unified-ble-manager 4.0.3 → 4.0.5

package/CHANGELOG.md

@@ -4,6 +4,47 @@ All notable changes to `unified-ble-manager` are documented here.
 
 ## [Unreleased]
 
+## [4.0.5] - 2026-08-25
+
+First release cut against a live peripheral. Every fix below came from driving a real CGM from an Android phone and a Linux/BlueZ host, and several are defects no unit test had reason to catch. Does not retag `v4.0.4`.
+
+### Fixes
+
+- `readiness()` no longer reports a working radio as `unavailable` before the Android adapter publishes its authoritative state; a boundary that has not yet been told the radio's state is a pending condition, not an absent radio (#116, #128).
+- The direct-GATT backend is shared by CoreBluetooth and React Native Android, so its diagnostics now name the platform that is actually running — `[unified-ble:android-gatt.*]` rather than `[CoreBluetoothBackend.*]` — and its operation ids are `direct-gatt.*` instead of `corebluetooth.*`. Scan-stop cleanup timeouts carry the platform identity instead of `platform: null` (#117, #128, #132).
+- An address known out of band can now enter the system: `ScanClause.addresses` and `connect({ address })`, gated on the reported `peer:address-targeting` capability, with pending BlueZ semantics that complete whenever the peripheral next advertises, and Android `ScanFilter.setDeviceAddress`. Hosts that cannot express a radio address — CoreBluetooth, Web, and the IPC transport — report the capability unsupported and fail closed rather than advertising something they cannot honour (#118, #128, #131, #133).
+- `ScanOptions.platform` is honoured instead of unconditionally rejected, so consumers can select Android scan mode; peripherals that advertise infrequently are no longer effectively undiscoverable behind the platform default duty cycle. Gated on `scan:platform-options` in the public, core and IPC paths; `match-lost` and pre-26 `legacy: false` fail closed rather than silently doing something else (#120, #130).
+- BlueZ GATT works again: occurrences are decimal indices rather than D-Bus object paths, so `discover()` no longer fails with `protocol.violation: public-gatt.occurrence` on every device — a regression introduced when the public validator was tightened without migrating the backend. Two same-UUID services are now distinctly addressable, which neither the old leniency nor the strict check managed (#123, #129).
+- The BlueZ boundary decodes the `y` and `a{qv}` D-Bus variants that BlueZ 5.85 actually sends, and routes `Adapter1.ConnectDevice` through the boundary instead of rejecting it as locally unsupported; without these the backend could not attach at all (#128).
+- Public BLE resources are portable across copies, and closing an adapter watch's value stream tears the watch down instead of leaving a 25 ms poll timer and an abort listener alive (#122).
+- `@babel/runtime` is declared as a production dependency. The emitted CommonJS imports its helpers, so an external linked checkout failed with `MODULE_NOT_FOUND` while repository-local tests passed against a transitive copy — a packaging gap only a real consumer could surface (#134, #135).
+- A database stream is finalized after an invalidation retry succeeds, and per-subscription React cleanup and failed IPC CCCDs stay owned (#127).
+
+### Compatibility
+
+- Native protocol ABI 3 → 4. A JavaScript bundle carrying the new scan fields now fails attachment negotiation against an older native binary instead of failing at scan-start — or, worse, silently selecting the opposite scan mode.
+
+### Release integrity
+
+- Cut from the exact `main` merge commit through the tag-driven trusted-publishing workflow.
+- Intended for publication as `latest`; this does not promote backend support labels. The live-hardware runs behind these fixes are development evidence, not qualification evidence.
+
+## [4.0.4] - 2026-08-25
+
+Post-4.0.3 audit: wire/scan/IPC ownership, Android 16 KB ELF alignment, Apple teardown, abortable Web chooser honesty, React remount-owned cleanup, and React Native entropy without WebCrypto. Does not retag `v4.0.3`.
+
+### Fixes
+
+- Tauri wire codec budgets, public scan presence overflow, IPC contract errors, GATT admission/rediscovery, Android scanCallback/receiver commit-after-success, 16 KB native page size (#80, #81, #83, #84, #93, #85, #86, #100, #107).
+- Apple disconnect confirmation, Service Changed CCCD retry, restored notify-off; Web chooser abort/timeout does not retain a late `requestDevice` grant (#87, #89, #90, #88).
+- React adapter-watch fail-visible terminals, remount-owned scan/characteristic `release-failed`, scoped BleProvider barriers, composeAbortSignal listener cleanup, `managerKey` replacement (#96, #97, #98, #99, #101).
+- React Native manager construction no longer depends on WebCrypto or a Metro-fatal `crypto` require; native CSPRNG is the default, with injectable `randomBytes` (#111, #113, #114).
+
+### Release integrity
+
+- Cut from the exact post-PR #110 `main` merge commit through the tag-driven trusted-publishing workflow.
+- Intended for publication as `latest`; this does not promote backend support labels or claim physical-radio evidence.
+
 ## [4.0.3] - 2026-08-25
 
