L
+        }
+
+        val wifi = when {
+            isBackground && batteryBand == PowerManager.BatteryBand.NORMAL ->
+                wifi(10, 60, 60, 5, 5, 10)
+            isBackground && batteryBand == PowerManager.BatteryBand.LOW ->
+                wifi(20, 120, 120, 10, 10, 15)
+            isBackground ->
+                wifi(30, 180, 180, 15, 15, 20)
+            mode == PowerManager.PowerMode.PERFORMANCE ->
+                PowerManager.WifiAwareSchedule(2_000L, 20_000L, 15_000L, 120_000L, 90_000L, 300_000L)
+            mode == PowerManager.PowerMode.BALANCED ->
+                PowerManager.WifiAwareSchedule(5_000L, 30_000L, 30_000L, 180_000L, 120_000L, 300_000L)
+            mode == PowerManager.PowerMode.POWER_SAVER ->
+                PowerManager.WifiAwareSchedule(10_000L, 60_000L, 60_000L, 300_000L, 180_000L, 600_000L)
+            else ->
+                PowerManager.WifiAwareSchedule(15_000L, 90_000L, 90_000L, 600_000L, 300_000L, 900_000L)
+        }
+
+        val nostr = when {
+            isBackground && batteryBand == PowerManager.BatteryBand.NORMAL ->
+                PowerManager.NostrSchedule(300_000L, 330_000L, 300_000L)
+            isBackground && batteryBand == PowerManager.BatteryBand.LOW ->
+                PowerManager.NostrSchedule(600_000L, 660_000L, 600_000L)
+            isBackground ->
+                PowerManager.NostrSchedule(900_000L, 990_000L, 900_000L)
+            mode == PowerManager.PowerMode.POWER_SAVER ->
+                PowerManager.NostrSchedule(120_000L, 132_000L, 60_000L)
+            mode == PowerManager.PowerMode.ULTRA_LOW_POWER ->
+                PowerManager.NostrSchedule(300_000L, 330_000L, 120_000L)
+            else ->
+                PowerManager.NostrSchedule(40_000L, 80_000L, 30_000L)
+        }
+
+        return PowerManager.RuntimePerformanceProfile(
+            mode = mode,
+            batteryBand = batteryBand,
+            isBackground = isBackground,
+            isCharging = isCharging,
+            hasDirectPeers = hasDirectPeers,
+            ble = ble,
+            meshAnnouncementIntervalMs = announcementInterval,
+            wifiAware = wifi,
+            nostr = nostr
+        )
+    }
+
+    private fun wifi(
+        tcpSeconds: Long,
+        discoverySeconds: Long,
+        maintenanceSeconds: Long,
+        idleMinutes: Long,
+        minRefreshMinutes: Long,
+        staleMinutes: Long
+    ) = PowerManager.WifiAwareSchedule(
+        tcpKeepAliveMs = tcpSeconds * 1_000L,
+        discoveryKeepAliveMs = discoverySeconds * 1_000L,
+        connectionMaintenanceMs = maintenanceSeconds * 1_000L,
+        discoveryIdleRefreshMs = idleMinutes * 60_000L,
+        discoverySessionRefreshMinMs = minRefreshMinutes * 60_000L,
+        discoveryStaleMs = staleMinutes * 60_000L
+    )
+
+    private fun backgroundRssiInterval(band: PowerManager.BatteryBand): Long = when (band) {
+        PowerManager.BatteryBand.NORMAL -> 60_000L
+        PowerManager.BatteryBand.LOW -> 120_000L
+        PowerManager.BatteryBand.CRITICAL -> 300_000L
+    }
 }

app/src/main/java/com/bitchat/android/mesh/PrivateMediaSecurity.kt

@@ -0,0 +1,64 @@
+package com.bitchat.android.mesh
+
+import com.bitchat.android.model.PeerCapabilities
+import com.bitchat.android.noise.AuthenticatedNoiseSession
+
+internal sealed interface PrivateMediaPolicyDecision {
+    data class Encrypted(
+        val authenticatedSession: AuthenticatedNoiseSession
+    ) : PrivateMediaPolicyDecision
+    data object RequiresLegacyConsent : PrivateMediaPolicyDecision
+    data object NeedsHandshake : PrivateMediaPolicyDecision
+    data object AwaitingPeerState : PrivateMediaPolicyDecision
+    data class Blocked(val reason: String) : PrivateMediaPolicyDecision
+}
+
+/**
+ * Binds an advertised private-media capability to a live Noise remote-static
+ * key and persists an HSTS-style pin by that authenticated key's SHA-256
+ * fingerprint. Announcements alone can never create a pin.
+ */
+internal class PrivateMediaSecurityController(
+    private val authenticatedSessionProvider: (String) -> AuthenticatedNoiseSession?,
+    private val peerStateStatusProvider: (
+        String,
+        AuthenticatedNoiseSession
+    ) -> AuthenticatedPeerStateStatus,
+    private val isPrivateMediaPinned: (String) -> Boolean
+) {
+    fun sendPolicy(peerID: String): PrivateMediaPolicyDecision {
+        val authenticatedSession = authenticatedSessionProvider(peerID)
+            ?.takeIf { it.remoteStaticKey.size == 32 && it.sessionToken.size == 32 }
+            ?: return PrivateMediaPolicyDecision.NeedsHandshake
+
+        return when (val status = peerStateStatusProvider(peerID, authenticatedSession)) {
+            AuthenticatedPeerStateStatus.Awaiting -> PrivateMediaPolicyDecision.AwaitingPeerState
+            is AuthenticatedPeerStateStatus.Proven -> {
+                if (status.state.capabilities.contains(PeerCapabilities.PRIVATE_MEDIA)) {
+                    PrivateMediaPolicyDecision.Encrypted(authenticatedSession)
+                } else if (isPrivateMediaPinned(peerID)) {
+                    PrivateMediaPolicyDecision.Blocked(
+                        "Encrypted private media was previously pinned, but this session proved no support; send blocked"
+                    )
+                } else {
+                    PrivateMediaPolicyDecision.RequiresLegacyConsent
+                }
+            }
+            AuthenticatedPeerStateStatus.Missing ->
+                // A live crypto session can become visible just before its authenticated callback
+                // installs the coordinator generation. Never treat that gap as a watchdog timeout.
+                PrivateMediaPolicyDecision.AwaitingPeerState
+            AuthenticatedPeerStateStatus.TimedOut -> {
+                if (isPrivateMediaPinned(peerID)) {
+                    PrivateMediaPolicyDecision.Blocked(
+                        "Encrypted private media was previously pinned, but this session did not provide authenticated peer state"
+                    )
+                } else {
+                    // A Noise-capable old client that does not know 0x21 may use explicit one-shot
+                    // legacy consent after the five-second generation watchdog.
+                    PrivateMediaPolicyDecision.RequiresLegacyConsent
+                }
+            }
+        }
+    }
+}

