@onekeyfe/hd-transport-react-native 1.2.0-alpha.66 → 1.2.0-alpha.68

package/src/index.ts

@@ -135,6 +135,22 @@ const resolveFirmwareUploadRetryDelay = (attempt: number, baseDelayMs = 200, max
   Math.min(baseDelayMs * 2 ** attempt, maxDelayMs);
 const PROTOCOL_PROBE_TIMEOUT_MS = 1000;
 const PROTOCOL_V2_PROBE_TIMEOUT_MS = 10_000;
+/**
+ * Per-packet write budget. iOS only resolves writeWithoutResponse once CoreBluetooth
+ * reports the peripheral ready again; a peripheral wedged by its own firmware reboot
+ * stops reporting ready while staying connected, so the write promise never settles.
+ * Response timeouts cannot cover that — they are armed after the writes complete —
+ * and an unbounded write leaves the whole transport unusable until the process dies.
+ * A healthy packet completes in milliseconds, so this only fires on a dead link.
+ */
+export const BLE_WRITE_PACKET_TIMEOUT_MS = 10_000;
+const WEDGED_WRITE_MESSAGE = 'BLE write timeout after';
+const isWedgedWriteError = (error: unknown): boolean =>
+  (error as { errorCode?: unknown })?.errorCode === HardwareErrorCode.BleWriteCharacteristicError &&
+  typeof (error as { message?: unknown })?.message === 'string' &&
+  (error as { message: string }).message.startsWith(WEDGED_WRITE_MESSAGE);
+/** Consecutive wedged writes on one device before the BLE manager itself is recreated. */
+export const BLE_WRITE_TIMEOUT_MANAGER_RESET_THRESHOLD = 2;
 const DEVICE_SCAN_TIMEOUT_MS = 3000;
 const IOS_NOTIFY_READY_DELAY_MS = 150;
 const ANDROID_NOTIFY_READY_DELAY_MS = 300;
@@ -191,12 +207,52 @@ function getDeviceDisplayName(device?: Device | null) {
 
 const ANDROID_REQUEST_MTU = 256;
 
+const BLE_NATIVE_CONNECT_TIMEOUT_MS = 3000;
+
 const connectOptions: Record<string, unknown> = {
   requestMTU: ANDROID_REQUEST_MTU,
-  timeout: 3000,
+  timeout: BLE_NATIVE_CONNECT_TIMEOUT_MS,
   refreshGatt: 'OnConnected',
 };
 
+/** Fallback connect options: drops requestMTU (the thing being worked around) but keeps the native budget. */
+const fallbackConnectOptions: Record<string, unknown> = {
+  timeout: BLE_NATIVE_CONNECT_TIMEOUT_MS,
+};
+
+/**
+ * JS backstop for connect. The native adapter applies its own 3s budget, but it
+ * schedules that timeout on its serial queue, so a busy queue (e.g. right after a
+ * firmware install tears the link down) can leave the promise unsettled — observed
+ * blocking a reconnect for 61s until the app-level timeout. Healthy connects finish
+ * inside the native budget, so this only fires when the native timeout did not.
+ */
+export const BLE_CONNECT_TIMEOUT_MS = BLE_NATIVE_CONNECT_TIMEOUT_MS * 2 + 2000;
+/**
+ * Service discovery and characteristic resolution run after connect() succeeds, but
+ * CoreBluetooth schedules them on the same serial queue. If that queue is wedged by a
+ * device reboot, these calls can remain pending forever unless they have their own
+ * budget.
+ */
+export const BLE_GATT_SETUP_TIMEOUT_MS = 10_000;
+/**
+ * How many times a known device may fail its own protocol before we probe the others
+ * again. Reconnect polling during a device reboot repeats this every few seconds, and
+ * probing Protocol V2 costs a 10s Ping timeout, so paying it on every attempt for a
+ * device we just spoke V1 to dominates the wait. A firmware update can legitimately
+ * change a device's protocol, so the shortcut has to expire rather than stick.
+ */
+export const PROTOCOL_REPROBE_FALLBACK_ATTEMPTS = 3;
+/** BLE setup timeouts since the last successful setup before the manager is recreated. */
+export const BLE_CONNECT_TIMEOUT_MANAGER_RESET_THRESHOLD = 2;
+const CONNECT_TIMEOUT_MESSAGE = 'BLE connect timeout after';
+const isConnectTimeoutError = (error: unknown): boolean =>
+  (error as { errorCode?: unknown })?.errorCode === HardwareErrorCode.BleConnectedError &&
+  typeof (error as { message?: unknown })?.message === 'string' &&
+  (error as { message: string }).message.startsWith(CONNECT_TIMEOUT_MESSAGE);
+const isNativeOperationTimeoutError = (error: unknown): boolean =>
+  (error as { errorCode?: unknown })?.errorCode === BleErrorCode.OperationTimedOut;
+
 export type IOneKeyDevice = OneKeyDeviceInfoBase & Device;
 
