@onekeyfe/hd-core 1.2.0-alpha.19 → 1.2.0-alpha.20

package/__tests__/protocol-v2.test.ts

@@ -18,13 +18,13 @@ import DeviceReboot from '../src/api/protocol-v2/DeviceReboot';
 import DeviceCancel from '../src/api/device/DeviceCancel';
 import DeviceChangePin from '../src/api/device/DeviceChangePin';
 import DeviceLock from '../src/api/device/DeviceLock';
+import DeviceSettings from '../src/api/device/DeviceSettings';
 import DeviceUnlock from '../src/api/device/DeviceUnlock';
 import DeviceWipe from '../src/api/device/DeviceWipe';
 import DeviceSettingsGet from '../src/api/protocol-v2/DeviceSettingsGet';
 import DeviceSettingsPageShow from '../src/api/protocol-v2/DeviceSettingsPageShow';
 import DeviceSettingsSet from '../src/api/protocol-v2/DeviceSettingsSet';
 import DeviceUploadWallpaper from '../src/api/protocol-v2/DeviceUploadWallpaper';
-import DeviceSessionOpen from '../src/api/protocol-v2/DeviceSessionOpen';
 import DeviceStatusGet from '../src/api/protocol-v2/DeviceStatusGet';
 import FilesystemFormat from '../src/api/protocol-v2/FilesystemFormat';
 import FilesystemPermissionFix from '../src/api/protocol-v2/FilesystemPermissionFix';
@@ -58,10 +58,12 @@ import { DataManager } from '../src/data-manager';
 import { createCoreApi } from '../src/inject';
 import { Device, preloadSessionCache } from '../src/device/Device';
 import { DevicePool } from '../src/device/DevicePool';
-import { DEVICE } from '../src/events/device';
 import { UI_REQUEST } from '../src/events/ui-request';
 import {
   PROTOCOL_V2_DEVICE_INFO_TIMEOUT_MS,
+  type ProtocolV2DeviceInfo,
+  type ProtocolV2RuntimeMode,
+  getProtocolV2RuntimeMode,
   requestProtocolV2DeviceInfo,
   requestProtocolV2DeviceStatus,
 } from '../src/protocols/protocol-v2/features';
@@ -92,7 +94,6 @@ import {
 import type { DeviceCommands } from '../src/device/DeviceCommands';
 import type { Features } from '../src/types';
 import type { DeviceStatus } from '@onekeyfe/hd-transport';
-import type { ProtocolV2DeviceInfo } from '../src/protocols/protocol-v2/features';
 
 jest.mock('../src/data/config', () => ({
   getSDKVersion: jest.fn(() => '1.0.0'),
@@ -215,6 +216,7 @@ describe('UploadPortfolio', () => {
 
     expect(method.unlockPolicy).toBe('retry-on-locked');
     expect(method.protocolV2UiMode).toBe('none');
+    expect(method.executionPriority).toBe('background');
     expect(method.protocolV2UiInteraction).toBeUndefined();
     expect(method.payload.emitProgress).toBe(false);
     expect(typedCall).toHaveBeenNthCalledWith(
@@ -232,9 +234,15 @@ describe('UploadPortfolio', () => {
         append: false,
         ui_percentage: 100,
       },
-      { timeoutMs: undefined }
+      { timeoutMs: 5_000 }
+    );
+    expect(typedCall).toHaveBeenNthCalledWith(
+      2,
+      'PortfolioUpdate',
+      'Success',
+      {},
+      { timeoutMs: 5_000 }
     );
-    expect(typedCall).toHaveBeenNthCalledWith(2, 'PortfolioUpdate', 'Success', {});
     expect(method.postMessage).not.toHaveBeenCalled();
     expect(result).toMatchObject({
       path: 'vol1:/portfolio/portfolio.okpkg.pending',
@@ -294,8 +302,8 @@ const descriptor = {
 };
 
 /**
- * 为纯对象 stub 设备补齐 Device 的协议判别与 getCurrent* accessor，
- * 缺省实现与 Device.ts 语义保持一致；已有同名字段（如 jest.fn()）不覆盖。
+ * Add Device protocol and getCurrent* accessors to plain-object stubs.
+ * Defaults match Device.ts and never replace an existing member such as jest.fn().
  */
 function stubDevice<T extends Record<string, any>>(device: T): T {
   const d = device as any;
@@ -320,15 +328,54 @@ function stubDevice<T extends Record<string, any>>(device: T): T {
   };
   d.updateProtocolV2Features ??= (
     deviceInfo?: ProtocolV2DeviceInfo,
-    deviceStatus?: DeviceStatus
+    deviceStatus?: DeviceStatus,
+    runtimeMode?: ProtocolV2RuntimeMode
   ) => {
     d.features = buildProtocolV2FeaturesPayload({
       deviceInfo,
       deviceStatus: deviceStatus ?? deviceInfo?.status,
       previous: d.features,
+      runtimeMode: runtimeMode ?? (deviceStatus ? 'normal' : undefined),
     });
     return d.features;
   };
+  d.probeProtocolV2RuntimeState ??= async (
+    deviceInfo: ProtocolV2DeviceInfo,
+    timeoutMs?: number
+  ) => {
+    try {
+      const response = await d
+        .getCommands()
+        .typedCall(
+          'DeviceStatusGet',
+          'DeviceStatus',
+          {},
+          timeoutMs === undefined ? undefined : { timeoutMs }
+        );
+      const features = d.updateProtocolV2Features(deviceInfo, response.message, 'normal');
+      return (
+        features ??
+        buildProtocolV2FeaturesPayload({
+          deviceInfo,
+          deviceStatus: response.message,
+          previous: d.features,
+          runtimeMode: 'normal',
+        })
+      );
+    } catch {
+      const runtimeMode = getProtocolV2RuntimeMode({
+        deviceInfo,
+        deviceStatusAvailable: false,
+      });
+      const features = d.updateProtocolV2Features(deviceInfo, null, runtimeMode);
+      if (features?.mode === runtimeMode) return features;
+      return buildProtocolV2FeaturesPayload({
+        deviceInfo,
+        previous: d.features,
+        runtimeMode,
+      });
+    }
+  };
   d.updateProtocolV2Status ??= (deviceStatus: DeviceStatus) => {
     d.features = buildProtocolV2FeaturesPayload({
       deviceInfo: d.features?.raw?.protocolV2DeviceInfo,
@@ -348,10 +395,15 @@ function stubDevice<T extends Record<string, any>>(device: T): T {
 }
 
 // 直接复用生产映射函数，避免测试内副本与实现漂移（之前的手抄副本已缺失 se boot 字段）
-function normalizeProtocolV2Features(_descriptor: unknown, deviceInfo?: ProtocolV2DeviceInfo) {
+function normalizeProtocolV2Features(
+  _descriptor: unknown,
+  deviceInfo?: ProtocolV2DeviceInfo,
+  runtimeMode: ProtocolV2RuntimeMode = 'normal'
+) {
   return buildProtocolV2FeaturesPayload({
     deviceInfo,
     deviceStatus: deviceInfo?.status,
+    runtimeMode,
   });
 }
 
@@ -365,6 +417,7 @@ const protocolV2BootloaderDeviceInfo: ProtocolV2DeviceInfo = {
       version: '0.0.1',
     },
   },
+  se1: {},
 };
 
 async function requestProtocolV2Features({
@@ -576,7 +629,7 @@ describe('Protocol V2 feature adapter', () => {
     expect(features.bleEnabled).toBeNull();
   });
 
-  test('marks Protocol V2 DeviceInfo without status as bootloader mode', () => {
+  test('marks Protocol V2 DeviceInfo as bootloader when DeviceStatusGet fails', () => {
     const deviceInfo = {
       protocol_version: 1,
       hw: {
@@ -587,14 +640,34 @@ describe('Protocol V2 feature adapter', () => {
           version: '0.2.0',
         },
       },
+      se1: {},
     };
-    const features = normalizeProtocolV2Features(descriptor as any, deviceInfo);
+    const runtimeMode = getProtocolV2RuntimeMode({
+      deviceInfo: deviceInfo as ProtocolV2DeviceInfo,
+      deviceStatusAvailable: false,
+    });
+    const features = normalizeProtocolV2Features(
+      descriptor as any,
+      deviceInfo as ProtocolV2DeviceInfo,
+      runtimeMode
+    );
     expect(features.mode).toBe('bootloader');
     expect(features.bootloaderMode).toBe(true);
     expect(features.initialized).toBeNull();
   });
 
-  test('marks current romloader-shaped Protocol V2 DeviceInfo as romloader mode', () => {
+  test('keeps normal mode when DeviceStatusGet succeeds even if application metadata is absent', () => {
+    const features = normalizeProtocolV2Features(descriptor as any, {
+      protocol_version: 1,
+      hw: { serial_no: 'PR2NORMAL' },
+      fw: { bootloader: { version: '0.2.0' } },
+    });
+
+    expect(features.mode).toBe('normal');
+    expect(features.bootloaderMode).toBe(false);
+  });
+
+  test('temporarily treats romloader metadata as bootloader when DeviceStatusGet fails', () => {
     const deviceInfo = {
       protocol_version: 1,
       hw: {
@@ -609,9 +682,17 @@ describe('Protocol V2 feature adapter', () => {
         },
       },
     };
-    const features = normalizeProtocolV2Features(descriptor as any, deviceInfo);
-    expect(features.mode).toBe('romloader');
-    expect(features.bootloaderMode).toBe(false);
+    const runtimeMode = getProtocolV2RuntimeMode({
+      deviceInfo: deviceInfo as ProtocolV2DeviceInfo,
+      deviceStatusAvailable: false,
+    });
+    const features = normalizeProtocolV2Features(
+      descriptor as any,
+      deviceInfo as ProtocolV2DeviceInfo,
+      runtimeMode
+    );
+    expect(features.mode).toBe('bootloader');
+    expect(features.bootloaderMode).toBe(true);
     expect(features.boardVersion).toBe('1.0.0');
   });
 
