@onekeyfe/hd-transport-react-native 1.2.2-alpha.114 → 1.2.2-alpha.116

package/src/index.ts

@@ -185,7 +185,10 @@ const shouldRethrowProtocolProbeError = (error: unknown): boolean => {
     code === HardwareErrorCode.BleDeviceDisconnected ||
     code === HardwareErrorCode.BleCharacteristicNotifyError ||
     code === HardwareErrorCode.BleCharacteristicNotifyChangeFailure ||
-    code === HardwareErrorCode.BleWriteCharacteristicError
+    code === HardwareErrorCode.BleWriteCharacteristicError ||
+    // A link stuck at the default MTU cannot answer Protocol V2 at all; reporting it as a
+    // probe miss would send detection on to report a protocol mismatch instead.
+    isProtocolV2DefaultMtuError(error)
   );
 };
 /** Consecutive wedged writes on one device before the BLE manager itself is recreated. */
@@ -261,6 +264,104 @@ const fallbackConnectOptions: Record<string, unknown> = {
   timeout: BLE_NATIVE_CONNECT_TIMEOUT_MS,
 };
 
+/**
+ * Android connects with the bare native budget: no MTU request and no GATT cache refresh
+ * inside that timer. ble-plx runs establishConnection -> refreshGatt -> requestMtu under one
+ * timeout, and refreshGatt makes the Android stack rediscover every service at the default
+ * 23-byte MTU before the MTU request can leave the ATT queue. A Pro 2 needs 2-5s for that
+ * rediscovery, so the budget expired with the request still unsent. Closing the client then
+ * left the exchange marked in progress for the whole LE link, and the stack parked every
+ * later MTU request on it ("Put conn_id on wait list"; btsnoop showed no Exchange MTU
+ * Request on the air). The MTU is negotiated as a separate first step instead.
+ */
+const androidConnectOptions: Record<string, unknown> = {
+  timeout: BLE_NATIVE_CONNECT_TIMEOUT_MS,
+};
+
+/**
+ * Only used when the cached GATT table is known or likely to be stale; the rediscovery it
+ * starts is then allowed to finish before the MTU exchange instead of racing it.
+ */
+const androidRefreshGattConnectOptions: Record<string, unknown> = {
+  timeout: BLE_NATIVE_CONNECT_TIMEOUT_MS,
+  refreshGatt: 'OnConnected',
+};
+
+/**
+ * Bound for the Android MTU exchange. A healthy exchange with a Pro 2 completes in ~50ms.
+ * When the phone has no cached GATT table (first connect after bonding, or a connect after
+ * an aborted discovery) the stack runs its own discovery first and only executes the MTU
+ * request after it; single passes on a Pro 2 at MTU 23 measured 1.7-4.8s and a refresh
+ * plus restart 7.7s, so the bound has to sit well above those. An exchange the stack holds
+ * as already in progress never completes, so a longer bound costs nothing on that link.
+ */
+export const ANDROID_MTU_EXCHANGE_TIMEOUT_MS = 12_000;
+
+/**
+ * Android keeps an LE link up for its GATT link idle timer (4s) after the last client
+ * closes, and per-link ATT state such as a pending MTU exchange lives as long as the link.
+ * A reconnect inside that window attaches to the same link. The only connectivity signal
+ * reachable from here, BluetoothManager.getConnectedDevices(GATT), is built from the
+ * per-app GATT client registry rather than the LE link: it empties the moment this client
+ * closes on phones with no resident GATT server, and stays populated for the life of the
+ * link on phones that have one. So an unusable link is held for at least the quiet period
+ * (past the idle timer), and additionally until that registry no longer lists the device,
+ * within the overall bound.
+ */
+export const ANDROID_LINK_DROP_QUIET_MS = 5000;
+export const ANDROID_LINK_DROP_TIMEOUT_MS = 8000;
+const ANDROID_LINK_DROP_POLL_MS = 250;
+
+/**
+ * Nothing works at the default 23-byte ATT MTU on Android. Protocol V1 writes 192-byte
+ * packets whatever the MTU, and a Pro 2 answers Protocol V2 with a single ATT_MTU-3
+ * notification and never sends the rest of the frame, so the 29-byte reply to a probe Ping
+ * arrives as 20 bytes declaring 29 and the call hangs. Only a known default MTU counts; an