 Lifecycle ownership is explicit through clone/decode, public stream close, IPC admission, Web/Tauri teardown, backend unregister/overflow native release, and React hook store/terminal cleanup. Does not retag `v4.0.2`.

package/MIGRATION_4.0.md

@@ -2,7 +2,7 @@
 
 # Migrating from react-native-ble-plx
 
-The current package is `4.0.3`. The `4.0.0` release is a new package and a new contract. It is **not a source-compatible rename**. There is no `new BleManager()` facade, no Base64 characteristic values, and no public transaction IDs.
+The current package is `4.0.5`. The `4.0.0` release is a new package and a new contract. It is **not a source-compatible rename**. There is no `new BleManager()` facade, no Base64 characteristic values, and no public transaction IDs.
 
 This page is for a React Native app that already uses `react-native-ble-plx`. Web, Electron, Node, and Tauri are new hosts — use those pages after you understand the RN rewrite.
 

package/README.md

@@ -6,7 +6,7 @@
 
 It is an evolution of `react-native-ble-plx`, rewritten as a **cross-platform unified product**. One bytes-first BLE model and lifecycle semantics across hosts, with host-specific construction and ownership. The root package never picks a radio for you, and it will not quietly fall back to a simulator or a different backend.
 
-Install `unified-ble-manager` from npm (`4.0.3` on `latest`). The root import does not pick a radio. Package SemVer and backend support labels are independent: each radio backend stays Experimental until live-radio evidence says otherwise. See [`docs/PLATFORMS.md`](docs/PLATFORMS.md).
+Install `unified-ble-manager` from npm (`4.0.5` on `latest`). The root import does not pick a radio. Package SemVer and backend support labels are independent: each radio backend stays Experimental until live-radio evidence says otherwise. See [`docs/PLATFORMS.md`](docs/PLATFORMS.md).
 
 > Sponsored by [Imagi Explain](https://imagiexplain.com) — researched, narrated whiteboard explainers from a prompt, a PDF, or your notes.
 

package/RELEASE.md

@@ -81,7 +81,7 @@ Active `4.0.0-rc.*` release-train candidates publish to npm `latest` so a bare `
 
 On release day, set `release_candidate` to the exact candidate required by the
 release plan. RC2, RC3, RC4, `4.0.0-rc.4.1`, and RC5 are already immutable
-once tagged. Stable `4.0.0`, `4.0.1`, and `4.0.2` are immutable. `4.0.3` is the current train head.
+once tagged. Stable `4.0.0`, `4.0.1`, `4.0.2`, and `4.0.3` are immutable. `4.0.5` is the current train head.
 
 ```sh
 release_candidate=4.0.0-rc.N
@@ -127,7 +127,15 @@ git tag -a v4.0.2 -m "v4.0.2"
 
 ## Releasing 4.0.3
 
-The source version is prepared on `main` before the tag. The release workflow verifies that every initial release tag points at the exact current `main` commit before publication; do not create that tag from a side branch or an older commit. Do not retag immutable `v4.0.0`, `v4.0.1`, or `v4.0.2`.
+The `v4.0.3` tag is immutable published history. Do not recreate or move it.
+
+```sh
+git tag -a v4.0.3 -m "v4.0.3"
+```
+
+## Releasing 4.0.5
+
+The source version is prepared on `main` before the tag. The release workflow verifies that every initial release tag points at the exact current `main` commit before publication; do not create that tag from a side branch or an older commit. Do not retag immutable `v4.0.0`, `v4.0.1`, `v4.0.2`, or `v4.0.3`.
 
 On release day:
 
@@ -137,12 +145,12 @@ git checkout main
 git pull --ff-only origin main
 
 test "$(git branch --show-current)" = "main"
-test "$(node -p "require('./package.json').version")" = "4.0.3"
+test "$(node -p "require('./package.json').version")" = "4.0.5"
 git diff --exit-code
 git diff --cached --exit-code
 
-git tag -a v4.0.3 -m "v4.0.3"
-git push origin v4.0.3
+git tag -a v4.0.5 -m "v4.0.5"
+git push origin v4.0.5
 ```
 
