78:Ta56,Ports three security/privacy fixes from bitchat iOS and pins a fourth that Android already handles. ## Changes **Geohash DMs no longer carry the mesh peer ID** (jackjackbits/bitchat#1718) The recipient-less encoders used for geohash DMs and their acks wrote our mesh peer ID into the embedded packet's sender field. That ID is the stable Noise fingerprint prefix, so anyone who DMs a geohash identity (and gets the automatic DELIVERED ack) could link that persona to the device. Each envelope now gets fresh random bytes. No iOS or Android receiver reads this field; favorites (recipient-addressed) envelopes are unchanged. **Per-type payload caps at decode** (decoder part of jackjackbits/bitchat#1719) New `PacketPayloadLimits` with the same per-type caps as iOS (public message 128 KiB, request sync 8 KiB, announce/leave/handshake/voice 4 KiB, fragment 1,280 B, unknown types 128 KiB). `FILE_TRANSFER` and `NOISE_ENCRYPTED` keep the existing `MAX_PAYLOAD_LENGTH`. Enforced on compressed and uncompressed payloads before allocation. The 50,000:1 compression-ratio guard becomes DEFLATE's 1032:1 bound. Not ported here: the iOS reassembly bound by claimed type and byte budgets for sync stores. **Panic wipe asks first** (jackjackbits/bitchat#1588) Triple-tapping the logo now opens a "Wipe all data?" dialog instead of wiping immediately. A completed wipe posts "all data wiped — new identity created"; a wipe whose conversation-database erase fails now says so in the chat instead of failing silently. New strings are English-only (`tools:ignore="MissingTranslation"`), following recent precedent. **Ack only after the block check** Already correct on Android (the block check runs right after decryption). Added a regression test. ## Risk - Payload caps are receive-side only and sized at ≥2× the largest payload current iOS/Android encoders produce, but an oversized legitimate packet of a capped type would now be dropped at decode. - The sender-ID change touches the geohash DM wire content; receivers key these conversations on the Nostr pubkey, so interop should be unaffected. - Panic flow gains one extra tap. ## Testing - `./gradlew testDebugUnitTest lintDebug` passes (app 659 tests, Wear 231 tests); no new lint findings in changed code. - New tests: `PacketPayloadLimitsTest`, `NostrEmbeddedBitChatTest`, blocked-sender case in `NostrDirectMessageHandlerTest`; existing `BinaryProtocolTest` fixtures updated for the new bounds. - Not yet done: Mesh Lab validation on physical devices (iOS↔Android geohash DMs, large public messages and file transfers), and before/after screenshots of the panic confirmation dialog. 79:T48b, ## Codex Review Summary This comment shows the latest Codex review activity on this pull request. | Review | Status | Commit | Review trigger | | --- | --- | --- | --- | | 📝 **Code Review** | ✅ **Completed** 2026-10-24T23:07:20.089843Z | `df0b138` | Manual request |

ℹ️ About Codex in GitHub

[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you - Open a pull request for review - Mark a draft as ready - Comment "@codex review" or "@codex security review". Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

