@onekeyfe/hd-transport-react-native 1.2.3-alpha.1 → 1.2.3-alpha.11

package/src/index.ts

@@ -47,6 +47,7 @@ import {
   getInfosForServiceUuid,
   isSameBleUuid,
 } from './constants';
+import { isNativeBleDisconnectError, toBleDisconnectHardwareError } from './bleNativeDisconnect';
 import {
   isBleStaleBondHardwareError,
   isNativeBleStaleBondError,
@@ -76,6 +77,8 @@ const { check, ProtocolV1, parseConfigure } = transport;
 const Log = bleLogger;
 
 const transportCache: Record<string, BleTransport> = {};
+// ble-plx shares one manager across transport instances in this JS runtime.
+let bleManagerResetPromise: Promise<void> | undefined;
 const FIRMWARE_UPLOAD_WRITE_BURST_SIZE = Platform.OS === 'ios' ? 4 : 5;
 const FIRMWARE_UPLOAD_WRITE_PAUSE_MS = Platform.OS === 'ios' ? 8 : 10;
 const FIRMWARE_UPLOAD_WRITE_FLUSH_DELAY_MS = Platform.OS === 'ios' ? 24 : 30;
@@ -168,6 +171,69 @@ const isWedgedWriteError = (error: unknown): boolean =>
   (error as { errorCode?: unknown })?.errorCode === HardwareErrorCode.BleWriteCharacteristicError &&
   typeof (error as { message?: unknown })?.message === 'string' &&
   (error as { message: string }).message.startsWith(WEDGED_WRITE_MESSAGE);
+const shouldRethrowProtocolProbeError = (error: unknown): boolean => {
+  const code = (error as { errorCode?: unknown })?.errorCode;
+  // Bonding and GATT failures are not evidence of a protocol mismatch. Preserve
+  // them instead of probing another protocol on an unusable connection.
+  // Native PLX disconnects (errorCode 201 / iOS 7) must match before they are
+  // mapped: Protocol V2 writes rethrow them unchanged unless normalized first.
+  return (
+    isBleStaleBondHardwareError(error) ||
+    isNativeBleDisconnectError(error) ||
+    code === HardwareErrorCode.BleDeviceNotBonded ||
+    code === HardwareErrorCode.BleDeviceBondedCanceled ||
+    code === HardwareErrorCode.BleDeviceDisconnected ||
+    code === HardwareErrorCode.BleCharacteristicNotifyError ||
+    code === HardwareErrorCode.BleCharacteristicNotifyChangeFailure ||
+    code === HardwareErrorCode.BleWriteCharacteristicError
+  );
+};
+
+const logIosBleBondDiagnostic = (
+  phase: string,
+  error: unknown,
+  outcome: 'fallback' | 'rethrow'
+) => {
+  if (Platform.OS !== 'ios') return;
+
+  const nativeError = (error ?? {}) as {
+    name?: unknown;
+    errorCode?: unknown;
+    attErrorCode?: unknown;
+    iosErrorCode?: unknown;
+    androidErrorCode?: unknown;
+  };
+  const scalar = (value: unknown) =>
+    typeof value === 'string' || typeof value === 'number' ? value : undefined;
+
+  Log?.debug('[ReactNativeBleTransport][BleBondDiagnostic] probe error', {
+    phase,
+    outcome,
+    errorName: scalar(nativeError.name),
+    errorCode: scalar(nativeError.errorCode),
+    attErrorCode: scalar(nativeError.attErrorCode),
+    iosErrorCode: scalar(nativeError.iosErrorCode),
+    androidErrorCode: scalar(nativeError.androidErrorCode),
+    nativeStaleBond: isNativeBleStaleBondError(error),
+    hardwareStaleBond: isBleStaleBondHardwareError(error),
+    nativeDisconnect: isNativeBleDisconnectError(error),
+  });
+};
+
+type IosProbeDisconnectEvidence = {
+  phase: 'protocol-v1-get-features' | 'protocol-v2-ping';
+  errorCode?: string | number;
+};
+
+const isIosProbeDisconnectError = (error: unknown): boolean => {
+  if (Platform.OS !== 'ios') return false;
+  const code = (error as { errorCode?: unknown })?.errorCode;
+  return (
+    isNativeBleDisconnectError(error) ||
+    code === HardwareErrorCode.BleDeviceNotBonded ||
+    code === HardwareErrorCode.BleDeviceDisconnected
+  );
+};
 /** Consecutive wedged writes on one device before the BLE manager itself is recreated. */
 export const BLE_WRITE_TIMEOUT_MANAGER_RESET_THRESHOLD = 2;
 const DEVICE_SCAN_TIMEOUT_MS = 3000;
@@ -222,13 +288,13 @@ function getDeviceDisplayName(device?: Device | null) {
 
 const IOS_REQUEST_MTU = 247;
 const ANDROID_REQUEST_MTU = 517;
-const BLE_MTU_REFRESH_RETRY_DELAY_MS = 200;
 const ANDROID_HIGH_PRIORITY_IDLE_MS = 1000;
 
 const getRequestedBleMtu = () =>
   Platform.OS === 'android' ? ANDROID_REQUEST_MTU : IOS_REQUEST_MTU;
 
 const BLE_NATIVE_CONNECT_TIMEOUT_MS = 3000;
+const BLE_MTU_REQUEST_TIMEOUT_MS = BLE_NATIVE_CONNECT_TIMEOUT_MS;
 
 const connectOptions: Record<string, unknown> = {
   requestMTU: getRequestedBleMtu(),
@@ -236,11 +302,63 @@ const connectOptions: Record<string, unknown> = {
   refreshGatt: 'OnConnected',
 };
 
-/** Fallback connect options: drops requestMTU (the thing being worked around) but keeps the native budget. */
+/** Connect options without requestMTU: the iOS fallback and every bare Android connect. */
 const fallbackConnectOptions: Record<string, unknown> = {
   timeout: BLE_NATIVE_CONNECT_TIMEOUT_MS,
 };
 
+/**
+ * Android never requests the MTU inside the native connect budget: refreshGatt makes the stack
+ * rediscover first, and a budget that expires with the MTU request unsent parks every later MTU
+ * request on that LE link. refreshGatt itself is only added after a firmware install or a
+ * stale-table symptom, and discovery finishes before the MTU exchange.
+ */
+const androidRefreshGattConnectOptions: Record<string, unknown> = {
+  timeout: BLE_NATIVE_CONNECT_TIMEOUT_MS,
+  refreshGatt: 'OnConnected',
+};
+
+/**
+ * With no cached GATT table the stack runs its own discovery (up to ~8s) before the MTU
+ * exchange, so the bound sits above that; a stuck exchange never completes.
+ */
+export const ANDROID_MTU_EXCHANGE_TIMEOUT_MS = 12_000;
+
+/**
+ * Android keeps an LE link, with per-link ATT state such as a pending MTU exchange, for its
+ * 4s GATT link idle timer after the last client closes; a reconnect inside it reuses the link.
+ */
+export const ANDROID_LINK_DROP_QUIET_MS = 5000;
+const ANDROID_LINK_DROP_POLL_MS = 250;
+
+/**
+ * Android cannot use a link at the default 23-byte ATT MTU: Protocol V1 writes 192-byte
+ * packets regardless, and a Pro 2 sends only the first ATT_MTU-3 bytes of a V2 reply.
+ * An unknown MTU is not treated as default.
+ */
+const isKnownDefaultMtu = (mtu: unknown): boolean =>
+  typeof mtu === 'number' && Number.isFinite(mtu) && mtu <= 23;
+
+/** Discovery found no OneKey service, or a characteristic of the wrong shape: the cached GATT table may be stale. */
+const isMissingGattShapeError = (error: unknown): boolean => {
+  const code = (error as { errorCode?: unknown })?.errorCode;
+  const message = (error as { message?: unknown })?.message;
+  return (
+    code === HardwareErrorCode.BleServiceNotFound ||
+    code === HardwareErrorCode.BleCharacteristicNotFound ||
+    (typeof message === 'string' &&
+      (message.includes('BLECharacteristicNotFound') ||
+        message.includes('BLECharacteristicNotWritable') ||
+        message.includes('BLECharacteristicNotNotifiable')))
+  );
+};
+const isStaleGattTableNotifyReason = (reason: string | null | undefined): boolean =>
+  !!reason &&
+  (reason.includes('Cannot write client characteristic config descriptor') ||
+    reason.includes('Cannot find client characteristic config descriptor') || // pro firmware 2.3.0 upgrade
+    reason.includes('The handle is invalid') ||
+    reason.includes('Writing is not permitted')); // pro firmware 2.3.4 upgrade
+
 /**
  * JS backstop for connect. The native adapter applies its own 3s budget, but it
  * schedules that timeout on its serial queue, so a busy queue (e.g. right after a
@@ -280,6 +398,15 @@ const shouldRethrowBleSetupError = (error: unknown): boolean =>
   isConnectTimeoutError(error) || isWedgedBleSetupError(error);
 const isNativeOperationTimeoutError = (error: unknown): boolean =>
   (error as { errorCode?: unknown })?.errorCode === BleErrorCode.OperationTimedOut;
+const isMtuOrCancelledConnectError = (error: unknown): boolean => {
+  const errorCode = (error as { errorCode?: unknown })?.errorCode;
+  return (
+    errorCode === BleErrorCode.DeviceMTUChangeFailed ||
+    errorCode === BleErrorCode.OperationCancelled
+  );
+};
+
+type NegotiatedMtuResult = { device: Device; timedOut: boolean };
 