 Do not push another commit to `main` between the final verification and the tag push.

package/SBOM.cdx.json

@@ -6,20 +6,20 @@
   "metadata": {
     "component": {
       "type": "library",
-      "bom-ref": "pkg:npm/unified-ble-manager@4.0.3",
+      "bom-ref": "pkg:npm/unified-ble-manager@4.0.5",
       "name": "unified-ble-manager",
-      "version": "4.0.3",
+      "version": "4.0.5",
       "licenses": [
         {
           "expression": "Apache-2.0"
         }
       ],
-      "purl": "pkg:npm/unified-ble-manager@4.0.3"
+      "purl": "pkg:npm/unified-ble-manager@4.0.5"
     },
     "properties": [
       {
         "name": "unified-ble-manager:pnpm-lock-sha256",
-        "value": "95b40628ee5be6e80662325b6f7c09547541957e885f4bb714fe1aca28f4153f"
+        "value": "5fb778bd200cb93f552ec61264d53829dca5bdd27623ccc692d4d9bcbf9ec296"
       },
       {
         "name": "unified-ble-manager:dependency-scope",
@@ -28,6 +28,25 @@
     ]
   },
   "components": [
+    {
+      "type": "library",
+      "bom-ref": "pkg:npm/%40babel/runtime@7.29.7",
+      "group": "@babel",
+      "name": "runtime",
+      "version": "7.29.7",
+      "licenses": [
+        {
+          "expression": "MIT"
+        }
+      ],
+      "purl": "pkg:npm/%40babel/runtime@7.29.7",
+      "properties": [
+        {
+          "name": "unified-ble-manager:license-source",
+          "value": "package-metadata"
+        }
+      ]
+    },
     {
       "type": "library",
       "bom-ref": "pkg:npm/%40isaacs/fs-minipass@4.0.1",
@@ -428,6 +447,10 @@
     }
   ],
   "dependencies": [
+    {
+      "ref": "pkg:npm/%40babel/runtime@7.29.7",
+      "dependsOn": []
+    },
     {
       "ref": "pkg:npm/%40isaacs/fs-minipass@4.0.1",
       "dependsOn": [
@@ -537,8 +560,9 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:npm/unified-ble-manager@4.0.3",
+      "ref": "pkg:npm/unified-ble-manager@4.0.5",
       "dependsOn": [
+        "pkg:npm/%40babel/runtime@7.29.7",
         "pkg:npm/%40tauri-apps/api@2.11.1",
         "pkg:npm/node-addon-api@8.9.0",
         "pkg:npm/node-gyp@12.4.0"

package/THIRD_PARTY_LICENSES.json

@@ -4,12 +4,12 @@
   "schemaVersion": "1.0.0",
   "package": {
     "name": "unified-ble-manager",
-    "version": "4.0.3"
+    "version": "4.0.5"
   },
   "source": {
     "method": "pnpm-lock production graph with installed-manifest license audit",
     "lockfile": "pnpm-lock.yaml",
-    "lockfileSha256": "95b40628ee5be6e80662325b6f7c09547541957e885f4bb714fe1aca28f4153f"
+    "lockfileSha256": "5fb778bd200cb93f552ec61264d53829dca5bdd27623ccc692d4d9bcbf9ec296"
   },
   "reviewedOverrides": [
     {
@@ -27,6 +27,13 @@
   ],
   "unresolved": [],
   "packages": [
+    {
+      "name": "@babel/runtime",
+      "version": "7.29.7",
+      "license": "MIT",
+      "licenseSource": "package-metadata",
+      "purl": "pkg:npm/%40babel/runtime@7.29.7"
+    },
     {
       "name": "@isaacs/fs-minipass",
       "version": "4.0.1",

package/android/build.gradle

@@ -41,6 +41,8 @@ def supportsNamespace() {
 }
 
 android {
+  ndkVersion rootProject.ext.has("ndkVersion") ? rootProject.ext.ndkVersion : "27.1.12297006"
+
   if (supportsNamespace()) {
     namespace = "com.sfourdrinier.unifiedblemanager"
 

package/android/src/main/java/com/sfourdrinier/unifiedblemanager/protocol/UnifiedBleProtocolAndroidDispatcher.kt