app/src/main/java/com/bitchat/android/mesh/PrivateMediaTransfer.kt

@@ -0,0 +1,215 @@
+package com.bitchat.android.mesh
+
+import com.bitchat.android.model.BitchatFilePacket
+import com.bitchat.android.model.NoisePayload
+import com.bitchat.android.model.NoisePayloadType
+import com.bitchat.android.noise.AuthenticatedNoiseSession
+import com.bitchat.android.protocol.BitchatPacket
+import com.bitchat.android.protocol.MessageType
+import java.util.concurrent.atomic.AtomicBoolean
+
+enum class PrivateMediaWireMode {
+    ENCRYPTED_NOISE_0X20,
+    SIGNED_DIRECTED_RAW_0X22
+}
+
+class PreparedPrivateMediaTransfer internal constructor(
+    val transferId: String,
+    val wireMode: PrivateMediaWireMode,
+    private val commitAction: () -> Boolean
+) {
+    private val committed = AtomicBoolean(false)
+
+    /** A prepared transfer is single-use, including after a failed commit. */
+    fun commit(): Boolean {
+        if (!committed.compareAndSet(false, true)) return false
+        return commitAction()
+    }
+}
+
+sealed interface PrivateMediaPreparation {
+    data class Ready(val transfer: PreparedPrivateMediaTransfer) : PrivateMediaPreparation
+    data class RequiresLegacyConsent(val warning: String) : PrivateMediaPreparation
+    data object NeedsHandshake : PrivateMediaPreparation
+    data object AwaitingPeerState : PrivateMediaPreparation
+    data class Rejected(val reason: String) : PrivateMediaPreparation
+}
+
+internal data class BuiltPrivateMediaTransfer(
+    val packet: BitchatPacket,
+    val fragments: List<BitchatPacket>,
+    val wireMode: PrivateMediaWireMode
+)
+
+internal sealed interface PrivateMediaBuildOutcome {
+    data class Ready(val built: BuiltPrivateMediaTransfer) : PrivateMediaBuildOutcome
+    data class RequiresLegacyConsent(val warning: String) : PrivateMediaBuildOutcome
+    data object NeedsHandshake : PrivateMediaBuildOutcome
+    data object AwaitingPeerState : PrivateMediaBuildOutcome
+    data class Rejected(val reason: String) : PrivateMediaBuildOutcome
+}
+
+internal sealed interface PrivateMediaEncryptionResult {
+    data class Success(val ciphertext: ByteArray) : PrivateMediaEncryptionResult
+    data object GenerationChanged : PrivateMediaEncryptionResult
+    data object Failed : PrivateMediaEncryptionResult
+}
+
+/** Builds, routes, signs, and fragments exactly once before UI local echo. */
+internal class PrivateMediaTransferPreparer(
+    private val senderID: ByteArray,
+    private val ttl: UByte,
+    private val policyProvider: (String) -> PrivateMediaPolicyDecision,
+    private val encrypt: (
+        ByteArray,
+        String,
+        AuthenticatedNoiseSession
+    ) -> PrivateMediaEncryptionResult,
+    private val finalizeRoutedAndSigned: (BitchatPacket) -> BitchatPacket?,
+    private val fragment: (BitchatPacket, Int) -> List<BitchatPacket>,
+    private val now: () -> ULong = { System.currentTimeMillis().toULong() }
+) {
+    fun prepare(
+        recipientPeerID: String,
+        recipientID: ByteArray,
+        file: BitchatFilePacket,
+        allowLegacyFallback: Boolean
+    ): PrivateMediaBuildOutcome = prepare(
+        recipientPeerID,
+        recipientID,
+        file,
+        allowLegacyFallback,
+        generationRetriesRemaining = 1
+    )
+
+    private fun prepare(
+        recipientPeerID: String,
+        recipientID: ByteArray,
+        file: BitchatFilePacket,
+        allowLegacyFallback: Boolean,
+        generationRetriesRemaining: Int
+    ): PrivateMediaBuildOutcome {
+        val maxPrivateFragments =
+            com.bitchat.android.util.AppConstants.Fragmentation.MAX_FRAGMENTS_PER_ID
+        val absolutePayloadUpperBound =
+            maxPrivateFragments.toLong() *
+                com.bitchat.android.util.AppConstants.Fragmentation.MAX_FRAGMENT_SIZE.toLong()
+        // The file content alone cannot exceed the total bytes carried by every
+        // possible fragment. Reject before TLV encoding, encryption, signing,
+        // and packet serialization make additional full-size copies.
+        if (file.content.size.toLong() > absolutePayloadUpperBound) {
+            return PrivateMediaBuildOutcome.Rejected(
+                "File exceeds the private-media v1 limit of 256 final mesh fragments"
+            )
+        }
+
+        val policy = policyProvider(recipientPeerID)
+        val mode = when (policy) {
+            is PrivateMediaPolicyDecision.Encrypted -> PrivateMediaWireMode.ENCRYPTED_NOISE_0X20
+            PrivateMediaPolicyDecision.RequiresLegacyConsent -> {
+                if (!allowLegacyFallback) {
+                    return PrivateMediaBuildOutcome.RequiresLegacyConsent(
+                        "This older client cannot receive encrypted private media. " +
+                            "Sending this one file will expose its contents to mesh relays, " +
+                            "although the directed packet will still be signed."
+                    )
+                }
+                PrivateMediaWireMode.SIGNED_DIRECTED_RAW_0X22
+            }
+            PrivateMediaPolicyDecision.NeedsHandshake ->
+                return PrivateMediaBuildOutcome.NeedsHandshake
+            PrivateMediaPolicyDecision.AwaitingPeerState ->
+                return PrivateMediaBuildOutcome.AwaitingPeerState
+            is PrivateMediaPolicyDecision.Blocked ->
+                return PrivateMediaBuildOutcome.Rejected(policy.reason)
+        }
+
+        val filePayload = file.encode()
+            ?: return PrivateMediaBuildOutcome.Rejected("Failed to encode private media")
+
+        val packet = when (mode) {
+            PrivateMediaWireMode.ENCRYPTED_NOISE_0X20 -> {
+                val plaintext = NoisePayload(NoisePayloadType.FILE_TRANSFER, filePayload).encode()
+                val encryption = try {
+                    encrypt(
+                        plaintext,
+                        recipientPeerID,
+                        (policy as PrivateMediaPolicyDecision.Encrypted).authenticatedSession
+                    )
+                } catch (_: Exception) {
+                    PrivateMediaEncryptionResult.Failed
+                }
+                val ciphertext = when (encryption) {
+                    is PrivateMediaEncryptionResult.Success -> encryption.ciphertext
+                    PrivateMediaEncryptionResult.GenerationChanged -> {
+                        if (generationRetriesRemaining > 0) {
+                            return prepare(
+                                recipientPeerID,
+                                recipientID,
+                                file,
+                                allowLegacyFallback,
+                                generationRetriesRemaining - 1
+                            )
+                        }
+                        return PrivateMediaBuildOutcome.AwaitingPeerState
+                    }
+                    PrivateMediaEncryptionResult.Failed ->
+                        return PrivateMediaBuildOutcome.Rejected(
+                            "The authenticated Noise session could not encrypt this file"
+                        )
+                }
+                BitchatPacket(
+                    version = if (ciphertext.size > 0xFFFF) 2u else 1u,
+                    type = MessageType.NOISE_ENCRYPTED.value,
+                    senderID = senderID.copyOf(),
+                    recipientID = recipientID.copyOf(),
+                    timestamp = now(),
+                    payload = ciphertext,
+                    signature = null,
+                    ttl = ttl
+                )
+            }
+
+            PrivateMediaWireMode.SIGNED_DIRECTED_RAW_0X22 -> BitchatPacket(
+                version = 2u,
+                type = MessageType.FILE_TRANSFER.value,
+                senderID = senderID.copyOf(),
+                recipientID = recipientID.copyOf(),
+                timestamp = now(),
+                payload = filePayload,
+                signature = null,
+                ttl = ttl
+            )
+        }
+
+        val finalized = finalizeRoutedAndSigned(packet)
+            ?: return PrivateMediaBuildOutcome.Rejected(
+                if (mode == PrivateMediaWireMode.SIGNED_DIRECTED_RAW_0X22) {
+                    "Could not sign the legacy private-media packet; nothing was sent"
+                } else {
+                    "Could not sign the encrypted private-media packet; nothing was sent"
+                }
+            )
+        if (finalized.signature?.size != 64) {
+            return PrivateMediaBuildOutcome.Rejected(
+                "Could not produce a valid Ed25519 private-media signature; nothing was sent"
+            )
+        }
+
+        val fragments = fragment(finalized, maxPrivateFragments)
+        if (fragments.isEmpty()) {
+            return PrivateMediaBuildOutcome.Rejected(
+                "File exceeds the private-media v1 limit of 256 final mesh fragments"
+            )
+        }
+        if (fragments.size > maxPrivateFragments) {
+            return PrivateMediaBuildOutcome.Rejected(
+                "File exceeds the private-media v1 limit of 256 final mesh fragments"
+            )
+        }
+
+        return PrivateMediaBuildOutcome.Ready(
+            BuiltPrivateMediaTransfer(finalized, fragments, mode)
+        )
+    }
+}

app/src/main/java/com/bitchat/android/mesh/RetryingControlPacketSender.kt

@@ -0,0 +1,82 @@
+package com.bitchat.android.mesh
+
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.CoroutineStart
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+
+/**
+ * Sends small idempotent control packets redundantly while serializing the attempts submitted
+ * through this sender. Android BLE only reports that a GATT write/notification was accepted;
+ * it does not prove that the remote application processed the packet. Reusing the exact encoded
+ * packet makes retries safe: the receiver's packet/replay protection drops copies it already saw.
+ */
+internal class RetryingControlPacketSender(
+    private val scope: CoroutineScope,
+    private val maxAttempts: Int = 3,
+    private val retryDelayMs: Long = 750L,
+    private val interSendDelayMs: Long = 75L
+) {
+    private val sendMutex = Mutex()
+    private val jobsLock = Any()
+    private val activeJobs = mutableMapOf<String, Job>()
+
+    init {
+        require(maxAttempts > 0)
+        require(retryDelayMs >= 0)
+        require(interSendDelayMs >= 0)
+    }
+
+    /**
+     * Coalesces concurrent requests for the same logical packet. Once the retry window finishes,
+     * a later user action may enqueue the packet again; duplicate receipt processing is idempotent.
+     */
+    fun enqueue(
+        key: String,
+        sendAttempt: suspend (attempt: Int) -> Boolean,
+        onComplete: (acceptedAtLeastOnce: Boolean) -> Unit = {}
+    ) {
+        val job = synchronized(jobsLock) {
+            if (activeJobs[key]?.isActive == true) return
+
+            scope.launch(start = CoroutineStart.LAZY) {
+                var acceptedAtLeastOnce = false
+                var completed = false
+                try {
+                    repeat(maxAttempts) { index ->
+                        if (!isActive) return@launch
+                        val attempt = index + 1
+                        sendMutex.withLock {
+                            try {
+                                val accepted = try {
+                                    sendAttempt(attempt)
+                                } catch (_: Exception) {
+                                    false
+                                }
+                                acceptedAtLeastOnce = accepted || acceptedAtLeastOnce
+                            } finally {
+                                if (interSendDelayMs > 0) delay(interSendDelayMs)
+                            }
+                        }
+                        if (attempt < maxAttempts && retryDelayMs > 0) {
+                            delay(retryDelayMs)
+                        }
+                    }
+                    completed = true
+                } finally {
+                    synchronized(jobsLock) {
+                        activeJobs.remove(key)
+                    }
+                    if (completed) {
+                        try { onComplete(acceptedAtLeastOnce) } catch (_: Exception) { }
+                    }
+                }
+            }.also { activeJobs[key] = it }
+        }
+        job.start()
+    }
+}