 const tryToGetConfiguration = (device: Device) => {
@@ -285,8 +341,28 @@ export default class ReactNativeBleTransport {
   /** Per-device protocol type detected by active wire-level probe after connect. */
   private deviceProtocol: Map<string, ProtocolType> = new Map();
 
+  /**
+   * Protocol a probe is currently trying, before the device has confirmed it. Calls
+   * must route with it, but acquire() must not treat it as a detected protocol: a
+   * probe that never answers would otherwise leave the reuse fast path handing out a
+   * transport that was never validated.
+   */
+  private probingProtocols: Map<string, ProtocolType> = new Map();
+
+  /** Consecutive write timeouts per device; reset by any write that completes. */
+  private writeTimeoutCounts: Map<string, number> = new Map();
+
+  /** BLE setup timeouts per device since the last complete characteristic resolution. */
+  private connectionSetupTimeoutCounts: Map<string, number> = new Map();
+
   private deviceProtocolHints: Map<string, ProtocolType> = new Map();
 
+  /** Protocol this device actually answered on, kept across reconnects of one session. */
+  private sessionProtocols: Map<string, ProtocolType> = new Map();
+
+  /** Consecutive detections that failed while trusting sessionProtocols. */
+  private protocolReprobeFailures: Map<string, number> = new Map();
+
   private protocolV2Assemblers: Map<string, ProtocolV2FrameAssembler> = new Map();
 
   private protocolV2FrameQueues: Map<string, Uint8Array[]> = new Map();
@@ -504,22 +580,21 @@ export default class ReactNativeBleTransport {
       const isConnected = await device.isConnected().catch(() => false);
       if (!isConnected) {
         try {
-          device = await device.connect(connectOptions);
+          device = await this.connectWithTimeout(uuid, () => device.connect(connectOptions));
         } catch (e) {
           if (
             e.errorCode === BleErrorCode.DeviceMTUChangeFailed ||
             e.errorCode === BleErrorCode.OperationCancelled
           ) {
-            device = await device.connect();
+            device = await this.connectWithTimeout(uuid, () => device.connect());
           } else if (e.errorCode !== BleErrorCode.DeviceAlreadyConnected) {
             throw e;
           }
         }
       }
 
-      const { writeCharacteristic, notifyCharacteristic } = await this.resolveCharacteristics(
-        device
-      );
+      const { writeCharacteristic, notifyCharacteristic } =
+        await this.resolveCharacteristicsWithTimeout(uuid, device);
 
       transport.device = device;
       transport.writeCharacteristic = writeCharacteristic;
@@ -698,7 +773,7 @@ export default class ReactNativeBleTransport {
     characteristics?: ResolvedBleCharacteristics
   ) {
     const { writeCharacteristic, notifyCharacteristic } =
-      characteristics ?? (await this.resolveCharacteristics(device));
+      characteristics ?? (await this.resolveCharacteristicsWithTimeout(uuid, device));
     const transport = new BleTransport(device, writeCharacteristic, notifyCharacteristic);
     if (Platform.OS === 'android') {
       transport.mtuSize = typeof device.mtu === 'number' ? device.mtu : transport.mtuSize;
@@ -802,15 +877,22 @@ export default class ReactNativeBleTransport {
     if (!device) {
       Log?.debug('try to connect to device: ', uuid);
       try {
-        device = await blePlxManager.connectToDevice(uuid, connectOptions);
+        device = await this.connectWithTimeout(uuid, () =>
+          blePlxManager.connectToDevice(uuid, connectOptions)
+        );
       } catch (e) {
         Log?.debug('try to connect to device has error: ', e);
+        if (isConnectTimeoutError(e)) {
+          throw e;
+        }
         if (
           e.errorCode === BleErrorCode.DeviceMTUChangeFailed ||
           e.errorCode === BleErrorCode.OperationCancelled
         ) {
           Log?.debug('first try to reconnect without params');
-          device = await blePlxManager.connectToDevice(uuid);
+          device = await this.connectWithTimeout(uuid, () =>
+            blePlxManager.connectToDevice(uuid, fallbackConnectOptions)
+          );
         } else if (e.errorCode === BleErrorCode.DeviceAlreadyConnected) {
           Log?.debug('device already connected');
           throw ERRORS.TypedError(HardwareErrorCode.BleAlreadyConnected);
@@ -826,26 +908,36 @@ export default class ReactNativeBleTransport {
 