@@ -639,6 +720,7 @@ describe('Protocol V2 feature adapter', () => {
       passphraseState: undefined,
       newSession: undefined,
       unlockedAttachPin: false,
+      resumed: false,
     });
     expect(typedCall).not.toHaveBeenCalled();
     expect(device.getInternalState()).toBeUndefined();
@@ -660,6 +742,7 @@ describe('Protocol V2 feature adapter', () => {
       passphraseState: undefined,
       newSession: undefined,
       unlockedAttachPin: false,
+      resumed: false,
     });
 
     expect(promptPassphrase).not.toHaveBeenCalled();
@@ -718,7 +801,7 @@ describe('Protocol V2 feature adapter', () => {
       }
     );
     const typedCall = jest.fn().mockImplementation((request: string) => {
-      if (request === 'DeviceSessionOpen') {
+      if (request === 'DeviceSessionGet') {
         return Promise.resolve({
           message: {
             btc_test_address: 'state-after-unlock',
@@ -748,6 +831,7 @@ describe('Protocol V2 feature adapter', () => {
       passphraseState: undefined,
       newSession: undefined,
       unlockedAttachPin: false,
+      resumed: false,
     });
 
     expect(unlockDevice).toHaveBeenCalledTimes(1);
@@ -773,26 +857,7 @@ describe('Protocol V2 feature adapter', () => {
     expect(device.getInternalState()).toBe('hidden-session');
   });
 
-  test.each([
-    {
-      name: 'Host Passphrase',
-      response: { passphrase: 'hidden\u00e9 secret' },
-      select: { host_passphrase: { passphrase: 'hidden\u0065\u0301 secret' } },
-      event: undefined,
-    },
-    {
-      name: '设备 Passphrase',
-      response: { passphraseOnDevice: true },
-      select: { passphrase_on_device: {} },
-      event: DEVICE.PASSPHRASE_ON_DEVICE,
-    },
-    {
-      name: 'Attach PIN',
-      response: { attachPinOnDevice: true },
-      select: { attach_pin_on_device: {} },
-      event: DEVICE.ATTACH_PIN_ON_DEVICE,
-    },
-  ])('maps $name selection to DeviceSessionOpen', async ({ response, select, event }) => {
+  test('gets the wallet session selected by the Protocol V2 device', async () => {
     const device = Device.fromDescriptor({
       id: 'select-device',
       path: 'select-path',
@@ -813,33 +878,16 @@ describe('Protocol V2 feature adapter', () => {
       type: 'DeviceSession',
       message: { session_id: 'hidden-session', btc_test_address: 'hidden-state' },
     });
-    const promptPassphrase = jest.fn().mockResolvedValue(response);
+    const promptPassphrase = jest.fn();
     (device as any).commands = { typedCall, promptPassphrase };
-    const emit = jest.spyOn(device, 'emit');
 
     await expect(getProtocolV2WalletSession(device)).resolves.toMatchObject({
       newSession: 'hidden-session',
       passphraseState: 'hidden-state',
     });
 
-    expect(promptPassphrase).toHaveBeenCalledWith(
-      expect.objectContaining({
-        source: 'wallet-session-coordinator',
-        reason: 'open-wallet',
-        existsAttachPinUser: true,
-      }),
-      { cancelDeviceOnReject: false }
-    );
-    expect(typedCall).toHaveBeenCalledWith('DeviceSessionOpen', 'DeviceSession', {
-      select,
-    });
-    if (event) {
-      expect(emit).toHaveBeenCalledWith(
-        event,
-        device,
-        expect.objectContaining({ source: 'wallet-session-coordinator' })
-      );
-    }
+    expect(promptPassphrase).not.toHaveBeenCalled();
+    expect(typedCall).toHaveBeenCalledWith('DeviceSessionGet', 'DeviceSession', {});
   });
 
   test('deviceStatusGet returns raw DeviceStatus and updates dynamic features', async () => {
@@ -900,77 +948,18 @@ describe('Protocol V2 feature adapter', () => {
     expect(method.requireProtocolV2).toBe(true);
   });
 
-  test('deviceSessionOpen sends the explicit wallet selection and does not mutate wallet cache', async () => {
-    const typedCall = jest.fn().mockResolvedValue({
-      type: 'DeviceSession',
-      message: { session_id: 'new-session', btc_test_address: 'state-a' },
-    });
-    const updateInternalState = jest.fn();
-    const method = new DeviceSessionOpen({
-      payload: {
-        method: 'deviceSessionOpen',
-        connectId: 'connect-id',
-        select: { host_passphrase: { passphrase: 'hidden secret' } },
-      },
-    });
-    method.init();
-    method.device = stubDevice({
-      originalDescriptor: { ...descriptor, protocolType: 'V2' },
-      commands: { typedCall },
-      updateInternalState,
-    }) as any;
-
-    await expect(method.run()).resolves.toEqual({
-      session_id: 'new-session',
-      btc_test_address: 'state-a',
-    });
-    expect(typedCall).toHaveBeenCalledWith('DeviceSessionOpen', 'DeviceSession', {
-      select: { host_passphrase: { passphrase: 'hidden secret' } },
-    });
-    expect(updateInternalState).not.toHaveBeenCalled();
-  });
-
-  test.each([
-    { payload: {}, reason: 'missing mode' },
-    { payload: { resume: { session_id: '' } }, reason: 'empty resume session' },
-    { payload: { select: { wallet_type: 0 } }, reason: 'removed standard wallet selection' },
-    {
-      payload: { select: { host_passphrase: { passphrase: 'secret' }, passphrase_on_device: {} } },
-      reason: 'multiple hidden wallet access modes',
-    },
-  ])('rejects invalid deviceSessionOpen payload: $reason', ({ payload }) => {
-    const method = new DeviceSessionOpen({
-      payload: {
-        method: 'deviceSessionOpen',
-        connectId: 'connect-id',
-        ...payload,
-      } as any,
-    });
-
-    expect(() => method.init()).toThrow();
-  });
-
-  test('routes public onboarding and session methods through CoreApi', async () => {
+  test('routes onboarding without exposing the raw session command through CoreApi', async () => {
     const call = jest.fn().mockResolvedValue({ success: true, payload: {} });
     const api = createCoreApi(call as any);
 
     await api.deviceGetOnboardingStatus('connect-id', { retryCount: 1 });
-    await api.deviceSessionOpen('connect-id', {
-      retryCount: 1,
-      select: { passphrase_on_device: {} },
-    });
 
-    expect(call).toHaveBeenNthCalledWith(1, {
+    expect(call).toHaveBeenCalledWith({
       method: 'deviceGetOnboardingStatus',
       connectId: 'connect-id',
       retryCount: 1,
     });
-    expect(call).toHaveBeenNthCalledWith(2, {
-      method: 'deviceSessionOpen',
-      connectId: 'connect-id',
-      retryCount: 1,
-      select: { passphrase_on_device: {} },
-    });
+    expect(api).not.toHaveProperty('deviceSessionOpen');
   });
 
   test('reuses the cached session id for the selected Pro2 wallet', async () => {
@@ -1002,8 +991,8 @@ describe('Protocol V2 feature adapter', () => {
       newSession: 'session-b',
     });
 
-    expect(typedCall).toHaveBeenCalledWith('DeviceSessionOpen', 'DeviceSession', {
-      resume: { session_id: 'session-a' },
+    expect(typedCall).toHaveBeenCalledWith('DeviceSessionGet', 'DeviceSession', {
+      session_id: 'session-a',
     });
     expect(device.getInternalState()).toBe('session-b');
   });
@@ -1031,7 +1020,7 @@ describe('Protocol V2 feature adapter', () => {
     expect(device.getInternalState()).toBeUndefined();
   });
 
-  test('retries without the selected Pro2 cache entry after invalid session rejection', async () => {
+  test('clears the selected Pro2 cache entry after session rejection', async () => {
     const device = Device.fromDescriptor({
       id: 'cache-device-3',
       path: 'cache-path-3',
@@ -1049,33 +1038,22 @@ describe('Protocol V2 feature adapter', () => {
     );
     device.passphraseState = 'state-a';
     preloadSessionCache('stable-device-3', 'state-a', 'session-a');
-    const typedCall = jest
-      .fn()
-      .mockRejectedValueOnce(new Error('Failure_ProcessError,Failure_InvalidSession'))
-      .mockResolvedValueOnce({
-        type: 'DeviceSession',
-        message: { session_id: 'session-b', btc_test_address: 'state-a' },
-      });
-    const promptPassphrase = jest.fn().mockResolvedValue({ passphrase: 'state-a-secret' });
+    const typedCall = jest.fn().mockRejectedValue(
+      Object.assign(new Error('SE request failed'), {
+        errorCode: HardwareErrorCode.RuntimeError,
+      })
+    );
+    const promptPassphrase = jest.fn();
     (device as any).commands = { typedCall, promptPassphrase };
 
-    await expect(getProtocolV2WalletSession(device)).resolves.toMatchObject({
-      passphraseState: 'state-a',
-      newSession: 'session-b',
+    await expect(getProtocolV2WalletSession(device)).rejects.toMatchObject({
+      errorCode: HardwareErrorCode.RuntimeError,
     });
     expect(typedCall.mock.calls).toEqual([
-      ['DeviceSessionOpen', 'DeviceSession', { resume: { session_id: 'session-a' } }],
-      [
-        'DeviceSessionOpen',
-        'DeviceSession',
-        {
-          select: {
-            host_passphrase: { passphrase: 'state-a-secret' },
-          },
-        },
-      ],
+      ['DeviceSessionGet', 'DeviceSession', { session_id: 'session-a' }],
     ]);
-    expect(device.getInternalState()).toBe('session-b');
+    expect(promptPassphrase).not.toHaveBeenCalled();
+    expect(device.getInternalState()).toBeUndefined();
   });
 
   test('does not retry an invalid Pro2 session when no cached session was sent', async () => {
@@ -1094,26 +1072,20 @@ describe('Protocol V2 feature adapter', () => {
         },
       }
     );
-    const typedCall = jest
-      .fn()
-      .mockRejectedValue(new Error('Failure_ProcessError,Failure_InvalidSession'));
+    const typedCall = jest.fn().mockRejectedValue(
+      Object.assign(new Error('Invalid session'), {
+        errorCode: HardwareErrorCode.WalletSessionInvalid,
+      })
+    );
     (device as any).commands = {
       typedCall,
       promptPassphrase: jest.fn().mockResolvedValue({ passphrase: 'new-secret' }),
     };
 
