78:T298d,**Stacked on #1812** (base: `perf/identity-cache-writes`). **Before the base PR merges, retarget this one to `main`**: the repo auto-deletes merged branches, which would close this PR. **Squash-merge with this description as the commit message.** The first commit's message (e0293310) describes the earlier draft, with its direct-message record; the two commits after it remove that record and correct the docs. **Decision on the earlier draft:** keep stranger eviction and the cap, and drop the direct-message record. bitchat keeps conversations in memory only, so nothing about whom you talk to should survive on disk. This version keeps no record of private conversations. The one remaining trace of Noise sessions is trade-off 3. ## Why The identity cache keeps every announced stranger forever. Its size C drives three costs: - every real cache write is O(C) (~6 ms at 2,000 identities on an M5, ~25-40 ms on an older iPhone); - the launch decode on main is O(C) (33 ms on an M5 at 10,000); - prefix scans were O(C) (the base PR indexes those). At protests and festivals C grows by thousands. The base PR removes the per-announce rewrite, so what remains is the first-contact write and the launch decode, and both scale with C. ## What it does Strangers are evicted once they are long unseen, and the stranger count is capped. A stranger is anyone with none of these relationships: - favorited (`FavoritesPersistenceService` snapshot, fail-closed if favorites can't be read); - verified; - blocked, petnamed, or carrying notes or a trust level; - vouched for, or vouching. Favorites, blocks, petnames and notes protect someone while they last. Removing a verification leaves a `casual` trust level, and vouch links never expire. So anyone you ever verified, and anyone a verified peer vouched for, is kept until a panic wipe. That is the protected set as specified; narrowing it would be a separate change. A private conversation is not a relationship. Someone you only messaged is a stranger like anyone else: forgotten once unseen long enough, and their key is learned again from their next announce. Favoriting or verifying someone keeps them. **Retention rules:** - `lastSeen` is a UTC day, refreshed at most weekly, so it lags the last sighting by up to six days. - A stranger whose stamp is older than 30 + 7 days is evicted at the next pass, together with its signing-key pin, Noise binding, media pin, nickname-index entry, and index entry. By UTC date, that is 32 to 38 days after the day it was last seen. - Above 2,000 strangers, the cache trims to 1,500 by latest possible sighting (the stamp plus a week). Strangers stamped within the last week, which includes everyone seen today or yesterday, rank as seen today, and among them the newest arrivals go first. A flood of minted identities therefore pushes out older stamps first. It reaches a stranger stamped this week only after every newer arrival, and only when more than 1,500 strangers carry such a stamp. Because the stamp lags, an older stamp can belong to a stranger seen two days ago. The announcer is never evicted. - A stranger without a stamp is stamped at the next pass and kept 37 days from then. That covers everyone in a cache written before this PR, and anyone whose protection just lapsed. - Stamps never move back, and forgetting by age needs passes on two different days to agree, so a single wrong clock reading forgets nothing. A clock that stays wrong across passes on two days ages strangers by its error. - A pass runs on the first verified announce after each launch, then about daily, and at once whenever strangers pass the cap. None runs without verified announces, or in a session whose stored favorites can't be read. After a relaunch, or more than two days without a pass, the first pass may hold removals back until a pass on a later day. - Everything runs inside the existing upsert barrier, with no timers and no lifecycle hooks. **`IdentityCache.lastInteractions`:** nothing uses it any more. - Builds from mid-2025 filled it with a timestamp for every peer whose key they registered. The load now empties it and leaves the write pending. The next write of the cache clears it from the keychain too: the next upsert, any other change, or the flush at termination. - The key stays in the blob, always empty: v1.7.0 and earlier decode the cache with a synthesized decoder that requires it, and would discard the whole cache after a downgrade without it. - The test-only `updateHandshakeState` still does not write it (on main it does). **Privacy docs:** `PRIVACY_POLICY.md` (Data Retention Summary) and the "Peer Identity Cache" section of `docs/privacy-assessment.md` describe the behavior above. That includes who is kept until a panic wipe, the exact first-seen time stored for everyone, and the residual risk below. Both documents' dates are now October 2026; adjust them if this merges in a later month. ## Trade-offs 1. **TOFU.