fix(android): keep the app files dir resolvable without a foreground Activity

[DepengWang]

Summary

On Android, the credential vault resolved its file path with a live JNI lookup that only works while the Tauri Activity is in the foreground. When encrypted sync ran a restore while the IME was in use and no Activity was visible, the restore failed half-way and stayed pending. The sync write gate then rejected every later write, and the IME stopped working with no visible error until the process was restarted.

This PR makes the JNI helper app_files_dir() cache its result and fall back to the always-registered Context when no Activity is in the foreground.

What happened (OnePlus CPH2573, encrypted sync signed in)

Taken from the on-device openless.log and app state; the process stayed alive for the whole period, no crash.

• 11:15:58 sync connects right after a dictation and starts a restore (pendingRestore written to encrypted-sync/generation.json, restore-*.bin created).
• 11:16:02 [vault] credential read failed: resolve Android credential directory: Tao Android context not yet initialized
• The restore never completes. SyncWriteGate::begin_mutation returns RecoveryRequired while pending_restore is set.
• For the next 25 hours:
  • every time settings is opened: [splash] failed to persist splash marker: recovery_required, so the startup animation replays each time;
  • tapping the mic in the IME does nothing. The Kotlin readiness checks pass (no mictap / heartbeat counters), the start command reaches Rust, and it fails at the credential read. That warning is de-duplicated against the previous one, so nothing is logged at the tap and the user sees no error.
• Provider tests run from the settings screen during that time succeed, because the Activity is in the foreground then.

Cause

android_credentials_path() calls jni::app_files_dir() on every use. That helper went only through tao::platform::android::prelude::main_android_context(), and the comment at the top of android/jni.rs already notes that Tao only keeps an Activity in that map while it is resumed.

Introduced with the Keystore-backed vault in #838; it becomes reachable once something reloads credentials while no Activity is in the foreground, which a sync restore does.

Change

app_files_dir() (in android/jni.rs) now:

• caches the directory in a OnceLock once resolved; it cannot change during the life of the process;
• still tries Tao's registry first (needed during early startup), and falls back to the Context registered through nativeRegisterActivityContext (the Application at startup, then the runtime service). That Context returns the same getFilesDir() and stays valid while only the IME is running.

android_credentials_path() is unchanged: the vault path is still derived only from the JNI getFilesDir(), never from TAURI_ANDROID_APP_DATA_DIR or a temp directory.

Note on the two commits

The first commit pointed the vault at android_storage::android_data_dir(). That cache can be filled from the environment variable when JNI fails, so it would have weakened the "no environment or temporary fallback" rule that android-credential-keystore-contract.test.mjs enforces; CI caught it. The second commit reverts that and fixes the lookup itself. Happy to squash.

Testing

• android-credential-keystore-contract.test.mjs passes; all of scripts/*.test.mjs: 53 of 56 pass, and the 3 failures (android-apk-workflow-contract, ci-cache-usage, ci-changed-areas) fail identically on an untouched upstream/beta checkout on this machine.
• cargo check --locked --target aarch64-linux-android on this branch; host cargo check --locked; rustfmt --check on the touched file.
• The diagnosis and the effect of removing the failing lookup were verified on the OnePlus with the first commit's approach: on the next process start the pending restore completed by itself within about two minutes (pendingRestore gone, restore-*.bin removed, generation 267 -> 270), three dictations ran normally, and later settings opens no longer logged the splash-marker failure.

Not tested:

• The final version (second commit) has been compiled for Android but not yet run on a device.
• No automated regression test: reproducing needs a sync restore with the Activity backgrounded.

Not addressed here

• A restore that fails half-way for any other reason still leaves the gate blocked with nothing shown to the user; only a process restart retries the recovery. On the same phone the Keystore reported temporarily_unavailable several times during a cold start, which could hit the same window.
• The de-duplicated vault warning makes a repeating failure look like a single old one in the log.

🤖 Generated with Claude Code