+ * unknown value keeps the existing conservative-packet behaviour.
+ */
+const isKnownDefaultMtu = (mtu: unknown): boolean =>
+  typeof mtu === 'number' && Number.isFinite(mtu) && mtu <= 23;
+const DEFAULT_MTU_LINK_MESSAGE = 'BLE link stayed at the default MTU';
+const createDefaultMtuLinkError = (mtu: unknown) =>
+  ERRORS.TypedError(
+    HardwareErrorCode.BleConnectedError,
+    `${DEFAULT_MTU_LINK_MESSAGE} ${String(mtu)}, reconnecting on a fresh link`
+  );
+const PROTOCOL_V2_DEFAULT_MTU_MESSAGE = 'Protocol V2 needs a negotiated BLE MTU';
+const isProtocolV2DefaultMtuError = (error: unknown): boolean =>
+  (error as { errorCode?: unknown })?.errorCode === HardwareErrorCode.BleConnectedError &&
+  typeof (error as { message?: unknown })?.message === 'string' &&
+  (error as { message: string }).message.startsWith(PROTOCOL_V2_DEFAULT_MTU_MESSAGE);
+const createProtocolV2DefaultMtuError = (mtu: unknown) =>
+  ERRORS.TypedError(
+    HardwareErrorCode.BleConnectedError,
+    `${PROTOCOL_V2_DEFAULT_MTU_MESSAGE}, current MTU ${String(mtu)}`
+  );
+
+/**
+ * Symptoms of a cached GATT table that no longer matches the device. The UUIDs still
+ * resolve from the cache in the firmware-upgrade case, so the stale handles surface at
+ * discovery (missing or mis-typed characteristic) or when notifications are enabled.
+ */
+const isMissingGattShapeError = (error: unknown): boolean => {
+  const code = (error as { errorCode?: unknown })?.errorCode;
+  const message = (error as { message?: unknown })?.message;
+  return (
+    code === HardwareErrorCode.BleServiceNotFound ||
+    code === HardwareErrorCode.BleCharacteristicNotFound ||
+    (typeof message === 'string' &&
+      (message.includes('BLECharacteristicNotFound') ||
+        message.includes('BLECharacteristicNotWritable') ||
+        message.includes('BLECharacteristicNotNotifiable')))
+  );
+};
+const isStaleGattTableNotifyReason = (reason: string | null | undefined): boolean =>
+  !!reason &&
+  (reason.includes('Cannot write client characteristic config descriptor') ||
+    reason.includes('Cannot find client characteristic config descriptor') ||
+    reason.includes('The handle is invalid') ||
+    reason.includes('Writing is not permitted'));
+
 /**
  * JS backstop for connect. The native adapter applies its own 3s budget, but it
  * schedules that timeout on its serial queue, so a busy queue (e.g. right after a
@@ -300,16 +401,22 @@ const shouldRethrowBleSetupError = (error: unknown): boolean =>
   isConnectTimeoutError(error) || isWedgedBleSetupError(error);
 const isNativeOperationTimeoutError = (error: unknown): boolean =>
   (error as { errorCode?: unknown })?.errorCode === BleErrorCode.OperationTimedOut;
-const isMtuOrCancelledConnectError = (error: unknown): boolean => {
+/**
+ * ble-plx reports its own expired budget as OperationCancelled, not OperationTimedOut:
+ * safeConnectToDevice disposes the operation chain and its doFinally reports a
+ * cancellation. Either code means the native layer abandoned work that still owned
+ * connection/GATT state, so both have to go through the stalled-connection cleanup.
+ * Only used where nothing else recovers the link — the connect path does its own
+ * ordered teardown before retrying, and routing it here too would both duplicate that
+ * and spend the manager-reset budget on a connect that is about to be retried.
+ */
+const isAbandonedNativeOperationError = (error: unknown): boolean => {
   const errorCode = (error as { errorCode?: unknown })?.errorCode;
   return (
-    errorCode === BleErrorCode.DeviceMTUChangeFailed ||
-    errorCode === BleErrorCode.OperationCancelled
+    errorCode === BleErrorCode.OperationTimedOut || errorCode === BleErrorCode.OperationCancelled
   );
 };
 
-type NegotiatedMtuResult = { device: Device; timedOut: boolean };
-
 export type IOneKeyDevice = OneKeyDeviceInfoBase & Device;
 
 const tryToGetConfiguration = (device: Device) => {
@@ -321,13 +428,26 @@ const tryToGetConfiguration = (device: Device) => {
   return infos;
 };
 