 export type IOneKeyDevice = OneKeyDeviceInfoBase & Device;
 
@@ -294,29 +421,75 @@ const tryToGetConfiguration = (device: Device) => {
 
 const requestNegotiatedMtu = async (
   device: Device,
-  stage: 'connected' | 'servicesAndNotifyReady' | 'highThroughput',
-  attempt: number
-) => {
-  if (Platform.OS !== 'ios' && Platform.OS !== 'android') return device;
+  stage: 'connected' | 'highThroughput',
+  attempt: number,
+  cancelTransaction?: (transactionId: string) => Promise<void> | void
+): Promise<NegotiatedMtuResult> => {
+  if (Platform.OS !== 'ios' && Platform.OS !== 'android') return { device, timedOut: false };
+
+  const transactionId = `${device.id}:mtu:${stage}:${attempt}:${Date.now()}`;
+  let timeoutId: ReturnType<typeof setTimeout> | undefined;
+  let timedOut = false;
 
   try {
     // iOS ignores the requested value but react-native-ble-plx returns a fresh
     // Device snapshot whose MTU is derived from CoreBluetooth's maximum write length.
-    const mtuDevice = await device.requestMTU(getRequestedBleMtu());
-    return mtuDevice;
+    const request = device.requestMTU(getRequestedBleMtu(), transactionId);
+    // The timeout race may settle before the native request does. Attach a
+    // rejection handler so a late native cancellation cannot become an
+    // unhandled rejection after we continue with the current MTU.
+    request.catch(() => undefined);
+    const mtuDevice = await Promise.race([
+      request,
+      new Promise<never>((_, reject) => {
+        timeoutId = setTimeout(() => {
+          timedOut = true;
+          reject(new Error(`BLE MTU request timeout after ${BLE_MTU_REQUEST_TIMEOUT_MS}ms`));
+        }, BLE_MTU_REQUEST_TIMEOUT_MS);
+      }),
+    ]);
+    return { device: mtuDevice, timedOut: false };
   } catch (error) {
+    if (timedOut && cancelTransaction) {
+      try {
+        Promise.resolve(cancelTransaction(transactionId)).catch(cancelError => {
+          Log?.debug('[ReactNativeBleTransport] MTU cancellation failed', {
+            platform: Platform.OS,
+            stage,
+            attempt,
+            error: cancelError instanceof Error ? cancelError.message : String(cancelError),
+          });
+        });
+      } catch (cancelError) {
+        Log?.debug('[ReactNativeBleTransport] MTU cancellation failed', {
+          platform: Platform.OS,
+          stage,
+          attempt,
+          error: cancelError instanceof Error ? cancelError.message : String(cancelError),
+        });
+      }
+    }
     Log?.debug('[ReactNativeBleTransport] MTU refresh failed, continuing with current value', {
       platform: Platform.OS,
       stage,
       attempt,
       actual: device.mtu,
+      timedOut,
       error: error instanceof Error ? error.message : String(error),
     });
-    return device;
+    return { device, timedOut };
+  } finally {
+    if (timeoutId) clearTimeout(timeoutId);
   }
 };
 
-const resolveNegotiatedMtu = (device: Device) => requestNegotiatedMtu(device, 'connected', 0);
+const resolveNegotiatedMtu = (
+  device: Device,
+  cancelTransaction?: (transactionId: string) => Promise<void> | void
+): Promise<NegotiatedMtuResult> =>
+  shouldRefreshNegotiatedMtu(device.mtu)
+    ? requestNegotiatedMtu(device, 'connected', 0, cancelTransaction)
+    : Promise.resolve({ device, timedOut: false });
 
 type IOBleErrorRemap = Error | BleError | null | undefined;
 
@@ -360,6 +533,8 @@ export default class ReactNativeBleTransport {
 
   stopped = false;
 
+  private readonly bondAbortController = new AbortController();
+
   scanTimeout = DEVICE_SCAN_TIMEOUT_MS;
 
   runPromise: Deferred<any> | null = null;
@@ -398,6 +573,20 @@ export default class ReactNativeBleTransport {
   /** Consecutive detections that failed while trusting sessionProtocols. */
   private protocolReprobeFailures: Map<string, number> = new Map();
 
+  /** Endpoints whose last detection got no answer; 'woken' once their Initialize wake is spent. */
+  private silentDetections = new Map<string, 'silent' | 'woken'>();
+
+  /**
+   * iOS can report a reset Pro2 as a generic peripheral disconnect instead of
+   * CBErrorPeerRemovedPairingInformation. Keep that first probe failure across
+   * the automatic cold reconnect and require a second failed probe before
+   * classifying the OS bond as invalid.
+   */
+  private iosProbeDisconnectEvidence = new Map<string, IosProbeDisconnectEvidence>();
+
+  /** Android endpoints whose cached GATT table is suspect; the next connect refreshes it. */
+  private androidGattCacheRefreshes = new Set<string>();
+
   /**
    * Native encryption/pairing failures seen before Protocol V2 probe starts.
    * Pro2/Neo GATT connect can succeed on a stale iOS bond; the CCCD write then
@@ -430,6 +619,14 @@ export default class ReactNativeBleTransport {
       this.rejectProtocolV2Frames(uuid, new Error(reason));
       Log?.debug('[ReactNativeBleTransport] Protocol V2 link invalidated:', uuid, reason);
       if (reason.startsWith('Protocol V2 link-fatal error:')) {
+        if (this.probingProtocols.get(uuid) !== 'V2') {
+          const transport = transportCache[uuid];
+          try {
+            this.emitDeviceDisconnect(uuid, transport?.device?.name, transport?.monitorToken);
+          } catch {
+            Log?.error('[ReactNativeBleTransport] Protocol V2 disconnect listener failed');
+          }
+        }
         await this.releaseNative(uuid, true);
       }
     },
@@ -450,6 +647,10 @@ export default class ReactNativeBleTransport {
   /** Serializes transport lifecycle changes for the same physical device. */
   private lifecycleOperations: Map<string, Promise<void>> = new Map();
 
+  private stopPromise?: Promise<void>;
+
+  private scanCleanups = new Set<() => Promise<void>>();
+
   constructor(options: TransportOptions) {
     this.scanTimeout = options.scanTimeout ?? DEVICE_SCAN_TIMEOUT_MS;
   }
@@ -485,10 +686,34 @@ export default class ReactNativeBleTransport {
     // empty
   }
 
