Eighth-pass audit: fix silent send/profile errors, draft loss on failed send

Three bugs in the Swift shell + core:

1. ChatView never displayed core.view.error. Errors from send_text
   ("message too long", "contact list is full", "cannot send to a
   blocked contact", "gave up sending N messages", "invalid key")
   were set on model.error and rendered into view.error, but ChatView
   had no error display. The user tapped send, it failed, and they
   saw nothing. Now shows the error above the composer.

2. ChatView cleared the local draft unconditionally after sendText,
   even when send_text refused the message (blocked, too long, cap
   full). The core preserved model.compose on those paths, but the
   Swift draft was already wiped -- the failure was both invisible
   and destructive. Now only clears draft when core.view.error is
   empty (i.e., the core accepted the message).

3. EditProfileView never displayed core.view.error. "display name too
   long", "bio too long", "photo too large" were silently swallowed
   when the user tapped Save. Now shows the error in a section.

Also in core: send_text and SaveProfile now clear model.error at the
top, so a stale error from a previous failed attempt does not persist
after the user fixes the issue and tries again. Previously the error
display would show the old error even after a successful send/save.

Test: send_text_clears_a_stale_error_on_success verifies the clearing.

Author: ilyakooo0

apple/SkrepkaApp/Forms.swift

@@ -158,6 +158,15 @@ struct EditProfileView: View {
                 }
                 Section("Name") { TextField("Display name", text: $name) }
                 Section("Bio") { TextField("About you", text: $bio, axis: .vertical) }
+                // SaveProfile sets model.error on validation failures ("display name
+                // too long", "bio too long", "photo too large") but leaves the page
+                // open. Without displaying it the user taps Save, nothing happens, and
+                // they have no idea why.
+                if !core.view.error.isEmpty {
+                    Section {
+                        Text(core.view.error).foregroundColor(.red)
+                    }
+                }
             }
             .navigationTitle("Edit profile")
             .toolbar {

apple/SkrepkaApp/Views.swift

@@ -319,22 +319,45 @@ struct ChatView: View {
     }
 
     private var composer: some View {
-        HStack(spacing: 8) {
-            TextField("Message", text: $draft, axis: .vertical)
-                .textFieldStyle(.roundedBorder)
-                .lineLimit(1...4)
-                .disabled(core.view.activePeerBlocked)
-            Button {
-                let text = draft.trimmingCharacters(in: .whitespacesAndNewlines)
-                guard !text.isEmpty else { return }
-                core.update(.composeChanged(text))
-                core.update(.sendText)
-                draft = ""
-            } label: {
-                Image(systemName: "arrow.up.circle.fill").font(.title)
+        VStack(spacing: 0) {
+            // Errors from send_text ("message too long", "contact list is full",
+            // "gave up sending …", "invalid key") are set on model.error and rendered
+            // into view.error, but without this the chat page swallowed them — the
+            // user tapped send, it failed, and they saw nothing.
+            if !core.view.error.isEmpty {
+                Text(core.view.error)
+                    .font(.caption)
+                    .foregroundColor(.red)
+                    .frame(maxWidth: .infinity, alignment: .leading)
+                    .padding(.horizontal)
+                    .padding(.top, 4)
+            }
+            HStack(spacing: 8) {
+                TextField("Message", text: $draft, axis: .vertical)
+                    .textFieldStyle(.roundedBorder)
+                    .lineLimit(1...4)
+                    .disabled(core.view.activePeerBlocked)
+                Button {
+                    let text = draft.trimmingCharacters(in: .whitespacesAndNewlines)
+                    guard !text.isEmpty else { return }
+                    core.update(.composeChanged(text))
+                    core.update(.sendText)
+                    // Only clear the local draft when the core actually accepted the
+                    // message. send_text refuses (and sets error) on a blocked peer,
+                    // an oversized body, or a full contact list — and it preserves
+                    // model.compose on those paths so the user's text is not lost.
+                    // Clearing draft unconditionally wiped it from the UI even though
+                    // the core kept it, so the failure was both invisible and
+                    // destructive: the text was gone with no explanation.
+                    if core.view.error.isEmpty {
+                        draft = ""
+                    }
+                } label: {
+                    Image(systemName: "arrow.up.circle.fill").font(.title)
+                }
+                .disabled(draft.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
+                          || core.view.activePeerBlocked)
             }
-            .disabled(draft.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
-                      || core.view.activePeerBlocked)
         }
         .padding(.horizontal).padding(.vertical, 8)
         .background(.bar)

core/src/app.rs

@@ -959,6 +959,8 @@ impl App for Skrepka {
                 bio,
                 photo,
             } => {
+                // Clear a stale error from a previous failed save.
+                model.error = None;
                 // The recipient's `parse_payload` enforces these caps and
                 // silently drops oversized profiles. Without these checks the
                 // sender's local profile would be saved, broadcast to every
@@ -1574,6 +1576,9 @@ impl Skrepka {
         let Some(peer) = model.active_peer.clone() else {
             return render();
         };
+        // Clear a stale error from a previous failed send, so the error display
+        // does not persist after the user fixes the issue and sends again.
+        model.error = None;
         // Blocking cuts the peer off in both directions (PROTOCOL.md §4). The
         // ingest side drops their messages; the send side must refuse too, or
         // a blocked peer still receives our texts, acks, and the liveness
@@ -4435,6 +4440,25 @@ mod tests {
         assert!(m.error.as_ref().is_some_and(|e| e.contains("too long")));
     }
 
+    /// A stale error from a previous failed send must be cleared on the next
+    /// attempt, so the error display does not persist after the user fixes the
+    /// issue and sends again successfully.
+    #[test]
+    fn send_text_clears_a_stale_error_on_success() {
+        let app = Skrepka;
+        let mut m = with_identity();
+        let peer = peer_hex(9);
+        m.active_peer = Some(peer.clone());
+        // Simulate a prior failure that left an error behind.
+        m.error = Some("message too long".into());
+
+        m.compose = "hello".into();
+        let _ = app.update(Event::SendText, &mut m);
+
+        assert!(m.error.is_none(), "a successful send clears the stale error");
+        assert!(!m.outbox.is_empty(), "the message was queued");
+    }
+
     // -----------------------------------------------------------------------
     // SaveProfile field length checks
     // -----------------------------------------------------------------------