-    await expect(getProtocolV2WalletSession(device)).rejects.toThrow('Failure_InvalidSession');
-    expect(typedCall.mock.calls).toEqual([
-      [
-        'DeviceSessionOpen',
-        'DeviceSession',
-        {
-          select: {
-            host_passphrase: { passphrase: 'new-secret' },
-          },
-        },
-      ],
-    ]);
+    await expect(getProtocolV2WalletSession(device)).rejects.toMatchObject({
+      errorCode: HardwareErrorCode.WalletSessionInvalid,
+    });
+    expect(typedCall.mock.calls).toEqual([['DeviceSessionGet', 'DeviceSession', {}]]);
   });
 
   test('rejects a mismatched Pro2 wallet state and clears the selected cache entry', async () => {
@@ -1151,7 +1123,7 @@ describe('Protocol V2 feature adapter', () => {
     expect(device.getInternalState()).toBeUndefined();
   });
 
-  test('unlocks and retries DeviceSessionOpen when hidden-wallet selection is locked', async () => {
+  test('unlocks and retries DeviceSessionGet when wallet selection is locked', async () => {
     const device = Device.fromDescriptor({
       id: 'cache-device-4',
       path: 'cache-path-4',
@@ -1168,7 +1140,10 @@ describe('Protocol V2 feature adapter', () => {
       .fn()
       .mockRejectedValueOnce(lockedError)
       .mockResolvedValueOnce({
-        message: { session_id: 'session-after-unlock', btc_test_address: '' },
+        message: {
+          session_id: 'session-after-unlock',
+          btc_test_address: 'state-after-unlock',
+        },
       });
     (device as any).commands = {
       typedCall,
@@ -1178,6 +1153,7 @@ describe('Protocol V2 feature adapter', () => {
 
     await expect(getProtocolV2WalletSession(device)).resolves.toMatchObject({
       newSession: 'session-after-unlock',
+      passphraseState: 'state-after-unlock',
     });
     expect(unlockDevice).toHaveBeenCalledTimes(1);
     expect(typedCall).toHaveBeenCalledTimes(2);
@@ -1256,7 +1232,7 @@ describe('Protocol V2 feature adapter', () => {
       } as any,
     });
 
-    (device as any).updateProtocolV2Features(protocolV2BootloaderDeviceInfo, null);
+    (device as any).updateProtocolV2Features(protocolV2BootloaderDeviceInfo, null, 'bootloader');
 
     expect(device.features?.mode).toBe('bootloader');
     expect(device.features?.bootloaderMode).toBe(true);
@@ -1311,7 +1287,7 @@ describe('Protocol V2 feature adapter', () => {
     );
   });
 
-  test('returns passphrase state string for Pro2 devices', async () => {
+  test('does not expose getPassphraseState on Pro2 devices', async () => {
     const features = {
       deviceId: null,
       deviceType: 'pro2',
@@ -1349,7 +1325,9 @@ describe('Protocol V2 feature adapter', () => {
       getCurrentPassphraseProtection: () => true,
     }) as any;
 
-    await expect(method.run()).resolves.toBe('state-pro2');
+    await expect(method.run()).rejects.toMatchObject({
+      errorCode: HardwareErrorCode.DeviceNotSupportMethod,
+    });
     expect(getFeatures).not.toHaveBeenCalled();
   });
 
@@ -1382,7 +1360,9 @@ describe('Protocol V2 feature adapter', () => {
       getCurrentPassphraseProtection: () => false,
     }) as any;
 
-    await expect(method.run()).resolves.toBeUndefined();
+    await expect(method.run()).rejects.toMatchObject({
+      errorCode: HardwareErrorCode.DeviceNotSupportMethod,
+    });
     expect(typedCall).not.toHaveBeenCalled();
     expect(updateInternalState).not.toHaveBeenCalled();
   });
@@ -1424,15 +1404,11 @@ describe('Protocol V2 feature adapter', () => {
       getCurrentPassphraseProtection: () => true,
     }) as any;
 
-    await expect(method.run()).resolves.toBe('state-pro2-new');
-    expect(clearInternalState).toHaveBeenCalledTimes(1);
-    expect(updateInternalState).toHaveBeenCalledWith(
-      true,
-      'state-pro2-new',
-      'pro2-device-id',
-      undefined,
-      null
-    );
+    await expect(method.run()).rejects.toMatchObject({
+      errorCode: HardwareErrorCode.DeviceNotSupportMethod,
+    });
+    expect(clearInternalState).not.toHaveBeenCalled();
+    expect(updateInternalState).not.toHaveBeenCalled();
   });
 
   test('stores Pro2 passphrase session cache without synthetic device id', async () => {
@@ -1507,11 +1483,7 @@ describe('Protocol V2 feature adapter', () => {
     expect(device.getInternalState()).toBeUndefined();
     device.passphraseState = 'state-auto';
     expect(device.getInternalState()).toBe('session-auto');
-    expect(typedCall).toHaveBeenLastCalledWith('DeviceSessionOpen', 'DeviceSession', {
-      select: {
-        host_passphrase: { passphrase: 'state-auto-secret' },
-      },
-    });
+    expect(typedCall).toHaveBeenLastCalledWith('DeviceSessionGet', 'DeviceSession', {});
   });
 
   test('does not mark Pro2 passphrase enabled from a main PIN session alone', async () => {
@@ -1581,11 +1553,32 @@ describe('Protocol V2 feature adapter', () => {
     );
 
     expect(device.getInternalState()).toBeUndefined();
-    expect(typedCall).toHaveBeenNthCalledWith(1, 'DeviceSessionOpen', 'DeviceSession', {
-      select: {
-        host_passphrase: { passphrase: 'expected-secret' },
-      },
-    });
+    expect(typedCall).toHaveBeenNthCalledWith(1, 'DeviceSessionGet', 'DeviceSession', {});
+  });
+
+  test('useEmptyPassphrase ignores a stale hidden-wallet state during Protocol V2 safety check', async () => {
+    const device = Device.fromDescriptor({ ...descriptor, protocolType: 'V2' } as any);
+    const typedCall = jest.fn();
+
+    (device as any).features = normalizeProtocolV2Features(
+      { ...descriptor, protocolType: 'V2' } as any,
+      {
+        status: {
+          device_id: 'main-wallet-device',
+          unlocked: true,
+          passphrase_enabled: true,
+          unlocked_by_attach_to_pin: false,
+        },
+      }
+    );
+    (device as any).features.firmwareVersion = '4.15.0';
+    (device as any).commands = { typedCall };
+    device.passphraseState = 'stale-hidden-state';
+
+    await expect(
+      device.checkPassphraseStateSafety('stale-hidden-state', true, false)
+    ).resolves.toBe(true);
+    expect(typedCall).not.toHaveBeenCalled();
   });
 
   test('marks fallback features as unavailable when DeviceInfo is missing', () => {
@@ -1647,15 +1640,17 @@ describe('Protocol V2 feature adapter', () => {
       passphraseProtection: true,
     };
 
-    expect(device.toMessageObject()).toMatchObject({
+    const message = device.toMessageObject();
+    expect(message).toMatchObject({
+      serialNo: 'CACHED-SERIAL',
       uuid: 'CACHED-SERIAL',
       deviceId: null,
       bleName: 'Cached BLE',
       name: 'Cached BLE',
-      displayName: 'Cached Label',
       label: 'Cached Label',
       deviceType: 'pro2',
     });
+    expect(message).not.toHaveProperty('sessionId');
     expect(device.getCurrentPassphraseProtection()).toBe(true);
     expect(device.hasUsePassphrase()).toBe(true);
   });
@@ -1674,6 +1669,7 @@ describe('Protocol V2 feature adapter', () => {
     expect(current.getCurrentDeviceId()).toBeUndefined();
     expect(current.getCurrentSerialNo()).toBe('CACHED-SERIAL');
     expect(current.toMessageObject()).toMatchObject({
+      serialNo: 'CACHED-SERIAL',
       uuid: 'CACHED-SERIAL',
       deviceId: null,
     });
@@ -1708,6 +1704,10 @@ describe('Protocol V2 feature adapter', () => {
           hw: true,
           fw: true,
           coprocessor: true,
+          se1: true,
+          se2: true,
+          se3: true,
+          se4: true,
         },
         types: {
           version: true,
@@ -1869,18 +1869,24 @@ describe('Protocol V2 feature adapter', () => {
     expect(typedCall).not.toHaveBeenCalled();
   });
 
-  test('initializes and reuses Protocol V2 features from DeviceInfo only', async () => {
+  test('initializes and reuses Protocol V2 features after DeviceStatusGet succeeds', async () => {
     const device = Device.fromDescriptor({
       path: 'usb-path',
       protocolType: 'V2',
     } as any);
-    const typedCall = jest.fn().mockResolvedValueOnce({
-      type: 'DeviceInfo',
-      message: {
-        hw: { serial_no: 'PR2SERIAL' },
-        fw: { application: { version: '1.2.3' } },
-      },
-    });
+    const typedCall = jest
+      .fn()
+      .mockResolvedValueOnce({
+        type: 'DeviceInfo',
+        message: {
+          hw: { serial_no: 'PR2SERIAL' },
+          fw: { application: { version: '1.2.3' } },
+        },
+      })
+      .mockResolvedValueOnce({
+        type: 'DeviceStatus',
+        message: { init_states: true, unlocked: true },
+      });
 
