Fix cloud backup restore and recovery coverage

.envrc.example

@@ -14,6 +14,10 @@ export COVE_KEYSTORE_PASSWORD="your-keystore-password-here"
 export COVE_KEY_ALIAS="upload"
 export COVE_KEY_PASSWORD="your-key-password-here"
 
+# Google Play internal releases: just rela (requires fastlane)
+# grant this service account access to testing releases for org.bitcoinppl.cove
+# export GOOGLE_PLAY_JSON_KEY_PATH="$HOME/.secrets/cove-google-play.json"
+
 # iOS device aliases for: just brall --device main|se
 # export IOS_DEVICE_MAIN="00008120-0006243420214032"
 # export IOS_DEVICE_SE="00008xxx-xxxxxxxxxxxxxxxx"

ARCHITECTURE.md

@@ -85,7 +85,7 @@ This pattern is used throughout the codebase for shared resources and is safe to
 
 redb stores typed table metadata for each table and validates the key and value `TypeName` on `open_table`. Treat changes to `TableDefinition`, `Value::type_name()`, persisted database type names, and module paths for persisted types as compatibility-sensitive. `std::any::type_name::<T>()` uses the type's defining module path, not a public re-export path, so moving a persisted type into or out of a nested module can change on-disk expectations even when serialized bytes stay identical. Preserve exact historical type names or add a compatibility/migration path, and test every install path that could have created the table, including short-lived beta/internal builds. See [docs/redb.md](docs/redb.md) for the redb compatibility checklist.
 
-**Destructive operations.** The process-wide wallet lifecycle coordinator owns persistent wallet construction, writes, actor registration, deletion, and full wipe. Deletion cannot get a prepared capability until current construction and persistence operations drain and all registered actors terminate. A failed or timed-out terminal request is cancelled, resumes the manager when possible, and returns a typed retry authorization; it never permits a force-delete path. Full wipe also requires a drained Cloud Backup reset permit. Inventory covers every network and main or decoy mode, and deletion uses those exact durable locations. Wallet deletion removes secrets first, address-switch and BDK artifacts second, wallet data third, and exact metadata rows last. Missing artifacts are idempotent, but a missing prepared metadata row is an invariant failure. The main database resets only after every local secret, artifact, restore marker, lock, and diagnostics log is removed. Address-type switches need no journal: the replacement store is published with one atomic rename, every post-publication path moves live state forward, and wallet load heals metadata to match the store it finds.
+**Destructive operations.** The process-wide wallet lifecycle coordinator owns persistent wallet construction, writes, actor registration, deletion, and full wipe. Deletion cannot get a prepared capability until current construction and persistence operations drain and all registered actors terminate. A failed or timed-out terminal request is cancelled, resumes the manager when possible, and returns a typed retry authorization; it never permits a force-delete path. Full wipe also requires a drained Cloud Backup reset permit. Inventory covers every network and main or decoy mode, and deletion uses those exact durable locations. Wallet deletion removes secrets first, address-switch and BDK artifacts second, wallet data third, and exact metadata rows last. Missing artifacts are idempotent, but a missing prepared metadata row is an invariant failure. The main database resets only after every local secret, artifact, restore marker, lock, and diagnostics log is removed. A successful full wipe returns a `FullWipeCompletion` with the committed post-wipe app and authentication state. Frontends apply it before releasing authentication and clear only the presentation state they own, so no frontend decides on its own what a wiped app looks like. Address-type switches need no journal: the replacement store is published with one atomic rename, every post-publication path moves live state forward, and wallet load heals metadata to match the store it finds.
 
 **Database tables:**
 

CONTRIBUTING.md

@@ -48,10 +48,14 @@ Set `ASC_API_KEY_PATH`, `ASC_API_KEY_ID`, and `ASC_API_ISSUER_ID`. The API key m
 ### Android
 
 ```bash
-just build-android-release    # alias: just bar
+just release-android    # alias: just rela
 ```
 
-Then build a signed APK/AAB via Android Studio (Build → Generate Signed Bundle/APK).
+This bumps the Android versionCode, rebuilds the release Android bindings, builds the signed Play bundle, and uploads it to Google Play internal testing.
+
+Set `GOOGLE_PLAY_JSON_KEY_PATH` to a readable Google Play service account JSON file. Install fastlane (`brew install fastlane`). The service account must have access to testing releases for `org.bitcoinppl.cove`.
+
+Use `just upload-google-play` (`just ugp`) when the versionCode was already bumped and the signed bundle already exists.
 
