[piotr-iohk]

Twin: synonymdev/bitkit-ios#1193

This PR prepares version 3.1.0 (build 196) from master for release testing. Merge after the store release.

3.1 release blocker — manual sanity in progress

Updated 2026-11-03 14:52 CET. One manual sanity case is failing: RS-BRIDGE (Ethereum → Arbitrum USDT via Orchestra), reproduced on both platforms. Release sign-off is blocked while this route remains enabled.

• Android 3.1.0 (196), d13769269cf17737100e092d66b2bc9236bc8eb8: accepted a fresh 4 USDT estimate (1.28 deduction / 2.72 estimated credit), then rejected the confirmed source deposit as below_minimum / xchain_amount_too_small. The full 4 USDT refund is verified; Samsung shows Refunded. All three deposits’ 8.5 USDT principal is recovered; source gas remains spent. Refund recovery does not clear this bridge blocker.
• iOS 3.1.0 (203), 6bcce8f77d4077430d7183c40e8062b0a0326d67: accepted 2 and 2.5 USDT estimates, then rejected both funded deposits with the same error. Both principals were fully refunded; source gas was spent.
• Linked reports: Android #1764 · iOS #1197. The cross-platform symptom is established; exact root cause and whether this is a 3.1 regression remain unproven.
• Candidate for a 3.1 fix. Clear the blocker with a verified fix and successful funded bridge/minimum validation, or disable the affected route and verify both apps prevent new deposits through it. Manual sanity is still in progress; other uncompleted checks remain open.
• 3.1.0 sanity checklist. This product failure is separate from automated results and the accepted Android native UI test exception below.

Description

• Bump version 3.0.1 → 3.1.0 and build 195 → 196.
• Collect next-release changelog fragments into the dated 3.1.0 section.
• Release base: cb59453ce5170e6fad76a9b0a09abf96f496c433.

Design

N/A — no UI changes.

Preview

N/A

QA Notes

Setup

Release branch release-3.1.0. Staging workflow uses regtest and synonymdev/bitkit-e2e-tests branch main; completed staging/migration checkout logs resolve to 611509ee2d6dc44094276b567ac51949d63760f9.

Journeys

N/A — this PR changes version and changelog metadata only.

Manual Tests

N/A for the metadata changes. Manual release sanity is in progress; RS-BRIDGE fails on both platforms and blocks 3.1 sign-off (details above).

Automated Checks

No test changes. Current release automation results and coverage caveats follow.

Automated test status

Final results checked 2026-11-02 17:56 CET on release commit d13769269cf17737100e092d66b2bc9236bc8eb8.

Gate	Status	Evidence / coverage
Build / unit tests	PASSED	Workflow completed successfully.
Lint	PASSED	Workflow completed successfully.
Local E2E	PASSED	7 shards passed; Settings and Lightning/security needed second attempts.
Migration	PASSED	RN 1.1.6 and native 3.0.1 upgrade/restore: all four passed first attempt.
Staging	PASSED	Pubky/Paykit passed on attempt 2. Transfer: 2 intentionally skipped; multi-address: 1 intentionally skipped (Blocktank order creation retired; these shards execute no cases); hardware wallet: 3 passed, 1 skipped. Retry skips for already-passed cases are separate.
Native UI tests	FAILED	5 failed tests; details below.
Signed mainnet build	PASSED	3.1.0 (196); APKs, native symbols and checksums uploaded and verified; AAB excluded.

Native UI investigation — 2026-11-02 17:18 CET: 3 stale UI assertions and 2 staging funding/sync timing failures. The result remains FAILED, investigated and accepted as a native UI gate exception for 3.1.0. Test/CI-only fixes and pre-merge enforcement are being handled separately on master; no release rebuild or retag is required for those test changes. A green master run will not be counted as release validation.

• PreparedOnchainRecoveryFixtureTest.seedPreparedOriginalForRecoveryUi — native log reports No spendable outputs available. The wallet's last observed chain tip was 261358, while its 100,000-sat funding transaction confirmed at 261359. The fixture waits 15 seconds and syncs once before preparing the send, without checking funding readiness. This fails before the recovery behavior is exercised.
• TxBumpingTests.testBumpFeeByRbf — expected 100,000 sats, observed 0. Its last synced tip was 261371, while the funding transaction confirmed at 261374. It also uses a fixed 15-second wait. The failure occurs before sending or bumping a transaction; it is not evidence of broken RBF replacement.
• CreatePaymentRequestScreenTest.amountShowsNumberPadAndContinue — stale global selector expects one $ match; the report shows both the MoneyText amount ($ 28.79) and the unit-toggle label ($). Scope assertions to the intended control instead of counting the whole screen.
• ReceiveHardwareFlowTest.hardwareEditorReturnsToTrezorTab — ambiguous SpecifyInvoiceButton selector matches two composed receive pages, including one off-screen at negative x coordinates. Scope the click to the displayed hardware page.
• UsdtBridgeDetailsTest.providerRefundShowsSourceNetworkAndLocalizedAmountAndHonorsEligibility — stale comma-decimal expectation (50,000001 USDT). The shared formatter explicitly uses a decimal point, and UsdtDisplayTest asserts that convention across locales. The expected amount is 50.000001 USDT.

