@onekeyfe/hd-transport-react-native 1.2.0-alpha.66 → 1.2.0-alpha.67

package/src/index.ts

@@ -28,7 +28,6 @@ import {
   HardwareErrorCode,
   createDeferred,
   isOnekeyBluetoothDevice,
-  isPro2FindMyAdvertisementName,
 } from '@onekeyfe/hd-shared';
 
 import { getConnectedDeviceIds, onDeviceBondState, pairDevice } from './BleManager';
@@ -61,7 +60,6 @@ const FIRMWARE_UPLOAD_WRITE_BURST_SIZE = Platform.OS === 'ios' ? 4 : 5;
 const FIRMWARE_UPLOAD_WRITE_PAUSE_MS = Platform.OS === 'ios' ? 8 : 10;
 const FIRMWARE_UPLOAD_WRITE_FLUSH_DELAY_MS = Platform.OS === 'ios' ? 24 : 30;
 const FIRMWARE_UPLOAD_WRITE_MAX_RETRIES = 8;
-const IOS_PROTOCOL_V2_CONTROL_WRITE_DELAY_MS = 5;
 const ANDROID_FIRMWARE_UPLOAD_PACKET_LENGTH = 192;
 const FIRMWARE_UPLOAD_WRITE_PACKET_CAPACITY =
   Platform.OS === 'ios' ? IOS_PACKET_LENGTH : ANDROID_FIRMWARE_UPLOAD_PACKET_LENGTH;
@@ -73,33 +71,6 @@ type ResolvedBleCharacteristics = {
   notifyCharacteristic: Characteristic;
 };
 
-const isAsciiWhitespace = (code: number) =>
-  code === 0x09 ||
-  code === 0x0a ||
-  code === 0x0b ||
-  code === 0x0c ||
-  code === 0x0d ||
-  code === 0x20;
-
-const hasGattCongestedStatus = (text: string) => {
-  let searchFrom = 0;
-  while (searchFrom < text.length) {
-    const statusIndex = text.indexOf('status', searchFrom);
-    if (statusIndex < 0) return false;
-
-    let cursor = statusIndex + 'status'.length;
-    while (cursor < text.length && isAsciiWhitespace(text.charCodeAt(cursor))) cursor += 1;
-    if (text[cursor] === ':' || text[cursor] === '=') {
-      cursor += 1;
-      while (cursor < text.length && isAsciiWhitespace(text.charCodeAt(cursor))) cursor += 1;
-    }
-    if (text.startsWith(String(ANDROID_GATT_CONGESTED_STATUS), cursor)) return true;
-
-    searchFrom = statusIndex + 'status'.length;
-  }
-  return false;
-};
-
 const delay = (ms: number) =>
   new Promise<void>(resolve => {
     setTimeout(resolve, ms);
@@ -128,13 +99,29 @@ export const getFirmwareUploadWriteRetryType = (
   const text = [bleWriteError.reason, bleWriteError.message, bleWriteError.name]
     .filter(value => typeof value === 'string')
     .join(' ');
-  return text.includes('GATT_CONGESTED') || hasGattCongestedStatus(text) ? 'congested' : null;
+  return /GATT_CONGESTED|status\s*[:=]?\s*143/.test(text) ? 'congested' : null;
 };
 
 const resolveFirmwareUploadRetryDelay = (attempt: number, baseDelayMs = 200, maxDelayMs = 1200) =>
   Math.min(baseDelayMs * 2 ** attempt, maxDelayMs);
 const PROTOCOL_PROBE_TIMEOUT_MS = 1000;
 const PROTOCOL_V2_PROBE_TIMEOUT_MS = 10_000;
+/**
+ * Per-packet write budget. iOS only resolves writeWithoutResponse once CoreBluetooth
+ * reports the peripheral ready again; a peripheral wedged by its own firmware reboot
+ * stops reporting ready while staying connected, so the write promise never settles.
+ * Response timeouts cannot cover that — they are armed after the writes complete —
+ * and an unbounded write leaves the whole transport unusable until the process dies.
+ * A healthy packet completes in milliseconds, so this only fires on a dead link.
+ */
+export const BLE_WRITE_PACKET_TIMEOUT_MS = 10_000;
+const WEDGED_WRITE_MESSAGE = 'BLE write timeout after';
+const isWedgedWriteError = (error: unknown): boolean =>
+  (error as { errorCode?: unknown })?.errorCode === HardwareErrorCode.BleWriteCharacteristicError &&
+  typeof (error as { message?: unknown })?.message === 'string' &&
+  (error as { message: string }).message.startsWith(WEDGED_WRITE_MESSAGE);
+/** Consecutive wedged writes on one device before the BLE manager itself is recreated. */
+export const BLE_WRITE_TIMEOUT_MANAGER_RESET_THRESHOLD = 2;
 const DEVICE_SCAN_TIMEOUT_MS = 3000;
 const IOS_NOTIFY_READY_DELAY_MS = 150;
 const ANDROID_NOTIFY_READY_DELAY_MS = 300;
@@ -191,12 +178,52 @@ function getDeviceDisplayName(device?: Device | null) {
 
 const ANDROID_REQUEST_MTU = 256;
 
