fix(chat): address adversarial review of the send-path change

Four confirmed findings from the review of ef247c9:

1. Persistence regression — the deferred-persist echo (in-memory Sending, written
   only when the async callback resolved) meant a message broadcast on-chain but
   whose callback hadn't fired yet was LOST from history if the app quit/crashed
   in that window. Persist the echo immediately as Sending and UPSERT the final
   status on resolve (new ChatDatabase::upsert with ON CONFLICT DO UPDATE, since
   append is INSERT-OR-IGNORE). A stray persisted Sending still loads as Sent.

2. Fee ceiling — dragonxd REJECTS a 0-value tx whose fee exceeds the default
   miners fee (0.0001), and max(getDefaultFee(), 0.0001) can only raise it, so a
   default_fee > 0.0001 broke every chat send. Pin chat to exactly kChatMinFeeDrgx,
   dropping getDefaultFee() from this path (chat always moves 0 value).

3. Lifetime — the resolve callback had no generation guard, so a wallet lock (which
   doesn't disconnect) between submit and callback could resolve against a cleared
   store. Capture chat_session_generation_ and bail on mismatch (both the full-node
   callback and the lite optimistic resolve), matching the identity-fetch pattern.

4. Retry misdirect — Retry on a failed CONTACT REQUEST called sendChatMessage,
   which (no peer key yet) just showed "waiting for reply". Route it to
   sendContactRequestForCid() (refactored out of startChatConversation) so it
   re-sends the request into the SAME conversation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/chat/chat_database.cpp

@@ -129,6 +129,35 @@ bool ChatDatabase::append(const ChatMessage& message)
     return sqlite3_changes(db_) > 0;
 }
 
+bool ChatDatabase::upsert(const ChatMessage& message)
+{
+    if (!key_ready_ || !ensureOpen()) return false;
+
+    std::vector<unsigned char> nonce;
+    std::vector<unsigned char> cipher;
+    std::string plain = serialize(message);
+    const bool encrypted = encrypt(plain, nonce, cipher);
+    if (!plain.empty()) sodium_memzero(&plain[0], plain.size());
+    if (!encrypted) return false;
+
+    const std::string dedup = dedupHash(message.txid, message.payload_position);
+
+    sqlite3_stmt* stmt = nullptr;
+    if (sqlite3_prepare_v2(db_,
+            "INSERT INTO chat_messages (wallet_tag, dedup_hash, nonce, payload) VALUES (?, ?, ?, ?) "
+            "ON CONFLICT(wallet_tag, dedup_hash) DO UPDATE SET nonce=excluded.nonce, payload=excluded.payload",
+            -1, &stmt, nullptr) != SQLITE_OK) {
+        return false;
+    }
+    sqlite3_bind_text(stmt, 1, wallet_tag_.c_str(), -1, SQLITE_TRANSIENT);
+    sqlite3_bind_text(stmt, 2, dedup.c_str(), -1, SQLITE_TRANSIENT);
+    sqlite3_bind_blob(stmt, 3, nonce.data(), static_cast<int>(nonce.size()), SQLITE_TRANSIENT);
+    sqlite3_bind_blob(stmt, 4, cipher.data(), static_cast<int>(cipher.size()), SQLITE_TRANSIENT);
+    const bool done = sqlite3_step(stmt) == SQLITE_DONE;
+    sqlite3_finalize(stmt);
+    return done;
+}
+
 std::vector<ChatMessage> ChatDatabase::load()
 {
     std::vector<ChatMessage> out;

src/chat/chat_database.h

@@ -43,6 +43,11 @@ public:
     // Returns true if newly inserted; false on duplicate or while locked.
     bool append(const ChatMessage& message);
 
+    // Persist-or-overwrite one message by its (txid+position) dedup key. Unlike append(), this
+    // updates an existing row's payload — used for outgoing echoes whose delivery status changes
+    // (Sending → Sent/Failed). Returns true on success; false while locked / on error.
+    bool upsert(const ChatMessage& message);
+
     // Decrypt and return every stored message for the unlocked wallet, in insertion order. Empty
     // while locked or if none. Rows that fail to decrypt/parse are skipped.
     std::vector<ChatMessage> load();

src/chat/chat_service.cpp

@@ -110,14 +110,17 @@ bool ChatService::recordOutgoing(const ChatMessage& message) {
 }
 
 bool ChatService::recordOutgoingPending(const ChatMessage& message) {
-    // In-memory only — deliberately NOT persisted yet, so "Sending" never survives to a restart; the
-    // row is written by resolveOutgoing() once the broadcast resolves to Sent/Failed.
-    return store_.append(message);
+    // Persist immediately (as Sending) so a send survives an app quit before the broadcast resolves;
+    // resolveOutgoing() then UPSERTS the row to the final status. A stray persisted Sending (crash mid-
+    // broadcast) loads as Sent (see ChatDatabase::deserialize).
+    const bool appended = store_.append(message);
+    if (appended && db_) db_->upsert(message);
+    return appended;
 }
 
 void ChatService::resolveOutgoing(const std::string& txid, ChatDelivery delivery) {
     const ChatMessage* updated = store_.updateDelivery(txid, delivery);
-    if (updated && db_) db_->append(*updated);  // first persist, carrying the final status
+    if (updated && db_) db_->upsert(*updated);  // overwrite the Sending row with the final status
 }
 
 } // namespace dragonx::chat

src/chat/chat_service.h

@@ -76,9 +76,9 @@ public:
     // only local record of what we sent.)
     bool recordOutgoing(const ChatMessage& message);
 
-    // Two-phase echo for delivery tracking: record in-memory only (shows immediately as Sending),
-    // then resolveOutgoing() flips the status once the broadcast completes AND persists it with the
-    // final status — so a restart never shows a stuck "Sending".
+    // Two-phase echo for delivery tracking: record + persist immediately as Sending (survives an app
+    // quit), then resolveOutgoing() upserts the final status once the broadcast completes. A stray
+    // persisted Sending (crash mid-broadcast) loads back as Sent.
     bool recordOutgoingPending(const ChatMessage& message);
     void resolveOutgoing(const std::string& txid, ChatDelivery delivery);