Compared with master UI run 41428123820 at ddd4256b7556ecb71d8c39453d37b48fbecad9c9: the same three UI assertions failed, while recovery and RBF passed. That run instead failed UTXO funding (120,000 of 170,000 sats); UTXO funding passed in this release run. This supports intermittent staging chain visibility/readiness, not a release-only regression. Logs establish the lagging wallet view but do not isolate whether the delay originated in the indexer or client sync.

Evidence: release report + per-test logcats, recovery funding transaction, RBF funding transaction. Funding transactions were independently checked read-only against staging. JUnit report: 295 tests, 5 failures, 4 skips.

Required follow-up: repair the three assertions; make funding setup wait with a bounded timeout for the specific deposit to become visible and spendable, logging chain heights and balances; then rerun the affected tests. No release sign-off is implied.
All current-head test workflows have finished. Native UI remains FAILED with the documented 3.1.0 exception; every other tracked gate passed. A successful staging workflow does not cover skipped cases. No release sign-off is implied.

Evidence

Version/build consistency, changelog fragment preservation, unchanged released changelog history and git diff --check passed. Independent metadata review found no actionable findings. Release commit signature verified locally and by GitHub.

Gaps

3.1 blocker: RS-BRIDGE fails on Android and iOS; see the linked reports and manual sanity status above. No release sign-off until resolved or safely mitigated and verified.

Native UI remains failed: three stale UI assertions and two staging funding/sync timing failures (evidence above). This native UI failure is accepted as a documented 3.1.0 exception; test-fix validation remains outstanding in the separate master follow-up. Staging contains skipped cases, and local/staging E2E required retries. Manual release QA and allowance-specific runtime gaps remain outside these automation results.

Release runs

Current release commit: d13769269cf17737100e092d66b2bc9236bc8eb8. The signed v3.1.0 tag points here. All 3.1.0 changelog entries now have PR references; both draft release bodies contain the changelog. Earlier runs were cancelled after the changelog correction.

• UI Tests
• E2E Staging
• E2E
• CI
• E2E Migration
• Lint
• Signed mainnet build — passed on d13769269cf17737100e092d66b2bc9236bc8eb8. Four APK variants, matching native debug symbols and checksums are attached to the draft release; the AAB is excluded. Asset digests, version 3.1.0/build 196, and the existing release signing certificate were verified.

Store release notes — shared with synonym.to.

Models used

• Planning/scoping: gpt-6-astra (reasoning: high)
• Implementation: gpt-6-astra (reasoning: high)
• Review: gpt-6-astra (reasoning: high)
• Review rounds: 1

[greptile-apps]

Confidence Score: 5/5

[Low impact] The metadata changes appear safe to merge.

Summary

Prepares version 3.1.0, build 196.

• Bitkit's release metadata now identifies version 3.1.0.

_{Reviews (1) · Last reviewed commit: "chore: version 3.1.0" · Reviewed by Greptile}

[ovitrif]

Milestone 3.1.0: this is the 3.1.0 release version bump.

[talosmachina]

No findings. Release prep for Bitkit Android 3.1.0: versionName 3.0.1 to 3.1.0 and versionCode 195 to 196, and the changelog.d/next/ fragments collected into a dated [3.1.0] section. Reviewed f67b68a, light tier, static (metadata-only diff; per the Bitkit track rules this box does not build the app branch, CI does).

What I checked, and 3 candidates I ruled out

Changed: app/build.gradle.kts, CHANGELOG.md, and 65 deleted fragments under changelog.d/next/ (only .gitkeep remains).

Changelog reproduced, not read: ran scripts/collect-changelog.sh --target next from master's own copy on a clean worktree of the base (master, the PR's merge base). It collected 65 entries; the only difference from this PR's CHANGELOG.md is the ## [3.1.0] - 2026-11-02 heading and the two link-reference lines ([Unreleased] now compares from v3.1.0, new [3.1.0] compares v3.0.1...v3.1.0). So every bullet, its category (6 Added, 6 Changed, 52 Fixed, 1 Security) and its #<n> suffix is exactly what the fragments produce, and no released section was touched (the diff's only removed line is the old [Unreleased] link).

Version: versionName 3.0.1 to 3.1.0 and versionCode 195 to 196; no other occurrence of the old marketing version left in the build file.

Ruled out

• Tag already exists: v3.1.0 points at f67b68a, the head of this PR, which is what Docs/RELEASE.md describes (tag the release branch, merge this PR after the store release).
• Fragments lost: 65 fragments deleted, 65 bullets in the new section, each fragment's text found in its category.
• Hotfix fragments: changelog.d/hotfix/ holds only .gitkeep on both base and head, so nothing was skipped.

Merge confidence: 4/5, no findings, but CI is still running at the time of review (lint, unit build, local E2E and migration jobs pending), so the green row does not apply yet.

Reviewer model: claude-opus-5-5
Reasoning effort: Not exposed (the reviewer's session metadata names the model but carries no reasoning setting)

[github-actions]

Regtest APK

Built from d137692 (run).