+const BLE_NATIVE_CONNECT_TIMEOUT_MS = 3000;
+
 const connectOptions: Record<string, unknown> = {
   requestMTU: ANDROID_REQUEST_MTU,
-  timeout: 3000,
+  timeout: BLE_NATIVE_CONNECT_TIMEOUT_MS,
   refreshGatt: 'OnConnected',
 };
 
+/** Fallback connect options: drops requestMTU (the thing being worked around) but keeps the native budget. */
+const fallbackConnectOptions: Record<string, unknown> = {
+  timeout: BLE_NATIVE_CONNECT_TIMEOUT_MS,
+};
+
+/**
+ * JS backstop for connect. The native adapter applies its own 3s budget, but it
+ * schedules that timeout on its serial queue, so a busy queue (e.g. right after a
+ * firmware install tears the link down) can leave the promise unsettled — observed
+ * blocking a reconnect for 61s until the app-level timeout. Healthy connects finish
+ * inside the native budget, so this only fires when the native timeout did not.
+ */
+export const BLE_CONNECT_TIMEOUT_MS = BLE_NATIVE_CONNECT_TIMEOUT_MS * 2 + 2000;
+/**
+ * Service discovery and characteristic resolution run after connect() succeeds, but
+ * CoreBluetooth schedules them on the same serial queue. If that queue is wedged by a
+ * device reboot, these calls can remain pending forever unless they have their own
+ * budget.
+ */
+export const BLE_GATT_SETUP_TIMEOUT_MS = 10_000;
+/**
+ * How many times a known device may fail its own protocol before we probe the others
+ * again. Reconnect polling during a device reboot repeats this every few seconds, and
+ * probing Protocol V2 costs a 10s Ping timeout, so paying it on every attempt for a
+ * device we just spoke V1 to dominates the wait. A firmware update can legitimately
+ * change a device's protocol, so the shortcut has to expire rather than stick.
+ */
+export const PROTOCOL_REPROBE_FALLBACK_ATTEMPTS = 3;
+/** BLE setup timeouts since the last successful setup before the manager is recreated. */
+export const BLE_CONNECT_TIMEOUT_MANAGER_RESET_THRESHOLD = 2;
+const CONNECT_TIMEOUT_MESSAGE = 'BLE connect timeout after';
+const isConnectTimeoutError = (error: unknown): boolean =>
+  (error as { errorCode?: unknown })?.errorCode === HardwareErrorCode.BleConnectedError &&
+  typeof (error as { message?: unknown })?.message === 'string' &&
+  (error as { message: string }).message.startsWith(CONNECT_TIMEOUT_MESSAGE);
+const isNativeOperationTimeoutError = (error: unknown): boolean =>
+  (error as { errorCode?: unknown })?.errorCode === BleErrorCode.OperationTimedOut;
+
 export type IOneKeyDevice = OneKeyDeviceInfoBase & Device;
 
 const tryToGetConfiguration = (device: Device) => {
@@ -285,8 +312,28 @@ export default class ReactNativeBleTransport {
   /** Per-device protocol type detected by active wire-level probe after connect. */
   private deviceProtocol: Map<string, ProtocolType> = new Map();
 
+  /**
+   * Protocol a probe is currently trying, before the device has confirmed it. Calls
+   * must route with it, but acquire() must not treat it as a detected protocol: a
+   * probe that never answers would otherwise leave the reuse fast path handing out a
+   * transport that was never validated.
+   */
+  private probingProtocols: Map<string, ProtocolType> = new Map();
+
+  /** Consecutive write timeouts per device; reset by any write that completes. */
+  private writeTimeoutCounts: Map<string, number> = new Map();
+
+  /** BLE setup timeouts per device since the last complete characteristic resolution. */
+  private connectionSetupTimeoutCounts: Map<string, number> = new Map();
+
   private deviceProtocolHints: Map<string, ProtocolType> = new Map();
 
+  /** Protocol this device actually answered on, kept across reconnects of one session. */
+  private sessionProtocols: Map<string, ProtocolType> = new Map();
+
+  /** Consecutive detections that failed while trusting sessionProtocols. */
+  private protocolReprobeFailures: Map<string, number> = new Map();
+
   private protocolV2Assemblers: Map<string, ProtocolV2FrameAssembler> = new Map();
 
   private protocolV2FrameQueues: Map<string, Uint8Array[]> = new Map();
@@ -504,22 +551,21 @@ export default class ReactNativeBleTransport {
       const isConnected = await device.isConnected().catch(() => false);
       if (!isConnected) {
         try {
-          device = await device.connect(connectOptions);
+          device = await this.connectWithTimeout(uuid, () => device.connect(connectOptions));
         } catch (e) {
           if (
             e.errorCode === BleErrorCode.DeviceMTUChangeFailed ||
             e.errorCode === BleErrorCode.OperationCancelled
           ) {
-            device = await device.connect();
+            device = await this.connectWithTimeout(uuid, () => device.connect());
           } else if (e.errorCode !== BleErrorCode.DeviceAlreadyConnected) {
             throw e;
           }
         }
       }
 