** Evicting a stranger forgets its signing-key pin, so its next announce is first contact again: whoever announces its Noise key first is pinned. - That is the exposure every never-seen peer already has. It applies to unprotected strangers unseen for about five weeks, and past the cap to the least recently seen ones. It now includes people you messaged but never favorited or verified. - Someone who mints enough identities to pass the cap can push out a chosen stranger whose stamp is over a week old. That can happen two to eight days after it was last seen, depending on when its stamp was refreshed. Once it is out of range, they can replay its Noise key first. - The real peer's announces are then refused on this device until that pin goes. Refused announces refresh nothing, so the pin ages out once the impostor stops announcing. A Noise session with the real peer also rebinds its key. - While a peer is in range, the live registry still holds its pin. 2. **Carried traffic from evicted strangers.** Packets an evicted stranger signed that arrive while it is out of range are checked against this cache. That covers synced public messages, broadcast files, public voice frames, leaves, and prekey bundles. They are dropped and not relayed. 3. **Remaining on-disk trace of sessions, unchanged from main.** A completed Noise session stores the peer's authenticated signing-key binding and its private-media pin. Main keeps them forever; here they go when the stranger is evicted. Sessions start on their own with most directly connected peers. With peers further away they mostly carry private traffic, so until then the binding hints that some was exchanged. The binding is the copied-Noise-key defense, so this PR keeps it. The assessment's residual-risk line says so. ## Costs this adds - **No per-message costs.** Sending or receiving a private message or file touches the identity cache exactly as it does without this PR. The PR changes no messaging view-model or coordinator file; it changes only `ChatViewModelBootstrapper`, which pushes the favorites snapshot. The earlier draft's write on main per new DM partner, and its ~2.9 µs per inbound DM, went with the marker. - **Each full write and load:** the `lastSeen` stamp adds 21 bytes per identity, about 5-9% at equal C (a first-contact write at 2,000 identities goes from 6.25 to 6.78 ms). Bounded by the cap, while main's C grows without limit. - **Retention passes:** the daily pass costs about 0.4 ms; a cap pass about 8-10 ms, including its write (saved release runs on the previous revision of this PR; the pass now does strictly less). - **Once per device, on upgrade:** a cache holding old `lastInteractions` entries is written by the next upsert even if that upsert changes nothing. After an upgrade that is usually the same write that stamps legacy strangers. ## Tests `SecureIdentityStateManagerRetentionTests` (18 tests) covers: - the eviction boundaries: kept at 36-37 days, evicted at 38; - every protected relationship, plus three peers that are evicted: a plain stranger, a Noise-authenticated stranger (its binding, pin, and media pin go too), and a peer with an old `lastInteractions` entry; - cap ordering, the regulars-plus-flood case, and that the cap counts only strangers; - the pass cadence and the O(1) cap trigger; - no pass before the favorites snapshot arrives; - a full period for strangers without a stamp: legacy entries, and a favorite unfavorited after 100 days unseen; - the weekly restamp; - clock steps forward and back, and forgetting one pass after an absence; - the legacy purge: the entries are gone after load, the next unchanged upsert writes once and only once, the stored blob still decodes in v1.7.0's synthesized shape with the key present and empty, and nothing else is dropped; - downgrade decode of the entry shape. `SecureIdentityStateManagerTests` checks that a completed handshake writes nothing, and that removing a verification leaves