     (device as any).commands = { typedCall };
 
@@ -1897,8 +1903,9 @@ describe('Protocol V2 feature adapter', () => {
     expect(device.features?.passphraseProtection).toBeNull();
     expect(device.features?.label).toBeNull();
     expect(device.features?.firmwareVersion).toBe('1.2.3');
-    expect(typedCall).toHaveBeenCalledTimes(1);
-    expect(typedCall).toHaveBeenCalledWith(
+    expect(typedCall).toHaveBeenCalledTimes(2);
+    expect(typedCall).toHaveBeenNthCalledWith(
+      1,
       'DeviceInfoGet',
       'DeviceInfo',
       {
@@ -1906,6 +1913,10 @@ describe('Protocol V2 feature adapter', () => {
           hw: true,
           fw: true,
           coprocessor: true,
+          se1: true,
+          se2: true,
+          se3: true,
+          se4: true,
         },
         types: {
           version: true,
@@ -1916,9 +1927,10 @@ describe('Protocol V2 feature adapter', () => {
         timeoutMs: PROTOCOL_V2_DEVICE_INFO_TIMEOUT_MS,
       }
     );
+    expect(typedCall).toHaveBeenNthCalledWith(2, 'DeviceStatusGet', 'DeviceStatus', {});
   });
 
-  test('recognizes bootloader DeviceInfo without requesting device status', async () => {
+  test('recognizes bootloader when DeviceStatusGet fails', async () => {
     const device = Device.fromDescriptor({
       path: 'usb-path',
       protocolType: 'V2',
@@ -1930,21 +1942,18 @@ describe('Protocol V2 feature adapter', () => {
         message: {
           hw: { serial_no: 'PR2SERIAL' },
           fw: { bootloader: { version: '0.2.0' } },
+          se1: {},
         },
       })
-      .mockResolvedValueOnce({
-        type: 'DeviceStatus',
-        message: {
-          device_id: 'UNEXPECTED-SEPARATE-STATUS',
-        },
-      });
+      .mockRejectedValueOnce(new Error('DeviceStatusGet unsupported in bootloader'));
 
     (device as any).commands = { typedCall };
 
     await device.initialize();
 
-    expect(typedCall).toHaveBeenCalledTimes(1);
-    expect(typedCall).toHaveBeenCalledWith(
+    expect(typedCall).toHaveBeenCalledTimes(2);
+    expect(typedCall).toHaveBeenNthCalledWith(
+      1,
       'DeviceInfoGet',
       'DeviceInfo',
       expect.not.objectContaining({
@@ -1952,6 +1961,7 @@ describe('Protocol V2 feature adapter', () => {
       }),
       expect.anything()
     );
+    expect(typedCall).toHaveBeenNthCalledWith(2, 'DeviceStatusGet', 'DeviceStatus', {});
     expect(device.features).toMatchObject({
       deviceId: null,
       bootloaderMode: true,
@@ -1959,72 +1969,36 @@ describe('Protocol V2 feature adapter', () => {
     });
   });
 
-  test('does not probe DeviceStatusGet while firmware device is still in bootloader mode', async () => {
-    const method = new FirmwareUpdateV4({
-      id: 1,
-      payload: {
-        method: 'firmwareUpdateV4',
-      },
+  test('does not reinterpret a state update error as DeviceStatusGet failure', async () => {
+    const device = Device.fromDescriptor({
+      path: 'usb-path',
+      protocolType: 'V2',
+    } as any);
+    const typedCall = jest.fn().mockResolvedValue({
+      type: 'DeviceStatus',
+      message: { init_states: true, unlocked: true },
     });
-    const typedCall = jest.fn().mockImplementation((request: string) => {
-      if (request === 'DeviceStatusGet') {
-        throw new Error('bootloader must not receive DeviceStatusGet');
-      }
-      return Promise.resolve({
-        type: 'DeviceInfo',
-        message: {
-          hw: { serial_no: 'PR2BOOT' },
-          fw: { bootloader: { version: '0.2.0' } },
-          se1: {},
-        },
+    const updateProtocolV2Features = jest
+      .spyOn(device, 'updateProtocolV2Features')
+      .mockImplementation(() => {
+        throw new Error('state update failed');
       });
-    });
-    (method as any).device = stubDevice({
-      getCommands: () => ({ typedCall }),
-      updateProtocolV2Features: jest.fn(),
-    });
-
-    await expect((method as any).probeProtocolV2NormalMode()).resolves.toBe(false);
-    expect(typedCall).toHaveBeenCalledTimes(1);
-    expect(typedCall).toHaveBeenCalledWith(
-      'DeviceInfoGet',
-      'DeviceInfo',
-      expect.not.objectContaining({
-        targets: expect.objectContaining({ status: true }),
-      }),
-      expect.anything()
-    );
-  });
+    (device as any).commands = { typedCall };
 
-  test('does not probe DeviceStatusGet while firmware device is still in romloader mode', async () => {
-    const method = new FirmwareUpdateV4({
-      id: 1,
-      payload: {
-        method: 'firmwareUpdateV4',
-      },
-    });
-    const typedCall = jest.fn().mockImplementation((request: string) => {
-      if (request === 'DeviceStatusGet') {
-        throw new Error('romloader must not receive DeviceStatusGet');
-      }
-      return Promise.resolve({
-        type: 'DeviceInfo',
-        message: {
-          hw: { serial_no: 'PR2ROM' },
-          fw: {
-            romloader: { version: '0.1.0' },
-            bootloader: { version: '0.2.0' },
-          },
-        },
-      });
-    });
-    (method as any).device = stubDevice({
-      getCommands: () => ({ typedCall }),
-      updateProtocolV2Features: jest.fn(),
-    });
+    await expect(
+      device.probeProtocolV2RuntimeState({
+        hw: { serial_no: 'PR2SERIAL' },
+        fw: { application: { version: '1.0.0' } },
+      })
+    ).rejects.toThrow('state update failed');
 
-    await expect((method as any).probeProtocolV2NormalMode()).resolves.toBe(false);
     expect(typedCall).toHaveBeenCalledTimes(1);
+    expect(updateProtocolV2Features).toHaveBeenCalledTimes(1);
+    expect(updateProtocolV2Features).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ init_states: true }),
+      'normal'
+    );
   });
 
   test('refreshes Protocol V2 features without falling back to V1 GetFeatures', async () => {
@@ -2041,12 +2015,20 @@ describe('Protocol V2 feature adapter', () => {
           fw: { application: { version: '1.2.3' } },
         },
       })
+      .mockResolvedValueOnce({
+        type: 'DeviceStatus',
+        message: { init_states: true, unlocked: true },
+      })
       .mockResolvedValueOnce({
         type: 'DeviceInfo',
         message: {
           hw: { serial_no: 'PR2SERIAL' },
           fw: { application: { version: '1.2.4' } },
         },
+      })
+      .mockResolvedValueOnce({
+        type: 'DeviceStatus',
+        message: { init_states: true, unlocked: true },
       });
 
     (device as any).commands = { typedCall };
@@ -2065,9 +2047,9 @@ describe('Protocol V2 feature adapter', () => {
       firmwareVersion: '1.2.4',
       passphraseProtection: null,
     });
-    expect(typedCall).toHaveBeenCalledTimes(2);
+    expect(typedCall).toHaveBeenCalledTimes(4);
     expect(typedCall).toHaveBeenNthCalledWith(
-      2,
+      3,
       'DeviceInfoGet',
       'DeviceInfo',
       {
@@ -2075,6 +2057,10 @@ describe('Protocol V2 feature adapter', () => {
           hw: true,
           fw: true,
           coprocessor: true,
+          se1: true,
+          se2: true,
+          se3: true,
+          se4: true,
         },
         types: {
           version: true,
@@ -2142,12 +2128,22 @@ describe('Protocol V2 feature adapter', () => {
           message: { message: 'ok' },
         };
       }
+      if (requestType === 'DeviceStatusGet') {
+        return {
+          type: 'DeviceStatus',
+          message: {
+            init_states: true,
+            unlocked: true,
+            passphrase_enabled: false,
+          },
+        };
+      }
       throw new Error(`Unexpected request: ${requestType}`);
     });
 
     (device as any).commands = { typedCall };
-    // Pro2 版本线独立于 Pro（这里是 1.2.3，不满足 Pro 系列 4.15.0 门槛），
-    // Protocol V2 走独立的设备端 PIN 解锁流程，不走 Pro 系列版本门槛或 GetAddress 探测回退。
+    // Pro2 uses an independent version line and dedicated device-side PIN flow,
+    // without the Pro version threshold or GetAddress probe fallback.
     (device as any).features = normalizeProtocolV2Features(
       { ...descriptor, protocolType: 'V2' } as any,
       {
@@ -2161,6 +2157,7 @@ describe('Protocol V2 feature adapter', () => {
 
     expect(typedCall.mock.calls).toEqual([
       ['DeviceSessionAskPin', 'Success', undefined, { timeoutMs: 120_000 }],
+      ['DeviceStatusGet', 'DeviceStatus', {}],
     ]);
     expect(typedCall).not.toHaveBeenCalledWith('GetAddress', 'Address', expect.anything());
     expect(typedCall).not.toHaveBeenCalledWith('GetFeatures', 'Features', {});
@@ -2171,7 +2168,7 @@ describe('Protocol V2 feature adapter', () => {
     });
   });
 