     if (!(await device.isConnected())) {
       Log?.debug('not connected, try to connect to device: ', uuid);
+      const disconnectedDevice = device;
 
       try {
-        device = await device.connect(connectOptions);
+        device = await this.connectWithTimeout(uuid, () =>
+          disconnectedDevice.connect(connectOptions)
+        );
       } catch (e) {
         Log?.debug('not connected, try to connect to device has error: ', e);
+        if (isConnectTimeoutError(e)) {
+          throw e;
+        }
         if (
           e.errorCode === BleErrorCode.DeviceMTUChangeFailed ||
           e.errorCode === BleErrorCode.OperationCancelled
         ) {
           Log?.debug('second try to reconnect without params');
           try {
-            device = await device.connect();
+            device = await this.connectWithTimeout(uuid, () =>
+              disconnectedDevice.connect(fallbackConnectOptions)
+            );
           } catch (e) {
             Log?.debug('last try to reconnect error: ', e);
             // last try to reconnect device if this issue exists
             // https://github.com/dotintent/react-native-ble-plx/issues/426
             if (e.errorCode === BleErrorCode.OperationCancelled) {
               Log?.debug('last try to reconnect');
-              await device.cancelConnection();
-              device = await device.connect();
+              await disconnectedDevice.cancelConnection();
+              device = await this.connectWithTimeout(uuid, () =>
+                disconnectedDevice.connect(fallbackConnectOptions)
+              );
             }
           }
         } else {
@@ -856,9 +948,8 @@ export default class ReactNativeBleTransport {
 
     device = await requestAndroidMtu(device);
     const acquiredDevice = device;
-    const { writeCharacteristic, notifyCharacteristic } = await this.resolveCharacteristics(
-      acquiredDevice
-    );
+    const { writeCharacteristic, notifyCharacteristic } =
+      await this.resolveCharacteristicsWithTimeout(uuid, acquiredDevice);
 
     const protocolHint = expectedProtocol
       ? undefined
@@ -922,7 +1013,7 @@ export default class ReactNativeBleTransport {
           Log?.debug('monitor error ignored for stale transport: ', uuid, notifyTransactionId);
           return;
         }
-        if (this.deviceProtocol.get(uuid) === 'V2') {
+        if (this.getActiveProtocol(uuid) === 'V2') {
           let errorCode:
             | typeof HardwareErrorCode.BleDeviceBondError
             | typeof HardwareErrorCode.BleCharacteristicNotifyError
@@ -992,7 +1083,7 @@ export default class ReactNativeBleTransport {
 
       try {
         const data = Buffer.from(c.value as string, 'base64');
-        const protocol = this.deviceProtocol.get(uuid);
+        const protocol = this.getActiveProtocol(uuid);
         if (!protocol) {
           Log?.debug('monitor data ignored before protocol detection: ', uuid);
           return;
@@ -1026,7 +1117,7 @@ export default class ReactNativeBleTransport {
       } catch (error) {
         Log?.debug('monitor data error: ', error);
         const notifyError = ERRORS.TypedError(HardwareErrorCode.BleWriteCharacteristicError);
-        if (this.deviceProtocol.get(uuid) === 'V2') {
+        if (this.getActiveProtocol(uuid) === 'V2') {
           this.rejectProtocolV2Frames(uuid, notifyError);
         } else if (this.runPromiseDeviceId === uuid) {
           this.runPromise?.reject(notifyError);
@@ -1090,6 +1181,7 @@ export default class ReactNativeBleTransport {
     }
 