Download bitkit-dev-debug universal APK (expires in 30 days).

[jvsena42]

Code scan against v3.0.1, the last published release on this lineage. No findings. Approval waits for E2E Staging.

• Version: 3.1.0 (196). That's above every published build: v3.0.1 195, v3.0.0 193, v2.6.0 192, v2.5.1 191.
• Changelog: all 65 fragments are consumed, the hotfix section and the released sections are untouched, and every merge since v3.0.1 maps to an entry or is chore, test or perf work. No entry describes excluded work; allowances are on by default, so their entries are accurate.
• Hotfixes: v3.0.0 contains only release chores. The v2.5.1 Lightning 0.2.7 security fix is carried by ldk-node rc.78.
• Dependencies since v3.0.1: ldk-node rc.76 → rc.78, bitkit-core rc6 → rc11, paykit 0.1.0 → 0.1.1-rc2, vss 0.5.23 → 0.5.26-rc1. None needs a stored-state migration. Room stays at 7. Removed settings and cache fields are dropped through ignoreUnknownKeys. All four match synonymdev/bitkit-ios#1193.
• Newly on or off by default since v3.0.1: allowances are on. Geoblocking is removed. The Blocktank purchase, CJIT and wake paths are removed (#1696). Trusted 0-conf and no-reserve peers are now empty. Each of these is intended.
• Debug leaks: none in mainnet. The E2E server URLs are empty outside debug builds and resolve only when isDebug && isE2eTest.
• Upgrade paths I checked and left alone, because each was accepted in its own PR: paid but unopened Blocktank orders settled without a channel (#1696), Boost of a send broadcast before the upgrade (#1706), and the fee-warning estimate (#1724). A lingering pending-restore marker from 3.0.1 is unreadable only if the app's own WALLET backup can't be decoded; I found no realistic payload that does that. That case was raised on #1685.

Notes for the release, nothing to change here:

• With WakeNodeWorker gone, the app is no longer woken for incoming Lightning payments while closed. The changelog mentions only transfers and force close.
• Blocktank channels now pay anchor CPFP from on-chain funds on force close, because the no-reserve peers are empty.

CI at d137692: CI, Lint, E2E (all 7 local suites), E2E Migration (native_upgrade and native_restore from 3.0.1, rn_upgrade and rn_restore) and the signed mainnet build are green.

• UI Tests run 41468314316 failed 5/295. Three of these also fail on master's runs 41428123820 and 41414237130: UsdtBridgeDetailsTest, ReceiveHardwareFlowTest and CreatePaymentRequestScreenTest.
• The other two are regtest funding failures: TxBumpingTests.testBumpFeeByRbf ("Balance should equal deposit amount expected:<100000> but was:<0>") and PreparedOnchainRecoveryFixtureTest (OnchainTxCreationFailed). Master's runs fail a different funding test in the same way (UtxoSelectionTests, "expected:<170000> but was:<120000>"). I read these as environment flakes, not caused by this release; a re-run will settle it.

Device gate (partial): d137692 — not run; the runtime evidence is CI. Pending: E2E Staging run 41468153162. I'll approve once it's green.

Replaced by a comment review: release PRs merge after the store release.

[ovitrif]

Verdict: 💬 No blocking findings. Posted as a comment, not an approval, so this release PR is not merged before the store release; version and changelog are correct, and the notes below are non-blocking.

Checked

• versionName 3.1.0 and versionCode 196 in app/build.gradle.kts, the only version site; 196 is above every tagged build (195 is the last).
• v3.1.0 points at f67b68a; this head adds only the #1706 link in CHANGELOG.md. Master has no commits after the tag.
• All 65 changelog.d/next/ fragments are in the [3.1.0] section with the right category and number, and the folder is empty again. Compare links are correct.
• The diff touches only CHANGELOG.md, app/build.gradle.kts and the fragments. CI is green.

Notes (non-blocking)

• CHANGELOG.md:84-90: 7 blank lines before ## [3.0.1].
• CHANGELOG.md:47 and :49 (#1593, #1608) describe the same Receive-tab swipe and read as contradictory; one entry would do.
• CHANGELOG.md:43, :52, :73 (#1581, #1623, #1713) overlap on payment requests skipping the amount step.
• CHANGELOG.md:77 cites issue #1733; the PR is #1736.
• The allowance follow-ups #1707, #1708 and #1716 have no entry, while the iOS changelog lists their twins. Fine if intended, since allowances are new in 3.1.0.

[jvsena42]

Approving at d137692. The code scan in my partial review stands: no findings against v3.0.1.

CI at d137692: E2E Staging run 41468153162 is green on all four suites (pubky_paykit, transfer, hardware_wallet, multi_address). CI, Lint, E2E, E2E Migration and the signed mainnet build were already green.

UI Tests run 41468314316 failed 5 of 295; this approval doesn't cover them.

• Three of the failures also fail on master.
• The other two are regtest funding failures, TxBumpingTests.testBumpFeeByRbf and PreparedOnchainRecoveryFixtureTest. Re-run UI Tests before merging to confirm they pass.

Device gate: no device check needed — the diff is version and changelog only; the shipped code's runtime evidence is the CI above.