fix(notifications): harden shortcut labels and on-demand pruning per review

- Never expose the raw contactKey as a user-facing label: DM shortcuts fall
  back to the localized unknown-username string, and the post-reply refresh
  uses localized fallbacks too. contactKey stays confined to internal ids and
  deep-link metadata (privacy-first convention).
- Drop the dead "Channel N" fallback: Channel.name resolves an empty
  settings.name to the modem-preset display name (or "Custom"), so the
  effective name is never empty.
- Protect on-demand shortcuts from the observer's pruning until a contacts
  snapshot includes their conversation, so a brand-new conversation's first
  notification cannot have its shortcut link severed by an in-flight publish.

Adds regression tests for the pruning protection and reseeds the stale-removal
test via a raw push (the in-memory protection intentionally doesn't survive a
process restart, so the observer still owns cross-session cleanup).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: jamesarich

core/service/src/androidHostTest/kotlin/org/meshtastic/core/service/ConversationShortcutPublisherTest.kt

@@ -125,8 +125,9 @@ class ConversationShortcutPublisherTest {
 
     @Test
     fun `stale shortcuts are removed when no longer part of the conversation set`() = runTest {
-        // Simulate a leftover shortcut from a previous device/channel config.
-        publisher.ensureConversationShortcut("9^all", "Old Channel")
+        // Simulate a leftover shortcut from a previous session (raw push: the in-memory on-demand protection does not
+        // survive a process restart, so the observer owns its cleanup).
+        pushRawShortcut("9^all", "Old Channel")
         assertTrue(shortcutManager.dynamicShortcuts.any { it.id == "9^all" })
 
         every { packetRepository.getContacts() } returns flowOf(emptyMap())
@@ -137,4 +138,29 @@ class ConversationShortcutPublisherTest {
         assertNull(shortcutManager.dynamicShortcuts.find { it.id == "9^all" }, "stale shortcut should be pruned")
         assertTrue(shortcutManager.dynamicShortcuts.any { it.id == "0^all" }, "current channels are published")
     }
+
+    @Test
+    fun `on-demand shortcuts survive pruning until a snapshot includes their conversation`() = runTest {
+        // A brand-new conversation's first notification publishes its shortcut before the contacts flow emits it.
+        publisher.ensureConversationShortcut("0!000000ff", "New Peer")
+
+        every { packetRepository.getContacts() } returns flowOf(emptyMap())
+
+        publisher.startObserving(this)
+        advanceUntilIdle()
+
+        assertTrue(
+            shortcutManager.dynamicShortcuts.any { it.id == "0!000000ff" },
+            "pending on-demand shortcut must not be pruned before the snapshot catches up",
+        )
+    }
+
+    private fun pushRawShortcut(id: String, label: String) {
+        val shortcut =
+            androidx.core.content.pm.ShortcutInfoCompat.Builder(context, id)
+                .setShortLabel(label)
+                .setIntent(android.content.Intent(android.content.Intent.ACTION_VIEW))
+                .build()
+        androidx.core.content.pm.ShortcutManagerCompat.pushDynamicShortcut(context, shortcut)
+    }
 }

core/service/src/androidMain/kotlin/org/meshtastic/core/service/ConversationShortcutPublisher.kt

@@ -43,7 +43,11 @@ import org.meshtastic.core.navigation.DEEP_LINK_BASE_URI
 import org.meshtastic.core.repository.NodeRepository
 import org.meshtastic.core.repository.PacketRepository
 import org.meshtastic.core.repository.RadioConfigRepository
+import org.meshtastic.core.resources.Res
+import org.meshtastic.core.resources.getString
+import org.meshtastic.core.resources.unknown_username
 import org.meshtastic.proto.ChannelSet
+import java.util.concurrent.ConcurrentHashMap
 
 /**
  * Single owner of the dynamic conversation shortcuts that link Meshtastic conversations to their notifications.
@@ -69,6 +73,13 @@ class ConversationShortcutPublisher(
 
     private var observeJob: Job? = null
 
+    /**
+     * On-demand shortcut ids published ahead of the observed contacts snapshot (a brand-new conversation's first
+     * notification). Protected from pruning until a snapshot includes them, so [publishShortcuts] can't sever a live
+     * notification's shortcut link during the window before the flow catches up.
+     */
+    private val pendingOnDemandIds = ConcurrentHashMap.newKeySet<String>()
+
     fun startObserving(scope: CoroutineScope) {
         observeJob?.cancel()
         observeJob =
@@ -134,7 +145,12 @@ class ConversationShortcutPublisher(
 
         try {
             val currentKeys = shortcuts.map { it.id }.toSet()
-            val stale = ShortcutManagerCompat.getDynamicShortcuts(context).map { it.id }.filter { it !in currentKeys }
+            // The snapshot now covers these conversations; normal pruning applies to them from here on.
+            pendingOnDemandIds.removeAll(currentKeys)
+            val stale =
+                ShortcutManagerCompat.getDynamicShortcuts(context)
+                    .map { it.id }
+                    .filter { it !in currentKeys && it !in pendingOnDemandIds }
             if (stale.isNotEmpty()) {
                 ShortcutManagerCompat.removeDynamicShortcuts(context, stale)
             }
@@ -151,12 +167,14 @@ class ConversationShortcutPublisher(
 