-  getPlxManager(): Promise<BlePlxManager> {
-    if (this.blePlxManager) return Promise.resolve(this.blePlxManager);
-    this.blePlxManager = new BlePlxManager();
-    return Promise.resolve(this.blePlxManager);
+  async getPlxManager(): Promise<BlePlxManager> {
+    while (bleManagerResetPromise) {
+      await this.waitForManagerReset();
+    }
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+    if (!this.blePlxManager) this.blePlxManager = new BlePlxManager();
+    return this.blePlxManager;
+  }
+
+  private async waitForManagerReset(): Promise<void> {
+    if (!bleManagerResetPromise) return;
+    let timeout: ReturnType<typeof setTimeout> | undefined;
+    try {
+      await Promise.race([
+        bleManagerResetPromise,
+        new Promise<never>((_, reject) => {
+          timeout = setTimeout(
+            () => reject(this.createWedgedBleSetupError()),
+            BLE_CONNECT_TIMEOUT_MS
+          );
+        }),
+      ]);
+    } catch {
+      // A timeout or failed destroy is not permission to reuse the old singleton.
+      throw this.createWedgedBleSetupError();
+    } finally {
+      if (timeout) clearTimeout(timeout);
+    }
   }
 
   async resolveCharacteristics(device: Device): Promise<ResolvedBleCharacteristics> {
@@ -677,35 +902,58 @@ export default class ReactNativeBleTransport {
    * @returns
    */
   async enumerate() {
-    // eslint-disable-next-line no-async-promise-executor
-    return new Promise<IOneKeyDevice[]>(async (resolve, reject) => {
-      const deviceList: IOneKeyDevice[] = [];
-      const blePlxManager = await this.getPlxManager();
-      try {
-        await subscribeBleOn(blePlxManager);
-      } catch (error) {
-        Log?.debug('subscribeBleOn error: ', error);
-        reject(error);
-        return;
-      }
-
-      if (Platform.OS === 'android' && Platform.Version >= 31) {
-        Log?.debug('requesting permissions, please wait...');
+    const scanStartedAt = Date.now();
+    let firstDeviceMs: number | undefined;
+    const blePlxManager = await this.getPlxManager();
+    await subscribeBleOn(blePlxManager);
+    if (Platform.OS === 'android' && Platform.Version >= 31) {
+      Log?.debug('requesting permissions, please wait...');
 
-        const resultConnect = await PermissionsAndroid.requestMultiple([
-          PermissionsAndroid.PERMISSIONS.BLUETOOTH_CONNECT,
-          PermissionsAndroid.PERMISSIONS.BLUETOOTH_SCAN,
-        ]);
+      const resultConnect = await PermissionsAndroid.requestMultiple([
+        PermissionsAndroid.PERMISSIONS.BLUETOOTH_CONNECT,
+        PermissionsAndroid.PERMISSIONS.BLUETOOTH_SCAN,
+      ]);
 
-        Log?.debug('requesting permissions, result: ', resultConnect);
-        if (
-          resultConnect[PermissionsAndroid.PERMISSIONS.BLUETOOTH_CONNECT] !== 'granted' ||
-          resultConnect[PermissionsAndroid.PERMISSIONS.BLUETOOTH_SCAN] !== 'granted'
-        ) {
-          reject(ERRORS.TypedError(HardwareErrorCode.BlePermissionError));
-          return;
-        }
+      Log?.debug('requesting permissions, result: ', resultConnect);
+      if (
+        resultConnect[PermissionsAndroid.PERMISSIONS.BLUETOOTH_CONNECT] !== 'granted' ||
+        resultConnect[PermissionsAndroid.PERMISSIONS.BLUETOOTH_SCAN] !== 'granted'
+      ) {
+        throw ERRORS.TypedError(HardwareErrorCode.BlePermissionError);
       }
+    }
+
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+    return new Promise<IOneKeyDevice[]>((resolve, reject) => {
+      const deviceList: IOneKeyDevice[] = [];
+      let finished = false;
+      let scanCleanup: Promise<void> | undefined;
+      const finishScan = (error?: unknown) => {
+        if (scanCleanup) return scanCleanup;
+        finished = true;
+        clearScanTimer();
+        scanCleanup = this.runNativeTeardown('scan', blePlxManager, async () => {
+          await blePlxManager.stopDeviceScan();
+        }).then(() => {
+          this.scanCleanups.delete(cancelScan);
+          if (error) reject(error);
+          else resolve(deviceList);
+        });
+        return scanCleanup;
+      };
+      const cancelScan = () =>
+        finishScan(ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected));
+      this.scanCleanups.add(cancelScan);
+
+      const clearScanTimer = timer.timeout(() => {
+        Log?.debug('[ReactNativeBleTransport] scan completed', {
+          elapsedMs: Date.now() - scanStartedAt,
+          firstDeviceMs,
+          deviceCount: deviceList.length,
+          scanWindowMs: this.scanTimeout,
+        });
+        finishScan();
+      }, this.scanTimeout);
 
       blePlxManager.startDeviceScan(
         getBluetoothServiceUuids(),
@@ -721,18 +969,17 @@ export default class ReactNativeBleTransport {
                 error.errorCode
               )
             ) {
-              reject(ERRORS.TypedError(HardwareErrorCode.BlePermissionError));
+              finishScan(ERRORS.TypedError(HardwareErrorCode.BlePermissionError));
             } else if (error.errorCode === BleErrorCode.BluetoothUnauthorized) {
-              reject(ERRORS.TypedError(HardwareErrorCode.BleLocationError));
+              finishScan(ERRORS.TypedError(HardwareErrorCode.BleLocationError));
             } else if (error.errorCode === BleErrorCode.LocationServicesDisabled) {
-              reject(ERRORS.TypedError(HardwareErrorCode.BleLocationServicesDisabled));
+              finishScan(ERRORS.TypedError(HardwareErrorCode.BleLocationServicesDisabled));
             } else if (error.errorCode === BleErrorCode.ScanStartFailed) {
               // Android Bluetooth will report an error when the search frequency is too fast,
               // then nothing is processed and an empty array of devices is returned.
               // Then the next search will be back to normal
-              timer.timeout(() => {}, this.scanTimeout);
             } else {
-              reject(ERRORS.TypedError(HardwareErrorCode.BleScanError, error.reason ?? ''));
+              finishScan(ERRORS.TypedError(HardwareErrorCode.BleScanError, error.reason ?? ''));
             }
             return;
           }
@@ -764,6 +1011,7 @@ export default class ReactNativeBleTransport {
         }
       );
 
+      if (finished) return;
       getConnectedDeviceIds(Platform.OS === 'ios' ? getBluetoothServiceUuids() : []).then(
         devices => {
           for (const device of devices) {
@@ -783,11 +1031,13 @@ export default class ReactNativeBleTransport {
               addDevice(device as unknown as Device);
             }
           }
-        }
+        },
+        error => Log?.debug('search connected peripheral failed:', error)
       );
 
       const addDevice = (device: Device) => {
-        if (deviceList.every(d => d.id !== device.id)) {
+        if (!finished && deviceList.every(d => d.id !== device.id)) {
+          firstDeviceMs ??= Date.now() - scanStartedAt;
           const displayName = getDeviceDisplayName(device) ?? 'Unknown BLE Device';
 
           deviceList.push({
@@ -802,11 +1052,6 @@ export default class ReactNativeBleTransport {
           });
         }
       };
-
-      timer.timeout(() => {
-        blePlxManager.stopDeviceScan();
-        resolve(deviceList);
-      }, this.scanTimeout);
     });
   }
 
@@ -817,6 +1062,7 @@ export default class ReactNativeBleTransport {
   ) {
     const { writeCharacteristic, notifyCharacteristic } =
       characteristics ?? (await this.resolveCharacteristicsWithTimeout(uuid, device));
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
     const transport = new BleTransport(device, writeCharacteristic, notifyCharacteristic);
     transport.mtuSize = typeof device.mtu === 'number' ? device.mtu : undefined;
     const monitorToken = this.nextMonitorToken;
@@ -845,39 +1091,12 @@ export default class ReactNativeBleTransport {
     } else if (Platform.OS === 'android') {
       await delay(ANDROID_NOTIFY_READY_DELAY_MS);
     }
-
-    const initialMtu = transport.mtuSize;
-    let refreshAttempts = 0;
-    if (
-      (Platform.OS === 'ios' || Platform.OS === 'android') &&
-      shouldRefreshNegotiatedMtu(transport.mtuSize)
-    ) {
-      refreshAttempts += 1;
-      let refreshedDevice = await requestNegotiatedMtu(
-        transport.device,
-        'servicesAndNotifyReady',
-        1
-      );
-      transport.device = refreshedDevice;
-      transport.mtuSize =
-        typeof refreshedDevice.mtu === 'number' ? refreshedDevice.mtu : transport.mtuSize;
-
-      if (shouldRefreshNegotiatedMtu(transport.mtuSize)) {
-        await delay(BLE_MTU_REFRESH_RETRY_DELAY_MS);
-        refreshAttempts += 1;
-        refreshedDevice = await requestNegotiatedMtu(transport.device, 'servicesAndNotifyReady', 2);
-        transport.device = refreshedDevice;
-        transport.mtuSize =
-          typeof refreshedDevice.mtu === 'number' ? refreshedDevice.mtu : transport.mtuSize;
-      }
-    }
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
 
