fix(android): API 31+ Invalid window token crash + v0.1.9

[amillez]

Summary

v0.1.9 — fixes a production crash recurrence on Android 12 (Pixel 6, API 31). Same IllegalArgumentException: Invalid window token class that v0.1.6 fixed for Android 11 (API 30), reappearing because v0.1.6's INTERNAL_SYSTEM_WINDOW pre-check was scoped to SDK_INT == 30 only.

Reproduced 1:1 on the Pixel 6 / Android 12 emulator with the exact stack trace from the user's crash report:

Exception java.lang.IllegalArgumentException: Invalid window token (never added or removed already)
  at android.view.WindowlessWindowManager.relayout (WindowlessWindowManager.java:275)
  at android.view.ViewRootImpl.relayoutWindow (ViewRootImpl.java:7792)
  at android.view.ViewRootImpl.performTraversals (ViewRootImpl.java:2840)
  at android.view.ViewRootImpl$TraversalRunnable.run
  at android.view.Choreographer.doFrame
  at android.os.Looper.loop

host.setView() throws SecurityException: Requires INTERNAL_SYSTEM_WINDOW permission on Android 12 (same as 11), but ViewRootImpl.setView queues a TraversalRunnable via requestLayout() before the throw. Runnable fires at next vsync (TRAVERSAL phase) → WWM.relayout → token never registered → crash from Looper.loop.

Two-layer fix

1. Pre-check broadened to API 30..32 (Android 11, 12, 12L). AOSP enforces INTERNAL_SYSTEM_WINDOW for SCVH addToDisplay on all three; API 33 (Android 13) relaxed it.

-if (Build.VERSION.SDK_INT == Build.VERSION_CODES.R &&
+if (Build.VERSION.SDK_INT in Build.VERSION_CODES.R..Build.VERSION_CODES.S_V2 &&
   activity.checkSelfPermission("android.permission.INTERNAL_SYSTEM_WINDOW")
     != PackageManager.PERMISSION_GRANTED
 ) {
   scvhDisabled = true
   return false
 }

2. New failScvhAttach(host, reason) helper invoked from all 5 SCVH attach recovery branches. SYNCHRONOUSLY calls unscheduleScvhTraversals(host) to cancel the queued TraversalRunnable BEFORE returning to the caller — main-thread synchronous, drains the queue strictly before the next vsync. deferredReleaseScvh was structurally too late: it posts via Choreographer.postFrameCallback (animation phase) → mainHandler.post, which lands AFTER the same vsync's TRAVERSAL phase completes. The runnable runs IN the traversal phase, strictly before our handler message.

Layer 2 protects every API where SCVH might unexpectedly fail — cold-boot Pixel emulator quirks on Android 14, future Android versions, OEM-customised WindowManager builds. Layer 1 is an optimization on top: known-affected APIs skip the wasted SCVH attempt.

Side benefit: helper collapses ~110 lines of duplicated catch-block comments/code across five recovery branches into one-line invocations.

Verified

Device	Result
Pixel 6 / Android 12 (API 31) — the reproducer	✅ No FATAL EXCEPTION, no Invalid window token. App PID stable through 5× home/app-switcher + 10× toggle stress. New API 31 pre-check log: attachCover scvh: API 31 + INTERNAL_SYSTEM_WINDOW not granted; SCVH would throw at setView, disabling SCVH for this session.
Pixel_9 emulator / Android 16 (API 37)	✅ 9/9 maestro flows pass in 3m 26s — identical to v0.1.6 / v0.1.8 baseline. SCVH still works, SurfaceFlinger-direct alpha toggle still wins the snapshot race (broadcast: fast scvh=true).

Files changed

• android/src/main/java/com/margelo/nitro/cover/HybridCover.kt — net -5 lines (the helper refactor consolidates duplicated catch blocks).
• package.json — 0.1.8 → 0.1.9.
• CHANGELOG.md — new 0.1.9 - 2026-06-02 entry.