Whisperfish

The dme-sender release added a retry receipt (DecryptionErrorMessage / DME) so a group message failing to decrypt with NoSenderKeyState self-heals: the receiver asks the sender to re-share its sender key. That DME is delivered over the 1:1 encrypted channel, whose session establishment runs process_prekey_bundle and gates on is_trusted_identity. When the group sender has a stored, mismatched identity locally (e.g. they re-registered, or a prior 1:1 exchange left a stale key), the DME send failed with UntrustedIdentity and was logged-and-dropped, leaving group reception from that sender wedged until a 1:1 exchange surfaced the stale identity on the receive-side reset path. The identity-trust gap itself is long-standing; the regression is that the new DME path relied on that channel being reachable without recovering a stale identity itself. Fix on MR !822: run the same identity recovery as the receive side (recover_untrusted_identity) on the DME send's UntrustedIdentity, then retry the DME once, and don't let the recovered-identity failure poison the per-(recipient,device,distribution_id) rate-limit slot.