+type NegotiatedMtuResult = {
+  device: Device;
+  /**
+   * True when the bounded wait gave up while the native MTU exchange was still
+   * outstanding. `cancelTransaction` only disposes the JS-side subscription:
+   * RxAndroidBle releases a connection's serial operation queue from onComplete /
+   * onError alone, so an abandoned exchange keeps that queue until its own native
+   * timeout. Any GATT work issued before then — service discovery above all —
+   * queues behind it and cannot settle inside its own budget.
+   */
+  abandoned: boolean;
+};
+
 const requestNegotiatedMtu = async (
   device: Device,
   stage: 'connected' | 'highThroughput',
   attempt: number,
   cancelTransaction?: (transactionId: string) => Promise<void> | void
 ): Promise<NegotiatedMtuResult> => {
-  if (Platform.OS !== 'ios' && Platform.OS !== 'android') return { device, timedOut: false };
+  if (Platform.OS !== 'ios' && Platform.OS !== 'android') return { device, abandoned: false };
 
   const transactionId = `${device.id}:mtu:${stage}:${attempt}:${Date.now()}`;
   let timeoutId: ReturnType<typeof setTimeout> | undefined;
@@ -350,7 +470,7 @@ const requestNegotiatedMtu = async (
         }, BLE_MTU_REQUEST_TIMEOUT_MS);
       }),
     ]);
-    return { device: mtuDevice, timedOut: false };
+    return { device: mtuDevice, abandoned: false };
   } catch (error) {
     if (timedOut && cancelTransaction) {
       try {
@@ -376,10 +496,9 @@ const requestNegotiatedMtu = async (
       stage,
       attempt,
       actual: device.mtu,
-      timedOut,
       error: error instanceof Error ? error.message : String(error),
     });
-    return { device, timedOut };
+    return { device, abandoned: timedOut };
   } finally {
     if (timeoutId) clearTimeout(timeoutId);
   }
@@ -391,7 +510,7 @@ const resolveNegotiatedMtu = (
 ): Promise<NegotiatedMtuResult> =>
   shouldRefreshNegotiatedMtu(device.mtu)
     ? requestNegotiatedMtu(device, 'connected', 0, cancelTransaction)
-    : Promise.resolve({ device, timedOut: false });
+    : Promise.resolve({ device, abandoned: false });
 
 type IOBleErrorRemap = Error | BleError | null | undefined;
 
@@ -475,6 +594,31 @@ export default class ReactNativeBleTransport {
   /** Consecutive detections that failed while trusting sessionProtocols. */
   private protocolReprobeFailures: Map<string, number> = new Map();
 
+  /** Endpoints whose last detection got no answer on any protocol. */
+  private silentDetections = new Set<string>();
+
+  /**
+   * Android endpoints whose cached GATT table is suspect and must be rediscovered on the
+   * next connect. The cache is no longer refreshed on every connect, so a missing OneKey
+   * service or characteristic marks the endpoint instead.
+   */
+  private androidGattCacheRefreshes = new Set<string>();
+
+  /** Instance copies of the Android timing bounds so tests can shorten real-time waits. */
+  androidMtuExchangeTimeoutMs = ANDROID_MTU_EXCHANGE_TIMEOUT_MS;
+
+  androidLinkDropQuietMs = ANDROID_LINK_DROP_QUIET_MS;
+
+  androidLinkDropTimeoutMs = ANDROID_LINK_DROP_TIMEOUT_MS;
+
+  /**
+   * Endpoints already sent a Protocol V1 wake. The wake starts a fresh wallet session
+   * on the device, and a failed detection tears the link down and reconnects on every
+   * poll, so neither set is cleared on teardown: one wake is spent per endpoint until a
+   * detection succeeds, which re-arms it for the next time the device sleeps.
+   */
+  private protocolWakeAttempts = new Set<string>();
+
   /**
    * Native encryption/pairing failures seen before Protocol V2 probe starts.
    * Pro2/Neo GATT connect can succeed on a stale iOS bond; the CCCD write then
@@ -745,9 +889,13 @@ export default class ReactNativeBleTransport {
 
       let { device } = transport;
       const isConnected = await device.isConnected().catch(() => false);
+      // A firmware upload reconnect keeps the GATT refresh; on Android it uses the same
+      // order as acquire: bare connect, discovery, then the MTU exchange on its own.
+      const reconnectOptions =
+        Platform.OS === 'android' ? androidRefreshGattConnectOptions : connectOptions;
       if (!isConnected) {
         try {
-          device = await this.connectWithTimeout(uuid, () => device.connect(connectOptions));
+          device = await this.connectWithTimeout(uuid, () => device.connect(reconnectOptions));
         } catch (e) {
           if (
             e.errorCode === BleErrorCode.DeviceMTUChangeFailed ||
@@ -762,8 +910,17 @@ export default class ReactNativeBleTransport {
 
       const { writeCharacteristic, notifyCharacteristic } =
         await this.resolveCharacteristicsWithTimeout(uuid, device);
+      if (Platform.OS === 'android') {
+        const manager = await this.getPlxManager();
+        device = await this.negotiateAndroidMtu(uuid, manager, device);
+        if (isKnownDefaultMtu(device.mtu)) {
+          await this.dropAndroidLink(uuid, manager, device, 'firmware reconnect default mtu');
+          throw createDefaultMtuLinkError(device.mtu);
+        }
+      }
 