the `casual` trust level. Bootstrapper, favorites, BLE-announce, and private-media end-to-end tests cover the wiring, including failing closed when stored favorites can't be read (`ChatViewModelBootstrapperTests`, `FavoritesPersistenceServiceTests`). The direct-message tests (marker record, refresh, expiry, and forget; view-model and coordinator marking) were removed with the code. Mutation checks, each built and run against the filtered suites: 13 of 13 detected. - Eviction boundary (3): evicting at 37 days, at 30 without the refresh interval, and a day late. - Cap ordering (5): trimming by the raw stamp, most recent first, oldest arrival first on ties, an evictable announcer, and a cap that counts protected identities. - Legacy purge (5): no purge; a purge kept in memory only; a purge that drops the key older builds need; the handshake writing the field again; and no purge with the field protecting again. SwiftPM on this tree (`swift test --build-system native --parallel`): 2,169 Swift Testing tests in 232 suites and 246 XCTest cases, all passed. SwiftLint 0.65.1 `--strict`: 0 violations in the 14 Swift files this PR changes. Periphery 3.8.0 `--strict` with the CI config and baseline, run before the last review round (which added only comments, docs, and one test method): nothing new; the only findings are the 16 local-toolchain-only ones in `ContentView` and `ViewSmokeTests` that origin/main shows too. iOS simulator (`bitchat (iOS)` scheme, iPhone 17 Pro Max on iOS 27.0, one test runner as CI runs it): 2,418 of 2,418 passed (246 XCTest cases and 2,172 Swift Testing tests in 232 suites), none failed or skipped. 🤖 Generated with [Claude Code](https://claude.com/claude-code) 79:T491, ## Codex Review Summary This comment shows the latest Codex review activity on this pull request. | Review | Status | Commit | Review trigger | | --- | --- | --- | --- | | 📝 **Code Review** | ✅ **Completed** 2026-10-25T21:14:27.095676Z | `df5b671` | Draft marked ready |

ℹ️ About Codex in GitHub

[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you - Open a pull request for review - Mark a draft as ready - Comment "@codex review" or "@codex security review". Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

7a:T75c,Address review: describe identity retention as it behaves The privacy docs and several comments overstated or left out parts of identity-cache retention. This changes no behavior. - Who is kept: favorites, blocks and petnames protect while they last. Removing a verification leaves the casual trust level, and vouch links never expire, so anyone once verified, and anyone vouched for by someone verified, stays until a panic wipe. PRIVACY_POLICY.md and docs/privacy-assessment.md now say so. - For how long: a stranger without a stamp (everyone in an older cache, and anyone whose protection just lapsed) is stamped at the next pass and kept 37 days from then, however long it was unseen. A new test covers the lapsed case. - What is stored: every entry keeps the exact time it was first seen. The residual-risk line now names that, the private-media pin, and the day of the last pass, and scopes the window to the device's last five weeks of use. - When passes run: on the first verified announce after each launch, then about daily, at once past the cap, and never in a session that cannot read the stored favorites. After a relaunch or a gap, removals can wait for a pass on a later day. - The cap: strangers stamped within the week, which includes everyone seen today or yesterday, rank as seen today. A stamp lags the last sighting by up to six days, though, so a flood can push out a stranger seen two days ago. The comments no longer say a flood reaches only strangers unseen for a week. - Pins: a refused announce refreshes nothing, so an impostor's pin ages out once they stop, and a Noise session rebinds the real key. The comments no longer call the refusal permanent. The media-pin and pendingSave comments now match the code. - Both documents' dates move to October 2026. Co-Authored-By: Claude Opus 5.5 7b:T8a8,Drop the direct-message marker from identity retention bitchat keeps conversations in memory only, so nothing about whom you talk to should survive on disk. The marker in IdentityCache.lastInteractions kept the day of the latest direct message with each mesh peer for up to 97 days. A seized, unlocked phone would show whom its owner had messaged. Remove the marker and everything that