app/src/main/java/com/bitchat/android/mesh/SecurityManager.kt

@@ -5,6 +5,8 @@ import com.bitchat.android.crypto.EncryptionService
 import com.bitchat.android.protocol.BitchatPacket
 import com.bitchat.android.protocol.MessageType
 import com.bitchat.android.model.RoutedPacket
+import com.bitchat.android.noise.AuthenticatedNoiseSession
+import com.bitchat.android.noise.NoiseDecryptionResult
 import com.bitchat.android.util.toHexString
 import kotlinx.coroutines.*
 import java.util.*
@@ -23,12 +25,14 @@ class SecurityManager(private val encryptionService: EncryptionService, private
         private const val CLEANUP_INTERVAL = com.bitchat.android.util.AppConstants.Security.CLEANUP_INTERVAL_MS // 5 minutes
         private const val MAX_PROCESSED_MESSAGES = com.bitchat.android.util.AppConstants.Security.MAX_PROCESSED_MESSAGES
         private const val MAX_PROCESSED_KEY_EXCHANGES = com.bitchat.android.util.AppConstants.Security.MAX_PROCESSED_KEY_EXCHANGES
+        private const val KEY_EXCHANGE_DEDUP_TIMEOUT = com.bitchat.android.util.AppConstants.Security.KEY_EXCHANGE_DEDUP_TIMEOUT_MS
     }
     
     // Security tracking
     private val processedMessages = Collections.synchronizedSet(mutableSetOf<String>())
     private val processedKeyExchanges = Collections.synchronizedSet(mutableSetOf<String>())
     private val messageTimestamps = Collections.synchronizedMap(mutableMapOf<String, Long>())
+    private val keyExchangeTimestamps = Collections.synchronizedMap(mutableMapOf<String, Long>())
     
     // Delegate for callbacks
     var delegate: SecurityManagerDelegate? = null
@@ -46,7 +50,6 @@ class SecurityManager(private val encryptionService: EncryptionService, private
     fun validatePacket(packet: BitchatPacket, peerID: String): Boolean {
         // Skip validation for our own packets
         if (peerID == myPeerID) {
-            Log.d(TAG, "Skipping validation for our own packet")
             return false
         }
         
@@ -54,34 +57,48 @@ class SecurityManager(private val encryptionService: EncryptionService, private
         val currentTime = System.currentTimeMillis()
         val messageType = MessageType.fromValue(packet.type)
 
+        // LEAVE mutates presence immediately and cannot be safely replayed after the in-memory
+        // duplicate cache expires (or after an app restart). Bound it to the same five-minute
+        // security window used for duplicate retention while tolerating symmetric clock skew.
+        if (messageType == MessageType.LEAVE) {
+            val now = currentTime.coerceAtLeast(0).toULong()
+            val clockSkew = if (packet.timestamp >= now) {
+                packet.timestamp - now
+            } else {
+                now - packet.timestamp
+            }
+            if (clockSkew > MESSAGE_TIMEOUT.toULong()) {
+                Log.w(TAG, "Dropping stale or future-dated LEAVE from $peerID")
+                return false
+            }
+        }
+
         // Duplicate detection
         val messageID = generateMessageID(packet, peerID)
         
         if (processedMessages.contains(messageID)) {
             // Check for ANNOUNCE exception: allow if it looks like a direct neighbor (max TTL)
-            // This ensures we catch the "first announce" on a new connection for binding,
+            // This ensures we observe the same peer on a new direct transport connection,
             // while still dropping looped/relayed duplicates.
             val isFreshAnnounce = messageType == MessageType.ANNOUNCE &&
                     packet.ttl >= com.bitchat.android.util.AppConstants.MESSAGE_TTL_HOPS
 
             if (!isFreshAnnounce) {
-                Log.d(TAG, "Dropping duplicate packet: $messageID")
                 return false
             }
-            Log.d(TAG, "Allowing duplicate ANNOUNCE from direct neighbor: $messageID")
         }
 
-        // Add to processed messages
-        processedMessages.add(messageID)
-        messageTimestamps[messageID] = currentTime
-        
         // Enforce mandatory signature verification
         if (!verifyPacketSignature(packet, peerID)) {
-            Log.w(TAG, "Dropping packet from $peerID due to signature verification failure")
             return false
         }
-        
-        Log.d(TAG, "Packet validation passed for $peerID, messageID: $messageID")
+
+        // Record only authenticated packets. Recording an attacker-controlled
+        // invalid packet first would let it poison duplicate detection for a
+        // later legitimate packet with the same timestamp and payload.
+        processedMessages.add(messageID)
+        messageTimestamps[messageID] = currentTime
+
         return true
     }
     
@@ -95,80 +112,76 @@ class SecurityManager(private val encryptionService: EncryptionService, private
 
         // Skip handshakes not addressed to us
         if (packet.recipientID?.toHexString() != myPeerID) {
-            Log.d(TAG, "Skipping handshake not addressed to us: $peerID")
             return false
         }
-            
+
         // Skip our own handshake messages
         if (peerID == myPeerID) return false
 
-        // If we already have an established session but the peer is initiating a new handshake,
-        // drop the existing session so we can re-establish cleanly.
-        var forcedRehandshake = false
-        if (encryptionService.hasEstablishedSession(peerID)) {
-            Log.d(TAG, "Received new Noise handshake from $peerID with an existing session. Dropping old session to re-handshake.")
-            try {
-                encryptionService.removePeer(peerID)
-                forcedRehandshake = true
-            } catch (e: Exception) {
-                Log.w(TAG, "Failed to remove existing Noise session for $peerID: ${e.message}")
-            }
-        }
-        
         if (packet.payload.isEmpty()) {
-            Log.w(TAG, "Noise handshake packet has empty payload")
+            Log.d(TAG, "Noise handshake packet has empty payload")
             return false
         }
-        
+
         // Prevent duplicate handshake processing
         val exchangeKey = "$peerID-${packet.payload.sliceArray(0 until minOf(16, packet.payload.size)).contentHashCode()}"
-        
-        if (!forcedRehandshake && processedKeyExchanges.contains(exchangeKey)) {
-            Log.d(TAG, "Already processed handshake: $exchangeKey")
+
+        if (processedKeyExchanges.contains(exchangeKey)) {
             return false
         }
-        Log.d(TAG, "Processing Noise handshake from $peerID (${packet.payload.size} bytes)")
-        processedKeyExchanges.add(exchangeKey)
-        
+
         try {
-            // Process the Noise handshake through the updated EncryptionService
-            val response = encryptionService.processHandshakeMessage(packet.payload, peerID)
+            // The session manager preserves an existing transport in a separate responder-candidate
+            // flow and reports whether this exact frame completed authentication. Never infer that
+            // from ambient session state: a rejected replacement may leave the old session active.
+            val result = encryptionService.processHandshakeMessageWithResult(packet.payload, peerID)
+            processedKeyExchanges.add(exchangeKey)
+            keyExchangeTimestamps[exchangeKey] = System.currentTimeMillis()
             
-            if (response != null) {
-                Log.d(TAG, "Successfully processed Noise handshake from $peerID, sending response")
+            if (result.response != null) {
                 // Send handshake response through delegate
-                delegate?.sendHandshakeResponse(peerID, response)
+                delegate?.sendHandshakeResponse(peerID, result.response)
             }
-            // Check if session is now established (handshake complete)
-            if (encryptionService.hasEstablishedSession(peerID)) {
-                Log.d(TAG, "✅ Noise handshake completed with $peerID")
-                delegate?.onKeyExchangeCompleted(peerID, packet.payload)
+            if (result.establishedNow) {
+                val authenticatedRemoteStaticKey = result.authenticatedRemoteStaticKey
+                if (authenticatedRemoteStaticKey == null) {
+                    Log.e(TAG, "Bound Noise completion for $peerID omitted its authenticated static key")
+                    return false
+                }
+                val authenticatedSessionToken = result.authenticatedSessionToken
+                if (authenticatedSessionToken?.size != 32 ||
+                    authenticatedSessionToken.all { it == 0.toByte() }
+                ) {
+                    Log.e(TAG, "Bound Noise completion for $peerID omitted its generation token")
+                    return false
+                }
+                val isDirectIngress = packet.ttl == com.bitchat.android.util.AppConstants.MESSAGE_TTL_HOPS
+                Log.i(TAG, "Noise handshake completed with $peerID")
+                delegate?.onKeyExchangeCompleted(
+                    peerID = peerID,
+                    authenticatedRemoteStaticKey = authenticatedRemoteStaticKey,
+                    authenticatedSessionToken = authenticatedSessionToken,
+                    directRelayAddress = routed.relayAddress.takeIf { isDirectIngress },
+                    ingressLinkID = routed.ingressLinkID.takeIf { isDirectIngress }
+                )
             }
             return true
 