       transport.device = device;
+      transport.mtuSize = typeof device.mtu === 'number' ? device.mtu : transport.mtuSize;
       transport.writeCharacteristic = writeCharacteristic;
       transport.notifyCharacteristic = notifyCharacteristic;
       const monitorToken = this.nextMonitorToken;
@@ -949,7 +1106,7 @@ export default class ReactNativeBleTransport {
     characteristics?: ResolvedBleCharacteristics
   ) {
     const { writeCharacteristic, notifyCharacteristic } =
-      characteristics ?? (await this.resolveCharacteristicsWithTimeout(uuid, device));
+      characteristics ?? (await this.resolveCharacteristicsForAcquire(uuid, device));
     if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
     const transport = new BleTransport(device, writeCharacteristic, notifyCharacteristic);
     transport.mtuSize = typeof device.mtu === 'number' ? device.mtu : undefined;
@@ -1052,8 +1209,16 @@ export default class ReactNativeBleTransport {
         const isCachedDeviceConnected = await cachedTransport.device
           .isConnected()
           .catch(() => false);
+        // A cached Android link at the default MTU, or one whose GATT table is suspect,
+        // has to go through the full acquire again so the MTU exchange and the refresh
+        // connect actually run instead of every retry reusing the same unusable link.
+        const isCachedAndroidLinkUsable =
+          Platform.OS !== 'android' ||
+          (!isKnownDefaultMtu(cachedTransport.mtuSize) &&
+            !this.androidGattCacheRefreshes.has(uuid));
         if (
           isCachedDeviceConnected &&
+          isCachedAndroidLinkUsable &&
           cachedProtocol &&
           (!expectedProtocol || cachedProtocol === expectedProtocol)
         ) {
@@ -1072,6 +1237,21 @@ export default class ReactNativeBleTransport {
     }
 
     let device: Device | null = null;
+    const isAndroid = Platform.OS === 'android';
+    // A firmware-install reconnect keeps the per-connect GATT refresh it always had: the
+    // install loader may expose a different table than the firmware that was cached.
+    const refreshAndroidGattCache =
+      isAndroid && (!!skipProtocolProbe || this.androidGattCacheRefreshes.has(uuid));
+    let nativeConnectOptions = connectOptions;
+    if (isAndroid) {
+      nativeConnectOptions = refreshAndroidGattCache
+        ? androidRefreshGattConnectOptions
+        : androidConnectOptions;
+    }
+    // Only a connect that actually carried refreshGatt consumes a pending refresh; the
+    // fallback connects below drop that option, so the marker then survives for the next
+    // attempt instead of being cleared by a connect that never reached the cache.
+    let androidRefreshConnectRan = false;
 
     if (forceCleanRunPromise && this.runPromise) {
       const error = ERRORS.TypedError(HardwareErrorCode.BleForceCleanRunPromise);
@@ -1082,7 +1262,6 @@ export default class ReactNativeBleTransport {
     }
 
     const blePlxManager = await this.getPlxManager();
-    let skipPostConnectMtu = false;
     try {
       await subscribeBleOn(blePlxManager);
     } catch (error) {
@@ -1127,16 +1306,25 @@ export default class ReactNativeBleTransport {
       Log?.debug('try to connect to device: ', uuid);
       try {
         device = await this.connectWithTimeout(uuid, () =>
-          blePlxManager.connectToDevice(uuid, connectOptions)
+          blePlxManager.connectToDevice(uuid, nativeConnectOptions)
         );
+        androidRefreshConnectRan = refreshAndroidGattCache;
       } catch (e) {
         Log?.debug('try to connect to device has error: ', e);
         if (shouldRethrowBleSetupError(e)) {
           throw e;
         }
-        if (isMtuOrCancelledConnectError(e)) {
-          skipPostConnectMtu = true;
+        if (
+          e.errorCode === BleErrorCode.DeviceMTUChangeFailed ||
+          e.errorCode === BleErrorCode.OperationCancelled
+        ) {
           Log?.debug('first try to reconnect without params');
+          // The disposed chain can still own native connection state, and the retry
+          // would otherwise run on top of a half-open GATT client.
+          await this.runBestEffortNativeOperation(
+            'connect cancelled: cancel manager connection',
+            () => blePlxManager.cancelDeviceConnection(uuid)
+          );
           device = await this.connectWithTimeout(uuid, () =>
             blePlxManager.connectToDevice(uuid, fallbackConnectOptions)
           );
@@ -1153,22 +1341,38 @@ export default class ReactNativeBleTransport {
       throw ERRORS.TypedError(HardwareErrorCode.BleConnectedError, 'unable to connect to device');
     }
 