existed for it: - recordDirectMessageHistory and forgetDirectMessageHistory (manager, protocol, view model, and coordinator contexts); - the calls when sending and receiving private messages and media, and on /clear; - RetentionPolicy.directMessageRetention and the pass's marker expiry; - lastInteractions as a protection signal. Someone you only messaged is now a stranger like anyone else: evicted once unseen for 30 + 7 days, with their key learned again from their next announce. Favoriting or verifying someone still keeps them. Nothing uses lastInteractions any more. Builds from mid-2025 filled it with a timestamp for every peer whose key they registered. The load now empties it and marks the write pending; the next upsert, or the flush at termination, clears it from the keychain. The key stays in the blob, always empty: v1.7.0 and earlier decode the cache with a synthesized decoder that requires it. PRIVACY_POLICY.md and docs/privacy-assessment.md now describe this, and state the window as it works: 32 to 38 days after the last sighting, at the next pass. The assessment also names the trace that remains: a stranger's signing-key binding from a Noise session, kept until the stranger is evicted. Stranger eviction, the cap, the clock rules, legacy grace and the favorites gate are unchanged. The per-message costs go with the marker: a full cache write on main per new DM partner and per weekly refresh, and about 2.9 us per inbound DM to derive the fingerprint. Tests: the marker, view-model and coordinator marking tests are gone. The protected-relationship test now evicts a peer that has an old lastInteractions entry. A new test checks the purge, the single write that stores it, and that the stored cache still decodes in v1.7.0's shape. Co-Authored-By: Claude Opus 5.5 7c:T713,Evict long-unseen strangers from the identity cache The identity cache kept every announced stranger forever, so every real write, the launch decode on main, and identity scans grew with everyone ever seen (33 ms launch decode at 10,000 identities on an M5). Strangers now age out. A stranger has no favorite, verification, block, petname, notes or trust level, no vouch link, and no direct message in the last 90 days. - lastSeen (a UTC day) is stamped on announces and refreshed at most weekly. A stranger unseen for 30 + 7 days is evicted with its pins, Noise binding, media pin and index entries. - Above 2,000 strangers the cache trims to 1,500 by latest possible sighting, so a flood of minted identities can only push out strangers not seen for over a week. The announcer is never evicted. - Stamps never move back, and forgetting needs two passes on different days, so a clock jump cannot wipe the cache. Older caches get a 30-day grace period. - Retention starts only once the favorites snapshot arrives, and stays off for the session if stored favorites cannot be read. IdentityCache.lastInteractions now records the UTC day of the latest direct message with a mesh peer. It is refreshed at most weekly, expires 90 + 7 days after the last message, and /clear removes it. PRIVACY_POLICY.md and docs/privacy-assessment.md document it. Trade-offs: evicting a stranger forgets its TOFU signing-key pin, so its next announce is first contact again; and the DM marker is a new, bounded on-disk record of whom you messaged. Costs: one full cache write on main per new DM partner (and per weekly refresh), about 2.9 us per inbound DM to derive the fingerprint, a ~0.4 ms daily pass, and 21 bytes more per identity in each full write. Co-Authored-By: Claude Opus 5.5 62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"permissionlesstech","repo":"bitchat","pullNumber":1813}],"data":{"repositoryId":"1517","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/ca185b7deba3035a00a23e3bf238e60c?key=AdnXujMHBKWhJp2Dnr4UDYOkQg4qjk7D40If7e25Uk%2BlHBee%2F%2B5v%2ByIcDunfhcapdKM%2FMVjbic3b4Xk0SfpEHfcNwaIT1Ci5tjv0gKk4Dx3UbYw1zCY8C5VrWxHnEa68tqpGLoeF4ir2YdqxXYiTyR%2BmOM3Ri66WN3SKAiSvK3tEbkjWDh%2F8gmnJXT8%3D","externalProvider":"github","login":"jackjackbits","type":"User","url":"https://github.com/jackjackbits"},"authorId":"212554440","baseRefName":"perf/identity-cache-writes","closedAt":null,"comments":1,"createdAt":"2026-10-25T02:24:40Z","headRefName":"perf/identity-cache-retention","id":"4957435","isDraft":false,"labels":[],"number":1813,"repository":{"name":"bitchat","owner":"permissionlesstech","provider":"forgejo"},"state":"open","title":"Evict