-      const { writeCharacteristic, notifyCharacteristic } = await this.resolveCharacteristics(
-        device
-      );
+      const { writeCharacteristic, notifyCharacteristic } =
+        await this.resolveCharacteristicsWithTimeout(uuid, device);
 
       transport.device = device;
       transport.writeCharacteristic = writeCharacteristic;
@@ -609,21 +655,12 @@ export default class ReactNativeBleTransport {
           }
 
           const displayName = getDeviceDisplayName(device);
-          // iOS may report a service-only advertisement before the named scan response.
-          // Do not cache that incomplete advertisement as an unknown device.
-          const isUnnamedIOSPeripheral = Platform.OS === 'ios' && !displayName?.trim();
-          const isFindMyPeripheral =
-            isPro2FindMyAdvertisementName(device?.name) ||
-            isPro2FindMyAdvertisementName(device?.localName);
-          const isOneKey =
-            !isUnnamedIOSPeripheral &&
-            !isFindMyPeripheral &&
-            isOnekeyBluetoothDevice({
-              id: device?.id,
-              name: device?.name,
-              localName: device?.localName,
-              serviceUuids: device?.serviceUUIDs,
-            });
+          const isOneKey = isOnekeyBluetoothDevice({
+            id: device?.id,
+            name: device?.name,
+            localName: device?.localName,
+            serviceUuids: device?.serviceUUIDs,
+          });
           if (isOneKey) {
             addDevice(device as unknown as Device);
           } else if (displayName && /\bpro\s*2\b/i.test(displayName)) {
@@ -644,12 +681,7 @@ export default class ReactNativeBleTransport {
               'localName' in device && typeof device.localName === 'string'
                 ? device.localName
                 : null;
-            const isFindMyPeripheral =
-              isPro2FindMyAdvertisementName(device.name) ||
-              isPro2FindMyAdvertisementName(localName);
-
             if (
-              !isFindMyPeripheral &&
               isOnekeyBluetoothDevice({
                 id: device.id,
                 name: device.name,
@@ -698,7 +730,7 @@ export default class ReactNativeBleTransport {
     characteristics?: ResolvedBleCharacteristics
   ) {
     const { writeCharacteristic, notifyCharacteristic } =
-      characteristics ?? (await this.resolveCharacteristics(device));
+      characteristics ?? (await this.resolveCharacteristicsWithTimeout(uuid, device));
     const transport = new BleTransport(device, writeCharacteristic, notifyCharacteristic);
     if (Platform.OS === 'android') {
       transport.mtuSize = typeof device.mtu === 'number' ? device.mtu : transport.mtuSize;
@@ -802,15 +834,22 @@ export default class ReactNativeBleTransport {
     if (!device) {
       Log?.debug('try to connect to device: ', uuid);
       try {
-        device = await blePlxManager.connectToDevice(uuid, connectOptions);
+        device = await this.connectWithTimeout(uuid, () =>
+          blePlxManager.connectToDevice(uuid, connectOptions)
+        );
       } catch (e) {
         Log?.debug('try to connect to device has error: ', e);
+        if (isConnectTimeoutError(e)) {
+          throw e;
+        }
         if (
           e.errorCode === BleErrorCode.DeviceMTUChangeFailed ||
           e.errorCode === BleErrorCode.OperationCancelled
         ) {
           Log?.debug('first try to reconnect without params');
-          device = await blePlxManager.connectToDevice(uuid);
+          device = await this.connectWithTimeout(uuid, () =>
+            blePlxManager.connectToDevice(uuid, fallbackConnectOptions)
+          );
         } else if (e.errorCode === BleErrorCode.DeviceAlreadyConnected) {
           Log?.debug('device already connected');
           throw ERRORS.TypedError(HardwareErrorCode.BleAlreadyConnected);
@@ -826,26 +865,36 @@ export default class ReactNativeBleTransport {
 
     if (!(await device.isConnected())) {
       Log?.debug('not connected, try to connect to device: ', uuid);
+      const disconnectedDevice = device;
 
       try {
-        device = await device.connect(connectOptions);
+        device = await this.connectWithTimeout(uuid, () =>
+          disconnectedDevice.connect(connectOptions)
+        );
       } catch (e) {
         Log?.debug('not connected, try to connect to device has error: ', e);
+        if (isConnectTimeoutError(e)) {
+          throw e;
+        }
         if (
           e.errorCode === BleErrorCode.DeviceMTUChangeFailed ||
           e.errorCode === BleErrorCode.OperationCancelled
         ) {
           Log?.debug('second try to reconnect without params');
           try {
-            device = await device.connect();
+            device = await this.connectWithTimeout(uuid, () =>
+              disconnectedDevice.connect(fallbackConnectOptions)
+            );
           } catch (e) {
             Log?.debug('last try to reconnect error: ', e);
             // last try to reconnect device if this issue exists
             // https://github.com/dotintent/react-native-ble-plx/issues/426
             if (e.errorCode === BleErrorCode.OperationCancelled) {
               Log?.debug('last try to reconnect');
-              await device.cancelConnection();
-              device = await device.connect();
+              await disconnectedDevice.cancelConnection();
+              device = await this.connectWithTimeout(uuid, () =>
+                disconnectedDevice.connect(fallbackConnectOptions)
+              );
             }
           }
         } else {
@@ -856,9 +905,8 @@ export default class ReactNativeBleTransport {
 
     device = await requestAndroidMtu(device);
     const acquiredDevice = device;
-    const { writeCharacteristic, notifyCharacteristic } = await this.resolveCharacteristics(
-      acquiredDevice
-    );
+    const { writeCharacteristic, notifyCharacteristic } =
+      await this.resolveCharacteristicsWithTimeout(uuid, acquiredDevice);
 
