Description

Relays in the bundled CSV can require NIP-42 authentication, leaving Bitchat subscriptions and publications rejected with auth-required. Authenticate those operations with their originating Nostr identity and retry them after the relay accepts the matching proof.

• Carry the channel signer through public messages, presence, notes, channel DMs, and delivery/read receipts. Keep the separate account/favorites signer for that path; an unavailable channel signer never falls back to the account key or a gift-wrap key.
• Track authentication independently per key and WebSocket, bound challenges and attempts, and discard socket authorization on reconnect or panic.
• Retain bounded pending publications until relay acknowledgement. Retries preserve signed events, relay targets, and privacy provenance, and exclude revoked or unsubscribed operations. Authenticated replay rechecks the originating signer and atomically verifies pending delivery before enqueue, preventing stale replay after reset.
• Add a literal protocol vector, deterministic regression tests, and opt-in JVM/Android live probes. Normal test suites remain offline.

Related issue: none; no matching NIP-42 issue was found.

Validation

• ./gradlew testDebugUnitTest lintDebug :app:assembleDebug :wear:assembleDebug clientRewriteContractTest passed: 887 tests passed, 3 existing skips. Lint completed under the repository configuration with existing findings; no errors were reported in changed files.
• Four new deterministic regression cases reproduce stale replay and signer revocation/replacement on the original implementation and pass with the fix.
• Initial feature validation: the opt-in JVM live probe passed against a NIP-42 relay listed in the bundled CSV.
• Initial feature validation: the instrumented Android probe passed on a fresh disposable emulator using a synthetic channel identity and encrypted storage. It confirmed identity reload, an auth-required rejection, acceptance of the channel key's proof, and completion of the retried DM subscription.
• Physical BLE Mesh Lab validation was not run and remains a pre-merge validation item. Emulator results cover Android/Nostr behavior, not physical mesh delivery.

Risk and limits

This changes relay delivery bookkeeping and authentication retries. Failed proofs and relay access restrictions remain terminal for that challenge; successful authentication does not grant membership. Existing relay sockets can authenticate multiple keys and still multiplex channel traffic, so this does not provide transport-level channel isolation.

Checklist

• I have read the repository contribution guidance in AGENTS.md.
• I have performed a self-review of my code.
• I have linked a corresponding issue (not applicable; no matching issue).
• I have added automated tests for this core feature.