7a:T739,Addressed the Codex review in df0b1389: **Verify all wipe stages before announcing success** — fixed. Each data-at-rest wipe stage now reports whether its wipe was committed instead of swallowing failures: identity prefs (`clearIdentityData`), the Noise identity and Ed25519 signing key (`clearPersistentIdentity` / `clearAllEncryptionData`, now `Boolean` through `MeshService`), Nostr keys (`clearAllAssociations`, now a synchronous commit), favorites secure values, media (`clearAllMedia` checks every `deleteRecursively`), bookmarks and the persisted channel. "all data wiped — new identity created" is shown only when every stage succeeded; otherwise the incomplete message is shown. Added `FileUtilsClearAllMediaTest`. **Document and pin the protocol acceptance contract** — fixed. Added `docs/PACKET_PAYLOAD_LIMITS.md` (rules, per-type table, what is not ported yet) and linked it from `docs/client-rewrite-contracts.md`, which now also documents the random sender ID in geohash envelopes. Added `PacketPayloadLimitsWireContractTest`: literal frames with real raw-DEFLATE bodies decoded through the production decompressor — announce at 4,096 B (accepted) and 4,097 B (rejected), public message at 128 KiB (accepted, ~917:1) and one byte past (rejected), the same body as `FILE_TRANSFER` (accepted), and a 1032:1 overrun that never reaches the decompressor. **Physical Mesh Lab validation** — agreed it is required, not done yet. No devices were attached in this environment, so the PR still needs a Mesh Lab run (BLE receive/relay/transfer scenarios, plus an iOS↔Android geohash DM and ack exchange) before merge. `./gradlew testDebugUnitTest lintDebug`: app 667 tests, Wear 231 tests, 0 failures; no new lint errors (one new `UseKtx` warning where the KTX `edit {}` form can't return the commit result the wipe check needs). 62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"permissionlesstech","repo":"bitchat-android","pullNumber":996}],"data":{"repositoryId":"1518","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/95dcc8c9890ad1354665bdd09764d59d?key=AeFNlU31IU6e9ClC2xdb6F5S7vx7ufxYJhbP%2FnuC1UfnB5ysBJxJE%2FdIhbDHKqLbyEGlbUxJNEV9tAgmpYhD47g993boXGDL%2Bv494SJwYHnYoLD7ABV88f00ngvKjQ3LZVvW434SQmVSgwYSHXOnU9UsvPxhZOqcHTVv4coLAj37EJOSJVGJ6H9QPw%3D%3D","externalProvider":"github","login":"callebtc","type":"User","url":"https://github.com/callebtc"},"authorId":"93376500","baseRefName":"main","closedAt":null,"comments":5,"createdAt":"2026-10-24T22:54:20Z","headRefName":"claude/ios-features-android-port-ebe483","id":"4944175","isDraft":false,"labels":[],"number":996,"repository":{"name":"bitchat-android","owner":"permissionlesstech","provider":"forgejo"},"state":"open","title":"Port iOS geohash DM, payload cap, and panic confirm fixes","updatedAt":"2026-10-24T23:44:18Z","url":"https://trylle.com/permissionlesstech/bitchat-android/pulls/996","body":"$78","additions":0,"deletions":0,"changedFiles":0,"commits":0,"reviewComments":1,"headSha":"57bb99c170bb24ad2ebdd7bf4f1730ee62ff077b","baseSha":"20501fdfe0d56c7705c377d4a263b01d8f38eeeb","headRepoOwner":"permissionlesstech","headRepoName":"bitchat-android","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":true,"mergeableState":"clean","conflictingFiles":null,"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:996"},"comments":[{"id":26933263,"graphqlId":"26933263","body":"$79","createdAt":"2026-10-24T22:54:29Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/fdedb714e9add836fd78428365411061?key=AbTl84PUpcB4AQFwbMXuaKdUswwUmlivTOVSlxm3nEp0jqDQNNmsjqx0pi8Gv5DD6U88zm8KvjR%2B2dq3EuWbeQbbulrG%2BlcEiJ5GsJS7eQphSJmBFHIx4QT60r62zC1isNJWQJxzZY0LYUmSwyBvW%2BiCNKisU%2BSqP%2Bj2mf0aULYPwb3WpCDJRPYTyYg%3D","externalProvider":"github","login":"chatgpt-codex-connector[bot]","type":"Bot","url":"https://github.com/apps/chatgpt-codex-connector"}},{"id":26933264,"graphqlId":"26933264","body":"$7a","createdAt":"2026-10-24T23:06:02Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/95dcc8c9890ad1354665bdd09764d59d?key=AeFNlU31IU6e9ClC2xdb6F5S7vx7ufxYJhbP%2FnuC1UfnB5ysBJxJE%2FdIhbDHKqLbyEGlbUxJNEV9tAgmpYhD47g993boXGDL%2Bv494SJwYHnYoLD7ABV88f00ngvKjQ3LZVvW434SQmVSgwYSHXOnU9UsvPxhZOqcHTVv4coLAj37EJOSJVGJ6H9QPw%3D%3D","externalProvider":"github","login":"callebtc","type":"User","url":"https://github.com/callebtc"}},{"id":26933265,"graphqlId":"26933265","body":"@codex review","createdAt":"2026-10-24T23:06:04Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/95dcc8c9890ad1354665bdd09764d59d?key=AeFNlU31IU6e9ClC2xdb6F5S7vx7ufxYJhbP%2FnuC1UfnB5ysBJxJE%2FdIhbDHKqLbyEGlbUxJNEV9tAgmpYhD47g993boXGDL%2Bv494SJwYHnYoLD7ABV88f00ngvKjQ3LZVvW434SQmVSgwYSHXOnU9UsvPxhZOqcHTVv4coLAj37EJOSJVGJ6H9QPw%3D%3D","externalProvider":"github","login":"callebtc","type":"User","url":"https://github.com/callebtc"}},{"id":26933266,"graphqlId":"26933266","body":"\n\nCodex Review: Didn't find any major issues. Can't wait for the next one!\n\n**Reviewed commit:** `df0b1389f1`\n\n

ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

","createdAt":"2026-10-24T23:07:18Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/fdedb714e9add836fd78428365411061?key=AbTl84PUpcB4AQFwbMXuaKdUswwUmlivTOVSlxm3nEp0jqDQNNmsjqx0pi8Gv5DD6U88zm8KvjR%2B2dq3EuWbeQbbulrG%2BlcEiJ5GsJS7eQphSJmBFHIx4QT60r62zC1isNJWQJxzZY0LYUmSwyBvW%2BiCNKisU%2BSqP%2Bj2mf0aULYPwb3WpCDJRPYTyYg%3D","externalProvider":"github","login":"chatgpt-codex-connector[bot]","type":"Bot","url":"https://github.com/apps/chatgpt-codex-connector"}}],"commits":[],"events":[{"id":26933315,"event":"reviewed","createdAt":"2026-10-24T22:55:56Z","actor":{"avatarUrl":"https://cdn.trylle.com/media/images/fdedb714e9add836fd78428365411061?key=AbTl84PUpcB4AQFwbMXuaKdUswwUmlivTOVSlxm3nEp0jqDQNNmsjqx0pi8Gv5DD6U88zm8KvjR%2B2dq3EuWbeQbbulrG%2BlcEiJ5GsJS7eQphSJmBFHIx4QT60r62zC1isNJWQJxzZY0LYUmSwyBvW%2BiCNKisU%2BSqP%2Bj2mf0aULYPwb3WpCDJRPYTyYg%3D","externalProvider":"github","login":"chatgpt-codex-connector[bot]","type":"Bot","url":"https://github.com/apps/chatgpt-codex-connector"},"reviewId":3623729,"reviewState":"COMMENT","body":"\n\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `30f911f947`\n \n\n

ℹ️ About Codex in GitHub

"}],"reviews":[{"id":3623729,"state":"COMMENT","author":{"avatarUrl":"https://cdn.trylle.com/media/images/fdedb714e9add836fd78428365411061?key=AbTl84PUpcB4AQFwbMXuaKdUswwUmlivTOVSlxm3nEp0jqDQNNmsjqx0pi8Gv5DD6U88zm8KvjR%2B2dq3EuWbeQbbulrG%2BlcEiJ5GsJS7eQphSJmBFHIx4QT60r62zC1isNJWQJxzZY0LYUmSwyBvW%2BiCNKisU%2BSqP%2Bj2mf0aULYPwb3WpCDJRPYTyYg%3D","externalProvider":"github","login":"chatgpt-codex-connector[bot]","type":"Bot","url":"https://github.com/apps/chatgpt-codex-connector"},"body":"\n\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `30f911f947`\n \n\n

ℹ️ About Codex in GitHub

","submittedAt":"2026-10-24T22:55:56Z","official":false}],"stackEvents":[],"commentPagination":{"totalCount":5,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false},"fetchedAt":1793417664408}],"children":"$L7b"}] 64:null 6b:[["$","title","0",{"children":"Commits · Port iOS geohash DM, payload cap, and panic confirm fixes · permissionlesstech/bitchat-android | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on Port iOS geohash DM, payload cap, and panic confirm fixes (#996) in permissionlesstech/bitchat-android."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · Port iOS geohash DM, payload cap, and panic confirm fixes · permissionlesstech/bitchat-android, permissionlesstech/bitchat-android, permissionlesstech/bitchat-android repository, bitchat-android, Kotlin repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/permissionlesstech/bitchat-android/pulls/996/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/permissionlesstech/bitchat-android/pulls/996/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · Port iOS geohash DM, payload cap, and panic confirm fixes · permissionlesstech/bitchat-android | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on Port iOS geohash DM, payload cap, and panic confirm fixes (#996) in permissionlesstech/bitchat-android."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/permissionlesstech/bitchat-android/pulls/996/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=permissionlesstech&repo=bitchat-android"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=permissionlesstech&repo=bitchat-android"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"permissionlesstech/bitchat-android repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · Port iOS geohash DM, payload cap, and panic confirm fixes · permissionlesstech/bitchat-android | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on Port iOS geohash DM, payload cap, and panic confirm fixes (#996) in permissionlesstech/bitchat-android."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=permissionlesstech&repo=bitchat-android"}],["$","meta","32",{"name":"twitter:image:alt","content":"permissionlesstech/bitchat-android repository preview on Trylle"}],"$L7c","$L7d","$L7e","$L7f"]