     const protocolHint = expectedProtocol
       ? undefined
@@ -922,7 +970,7 @@ export default class ReactNativeBleTransport {
           Log?.debug('monitor error ignored for stale transport: ', uuid, notifyTransactionId);
           return;
         }
-        if (this.deviceProtocol.get(uuid) === 'V2') {
+        if (this.getActiveProtocol(uuid) === 'V2') {
           let errorCode:
             | typeof HardwareErrorCode.BleDeviceBondError
             | typeof HardwareErrorCode.BleCharacteristicNotifyError
@@ -992,7 +1040,7 @@ export default class ReactNativeBleTransport {
 
       try {
         const data = Buffer.from(c.value as string, 'base64');
-        const protocol = this.deviceProtocol.get(uuid);
+        const protocol = this.getActiveProtocol(uuid);
         if (!protocol) {
           Log?.debug('monitor data ignored before protocol detection: ', uuid);
           return;
@@ -1026,7 +1074,7 @@ export default class ReactNativeBleTransport {
       } catch (error) {
         Log?.debug('monitor data error: ', error);
         const notifyError = ERRORS.TypedError(HardwareErrorCode.BleWriteCharacteristicError);
-        if (this.deviceProtocol.get(uuid) === 'V2') {
+        if (this.getActiveProtocol(uuid) === 'V2') {
           this.rejectProtocolV2Frames(uuid, notifyError);
         } else if (this.runPromiseDeviceId === uuid) {
           this.runPromise?.reject(notifyError);
@@ -1090,6 +1138,7 @@ export default class ReactNativeBleTransport {
     }
 
     this.deviceProtocol.delete(uuid);
+    this.probingProtocols.delete(uuid);
     // Preserve a name-derived hint across disconnects so reconnect can probe V2 first.
     this.protocolV2Assemblers.get(uuid)?.reset();
     this.protocolV2Assemblers.delete(uuid);
@@ -1156,8 +1205,25 @@ export default class ReactNativeBleTransport {
     const transport = this.getCachedTransport(uuid);
     const runPromise = createDeferred<string>();
     runPromise.promise.catch(() => undefined);
+    const supersededRunPromise = this.runPromise;
+    if (supersededRunPromise) {
+      // Only forceRun calls (Initialize/Cancel) reach here with a pending call. Settle
+      // the superseded deferred now so its response race resolves and its finally block
+      // clears its timeout timer; an orphaned timer would otherwise fire much later and
+      // tear down the shared connection while another call is using it.
+      supersededRunPromise.reject(ERRORS.TypedError(HardwareErrorCode.BleForceCleanRunPromise));
+    }
     this.runPromise = runPromise;
     this.runPromiseDeviceId = uuid;
+    // A superseded call's late write failure must not clear the successor's ownership;
+    // only the call that still owns the slot may release it.
+    const releaseOwnershipIfCurrent = () => {
+      if (this.runPromise === runPromise) {
+        this.runPromise = null;
+        this.runPromiseDeviceId = null;
+      }
+    };
+    const isCurrentOwner = () => this.runPromise === runPromise;
     const messages = this._messages;
     const buffers = ProtocolV1.encodeTransportPackets(messages, name, data);
     let timeout: ReturnType<typeof setTimeout> | undefined;
@@ -1183,6 +1249,9 @@ export default class ReactNativeBleTransport {
             chunk = ByteBuffer.allocate(packetCapacity);
           } catch (e) {
             onError(e);
+            if (isWedgedWriteError(e)) {
+              throw e;
+            }
             throw ERRORS.TypedError(HardwareErrorCode.BleWriteCharacteristicError);
           }
         }
@@ -1214,6 +1283,9 @@ export default class ReactNativeBleTransport {
             }
           } catch (e) {
             onError(e);
+            if (isWedgedWriteError(e)) {
+              throw e;
+            }
             throw ERRORS.TypedError(HardwareErrorCode.BleWriteCharacteristicError);
           }
         }
@@ -1227,9 +1299,15 @@ export default class ReactNativeBleTransport {
     if (name === 'EmmcFileWrite') {
       await writeChunkedData(
         buffers,
-        data => transport.writeWithRetry(data),
+        data =>
+          this.writeBlePacket(
+            uuid,
+            data,
+            payload => transport.writeWithRetry(payload),
+            isCurrentOwner
+          ),
         e => {
-          this.runPromise = null;
+          releaseOwnershipIfCurrent();
           Log?.error('writeCharacteristic write error: ', e);
         }
       );
@@ -1250,7 +1328,12 @@ export default class ReactNativeBleTransport {
           // eslint-disable-next-line no-constant-condition
           while (true) {
             try {
-              await transport.writeWithRetry(data);
+              await this.writeBlePacket(
+                uuid,
+                data,
+                payload => transport.writeCharacteristic.writeWithoutResponse(payload),
+                isCurrentOwner
+              );
               return;
             } catch (error) {
               const retryType = getFirmwareUploadWriteRetryType(error);
@@ -1269,7 +1352,7 @@ export default class ReactNativeBleTransport {
           }
         },
         e => {
-          this.runPromise = null;
+          releaseOwnershipIfCurrent();
           Log?.error('writeCharacteristic write error: ', e);
         }
       );
@@ -1278,16 +1361,18 @@ export default class ReactNativeBleTransport {
         const outData = o.toString('base64');
         // Upload resources on low-end phones may OOM
         try {
-          const shouldUseWriteWithResponse =
-            Platform.OS === 'ios' && transport.writeCharacteristic.isWritableWithResponse;
-          if (shouldUseWriteWithResponse) {
-            await transport.writeCharacteristic.writeWithResponse(outData);
-          } else {
-            await transport.writeCharacteristic.writeWithoutResponse(outData);
-          }
+          await this.writeBlePacket(
+            uuid,
+            outData,
+            payload => transport.writeCharacteristic.writeWithoutResponse(payload),
+            isCurrentOwner
+          );
         } catch (e) {
           Log?.debug('writeCharacteristic write error: ', e);
-          this.runPromise = null;
+          releaseOwnershipIfCurrent();
+          if (isWedgedWriteError(e)) {
+            throw e;
+          }
           if (e.errorCode === BleErrorCode.DeviceDisconnected) {
             throw ERRORS.TypedError(HardwareErrorCode.BleDeviceNotBonded);
           } else if (e.errorCode === BleErrorCode.OperationStartFailed) {
@@ -1330,8 +1415,13 @@ export default class ReactNativeBleTransport {
       }
       const isProbeTimeout =
         name === 'GetFeatures' && options?.timeoutMs === PROTOCOL_PROBE_TIMEOUT_MS;
+      // A call that has been superseded (forceRun) or cleaned up no longer owns the
+      // transport; its late timeout must not tear down the connection the current
+      // call is actively using.
+      const isStaleCall = this.runPromise !== runPromise;
       if (
         !isProbeTimeout &&
+        !isStaleCall &&
         (e as { errorCode?: unknown })?.errorCode === HardwareErrorCode.BleTimeoutError
       ) {
         await this.disconnect(uuid);
@@ -1411,7 +1501,10 @@ export default class ReactNativeBleTransport {
       delete transportCache[session];
     }
     this.deviceProtocol.delete(session);
+    this.probingProtocols.delete(session);
     this.deviceProtocolHints.delete(session);
+    this.sessionProtocols.delete(session);
+    this.protocolReprobeFailures.delete(session);
     this.protocolV2Assemblers.delete(session);
     this.resetProtocolV2Frames(session);
 