@@ -255,7 +255,8 @@ class UnifiedBleProtocolAndroidDispatcher(
         scanMode = options.requiredSignedInteger(3).toInt(),
         callbackType = options.requiredSignedInteger(4).toInt(),
         legacyScan = options.requiredBoolean(5),
-        allowDuplicates = options.requiredBoolean(2)
+        allowDuplicates = options.requiredBoolean(2),
+        deviceAddresses = options.optionalStringList(6).toTypedArray()
       )
       emitSuccess(command, "scanStarted")
     } catch (error: Exception) {
@@ -1180,6 +1181,11 @@ private fun ProtocolWireRecord.requiredStringList(fieldId: Int): List<String> {
   return if (value is ProtocolWireValue.StringListValue) value.value else throw IllegalArgumentException("String list field is missing")
 }
 
+private fun ProtocolWireRecord.optionalStringList(fieldId: Int): List<String> {
+  val value = fields[fieldId] ?: return emptyList()
+  return if (value is ProtocolWireValue.StringListValue) value.value else throw IllegalArgumentException("String list field is malformed")
+}
+
 private fun Boolean?.toNativeConnectableState(): Int = when (this) {
   true -> 1
   false -> 0

package/android/src/main/java/com/sfourdrinier/unifiedblemanager/protocol/UnifiedBleProtocolControlModule.java

@@ -453,6 +453,22 @@ public final class UnifiedBleProtocolControlModule extends NativeUnifiedBleProto
     }
   }
 
+  @Override
+  public void getRandomBytes(double length, Promise promise) {
+    final int n = (int) length;
+    if (n != length || n <= 0 || n > 1024) {
+      promise.reject("argument.invalid", "randomBytes.length");
+      return;
+    }
+    final byte[] out = new byte[n];
+    new java.security.SecureRandom().nextBytes(out);
+    final com.facebook.react.bridge.WritableArray values = Arguments.createArray();
+    for (byte value : out) {
+      values.pushInt(value & 0xff);
+    }
+    promise.resolve(values);
+  }
+
   @Override
   public synchronized void installExecutionRuntime(Promise promise) {
     try {

package/android/src/main/java/com/sfourdrinier/unifiedblemanager/protocol/generated/NativeProtocolV2Schema.kt

@@ -3,7 +3,7 @@
 package com.sfourdrinier.unifiedblemanager.protocol.generated
 
 const val NATIVE_PROTOCOL_VERSION: Int = 2
-const val NATIVE_PROTOCOL_ABI_VERSION: Int = 3
+const val NATIVE_PROTOCOL_ABI_VERSION: Int = 4
 const val NATIVE_PROTOCOL_CONTROL_SURFACE_VERSION: Int = 2
 const val MAXIMUM_CONTROL_RECORD_BYTES: Int = 262144
 const val MAXIMUM_BINARY_PAYLOAD_BYTES: Int = 524288
@@ -223,6 +223,7 @@ val NATIVE_PROTOCOL_FIELDS: List<FieldDescriptor> = listOf(
     FieldDescriptor(RecordKind.SCAN_OPTIONS, 3, "scanMode", "int64", true),
     FieldDescriptor(RecordKind.SCAN_OPTIONS, 4, "callbackType", "int64", true),
     FieldDescriptor(RecordKind.SCAN_OPTIONS, 5, "legacyScan", "boolean", true),
+    FieldDescriptor(RecordKind.SCAN_OPTIONS, 6, "deviceAddresses", "strings", false),
     FieldDescriptor(RecordKind.ADAPTER_STATE_SNAPSHOT, 1, "availability", "enum:adapterAvailability", true),
     FieldDescriptor(RecordKind.ADAPTER_STATE_SNAPSHOT, 2, "authorization", "enum:adapterAuthorization", true),
     FieldDescriptor(RecordKind.ADAPTER_STATE_SNAPSHOT, 3, "power", "enum:adapterPower", true),

package/android/src/main/java/com/sfourdrinier/unifiedblemanager/radio/OwnedAndroidGattRadio.kt