     Log?.debug('[ReactNativeBleTransport] BLE MTU ready', {
       platform: Platform.OS,
       requested: getRequestedBleMtu(),
-      initial: initialMtu,
       actual: transport.mtuSize,
-      refreshAttempts,
     });
 
     return transport;
@@ -894,6 +1113,7 @@ export default class ReactNativeBleTransport {
   }
 
   private async acquireUnlocked(input: FirmwareInstallBleAcquireInput) {
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
     const { uuid, forceCleanRunPromise, expectedProtocol, skipProtocolProbe } = input;
     const shouldMapProtocolV2StaleBond = expectedProtocol
       ? expectedProtocol === 'V2'
@@ -944,11 +1164,16 @@ export default class ReactNativeBleTransport {
         const isCachedDeviceConnected = await cachedTransport.device
           .isConnected()
           .catch(() => false);
+        // A suspect GATT table is only refreshed through a new connect.
+        const isCachedAndroidLinkUsable =
+          Platform.OS !== 'android' || !this.androidGattCacheRefreshes.has(uuid);
         if (
           isCachedDeviceConnected &&
+          isCachedAndroidLinkUsable &&
           cachedProtocol &&
           (!expectedProtocol || cachedProtocol === expectedProtocol)
         ) {
+          if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
           Log?.debug('[ReactNativeBleTransport] reuse cached BLE transport:', uuid, cachedProtocol);
           return { uuid, protocolType: cachedProtocol };
         }
@@ -963,6 +1188,18 @@ export default class ReactNativeBleTransport {
     }
 
     let device: Device | null = null;
+    const isAndroid = Platform.OS === 'android';
+    // A firmware-install reconnect always refreshes: the new firmware may expose a different table.
+    const refreshAndroidGattCache =
+      isAndroid && (!!skipProtocolProbe || this.androidGattCacheRefreshes.has(uuid));
+    let nativeConnectOptions = connectOptions;
+    if (isAndroid) {
+      nativeConnectOptions = refreshAndroidGattCache
+        ? androidRefreshGattConnectOptions
+        : fallbackConnectOptions;
+    }
+    // Only a connect that carried refreshGatt clears the marker; the fallback connects drop it.
+    let androidRefreshConnectRan = false;
 
     if (forceCleanRunPromise && this.runPromise) {
       const error = ERRORS.TypedError(HardwareErrorCode.BleForceCleanRunPromise);
@@ -973,6 +1210,7 @@ export default class ReactNativeBleTransport {
     }
 
     const blePlxManager = await this.getPlxManager();
+    let skipPostConnectMtu = false;
     try {
       await subscribeBleOn(blePlxManager);
     } catch (error) {
@@ -980,6 +1218,27 @@ export default class ReactNativeBleTransport {
       throw error;
     }
 
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+    if (Platform.OS === 'android') {
+      // Initiate bonding locally before GATT can trigger peripheral-initiated pairing.
+      try {
+        const bondState = await pairDevice(uuid);
+        if (bondState.bonding) {
+          await onDeviceBondState(uuid, this.bondAbortController.signal);
+        } else if (!bondState.bonded) {
+          throw ERRORS.TypedError(HardwareErrorCode.BleDeviceNotBonded, 'device is not bonded');
+        }
+      } catch (error) {
+        await this.runNativeTeardown(uuid, blePlxManager, async () => {
+          await this.runBestEffortNativeOperation('bond failure: cancel manager connection', () =>
+            blePlxManager.cancelDeviceConnection(uuid)
+          );
+        });
+        throw error;
+      }
+    }
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+
     if (!device) {
       const devices = await blePlxManager.devices([uuid]);
       [device] = devices;
@@ -996,17 +1255,16 @@ export default class ReactNativeBleTransport {
       Log?.debug('try to connect to device: ', uuid);
       try {
         device = await this.connectWithTimeout(uuid, () =>
-          blePlxManager.connectToDevice(uuid, connectOptions)
+          blePlxManager.connectToDevice(uuid, nativeConnectOptions)
         );
+        androidRefreshConnectRan = refreshAndroidGattCache;
       } catch (e) {
         Log?.debug('try to connect to device has error: ', e);
         if (shouldRethrowBleSetupError(e)) {
           throw e;
         }
-        if (
-          e.errorCode === BleErrorCode.DeviceMTUChangeFailed ||
-          e.errorCode === BleErrorCode.OperationCancelled
-        ) {
+        if (isMtuOrCancelledConnectError(e)) {
+          skipPostConnectMtu = true;
           Log?.debug('first try to reconnect without params');
           device = await this.connectWithTimeout(uuid, () =>
             blePlxManager.connectToDevice(uuid, fallbackConnectOptions)
@@ -1024,23 +1282,33 @@ export default class ReactNativeBleTransport {
       throw ERRORS.TypedError(HardwareErrorCode.BleConnectedError, 'unable to connect to device');
     }
 
+    if (
+      refreshAndroidGattCache &&
+      !androidRefreshConnectRan &&
+      (await device.isConnected().catch(() => false))
+    ) {
+      // refreshGatt only reaches the stack through a connect. A link that is still up would
+      // skip the connect below and keep serving the stale table, so it is dropped first.
+      await this.dropAndroidLink(uuid, blePlxManager, device, 'gatt cache refresh');
+      if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+    }
+
     if (!(await device.isConnected())) {
       Log?.debug('not connected, try to connect to device: ', uuid);
       const disconnectedDevice = device;
 
       try {
         device = await this.connectWithTimeout(uuid, () =>
-          disconnectedDevice.connect(connectOptions)
+          disconnectedDevice.connect(nativeConnectOptions)
         );
+        androidRefreshConnectRan = refreshAndroidGattCache;
       } catch (e) {
         Log?.debug('not connected, try to connect to device has error: ', e);
         if (shouldRethrowBleSetupError(e)) {
           throw e;
         }
-        if (
-          e.errorCode === BleErrorCode.DeviceMTUChangeFailed ||
-          e.errorCode === BleErrorCode.OperationCancelled
-        ) {
+        if (isMtuOrCancelledConnectError(e)) {
+          skipPostConnectMtu = true;
           Log?.debug('second try to reconnect without params');
           try {
             device = await this.connectWithTimeout(uuid, () =>
@@ -1066,42 +1334,80 @@ export default class ReactNativeBleTransport {
       }
     }
 