     this.deviceProtocol.delete(uuid);
+    this.probingProtocols.delete(uuid);
     // Preserve a name-derived hint across disconnects so reconnect can probe V2 first.
     this.protocolV2Assemblers.get(uuid)?.reset();
     this.protocolV2Assemblers.delete(uuid);
@@ -1156,8 +1248,25 @@ export default class ReactNativeBleTransport {
     const transport = this.getCachedTransport(uuid);
     const runPromise = createDeferred<string>();
     runPromise.promise.catch(() => undefined);
+    const supersededRunPromise = this.runPromise;
+    if (supersededRunPromise) {
+      // Only forceRun calls (Initialize/Cancel) reach here with a pending call. Settle
+      // the superseded deferred now so its response race resolves and its finally block
+      // clears its timeout timer; an orphaned timer would otherwise fire much later and
+      // tear down the shared connection while another call is using it.
+      supersededRunPromise.reject(ERRORS.TypedError(HardwareErrorCode.BleForceCleanRunPromise));
+    }
     this.runPromise = runPromise;
     this.runPromiseDeviceId = uuid;
+    // A superseded call's late write failure must not clear the successor's ownership;
+    // only the call that still owns the slot may release it.
+    const releaseOwnershipIfCurrent = () => {
+      if (this.runPromise === runPromise) {
+        this.runPromise = null;
+        this.runPromiseDeviceId = null;
+      }
+    };
+    const isCurrentOwner = () => this.runPromise === runPromise;
     const messages = this._messages;
     const buffers = ProtocolV1.encodeTransportPackets(messages, name, data);
     let timeout: ReturnType<typeof setTimeout> | undefined;
@@ -1183,6 +1292,9 @@ export default class ReactNativeBleTransport {
             chunk = ByteBuffer.allocate(packetCapacity);
           } catch (e) {
             onError(e);
+            if (isWedgedWriteError(e)) {
+              throw e;
+            }
             throw ERRORS.TypedError(HardwareErrorCode.BleWriteCharacteristicError);
           }
         }
@@ -1214,6 +1326,9 @@ export default class ReactNativeBleTransport {
             }
           } catch (e) {
             onError(e);
+            if (isWedgedWriteError(e)) {
+              throw e;
+            }
             throw ERRORS.TypedError(HardwareErrorCode.BleWriteCharacteristicError);
           }
         }
@@ -1227,9 +1342,15 @@ export default class ReactNativeBleTransport {
     if (name === 'EmmcFileWrite') {
       await writeChunkedData(
         buffers,
-        data => transport.writeWithRetry(data),
+        data =>
+          this.writeBlePacket(
+            uuid,
+            data,
+            payload => transport.writeWithRetry(payload),
+            isCurrentOwner
+          ),
         e => {
-          this.runPromise = null;
+          releaseOwnershipIfCurrent();
           Log?.error('writeCharacteristic write error: ', e);
         }
       );
@@ -1250,7 +1371,12 @@ export default class ReactNativeBleTransport {
           // eslint-disable-next-line no-constant-condition
           while (true) {
             try {
-              await transport.writeWithRetry(data);
+              await this.writeBlePacket(
+                uuid,
+                data,
+                payload => transport.writeWithRetry(payload),
+                isCurrentOwner
+              );
               return;
             } catch (error) {
               const retryType = getFirmwareUploadWriteRetryType(error);
@@ -1269,7 +1395,7 @@ export default class ReactNativeBleTransport {
           }
         },
         e => {
-          this.runPromise = null;
+          releaseOwnershipIfCurrent();
           Log?.error('writeCharacteristic write error: ', e);
         }
       );
@@ -1280,14 +1406,21 @@ export default class ReactNativeBleTransport {
         try {
           const shouldUseWriteWithResponse =
             Platform.OS === 'ios' && transport.writeCharacteristic.isWritableWithResponse;
-          if (shouldUseWriteWithResponse) {
-            await transport.writeCharacteristic.writeWithResponse(outData);
-          } else {
-            await transport.writeCharacteristic.writeWithoutResponse(outData);
-          }
+          await this.writeBlePacket(
+            uuid,
+            outData,
+            payload =>
+              shouldUseWriteWithResponse
+                ? transport.writeCharacteristic.writeWithResponse(payload)
+                : transport.writeCharacteristic.writeWithoutResponse(payload),
+            isCurrentOwner
+          );
         } catch (e) {
           Log?.debug('writeCharacteristic write error: ', e);
-          this.runPromise = null;
+          releaseOwnershipIfCurrent();
+          if (isWedgedWriteError(e)) {
+            throw e;
+          }
           if (e.errorCode === BleErrorCode.DeviceDisconnected) {
             throw ERRORS.TypedError(HardwareErrorCode.BleDeviceNotBonded);
           } else if (e.errorCode === BleErrorCode.OperationStartFailed) {
@@ -1330,8 +1463,13 @@ export default class ReactNativeBleTransport {
       }
       const isProbeTimeout =
         name === 'GetFeatures' && options?.timeoutMs === PROTOCOL_PROBE_TIMEOUT_MS;
+      // A call that has been superseded (forceRun) or cleaned up no longer owns the
+      // transport; its late timeout must not tear down the connection the current
+      // call is actively using.
+      const isStaleCall = this.runPromise !== runPromise;
       if (
         !isProbeTimeout &&
+        !isStaleCall &&
         (e as { errorCode?: unknown })?.errorCode === HardwareErrorCode.BleTimeoutError
       ) {
         await this.disconnect(uuid);
@@ -1411,7 +1549,10 @@ export default class ReactNativeBleTransport {
       delete transportCache[session];
     }
     this.deviceProtocol.delete(session);
+    this.probingProtocols.delete(session);
     this.deviceProtocolHints.delete(session);
+    this.sessionProtocols.delete(session);
+    this.protocolReprobeFailures.delete(session);
     this.protocolV2Assemblers.delete(session);
     this.resetProtocolV2Frames(session);
 