@@ -349,7 +349,6 @@ class OwnedAndroidGattRadio(private val context: Context) {
           onAdapterState?.invoke(mapAdapterState(state))
         }
       }
-    adapterStateReceiver = receiver
     val filter = IntentFilter(BluetoothAdapter.ACTION_STATE_CHANGED)
     // System broadcast (ACTION_STATE_CHANGED) requires RECEIVER_EXPORTED on API 33+.
     if (Build.VERSION.SDK_INT >= 33) {
@@ -358,6 +357,7 @@ class OwnedAndroidGattRadio(private val context: Context) {
       @Suppress("UnspecifiedRegisterReceiverFlag")
       context.registerReceiver(receiver, filter)
     }
+    adapterStateReceiver = receiver
   }
 
   internal fun unregisterAdapterStateReceiver(): OwnedRadioTeardownFailure? {
@@ -394,8 +394,16 @@ class OwnedAndroidGattRadio(private val context: Context) {
     scanMode: Int,
     callbackType: Int = ScanSettings.CALLBACK_TYPE_ALL_MATCHES,
     legacyScan: Boolean = true,
-    allowDuplicates: Boolean = true
+    allowDuplicates: Boolean = true,
+    deviceAddresses: Array<out String> = emptyArray()
   ) {
+    // ScanSettings.Builder.setLegacy exists only on API 26+; below that the
+    // platform can only run a legacy scan, so accepting legacyScan=false would
+    // silently ignore the caller's extended-advertising request. Fail closed
+    // before any scan state is touched.
+    require(legacyScan || Build.VERSION.SDK_INT >= 26) {
+      "legacyScan=false requires ScanSettings.Builder.setLegacy (API 26+); this device cannot honour it"
+    }
     val normalizedServiceUuids = normalizeScanServiceUuids(serviceUuids?.toList() ?: emptyList())
     check(scanCallback == null) { "Android scan cleanup is still owned by a prior scan" }
     scanSeenDeviceIds.clear()
@@ -404,6 +412,7 @@ class OwnedAndroidGattRadio(private val context: Context) {
     val builder = ScanSettings.Builder()
       .setScanMode(
         when (scanMode) {
+          -1 -> ScanSettings.SCAN_MODE_OPPORTUNISTIC
           0 -> ScanSettings.SCAN_MODE_LOW_POWER
           1 -> ScanSettings.SCAN_MODE_BALANCED
           2 -> ScanSettings.SCAN_MODE_LOW_LATENCY
@@ -417,8 +426,26 @@ class OwnedAndroidGattRadio(private val context: Context) {
     }
     val settings = builder.build()
     val filters = mutableListOf<ScanFilter>()
-    normalizedServiceUuids.forEach { uuid ->
-      filters.add(ScanFilter.Builder().setServiceUuid(ParcelUuid.fromString(uuid)).build())
+    val normalizedAddresses = deviceAddresses.map { it.uppercase() }.distinct()
+    if (normalizedAddresses.isEmpty()) {
+      normalizedServiceUuids.forEach { uuid ->
+        filters.add(ScanFilter.Builder().setServiceUuid(ParcelUuid.fromString(uuid)).build())
+      }
+    } else if (normalizedServiceUuids.isEmpty()) {
+      normalizedAddresses.forEach { address ->
+        filters.add(ScanFilter.Builder().setDeviceAddress(address).build())
+      }
+    } else {
+      normalizedAddresses.forEach { address ->
+        normalizedServiceUuids.forEach { uuid ->
+          filters.add(
+            ScanFilter.Builder()
+              .setDeviceAddress(address)
+              .setServiceUuid(ParcelUuid.fromString(uuid))
+              .build()
+          )
+        }
+      }
     }
     val cb = object : ScanCallback() {
       override fun onScanResult(callbackType: Int, result: AndroidScanResult) {
@@ -444,11 +471,30 @@ class OwnedAndroidGattRadio(private val context: Context) {
         onScanFailed?.invoke(errorCode)
       }
     }
-    scanCallback = cb
-    if (filters.isEmpty()) {
-      scanner?.startScan(null, settings, cb)
-    } else {
-      scanner?.startScan(filters, settings, cb)
+    try {
+      if (filters.isEmpty()) {
+        scanner?.startScan(null, settings, cb)
+      } else {
+        scanner?.startScan(filters, settings, cb)
+      }
+      scanCallback = cb
+    } catch (error: Throwable) {
+      val cleanupFailure =
+        try {
+          scanner?.stopScan(cb)
+          null
+        } catch (stopError: Throwable) {
+          OwnedAndroidLog.e("startScan compensating stopScan", stopError)
+          stopError
+        }
+      if (cleanupFailure == null) {
+        scanCallback = null
+        scanner = null
+        scanSeenDeviceIds.clear()
+      } else {
+        scanCallback = cb
+      }
+      throw error
     }
   }
 