-    if (Platform.OS === 'android') {
-      // Establish the LE link before createBond(). Without an existing LE ACL,
-      // Android TRANSPORT_AUTO can choose BR/EDR for a BLE-only device.
-      const connectedDevice = device;
-      try {
-        if (!(await connectedDevice.isConnected().catch(() => false))) {
-          throw ERRORS.TypedError(
-            HardwareErrorCode.BleConnectedError,
-            `Device ${uuid} is not connected before bonding`
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+    if (Platform.OS === 'android' && !(await device.isConnected().catch(() => false))) {
+      const disconnectedDevice = device;
+      await this.runNativeTeardown(uuid, blePlxManager, async () => {
+        await Promise.all([
+          this.runBestEffortNativeOperation('connect failure: cancel manager connection', () =>
+            blePlxManager.cancelDeviceConnection(uuid)
+          ),
+          this.runBestEffortNativeOperation('connect failure: cancel device connection', () =>
+            disconnectedDevice.cancelConnection()
+          ),
+        ]);
+      });
+      throw ERRORS.TypedError(HardwareErrorCode.BleConnectedError, 'device is not connected');
+    }
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+    let characteristics: ResolvedBleCharacteristics | undefined;
+    if (isAndroid) {
+      if (refreshAndroidGattCache) {
+        // refreshGatt has already started a full rediscovery; let it finish before the MTU
+        // exchange so the request is not queued behind it.
+        characteristics = await this.resolveCharacteristicsWithTimeout(uuid, device);
+        if (androidRefreshConnectRan) this.androidGattCacheRefreshes.delete(uuid);
+        if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+      }
+      device = await this.negotiateAndroidMtu(uuid, blePlxManager, device);
+    } else if (!skipPostConnectMtu) {
+      // Match 1.1.31: MTU is a connect() best-effort. If connect already fell back
+      // without requestMTU, do not put another requestMTU on the native serial
+      // queue — that is what wedges GATT after Account#2 reconnect.
+      const mtuResult = await resolveNegotiatedMtu(device, transactionId =>
+        blePlxManager.cancelTransaction(transactionId)
+      );
+      device = mtuResult.device;
+      if (mtuResult.timedOut) {
+        if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+        Log?.debug(
+          '[ReactNativeBleTransport] post-connect MTU timed out, reconnecting without requesting MTU'
+        );
+        const timedOutDevice = device;
+        let mtuTeardownSettled = false;
+        await this.runNativeTeardown(uuid, blePlxManager, async () => {
+          await this.runBestEffortNativeOperation('mtu timeout: cancel device connection', () =>
+            timedOutDevice.cancelConnection()
           );
+          mtuTeardownSettled = true;
+        });
+        if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+        if (!mtuTeardownSettled || this.blePlxManager !== blePlxManager) {
+          // The teardown budget expired and the manager that owned timedOutDevice was reset.
+          throw ERRORS.TypedError(HardwareErrorCode.BleTimeoutError, 'BLE MTU cleanup timed out');
         }
-        const bondState = await pairDevice(uuid);
-        if (bondState.bonding) {
-          await onDeviceBondState(uuid);
-        } else if (!bondState.bonded) {
-          throw ERRORS.TypedError(HardwareErrorCode.BleDeviceNotBonded, 'device is not bonded');
+        try {
+          device = await this.connectWithTimeout(uuid, () =>
+            timedOutDevice.connect(fallbackConnectOptions)
+          );
+        } catch (error) {
+          if (shouldRethrowBleSetupError(error)) throw error;
+          if (
+            (error as { errorCode?: unknown })?.errorCode === BleErrorCode.DeviceAlreadyConnected
+          ) {
+            // GATT resolution and the protocol probe below still validate the retained link.
+            device = timedOutDevice;
+          } else {
+            remapError(error);
+          }
         }
-      } catch (error) {
-        await this.runNativeTeardown(uuid, blePlxManager, async () => {
-          await Promise.all([
-            this.runBestEffortNativeOperation('bond failure: cancel manager connection', () =>
-              blePlxManager.cancelDeviceConnection(uuid)
-            ),
-            this.runBestEffortNativeOperation('bond failure: cancel device connection', () =>
-              connectedDevice.cancelConnection()
-            ),
-          ]);
-        });
-        throw error;
       }
     }
-
-    device = await resolveNegotiatedMtu(device);
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
     const acquiredDevice = device;
     const { writeCharacteristic, notifyCharacteristic } =
-      await this.resolveCharacteristicsWithTimeout(uuid, acquiredDevice);
+      characteristics ?? (await this.resolveCharacteristicsWithTimeout(uuid, acquiredDevice));
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
 
     const protocolHint = expectedProtocol
       ? undefined
@@ -1163,6 +1469,7 @@ export default class ReactNativeBleTransport {
           await this.installTransportForAcquire(uuid, acquiredDevice);
         }
       );
+      if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
       const currentTransport = transportCache[uuid];
       if (!currentTransport) {
         throw ERRORS.TypedError(HardwareErrorCode.TransportNotFound);
@@ -1170,11 +1477,11 @@ export default class ReactNativeBleTransport {
       this.attachDisconnectSubscription(currentTransport, currentTransport.device, uuid);
       return { uuid, protocolType };
     } catch (error) {
-      if (isBleStaleBondHardwareError(error)) {
-        await this.disconnectUnlocked(uuid);
-      } else {
-        await this.releaseUnlocked(uuid, true);
-      }
+      // A failed acquire must retire the physical link before Core retries. Logical
+      // release leaves GATT connected even when neither protocol receives a response.
+      await this.disconnectUnlocked(uuid, {
+        preserveIosProbeDisconnect: this.iosProbeDisconnectEvidence.has(uuid),
+      });
       throw error;
     } finally {
       this.acquiringProtocolV2.delete(uuid);
@@ -1212,6 +1519,9 @@ export default class ReactNativeBleTransport {
           this.rememberStaleBondError(uuid, toBleStaleBondHardwareError(error));
           return;
         }
+        if (Platform.OS === 'android' && isStaleGattTableNotifyReason(error.reason)) {
+          this.androidGattCacheRefreshes.add(uuid);
+        }
         if (this.getActiveProtocol(uuid) === 'V2') {
           let errorCode:
             | typeof HardwareErrorCode.BleCharacteristicNotifyError
@@ -1221,10 +1531,7 @@ export default class ReactNativeBleTransport {
           if (error.reason?.includes('The connection has timed out unexpectedly')) {
             errorCode = HardwareErrorCode.BleTimeoutError;
           } else if (
-            error.reason?.includes('Cannot write client characteristic config descriptor') ||
-            error.reason?.includes('Cannot find client characteristic config descriptor') ||
-            error.reason?.includes('The handle is invalid') ||
-            error.reason?.includes('Writing is not permitted') ||
+            isStaleGattTableNotifyReason(error.reason) ||
             error.reason?.includes('notify change failed for device')
           ) {
             errorCode = HardwareErrorCode.BleCharacteristicNotifyChangeFailure;
@@ -1241,10 +1548,7 @@ export default class ReactNativeBleTransport {
             ERROR = HardwareErrorCode.BleTimeoutError;
           }
           if (
-            error.reason?.includes('Cannot write client characteristic config descriptor') ||
-            error.reason?.includes('Cannot find client characteristic config descriptor') || // pro firmware 2.3.0 upgrade
-            error.reason?.includes('The handle is invalid') ||
-            error.reason?.includes('Writing is not permitted') || // pro firmware 2.3.4 upgrade
+            isStaleGattTableNotifyReason(error.reason) ||
             error.reason?.includes('notify change failed for device')
           ) {
             const notifyError = ERRORS.TypedError(
@@ -1674,13 +1978,14 @@ export default class ReactNativeBleTransport {
       const jsonData = ProtocolV1.decodeMessage(messages, response);
       return check.call(jsonData);
     } catch (e) {
-      if (name === 'GetFeatures' && options?.timeoutMs === PROTOCOL_PROBE_TIMEOUT_MS) {
-        Log?.debug('[ReactNativeBleTransport] Protocol V1 GetFeatures probe call failed:', e);
+      const isProbeTimeout =
+        options?.timeoutMs === PROTOCOL_PROBE_TIMEOUT_MS &&
+        (name === 'GetFeatures' || name === 'Initialize');
+      if (isProbeTimeout) {
+        Log?.debug(`[ReactNativeBleTransport] Protocol V1 ${name} probe call failed:`, e);
       } else {
         Log?.error('call error: ', e);
       }
-      const isProbeTimeout =
-        name === 'GetFeatures' && options?.timeoutMs === PROTOCOL_PROBE_TIMEOUT_MS;
       // A call that has been superseded (forceRun) or cleaned up no longer owns the
       // transport; its late timeout must not tear down the connection the current
       // call is actively using.
@@ -1703,14 +2008,60 @@ export default class ReactNativeBleTransport {
   }
 
   stop() {
+    if (this.stopPromise) return this.stopPromise;
     this.stopped = true;
+    // Bonding precedes GATT, so cancelDeviceConnection cannot end this wait.
+    this.bondAbortController.abort();
+    const deviceIds = new Set([
+      ...this.monitorTokens.keys(),
+      ...this.sessionProtocols.keys(),
+      ...this.lifecycleOperations.keys(),
+      ...(this.runPromiseDeviceId ? [this.runPromiseDeviceId] : []),
+    ]);
+    const scans = Array.from(this.scanCleanups, cleanup => cleanup());
+    this.androidPriorityResetTimers.forEach(timeout => clearTimeout(timeout));
+    this.androidPriorityResetTimers.clear();
+    this.androidHighPriorityDevices.clear();
+    this.iosProbeDisconnectEvidence.clear();
+    const error = ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+    this.runPromise?.reject(error);
+    this.runPromise = null;
+    this.runPromiseDeviceId = null;
+    deviceIds.forEach(uuid => this.rejectProtocolV2Frames(uuid, error));
+    const manager = this.blePlxManager;
+    // Cancel native setup before waiting for its lifecycle lock. Otherwise stop
+    // waits for the very connect/MTU/GATT operation it needs to interrupt.
+    const pendingConnections = manager
+      ? Array.from(this.lifecycleOperations.keys(), uuid =>
+          this.runNativeTeardown(uuid, manager, async () => {
+            await this.runBestEffortNativeOperation('stop: cancel pending device connection', () =>
+              manager.cancelDeviceConnection(uuid)
+            );
+          })
+        )
+      : [];
+    // Release only this transport's endpoints; other connectors may share ble-plx.
+    this.stopPromise = Promise.all([
+      ...scans,
+      ...pendingConnections,
+      ...Array.from(deviceIds, uuid => this.disconnect(uuid)),
+    ]).then(async () => {
+      await this.protocolV2Links.invalidateAllLinks('React Native BLE transport stopped');
+      await this.waitForManagerReset();
+      this.blePlxManager = undefined;
+      this.emitter = undefined;
+    });
+    return this.stopPromise;
   }
 
   async disconnect(session: string) {
     return this.runLifecycleOperation(session, () => this.disconnectUnlocked(session));
   }
 