+    if (isAndroid && refreshAndroidGattCache && (await device.isConnected().catch(() => false))) {
+      // refreshGatt only reaches the stack through a connect. A link that is still up would
+      // skip the connect below and keep serving the stale table, so it is dropped first.
+      await this.dropAndroidLink(uuid, blePlxManager, device, 'gatt cache refresh');
+      if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+    }
+
     if (!(await device.isConnected())) {
       Log?.debug('not connected, try to connect to device: ', uuid);
       const disconnectedDevice = device;
 
       try {
         device = await this.connectWithTimeout(uuid, () =>
-          disconnectedDevice.connect(connectOptions)
+          disconnectedDevice.connect(nativeConnectOptions)
         );
+        androidRefreshConnectRan = refreshAndroidGattCache;
       } catch (e) {
         Log?.debug('not connected, try to connect to device has error: ', e);
         if (shouldRethrowBleSetupError(e)) {
           throw e;
         }
-        if (isMtuOrCancelledConnectError(e)) {
-          skipPostConnectMtu = true;
+        if (
+          e.errorCode === BleErrorCode.DeviceMTUChangeFailed ||
+          e.errorCode === BleErrorCode.OperationCancelled
+        ) {
           Log?.debug('second try to reconnect without params');
+          // The disposed chain can still own native connection state, and the retry
+          // would otherwise run on top of a half-open GATT client.
+          await this.runBestEffortNativeOperation(
+            'connect cancelled: cancel device connection',
+            () => disconnectedDevice.cancelConnection()
+          );
           try {
             device = await this.connectWithTimeout(uuid, () =>
               disconnectedDevice.connect(fallbackConnectOptions)
@@ -1209,33 +1413,48 @@ export default class ReactNativeBleTransport {
       throw ERRORS.TypedError(HardwareErrorCode.BleConnectedError, 'device is not connected');
     }
     if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
-    // Match 1.1.31: MTU is a connect() best-effort. If connect already fell back
-    // without requestMTU, do not put another requestMTU on the native serial
-    // queue — that is what wedges GATT after Account#2 reconnect.
-    if (!skipPostConnectMtu) {
-      const mtuResult = await resolveNegotiatedMtu(device, transactionId =>
+    let characteristics: ResolvedBleCharacteristics | undefined;
+    if (isAndroid) {
+      if (refreshAndroidGattCache) {
+        // refreshGatt has already started a full rediscovery; let it finish before the MTU
+        // exchange so the request is not queued behind it.
+        characteristics = await this.resolveCharacteristicsForAcquire(uuid, device);
+        if (androidRefreshConnectRan) this.androidGattCacheRefreshes.delete(uuid);
+        if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+      }
+      device = await this.negotiateAndroidMtu(uuid, blePlxManager, device);
+      if (isKnownDefaultMtu(device.mtu)) {
+        // Neither protocol works at the default MTU on Android, so the link is not worth
+        // keeping for any device family. Counted like a setup timeout so a device that keeps
+        // ending here reaches the wedged-link guard instead of the full retry ladder.
+        const resetManager = this.abandonStalledConnection(uuid, 'mtu-default');
+        await this.dropAndroidLink(uuid, blePlxManager, device, 'default mtu');
+        if (resetManager) throw this.createWedgedBleSetupError();
+        throw createDefaultMtuLinkError(device.mtu);
+      }
+    } else {
+      const negotiatedMtu = await resolveNegotiatedMtu(device, transactionId =>
         blePlxManager.cancelTransaction(transactionId)
       );
-      device = mtuResult.device;
-      if (mtuResult.timedOut) {
-        if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
-        Log?.debug(
-          '[ReactNativeBleTransport] post-connect MTU timed out, reconnecting without requesting MTU'
-        );
-        const timedOutDevice = device;
-        await this.runBestEffortNativeOperation('mtu timeout: cancel device connection', () =>
-          timedOutDevice.cancelConnection()
-        );
-        if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
-        device = await this.connectWithTimeout(uuid, () =>
-          timedOutDevice.connect(fallbackConnectOptions)
+      device = negotiatedMtu.device;
+      if (negotiatedMtu.abandoned) {
+        // Service discovery would queue behind the abandoned exchange and miss its own
+        // budget. Drop the link so the next attempt starts on a queue nothing holds.
+        await this.runNativeTeardown(uuid, blePlxManager, async () => {
+          await this.runBestEffortNativeOperation('mtu abandoned: cancel manager connection', () =>
+            blePlxManager.cancelDeviceConnection(uuid)
+          );
+        });
+        throw ERRORS.TypedError(
+          HardwareErrorCode.BleConnectedError,
+          'BLE MTU negotiation abandoned, reconnecting'
         );
       }
     }
     if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
     const acquiredDevice = device;
     const { writeCharacteristic, notifyCharacteristic } =
-      await this.resolveCharacteristicsWithTimeout(uuid, acquiredDevice);
+      characteristics ?? (await this.resolveCharacteristicsForAcquire(uuid, acquiredDevice));
     if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
 
