Skip to content

fix(android): make wallet saves durable across power loss - #1265

Open
0bkevin wants to merge 3 commits into
zingolabs:devfrom
0bkevin:fix/1224-durable-wallet-saves
Open

fix(android): make wallet saves durable across power loss#1265
0bkevin wants to merge 3 commits into
zingolabs:devfrom
0bkevin:fix/1224-durable-wallet-saves

Conversation

@0bkevin

@0bkevin 0bkevin commented Aug 5, 2026

Copy link
Copy Markdown

Fixes #1224.

Problem

Android closed each encrypted wallet write without syncing the file or its parent directory. The save path then deleted its recovery copy in the same session. A hard power loss could leave a torn target on disk and no recovery file.

An already-corrupt target also prevented the recovery screen from replacing it with a newly created or restored wallet.

Changes

  • Sync encrypted wallet files and directory metadata after creates and deletes.
  • Keep the previous wallet in *.write.tmp until a later startup decrypts and syncs the replacement.
  • Restore the retained copy when the target is missing or unreadable.
  • Serialize wallet-file operations across app and background-worker module instances so recovery cannot overlap a save.
  • Remove retained recovery files before deleting wallets, preventing deleted wallets from returning at startup.
  • Permit replacement of an unreadable target while still requiring successful preservation of a readable target.
  • Add JVM tests for interrupted writes, recovery, cleanup, deletion, unreadable targets, durability failures, and concurrent recovery.

The encrypted format, filenames, native bridge API, dependencies, and iOS path remain unchanged.

Verification

Manual API 30 x86_64 emulator check during development:

  • Created a wallet, observed a wallet save, killed the emulator process, then cold-booted the same AVD.
  • Confirmed the wallet loaded and startup removed the retained recovery file after validating the target.
  • Confirmed wallet deletion removed the recovery file first and did not resurrect the wallet after relaunch.

The targeted Android JVM suite and release unit suite passed before the final unreadable-target follow-up. They were not rerun at the current head. Pull request CI will run the current branch.

@0bkevin

0bkevin commented Aug 5, 2026

Copy link
Copy Markdown
Author

Just trying to help :)

it's a big diff but it addressed the entire problem. Let me know if this follow your actual standards 🫡

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Wallet save survives process death but not power loss: no fsync leaves a torn file after a hard shutdown

2 participants