-  private async disconnectUnlocked(session: string) {
+  private async disconnectUnlocked(
+    session: string,
+    options?: { preserveIosProbeDisconnect?: boolean }
+  ) {
     await this.protocolV2Links.invalidateLink(session, 'React Native BLE transport disconnected');
     const transport = transportCache[session];
     const manager = this.blePlxManager;
@@ -1752,6 +2103,9 @@ export default class ReactNativeBleTransport {
     this.deviceProtocolHints.delete(session);
     this.sessionProtocols.delete(session);
     this.protocolReprobeFailures.delete(session);
+    if (!options?.preserveIosProbeDisconnect) {
+      this.iosProbeDisconnectEvidence.delete(session);
+    }
     this.protocolV2Assemblers.delete(session);
     this.resetProtocolV2Frames(session);
 
@@ -1855,17 +2209,119 @@ export default class ReactNativeBleTransport {
     }
   }
 
-  cancel() {
+  async cancel() {
     Log?.debug('transport-react-native transport cancel');
-    if (this.runPromise) {
-      // this.runPromise.reject(new Error('Transport_CallCanceled'));
+    const pending = this.runPromise;
+    const deviceId = this.runPromiseDeviceId;
+    if (pending) {
+      pending.reject(ERRORS.TypedError(HardwareErrorCode.CallQueueActionCancelled));
+      if (this.runPromise === pending) {
+        this.runPromise = null;
+        this.runPromiseDeviceId = null;
+      }
+      // A V1 read cannot be safely reused after abandoning its response.
+      // Drain native teardown before DeviceCommands releases the operation.
+      if (deviceId) await this.disconnect(deviceId);
     }
-    this.runPromise = null;
-    this.runPromiseDeviceId = null;
+  }
+
+  /**
+   * Android: request the MTU with nothing queued ahead and never close the client while it is
+   * outstanding; a link that times out or stays at MTU 23 is dropped.
+   */
+  private async negotiateAndroidMtu(
+    uuid: string,
+    manager: BlePlxManager,
+    device: Device
+  ): Promise<Device> {
+    if (!shouldRefreshNegotiatedMtu(device.mtu)) return device;
+
+    const startedAt = Date.now();
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    let timedOut = false;
+    let negotiated = device;
+    let failure: string | undefined;
+    try {
+      negotiated = await Promise.race([
+        device.requestMTU(ANDROID_REQUEST_MTU, `${device.id}:mtu:connected:0:${startedAt}`),
+        new Promise<never>((_, reject) => {
+          timer = setTimeout(() => {
+            timedOut = true;
+            reject(
+              new Error(`BLE MTU exchange timeout after ${ANDROID_MTU_EXCHANGE_TIMEOUT_MS}ms`)
+            );
+          }, ANDROID_MTU_EXCHANGE_TIMEOUT_MS);
+        }),
+      ]);
+    } catch (error) {
+      failure = error instanceof Error ? error.message : String(error);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+    Log?.debug(`[ReactNativeBleTransport] BLE MTU exchange ${failure ? 'failed' : 'completed'}`, {
+      connectIdSuffix: uuid.slice(-8),
+      elapsedMs: Date.now() - startedAt,
+      timedOut,
+      actual: negotiated.mtu,
+      error: failure,
+    });
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+    if (!timedOut && !isKnownDefaultMtu(negotiated.mtu)) return negotiated;
+
+    // Counted like a setup timeout so a link that keeps failing reaches the wedged-link guard.
+    const resetManager = this.abandonStalledConnection(
+      uuid,
+      timedOut ? 'mtu-backstop' : 'mtu-default'
+    );
+    await this.dropAndroidLink(
+      uuid,
+      manager,
+      negotiated,
+      timedOut ? 'mtu exchange timeout' : 'default mtu'
+    );
+    if (resetManager) throw this.createWedgedBleSetupError();
+    throw ERRORS.TypedError(
+      HardwareErrorCode.BleConnectedError,
+      timedOut
+        ? 'BLE MTU exchange did not complete, reconnecting on a fresh link'
+        : `BLE link stayed at the default MTU ${negotiated.mtu}, reconnecting on a fresh link`
+    );
+  }
+
+  /** Close the client and wait out the link idle timer so the next connect gets a fresh link. */
+  private async dropAndroidLink(
+    uuid: string,
+    manager: BlePlxManager,
+    device: Device,
+    reason: string
+  ) {
+    await this.runNativeTeardown(uuid, manager, async () => {
+      await Promise.all([
+        this.runBestEffortNativeOperation(`${reason}: cancel manager connection`, () =>
+          manager.cancelDeviceConnection(uuid)
+        ),
+        this.runBestEffortNativeOperation(`${reason}: cancel device connection`, () =>
+          device.cancelConnection()
+        ),
+      ]);
+    });
+
+    const startedAt = Date.now();
+    while (!this.stopped && Date.now() - startedAt < ANDROID_LINK_DROP_QUIET_MS) {
+      await delay(ANDROID_LINK_DROP_POLL_MS);
+    }
+    Log?.debug('[ReactNativeBleTransport] Android BLE link drop', {
+      connectIdSuffix: uuid.slice(-8),
+      reason,
+      stopped: this.stopped,
+    });
   }
 
   /** Run a native connect under the JS backstop budget. */
   private async connectWithTimeout<T>(uuid: string, connect: () => Promise<T>): Promise<T> {
+    if (this.stopped) throw ERRORS.TypedError(HardwareErrorCode.BleDeviceDisconnected);
+    const startedAt = Date.now();
+    let succeeded = false;
     let timer: ReturnType<typeof setTimeout> | undefined;
     let timedOut = false;
     const pending = connect();
@@ -1887,6 +2343,7 @@ export default class ReactNativeBleTransport {
           }, BLE_CONNECT_TIMEOUT_MS);
         }),
       ]);
+      succeeded = true;
       return result;
     } catch (error) {
       if (timedOut || isNativeOperationTimeoutError(error)) {
@@ -1901,6 +2358,12 @@ export default class ReactNativeBleTransport {
       throw error;
     } finally {
       if (timer) clearTimeout(timer);
+      Log?.debug('[ReactNativeBleTransport] connect completed', {
+        connectIdSuffix: uuid.slice(-8),
+        elapsedMs: Date.now() - startedAt,
+        succeeded,
+        backstopExpired: timedOut,
+      });
     }
   }
 
@@ -1909,6 +2372,8 @@ export default class ReactNativeBleTransport {
     uuid: string,
     device: Device
   ): Promise<ResolvedBleCharacteristics> {
+    const startedAt = Date.now();
+    let succeeded = false;
     let timer: ReturnType<typeof setTimeout> | undefined;
     let timedOut = false;
     const pending = this.resolveCharacteristics(device);
@@ -1929,6 +2394,7 @@ export default class ReactNativeBleTransport {
         }),
       ]);
       this.connectionSetupTimeoutCounts.delete(uuid);
+      succeeded = true;
       return result;
     } catch (error) {
       if (timedOut || isNativeOperationTimeoutError(error)) {
@@ -1940,9 +2406,18 @@ export default class ReactNativeBleTransport {
           throw this.createWedgedBleSetupError();
         }
       }
+      if (Platform.OS === 'android' && isMissingGattShapeError(error)) {
+        this.androidGattCacheRefreshes.add(uuid);
+      }
       throw error;
     } finally {
       if (timer) clearTimeout(timer);
+      Log?.debug('[ReactNativeBleTransport] GATT setup completed', {
+        connectIdSuffix: uuid.slice(-8),
+        elapsedMs: Date.now() - startedAt,
+        succeeded,
+        backstopExpired: timedOut,
+      });
     }
   }
 