long-unseen strangers from the identity cache","updatedAt":"2026-10-25T21:14:27Z","url":"https://trylle.com/permissionlesstech/bitchat/pulls/1813","body":"$78","additions":1258,"deletions":63,"changedFiles":17,"commits":3,"reviewComments":0,"headSha":"df5b671463647ea5c4faa1c177ec6d9a1a8624af","baseSha":"d806850443691e15fb079acf017a749f8c96b335","headRepoOwner":"permissionlesstech","headRepoName":"bitchat","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":true,"mergeableState":"clean","conflictingFiles":null,"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:1813","reactions":{"counts":{"+1":1},"viewerReacted":null,"userLoginsByContent":{"+1":["chatgpt-codex-connector[bot](github)"]}}},"comments":[{"id":27021076,"graphqlId":"27021076","body":"$79","createdAt":"2026-10-25T21:11:02Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/fdedb714e9add836fd78428365411061?key=AbTl84PUpcB4AQFwbMXuaKdUswwUmlivTOVSlxm3nEp0jqDQNNmsjqx0pi8Gv5DD6U88zm8KvjR%2B2dq3EuWbeQbbulrG%2BlcEiJ5GsJS7eQphSJmBFHIx4QT60r62zC1isNJWQJxzZY0LYUmSwyBvW%2BiCNKisU%2BSqP%2Bj2mf0aULYPwb3WpCDJRPYTyYg%3D","externalProvider":"github","login":"chatgpt-codex-connector[bot]","type":"Bot","url":"https://github.com/apps/chatgpt-codex-connector"}}],"commits":[{"sha":"df5b671463647ea5c4faa1c177ec6d9a1a8624af","message":"$7a","createdAt":"2026-10-25T13:50:49-07:00","author":{"avatarUrl":"","login":"","name":"jack","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}},{"sha":"027f54dcc9a8adbbba611c1033d096ea51ae0f0a","message":"$7b","createdAt":"2026-10-25T13:31:53-07:00","author":{"avatarUrl":"","login":"","name":"jack","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}},{"sha":"e029331089b6b0de6937b62638d194323b743cae","message":"$7c","createdAt":"2026-10-24T19:11:56-07:00","author":{"avatarUrl":"","login":"","name":"jack","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.not_signed_commit"}}],"events":[],"reviews":[],"stackEvents":[],"commentPagination":{"totalCount":1,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false,"stack":{"source":"inferred","parent":{"number":1812,"title":"Persist the identity cache only when it changes","state":"open","isDraft":false,"baseBranch":"main","headBranch":"perf/identity-cache-writes","url":"https://trylle.com/permissionlesstech/bitchat/pulls/1812"},"children":null,"siblings":[],"depth":1}},"fetchedAt":1793414474561}],"children":"$L7d"}] 64:null 6b:[["$","title","0",{"children":"Commits · Evict long-unseen strangers from the identity cache · permissionlesstech/bitchat | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on Evict long-unseen strangers from the identity cache (#1813) in permissionlesstech/bitchat."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · Evict long-unseen strangers from the identity cache · permissionlesstech/bitchat, permissionlesstech/bitchat, permissionlesstech/bitchat repository, bitchat, Swift repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/permissionlesstech/bitchat/pulls/1813/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/permissionlesstech/bitchat/pulls/1813/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · Evict long-unseen strangers from the identity cache · permissionlesstech/bitchat | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on Evict long-unseen strangers from the identity cache (#1813) in permissionlesstech/bitchat."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/permissionlesstech/bitchat/pulls/1813/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=permissionlesstech&repo=bitchat"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=permissionlesstech&repo=bitchat"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"permissionlesstech/bitchat repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · Evict long-unseen strangers from the identity cache · permissionlesstech/bitchat | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on Evict long-unseen strangers from the identity cache (#1813) in permissionlesstech/bitchat."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=permissionlesstech&repo=bitchat"}],["$","meta","32",{"name":"twitter:image:alt","content":"permissionlesstech/bitchat repository preview on Trylle"}],["$","link","33",{"rel":"icon","href":"/favicon.png","type":"image/png"}],["$","link","34",{"rel":"icon","href":"/favicon-white.png","type":"image/png","media":"(prefers-color-scheme: dark)"}],"$L7e","$L7f"]

Commits on Sun, Oct 25, 2026