             
         } catch (e: Exception) {
-            Log.e(TAG, "Failed to process Noise handshake from $peerID: ${e.message}")
+            Log.w(TAG, "Failed to process Noise handshake from $peerID: ${e.message}")
             return false
         }
     }
 
     /**
-     * Verify packet signature
+     * Verify a packet signature against the signing key learned from the
+     * peer's verified announcement. Signatures cover the canonical packet,
+     * not only its payload; otherwise routing and recipient fields could be
+     * changed without invalidating the signature.
      */
     fun verifySignature(packet: BitchatPacket, peerID: String): Boolean {
-        return packet.signature?.let { signature ->
-            try {
-                val isValid = encryptionService.verify(signature, packet.payload, peerID)
-                if (!isValid) {
-                    Log.w(TAG, "Invalid signature for packet from $peerID")
-                }
-                isValid
-            } catch (e: Exception) {
-                Log.e(TAG, "Failed to verify signature from $peerID: ${e.message}")
-                false
-            }
-        } ?: true // No signature means verification passes
+        return verifyPacketSignature(packet, peerID)
     }
     
     /**
@@ -194,13 +207,24 @@ class SecurityManager(private val encryptionService: EncryptionService, private
             null
         }
     }
+
+    fun encryptForPeer(
+        data: ByteArray,
+        recipientPeerID: String,
+        expectedSession: AuthenticatedNoiseSession
+    ): ByteArray? = try {
+        encryptionService.encryptForSession(data, recipientPeerID, expectedSession)
+    } catch (e: Exception) {
+        Log.e(TAG, "Noise generation changed before encrypting for $recipientPeerID: ${e.message}")
+        null
+    }
     
     /**
      * Decrypt payload from specific peer
      */
-    fun decryptFromPeer(encryptedData: ByteArray, senderPeerID: String): ByteArray? {
+    fun decryptFromPeer(encryptedData: ByteArray, senderPeerID: String): NoiseDecryptionResult? {
         return try {
-            encryptionService.decrypt(encryptedData, senderPeerID)
+            encryptionService.decryptWithSession(encryptedData, senderPeerID)
         } catch (e: Exception) {
             Log.e(TAG, "Failed to decrypt from $senderPeerID: ${e.message}")
             null
@@ -237,48 +261,73 @@ class SecurityManager(private val encryptionService: EncryptionService, private
      */
     private fun verifyPacketSignature(packet: BitchatPacket, peerID: String): Boolean {
         try {
-            // only verify ANNOUNCE, MESSAGE, and FILE_TRANSFER
+            // Public packets that mutate identity, presence, or user-visible state must prove the
+            // signing key learned from a verified announcement. LEAVE is included so an attacker
+            // cannot evict a claimed peer or amplify a forged departure through relay.
             if (MessageType.fromValue(packet.type) !in setOf(
                     MessageType.ANNOUNCE,
                     MessageType.MESSAGE,
-                    MessageType.FILE_TRANSFER
+                    MessageType.FILE_TRANSFER,
+                    MessageType.LEAVE
                 )) {
                 return true
             }
+
+            if (MessageType.fromValue(packet.type) == MessageType.ANNOUNCE) {
+                val announcement = AnnouncementIdentityValidator.verify(packet, peerID) { signature, data, key ->
+                    encryptionService.verifyEd25519Signature(signature, data, key)
+                } ?: run {
+                    Log.w(TAG, "Rejecting malformed, unbound, or invalidly signed ANNOUNCE from $peerID")
+                    return false
+                }
+
+                val persistedSigningKey = delegate?.getAuthenticatedSigningKey(announcement.noisePublicKey)
+                if (persistedSigningKey != null &&
+                    !persistedSigningKey.contentEquals(announcement.signingPublicKey)
+                ) {
+                    Log.w(TAG, "Rejecting ANNOUNCE Ed key that conflicts with authenticated peer state for $peerID")
+                    return false
+                }
+
+                val existingPeer = delegate?.getPeerInfo(peerID)
+                if (
+                    existingPeer?.noisePublicKey != null &&
+                    !existingPeer.noisePublicKey!!.contentEquals(announcement.noisePublicKey)
+                ) {
+                    Log.w(TAG, "Rejecting ANNOUNCE Noise-key replacement for $peerID")
+                    return false
+                }
+                if (
+                    existingPeer?.signingPublicKey != null &&
+                    !existingPeer.signingPublicKey!!.contentEquals(announcement.signingPublicKey)
+                ) {
+                    Log.w(TAG, "Rejecting ANNOUNCE signing-key replacement without authenticated peer state for $peerID")
+                    return false
+                }
+                return true
+            }
+
             // 1. Mandatory Signature Check
             if (packet.signature == null) {
-                Log.w(TAG, "❌ Signature check for $peerID: NO_SIGNATURE (packet type ${packet.type})")
+                Log.w(TAG, "Signature check for $peerID: NO_SIGNATURE (packet type ${packet.type})")
                 return false
             }
             
             // 2. Get Signing Public Key
-            var signingPublicKey: ByteArray? = null
-            
-            if (MessageType.fromValue(packet.type) == MessageType.ANNOUNCE) {
-                // Special Case: ANNOUNCE packets carry their own signing key
-                try {
-                    val announcement = com.bitchat.android.model.IdentityAnnouncement.decode(packet.payload)
-                    signingPublicKey = announcement?.signingPublicKey
-                } catch (e: Exception) {
-                    Log.w(TAG, "Failed to decode announcement for key extraction: ${e.message}")
-                }
-            } else {
-                // Standard Case: Get key from known peer info
-                val peerInfo = delegate?.getPeerInfo(peerID)
-                signingPublicKey = peerInfo?.signingPublicKey
-            }
+            val peerInfo = delegate?.getPeerInfo(peerID)
+            val signingPublicKey = peerInfo?.signingPublicKey
             
             if (signingPublicKey == null) {
                 // If we don't have a key (and it's not an announce), we can't verify.
                 // For security, we must reject packets from unknown peers unless it's an announce.
-                Log.w(TAG, "❌ Signature check for $peerID: NO_SIGNING_KEY_AVAILABLE (packet type ${packet.type})")
+                Log.w(TAG, "Signature check for $peerID: NO_SIGNING_KEY_AVAILABLE (packet type ${packet.type})")
                 return false
             }
             
             // 3. Get Canonical Data
             val packetDataForSigning = packet.toBinaryDataForSigning()
             if (packetDataForSigning == null) {
-                Log.w(TAG, "❌ Signature check for $peerID: ENCODING_ERROR (packet type ${packet.type})")
+                Log.w(TAG, "Signature check for $peerID: ENCODING_ERROR (packet type ${packet.type})")
                 return false
             }
             
@@ -291,15 +340,14 @@ class SecurityManager(private val encryptionService: EncryptionService, private
             )
             
             if (isSignatureValid) {
-                // Log.v(TAG, "✅ Signature verified for $peerID (type ${packet.type})")
                 return true
             } else {
-                Log.w(TAG, "❌ Signature INVALID for $peerID (type ${packet.type})")
+                Log.w(TAG, "Signature INVALID for $peerID (type ${packet.type})")
                 return false
             }
-            
+
         } catch (e: Exception) {
-            Log.e(TAG, "❌ Signature verification error for $peerID: ${e.message}")
+            Log.e(TAG, "Signature verification error for $peerID: ${e.message}")
             return false
         }
     }
@@ -348,40 +396,45 @@ class SecurityManager(private val encryptionService: EncryptionService, private
     /**
      * Clean up old processed messages and timestamps
      */
-    private fun cleanupOldData() {
-        val cutoffTime = System.currentTimeMillis() - MESSAGE_TIMEOUT
-        var removedCount = 0
-        
+    internal fun cleanupOldData(nowMs: Long = System.currentTimeMillis()) {
+        val cutoffTime = nowMs - MESSAGE_TIMEOUT
+
         // Clean up old message timestamps and corresponding processed messages
         val messagesToRemove = messageTimestamps.entries.filter { (_, timestamp) ->
             timestamp < cutoffTime
         }.map { it.key }
-        
+
         messagesToRemove.forEach { messageId ->
             messageTimestamps.remove(messageId)
-            if (processedMessages.remove(messageId)) {
-                removedCount++
-            }
+            processedMessages.remove(messageId)
         }
-        
+
         // Limit the size of processed messages set
         if (processedMessages.size > MAX_PROCESSED_MESSAGES) {
             val excess = processedMessages.size - MAX_PROCESSED_MESSAGES
             val toRemove = processedMessages.take(excess)
             processedMessages.removeAll(toRemove.toSet())
             removeFromMessageTimestamps(toRemove)
-            removedCount += excess
         }
-        
+
+        // Expire handshake dedup entries by time so a delayed same-ephemeral delivery
+        // (e.g. a re-handshake retry after a failed attempt) is not blocked forever.
+        val keyExchangeCutoff = nowMs - KEY_EXCHANGE_DEDUP_TIMEOUT
+        val keyExchangesToRemove = keyExchangeTimestamps.entries.filter { (_, timestamp) ->
+            timestamp < keyExchangeCutoff
+        }.map { it.key }
+
+        keyExchangesToRemove.forEach { exchangeKey ->
+            keyExchangeTimestamps.remove(exchangeKey)
+            processedKeyExchanges.remove(exchangeKey)
+        }
+
         // Limit the size of processed key exchanges set
         if (processedKeyExchanges.size > MAX_PROCESSED_KEY_EXCHANGES) {
             val excess = processedKeyExchanges.size - MAX_PROCESSED_KEY_EXCHANGES
             val toRemove = processedKeyExchanges.take(excess)
             processedKeyExchanges.removeAll(toRemove.toSet())
-        }
-        
-        if (removedCount > 0) {
-            Log.d(TAG, "Cleaned up $removedCount old processed messages")
+            toRemove.forEach { keyExchangeTimestamps.remove(it) }
         }
     }
     