     const protocolHint = expectedProtocol
@@ -1363,6 +1582,9 @@ export default class ReactNativeBleTransport {
           ) {
             errorCode = HardwareErrorCode.BleCharacteristicNotifyChangeFailure;
           }
+          if (Platform.OS === 'android' && isStaleGattTableNotifyReason(error.reason)) {
+            this.androidGattCacheRefreshes.add(uuid);
+          }
           this.rejectProtocolV2Frames(uuid, ERRORS.TypedError(errorCode));
           return;
         }
@@ -1384,6 +1606,9 @@ export default class ReactNativeBleTransport {
             const notifyError = ERRORS.TypedError(
               HardwareErrorCode.BleCharacteristicNotifyChangeFailure
             );
+            if (Platform.OS === 'android' && isStaleGattTableNotifyReason(error.reason)) {
+              this.androidGattCacheRefreshes.add(uuid);
+            }
             this.runPromise.reject(notifyError);
             Log?.debug(
               `${HardwareErrorCode.BleCharacteristicNotifyChangeFailure} ${error.message}    ${error.reason}`
@@ -2047,6 +2272,142 @@ export default class ReactNativeBleTransport {
     }
   }
 
+  /**
+   * Negotiate the ATT MTU as the first request on an Android GATT client, with nothing queued
+   * ahead of it, and never close the client while it is outstanding: an exchange abandoned
+   * mid-flight stays marked in progress for the whole LE link. A link that already negotiated
+   * an MTU answers at once with the recorded value.
+   */
+  private async negotiateAndroidMtu(
+    uuid: string,
+    manager: BlePlxManager,
+    device: Device
+  ): Promise<Device> {
+    if (!shouldRefreshNegotiatedMtu(device.mtu)) return device;
+
+    const startedAt = Date.now();
+    const transactionId = `${device.id}:mtu:connected:0:${startedAt}`;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let timedOut = false;
+    const request = device.requestMTU(ANDROID_REQUEST_MTU, transactionId);
+    request.catch(() => undefined);
+    try {
+      const negotiated = await Promise.race([
+        request,
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(() => {
+            timedOut = true;
+            reject(
+              new Error(`BLE MTU exchange timeout after ${this.androidMtuExchangeTimeoutMs}ms`)
+            );
+          }, this.androidMtuExchangeTimeoutMs);
+        }),
+      ]);
+      Log?.debug('[ReactNativeBleTransport] BLE MTU exchange completed', {
+        connectIdSuffix: uuid.slice(-8),
+        elapsedMs: Date.now() - startedAt,
+        actual: negotiated.mtu,
+      });
+      return negotiated;
+    } catch (error) {
+      Log?.debug('[ReactNativeBleTransport] BLE MTU exchange failed', {
+        connectIdSuffix: uuid.slice(-8),
+        elapsedMs: Date.now() - startedAt,
+        timedOut,
+        actual: device.mtu,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+      // A request the stack rejected is not left pending; the caller's MTU check decides.
+      if (!timedOut) return device;
+      // The JS-side subscription is released for hygiene only: the native operation, and
+      // the per-link state it may already hold, end with the link below.
+      await Promise.resolve(manager.cancelTransaction(transactionId)).catch(() => undefined);
+      const resetManager = this.abandonStalledConnection(uuid, 'mtu-backstop');
+      await this.dropAndroidLink(uuid, manager, device, 'mtu exchange timeout');
+      if (resetManager) throw this.createWedgedBleSetupError();
+      throw ERRORS.TypedError(
+        HardwareErrorCode.BleConnectedError,
+        'BLE MTU exchange did not complete, reconnecting on a fresh link'
+      );
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+
+  /**
+   * Abandon an Android LE link whose per-link GATT state is unusable. Closing the GATT
+   * client alone keeps the link up for the stack's idle timer, and Core's retry arrives
+   * inside that window, so this holds for at least ANDROID_LINK_DROP_QUIET_MS and until the
+   * GATT registry no longer lists the device, capped at ANDROID_LINK_DROP_TIMEOUT_MS.
+   */
+  private async dropAndroidLink(
+    uuid: string,
+    manager: BlePlxManager,
+    device: Device,
+    reason: string
+  ) {
+    await this.runNativeTeardown(uuid, manager, async () => {
+      await Promise.all([
+        this.runBestEffortNativeOperation(`${reason}: cancel manager connection`, () =>
+          manager.cancelDeviceConnection(uuid)
+        ),