@@ -612,13 +658,13 @@ class OwnedAndroidGattRadio(private val context: Context) {
         }
       }
     }
-    bondStateReceiver = receiver
     val filter = IntentFilter(BluetoothDevice.ACTION_BOND_STATE_CHANGED)
     if (Build.VERSION.SDK_INT >= 33) context.registerReceiver(receiver, filter, Context.RECEIVER_EXPORTED)
     else {
       @Suppress("UnspecifiedRegisterReceiverFlag")
       context.registerReceiver(receiver, filter)
     }
+    bondStateReceiver = receiver
   }
 
   internal fun unregisterBondStateReceiver(): OwnedRadioTeardownFailure? {

package/android/src/main/jni/CMakeLists.txt

@@ -48,3 +48,10 @@ target_compile_options(
   -Wextra
   -Werror
 )
+
+target_link_options(
+  ${CMAKE_PROJECT_NAME}
+  PRIVATE
+  "-Wl,-z,max-page-size=16384"
+  "-Wl,-z,common-page-size=16384"
+)

package/docs/ELECTRON.md

@@ -4,7 +4,7 @@
 
 Main owns the radio. The renderer uses a versioned IPC client and never loads a native addon.
 
-The current package is `4.0.3`. The release ships Node-API v8 prebuilds covering macOS and Windows `arm64`/`x64` for both Node and modern Electron.
+The current package is `4.0.5`. The release ships Node-API v8 prebuilds covering macOS and Windows `arm64`/`x64` for both Node and modern Electron.
 
 `unified-ble-manager/electron/main` and
 `unified-ble-manager/electron/renderer` are the only Electron entrypoints.

package/docs/EXPO_PLUGIN.md

@@ -7,7 +7,7 @@ start a radio, request runtime permissions during prebuild, or prove physical
 radio/restoration reliability. Expo Go is not a supported BLE execution
 environment because it cannot contain this native module.
 
-Use the v2 plugin options in the published `4.0.3` package. Those options match
+Use the v2 plugin options in the published `4.0.5` package. Those options match
 the schema introduced at `4.0.0-rc.4`. Expo Go cannot load this native module.
 
 ## Installation and development build
@@ -15,7 +15,7 @@ the schema introduced at `4.0.0-rc.4`. Expo Go cannot load this native module.
 Pin the package so a later `latest` bump does not change native plugin options
 without a rebuild:
 
-    pnpm add unified-ble-manager@4.0.3
+    pnpm add unified-ble-manager@4.0.5
     pnpm add expo@^57.0.0 expo-dev-client
     npx expo prebuild --clean
     npx expo run:ios

package/docs/GAPS.4.0.md

@@ -14,7 +14,7 @@ This file tracks platform code, CI, package, lab, and live-radio evidence. It do
 
 The clean-baseline contract, unified core, public manager, deterministic backend, TCK, native protocol, first-party backend implementations, host-isolated package exports, SDK/CLI, and legacy-absence gates exist in the 4.0 source. Passing deterministic, compile, ABI, or package tests are implementation proof; they do not become physical-radio support evidence unless a retained record proves the corresponding live scenario.
 