     private fun buildDmShortcut(dm: Conversation.Dm, rank: Int): ShortcutInfoCompat? {
         val node = nodeRepository.nodeDBbyNum.value.values.find { it.user.id == dm.userId }
-        // shortLabel is the compact 4-char short name; longLabel the full node name. Fall back sensibly when a name is
-        // missing so the shortcut is never blank.
+        // shortLabel is the compact 4-char short name; longLabel the full node name. Fall back to a localized generic
+        // name when node metadata is missing: the raw contactKey is a user-traceable identifier and must stay confined
+        // to internal ids and deep-link metadata (privacy-first convention).
         val shortName = node?.user?.short_name?.takeIf { it.isNotBlank() }
         val longName = node?.user?.long_name?.takeIf { it.isNotBlank() }
-        val shortLabel = shortName ?: longName ?: dm.contactKey
-        val longLabel = longName ?: shortName ?: dm.contactKey
+        val fallbackName by lazy { getString(Res.string.unknown_username) }
+        val shortLabel = shortName ?: longName ?: fallbackName
+        val longLabel = longName ?: shortName ?: fallbackName
 
         // A node-colored pill avatar showing the short name identifies the person and matches the in-app node chip.
         // Set it on the shortcut itself (not just the Person) so launchers/Android Auto render it instead of a generic
@@ -189,8 +207,9 @@ class ConversationShortcutPublisher(
     }
 
     private fun buildChannelShortcut(channel: Conversation.Channel, rank: Int): ShortcutInfoCompat {
-        // channel.name is already the effective name (preset-derived for an empty primary), so no placeholder here.
-        val channelName = channel.name.ifEmpty { "Channel ${channel.index}" }
+        // channel.name is the effective name and never empty: Channel.name resolves an empty settings.name to the
+        // modem-preset display name (or "Custom" for non-preset configs), so no fallback placeholder is needed.
+        val channelName = channel.name
         // A black rounded-square badge with the channel number visually separates channels from the node-colored DM
         // pills.
         val icon = channelIcon(channel.index)
@@ -228,6 +247,8 @@ class ConversationShortcutPublisher(
      * emission).
      */
     fun ensureConversationShortcut(contactKey: String, displayName: String) {
+        // Protect this conversation from the observer's pruning until a contacts snapshot includes it.
+        pendingOnDemandIds += contactKey
         val alreadyPublished = ShortcutManagerCompat.getDynamicShortcuts(context).any { it.id == contactKey }
         if (alreadyPublished) return
         // Match the styling the observer will republish so there is no generic-head flash: rounded channel badge with

core/service/src/androidMain/kotlin/org/meshtastic/core/service/MeshNotificationManagerImpl.kt

@@ -53,6 +53,7 @@ import org.meshtastic.core.repository.SERVICE_NOTIFY_ID
 import org.meshtastic.core.resources.R.drawable
 import org.meshtastic.core.resources.R.raw
 import org.meshtastic.core.resources.Res
+import org.meshtastic.core.resources.channel
 import org.meshtastic.core.resources.client_notification
 import org.meshtastic.core.resources.connected
 import org.meshtastic.core.resources.connecting
@@ -87,6 +88,7 @@ import org.meshtastic.core.resources.new_node_seen
 import org.meshtastic.core.resources.no_local_stats
 import org.meshtastic.core.resources.powered
 import org.meshtastic.core.resources.reply
+import org.meshtastic.core.resources.unknown_username
 import org.meshtastic.core.resources.you
 import org.meshtastic.core.service.MarkAsReadReceiver.Companion.MARK_AS_READ_ACTION
 import org.meshtastic.core.service.ReactionReceiver.Companion.REACT_ACTION
@@ -602,12 +604,14 @@ class MeshNotificationManagerImpl(
             val lora = channelSet.lora_config ?: Channel.default.loraConfig
             val index = contactKey.substringBefore(NodeAddress.ID_BROADCAST).toIntOrNull()
             channelName = index?.let { channelSet.settings.getOrNull(it) }?.let { Channel(it, lora).name }
-            conversationName = channelName ?: contactKey
+            // Never fall back to the raw contactKey for user-facing labels (privacy-first convention).
+            conversationName = channelName ?: getString(Res.string.channel)
         } else {
             // DM contactKey is "<channelIndex><userId>" where userId starts at the '!'.
             val userId = "!" + contactKey.substringAfter("!", missingDelimiterValue = "")
             val peer = nodeRepository.value.nodeDBbyNum.value.values.find { it.user.id == userId }
-            conversationName = peer?.user?.long_name?.takeIf { it.isNotBlank() } ?: contactKey
+            conversationName =
+                peer?.user?.long_name?.takeIf { it.isNotBlank() } ?: getString(Res.string.unknown_username)
         }
         showConversationNotification(contactKey, isBroadcast, channelName, conversationName, isSilent = true)
     }