fix: polish trezor reliability and ux

[piotr-iohk]

Fixes #1030

This PR:

1. Resets the six-digit Trezor pairing flow when the device requests a new code.
2. Fails pending BLE operations promptly when Bluetooth turns off.
3. Improves locked-device, reconnect, and connection guidance during hardware-wallet operations.
4. Separates hardware signing from broadcasting so a signed funding transaction can be retried without reopening Trezor.
5. Cancels abandoned hardware transfers and keeps Trezor diagnostics in the main app log with sensitive values redacted.

Description

This completes the app-level v1 reliability and UX polish for Trezor hardware wallets.

Pairing prompts now carry a request identity, so a wrong code followed by a new device code resets the input instead of leaving a spinner-only state. Device unlock remains on the Trezor itself.

Transfer to Spending now distinguishes reconnect, signing, and broadcast failures. Locked or busy devices show unlock guidance, network failures retain the signed transaction for an in-flow retry, and leaving the sign screen cancels the active operation so a later device approval cannot broadcast after the user exits.

The hardware wallet count is hidden when empty, connection failures include practical BLE guidance, and Trezor diagnostics are forwarded to the normal app log with pairing codes, PINs, passphrases, xpubs, PSBTs, and raw transactions redacted.

Passphrase/hidden-wallet pairing remains separately tracked in #1060. Emulator E2E coverage was handled in #1038. Durable signed-transaction recovery across process termination and deeper upstream transport retry changes are deliberate non-goals for this v1 polish.

Preview

QA Notes

Manual Tests

• 1. Connect Hardware → enter an incorrect six-digit pairing code → confirm the new code on Trezor: input resets and accepts the replacement code.
• 2. regression: Connect Hardware → turn Bluetooth off during connect → turn it back on: operation exits without an indefinite wait and reconnect can proceed.
• 3. Locked Trezor → Hardware Transfer Sign → Open Trezor Connect: informational unlock guidance appears instead of a raw firmware/timeout error.
• 4. Hardware Transfer Sign → approve on Trezor while network broadcast fails → Retry: “Transaction signed” remains visible and broadcast retries without signing again.
• 5. Hardware Transfer Sign → start signing → back: later approval on Trezor does not broadcast or advance the order.
• 6. Settings → General with no paired hardware wallet: Hardware Wallets does not show a 0 value.
• 7. Known BLE Trezor unavailable → Open Trezor Connect: informational Connect Device toast explains unlock, proximity, and other-device connection checks.

Automated Checks

• TrezorTransportTest.kt covers unique pairing requests and releasing pending BLE operation latches.
• TrezorRepoTest.kt covers locked-state handling, reconnect retries, and current-device reuse.
• HwConnectViewModelTest.kt and AppViewModelSendFlowTest.kt cover repeated pairing prompts and sheet routing.
• HwWalletRepoTest.kt covers separate signing/broadcasting and hardware-wallet business behavior.
• TransferViewModelTest.kt covers locked-device guidance, signed-broadcast retry, broadcast timeout, reconnect guidance, successful funding, and flow-exit cancellation.
• TrezorDebugLogTest.kt, TrezorExceptionExtTest.kt, and TrezorErrorPresenterTest.kt cover diagnostic redaction and user-facing error mapping.
• Full compile, unit test, and detekt checks passed locally; targeted suites were rerun after the final cancellation change.

Made with Cursor

[greptile-apps]

Greptile Summary

This PR improves Trezor hardware-wallet reliability and transfer recovery. The main changes are:

• Pairing prompts now reset with a per-request identity.
• BLE shutdown now releases pending transport operations.
• Hardware transfer signing is separated from broadcast retry.
• Locked-device, reconnect, and broadcast errors now show clearer guidance.
• Trezor diagnostics are forwarded through the app log with redaction.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/viewmodels/AppViewModel.kt	Pairing sheets now use request IDs so repeated pairing prompts can replace the active route.
app/src/main/java/to/bitkit/viewmodels/TransferViewModel.kt	Hardware transfer flow now preserves signed transaction state for broadcast retry and avoids cancelling active broadcast bookkeeping.
app/src/main/java/to/bitkit/services/TrezorDebugLog.kt	Trezor diagnostics are sanitized before being stored in the in-app buffer and forwarded to the app logger.

_{Reviews (5): Last reviewed commit: "fix: restore trezor funding signing" | Re-trigger Greptile}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a3a8832be5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d132d02a3b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Repo admins can enable using credits for code reviews in their settings.