// Add SPAKE2+ for introduction token protection
struct IntroductionToken {
    bob_ltik_pub: PublicKey,
    bob_mtsk_pub: PublicKey,
    temp_dht_address: Address,
    expiration: Timestamp,
    pake_salt: [u8; 32],  // NEW: SPAKE2+ salt
    signature: Signature,
}

// Alice initiates with password-based authentication
impl ClientHello {
    fn new_with_pake(
        intro_token: &IntroductionToken,
        shared_secret: &str  // From QR code or out-of-band
    ) -> Self {
        // SPAKE2+ prevents MITM even if token stolen
        let pake = SPAKE2Plus::new(
            b"LMP-introduction",
            shared_secret.as_bytes(),
            &intro_token.pake_salt
        );
        
        let (pake_msg, pake_state) = pake.start();
        
        ClientHello {
            // ... existing fields ...
            pake_message: pake_msg,  // NEW
            pake_commitment: hash(pake_state),  // NEW
        }
    }
}

struct TimestampValidator {
    base_tolerance: Duration,
    adaptive_bonus: Duration,
    recent_latencies: RingBuffer<Duration, 100>,
}

impl TimestampValidator {
    fn new() -> Self {
        Self {
            base_tolerance: Duration::from_secs(60),
            adaptive_bonus: Duration::from_secs(0),
            recent_latencies: RingBuffer::new(),
        }
    }
    
    fn validate(&mut self, msg_timestamp: i64) -> bool {
        let now = current_timestamp();
        let observed_latency = (now - msg_timestamp).abs();
        
        // Update adaptive tolerance based on network conditions
        self.recent_latencies.push(Duration::from_millis(observed_latency as u64));
        let p95_latency = self.percentile(0.95);
        
        // Allow timestamp if within base + adaptive window
        let max_tolerance = self.base_tolerance + self.adaptive_bonus;
        
        if observed_latency <= max_tolerance.as_millis() as i64 {
            true
        } else {
            // Check if network degraded recently
            if p95_latency > Duration::from_secs(30) {
                self.adaptive_bonus = p95_latency; // Increase tolerance
                log::warn!("High network latency detected, adjusting tolerance to {}s", 
                          (self.base_tolerance + self.adaptive_bonus).as_secs());
            }
            false
        }
    }
    
    fn percentile(&self, p: f64) -> Duration {
        let mut sorted = self.recent_latencies.to_vec();
        sorted.sort();
        sorted[(sorted.len() as f64 * p) as usize]
    }
}

// Nonce is 96 bits (12 bytes) for ChaCha20-Poly1305.
// Derive a deterministic 32-bit prefix from (conversation_id, sender_device_id), then append a 64-bit counter.
// This avoids cross-device collisions when multiple devices participate in the same conversation.
fn derive_nonce(conversation_id: &[u8; 32], sender_device_id: &[u8; 16], message_number: u64) -> [u8; 12] {
    let prefix32 = hkdf_sha3_256_extract(
        &[conversation_id.as_slice(), sender_device_id.as_slice()].concat(),
        b"LMP-nonce-prefix",
        4,
    );

    let mut nonce = [0u8; 12];
    nonce[0..4].copy_from_slice(&prefix32);
    nonce[4..12].copy_from_slice(&message_number.to_le_bytes());
    nonce
}

struct MessageHeader {
    conversation_id: [u8; 32],
    sender_device_id: [u8; 16],
    message_number: u64,
    prev_chain_length: u64,
    ratchet_id: [u8; 16],  // NEW: Unique per ratchet iteration
    timestamp: i64,
    eph_x25519_pub: Option<[u8; 32]>,
    eph_kyber_pub: Option<Vec<u8>>,
    mac: [u8; 16],  // Now covers ratchet_id
}

impl RatchetState {
    fn new_iteration(&mut self) -> [u8; 16] {
        // Generate unique ratchet ID
        let mut ratchet_id = [0u8; 16];
        let input = [
            &self.root_key[..],
            &self.iteration_count.to_le_bytes(),
            &current_timestamp().to_le_bytes()
        ].concat();
        
        hkdf_sha3_256_extract(
            &input,
            b"ratchet-iteration-id",
            16
        ).copy_to_slice(&mut ratchet_id);
        
        self.current_ratchet_id = ratchet_id;
        self.iteration_count += 1;
        ratchet_id
    }
    
    fn validate_message(&self, header: &MessageHeader) -> bool {
        // Reject if ratchet_id doesn't match current or recent iterations
        if header.ratchet_id != self.current_ratchet_id &&
           !self.recent_ratchet_ids.contains(&header.ratchet_id) {
            log::warn!("Message from unknown ratchet iteration, possible replay");
            return false;
        }
        