@@ -1437,6 +1530,113 @@ export default class ReactNativeBleTransport {
     this.runPromiseDeviceId = null;
   }
 
+  /** Run a native connect under the JS backstop budget. */
+  private async connectWithTimeout<T>(uuid: string, connect: () => Promise<T>): Promise<T> {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let timedOut = false;
+    const pending = connect();
+    // The abandoned attempt keeps running; swallow its late outcome so it cannot
+    // surface as an unhandled rejection after we have already given up on it.
+    pending.catch(() => undefined);
+    try {
+      const result = await Promise.race([
+        pending,
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(() => {
+            timedOut = true;
+            reject(
+              ERRORS.TypedError(
+                HardwareErrorCode.BleConnectedError,
+                `BLE connect timeout after ${BLE_CONNECT_TIMEOUT_MS}ms for ${uuid}`
+              )
+            );
+          }, BLE_CONNECT_TIMEOUT_MS);
+        }),
+      ]);
+      return result;
+    } catch (error) {
+      if (timedOut || isNativeOperationTimeoutError(error)) {
+        this.abandonStalledConnection(uuid, timedOut ? 'connect-backstop' : 'connect-native');
+      }
+      throw error;
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+
+  /** Resolve the complete GATT shape under a budget so acquire() always settles. */
+  private async resolveCharacteristicsWithTimeout(
+    uuid: string,
+    device: Device
+  ): Promise<ResolvedBleCharacteristics> {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let timedOut = false;
+    const pending = this.resolveCharacteristics(device);
+    pending.catch(() => undefined);
+    try {
+      const result = await Promise.race([
+        pending,
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(() => {
+            timedOut = true;
+            reject(
+              ERRORS.TypedError(
+                HardwareErrorCode.BleConnectedError,
+                `BLE GATT setup timeout after ${BLE_GATT_SETUP_TIMEOUT_MS}ms for ${uuid}`
+              )
+            );
+          }, BLE_GATT_SETUP_TIMEOUT_MS);
+        }),
+      ]);
+      this.connectionSetupTimeoutCounts.delete(uuid);
+      return result;
+    } catch (error) {
+      if (timedOut || isNativeOperationTimeoutError(error)) {
+        this.abandonStalledConnection(uuid, timedOut ? 'gatt-backstop' : 'gatt-native');
+      }
+      throw error;
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+
+  /**
+   * Give up on a BLE setup operation the native layer did not settle. The abandoned
+   * operation still owns native connection/GATT state that can poison the next attempt,
+   * so it is cleared here without awaiting the same queue that stopped responding.
+   */
+  private abandonStalledConnection(
+    uuid: string,
+    stage: 'connect-backstop' | 'connect-native' | 'gatt-backstop' | 'gatt-native'
+  ) {
+    const timeouts = (this.connectionSetupTimeoutCounts.get(uuid) ?? 0) + 1;
+    this.connectionSetupTimeoutCounts.set(uuid, timeouts);
+    Log?.error('[ReactNativeBleTransport] BLE setup timed out:', uuid, {
+      stage,
+      setupTimeoutsSinceSuccess: timeouts,
+    });
+
+    this.blePlxManager?.cancelDeviceConnection(uuid).catch(() => {
+      // Rejects with "Operation was cancelled" while merely connecting — expected.
+    });
+    const stalled = transportCache[uuid];
+    if (stalled) {
+      delete transportCache[uuid];
+    }
+    this.deviceProtocol.delete(uuid);
+    this.probingProtocols.delete(uuid);
+    this.protocolV2Assemblers.delete(uuid);
+    this.resetProtocolV2Frames(uuid);
+
+    if (timeouts >= BLE_CONNECT_TIMEOUT_MANAGER_RESET_THRESHOLD) {
+      // BleManager.destroy() force-rejects every promise the native queue abandoned —
+      // the only JS-reachable way to settle them — and drops all cached peripherals.
+      Log?.error('[ReactNativeBleTransport] BLE setup wedged repeatedly, resetting BLE manager');
+      this.resetPlxManager();
+      this.connectionSetupTimeoutCounts.delete(uuid);
+    }
+  }
+
   private getCachedTransport(uuid: string) {
     const transport = transportCache[uuid];
     if (!transport) {
@@ -1445,6 +1645,107 @@ export default class ReactNativeBleTransport {
     return transport;
   }
 