@@ -1954,7 +2429,13 @@ export default class ReactNativeBleTransport {
    */
   private abandonStalledConnection(
     uuid: string,
-    stage: 'connect-backstop' | 'connect-native' | 'gatt-backstop' | 'gatt-native'
+    stage:
+      | 'connect-backstop'
+      | 'connect-native'
+      | 'gatt-backstop'
+      | 'gatt-native'
+      | 'mtu-backstop'
+      | 'mtu-default'
   ): boolean {
     const timeouts = (this.connectionSetupTimeoutCounts.get(uuid) ?? 0) + 1;
     this.connectionSetupTimeoutCounts.set(uuid, timeouts);
@@ -1973,6 +2454,7 @@ export default class ReactNativeBleTransport {
     this.deviceProtocol.delete(uuid);
     this.probingProtocols.delete(uuid);
     this.staleBondErrors.delete(uuid);
+    this.iosProbeDisconnectEvidence.delete(uuid);
     this.acquiringProtocolV2.delete(uuid);
     this.protocolV2Assemblers.delete(uuid);
     this.resetProtocolV2Frames(uuid);
@@ -2071,6 +2553,7 @@ export default class ReactNativeBleTransport {
     this.deviceProtocol.delete(uuid);
     this.probingProtocols.delete(uuid);
     this.staleBondErrors.delete(uuid);
+    this.iosProbeDisconnectEvidence.delete(uuid);
     this.acquiringProtocolV2.delete(uuid);
     this.protocolV2Assemblers.delete(uuid);
     this.resetProtocolV2Frames(uuid);
@@ -2086,6 +2569,7 @@ export default class ReactNativeBleTransport {
   }
 
   private resetPlxManager() {
+    if (bleManagerResetPromise) return;
     const manager = this.blePlxManager;
     this.blePlxManager = undefined;
     const reason = 'React Native BLE manager reset';
@@ -2123,20 +2607,32 @@ export default class ReactNativeBleTransport {
     this.deviceProtocol.clear();
     this.probingProtocols.clear();
     this.staleBondErrors.clear();
+    this.iosProbeDisconnectEvidence.clear();
     this.acquiringProtocolV2.clear();
     this.sessionProtocols.clear();
     // Keep transport-lifetime V2 proof so the same endpoint can finish a no-probe
     // firmware reconnect after the native BLE manager is recreated.
     this.protocolReprobeFailures.clear();
+    this.silentDetections.clear();
     this.writeTimeoutCounts.clear();
     this.connectionSetupTimeoutCounts.clear();
     this.monitorTokens.clear();
     this.protocolV2Assemblers.clear();
+    let reset: Promise<void>;
     try {
-      manager?.destroy();
+      reset = Promise.resolve(manager?.destroy());
     } catch (error) {
-      Log?.debug('[ReactNativeBleTransport] BLE manager destroy failed (ignored):', error);
+      reset = Promise.reject(error);
     }
+    bleManagerResetPromise = reset;
+    reset.then(
+      () => {
+        if (bleManagerResetPromise === reset) bleManagerResetPromise = undefined;
+      },
+      error => {
+        Log?.error('[ReactNativeBleTransport] BLE manager destroy failed:', error);
+      }
+    );
   }
 
   private createProtocolMismatchError(expected: ProtocolType) {
@@ -2155,6 +2651,47 @@ export default class ReactNativeBleTransport {
     );
   }
 
+  private rememberIosProbeDisconnect(
+    uuid: string,
+    phase: IosProbeDisconnectEvidence['phase'],
+    error: unknown
+  ): Error | undefined {
+    if (!isIosProbeDisconnectError(error)) return undefined;
+
+    const previous = this.iosProbeDisconnectEvidence.get(uuid);
+    const errorCode = (error as { errorCode?: unknown })?.errorCode;
+    const evidence: IosProbeDisconnectEvidence = {
+      phase,
+      ...(typeof errorCode === 'string' || typeof errorCode === 'number' ? { errorCode } : {}),
+    };
+    this.iosProbeDisconnectEvidence.set(uuid, evidence);
+    Log?.debug('[ReactNativeBleTransport][BleBondDiagnostic] probe disconnect recorded', {
+      phase,
+      errorCode: evidence.errorCode,
+      repeated: Boolean(previous),
+    });
+
+    if (!previous) return undefined;
+    return this.consumeIosProbeDisconnect(uuid, 'repeated-probe-disconnect');
+  }
+
+  private consumeIosProbeDisconnect(
+    uuid: string,
+    confirmation: 'repeated-probe-disconnect' | 'follow-up-no-response'
+  ): Error | undefined {
+    const evidence = this.iosProbeDisconnectEvidence.get(uuid);
+    if (!evidence) return undefined;
+
+    this.iosProbeDisconnectEvidence.delete(uuid);
+    Log?.debug('[ReactNativeBleTransport][BleBondDiagnostic] stale bond confirmed', {
+      confirmation,
+      triggerPhase: evidence.phase,
+      triggerErrorCode: evidence.errorCode,
+      finalErrorCode: HardwareErrorCode.BleBondInvalid,
+    });
+    return ERRORS.TypedError(HardwareErrorCode.BleBondInvalid);
+  }
+
   private clearProbeProtocol(uuid: string, protocol: ProtocolType) {
     if (this.probingProtocols.get(uuid) === protocol) {
       this.probingProtocols.delete(uuid);
@@ -2186,6 +2723,7 @@ export default class ReactNativeBleTransport {
     // received no response. skipProtocolProbe does not need it either — its only
     // caller is the V2 firmware-install reconnect.
     if (expectedProtocol === 'V1') {
+      this.iosProbeDisconnectEvidence.delete(uuid);
       this.deviceProtocol.set(uuid, 'V1');
       Log?.debug('[ReactNativeBleTransport] protocol selected', {
         deviceId: uuid,
@@ -2201,6 +2739,7 @@ export default class ReactNativeBleTransport {
 
     if (expectedProtocol === 'V2') {
       if (await this.probeProtocolV2(uuid)) {
+        this.iosProbeDisconnectEvidence.delete(uuid);
         this.deviceProtocol.set(uuid, 'V2');
         this.sessionProtocols.set(uuid, 'V2');
         this.confirmedProtocolV2.add(uuid);
@@ -2211,6 +2750,18 @@ export default class ReactNativeBleTransport {
         });
         return 'V2';
       }
+      const staleBondError = this.consumeIosProbeDisconnect(uuid, 'follow-up-no-response');
+      if (Platform.OS === 'ios') {
+        Log?.debug('[ReactNativeBleTransport][BleBondDiagnostic] protocol detection ended', {
+          outcome: 'expected-v2-no-response',
+          expectedProtocol,
+          protocolHint: protocolHint ?? 'none',
+          finalErrorCode: staleBondError
+            ? HardwareErrorCode.BleBondInvalid
+            : HardwareErrorCode.RuntimeError,
+        });
+      }
+      if (staleBondError) throw staleBondError;
       throw this.createProtocolMismatchError(expectedProtocol);
     }
 
@@ -2229,6 +2780,8 @@ export default class ReactNativeBleTransport {
       reprobeFailures < PROTOCOL_REPROBE_FALLBACK_ATTEMPTS;
     const probeOrder: ProtocolType[] = trustSessionProtocol ? [sessionProtocol] : fullProbeOrder;
 
+    await this.wakeSilentProtocolV1Device(uuid, probeOrder);
+
     for (let i = 0; i < probeOrder.length; i += 1) {
       const protocol = probeOrder[i];
       if (i > 0) {
@@ -2244,12 +2797,14 @@ export default class ReactNativeBleTransport {
       const detected =
         protocol === 'V1' ? await this.probeProtocolV1(uuid) : await this.probeProtocolV2(uuid);
       if (detected) {
+        this.iosProbeDisconnectEvidence.delete(uuid);
         this.deviceProtocol.set(uuid, protocol);
         this.sessionProtocols.set(uuid, protocol);
         if (protocol === 'V2') {
           this.confirmedProtocolV2.add(uuid);
         }
         this.protocolReprobeFailures.delete(uuid);
+        this.silentDetections.delete(uuid);
         Log?.debug('[ReactNativeBleTransport] protocol detected', {
           deviceId: uuid,
           protocol,
@@ -2259,6 +2814,9 @@ export default class ReactNativeBleTransport {
       }
     }
 