        // Verify MAC includes ratchet_id (prevents cross-ratchet replay)
        self.verify_mac(header)
    }
}

// Forward-processing: Accept new ratchet even if old messages pending
impl MessageProcessor {
    fn handle_out_of_order_ratchet(&mut self, new_ratchet_msg: Message) {
        // Don't wait for old messages; advance ratchet immediately
        log::info!("New ratchet detected with {} skipped messages, advancing", 
                  new_ratchet_msg.header.message_number);
        
        // Mark old messages as permanently lost
        self.mark_messages_lost(
            self.current_ratchet_id,
            self.last_received_msg..new_ratchet_msg.header.message_number
        );
        
        // Process new ratchet
        self.ratchet_state.advance(new_ratchet_msg);
    }
}

struct SkippedKeyManager {
    skipped_keys: HashMap<MessageId, MessageKey>,
    sender_skip_counts: HashMap<DeviceId, SkipStats>,
    global_skip_limit: usize,  // 1000
    per_sender_limit: usize,   // 100 per sender
}

struct SkipStats {
    total_skips: usize,
    last_skip_time: Instant,
    consecutive_skips: usize,
}

impl SkippedKeyManager {
    fn try_skip(&mut self, 
                sender: &DeviceId, 
                skip_count: usize) -> Result<(), SkipError> {
        
        let stats = self.sender_skip_counts
            .entry(*sender)
            .or_insert(SkipStats::default());
        
        // Check per-sender limit
        if stats.total_skips + skip_count > self.per_sender_limit {
            log::warn!("Sender {} exceeded skip limit, possible DoS", sender);
            return Err(SkipError::SenderLimitExceeded);
        }
        
        // Check global limit
        if self.skipped_keys.len() + skip_count > self.global_skip_limit {
            log::warn!("Global skip limit reached, rejecting message");
            return Err(SkipError::GlobalLimitExceeded);
        }
        
        // Exponential backoff for consecutive skips
        let min_delay = Duration::from_millis(100 * (1 << stats.consecutive_skips));
        if stats.last_skip_time.elapsed() < min_delay {
            log::warn!("Sender {} skipping too rapidly, applying backoff", sender);
            return Err(SkipError::RateLimited);
        }
        
        // Update stats
        stats.total_skips += skip_count;
        stats.last_skip_time = Instant::now();
        stats.consecutive_skips += 1;
        
        Ok(())
    }
    
    fn on_successful_decrypt(&mut self, sender: &DeviceId) {
        // Reset consecutive counter on normal message
        if let Some(stats) = self.sender_skip_counts.get_mut(sender) {
            stats.consecutive_skips = 0;
        }
    }
}

struct MeshRouter {
    active_paths: HashMap<ConversationId, Vec<Path>>,
    path_metrics: HashMap<PathId, PathMetrics>,
}

struct Path {
    id: PathId,
    hops: Vec<NodeId>,
    latency: Duration,
    reliability: f64,
}

impl MeshRouter {
    fn send_message(&mut self, msg: &Message, conversation_id: &ConversationId) {
        let paths = self.select_diverse_paths(conversation_id, 3);  // 3 parallel paths
        
        for (i, path) in paths.iter().enumerate() {
            let fragment = if i == 0 {
                msg.clone()  // Primary: full message
            } else {
                msg.create_redundancy_shard(i)  // Secondary: erasure-coded shards
            };
            
            self.route_via_path(fragment, path);
        }
    }
    
    fn select_diverse_paths(&self, 
                            conversation_id: &ConversationId, 
                            count: usize) -> Vec<Path> {
        let mut paths = Vec::new();
        let mut used_nodes = HashSet::new();
        
        for _ in 0..count {
            // Select path with minimal node overlap
            let candidate = self.find_path_avoiding(&used_nodes);
            
            for hop in &candidate.hops {
                used_nodes.insert(*hop);
            }
            
            paths.push(candidate);
        }
        
        paths
    }
    
    fn find_path_avoiding(&self, excluded_nodes: &HashSet<NodeId>) -> Path {
        // Dijkstra's algorithm with node exclusion
        // Prioritize: low latency, high reliability, disjoint from excluded
        // ...
    }
}