 ## Development Workflow
 

android/app/build.gradle.kts

@@ -33,7 +33,7 @@ android {
         applicationId = "org.bitcoinppl.cove"
         minSdk = 33
         targetSdk = 36
-        versionCode = 39
+        versionCode = 41
         versionName = "1.4.0"
         manifestPlaceholders["keyTeleportAppLinksEnabled"] = "false"
 

android/app/src/main/java/org/bitcoinppl/cove/AppManager.kt

@@ -369,22 +369,58 @@ class AppManager private constructor() : FfiReconcile {
      * clears all cached data and reinitializes
      */
     fun reset() {
+        clearSessionForReset()
+        resetRustProjection()
+    }
+
+    private fun clearSessionForReset() {
         // close managers before clearing them
         clearWalletManager()
         clearKeyTeleportManager()
         corruptedWalletDeletionRetry = null
+    }
 
+    private fun resetRustProjection() {
         database = Database()
         needsOnboarding =
             withRustOr(needsOnboarding) {
                 needsOnboarding()
             }
 
         val routerState =
-            withRustOr(null) {
+            withRustOr<AppState?>(null) {
                 state()
-            }
-        router.reset(routerState?.router)
+            } ?: return
+
+        router.reset(routerState.router)
+    }
+
+    /**
+     * Apply the committed post-wipe state from Rust before authentication is released
+     *
+     * Rust decides what a wiped app looks like; this only clears Android-owned presentation state
+     */
+    internal fun applyWipeCompletion(completion: FullWipeCompletion) {
+        // replace everything visible first so a cleanup failure below cannot leave pre-wipe state on screen
+        router.isSidebarVisible = false
+        isLoading = false
+        alertState = null
+        sheetState = null
+        needsOnboarding = completion.needsOnboarding
+        selectedNetwork = completion.selectedNetwork
+        colorSchemeSelection = completion.colorScheme
+        selectedNode = completion.selectedNode
+        selectedFiatCurrency = completion.fiatCurrency
+        wallets = completion.wallets
+        router.reset(completion.router)
+
+        // the data is already gone, so a manager cleanup failure must not keep the app locked
+        runCatching {
+            clearSessionForReset()
+            database = Database()
+        }.onFailure { error ->
+            Log.e(tag, "failed to clear the app session after wipe", error)
+        }
     }
 
     val currentRoute: Route
@@ -822,17 +858,15 @@ class AppManager private constructor() : FfiReconcile {
             unverifiedWalletIds()
         }
 
-    internal fun dangerousWipeAllData() {
+    internal fun dangerousWipeAllData(): FullWipeCompletion =
         withRust {
             dangerousWipeAllData()
         }
-    }
 
-    internal fun retryDangerousWipeAllData(attemptId: ShutdownAttemptId) {
+    internal fun retryDangerousWipeAllData(attemptId: ShutdownAttemptId): FullWipeCompletion =
         withRust {
             retryDangerousWipeAllData(attemptId)
         }
-    }
 
     internal fun cancelDangerousWipe(attemptId: ShutdownAttemptId) {
         withRust {

android/app/src/main/java/org/bitcoinppl/cove/AuthManager.kt

@@ -56,9 +56,12 @@ sealed interface WipePresentationState {
     data object Idle : WipePresentationState
     data object Running : WipePresentationState
     data class ShutdownBlocked(val attemptId: ShutdownAttemptId) : WipePresentationState
-    data class Failed(val message: String) : WipePresentationState
+    data object Failed : WipePresentationState
 }
 
+internal const val WIPE_FAILURE_TITLE = "Unable to Open Cove"
+internal const val WIPE_FAILURE_MESSAGE = "Please try again."
+
 /**
  * auth manager - manages authentication state
  * ported from iOS AuthManager.swift
@@ -72,8 +75,7 @@ class AuthManager internal constructor(
     private val mainScope = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate)
     private val wipeCommand = OwnerScopedCommand<UnlockMode>(mainScope)
 
-    private var rust: RustAuthManager = RustAuthManager()
-        private set
+    private val rust = RustAuthManager()
     private val isRustClosed = AtomicBoolean(false)
     private val rustGuard =
         RustHandleGuard(
@@ -190,9 +192,7 @@ class AuthManager internal constructor(
     }
 
     internal fun completeMainBiometricAuthentication() {
-        if (isInDecoyMode()) {
-            switchToMainMode()
-        }
+        if (isInDecoyMode() && !switchToMainMode()) return
 
         recordMainCredentialAuthentication()
         unlock()
@@ -258,8 +258,8 @@ class AuthManager internal constructor(
         }
 
     private fun unlockWithMainPin(): UnlockMode {
-        if (Database().globalConfig().isInDecoyMode()) {
-            switchToMainMode()
+        if (Database().globalConfig().isInDecoyMode() && !switchToMainMode()) {
+            return UnlockMode.LOCKED
         }
 
         recordMainCredentialAuthentication()
@@ -318,49 +318,56 @@ class AuthManager internal constructor(
                 }
             }
 