+    // Arms the wake for the next detection.
+    if (!this.silentDetections.has(uuid)) this.silentDetections.set(uuid, 'silent');
+
     if (trustSessionProtocol) {
       // Still silent on its own protocol: count it, and let the streak expire the
       // shortcut so a device that genuinely switched protocols is found again.
@@ -2269,9 +2827,56 @@ export default class ReactNativeBleTransport {
 
     this.deviceProtocol.delete(uuid);
     this.probingProtocols.delete(uuid);
+    const staleBondError = this.consumeIosProbeDisconnect(uuid, 'follow-up-no-response');
+    if (Platform.OS === 'ios') {
+      Log?.debug('[ReactNativeBleTransport][BleBondDiagnostic] protocol detection ended', {
+        outcome: 'all-probes-no-response',
+        expectedProtocol: expectedProtocol ?? 'none',
+        protocolHint: protocolHint ?? 'none',
+        sessionProtocol: sessionProtocol ?? 'none',
+        probeOrder: probeOrder.join(','),
+        trustSessionProtocol,
+        reprobeFailures,
+        transportCached: Boolean(transportCache[uuid]),
+        notifyActive: Boolean(transportCache[uuid]?.notifySubscription),
+        staleBondRecorded: this.staleBondErrors.has(uuid),
+        finalErrorCode: staleBondError
+          ? HardwareErrorCode.BleBondInvalid
+          : HardwareErrorCode.BleTimeoutError,
+      });
+    }
+    if (staleBondError) throw staleBondError;
     throw this.createProtocolDetectionError();
   }
 
+  /**
+   * A sleeping Classic drops GetFeatures/Ping and only leaves its screensaver on Initialize, which
+   * resets the wallet session, so it is sent once after a fully silent detection. The firmware does
+   * not reliably answer it, so its timeout must not drop the link. It only runs when V1 is probed
+   * first, so a late reply lands on the V1 probe rather than on a V2 one.
+   */
+  private async wakeSilentProtocolV1Device(uuid: string, probeOrder: ProtocolType[]) {
+    if (
+      Platform.OS !== 'android' ||
+      probeOrder[0] !== 'V1' ||
+      this.silentDetections.get(uuid) !== 'silent'
+    ) {
+      return;
+    }
+    this.silentDetections.set(uuid, 'woken');
+    Log?.debug('[ReactNativeBleTransport] sending Protocol V1 Initialize wake', {
+      connectIdSuffix: uuid.slice(-8),
+    });
+    try {
+      this.probingProtocols.set(uuid, 'V1');
+      await this.callProtocolV1(uuid, 'Initialize', {}, { timeoutMs: PROTOCOL_PROBE_TIMEOUT_MS });
+    } catch (error) {
+      if (shouldRethrowProtocolProbeError(error)) throw error;
+    } finally {
+      this.clearProbeProtocol(uuid, 'V1');
+    }
+  }
+
   private async resetProbeStateAfterProtocolProbe(uuid: string, protocol: ProtocolType) {
     const transport = transportCache[uuid];
     await this.protocolV2Links.invalidateLink(
@@ -2339,9 +2944,19 @@ export default class ReactNativeBleTransport {
     } catch (error) {
       this.clearProbeProtocol(uuid, 'V1');
       Log?.debug('[ReactNativeBleTransport] Protocol V1 GetFeatures probe failed:', error);
-      // A wedged write already dropped the link, so probing another protocol on it
-      // would only fail against a torn-down transport: surface the real cause.
-      if (isWedgedWriteError(error)) {
+      const shouldRethrow = shouldRethrowProtocolProbeError(error);
+      const staleBondError = this.rememberIosProbeDisconnect(
+        uuid,
+        'protocol-v1-get-features',
+        error
+      );
+      logIosBleBondDiagnostic(
+        'protocol-v1-get-features',
+        error,
+        shouldRethrow ? 'rethrow' : 'fallback'
+      );
+      if (staleBondError) throw staleBondError;
+      if (shouldRethrow) {
         throw error;
       }
       return false;
@@ -2356,18 +2971,26 @@ export default class ReactNativeBleTransport {
     this.probingProtocols.set(uuid, 'V2');
     this.protocolV2Assemblers.get(uuid)?.reset();
     this.throwIfStaleBondError(uuid);
-    const detected = await probeProtocolV2Helper({
-      call: (name: string, data: Record<string, unknown>, options?: TransportCallOptions) =>
-        this.callProtocolV2(uuid, name, data, options),
-      timeoutMs: PROTOCOL_V2_PROBE_TIMEOUT_MS,
-      logger: Log,
-      logPrefix: 'ProtocolV2 RN-BLE',
-      onProbeFailed: () => {
-        this.protocolV2Assemblers.get(uuid)?.reset();
-        this.resetProtocolV2Frames(uuid);
-      },
-      shouldRethrow: isBleStaleBondHardwareError,
-    });
+    let detected: boolean;
+    try {
+      detected = await probeProtocolV2Helper({
+        call: (name: string, data: Record<string, unknown>, options?: TransportCallOptions) =>
+          this.callProtocolV2(uuid, name, data, options),
+        timeoutMs: PROTOCOL_V2_PROBE_TIMEOUT_MS,
+        logger: Log,
+        logPrefix: 'ProtocolV2 RN-BLE',
+        onProbeFailed: () => {
+          this.protocolV2Assemblers.get(uuid)?.reset();
+          this.resetProtocolV2Frames(uuid);
+        },
+        shouldRethrow: shouldRethrowProtocolProbeError,
+      });
+    } catch (error) {
+      const staleBondError = this.rememberIosProbeDisconnect(uuid, 'protocol-v2-ping', error);
+      logIosBleBondDiagnostic('protocol-v2-ping', error, 'rethrow');
+      if (staleBondError) throw staleBondError;
+      throw error;
+    }
     if (!detected) {
       this.clearProbeProtocol(uuid, 'V2');
     } else {
@@ -2513,6 +3136,9 @@ export default class ReactNativeBleTransport {
           this.rememberStaleBondError(uuid, bondError);
           throw bondError;
         }
+        if (isNativeBleDisconnectError(error)) {
+          throw toBleDisconnectHardwareError(error);
+        }
         if (
           getFirmwareUploadWriteRetryType(error) !== 'congested' ||
           attempt >= FIRMWARE_UPLOAD_WRITE_MAX_RETRIES
@@ -2573,6 +3199,7 @@ export default class ReactNativeBleTransport {
       throw ERRORS.TypedError(HardwareErrorCode.TransportNotConfigured);
     }
 
+    const isProtocolProbe = this.probingProtocols.get(uuid) === 'V2';
     const callOptions = options;
     const highThroughputWrite = isProtocolV2HighThroughputCall(name);
 
@@ -2624,6 +3251,19 @@ export default class ReactNativeBleTransport {
       );
     } catch (e) {
       Log?.error('[ReactNativeBleTransport] Protocol V2 call error:', e);
+      if (
+        !isProtocolProbe &&
+        e?.errorCode === HardwareErrorCode.BleTimeoutError &&
+        !this.monitorTokens.has(uuid)
+      ) {
+        // The failed link has finished invalidating. Disconnect outside that
+        // callback to avoid waiting on its own invalidation or acquire lock.
+        await this.runLifecycleOperation(uuid, async () => {
+          // A queued timeout leaves its active monitor intact; a newer acquire
+          // may also have installed one while cleanup waited for the lifecycle lock.
+          if (!this.monitorTokens.has(uuid)) await this.disconnectUnlocked(uuid);
+        });
+      }
       throw e;
     } finally {
       if (highThroughputWrite) {
@@ -2636,7 +3276,12 @@ export default class ReactNativeBleTransport {
     const transport = this.getCachedTransport(uuid);
     if (!shouldRefreshNegotiatedMtu(transport.mtuSize)) return;
 
-    const refreshedDevice = await requestNegotiatedMtu(transport.device, 'highThroughput', 1);
+    const { device: refreshedDevice } = await requestNegotiatedMtu(
+      transport.device,
+      'highThroughput',
+      1,
+      transactionId => this.blePlxManager?.cancelTransaction(transactionId)
+    );
     transport.device = refreshedDevice;
     transport.mtuSize =
       typeof refreshedDevice.mtu === 'number' ? refreshedDevice.mtu : transport.mtuSize;