@@ -1437,6 +1578,113 @@ export default class ReactNativeBleTransport {
     this.runPromiseDeviceId = null;
   }
 
+  /** Run a native connect under the JS backstop budget. */
+  private async connectWithTimeout<T>(uuid: string, connect: () => Promise<T>): Promise<T> {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let timedOut = false;
+    const pending = connect();
+    // The abandoned attempt keeps running; swallow its late outcome so it cannot
+    // surface as an unhandled rejection after we have already given up on it.
+    pending.catch(() => undefined);
+    try {
+      const result = await Promise.race([
+        pending,
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(() => {
+            timedOut = true;
+            reject(
+              ERRORS.TypedError(
+                HardwareErrorCode.BleConnectedError,
+                `BLE connect timeout after ${BLE_CONNECT_TIMEOUT_MS}ms for ${uuid}`
+              )
+            );
+          }, BLE_CONNECT_TIMEOUT_MS);
+        }),
+      ]);
+      return result;
+    } catch (error) {
+      if (timedOut || isNativeOperationTimeoutError(error)) {
+        this.abandonStalledConnection(uuid, timedOut ? 'connect-backstop' : 'connect-native');
+      }
+      throw error;
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+
+  /** Resolve the complete GATT shape under a budget so acquire() always settles. */
+  private async resolveCharacteristicsWithTimeout(
+    uuid: string,
+    device: Device
+  ): Promise<ResolvedBleCharacteristics> {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let timedOut = false;
+    const pending = this.resolveCharacteristics(device);
+    pending.catch(() => undefined);
+    try {
+      const result = await Promise.race([
+        pending,
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(() => {
+            timedOut = true;
+            reject(
+              ERRORS.TypedError(
+                HardwareErrorCode.BleConnectedError,
+                `BLE GATT setup timeout after ${BLE_GATT_SETUP_TIMEOUT_MS}ms for ${uuid}`
+              )
+            );
+          }, BLE_GATT_SETUP_TIMEOUT_MS);
+        }),
+      ]);
+      this.connectionSetupTimeoutCounts.delete(uuid);
+      return result;
+    } catch (error) {
+      if (timedOut || isNativeOperationTimeoutError(error)) {
+        this.abandonStalledConnection(uuid, timedOut ? 'gatt-backstop' : 'gatt-native');
+      }
+      throw error;
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+
+  /**
+   * Give up on a BLE setup operation the native layer did not settle. The abandoned
+   * operation still owns native connection/GATT state that can poison the next attempt,
+   * so it is cleared here without awaiting the same queue that stopped responding.
+   */
+  private abandonStalledConnection(
+    uuid: string,
+    stage: 'connect-backstop' | 'connect-native' | 'gatt-backstop' | 'gatt-native'
+  ) {
+    const timeouts = (this.connectionSetupTimeoutCounts.get(uuid) ?? 0) + 1;
+    this.connectionSetupTimeoutCounts.set(uuid, timeouts);
+    Log?.error('[ReactNativeBleTransport] BLE setup timed out:', uuid, {
+      stage,
+      setupTimeoutsSinceSuccess: timeouts,
+    });
+
+    this.blePlxManager?.cancelDeviceConnection(uuid).catch(() => {
+      // Rejects with "Operation was cancelled" while merely connecting — expected.
+    });
+    const stalled = transportCache[uuid];
+    if (stalled) {
+      delete transportCache[uuid];
+    }
+    this.deviceProtocol.delete(uuid);
+    this.probingProtocols.delete(uuid);
+    this.protocolV2Assemblers.delete(uuid);
+    this.resetProtocolV2Frames(uuid);
+
+    if (timeouts >= BLE_CONNECT_TIMEOUT_MANAGER_RESET_THRESHOLD) {
+      // BleManager.destroy() force-rejects every promise the native queue abandoned —
+      // the only JS-reachable way to settle them — and drops all cached peripherals.
+      Log?.error('[ReactNativeBleTransport] BLE setup wedged repeatedly, resetting BLE manager');
+      this.resetPlxManager();
+      this.connectionSetupTimeoutCounts.delete(uuid);
+    }
+  }
+
   private getCachedTransport(uuid: string) {
     const transport = transportCache[uuid];
     if (!transport) {
@@ -1445,6 +1693,107 @@ export default class ReactNativeBleTransport {
     return transport;
   }
 