-`unified-ble-manager@4.0.3` is the published, immutable stable package/API. Immutable `4.0.0`, `4.0.1`, and `4.0.2` remain published history. Backend support labels remain
+`unified-ble-manager@4.0.5` is the published, immutable stable package/API. Immutable `4.0.0`, `4.0.1`, `4.0.2`, and `4.0.3` remain published history. Backend support labels remain
 evidence-derived. This package does not rewrite the evidence inventory: a backend remains at the support level
 justified by its records. The alpha train, including `v4.0.0-alpha.40`, remains historical implementation/release
 evidence and must not be used to claim a higher current support label than it actually proved.

package/docs/GETTING_STARTED.md

@@ -4,7 +4,7 @@
 
 This page gets you to a first scan, connect, read, notify, and teardown on React Native. Other hosts are linked at the bottom. The root import does not turn Bluetooth on.
 
-The current package is `4.0.3`.
+The current package is `4.0.5`.
 
 ## Pick a host
 
@@ -27,7 +27,7 @@ The current package is `4.0.3`.
 Pin the current package for a known native rebuild:
 
 ```sh
-pnpm add unified-ble-manager@4.0.3
+pnpm add unified-ble-manager@4.0.5
 ```
 
 Declare Android Bluetooth permissions and the BLE hardware feature yourself,
@@ -37,10 +37,10 @@ request runtime permissions on Android 12+, add
 #### Expo / CNG v2
 
 The Expo v2 schema and `unified-ble-manager/expo` factory are in the published
-`4.0.3` package. Pin that exact version:
+`4.0.5` package. Pin that exact version:
 
 ```sh
-pnpm add unified-ble-manager@4.0.3
+pnpm add unified-ble-manager@4.0.5
 ```
 
 The package does not run in Expo Go.

package/docs/NODE.md

@@ -10,7 +10,7 @@ The root import does not open an adapter. Pick one backend:
 | `unified-ble-manager/node/winrt`         | Windows                                      |
 | `unified-ble-manager/node/bluez`         | Linux (needs `dbus-next@^0.10.2` in the app) |
 
-The current package is `4.0.3`. The release ships Node-API v8 prebuilds for macOS and Windows on `arm64` and `x64`. A normal install should not compile native code. BlueZ talks D-Bus and has no addon.
+The current package is `4.0.5`. The release ships Node-API v8 prebuilds for macOS and Windows on `arm64` and `x64`. A normal install should not compile native code. BlueZ talks D-Bus and has no addon.
 
 ## One-call factories
 

package/docs/PLATFORMS.md

@@ -8,7 +8,7 @@ This page is an evidence index, not a static compatibility matrix. An applicatio
 
 ## Package stability and backend support are separate
 
-`unified-ble-manager@4.0.3` is the published **stable package/API** for the 4.x contract; it is immutable. Backend support labels remain evidence-derived and independent of this SemVer. Immutable `4.0.0`, `4.0.1`, and `4.0.2` remain published history.
+`unified-ble-manager@4.0.5` is the published **stable package/API** for the 4.x contract; it is immutable. Backend support labels remain evidence-derived and independent of this SemVer. Immutable `4.0.0`, `4.0.1`, `4.0.2`, and `4.0.3` remain published history.
 
 This package is the portable API/semantics freeze; it does **not** mean every first-party backend is
 automatically Preview, Supported, or Reliability-qualified.

package/docs/WEB.md

@@ -4,7 +4,7 @@
 
 Use `unified-ble-manager/web` in a secure context (HTTPS or localhost) from a user gesture. There is no background scan and no process-level restoration.
 
-The current package is `4.0.3`. The backend is Experimental until artifact-bound physical-hardware validation says otherwise. See [`PLATFORMS.md`](PLATFORMS.md).
+The current package is `4.0.5`. The backend is Experimental until artifact-bound physical-hardware validation says otherwise. See [`PLATFORMS.md`](PLATFORMS.md).
 
 ## Create the manager
 

package/docs/generated/PLATFORM_SUPPORT.md

@@ -6,7 +6,7 @@ This page is generated by `scripts/docs/generate-platform-support.js` from valid
 
 ## Current package
 
-`unified-ble-manager@4.0.3`
+`unified-ble-manager@4.0.5`
 
 No evidence record is bound to this exact package version and artifact. Consequently, this generated page makes no Preview, Live Preview, Supported, or Reliability-qualified platform claim for the current package.
 