@@ -401,6 +454,7 @@ class SecurityManager(private val encryptionService: EncryptionService, private
         processedMessages.clear()
         processedKeyExchanges.clear()
         messageTimestamps.clear()
+        keyExchangeTimestamps.clear()
     }
     
     /**
@@ -416,7 +470,14 @@ class SecurityManager(private val encryptionService: EncryptionService, private
  * Delegate interface for security manager callbacks
  */
 interface SecurityManagerDelegate {
-    fun onKeyExchangeCompleted(peerID: String, peerPublicKeyData: ByteArray)
+    fun onKeyExchangeCompleted(
+        peerID: String,
+        authenticatedRemoteStaticKey: ByteArray,
+        authenticatedSessionToken: ByteArray,
+        directRelayAddress: String?,
+        ingressLinkID: String?
+    )
     fun sendHandshakeResponse(peerID: String, response: ByteArray)
     fun getPeerInfo(peerID: String): PeerInfo? // NEW: For signature verification
+    fun getAuthenticatedSigningKey(noisePublicKey: ByteArray): ByteArray? = null
 }

app/src/main/java/com/bitchat/android/mesh/TransferProgressManager.kt

@@ -11,7 +11,8 @@ data class TransferProgressEvent(
     val transferId: String,
     val sent: Int,
     val total: Int,
-    val completed: Boolean
+    val completed: Boolean,
+    val failed: Boolean = false
 )
 
 object TransferProgressManager {
@@ -22,9 +23,9 @@ object TransferProgressManager {
     fun start(id: String, total: Int) { emit(id, 0, total, false) }
     fun progress(id: String, sent: Int, total: Int) { emit(id, sent, total, sent >= total) }
     fun complete(id: String, total: Int) { emit(id, total, total, true) }
+    fun fail(id: String) { emit(id, 0, 0, done = true, failed = true) }
 
-    private fun emit(id: String, sent: Int, total: Int, done: Boolean) {
-        scope.launch { _events.emit(TransferProgressEvent(id, sent, total, done)) }
+    private fun emit(id: String, sent: Int, total: Int, done: Boolean, failed: Boolean = false) {
+        scope.launch { _events.emit(TransferProgressEvent(id, sent, total, done, failed)) }
     }
 }
-