+  /**
+   * Write one packet under a bounded budget. A write that never settles means the
+   * peripheral is wedged even though the GATT link still reports connected, so the
+   * link is torn down: releasing JS state alone would leave the poisoned peripheral
+   * cached and every later call would hang on it again.
+   */
+  private async writeBlePacket(
+    uuid: string,
+    data: string,
+    write: (payload: string) => Promise<unknown>,
+    isCurrentOwner?: () => boolean
+  ) {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let timedOut = false;
+    try {
+      await Promise.race([
+        write(data),
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(() => {
+            timedOut = true;
+            reject(
+              ERRORS.TypedError(
+                HardwareErrorCode.BleWriteCharacteristicError,
+                `BLE write timeout after ${BLE_WRITE_PACKET_TIMEOUT_MS}ms`
+              )
+            );
+          }, BLE_WRITE_PACKET_TIMEOUT_MS);
+        }),
+      ]);
+      this.writeTimeoutCounts.delete(uuid);
+    } catch (error) {
+      if (timedOut) {
+        // A superseded call's late write must not tear down the link the current
+        // call is using; only the owner of the transport may declare it dead.
+        if (isCurrentOwner && !isCurrentOwner()) {
+          Log?.debug('[ReactNativeBleTransport] stale BLE write timed out, link kept:', uuid);
+        } else {
+          this.tearDownWedgedLink(uuid);
+        }
+      }
+      throw error;
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+
+  /**
+   * Drop a link whose writes stopped completing. The JS state is purged synchronously
+   * so the next acquire() cannot reuse the dead transport, while the native teardown is
+   * intentionally NOT awaited: it talks to the very layer that just stopped settling
+   * promises, so awaiting it could hang exactly like the write it is recovering from.
+   */
+  private tearDownWedgedLink(uuid: string) {
+    const timeouts = (this.writeTimeoutCounts.get(uuid) ?? 0) + 1;
+    this.writeTimeoutCounts.set(uuid, timeouts);
+    Log?.error('[ReactNativeBleTransport] BLE write timed out, tearing down link:', uuid, {
+      consecutiveWriteTimeouts: timeouts,
+    });
+
+    const wedged = transportCache[uuid];
+    this.disconnect(uuid).catch(error => {
+      Log?.debug('[ReactNativeBleTransport] wedged link teardown failed (ignored):', error);
+    });
+    if (wedged && transportCache[uuid] === wedged) {
+      delete transportCache[uuid];
+    }
+    this.deviceProtocol.delete(uuid);
+    this.probingProtocols.delete(uuid);
+    this.protocolV2Assemblers.delete(uuid);
+    this.resetProtocolV2Frames(uuid);
+
+    if (timeouts >= BLE_WRITE_TIMEOUT_MANAGER_RESET_THRESHOLD) {
+      // Reconnecting reuses the same native peripheral object. When it stays wedged
+      // across attempts the poison lives in the BLE manager itself, and only a fresh
+      // manager drops every cached peripheral — the JS equivalent of restarting the app.
+      Log?.error('[ReactNativeBleTransport] BLE writes wedged repeatedly, resetting BLE manager');
+      this.resetPlxManager();
+      this.writeTimeoutCounts.delete(uuid);
+    }
+  }
+
+  private resetPlxManager() {
+    const manager = this.blePlxManager;
+    this.blePlxManager = undefined;
+    // Every cached transport belongs to the destroyed manager's peripherals.
+    Object.keys(transportCache).forEach(key => {
+      delete transportCache[key];
+    });
+    this.deviceProtocol.clear();
+    this.probingProtocols.clear();
+    this.sessionProtocols.clear();
+    this.protocolReprobeFailures.clear();
+    this.monitorTokens.clear();
+    this.protocolV2Assemblers.clear();
+    try {
+      manager?.destroy();
+    } catch (error) {
+      Log?.debug('[ReactNativeBleTransport] BLE manager destroy failed (ignored):', error);
+    }
+  }
+
   private createProtocolMismatchError(expected: ProtocolType) {
     return ERRORS.TypedError(
       HardwareErrorCode.RuntimeError,
@@ -1460,30 +1761,29 @@ export default class ReactNativeBleTransport {
   }
 
   private clearProbeProtocol(uuid: string, protocol: ProtocolType) {
+    if (this.probingProtocols.get(uuid) === protocol) {
+      this.probingProtocols.delete(uuid);
+    }
     if (this.deviceProtocol.get(uuid) === protocol) {
       this.deviceProtocol.delete(uuid);
     }
   }
 
