ios: iCloud backup docs: earlier recordings and SMP file transfers

apps/ios/spec/database.md

@@ -84,7 +84,7 @@ The app group container is included in backup when the "Enable iCloud backup" to
 
 Importing a database (including migration to this device) excludes the app data before the old database is removed, until the new one is opened. Deleting a database (including self-destruct) and restoring the database backup in [`DatabaseErrorView`](../Shared/Views/Database/DatabaseErrorView.swift) leave the attribute as it is: nothing of the deleted database remains on the device, and the new one is excluded when the app opens it (random passphrase) or at launch; a database created by the share extension in between stays in the container until then; the restored copy is the database as it was before the failed passphrase change, and the rule is applied again when it is opened. Voice messages are recorded into `app_files` unencrypted and encrypted only when sent, so [`AudioRecorder.start`](../Shared/Model/AudioRecPlay.swift) excludes the recording from backup once `record(forDuration:)` has created it; when "Encrypt local files" is on, sending encrypts it into a new file, which follows the container, and deletes the recording; when it is off, the recording is the sent file and stays excluded.
 
-Accepted gaps: `.bak` copies made during a passphrase change or migration, and `temp_files` re-created by the NSE or SE, are excluded only at the next update; files in `app_files` are backed up as stored, unencrypted when they were saved while "Encrypt local files" was off (turning it on does not encrypt existing files), except voice messages recorded on this device; with it on, the app writes no other unencrypted files there (attachments are encrypted when saved on send, videos wait in `temp_files`, the core encrypts received and forwarded files); custom wallpaper images (`assets/wallpapers`) are backed up unencrypted.
+Accepted gaps: `.bak` copies made during a passphrase change or migration, and `temp_files` re-created by the NSE or SE, are excluded only at the next update; files in `app_files` are backed up as stored, unencrypted when they were saved while "Encrypt local files" was off (turning it on does not encrypt existing files), except voice messages recorded on this device since this change; with it on, the app writes no other unencrypted files there, except files received over SMP (not XFTP), which stay in plaintext if the transfer stops or encryption fails (attachments are encrypted when saved on send, videos wait in `temp_files`, the core encrypts received and forwarded files); custom wallpaper images (`assets/wallpapers`) are backed up unencrypted.
 
 ---
 

plans/ios-icloud-backup.md

@@ -26,12 +26,12 @@ The app group container is included in backup when the toggle is on and `iCloudB
 
 The rule is applied when the database is opened (after the file paths are set, as the core re-creates `temp_files`), after a passphrase change, when the toggle changes, and at launch, before the database is opened. Launch never includes the app data, because encryption is only known after opening (a passphrase stored in the keychain is saved before it is verified, e.g. after restoring a backup): it excludes it when the toggle is off, the database is in Documents or uses the random passphrase, or the passphrase is stored in the keychain without a key (the database is unencrypted, or its passphrase is not available yet — e.g. after importing an archive, which removes the key, or after a restore to another device); otherwise it keeps the decision applied at the last open. This is skipped while protected data is unavailable (the device is locked). Importing a database excludes the app data before the old database is removed, until the new one is opened. Deleting a database needs no exclusion: nothing of it remains, and the new database is excluded when it is opened (random passphrase) or at launch (no key is stored). The toggle is disabled while an import or deletion is in progress (`progressIndicator`), and after it until the chat is started again, as it would be based on the old database. "Delete temp data" (Developer → Storage) re-applies the exclusion to the `temp_files` directory it re-creates.
 
-Voice messages are recorded into `app_files` unencrypted and encrypted only when sent, so `AudioRecorder.start` excludes the recording from backup once `record(forDuration:)` has created it. A voice draft is therefore never backed up. When "Encrypt local files" is on, sending encrypts the recording into a new file, which follows the container, and deletes the recording; when it is off, the recording itself is the sent file and stays excluded.
+Voice messages are recorded into `app_files` unencrypted and encrypted only when sent, so `AudioRecorder.start` excludes the recording from backup once `record(forDuration:)` has created it. A voice draft recorded since this change is therefore not backed up; recordings made by earlier versions are not excluded. When "Encrypt local files" is on, sending encrypts the recording into a new file, which follows the container, and deletes the recording; when it is off, the recording itself is the sent file and stays excluded.
 
 ## Accepted gaps
 
 - `.bak` copies made during a passphrase change or migration, and `temp_files` re-created by the NSE or SE, are excluded at the next update.
-- Files in `app_files` are backed up as stored: unencrypted when they were saved while "Encrypt local files" was off (turning it on does not encrypt existing files), except voice messages recorded on this device, which stay excluded. With it on, the app writes no other unencrypted files there: image and file attachments are encrypted when saved on send, videos wait in `temp_files`, the share extension saves encrypted files, and the core encrypts received and forwarded files. Custom wallpaper images (`assets/wallpapers`) are backed up unencrypted. The app group's settings file is backed up too; it includes the SOCKS proxy setting, which may contain credentials.
+- Files in `app_files` are backed up as stored: unencrypted when they were saved while "Encrypt local files" was off (turning it on does not encrypt existing files), except voice messages recorded on this device since this change, which stay excluded. With it on, the app writes no other unencrypted files there, except files received over SMP (not XFTP), which the core writes in plaintext until the last chunk and keeps in plaintext if the transfer stops or encryption fails: image and file attachments are encrypted when saved on send, videos wait in `temp_files`, the share extension saves encrypted files, and the core encrypts received and forwarded files. Custom wallpaper images (`assets/wallpapers`) are backed up unencrypted. The app group's settings file is backed up too; it includes the SOCKS proxy setting, which may contain credentials.
 - A database created by the share extension after a delete with the chat stopped (random passphrase) stays in an included container until the chat is started or the app relaunches.
 - `/db decrypt` in the developer console (it needs the chat stopped) removes the database encryption without updating `chatDbEncrypted` or the keychain, so it can leave the container included while the database is unencrypted, and the toggle can still include it in that session. When the passphrase is stored in the keychain, the launch rule does not detect it and opening with the stored passphrase fails before the rule is applied, so the container is excluded only when the app next opens the database successfully; when it is not stored, the next open (with an empty key) succeeds and excludes it. `/_db import` in the developer console has the same effect for an unencrypted archive: the key stays in the keychain, so the container stays included until the database is next opened successfully.