app/src/main/java/com/bitchat/android/mesh/UnifiedMeshService.kt

@@ -0,0 +1,532 @@
+package com.bitchat.android.mesh
+
+import android.content.Context
+import android.util.Log
+import com.bitchat.android.favorites.FavoriteControlMessage
+import com.bitchat.android.model.BitchatFilePacket
+import com.bitchat.android.model.BitchatMessage
+import com.bitchat.android.model.NdrFeatureGate
+import com.bitchat.android.noise.NoiseSession
+import com.bitchat.android.wifiaware.WifiAwareController
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.flow.collectLatest
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.launch
+
+/**
+ * Feature-facing mesh service that hides local transport selection from the rest of the app.
+ *
+ * BLE remains the canonical origin for broadcast packets when it is enabled so existing BLE mesh
+ * behavior and bridge semantics stay intact. Addressed Noise traffic is routed over whichever
+ * local transport already has the peer/session, falling back to a connected transport handshake.
+ */
+class UnifiedMeshService(
+    private val context: Context,
+    private val bluetooth: BluetoothMeshService
+) : MeshService, BluetoothMeshDelegate {
+
+    companion object {
+        private const val TAG = "UnifiedMeshService"
+        private const val BLE_NDR_TRANSPORT_ID = "BLE"
+    }
+
+    private val serviceScope = CoroutineScope(Dispatchers.Default + SupervisorJob())
+    private val powerManager = PowerManager.getInstance(context.applicationContext)
+    private var announcementJob: Job? = null
+
+    override val myPeerID: String
+        get() = bluetooth.myPeerID
+
+    override var delegate: MeshDelegate? = null
+        set(value) {
+            field = value
+            refreshDelegates()
+        }
+
+    fun refreshDelegates() {
+        try { bluetooth.delegate = if (delegate != null) this else null } catch (_: Exception) { }
+        try { wifiService()?.delegate = if (delegate != null) this else null } catch (_: Exception) { }
+    }
+
+    override fun startServices() {
+        if (isBleEnabled()) {
+            try { bluetooth.startServices() } catch (e: Exception) {
+                Log.w(TAG, "Failed to start BLE transport: ${e.message}")
+            }
+        } else {
+            try { bluetooth.setBleTransportEnabled(false) } catch (_: Exception) { }
+        }
+        try { WifiAwareController.startIfPossible() } catch (e: Exception) {
+            Log.w(TAG, "Failed to start Wi-Fi Aware transport: ${e.message}")
+        }
+        startAnnouncementScheduler()
+        refreshDelegates()
+    }
+
+    override fun stopServices() {
+        announcementJob?.cancel()
+        announcementJob = null
+        try { bluetooth.stopServices() } catch (_: Exception) { }
+        try { WifiAwareController.stop() } catch (_: Exception) { }
+    }
+
+    private fun startAnnouncementScheduler() {
+        if (announcementJob?.isActive == true) return
+        announcementJob = serviceScope.launch {
+            powerManager.profile
+                .map { profile ->
+                    profile.meshAnnouncementIntervalMs to profile.hasDirectPeers
+                }
+                .distinctUntilChanged()
+                .collectLatest { (intervalMs, hasRecipients) ->
+                    if (!hasRecipients) return@collectLatest
+                    // Connection-specific paths already send an immediate announce. Begin the
+                    // periodic cadence after the configured interval to avoid a transition burst.
+                    while (isActive) {
+                        delay(intervalMs)
+                        if (powerManager.profile.value.hasDirectPeers) sendBroadcastAnnounce()
+                    }
+                }
+            }
+    }
+
+    override fun sendMessage(content: String, mentions: List<String>, channel: String?) {
+        when {
+            isBleEnabled() -> bluetooth.sendMessage(content, mentions, channel)
+            else -> wifiService()?.sendMessage(content, mentions, channel)
+        }
+    }
+
+    override fun sendPrivateMessage(
+        content: String,
+        recipientPeerID: String,
+        recipientNickname: String,
+        messageID: String?
+    ) {
+        when {
+            isBleReady(recipientPeerID) -> bluetooth.sendPrivateMessage(content, recipientPeerID, recipientNickname, messageID)
+            isWifiReady(recipientPeerID) -> wifiService()?.sendPrivateMessage(content, recipientPeerID, recipientNickname, messageID)
+            isBleConnected(recipientPeerID) || (isBleEnabled() && !isWifiConnected(recipientPeerID)) ->
+                bluetooth.sendPrivateMessage(content, recipientPeerID, recipientNickname, messageID)
+            else -> wifiService()?.sendPrivateMessage(content, recipientPeerID, recipientNickname, messageID)
+        }
+    }
+
+    override fun sendReadReceipt(messageID: String, recipientPeerID: String, readerNickname: String) {
+        when {
+            isBleReady(recipientPeerID) -> bluetooth.sendReadReceipt(messageID, recipientPeerID, readerNickname)
+            isWifiReady(recipientPeerID) -> wifiService()?.sendReadReceipt(messageID, recipientPeerID, readerNickname)
+        }
+    }
+
+    override fun sendFavoriteNotification(peerID: String, isFavorite: Boolean) {
+        val myNpub = try {
+            com.bitchat.android.nostr.NostrIdentityBridge.getCurrentNostrIdentity(context)?.npub
+        } catch (_: Exception) {
+            null
+        }
+        val content = FavoriteControlMessage.encode(isFavorite, myNpub)
+        val nickname = getPeerNicknames()[peerID] ?: peerID
+        if (hasEstablishedSession(peerID)) {
+            sendPrivateMessage(content, peerID, nickname, java.util.UUID.randomUUID().toString())
+        }
+    }
+
+    override fun sendVerifyChallenge(peerID: String, noiseKeyHex: String, nonceA: ByteArray) {
+        when {
+            isBleReady(peerID) -> bluetooth.sendVerifyChallenge(peerID, noiseKeyHex, nonceA)
+            isWifiReady(peerID) -> wifiService()?.sendVerifyChallenge(peerID, noiseKeyHex, nonceA)
+        }
+    }
+
+    override fun sendVerifyResponse(peerID: String, noiseKeyHex: String, nonceA: ByteArray) {
+        when {
+            isBleReady(peerID) -> bluetooth.sendVerifyResponse(peerID, noiseKeyHex, nonceA)
+            isWifiReady(peerID) -> wifiService()?.sendVerifyResponse(peerID, noiseKeyHex, nonceA)
+        }
+    }
+
+    override fun currentNdrRoute(peerID: String, transportId: String?): NdrMeshRoute? {
+        if (!NdrFeatureGate.isEnabled()) return null
+        return when (transportId) {
+            null -> bluetooth.currentNdrRoute(peerID)
+                ?: wifiService()?.currentNdrRoute(peerID)
+            BLE_NDR_TRANSPORT_ID ->
+                bluetooth.currentNdrRoute(peerID, transportId)
+            else -> wifiService()?.currentNdrRoute(peerID, transportId)
+        }
+    }
+
+    override fun sendNdrEvent(
+        route: NdrMeshRoute,
+        payload: String,
+        isStillAuthorized: () -> Boolean,
+        completion: (admitted: Boolean) -> Unit
+    ) {
+        if (!NdrFeatureGate.isEnabled()) {
+            completion(false)
+            return
+        }
+        if (route.transportId == BLE_NDR_TRANSPORT_ID) {
+            bluetooth.sendNdrEvent(route, payload, isStillAuthorized, completion)
+            return
+        }
+        val wifi = wifiService()
+        if (wifi == null) {
+            completion(false)
+            return
+        }
+        wifi.sendNdrEvent(route, payload, isStillAuthorized, completion)
+    }
+
+    override fun sendFileBroadcast(file: BitchatFilePacket) {
+        when {
+            isBleEnabled() -> bluetooth.sendFileBroadcast(file)
+            else -> wifiService()?.sendFileBroadcast(file)
+        }
+    }
+
+    override fun sendFilePrivate(recipientPeerID: String, file: BitchatFilePacket) {
+        when {
+            isBleReady(recipientPeerID) -> bluetooth.sendFilePrivate(recipientPeerID, file)
+            isWifiReady(recipientPeerID) -> wifiService()?.sendFilePrivate(recipientPeerID, file)
+            isBleConnected(recipientPeerID) || (isBleEnabled() && !isWifiConnected(recipientPeerID)) ->
+                bluetooth.sendFilePrivate(recipientPeerID, file)
+            else -> wifiService()?.sendFilePrivate(recipientPeerID, file)
+        }
+    }
+
+    override fun prepareFilePrivate(
+        recipientPeerID: String,
+        file: BitchatFilePacket,
+        transferId: String,
+        allowLegacyFallback: Boolean
+    ): PrivateMediaPreparation {
+        return when {
+            isBleReady(recipientPeerID) -> bluetooth.prepareFilePrivate(
+                recipientPeerID,
+                file,
+                transferId,
+                allowLegacyFallback
+            )
+            isWifiReady(recipientPeerID) -> wifiService()?.prepareFilePrivate(
+                recipientPeerID,
+                file,
+                transferId,
+                allowLegacyFallback
+            ) ?: PrivateMediaPreparation.Rejected("Wi-Fi Aware transport is unavailable")
+            isBleConnected(recipientPeerID) || (isBleEnabled() && !isWifiConnected(recipientPeerID)) ->
+                bluetooth.prepareFilePrivate(
+                    recipientPeerID,
+                    file,
+                    transferId,
+                    allowLegacyFallback
+                )
+            else -> wifiService()?.prepareFilePrivate(
+                recipientPeerID,
+                file,
+                transferId,
+                allowLegacyFallback
+            ) ?: PrivateMediaPreparation.Rejected("No local transport is available for this peer")
+        }
+    }
+
+    override fun cancelFileTransfer(transferId: String): Boolean {
+        val bleCancelled = try { bluetooth.cancelFileTransfer(transferId) } catch (_: Exception) { false }
+        val wifiCancelled = try { wifiService()?.cancelFileTransfer(transferId) == true } catch (_: Exception) { false }
+        return bleCancelled || wifiCancelled
+    }
+
+    override fun sendBroadcastAnnounce() {
+        if (isBleEnabled()) {
+            try { bluetooth.sendBroadcastAnnounce() } catch (_: Exception) { }
+        }
+        try { wifiService()?.sendBroadcastAnnounce() } catch (_: Exception) { }
+    }
+
+    override fun sendAnnouncementToPeer(peerID: String) {
+        when {
+            isBleConnected(peerID) || (isBleEnabled() && !isWifiConnected(peerID)) -> bluetooth.sendAnnouncementToPeer(peerID)
+            else -> wifiService()?.sendAnnouncementToPeer(peerID)
+        }
+    }
+
+    override fun getPeerNicknames(): Map<String, String> {
+        val merged = linkedMapOf<String, String>()
+        try { merged.putAll(wifiService()?.getPeerNicknames().orEmpty()) } catch (_: Exception) { }
+        try { merged.putAll(bluetooth.getPeerNicknames()) } catch (_: Exception) { }
+        return merged
+    }
+
+    override fun getPeerRSSI(): Map<String, Int> {
+        val merged = linkedMapOf<String, Int>()
+        try { merged.putAll(wifiService()?.getPeerRSSI().orEmpty()) } catch (_: Exception) { }
+        try { merged.putAll(bluetooth.getPeerRSSI()) } catch (_: Exception) { }
+        return merged
+    }
+
+    override fun getActivePeerCount(): Int {
+        return mergedPeerIDs().filter { it != myPeerID }.distinct().size
+    }
+
+    override fun hasEstablishedSession(peerID: String): Boolean {
+        return isBleReady(peerID) || isWifiReady(peerID)
+    }
+
+    override fun getSessionState(peerID: String): NoiseSession.NoiseSessionState {
+        val bleState = try { bluetooth.getSessionState(peerID) } catch (_: Exception) { NoiseSession.NoiseSessionState.Uninitialized }
+        val wifiState = try { wifiService()?.getSessionState(peerID) } catch (_: Exception) { null }
+        return when {
+            bleState is NoiseSession.NoiseSessionState.Established -> bleState
+            wifiState is NoiseSession.NoiseSessionState.Established -> wifiState
+            bleState is NoiseSession.NoiseSessionState.Handshaking -> bleState
+            wifiState is NoiseSession.NoiseSessionState.Handshaking -> wifiState
+            bleState !is NoiseSession.NoiseSessionState.Uninitialized -> bleState
+            wifiState != null -> wifiState
+            else -> bleState
+        }
+    }
+
+    override fun initiateNoiseHandshake(peerID: String) {
+        when {
+            isBleConnected(peerID) -> bluetooth.initiateNoiseHandshake(peerID)
+            isWifiConnected(peerID) -> wifiService()?.initiateNoiseHandshake(peerID)
+            isBleEnabled() -> bluetooth.initiateNoiseHandshake(peerID)
+            else -> wifiService()?.initiateNoiseHandshake(peerID)
+        }
+    }
+
+    override fun getPeerFingerprint(peerID: String): String? {
+        return try { bluetooth.getPeerFingerprint(peerID) } catch (_: Exception) { null }
+            ?: try { wifiService()?.getPeerFingerprint(peerID) } catch (_: Exception) { null }
+    }
+
+    override fun getPeerInfo(peerID: String): PeerInfo? {
+        val ble = try { bluetooth.getPeerInfo(peerID) } catch (_: Exception) { null }
+        val wifi = try { wifiService()?.getPeerInfo(peerID) } catch (_: Exception) { null }
+        return when {
+            ble?.isConnected == true && hasEstablishedSessionOnBluetooth(peerID) -> ble
+            wifi?.isConnected == true && wifiService()?.hasEstablishedSession(peerID) == true -> wifi
+            ble?.isConnected == true -> ble
+            wifi?.isConnected == true -> wifi
+            else -> ble ?: wifi
+        }
+    }
+
+    override fun peerSupportsAuthenticatedCapability(
+        peerID: String,
+        capability: com.bitchat.android.model.PeerCapabilities
+    ): Boolean =
+        bleSupportsAuthenticatedCapability(peerID, capability) ||
+            wifiSupportsAuthenticatedCapability(peerID, capability)
+
+    private fun bleSupportsAuthenticatedCapability(
+        peerID: String,
+        capability: com.bitchat.android.model.PeerCapabilities
+    ): Boolean {
+        return try {
+            isBleReady(peerID) && bluetooth.peerSupportsAuthenticatedCapability(peerID, capability)
+        } catch (_: Exception) {
+            false
+        }
+    }
+
+    private fun wifiSupportsAuthenticatedCapability(
+        peerID: String,
+        capability: com.bitchat.android.model.PeerCapabilities
+    ): Boolean {
+        return try {
+            isWifiReady(peerID) &&
+                wifiService()?.peerSupportsAuthenticatedCapability(peerID, capability) == true
+        } catch (_: Exception) {
+            false
+        }
+    }
+
+    override fun updatePeerInfo(
+        peerID: String,
+        nickname: String,
+        noisePublicKey: ByteArray,
+        signingPublicKey: ByteArray,
+        isVerified: Boolean
+    ): Boolean {
+        val bleUpdated = try {
+            bluetooth.updatePeerInfo(peerID, nickname, noisePublicKey, signingPublicKey, isVerified)
+        } catch (_: Exception) {
+            false
+        }
+        val wifiUpdated = try {
+            wifiService()?.updatePeerInfo(peerID, nickname, noisePublicKey, signingPublicKey, isVerified) == true
+        } catch (_: Exception) {
+            false
+        }
+        return bleUpdated || wifiUpdated
+    }
+
+    override fun getIdentityFingerprint(): String = bluetooth.getIdentityFingerprint()
+
+    override fun getStaticNoisePublicKey(): ByteArray? {
+        return bluetooth.getStaticNoisePublicKey() ?: wifiService()?.getStaticNoisePublicKey()
+    }
+
+    override fun shouldShowEncryptionIcon(peerID: String): Boolean {
+        return hasEstablishedSession(peerID)
+    }
+
+    override fun getEncryptedPeers(): List<String> {
+        val encrypted = linkedSetOf<String>()
+        try { encrypted.addAll(bluetooth.getEncryptedPeers()) } catch (_: Exception) { }
+        try { encrypted.addAll(wifiService()?.getEncryptedPeers().orEmpty()) } catch (_: Exception) { }
+        mergedPeerIDs().filterTo(encrypted) { hasEstablishedSession(it) }
+        return encrypted.toList()
+    }
+
+    override fun getDeviceAddressForPeer(peerID: String): String? {
+        return try { bluetooth.getDeviceAddressForPeer(peerID) } catch (_: Exception) { null }
+            ?: try { wifiService()?.getDeviceAddressForPeer(peerID) } catch (_: Exception) { null }
+    }
+
+    override fun getDeviceAddressToPeerMapping(): Map<String, String> {
+        val merged = linkedMapOf<String, String>()
+        try { merged.putAll(wifiService()?.getDeviceAddressToPeerMapping().orEmpty()) } catch (_: Exception) { }
+        try { merged.putAll(bluetooth.getDeviceAddressToPeerMapping()) } catch (_: Exception) { }
+        return merged
+    }
+
+    override fun printDeviceAddressesForPeers(): String {
+        return buildString {
+            appendLine(bluetooth.printDeviceAddressesForPeers())
+            wifiService()?.let {
+                appendLine()
+                appendLine(it.printDeviceAddressesForPeers())
+            }
+        }
+    }
+
+    override fun getDebugStatus(): String {
+        return buildString {
+            appendLine("=== Unified Mesh Service Debug Status ===")
+            appendLine("My Peer ID: $myPeerID")
+            appendLine("Merged Peers: ${mergedPeerIDs().joinToString(", ")}")
+            appendLine()
+            appendLine(bluetooth.getDebugStatus())
+            wifiService()?.let {
+                appendLine()
+                appendLine(it.getDebugStatus())
+            }
+        }
+    }
+
+    override fun clearAllInternalData() {
+        try { bluetooth.clearAllInternalData() } catch (_: Exception) { }
+        try { wifiService()?.clearAllInternalData() } catch (_: Exception) { }
+    }
+
+    override fun clearAllEncryptionData() {
+        try { bluetooth.clearAllEncryptionData() } catch (_: Exception) { }
+        try { wifiService()?.clearAllEncryptionData() } catch (_: Exception) { }
+    }
+
+    override fun didReceiveMessage(message: BitchatMessage) {
+        delegate?.didReceiveMessage(message)
+    }
+
+    override fun didUpdatePeerList(peers: List<String>) {
+        delegate?.didUpdatePeerList(mergedPeerIDs().ifEmpty { peers.distinct() })
+    }
+
+    override fun didReceiveChannelLeave(channel: String, fromPeer: String) {
+        delegate?.didReceiveChannelLeave(channel, fromPeer)
+    }
+
+    override fun didReceiveDeliveryAck(messageID: String, recipientPeerID: String) {
+        delegate?.didReceiveDeliveryAck(messageID, recipientPeerID)
+    }
+
+    override fun didReceiveReadReceipt(messageID: String, recipientPeerID: String) {
+        delegate?.didReceiveReadReceipt(messageID, recipientPeerID)
+    }
+
+    override fun didReceiveVerifyChallenge(peerID: String, payload: ByteArray, timestampMs: Long) {
+        delegate?.didReceiveVerifyChallenge(peerID, payload, timestampMs)
+    }
+
+    override fun didReceiveVerifyResponse(peerID: String, payload: ByteArray, timestampMs: Long) {
+        delegate?.didReceiveVerifyResponse(peerID, payload, timestampMs)
+    }
+
+    override fun didReceiveNdrEvent(route: NdrMeshRoute, payload: ByteArray, timestampMs: Long) {
+        delegate?.didReceiveNdrEvent(route, payload, timestampMs)
+    }
+
+    override fun didResolvePrivateMediaPolicy(peerID: String) {
+        delegate?.didResolvePrivateMediaPolicy(peerID)
+    }
+
+    override fun decryptChannelMessage(encryptedContent: ByteArray, channel: String): String? {
+        return delegate?.decryptChannelMessage(encryptedContent, channel)
+    }
+
+    override fun getNickname(): String? = delegate?.getNickname()
+
+    override fun isFavorite(peerID: String): Boolean = delegate?.isFavorite(peerID) ?: false
+
+    private fun mergedPeerIDs(): List<String> {
+        val ids = linkedSetOf<String>()
+        try { ids.addAll(com.bitchat.android.services.AppStateStore.peers.value) } catch (_: Exception) { }
+        try { ids.addAll(bluetooth.getPeerNicknames().keys) } catch (_: Exception) { }
+        try { ids.addAll(wifiService()?.getPeerNicknames()?.keys.orEmpty()) } catch (_: Exception) { }
+        return ids.toList()
+    }
+
+    private fun wifiService(): MeshService? {
+        return try {
+            WifiAwareController.getService()?.also { service ->
+                if (delegate != null && service.delegate !== this) {
+                    service.delegate = this
+                }
+            }
+        } catch (_: Exception) {
+            null
+        }
+    }
+
+    private fun isBleEnabled(): Boolean {
+        return try {
+            com.bitchat.android.ui.debug.DebugSettingsManager.getInstance().bleEnabled.value
+        } catch (_: Exception) {
+            try { com.bitchat.android.ui.debug.DebugPreferenceManager.getBleEnabled(true) } catch (_: Exception) { true }
+        }
+    }
+
+    private fun isBleConnected(peerID: String): Boolean {
+        return try { bluetooth.getPeerInfo(peerID)?.isConnected == true } catch (_: Exception) { false }
+    }
+
+    private fun isWifiConnected(peerID: String): Boolean {
+        return try { wifiService()?.getPeerInfo(peerID)?.isConnected == true } catch (_: Exception) { false }
+    }
+
+    private fun isBleReady(peerID: String): Boolean {
+        return isBleConnected(peerID) && hasEstablishedSessionOnBluetooth(peerID)
+    }
+
+    private fun isWifiReady(peerID: String): Boolean {
+        return try {
+            val wifi = wifiService()
+            wifi?.getPeerInfo(peerID)?.isConnected == true && wifi.hasEstablishedSession(peerID)
+        } catch (_: Exception) {
+            false
+        }
+    }
+
+    private fun hasEstablishedSessionOnBluetooth(peerID: String): Boolean {
+        return try { bluetooth.hasEstablishedSession(peerID) } catch (_: Exception) { false }
+    }
+}