+  /**
+   * Write one packet under a bounded budget. A write that never settles means the
+   * peripheral is wedged even though the GATT link still reports connected, so the
+   * link is torn down: releasing JS state alone would leave the poisoned peripheral
+   * cached and every later call would hang on it again.
+   */
+  private async writeBlePacket(
+    uuid: string,
+    data: string,
+    write: (payload: string) => Promise<unknown>,
+    isCurrentOwner?: () => boolean
+  ) {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let timedOut = false;
+    try {
+      await Promise.race([
+        write(data),
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(() => {
+            timedOut = true;
+            reject(
+              ERRORS.TypedError(
+                HardwareErrorCode.BleWriteCharacteristicError,
+                `BLE write timeout after ${BLE_WRITE_PACKET_TIMEOUT_MS}ms`
+              )
+            );
+          }, BLE_WRITE_PACKET_TIMEOUT_MS);
+        }),
+      ]);
+      this.writeTimeoutCounts.delete(uuid);
+    } catch (error) {
+      if (timedOut) {
+        // A superseded call's late write must not tear down the link the current
+        // call is using; only the owner of the transport may declare it dead.
+        if (isCurrentOwner && !isCurrentOwner()) {
+          Log?.debug('[ReactNativeBleTransport] stale BLE write timed out, link kept:', uuid);
+        } else {
+          this.tearDownWedgedLink(uuid);
+        }
+      }
+      throw error;
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+
+  /**
+   * Drop a link whose writes stopped completing. The JS state is purged synchronously
+   * so the next acquire() cannot reuse the dead transport, while the native teardown is
+   * intentionally NOT awaited: it talks to the very layer that just stopped settling
+   * promises, so awaiting it could hang exactly like the write it is recovering from.
+   */
+  private tearDownWedgedLink(uuid: string) {
+    const timeouts = (this.writeTimeoutCounts.get(uuid) ?? 0) + 1;
+    this.writeTimeoutCounts.set(uuid, timeouts);
+    Log?.error('[ReactNativeBleTransport] BLE write timed out, tearing down link:', uuid, {
+      consecutiveWriteTimeouts: timeouts,
+    });
+
+    const wedged = transportCache[uuid];
+    this.disconnect(uuid).catch(error => {
+      Log?.debug('[ReactNativeBleTransport] wedged link teardown failed (ignored):', error);
+    });
+    if (wedged && transportCache[uuid] === wedged) {
+      delete transportCache[uuid];
+    }
+    this.deviceProtocol.delete(uuid);
+    this.probingProtocols.delete(uuid);
+    this.protocolV2Assemblers.delete(uuid);
+    this.resetProtocolV2Frames(uuid);
+
+    if (timeouts >= BLE_WRITE_TIMEOUT_MANAGER_RESET_THRESHOLD) {
+      // Reconnecting reuses the same native peripheral object. When it stays wedged
+      // across attempts the poison lives in the BLE manager itself, and only a fresh
+      // manager drops every cached peripheral — the JS equivalent of restarting the app.
+      Log?.error('[ReactNativeBleTransport] BLE writes wedged repeatedly, resetting BLE manager');
+      this.resetPlxManager();
+      this.writeTimeoutCounts.delete(uuid);
+    }
+  }
+
+  private resetPlxManager() {
+    const manager = this.blePlxManager;
+    this.blePlxManager = undefined;
+    // Every cached transport belongs to the destroyed manager's peripherals.
+    Object.keys(transportCache).forEach(key => {
+      delete transportCache[key];
+    });
+    this.deviceProtocol.clear();
+    this.probingProtocols.clear();
+    this.sessionProtocols.clear();
+    this.protocolReprobeFailures.clear();
+    this.monitorTokens.clear();
+    this.protocolV2Assemblers.clear();
+    try {
+      manager?.destroy();
+    } catch (error) {
+      Log?.debug('[ReactNativeBleTransport] BLE manager destroy failed (ignored):', error);
+    }
+  }
+
   private createProtocolMismatchError(expected: ProtocolType) {
     return ERRORS.TypedError(
       HardwareErrorCode.RuntimeError,
@@ -1460,11 +1809,19 @@ export default class ReactNativeBleTransport {
   }
 