-  test('preserves cached Protocol V2 passphrase state without polling status after unlock', async () => {
+  test('refreshes Protocol V2 passphrase and attach-PIN status after unlock', async () => {
     const device = Device.fromDescriptor({ ...descriptor, protocolType: 'V2' } as any);
     (device as any).features = normalizeProtocolV2Features(
       { ...descriptor, protocolType: 'V2' } as any,
@@ -2188,6 +2185,18 @@ describe('Protocol V2 feature adapter', () => {
           message: { message: 'ok' },
         };
       }
+      if (requestType === 'DeviceStatusGet') {
+        return {
+          type: 'DeviceStatus',
+          message: {
+            init_states: true,
+            unlocked: true,
+            passphrase_enabled: true,
+            attach_to_pin_enabled: true,
+            unlocked_by_attach_to_pin: true,
+          },
+        };
+      }
       throw new Error(`Unexpected request: ${requestType}`);
     });
     (device as any).commands = { typedCall };
@@ -2196,11 +2205,12 @@ describe('Protocol V2 feature adapter', () => {
 
     expect(typedCall.mock.calls).toEqual([
       ['DeviceSessionAskPin', 'Success', undefined, { timeoutMs: 120_000 }],
+      ['DeviceStatusGet', 'DeviceStatus', {}],
     ]);
     expect((device as any).profile).toBeUndefined();
     expect(device.features?.unlocked).toBe(true);
-    expect(device.features?.passphraseProtection).toBeNull();
-    expect(device.features?.unlockedAttachPin).toBeUndefined();
+    expect(device.features?.passphraseProtection).toBe(true);
+    expect(device.features?.unlockedAttachPin).toBe(true);
   });
 
   test('maps unsupported Protocol V2 DeviceSessionAskPin to DeviceNotSupportMethod', async () => {
@@ -2227,7 +2237,7 @@ describe('Protocol V2 feature adapter', () => {
       ['DeviceSessionAskPin', 'Success', undefined, { timeoutMs: 120_000 }],
     ]);
     expect(typedCall).not.toHaveBeenCalledWith(
-      'DeviceSessionOpen',
+      'DeviceSessionGet',
       'DeviceSession',
       expect.anything()
     );
@@ -2680,6 +2690,12 @@ describe('Protocol V2 firmware update targets', () => {
           },
         });
       }
+      if (name === 'DeviceStatusGet') {
+        return Promise.resolve({
+          type: 'DeviceStatus',
+          message: { init_states: true, unlocked: true },
+        });
+      }
       return Promise.reject(new Error(`unexpected call ${name}`));
     });
     const commands = { typedCall };
@@ -2701,7 +2717,7 @@ describe('Protocol V2 firmware update targets', () => {
     const versions = await (method as any).waitForProtocolV2FinalFeatures();
 
     expect(acquire).toHaveBeenCalledWith('ble-id', null, true, 'V2');
-    // 更新完成判定使用 VERSIONS 请求（含 SE targets），scope 与请求内容一致
+    // Completion uses the VERSIONS request, including SE targets, with matching scope.
     expect(typedCall).toHaveBeenNthCalledWith(
       1,
       'DeviceInfoGet',
@@ -2723,7 +2739,7 @@ describe('Protocol V2 firmware update targets', () => {
       },
       { timeoutMs: 5000 }
     );
-    expect(typedCall).toHaveBeenCalledTimes(1);
+    expect(typedCall).toHaveBeenCalledTimes(2);
     expect(typedCall).not.toHaveBeenCalledWith('Initialize', 'Features', {});
     expect(versions).toEqual({
       bootloaderVersion: '0.0.0',
@@ -2795,9 +2811,14 @@ describe('Protocol V2 firmware update targets', () => {
       message: 'Device rebooted successfully',
     });
     (method as any).checkDeviceToBootloader = jest.fn();
-    const typedCall = jest.fn().mockResolvedValue({
-      type: 'DeviceInfo',
-      message: protocolV2BootloaderDeviceInfo,
+    const typedCall = jest.fn().mockImplementation((requestType: string) => {
+      if (requestType === 'DeviceInfoGet') {
+        return Promise.resolve({
+          type: 'DeviceInfo',
+          message: protocolV2BootloaderDeviceInfo,
+        });
+      }
+      return Promise.reject(new Error('DeviceStatusGet unavailable in bootloader'));
     });
     const reconnectProtocolV2Device = jest.fn().mockImplementation(() => {
       (method as any).device.isBootloader = () => true;
@@ -2851,9 +2872,14 @@ describe('Protocol V2 firmware update targets', () => {
       features: { bootloader_mode: false, capabilities: [] },
       isBootloader: () => false,
     });
-    const typedCall = jest.fn().mockResolvedValue({
-      type: 'DeviceInfo',
-      message: protocolV2BootloaderDeviceInfo,
+    const typedCall = jest.fn().mockImplementation((requestType: string) => {
+      if (requestType === 'DeviceInfoGet') {
+        return Promise.resolve({
+          type: 'DeviceInfo',
+          message: protocolV2BootloaderDeviceInfo,
+        });
+      }
+      return Promise.reject(new Error('DeviceStatusGet unavailable in bootloader'));
     });
     const reconnectProtocolV2Device = jest
       .fn()
@@ -2871,6 +2897,7 @@ describe('Protocol V2 firmware update targets', () => {
 
     expect(reconnectProtocolV2Device).toHaveBeenCalledTimes(3);
     expect(typedCall).toHaveBeenCalledTimes(1);
+    expect(typedCall.mock.calls.map(call => call[0])).toEqual(['DeviceInfoGet']);
   });
 
   test('does not run generic initialize during Protocol V2 USB firmware reconnect', async () => {
@@ -2891,6 +2918,7 @@ describe('Protocol V2 firmware update targets', () => {
         }),
       },
       updateFromCache: jest.fn(),
+      hasDeviceAcquire: jest.fn(() => false),
       acquire: jest.fn().mockResolvedValue(undefined),
       initialize,
       commands,
@@ -2914,7 +2942,92 @@ describe('Protocol V2 firmware update targets', () => {
     expect(initialize).not.toHaveBeenCalled();
   });
 
-  test('reboots Protocol V2 firmware flow back to normal after install status is finished', async () => {
+  test('reuses an acquired Protocol V2 USB session while polling reconnect readiness', async () => {
+    const method = new FirmwareUpdateV4({
+      id: 1,
+      payload: {
+        method: 'firmwareUpdateV4',
+      },
+    });
+    const commands = { disposed: false, mainId: 'usb-session' };
+    const acquire = jest.fn().mockResolvedValue(undefined);
+    const device = stubDevice({
+      originalDescriptor: {
+        id: 'usb-id',
+        path: 'usb-path',
+        session: 'usb-session',
+        protocolType: 'V2',
+      },
+      deviceConnector: {
+        enumerate: jest.fn().mockResolvedValue({
+          descriptors: [
+            {
+              id: 'usb-id',
+              path: 'usb-path',
+              session: 'usb-session',
+              protocolType: 'V2',
+            },
+          ],
+        }),
+      },
+      updateDescriptor: jest.fn(),
+      updateFromCache: jest.fn(),
+      hasDeviceAcquire: jest.fn(() => true),
+      acquire,
+      commands,
+      getCommands: () => commands,
+      mainId: 'usb-session',
+    });
+    const getDevices = jest.spyOn(DevicePool, 'getDevices').mockResolvedValue({
+      devices: {},
+      deviceList: [{ getConnectId: () => 'usb-path' }],
+    } as any);
+    (method as any).device = device;
+
+    try {
+      await (method as any).reconnectProtocolV2Device();
+      await (method as any).reconnectProtocolV2Device();
+    } finally {
+      getDevices.mockRestore();
+    }
+
+    expect(acquire).not.toHaveBeenCalled();
+    expect(device.hasDeviceAcquire).toHaveBeenCalledTimes(2);
+  });
+
+  test('stops final reconnect polling immediately when firmware changes device identity', async () => {
+    const method = new FirmwareUpdateV4({
+      id: 1,
+      payload: {
+        method: 'firmwareUpdateV4',
+      },
+    });
+    const reconnectProtocolV2Device = jest.fn().mockResolvedValue(undefined);
+    const typedCall = jest.fn().mockResolvedValue({
+      type: 'DeviceInfo',
+      message: {
+        hw: { serial_no: 'PR2SERIAL' },
+        fw: { application: { version: '1.0.0' } },
+      },
+    });
+    (method as any).protocolV2ExpectedDeviceId = 'expected-device';
+    (method as any).reconnectProtocolV2Device = reconnectProtocolV2Device;
+    (method as any).device = stubDevice({
+      getCommands: () => ({ typedCall }),
+      probeProtocolV2RuntimeState: jest.fn().mockResolvedValue({
+        deviceId: 'changed-device',
+        mode: 'normal',
+        bootloaderMode: false,
+      }),
+    });
+
+    await expect((method as any).waitForProtocolV2ReconnectAndFeatures(60_000)).rejects.toThrow(
+      'identity mismatch'
+    );
+    expect(reconnectProtocolV2Device).toHaveBeenCalledTimes(1);
+  });
+
+  test('reboots Protocol V2 firmware flow back to normal without legacy switch-firmware prompt', async () => {
     const method = new FirmwareUpdateV4({
       id: 1,
       payload: {
@@ -2922,13 +3035,15 @@ describe('Protocol V2 firmware update targets', () => {
       },
     });
     method.postTipMessage = jest.fn();
+    (method as any).reconnectProtocolV2Device = jest.fn().mockResolvedValue(undefined);
     (method as any).protocolV2Reboot = jest.fn().mockResolvedValue({
       message: 'Device rebooted successfully',
     });
 
     await (method as any).exitProtocolV2BootloaderToNormal();
 
-    expect(method.postTipMessage).toHaveBeenCalledWith('SwitchFirmwareReconnectDevice');
+    expect(method.postTipMessage).not.toHaveBeenCalledWith('SwitchFirmwareReconnectDevice');
+    expect((method as any).reconnectProtocolV2Device).toHaveBeenCalledTimes(1);
     expect((method as any).protocolV2Reboot).toHaveBeenCalledWith(DeviceRebootType.Normal);
   });
 
@@ -2974,7 +3089,7 @@ describe('Protocol V2 firmware update targets', () => {
     });
   });
 