+        this.runBestEffortNativeOperation(`${reason}: cancel device connection`, () =>
+          device.cancelConnection()
+        ),
+      ]);
+    });
+
+    const startedAt = Date.now();
+    const target = uuid.toUpperCase();
+    let registryClear = false;
+    let quietPeriodElapsed = false;
+    while (!this.stopped) {
+      const elapsed = Date.now() - startedAt;
+      quietPeriodElapsed = elapsed >= this.androidLinkDropQuietMs;
+      if (!registryClear) {
+        const connected: Array<{ id?: unknown }> | undefined = await getConnectedDeviceIds(
+          []
+        ).catch(() => undefined);
+        registryClear =
+          !!connected &&
+          !connected.some(peripheral => String(peripheral?.id ?? '').toUpperCase() === target);
+      }
+      if ((registryClear && quietPeriodElapsed) || elapsed >= this.androidLinkDropTimeoutMs) {
+        break;
+      }
+      await delay(ANDROID_LINK_DROP_POLL_MS);
+    }
+    Log?.debug('[ReactNativeBleTransport] Android BLE link drop', {
+      connectIdSuffix: uuid.slice(-8),
+      reason,
+      registryClear,
+      quietPeriodElapsed,
+      stopped: this.stopped,
+      elapsedMs: Date.now() - startedAt,
+    });
+  }
+
+  private async resolveCharacteristicsForAcquire(
+    uuid: string,
+    device: Device
+  ): Promise<ResolvedBleCharacteristics> {
+    try {
+      return await this.resolveCharacteristicsWithTimeout(uuid, device);
+    } catch (error) {
+      if (Platform.OS === 'android' && isMissingGattShapeError(error)) {
+        this.androidGattCacheRefreshes.add(uuid);
+        // The refresh only reaches the stack through a connect, and a link that is still
+        // up would let the next acquire skip that connect and serve the same stale table.
+        const manager = this.blePlxManager;
+        if (manager) {
+          await this.dropAndroidLink(uuid, manager, device, 'stale gatt table');
+        }
+      }
+      throw error;
+    }
+  }
+
   /** Run a native connect under the JS backstop budget. */
   private async connectWithTimeout<T>(uuid: string, connect: () => Promise<T>): Promise<T> {
     if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
@@ -2127,7 +2488,7 @@ export default class ReactNativeBleTransport {
       succeeded = true;
       return result;
     } catch (error) {
-      if (timedOut || isNativeOperationTimeoutError(error)) {
+      if (timedOut || isAbandonedNativeOperationError(error)) {
         const resetManager = this.abandonStalledConnection(
           uuid,
           timedOut ? 'gatt-backstop' : 'gatt-native'
@@ -2156,7 +2517,13 @@ export default class ReactNativeBleTransport {
    */
   private abandonStalledConnection(
     uuid: string,
-    stage: 'connect-backstop' | 'connect-native' | 'gatt-backstop' | 'gatt-native'
+    stage:
+      | 'connect-backstop'
+      | 'connect-native'
+      | 'gatt-backstop'
+      | 'gatt-native'
+      | 'mtu-backstop'
+      | 'mtu-default'
   ): boolean {
     const timeouts = (this.connectionSetupTimeoutCounts.get(uuid) ?? 0) + 1;
     this.connectionSetupTimeoutCounts.set(uuid, timeouts);
@@ -2331,6 +2698,8 @@ export default class ReactNativeBleTransport {
     // Keep transport-lifetime V2 proof so the same endpoint can finish a no-probe
     // firmware reconnect after the native BLE manager is recreated.
     this.protocolReprobeFailures.clear();
+    this.silentDetections.clear();
+    this.protocolWakeAttempts.clear();
     this.writeTimeoutCounts.clear();
     this.connectionSetupTimeoutCounts.clear();
     this.monitorTokens.clear();
@@ -2442,6 +2811,8 @@ export default class ReactNativeBleTransport {
       reprobeFailures < PROTOCOL_REPROBE_FALLBACK_ATTEMPTS;
     const probeOrder: ProtocolType[] = trustSessionProtocol ? [sessionProtocol] : fullProbeOrder;
 
+    await this.wakeSilentProtocolV1Device(uuid, probeOrder);
+
     for (let i = 0; i < probeOrder.length; i += 1) {
       const protocol = probeOrder[i];
       if (i > 0) {
@@ -2463,6 +2834,8 @@ export default class ReactNativeBleTransport {
           this.confirmedProtocolV2.add(uuid);
         }
         this.protocolReprobeFailures.delete(uuid);
+        this.silentDetections.delete(uuid);
+        this.protocolWakeAttempts.delete(uuid);
         Log?.debug('[ReactNativeBleTransport] protocol detected', {
           deviceId: uuid,
           protocol,
@@ -2472,6 +2845,10 @@ export default class ReactNativeBleTransport {
       }
     }
 