app/src/main/java/com/bitchat/android/model/AuthenticatedPeerState.kt

@@ -0,0 +1,86 @@
+package com.bitchat.android.model
+
+/**
+ * Canonical payload carried inside Noise payload type 0x21.
+ *
+ * Wire format:
+ * `[version=0x01][type=0x01][len=1...8][minimal LE capabilities]`
+ * `[type=0x02][len=32][Ed25519 public key]`
+ *
+ * Unknown TLVs are skipped. Both known fields must occur exactly once.
+ */
+data class AuthenticatedPeerState(
+    val capabilities: PeerCapabilities,
+    val signingPublicKey: ByteArray
+) {
+    init {
+        require(signingPublicKey.size == SIGNING_PUBLIC_KEY_SIZE) {
+            "Ed25519 public key must be 32 bytes"
+        }
+    }
+
+    fun encode(): ByteArray {
+        val capabilityBytes = capabilities.encoded()
+        return buildList<Byte>(1 + 2 + capabilityBytes.size + 2 + signingPublicKey.size) {
+            add(VERSION.toByte())
+            add(CAPABILITIES_TLV.toByte())
+            add(capabilityBytes.size.toByte())
+            addAll(capabilityBytes.toList())
+            add(SIGNING_PUBLIC_KEY_TLV.toByte())
+            add(SIGNING_PUBLIC_KEY_SIZE.toByte())
+            addAll(signingPublicKey.toList())
+        }.toByteArray()
+    }
+
+    companion object {
+        const val VERSION = 0x01
+        private const val CAPABILITIES_TLV = 0x01
+        private const val SIGNING_PUBLIC_KEY_TLV = 0x02
+        private const val SIGNING_PUBLIC_KEY_SIZE = 32
+
+        fun decode(data: ByteArray): AuthenticatedPeerState? {
+            if (data.firstOrNull()?.toInt()?.and(0xFF) != VERSION) return null
+            var offset = 1
+            var capabilities: PeerCapabilities? = null
+            var signingPublicKey: ByteArray? = null
+
+            while (offset < data.size) {
+                if (offset + 2 > data.size) return null
+                val type = data[offset].toInt() and 0xFF
+                val length = data[offset + 1].toInt() and 0xFF
+                offset += 2
+                if (offset + length > data.size) return null
+                val value = data.copyOfRange(offset, offset + length)
+                offset += length
+
+                when (type) {
+                    CAPABILITIES_TLV -> {
+                        if (capabilities != null || length !in 1..8) return null
+                        val decoded = PeerCapabilities.decode(value)
+                        if (!decoded.encoded().contentEquals(value)) return null
+                        capabilities = decoded
+                    }
+
+                    SIGNING_PUBLIC_KEY_TLV -> {
+                        if (signingPublicKey != null || length != SIGNING_PUBLIC_KEY_SIZE) return null
+                        signingPublicKey = value
+                    }
+
+                    else -> Unit
+                }
+            }
+
+            val decodedCapabilities = capabilities ?: return null
+            val decodedSigningKey = signingPublicKey ?: return null
+            return AuthenticatedPeerState(decodedCapabilities, decodedSigningKey)
+        }
+    }
+
+    override fun equals(other: Any?): Boolean =
+        this === other ||
+            (other is AuthenticatedPeerState &&
+                capabilities == other.capabilities &&
+                signingPublicKey.contentEquals(other.signingPublicKey))
+
+    override fun hashCode(): Int = 31 * capabilities.hashCode() + signingPublicKey.contentHashCode()
+}