// Erasure coding for redundancy
impl Message {
    fn create_redundancy_shard(&self, shard_id: usize) -> Message {
        // Use Reed-Solomon: 2 of 3 shards sufficient to reconstruct
        let encoder = ReedSolomon::new(2, 1).unwrap();
        let shards = encoder.encode(&self.payload);
        
        Message {
            payload: shards[shard_id].clone(),
            shard_metadata: ShardMetadata {
                shard_id,
                total_shards: 3,
                reconstruction_needed: 2,
            },
            ..self.clone()
        }
    }
}

struct CoverTrafficGenerator {
    baseline_rate: f64,  // 1 cell per 5 min
    user_activity_profile: ActivityProfile,
    last_burst: Instant,
}

struct ActivityProfile {
    hourly_distribution: [f64; 24],  // Probability per hour
    burst_probability: f64,
    burst_size_range: (usize, usize),
}

impl CoverTrafficGenerator {
    fn generate_schedule(&mut self) -> Vec<Instant> {
        let mut schedule = Vec::new();
        let now = Instant::now();
        
        // Baseline Poisson process
        let mut next_event = now + self.poisson_sample(self.baseline_rate);
        
        for _ in 0..100 {  // Next 100 events
            schedule.push(next_event);
            next_event += self.poisson_sample(self.baseline_rate);
        }
        
        // Add random bursts (mimic user typing sessions)
        if rand::random::<f64>() < self.user_activity_profile.burst_probability {
            let burst_time = now + Duration::from_secs(rand::gen_range(0..3600));
            let burst_size = rand::gen_range(
                self.user_activity_profile.burst_size_range.0..
                self.user_activity_profile.burst_size_range.1
            );
            
            for i in 0..burst_size {
                schedule.push(burst_time + Duration::from_millis(i * 500));
            }
        }
        
        // Sort and deduplicate
        schedule.sort();
        schedule.dedup();
        schedule
    }
    
    fn adapt_to_user_behavior(&mut self, real_message_times: &[Instant]) {
        // Learn user's messaging pattern
        let mut hourly_counts = [0usize; 24];
        
        for time in real_message_times {
            let hour = time.hour();
            hourly_counts[hour] += 1;
        }
        
        // Normalize to probability distribution
        let total: usize = hourly_counts.iter().sum();
        self.user_activity_profile.hourly_distribution = 
            hourly_counts.map(|c| c as f64 / total as f64);
        
        log::info!("Cover traffic adapted to user's activity pattern");
    }
}

// Use TWO independent PQ implementations, verify both agree
struct HardenedPQCrypto {
    primary_kyber: liboqs::Kyber768,
    secondary_kyber: pqcrypto::Kyber768,  // Different implementation
}

impl HardenedPQCrypto {
    fn encapsulate(&self, public_key: &[u8]) -> Result<(Vec<u8>, Vec<u8>), Error> {
        // Encapsulate with both libraries
        let (ct1, ss1) = self.primary_kyber.encapsulate(public_key)?;
        let (ct2, ss2) = self.secondary_kyber.encapsulate(public_key)?;
        
        // Verify both produce same result (catch implementation bugs)
        if constant_time_eq(&ss1, &ss2) {
            Ok((ct1, ss1))
        } else {
            log::error!("PQ library mismatch detected, possible bug or attack");
            Err(Error::PQLibraryMismatch)
        }
    }
    
    fn decapsulate(&self, 
                   ciphertext: &[u8], 
                   secret_key: &[u8]) -> Result<Vec<u8>, Error> {
        let ss1 = self.primary_kyber.decapsulate(ciphertext, secret_key)?;
        let ss2 = self.secondary_kyber.decapsulate(ciphertext, secret_key)?;
        
        if constant_time_eq(&ss1, &ss2) {
            Ok(ss1)
        } else {
            Err(Error::PQLibraryMismatch)
        }
    }
}

// Side-channel resistant comparison
fn constant_time_eq(a: &[u8], b: &[u8]) -> bool {
    if a.len() != b.len() {
        return false;
    }
    
    let mut diff = 0u8;
    for (x, y) in a.iter().zip(b.iter()) {
        diff |= x ^ y;
    }
    
    diff == 0
}