+  /** Protocol to route a call with: confirmed if known, otherwise the one being probed. */
+  private getActiveProtocol(uuid: string): ProtocolType | undefined {
+    return this.deviceProtocol.get(uuid) ?? this.probingProtocols.get(uuid);
+  }
+
   private async detectProtocol(
     uuid: string,
     expectedProtocol?: ProtocolType,
     protocolHint?: ProtocolType,
     rebuildTransport?: () => Promise<void>
   ): Promise<ProtocolType> {
-    if (Platform.OS === 'ios' && expectedProtocol) {
-      this.deviceProtocol.set(uuid, expectedProtocol);
-      Log?.debug('[ReactNativeBleTransport] protocol selected', {
-        deviceId: uuid,
-        protocol: expectedProtocol,
-        source: 'expected',
-      });
-      return expectedProtocol;
-    }
-
     if (expectedProtocol === 'V1') {
       if (await this.probeProtocolV1(uuid)) {
         this.deviceProtocol.set(uuid, 'V1');
+        this.sessionProtocols.set(uuid, 'V1');
         Log?.debug('[ReactNativeBleTransport] protocol detected', {
           deviceId: uuid,
           protocol: 'V1',
@@ -1497,6 +1797,7 @@ export default class ReactNativeBleTransport {
     if (expectedProtocol === 'V2') {
       if (await this.probeProtocolV2(uuid)) {
         this.deviceProtocol.set(uuid, 'V2');
+        this.sessionProtocols.set(uuid, 'V2');
         Log?.debug('[ReactNativeBleTransport] protocol detected', {
           deviceId: uuid,
           protocol: 'V2',
@@ -1509,8 +1810,18 @@ export default class ReactNativeBleTransport {
 
     // Protocol must be actively probed after connection. Name, PID, and descriptors only
     // influence probe order; a V2 hint probes V2 first and falls back to V1.
-    const probeOrder: ProtocolType[] =
+    const sessionProtocol = this.sessionProtocols.get(uuid);
+    const reprobeFailures = this.protocolReprobeFailures.get(uuid) ?? 0;
+    const fullProbeOrder: ProtocolType[] =
       protocolHint === 'V2' || this.deviceProtocol.get(uuid) === 'V2' ? ['V2', 'V1'] : ['V1', 'V2'];
+    // A device that already answered on a protocol in this session keeps answering on
+    // it; while it is rebooting nothing answers at all, so probing the other protocol
+    // only adds its timeout to every poll.
+    const trustSessionProtocol =
+      sessionProtocol !== undefined &&
+      !protocolHint &&
+      reprobeFailures < PROTOCOL_REPROBE_FALLBACK_ATTEMPTS;
+    const probeOrder: ProtocolType[] = trustSessionProtocol ? [sessionProtocol] : fullProbeOrder;
 
     for (let i = 0; i < probeOrder.length; i += 1) {
       const protocol = probeOrder[i];
@@ -1528,6 +1839,8 @@ export default class ReactNativeBleTransport {
         protocol === 'V1' ? await this.probeProtocolV1(uuid) : await this.probeProtocolV2(uuid);
       if (detected) {
         this.deviceProtocol.set(uuid, protocol);
+        this.sessionProtocols.set(uuid, protocol);
+        this.protocolReprobeFailures.delete(uuid);
         Log?.debug('[ReactNativeBleTransport] protocol detected', {
           deviceId: uuid,
           protocol,
@@ -1537,7 +1850,16 @@ export default class ReactNativeBleTransport {
       }
     }
 
+    if (trustSessionProtocol) {
+      // Still silent on its own protocol: count it, and let the streak expire the
+      // shortcut so a device that genuinely switched protocols is found again.
+      this.protocolReprobeFailures.set(uuid, reprobeFailures + 1);
+    } else {
+      this.protocolReprobeFailures.delete(uuid);
+    }
+
     this.deviceProtocol.delete(uuid);
+    this.probingProtocols.delete(uuid);
     throw this.createProtocolDetectionError();
   }
 
@@ -1599,14 +1921,20 @@ export default class ReactNativeBleTransport {
     }
 
     try {
-      this.deviceProtocol.set(uuid, 'V1');
+      this.probingProtocols.set(uuid, 'V1');
       // GetFeatures identifies Protocol V1 without resetting an existing wallet
       // session before Core has a chance to restore a hidden wallet.
       await this.callProtocolV1(uuid, 'GetFeatures', {}, { timeoutMs: PROTOCOL_PROBE_TIMEOUT_MS });
+      this.probingProtocols.delete(uuid);
       return true;
     } catch (error) {
       this.clearProbeProtocol(uuid, 'V1');
       Log?.debug('[ReactNativeBleTransport] Protocol V1 GetFeatures probe failed:', error);
+      // A wedged write already dropped the link, so probing another protocol on it
+      // would only fail against a torn-down transport: surface the real cause.
+      if (isWedgedWriteError(error)) {
+        throw error;
+      }
       return false;
     }
   }
@@ -1616,7 +1944,7 @@ export default class ReactNativeBleTransport {
       return false;
     }
 