   private clearProbeProtocol(uuid: string, protocol: ProtocolType) {
+    if (this.probingProtocols.get(uuid) === protocol) {
+      this.probingProtocols.delete(uuid);
+    }
     if (this.deviceProtocol.get(uuid) === protocol) {
       this.deviceProtocol.delete(uuid);
     }
   }
 
+  /** Protocol to route a call with: confirmed if known, otherwise the one being probed. */
+  private getActiveProtocol(uuid: string): ProtocolType | undefined {
+    return this.deviceProtocol.get(uuid) ?? this.probingProtocols.get(uuid);
+  }
+
   private async detectProtocol(
     uuid: string,
     expectedProtocol?: ProtocolType,
@@ -1484,6 +1841,7 @@ export default class ReactNativeBleTransport {
     if (expectedProtocol === 'V1') {
       if (await this.probeProtocolV1(uuid)) {
         this.deviceProtocol.set(uuid, 'V1');
+        this.sessionProtocols.set(uuid, 'V1');
         Log?.debug('[ReactNativeBleTransport] protocol detected', {
           deviceId: uuid,
           protocol: 'V1',
@@ -1497,6 +1855,7 @@ export default class ReactNativeBleTransport {
     if (expectedProtocol === 'V2') {
       if (await this.probeProtocolV2(uuid)) {
         this.deviceProtocol.set(uuid, 'V2');
+        this.sessionProtocols.set(uuid, 'V2');
         Log?.debug('[ReactNativeBleTransport] protocol detected', {
           deviceId: uuid,
           protocol: 'V2',
@@ -1509,8 +1868,18 @@ export default class ReactNativeBleTransport {
 
     // Protocol must be actively probed after connection. Name, PID, and descriptors only
     // influence probe order; a V2 hint probes V2 first and falls back to V1.
-    const probeOrder: ProtocolType[] =
+    const sessionProtocol = this.sessionProtocols.get(uuid);
+    const reprobeFailures = this.protocolReprobeFailures.get(uuid) ?? 0;
+    const fullProbeOrder: ProtocolType[] =
       protocolHint === 'V2' || this.deviceProtocol.get(uuid) === 'V2' ? ['V2', 'V1'] : ['V1', 'V2'];
+    // A device that already answered on a protocol in this session keeps answering on
+    // it; while it is rebooting nothing answers at all, so probing the other protocol
+    // only adds its timeout to every poll.
+    const trustSessionProtocol =
+      sessionProtocol !== undefined &&
+      !protocolHint &&
+      reprobeFailures < PROTOCOL_REPROBE_FALLBACK_ATTEMPTS;
+    const probeOrder: ProtocolType[] = trustSessionProtocol ? [sessionProtocol] : fullProbeOrder;
 
     for (let i = 0; i < probeOrder.length; i += 1) {
       const protocol = probeOrder[i];
@@ -1528,6 +1897,8 @@ export default class ReactNativeBleTransport {
         protocol === 'V1' ? await this.probeProtocolV1(uuid) : await this.probeProtocolV2(uuid);
       if (detected) {
         this.deviceProtocol.set(uuid, protocol);
+        this.sessionProtocols.set(uuid, protocol);
+        this.protocolReprobeFailures.delete(uuid);
         Log?.debug('[ReactNativeBleTransport] protocol detected', {
           deviceId: uuid,
           protocol,
@@ -1537,7 +1908,16 @@ export default class ReactNativeBleTransport {
       }
     }
 
+    if (trustSessionProtocol) {
+      // Still silent on its own protocol: count it, and let the streak expire the
+      // shortcut so a device that genuinely switched protocols is found again.
+      this.protocolReprobeFailures.set(uuid, reprobeFailures + 1);
+    } else {
+      this.protocolReprobeFailures.delete(uuid);
+    }
+
     this.deviceProtocol.delete(uuid);
+    this.probingProtocols.delete(uuid);
     throw this.createProtocolDetectionError();
   }
 