-  test('treats WebUSB open NotFoundError during Protocol V2 firmware update as expected disconnect', async () => {
+  test('requires an explicit Protocol V2 update ACK before entering install state', async () => {
     const method = new FirmwareUpdateV4({
       id: 1,
       payload: {
@@ -2994,17 +3109,19 @@ describe('Protocol V2 firmware update targets', () => {
       getCommands: () => ({ typedCall }),
     });
     method.postTipMessage = jest.fn();
+    method.postProgressMessage = jest.fn();
 
     await expect(
       (method as any).protocolV2StartFirmwareUpdate({
         targets: [{ target_id: 4, path: 'vol1:firmware.bin' }],
       })
-    ).resolves.toBeUndefined();
+    ).rejects.toThrow();
 
-    expect(method.postTipMessage).toHaveBeenCalledWith('FirmwareUpdating');
+    expect(method.postTipMessage).not.toHaveBeenCalled();
+    expect(method.postProgressMessage).not.toHaveBeenCalled();
   });
 
-  test('continues Protocol V2 install polling when update request transfer times out', async () => {
+  test('does not poll Protocol V2 install status when the update ACK times out', async () => {
     const method = new FirmwareUpdateV4({
       id: 1,
       payload: {
@@ -3017,207 +3134,125 @@ describe('Protocol V2 firmware update targets', () => {
       getCommands: () => ({ typedCall }),
     });
     method.postTipMessage = jest.fn();
+    method.postProgressMessage = jest.fn();
 
     await expect(
       (method as any).protocolV2StartFirmwareUpdate({
         targets: [{ target_id: 4, path: 'vol1:application_p1.bin' }],
       })
-    ).resolves.toBeUndefined();
+    ).rejects.toThrow('LIBUSB_TRANSFER_TIMED_OUT');
 
-    expect(method.postTipMessage).toHaveBeenCalledWith('FirmwareUpdating');
+    expect(method.postTipMessage).not.toHaveBeenCalled();
+    expect(method.postProgressMessage).not.toHaveBeenCalled();
   });
 
-  test('retries final device readiness through temporary Protocol V2 probe failures', async () => {
+  test('polls only firmware status while Protocol V2 bootloader is installing', async () => {
     const method = new FirmwareUpdateV4({
       id: 1,
       payload: {
         method: 'firmwareUpdateV4',
       },
     });
-    const typedCall = jest.fn().mockImplementation((name: string) => {
-      if (name === 'DeviceStatusGet') {
-        const callCount = typedCall.mock.calls.filter(call => call[0] === name).length;
-        if (callCount === 1) {
-          return Promise.reject(
-            new Error(
-              'Device protocol mismatch: expected V2, but device did not respond to expected protocol'
-            )
-          );
-        }
-        return Promise.resolve({
-          type: 'DeviceStatus',
-          message: { device_id: 'PRO2-DEVICE-ID', init_states: true },
-        });
-      }
-      if (name === 'DeviceInfoGet') {
-        return Promise.resolve({
-          type: 'DeviceInfo',
-          message: {
-            hw: { serial_no: 'PR9999999999' },
-            fw: { application: { version: '9.9.9' } },
-          },
-        });
-      }
-      return Promise.reject(new Error(`unexpected call ${name}`));
-    });
-    const reconnectProtocolV2Device = jest.fn().mockResolvedValue(undefined);
-    const updateProtocolV2Features = jest.fn(() => ({
-      deviceId: 'PRO2-DEVICE-ID',
-      bootloaderMode: false,
-      mode: 'normal',
-    }));
+    const typedCall = jest
+      .fn()
+      .mockResolvedValueOnce({
+        type: 'DeviceFirmwareUpdateStatus',
+        message: { records: [{ target_id: 4, status: 1 }] },
+      })
+      .mockResolvedValueOnce({
+        type: 'DeviceFirmwareUpdateStatus',
+        message: { records: [{ target_id: 4, status: 2 }] },
+      });
+    const reconnectProtocolV2Device = jest
+      .fn()
+      .mockRejectedValueOnce(new Error('Device rebooting'))
+      .mockResolvedValue(undefined);
 
     (method as any).device = stubDevice({
       getCommands: () => ({ typedCall }),
-      updateProtocolV2Features,
     });
     (method as any).reconnectProtocolV2Device = reconnectProtocolV2Device;
     method.postProgressMessage = jest.fn();
 
     await (method as any).waitForProtocolV2FirmwareUpdateComplete([
-      { target_id: 6, path: 'vol1:ble-firmware.bin' },
+      { target_id: 4, path: 'vol0:/application_p1.bin' },
     ]);
 
-    expect(reconnectProtocolV2Device).toHaveBeenCalledTimes(2);
+    expect(reconnectProtocolV2Device).toHaveBeenCalledTimes(3);
     expect(typedCall.mock.calls.map(call => call[0])).toEqual([
-      'DeviceInfoGet',
-      'DeviceStatusGet',
-      'DeviceInfoGet',
-      'DeviceStatusGet',
+      'DeviceFirmwareUpdateStatusGet',
+      'DeviceFirmwareUpdateStatusGet',
     ]);
+    expect(typedCall.mock.calls.map(call => call[0])).not.toContain('DeviceStatusGet');
+    expect(method.postProgressMessage).toHaveBeenCalledWith(1, 'installingFirmware');
+    expect(method.postProgressMessage).toHaveBeenCalledWith(100, 'installingFirmware');
   });
 
-  test('retries final device readiness after the USB handle is no longer acquired', async () => {
+  test('accepts a missing firmware status handler as an app reboot signal', async () => {
     const method = new FirmwareUpdateV4({
       id: 1,
       payload: {
         method: 'firmwareUpdateV4',
       },
     });
-    const typedCall = jest.fn().mockImplementation((name: string) => {
-      if (name === 'DeviceStatusGet') {
-        const callCount = typedCall.mock.calls.filter(call => call[0] === name).length;
-        if (callCount === 1) {
-          return Promise.reject(new Error('Device not acquired: PR9999999999'));
-        }
-        return Promise.resolve({
-          type: 'DeviceStatus',
-          message: { device_id: 'PRO2-DEVICE-ID', init_states: true },
-        });
-      }
-      if (name === 'DeviceInfoGet') {
-        return Promise.resolve({
-          type: 'DeviceInfo',
-          message: {
-            hw: { serial_no: 'PR9999999999' },
-            fw: { application: { version: '9.9.9' } },
-          },
-        });
-      }
-      return Promise.reject(new Error(`unexpected call ${name}`));
-    });
+    const typedCall = jest
+      .fn()
+      .mockRejectedValue(new Error('Failure: Handler not registered for this message'));
     const reconnectProtocolV2Device = jest.fn().mockResolvedValue(undefined);
-    const updateProtocolV2Features = jest.fn(() => ({
-      deviceId: 'PRO2-DEVICE-ID',
-      bootloaderMode: false,
-      mode: 'normal',
-    }));
 
     (method as any).device = stubDevice({
       getCommands: () => ({ typedCall }),
-      updateProtocolV2Features,
     });
     (method as any).reconnectProtocolV2Device = reconnectProtocolV2Device;
     method.postProgressMessage = jest.fn();
 
     await (method as any).waitForProtocolV2FirmwareUpdateComplete([
-      { target_id: 3, path: 'vol0:/bootloader.bin' },
+      { target_id: 4, path: 'vol0:/application_p1.bin' },
     ]);
 
-    expect(reconnectProtocolV2Device).toHaveBeenCalledTimes(2);
-    expect(typedCall.mock.calls.map(call => call[0])).toEqual([
-      'DeviceInfoGet',
-      'DeviceStatusGet',
-      'DeviceInfoGet',
-      'DeviceStatusGet',
-    ]);
+    expect(reconnectProtocolV2Device).toHaveBeenCalledTimes(1);
+    expect(typedCall.mock.calls.map(call => call[0])).toEqual(['DeviceFirmwareUpdateStatusGet']);
   });
 
-  test('treats DeviceStatusGet and DeviceInfoGet readiness as firmware update complete', async () => {
+  test('polls target status after update ACK and finishes when all targets complete', async () => {
     const method = new FirmwareUpdateV4({
       id: 1,
       payload: {
         method: 'firmwareUpdateV4',
       },
     });
-    const typedCall = jest.fn().mockImplementation((name: string) => {
-      if (name === 'DeviceStatusGet') {
-        return Promise.resolve({
-          type: 'DeviceStatus',
-          message: {
-            device_id: 'PRO2-DEVICE-ID',
-            init_states: true,
-          },
-        });
-      }
-      if (name === 'DeviceInfoGet') {
-        return Promise.resolve({
-          type: 'DeviceInfo',
-          message: {
-            hw: { serial_no: 'PR9999999999' },
-            fw: {
-              bootloader: { version: '9.9.9' },
-              application: { version: '9.9.9' },
-            },
-          },
-        });
-      }
-      return Promise.reject(new Error(`unexpected call ${name}`));
-    });
+    const typedCall = jest.fn().mockResolvedValue({
+      type: 'DeviceFirmwareUpdateStatus',
+      message: {
+        records: [
+          { target_id: 3, status: 2 },
+          { target_id: 4, status: 2 },
+        ],
+      },
+    });
     const reconnectProtocolV2Device = jest.fn().mockResolvedValue(undefined);
-    const updateProtocolV2Features = jest.fn(() => ({
-      deviceId: 'PRO2-DEVICE-ID',
-      bootloaderMode: false,
-      mode: 'normal',
-    }));
 