-    this.deviceProtocol.set(uuid, 'V2');
+    this.probingProtocols.set(uuid, 'V2');
     this.protocolV2Assemblers.get(uuid)?.reset();
     const detected = await probeProtocolV2Helper({
       call: (name: string, data: Record<string, unknown>, options?: TransportCallOptions) =>
@@ -1631,6 +1959,8 @@ export default class ReactNativeBleTransport {
     });
     if (!detected) {
       this.clearProbeProtocol(uuid, 'V2');
+    } else {
+      this.probingProtocols.delete(uuid);
     }
     return detected;
   }
@@ -1712,14 +2042,12 @@ export default class ReactNativeBleTransport {
   }
 
   private async writeProtocolV2Packet(
+    uuid: string,
     transport: BleTransport,
     base64: string,
     context: ProtocolV2CallContext,
     assertCurrentGeneration: () => void
   ) {
-    const shouldUseWriteWithResponse =
-      transport.writeCharacteristic.isWritableWithResponse &&
-      (context.writeWithResponse === true || (Platform.OS === 'ios' && !context.highVolume));
     let attempt = 0;
     for (;;) {
       assertCurrentGeneration();
@@ -1727,11 +2055,21 @@ export default class ReactNativeBleTransport {
         throw new Error(`Protocol V2 BLE write aborted for ${context.messageName}`);
       }
       try {
-        if (shouldUseWriteWithResponse) {
-          await transport.writeCharacteristic.writeWithResponse(base64);
-        } else {
-          await transport.writeCharacteristic.writeWithoutResponse(base64);
-        }
+        await this.writeBlePacket(
+          uuid,
+          base64,
+          payload => transport.writeCharacteristic.writeWithoutResponse(payload),
+          // Same rule as Protocol V1: a write from a superseded generation must not
+          // tear down the link that the current generation is using.
+          () => {
+            try {
+              assertCurrentGeneration();
+              return !context.signal.aborted;
+            } catch {
+              return false;
+            }
+          }
+        );
         assertCurrentGeneration();
         return;
       } catch (error) {
@@ -1754,6 +2092,7 @@ export default class ReactNativeBleTransport {
   }
 
   private async writeProtocolV2Frame(
+    uuid: string,
     transport: BleTransport,
     frame: Uint8Array,
     context: ProtocolV2CallContext,
@@ -1766,25 +2105,19 @@ export default class ReactNativeBleTransport {
       androidPacketLength: tuning.androidPacketLength,
       mtu: Platform.OS === 'android' ? transport.mtuSize : undefined,
     });
-    // Match Desktop BLE pacing so Pro2 firmware can finish the previous response
-    // before the next single-packet control command is written.
-    const initialDelayMs =
-      Platform.OS === 'ios' && !context.highVolume && frame.length <= packetCapacity
-        ? IOS_PROTOCOL_V2_CONTROL_WRITE_DELAY_MS
-        : 0;
     await writeProtocolV2BleFrame({
       frame,
       packetCapacity,
       assertActive: assertCurrentGeneration,
       signal: context.signal,
       abortMessage: `Protocol V2 BLE write aborted for ${context.messageName}`,
-      initialDelayMs,
       burstSize: FIRMWARE_UPLOAD_WRITE_BURST_SIZE,
       burstPauseMs: FIRMWARE_UPLOAD_WRITE_PAUSE_MS,
       flushDelayMs: FIRMWARE_UPLOAD_WRITE_FLUSH_DELAY_MS,
       wait: delay,
       writePacket: packet =>
         this.writeProtocolV2Packet(
+          uuid,
           transport,
           Buffer.from(packet).toString('base64'),
           context,
@@ -1810,7 +2143,7 @@ export default class ReactNativeBleTransport {
       const tuning = getProtocolV2BleTuning();
       Log?.debug('[ReactNativeBleTransport] Protocol V2 high-volume write configured', {
         name,
-        writeMode: options?.writeWithResponse ? 'withResponse' : 'withoutResponse',
+        writeMode: 'withoutResponse',
         packetCapacity: Platform.OS === 'ios' ? tuning.iosPacketLength : tuning.androidPacketLength,
       });
     }
@@ -1849,7 +2182,13 @@ export default class ReactNativeBleTransport {
       writeFrame: async (frame: Uint8Array, context: ProtocolV2CallContext) => {
         assertCurrentGeneration();
         const currentTransport = this.getCachedTransport(uuid);
-        await this.writeProtocolV2Frame(currentTransport, frame, context, assertCurrentGeneration);
+        await this.writeProtocolV2Frame(
+          uuid,
+          currentTransport,
+          frame,
+          context,
+          assertCurrentGeneration
+        );
       },
       readFrame: async () => {
         assertCurrentGeneration();
@@ -1874,6 +2213,6 @@ export default class ReactNativeBleTransport {
   }
 
   getProtocolType(path: string): ProtocolType | undefined {
-    return this.deviceProtocol.get(path);
+    return this.getActiveProtocol(path);
   }
 }