-        result.exceptionOrNull()?.let { error ->
-            val lifecycle = (error as? AppException.WalletLifecycle)?.v1
+        val wipeError = result.exceptionOrNull()
+        if (wipeError != null) {
+            val lifecycle = (wipeError as? AppException.WalletLifecycle)?.v1
             if (lifecycle is WalletLifecycleFailure.ShutdownBlocked) {
                 wipePresentationState = WipePresentationState.ShutdownBlocked(lifecycle.attemptId)
             } else {
-                android.util.Log.e(tag, "failed to wipe all data", error)
-                wipePresentationState =
-                    WipePresentationState.Failed(error.message ?: "Unable to remove local data")
+                android.util.Log.e(tag, "failed to wipe all data", wipeError)
+                wipePresentationState = WipePresentationState.Failed
             }
 
             return UnlockMode.LOCKED
         }
 
-        val oldRust = rust
-        rust = RustAuthManager()
-        rustGuard.markOpen()
-        rust.listenForUpdates(this)
-        oldRust.close()
+        val completion = result.getOrThrow()
+        App.applyWipeCompletion(completion)
+        apply(completion.auth)
+
         unlock()
-        type = AuthType.NONE
         wipePresentationState = WipePresentationState.Idle
-        App.reset()
-
         return UnlockMode.WIPE
     }
 
+    private fun apply(settings: AuthSettings) {
+        type = settings.authType
+        isWipeDataPinEnabled = settings.isWipeDataPinEnabled
+        isDecoyPinEnabled = settings.isDecoyPinEnabled
+        isUsingBiometrics = false
+    }
+
     private fun recordMainCredentialAuthentication() {
         mainCredentialGeneration += 1
     }
 
     /**
      * switch to main mode from decoy mode
+     *
+     * returns false when the switch failed so callers keep the app locked
+     * instead of unlocking into the decoy projection with the main credential
      */
-    fun switchToMainMode() {
+    fun switchToMainMode(): Boolean =
         try {
             withRust {
                 switchToMainMode()
             }
             resetAppAndSelectWallet()
+            true
         } catch (e: Exception) {
             android.util.Log.e(tag, "failed to switch to main mode", e)
+            false
         }
-    }
 
     override fun reconcile(message: AuthManagerReconcileMessage) {
         logDebug("reconcile: $message")
@@ -371,17 +378,11 @@ class AuthManager internal constructor(
                 }
 
                 is AuthManagerReconcileMessage.WipeDataPinChanged -> {
-                    isWipeDataPinEnabled =
-                        withRustOr(isWipeDataPinEnabled) {
-                            isWipeDataPinEnabled()
-                        }
+                    isWipeDataPinEnabled = message.v1
                 }
 
                 is AuthManagerReconcileMessage.DecoyPinChanged -> {
-                    isDecoyPinEnabled =
-                        withRustOr(isDecoyPinEnabled) {
-                            isDecoyPinEnabled()
-                        }
+                    isDecoyPinEnabled = message.v1
                 }
             }
         }

android/app/src/main/java/org/bitcoinppl/cove/MainActivity.kt

@@ -491,7 +491,10 @@ class MainActivity : FragmentActivity() {
                 return@setContent
             }
 
-            if (bdkMigrationWarning != null) {
+            val app = remember { AppManager.getInstance() }
+            val auth = remember { AuthManager.getInstance() }
+
+            if (bdkMigrationWarning != null && auth.wipePresentationState != WipePresentationState.Running) {
                 AlertDialog(
                     onDismissRequest = { bdkMigrationWarning = null },
                     title = { Text("Encryption Migration Issue") },
@@ -506,8 +509,6 @@ class MainActivity : FragmentActivity() {
                 )
             }
 
-            val app = remember { AppManager.getInstance() }
-            val auth = remember { AuthManager.getInstance() }
             val snackbarHostState = remember { SnackbarHostState() }
             var startupMode by remember {
                 mutableStateOf(resolveStartupMode(app.needsOnboarding))