     (method as any).device = stubDevice({
       getCommands: () => ({ typedCall }),
-      updateProtocolV2Features,
     });
     (method as any).reconnectProtocolV2Device = reconnectProtocolV2Device;
     method.postProgressMessage = jest.fn();
 
     await expect(
-      (method as any).waitForProtocolV2FirmwareUpdateComplete(
-        [
-          { target_id: 3, path: 'vol1:bootloader.bin' },
-          { target_id: 4, path: 'vol1:application_p1.bin' },
-        ],
-        {
-          type: 'DeviceFirmwareUpdateStatus',
-          message: {
-            records: [
-              { target_id: 3, status: 2 },
-              { target_id: 4, status: 2 },
-            ],
-          },
-        }
-      )
+      (method as any).waitForProtocolV2FirmwareUpdateComplete([
+        { target_id: 3, path: 'vol1:bootloader.bin' },
+        { target_id: 4, path: 'vol1:application_p1.bin' },
+      ])
     ).resolves.toBeUndefined();
 
     expect(reconnectProtocolV2Device).toHaveBeenCalledTimes(1);
-    expect(updateProtocolV2Features).toHaveBeenCalledTimes(1);
-    expect(updateProtocolV2Features).toHaveBeenCalledWith(
-      expect.objectContaining({ hw: { serial_no: 'PR9999999999' } }),
-      expect.objectContaining({ device_id: 'PRO2-DEVICE-ID' })
-    );
-    expect(typedCall.mock.calls.map(call => call[0])).toEqual(['DeviceInfoGet', 'DeviceStatusGet']);
-    expect(typedCall).not.toHaveBeenCalledWith(
+    expect(typedCall).toHaveBeenCalledWith(
       'DeviceFirmwareUpdateStatusGet',
+      'DeviceFirmwareUpdateStatus',
       expect.anything(),
       expect.anything()
     );
+    expect(method.postProgressMessage).toHaveBeenCalledWith(100, 'installingFirmware');
   });
 
   test('uses SDK decoded enum names for Protocol V2 install polling', () => {
@@ -3262,7 +3297,7 @@ describe('Protocol V2 firmware update targets', () => {
         expectedTargetIds
       )
     ).toBe(false);
-    expect(method.postProgressMessage).toHaveBeenCalledWith(99, 'installingFirmware');
+    expect(method.postProgressMessage).toHaveBeenCalledWith(1, 'installingFirmware');
 
     try {
       (method as any).assertProtocolV2TargetStatus(
@@ -3276,15 +3311,72 @@ describe('Protocol V2 firmware update targets', () => {
 
     try {
       (method as any).assertProtocolV2TargetStatus(
-        [{ target_id: 4, status: 'FW_MGMT_UPDATER_TASK_STATUS_FAILED_VERIFY' }],
+        [
+          {
+            target_id: 4,
+            status: 'FW_MGMT_UPDATER_TASK_STATUS_FAILED_VERIFY',
+            payload_version: 0x010000,
+            path: 'vol0:/application_p1.bin',
+          },
+        ],
         expectedTargetIds
       );
       throw new Error('Expected Protocol V2 failed firmware status to throw');
     } catch (error: any) {
       expect(error.errorCode).toBe(HardwareErrorCode.FirmwareError);
+      expect(error.message).toContain('FW_MGMT_UPDATER_TASK_STATUS_FAILED_VERIFY');
+      expect(error.message).toContain('vol0:/application_p1.bin');
     }
   });
 
+  test('reports failed Protocol V2 install status before the normal-mode timeout', async () => {
+    const method = new FirmwareUpdateV4({
+      id: 1,
+      payload: {
+        method: 'firmwareUpdateV4',
+      },
+    });
+    const typedCall = jest.fn().mockResolvedValue({
+      type: 'DeviceFirmwareUpdateStatus',
+      message: {
+        records: [
+          {
+            target_id: 4,
+            status: 'FW_MGMT_UPDATER_TASK_STATUS_FAILED_VERIFY',
+            payload_version: 0x010000,
+            path: 'vol0:/application_p1.bin',
+          },
+        ],
+      },
+    });
+    (method as any).device = stubDevice({
+      getCommands: () => ({ typedCall }),
+    });
+    (method as any).reconnectProtocolV2Device = jest.fn().mockResolvedValue(undefined);
+    (method as any).probeProtocolV2NormalMode = jest.fn().mockResolvedValue(false);
+
+    await expect(
+      (method as any).waitForProtocolV2FirmwareUpdateComplete([
+        { target_id: 4, path: 'vol0:/application_p1.bin' },
+      ])
+    ).rejects.toMatchObject({
+      errorCode: HardwareErrorCode.FirmwareError,
+      message: expect.stringContaining('vol0:/application_p1.bin'),
+    });
+    expect(typedCall).toHaveBeenCalledWith(
+      'DeviceFirmwareUpdateStatusGet',
+      'DeviceFirmwareUpdateStatus',
+      {
+        fields: {
+          status: true,
+          payload_version: true,
+          path: true,
+        },
+      },
+      { timeoutMs: 5000 }
+    );
+  });
+
   test('passes bootloader, coprocessor, SE and app files to DeviceFirmwareUpdate targets', async () => {
     const method = new FirmwareUpdateV4({
       id: 1,
@@ -3679,6 +3771,137 @@ describe('Protocol V2 firmware update targets', () => {
     getFirmwareLatestReleaseSpy.mockRestore();
   });
 
+  test('downloads and validates remote RESC bundles before entering bootloader', async () => {
+    const method = new FirmwareUpdateV4({
+      id: 1,
+      payload: {
+        method: 'firmwareUpdateV4',
+        platform: 'web',
+        targetsToUpdate: ['resource'],
+      },
+    });
+    method.init();
+
+    const order: string[] = [];
+    const resourceBinary = new Uint8Array([1, 2, 3]).buffer;
+    const getSysResourceBinarySpy = jest
+      .spyOn(firmwareBinaryApi, 'getSysResourceBinary')
+      .mockImplementation(() => {
+        order.push('download');
+        return Promise.resolve({ binary: resourceBinary });
+      });
+    const getFirmwareLatestReleaseSpy = jest
+      .spyOn(DataManager, 'getFirmwareLatestRelease')
+      .mockReturnValue({
+        required: false,
+        version: [1, 0, 0],
+        url: '',
+        resourceBundles: [
+          {
+            name: 'images',
+            url: 'https://example.com/images.okpkg',
+            devicePath: 'vol0:/resource/images/images.okpkg',
+          },
+        ],
+        fingerprint: '',
+        changelog: {
+          'zh-CN': '',
+          'en-US': '',
+        },
+      });
+
+    (method as any).device = stubDevice({
+      originalDescriptor: { protocolType: 'V2' },
+      features: { deviceType: 'pro2', firmwareVersion: '1.0.0', capabilities: [] },
+    });
+    (method as any).prepareRemoteProtocolV2Binaries = jest.fn().mockResolvedValue({
+      bootloaderBinary: null,
+      fwBinaryMap: [],
+    });
+    (method as any).enterProtocolV2BootloaderMode = jest.fn().mockImplementation(() => {
+      order.push('bootloader');
+      return Promise.resolve(true);
+    });
+    (method as any).executeProtocolV2Update = jest.fn().mockResolvedValue(undefined);
+    (method as any).exitProtocolV2BootloaderToNormal = jest.fn().mockResolvedValue(undefined);
+    (method as any).waitForProtocolV2FinalFeatures = jest.fn().mockResolvedValue({
+      bootloaderVersion: '1.0.0',
+      bleVersion: '0.0.0',
+      firmwareVersion: '1.0.0',
+    });
+    method.postTipMessage = jest.fn();
+
+    await method.run();
+
+    expect(order).toEqual(['download', 'bootloader']);
+    expect((method as any).executeProtocolV2Update).toHaveBeenCalledWith({
+      bootloaderBinary: null,
+      fwBinaryMap: [],
+      resourceBundles: [
+        {
+          name: 'images',
+          binary: resourceBinary,
+          devicePath: 'vol0:/resource/images/images.okpkg',
+          url: 'https://example.com/images.okpkg',
+        },
+      ],
+    });
+
+    getSysResourceBinarySpy.mockRestore();
+    getFirmwareLatestReleaseSpy.mockRestore();
+  });
+
+  test('rejects an empty remote RESC bundle before entering bootloader', async () => {
+    const method = new FirmwareUpdateV4({
+      id: 1,
+      payload: {
+        method: 'firmwareUpdateV4',
+        platform: 'web',
+        targetsToUpdate: ['resource'],
+      },
+    });
+    method.init();
+
+    const getSysResourceBinarySpy = jest
+      .spyOn(firmwareBinaryApi, 'getSysResourceBinary')
+      .mockResolvedValue({ binary: new ArrayBuffer(0) });
+    const getFirmwareLatestReleaseSpy = jest
+      .spyOn(DataManager, 'getFirmwareLatestRelease')
+      .mockReturnValue({
+        required: false,
+        version: [1, 0, 0],
+        url: '',
+        resourceBundles: [
+          {
+            name: 'images',
+            url: 'https://example.com/images.okpkg',
+            devicePath: 'vol0:/resource/images/images.okpkg',
+          },
+        ],
+        fingerprint: '',
+        changelog: {
+          'zh-CN': '',
+          'en-US': '',
+        },
+      });
+    (method as any).device = stubDevice({
+      originalDescriptor: { protocolType: 'V2' },
+      features: { deviceType: 'pro2', firmwareVersion: '1.0.0', capabilities: [] },
+    });
+    (method as any).prepareRemoteProtocolV2Binaries = jest.fn().mockResolvedValue({
+      bootloaderBinary: null,
+      fwBinaryMap: [],
+    });
+    (method as any).enterProtocolV2BootloaderMode = jest.fn();
+    method.postTipMessage = jest.fn();
+
+    await expect(method.run()).rejects.toThrow('Protocol V2 RESC bundle is empty: images');
+    expect((method as any).enterProtocolV2BootloaderMode).not.toHaveBeenCalled();
+
+    getSysResourceBinarySpy.mockRestore();
+    getFirmwareLatestReleaseSpy.mockRestore();
+  });
+
   test('does not download Pro2 firmware components that App did not select', async () => {
     const method = new FirmwareUpdateV4({
       id: 1,
@@ -4073,14 +4296,20 @@ describe('Protocol V2 firmware update targets', () => {
     expect(writePayloads.map(payload => payload.ui_percentage)).toEqual([0, 100]);
   });
 