app/src/main/java/com/bitchat/android/model/BitchatMessage.kt

@@ -69,7 +69,15 @@ data class BitchatMessage(
     val encryptedContent: ByteArray? = null,
     val isEncrypted: Boolean = false,
     val deliveryStatus: DeliveryStatus? = null,
-    val powDifficulty: Int? = null
+    val powDifficulty: Int? = null,
+    /**
+     * Full canonical Nostr public key supplied by the local Nostr bridge.
+     *
+     * This is local identity metadata, not part of the Bitchat binary wire format. It lets UI
+     * surfaces color the sender by the same stable key while [senderPeerID] remains available for
+     * mesh IDs and private-chat routing aliases.
+     */
+    val senderNostrPubkey: String? = null
 ) : Parcelable {
 
     /**
@@ -355,4 +363,3 @@ data class BitchatMessage(
     }
 }
 
-

app/src/main/java/com/bitchat/android/model/FragmentPayload.kt

@@ -83,6 +83,9 @@ data class FragmentPayload(
      * Matches iOS implementation exactly
      */
     fun encode(): ByteArray {
+        require(index in 0..0xFFFF) { "Fragment index would truncate UInt16: $index" }
+        require(total in 1..0xFFFF) { "Fragment total would truncate UInt16: $total" }
+        require(index < total) { "Fragment index $index must be below total $total" }
         val payload = ByteArray(HEADER_SIZE + data.size)
         
         // Fragment ID (8 bytes)

app/src/main/java/com/bitchat/android/model/IdentityAnnouncement.kt

@@ -2,7 +2,6 @@ package com.bitchat.android.model
 
 import android.os.Parcelable
 import kotlinx.parcelize.Parcelize
-import com.bitchat.android.util.*
 
 /**
  * Identity announcement structure with TLV encoding
@@ -12,7 +11,9 @@ import com.bitchat.android.util.*
 data class IdentityAnnouncement(
     val nickname: String,
     val noisePublicKey: ByteArray,    // Noise static public key (Curve25519.KeyAgreement)
-    val signingPublicKey: ByteArray   // Ed25519 public key for signing
+    val signingPublicKey: ByteArray,  // Ed25519 public key for signing
+    val capabilities: PeerCapabilities? = null,
+    val unknownTLVs: List<UnknownAnnouncementTLV> = emptyList()
 ) : Parcelable {
 
     /**
@@ -21,7 +22,8 @@ data class IdentityAnnouncement(
     private enum class TLVType(val value: UByte) {
         NICKNAME(0x01u),
         NOISE_PUBLIC_KEY(0x02u),
-        SIGNING_PUBLIC_KEY(0x03u);  // NEW: Ed25519 signing public key
+        SIGNING_PUBLIC_KEY(0x03u),  // NEW: Ed25519 signing public key
+        CAPABILITIES(0x05u);
         
         companion object {
             fun fromValue(value: UByte): TLVType? {
@@ -37,7 +39,8 @@ data class IdentityAnnouncement(
         val nicknameData = nickname.toByteArray(Charsets.UTF_8)
         
         // Check size limits
-        if (nicknameData.size > 255 || noisePublicKey.size > 255 || signingPublicKey.size > 255) {
+        if (nicknameData.size > 255 || noisePublicKey.size > 255 || signingPublicKey.size > 255 ||
+            unknownTLVs.any { it.value.size > 255 }) {
             return null
         }
         
@@ -57,6 +60,21 @@ data class IdentityAnnouncement(
         result.add(TLVType.SIGNING_PUBLIC_KEY.value.toByte())
         result.add(signingPublicKey.size.toByte())
         result.addAll(signingPublicKey.toList())
+
+        // Optional little-endian feature bitfield. Old clients skip this TLV.
+        capabilities?.encoded()?.let { capabilityBytes ->
+            result.add(TLVType.CAPABILITIES.value.toByte())
+            result.add(capabilityBytes.size.toByte())
+            result.addAll(capabilityBytes.toList())
+        }
+
+        // Preserve extensions this build does not understand. This includes
+        // gossip TLV 0x04 when an announcement is decoded through this model.
+        unknownTLVs.forEach { tlv ->
+            result.add(tlv.type.toByte())
+            result.add(tlv.value.size.toByte())
+            result.addAll(tlv.value.toList())
+        }
         
         return result.toByteArray()
     }
@@ -73,6 +91,8 @@ data class IdentityAnnouncement(
             var nickname: String? = null
             var noisePublicKey: ByteArray? = null
             var signingPublicKey: ByteArray? = null
+            var capabilities: PeerCapabilities? = null
+            val unknownTLVs = mutableListOf<UnknownAnnouncementTLV>()
             
             while (offset + 2 <= dataCopy.size) {
                 // Read TLV type
@@ -102,20 +122,36 @@ data class IdentityAnnouncement(
                     TLVType.SIGNING_PUBLIC_KEY -> {
                         signingPublicKey = value
                     }
+                    TLVType.CAPABILITIES -> {
+                        capabilities = PeerCapabilities.decode(value)
+                    }
                     null -> {
-                        // Unknown TLV; skip (tolerant decoder for forward compatibility)
-                        continue
+                        // Retain unknown extensions so callers can forward or
+                        // re-encode the announcement without erasing them.
+                        unknownTLVs += UnknownAnnouncementTLV(typeValue.toInt(), value)
                     }
                 }
             }
             
             // All three fields are required
             return if (nickname != null && noisePublicKey != null && signingPublicKey != null) {
-                IdentityAnnouncement(nickname, noisePublicKey, signingPublicKey)
+                IdentityAnnouncement(nickname, noisePublicKey, signingPublicKey, capabilities, unknownTLVs)
             } else {
                 null
             }
         }
+
+        /** Construct the announcement emitted by this Android build. */
+        fun forLocalPeer(
+            nickname: String,
+            noisePublicKey: ByteArray,
+            signingPublicKey: ByteArray
+        ): IdentityAnnouncement = IdentityAnnouncement(
+            nickname = nickname,
+            noisePublicKey = noisePublicKey,
+            signingPublicKey = signingPublicKey,
+            capabilities = PeerCapabilities.LOCAL_SUPPORTED
+        )
     }
     
     // Override equals and hashCode since we use ByteArray
@@ -128,6 +164,8 @@ data class IdentityAnnouncement(
         if (nickname != other.nickname) return false
         if (!noisePublicKey.contentEquals(other.noisePublicKey)) return false
         if (!signingPublicKey.contentEquals(other.signingPublicKey)) return false
+        if (capabilities != other.capabilities) return false
+        if (unknownTLVs != other.unknownTLVs) return false
         
         return true
     }
@@ -136,10 +174,12 @@ data class IdentityAnnouncement(
         var result = nickname.hashCode()
         result = 31 * result + noisePublicKey.contentHashCode()
         result = 31 * result + signingPublicKey.contentHashCode()
+        result = 31 * result + (capabilities?.hashCode() ?: 0)
+        result = 31 * result + unknownTLVs.hashCode()
         return result
     }
     
     override fun toString(): String {
-        return "IdentityAnnouncement(nickname='$nickname', noisePublicKey=${noisePublicKey.joinToString("") { "%02x".format(it) }.take(16)}..., signingPublicKey=${signingPublicKey.joinToString("") { "%02x".format(it) }.take(16)}...)"
+        return "IdentityAnnouncement(nickname='$nickname', noisePublicKey=${noisePublicKey.joinToString("") { "%02x".format(it) }.take(16)}..., signingPublicKey=${signingPublicKey.joinToString("") { "%02x".format(it) }.take(16)}..., capabilities=${capabilities?.rawValue})"
     }
 }