package/ios/Generated/NativeProtocolV2Schema.swift

@@ -3,7 +3,7 @@
 import Foundation
 
 public let nativeProtocolVersion: UInt32 = 2
-public let nativeProtocolABIVersion: UInt32 = 3
+public let nativeProtocolABIVersion: UInt32 = 4
 public let nativeProtocolControlSurfaceVersion: UInt32 = 2
 public let maximumControlRecordBytes: Int = 262144
 public let maximumBinaryPayloadBytes: Int = 524288
@@ -223,6 +223,7 @@ public let nativeProtocolFields: [FieldDescriptor] = [
     FieldDescriptor(record: .scanOptions, fieldID: 3, name: "scanMode", type: "int64", required: true),
     FieldDescriptor(record: .scanOptions, fieldID: 4, name: "callbackType", type: "int64", required: true),
     FieldDescriptor(record: .scanOptions, fieldID: 5, name: "legacyScan", type: "boolean", required: true),
+    FieldDescriptor(record: .scanOptions, fieldID: 6, name: "deviceAddresses", type: "strings", required: false),
     FieldDescriptor(record: .adapterStateSnapshot, fieldID: 1, name: "availability", type: "enum:adapterAvailability", required: true),
     FieldDescriptor(record: .adapterStateSnapshot, fieldID: 2, name: "authorization", type: "enum:adapterAuthorization", required: true),
     FieldDescriptor(record: .adapterStateSnapshot, fieldID: 3, name: "power", type: "enum:adapterPower", required: true),

package/ios/Owned/OwnedCoreBluetoothProtocolRadio.swift

@@ -56,9 +56,9 @@ public final class OwnedCoreBluetoothProtocolRadio: NSObject, CBPeripheralDelega
   /// retained cleanup entry, rather than an unbounded timer fan-out, is the
   /// source of truth for the physical CCCD transition still in flight.
   var pendingCancellationCleanupRetryScheduled = Set<String>()
-  private var subscriptions = [CharacteristicAddress: String]()
+  var subscriptions = [CharacteristicAddress: String]()
   var activeScanOperationIdentifier: String?
-  private var restoredPeerIdentifiers = [String]()
+  var restoredPeerIdentifiers = [String]()
   var destroyed = false
 
   struct CharacteristicAddress: Hashable {
@@ -158,17 +158,14 @@ public final class OwnedCoreBluetoothProtocolRadio: NSObject, CBPeripheralDelega
       self.failAllPendingOperationsOnDestroy()
       self.pendingCancellationCleanup.removeAll()
       self.pendingCancellationCleanupRetryScheduled.removeAll()
+      self.disableActiveNotifications()
       self.subscriptions.removeAll()
       let restoredIdentifiers = Set(self.restoredPeerIdentifiers)
-      for (identifier, peripheral) in self.peripheralByIdentifier where !restoredIdentifiers.contains(identifier) {
-        if peripheral.state == .connected || peripheral.state == .connecting {
-          self.central.cancelPeripheralConnection(peripheral)
-        }
-        peripheral.delegate = nil
-      }
-      self.peripheralByIdentifier = self.peripheralByIdentifier.filter { restoredIdentifiers.contains($0.key) }
-      self.servicesByPeer = self.servicesByPeer.filter { restoredIdentifiers.contains($0.key) }
-      completion(nil)
+      self.completeAfterPendingDisconnects(
+        preserving: restoredIdentifiers,
+        destroyRadio: false,
+        completion: completion
+      )
     }
   }
 
@@ -450,17 +447,14 @@ public final class OwnedCoreBluetoothProtocolRadio: NSObject, CBPeripheralDelega
       self.destroyed = true
       self.central.stopScan()
       self.activeScanOperationIdentifier = nil
-      for peripheral in self.peripheralByIdentifier.values where peripheral.state == .connected || peripheral.state == .connecting {
-        self.central.cancelPeripheralConnection(peripheral)
-        peripheral.delegate = nil
-      }
       self.failAllPendingOperationsOnDestroy()
+      self.disableActiveNotifications()
       self.subscriptions.removeAll()
-      self.servicesByPeer.removeAll()
-      self.peripheralByIdentifier.removeAll()
-      self.restoredPeerIdentifiers.removeAll()
-      self.central.delegate = nil
-      completion(nil)
+      self.completeAfterPendingDisconnects(
+        preserving: [],
+        destroyRadio: true,
+        completion: completion
+      )
     }
   }