-  test('consumes Protocol V2 install progress before final update success', async () => {
+  test('ends device confirmation and starts install progress only after Protocol V2 ACK', async () => {
     const method = new FirmwareUpdateV4({
       id: 1,
       payload: {
         method: 'firmwareUpdateV4',
       },
     });
-    const typedCall = jest.fn().mockResolvedValue({ type: 'Success', message: { message: 'ok' } });
+    let resolveRequest: ((value: unknown) => void) | undefined;
+    const typedCall = jest.fn().mockImplementation(
+      () =>
+        new Promise(resolve => {
+          resolveRequest = resolve;
+        })
+    );
 
     (method as any).device = stubDevice({
       getCommands: () => ({ typedCall }),
@@ -4088,22 +4317,24 @@ describe('Protocol V2 firmware update targets', () => {
     method.postProgressMessage = jest.fn();
     method.postTipMessage = jest.fn();
 
-    await (method as any).protocolV2StartFirmwareUpdate({
+    const startPromise = (method as any).protocolV2StartFirmwareUpdate({
       targets: [{ target_id: 4, path: 'vol1:firmware.bin' }],
     });
+    await Promise.resolve();
 
-    const callOptions = typedCall.mock.calls[0][3];
-    expect(typedCall.mock.calls[0][1]).toEqual(['Success', 'DeviceFirmwareUpdateStatus']);
-    expect(callOptions.intermediateTypes).toEqual(['DeviceFirmwareUpdateStatus']);
-    callOptions.onIntermediateResponse({
-      type: 'DeviceFirmwareUpdateStatus',
-      message: { records: [{ target_id: 4, status: 1 }] },
-    });
+    expect(typedCall.mock.calls[0][1]).toBe('Success');
+    expect(typedCall.mock.calls[0][3]).toEqual(expect.objectContaining({ timeoutMs: 180_000 }));
+    expect(method.postTipMessage).not.toHaveBeenCalled();
+    expect(method.postProgressMessage).not.toHaveBeenCalled();
 
-    expect(method.postProgressMessage).toHaveBeenCalledWith(99, 'installingFirmware');
+    resolveRequest?.({ type: 'Success', message: { message: 'ok' } });
+    await startPromise;
+    expect(method.postTipMessage).toHaveBeenCalledWith('FirmwareUpdating');
+    expect(method.postProgressMessage).toHaveBeenCalledWith(0, 'installingFirmware');
+    expect(method.postTipMessage).toHaveBeenCalledTimes(1);
   });
 
-  test('accepts Protocol V2 firmware update status as start response', async () => {
+  test('requests only a Success ACK for Protocol V2 firmware install', async () => {
     const method = new FirmwareUpdateV4({
       id: 1,
       payload: {
@@ -4111,8 +4342,8 @@ describe('Protocol V2 firmware update targets', () => {
       },
     });
     const typedCall = jest.fn().mockResolvedValue({
-      type: 'DeviceFirmwareUpdateStatus',
-      message: { records: [{ target_id: 4, status: 1 }] },
+      type: 'Success',
+      message: { message: 'accepted' },
     });
 
     (method as any).device = stubDevice({
@@ -4125,7 +4356,7 @@ describe('Protocol V2 firmware update targets', () => {
       targets: [{ target_id: 4, path: 'vol1:firmware.bin' }],
     });
 
-    expect(typedCall.mock.calls[0][1]).toEqual(['Success', 'DeviceFirmwareUpdateStatus']);
+    expect(typedCall.mock.calls[0][1]).toBe('Success');
     expect(method.postTipMessage).toHaveBeenCalledWith('FirmwareUpdating');
   });
 });
@@ -4472,6 +4703,24 @@ describe('Protocol V2 protected method execution', () => {
     expect(method.unlockPolicy).toBe('none');
   });
 
+  test('uses the same label interaction for the compatible deviceSettings entry point', () => {
+    const method = new DeviceSettings({
+      id: 2,
+      payload: { method: 'deviceSettings', label: 'My Pro 2' },
+    });
+
+    method.init();
+
+    expect(method.protocolV2UiInteraction).toEqual({
+      request: 'button',
+      source: 'method-lifecycle',
+      reason: 'device-management',
+      completion: 'operation-completed',
+      deviceOnly: true,
+      operation: 'change-label',
+    });
+  });
+
   test.each([
     ['deviceInfoGet', DeviceInfoGet],
     ['deviceStatusGet', DeviceStatusGet],
@@ -4722,6 +4971,7 @@ describe('Protocol V2 current low-level methods', () => {
     });
 
     await expect(v2Method.run()).resolves.toEqual({ message: 'accepted' });
+    expect(v2Method.unlockPolicy).toBe('retry-on-locked');
     expect(v2TypedCall).toHaveBeenCalledWith('DeviceSettingsPageShow', 'Success', {
       page: DeviceSettingsPage.DeviceReset,
     });
@@ -4764,6 +5014,7 @@ describe('Protocol V2 current low-level methods', () => {
     });
 
     await expect(v2Method.run()).resolves.toEqual({ message: 'accepted' });
+    expect(v2Method.unlockPolicy).toBe('retry-on-locked');
     expect(v2TypedCall).toHaveBeenCalledWith('DeviceSettingsPageShow', 'Success', {
       page: DeviceSettingsPage.DevicePinChange,
     });
@@ -4927,6 +5178,9 @@ describe('Protocol V2 current low-level methods', () => {
 
   test('opens non-passphrase Protocol V2 settings pages', async () => {
     const typedCall = jest.fn().mockResolvedValue({ message: { message: 'ok' } });
+    const getDeviceState = jest.fn().mockResolvedValue({
+      settings: { airgapMode: true },
+    });
     const method = new DeviceSettingsPageShow({
       id: 1,
       payload: {
@@ -4936,7 +5190,7 @@ describe('Protocol V2 current low-level methods', () => {
       },
     });
     method.init();
-    (method as any).device = stubDevice({ commands: { typedCall } });
+    (method as any).device = stubDevice({ commands: { typedCall }, getDeviceState });
 
     await method.run();
 
@@ -4952,10 +5206,14 @@ describe('Protocol V2 current low-level methods', () => {
       deviceOnly: true,
       page: DeviceSettingsPage.DeviceAirgap,
     });
+    expect(getDeviceState).toHaveBeenCalledWith({ refreshSections: ['settings'] });
   });
 
   test('opens the Protocol V2 passphrase settings page', async () => {
     const typedCall = jest.fn().mockResolvedValue({ message: { message: 'ok' } });
+    const getDeviceState = jest.fn().mockResolvedValue({
+      status: { passphraseProtection: true },
+    });
     const method = new DeviceSettingsPageShow({
       id: 1,
       payload: {
@@ -4964,7 +5222,7 @@ describe('Protocol V2 current low-level methods', () => {
       },
     });
     method.init();
-    (method as any).device = stubDevice({ commands: { typedCall } });
+    (method as any).device = stubDevice({ commands: { typedCall }, getDeviceState });
 
     await method.run();
 
@@ -4972,6 +5230,7 @@ describe('Protocol V2 current low-level methods', () => {
       page: 2,
       field_name: undefined,
     });
+    expect(getDeviceState).toHaveBeenCalledWith({ refreshSections: ['status'] });
   });
 
   test('does not unlock before reading Protocol V2 device settings', () => {
@@ -4985,22 +5244,67 @@ describe('Protocol V2 current low-level methods', () => {
     expect(method.unlockPolicy).toBe('none');
   });
 
-  test('marks Protocol V2 settings mutations for unlock-on-locked retry', () => {
-    const methods = [
-      new DeviceSettingsSet({
-        id: 2,
-        payload: { method: 'deviceSettingsSet', settings: { brightness: 80 } },
-      }),
-      new DeviceSettingsPageShow({
-        id: 3,
-        payload: { method: 'deviceSettingsPageShow', page: 'DevicePassphrase' },
-      }),
-    ];
+  test.each([
+    ['label', { label: 'My Pro 2' }],
+    ['language', { language: 'ja-JP' }],
+    ['brightness', { brightness: 80 }],
+    ['haptic feedback', { haptic_feedback: true }],
+    [
+      'combined lock-free settings',
+      {
+        label: 'My Pro 2',
+        language: 'ja-JP',
+        brightness: 80,
+        haptic_feedback: true,
+      },
+    ],
+  ])('does not unlock before changing Protocol V2 %s', (_name, settings) => {
+    const method = new DeviceSettingsSet({
+      id: 2,
+      payload: { method: 'deviceSettingsSet', settings },
+    });
 
-    methods.forEach(method => {
-      method.init();
-      expect(method.unlockPolicy).toBe('retry-on-locked');
+    method.init();
+
+    expect(method.unlockPolicy).toBe('none');
+  });
+
+  test.each([
+    ['auto lock', { autolock_delay_ms: 60_000 }],
+    ['auto shutdown', { autoshutdown_delay_ms: 120_000 }],
+    ['mixed protected settings', { brightness: 80, autolock_delay_ms: 60_000 }],
+    ['other protected settings', { usb_lock_enable: true }],
+  ])('unlocks before changing Protocol V2 %s', (_name, settings) => {
+    const method = new DeviceSettingsSet({
+      id: 2,
+      payload: { method: 'deviceSettingsSet', settings },
+    });
+
+    method.init();
+
+    expect(method.unlockPolicy).toBe('retry-on-locked');
+  });
+
+  test('unlocks before opening Protocol V2 settings pages', () => {
+    const method = new DeviceSettingsPageShow({
+      id: 3,
+      payload: { method: 'deviceSettingsPageShow', page: 'DevicePassphrase' },
+    });
+
+    method.init();
+
+    expect(method.unlockPolicy).toBe('retry-on-locked');
+  });
+
+  test('keeps firmwareUpdateV4 unlock-before-reboot behavior explicit', () => {
+    const method = new FirmwareUpdateV4({
+      id: 4,
+      payload: { method: 'firmwareUpdateV4' },
     });
+
+    method.init();
+
+    expect(method.unlockPolicy).toBe('retry-on-locked');
   });
 
   test('sends FilesystemPermissionFix from filesystemPermissionFix', async () => {