fix(android): a panic can no longer abort the process

Four independent fences, each of which would have contained the launch
crash on its own: every JNI entry point runs inside an unwind fence
(logged default instead of abort), the panic hook is catch_unwind-wrapped
so the reporter can't kill what it reports on, Iroh init waits for the
ndk context and refuses in the service-only process, and the three cpal
sites check registration before touching the AAudio host.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: JSKitty

src-tauri/src/android/miniapp_jni.rs

@@ -12,6 +12,29 @@ fn try_android_context() -> Option<AndroidContext> {
     std::panic::catch_unwind(ndk_context::android_context).ok()
 }
 
+/// Whether tao has registered the ndk context yet. Gate for code whose
+/// DEPENDENCIES call `ndk_context::android_context()` unguarded (iroh's
+/// hickory-resolver reads system DNS with it and the panic aborts the
+/// process): they must not run before registration, and never in the
+/// Activity-less service-only process, where it never comes.
+pub fn context_registered() -> bool {
+    try_android_context().is_some()
+}
+
+/// Unwind fence for JNI entry points. A Rust panic crossing an `extern "C"`
+/// boundary is a process abort; inside the fence it becomes a logged default
+/// instead. The default must be safe for the Java caller (unit, or a null
+/// object the Kotlin side treats as failure).
+pub fn jni_fence<T>(name: &str, default: impl FnOnce() -> T, body: impl FnOnce() -> T) -> T {
+    match std::panic::catch_unwind(std::panic::AssertUnwindSafe(body)) {
+        Ok(v) => v,
+        Err(_) => {
+            vector_core::log_warn!("[JNI] {} panicked — returned default instead of aborting", name);
+            default()
+        }
+    }
+}
+
 /// Standard buffer size for reading streams
 pub const STREAM_BUFFER_SIZE: i32 = 8192;
 

src-tauri/src/android/utils.rs

@@ -94,6 +94,14 @@ fn get_device_sample_rate() -> Result<u32, String> {
         return Ok(cached);
     }
 
+    // cpal's AAudio host reads device params through `ndk_context`, which
+    // panics unregistered (service-only process, or pre-registration) — and a
+    // panic here can abort. Refuse with an error instead.
+    #[cfg(target_os = "android")]
+    if !crate::android::utils::context_registered() {
+        return Err("Audio unavailable: Android context not registered".to_string());
+    }
+
     // Query the device
     let host = cpal::default_host();
     let device = host

src-tauri/src/audio.rs

@@ -181,6 +181,14 @@ impl AudioEngine {
     }
 
     fn create() -> Result<Self, String> {
+        // cpal's AAudio host reads device params through `ndk_context`, which
+        // panics unregistered (service-only process, or pre-registration) — and a
+        // panic here can abort. Refuse with an error instead.
+        #[cfg(target_os = "android")]
+        if !crate::android::utils::context_registered() {
+            return Err("Audio unavailable: Android context not registered".to_string());
+        }
+
         let host = cpal::default_host();
         let device = host
             .default_output_device()

src-tauri/src/audio_engine.rs

@@ -131,21 +131,27 @@ pub fn run() {
     // Install a panic hook that logs the crash before the process dies.
     // Without this, panics in spawned tasks vanish silently.
     std::panic::set_hook(Box::new(|info| {
-        let backtrace = std::backtrace::Backtrace::force_capture();
-        let secs = std::time::SystemTime::now()
-            .duration_since(std::time::UNIX_EPOCH)
-            .unwrap_or_default()
-            .as_secs();
-        let msg = format!("[PANIC {:02}:{:02}:{:02}Z] {info}\n\nBacktrace:\n{backtrace}\n",
-            (secs / 3600) % 24, (secs / 60) % 60, secs % 60);
-        eprintln!("{msg}");
-        // Append to log file (shared with log_error!)
-        if let Ok(data_dir) = account_manager::get_app_data_dir() {
+        // A panic ESCAPING a panic hook aborts the process on the spot, so the
+        // reporter must never be able to kill what it reports on: everything
+        // here is catch_unwind-wrapped, and stderr uses the error-swallowing
+        // write (eprintln! itself panics when stderr is gone).
+        let _ = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
+            let backtrace = std::backtrace::Backtrace::force_capture();
+            let secs = std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap_or_default()
+                .as_secs();
+            let msg = format!("[PANIC {:02}:{:02}:{:02}Z] {info}\n\nBacktrace:\n{backtrace}\n",
+                (secs / 3600) % 24, (secs / 60) % 60, secs % 60);
             use std::io::Write;
-            if let Ok(mut f) = std::fs::OpenOptions::new().create(true).append(true).open(data_dir.join("vector.log")) {
-                let _ = write!(f, "{}\n", &msg);
+            let _ = writeln!(std::io::stderr(), "{msg}");
+            // Append to log file (shared with log_error!)
+            if let Ok(data_dir) = account_manager::get_app_data_dir() {
+                if let Ok(mut f) = std::fs::OpenOptions::new().create(true).append(true).open(data_dir.join("vector.log")) {
+                    let _ = write!(f, "{}\n", &msg);
+                }
             }
-        }
+        }));
     }));
 
     // Harden against memory inspection and debugger attachment (release builds only).

src-tauri/src/lib.rs

@@ -901,6 +901,28 @@ impl RealtimeManager {
         // the frontend obtains once-per-session user consent before launching
         // a realtime-capable Mini App while Tor is enabled.
 
+        // Android: iroh's resolver stack (hickory, netdev) reads system config
+        // through `ndk_context`, and hickory's reader ABORTS the process when
+        // the context isn't registered yet — tao 0.35 registers it later in
+        // startup than 0.34 did, so a boot-time peer-advert preconnect can
+        // race into the window. Wait it out; the service-only process never
+        // registers one, so cap the wait and refuse there (it has no UI for
+        // a realtime session anyway).
+        #[cfg(target_os = "android")]
+        {
+            let mut registered = crate::android::utils::context_registered();
+            for _ in 0..50 {
+                if registered { break; }
+                tokio::time::sleep(std::time::Duration::from_millis(100)).await;
+                registered = crate::android::utils::context_registered();
+            }
+            if !registered {
+                return Err(anyhow::anyhow!(
+                    "Android context never registered — refusing to start Iroh (service-only process?)"
+                ));
+            }
+        }
+
         // Slow path: write lock, double-check, initialize
         let mut guard = self.iroh.write().await;
         if let Some(ref iroh) = *guard {

src-tauri/src/miniapps/realtime.rs

@@ -125,6 +125,14 @@ impl AudioRecorder {
         let (tx, rx) = mpsc::channel();
         *self.stop_tx.lock().unwrap() = Some(tx);
 
+        // cpal's AAudio host reads device params through `ndk_context`, which
+        // panics unregistered (service-only process, or pre-registration) — and a
+        // panic here can abort. Refuse with an error instead.
+        #[cfg(target_os = "android")]
+        if !crate::android::utils::context_registered() {
+            return Err("Audio unavailable: Android context not registered".to_string());
+        }
+
         let host = cpal::default_host();
         let device = host.default_input_device().ok_or("No input device found")?;