@@ -1599,14 +1979,20 @@ export default class ReactNativeBleTransport {
     }
 
     try {
-      this.deviceProtocol.set(uuid, 'V1');
+      this.probingProtocols.set(uuid, 'V1');
       // GetFeatures identifies Protocol V1 without resetting an existing wallet
       // session before Core has a chance to restore a hidden wallet.
       await this.callProtocolV1(uuid, 'GetFeatures', {}, { timeoutMs: PROTOCOL_PROBE_TIMEOUT_MS });
+      this.probingProtocols.delete(uuid);
       return true;
     } catch (error) {
       this.clearProbeProtocol(uuid, 'V1');
       Log?.debug('[ReactNativeBleTransport] Protocol V1 GetFeatures probe failed:', error);
+      // A wedged write already dropped the link, so probing another protocol on it
+      // would only fail against a torn-down transport: surface the real cause.
+      if (isWedgedWriteError(error)) {
+        throw error;
+      }
       return false;
     }
   }
@@ -1616,7 +2002,7 @@ export default class ReactNativeBleTransport {
       return false;
     }
 
-    this.deviceProtocol.set(uuid, 'V2');
+    this.probingProtocols.set(uuid, 'V2');
     this.protocolV2Assemblers.get(uuid)?.reset();
     const detected = await probeProtocolV2Helper({
       call: (name: string, data: Record<string, unknown>, options?: TransportCallOptions) =>
@@ -1631,6 +2017,8 @@ export default class ReactNativeBleTransport {
     });
     if (!detected) {
       this.clearProbeProtocol(uuid, 'V2');
+    } else {
+      this.probingProtocols.delete(uuid);
     }
     return detected;
   }
@@ -1712,6 +2100,7 @@ export default class ReactNativeBleTransport {
   }
 
   private async writeProtocolV2Packet(
+    uuid: string,
     transport: BleTransport,
     base64: string,
     context: ProtocolV2CallContext,
@@ -1727,11 +2116,24 @@ export default class ReactNativeBleTransport {
         throw new Error(`Protocol V2 BLE write aborted for ${context.messageName}`);
       }
       try {
-        if (shouldUseWriteWithResponse) {
-          await transport.writeCharacteristic.writeWithResponse(base64);
-        } else {
-          await transport.writeCharacteristic.writeWithoutResponse(base64);
-        }
+        await this.writeBlePacket(
+          uuid,
+          base64,
+          payload =>
+            shouldUseWriteWithResponse
+              ? transport.writeCharacteristic.writeWithResponse(payload)
+              : transport.writeCharacteristic.writeWithoutResponse(payload),
+          // Same rule as Protocol V1: a write from a superseded generation must not
+          // tear down the link that the current generation is using.
+          () => {
+            try {
+              assertCurrentGeneration();
+              return !context.signal.aborted;
+            } catch {
+              return false;
+            }
+          }
+        );
         assertCurrentGeneration();
         return;
       } catch (error) {
@@ -1754,6 +2156,7 @@ export default class ReactNativeBleTransport {
   }
 
   private async writeProtocolV2Frame(
+    uuid: string,
     transport: BleTransport,
     frame: Uint8Array,
     context: ProtocolV2CallContext,
@@ -1785,6 +2188,7 @@ export default class ReactNativeBleTransport {
       wait: delay,
       writePacket: packet =>
         this.writeProtocolV2Packet(
+          uuid,
           transport,
           Buffer.from(packet).toString('base64'),
           context,
@@ -1849,7 +2253,13 @@ export default class ReactNativeBleTransport {
       writeFrame: async (frame: Uint8Array, context: ProtocolV2CallContext) => {
         assertCurrentGeneration();
         const currentTransport = this.getCachedTransport(uuid);
-        await this.writeProtocolV2Frame(currentTransport, frame, context, assertCurrentGeneration);
+        await this.writeProtocolV2Frame(
+          uuid,
+          currentTransport,
+          frame,
+          context,
+          assertCurrentGeneration
+        );
       },
       readFrame: async () => {
         assertCurrentGeneration();
@@ -1874,6 +2284,6 @@ export default class ReactNativeBleTransport {
   }
 
   getProtocolType(path: string): ProtocolType | undefined {
-    return this.deviceProtocol.get(path);
+    return this.getActiveProtocol(path);
   }
 }