+    // Nothing answered on any probed protocol. Remember it so the next detection, which
+    // the caller reaches on a freshly reconnected link, can spend a wake first.
+    this.silentDetections.add(uuid);
+
     if (trustSessionProtocol) {
       // Still silent on its own protocol: count it, and let the streak expire the
       // shortcut so a device that genuinely switched protocols is found again.
@@ -2485,6 +2862,47 @@ export default class ReactNativeBleTransport {
     throw this.createProtocolDetectionError();
   }
 
+  /**
+   * Sent once before probing when the previous detection on this endpoint got no answer
+   * at all. On Classic-family firmware that silence is also what a sleeping device looks
+   * like: its BLE co-processor keeps serving connect, GATT and MTU while the main MCU
+   * sits in the screensaver loop, whose host-message filter accepts only Initialize and
+   * the *Ack messages. GetFeatures and Ping are dropped there without a reply, so no
+   * amount of probing can bring the device back.
+   *
+   * Initialize is the one message that breaks that loop, but it also starts a fresh
+   * wallet session, which is why it is not the probe itself — a bare Initialize on every
+   * acquire would drop a hidden-wallet session before Core can restore it. Requiring a
+   * fully silent previous detection keeps it to devices with no session left to protect.
+   *
+   * The firmware consumes the wake to leave its loop and does not reliably answer it, so
+   * the result is ignored: the probes that follow are what decide the protocol.
+   */
+  private async wakeSilentProtocolV1Device(uuid: string, probeOrder: ProtocolType[]) {
+    if (!this._messages) return;
+    if (!probeOrder.includes('V1')) return;
+    if (!this.silentDetections.has(uuid)) return;
+    if (this.protocolWakeAttempts.has(uuid)) return;
+    if (!transportCache[uuid]) return;
+    this.protocolWakeAttempts.add(uuid);
+
+    Log?.debug('[ReactNativeBleTransport] sending Protocol V1 Initialize wake', {
+      connectIdSuffix: uuid.slice(-8),
+    });
+    try {
+      this.probingProtocols.set(uuid, 'V1');
+      await this.callProtocolV1(uuid, 'Initialize', {}, { timeoutMs: PROTOCOL_PROBE_TIMEOUT_MS });
+    } catch (error) {
+      if (shouldRethrowProtocolProbeError(error)) {
+        this.clearProbeProtocol(uuid, 'V1');
+        throw error;
+      }
+      Log?.debug('[ReactNativeBleTransport] Protocol V1 Initialize wake did not answer:', error);
+    } finally {
+      this.clearProbeProtocol(uuid, 'V1');
+    }
+  }
+
   private async resetProbeStateAfterProtocolProbe(uuid: string, protocol: ProtocolType) {
     const transport = transportCache[uuid];
     await this.protocolV2Links.invalidateLink(
@@ -2787,6 +3205,13 @@ export default class ReactNativeBleTransport {
       throw ERRORS.TypedError(HardwareErrorCode.TransportNotConfigured);
     }
 
+    if (Platform.OS === 'android') {
+      const activeTransport = transportCache[uuid];
+      if (activeTransport && isKnownDefaultMtu(activeTransport.mtuSize)) {
+        throw createProtocolV2DefaultMtuError(activeTransport.mtuSize);
+      }
+    }
+
     const isProtocolProbe = this.probingProtocols.get(uuid) === 'V2';
     const callOptions = options;
     const highThroughputWrite = isProtocolV2HighThroughputCall(name);
@@ -2864,7 +3289,7 @@ export default class ReactNativeBleTransport {
     const transport = this.getCachedTransport(uuid);
     if (!shouldRefreshNegotiatedMtu(transport.mtuSize)) return;
 
-    const { device: refreshedDevice } = await requestNegotiatedMtu(
+    const { device: refreshedDevice, abandoned } = await requestNegotiatedMtu(
       transport.device,
       'highThroughput',
       1,
@@ -2874,7 +3299,7 @@ export default class ReactNativeBleTransport {
     transport.mtuSize =
       typeof refreshedDevice.mtu === 'number' ? refreshedDevice.mtu : transport.mtuSize;
 
-    if (shouldRefreshNegotiatedMtu(transport.mtuSize)) {
+    if (abandoned || shouldRefreshNegotiatedMtu(transport.mtuSize)) {
       throw ERRORS.TypedError(
         HardwareErrorCode.BleConnectedError,
         `Protocol V2 high-throughput BLE MTU unavailable: ${String(transport.mtuSize)}`