[Bug]: wrong hardware passphrase toast is hidden behind the transfer passphrase sheet

[piotr-iohk]

What happened?

Transfer to Spending from a paired passphrase (hidden) hardware wallet. After the Trezor session is gone, Bitkit asks for the passphrase again. Entering the wrong passphrase is correctly refused (nothing is signed, no extra wallet is added). The error toast is sent, but it is behind the passphrase sheet, so it looks like nothing happened.

Device recording: the toast is not visible while the sheet is open. After Cancel, the sheet dismisses and the toast is then visible in the background.

iOS shows the same toast on top of the sheet.

The toast is sent in TransferViewModel.handleHardwarePassphraseFailure → ToastEventBus (common__error / hardware__passphrase_mismatch). Unit tests and the hardware passphrase transfer journey assert that send. The prompt is a ModalBottomSheet that stays open on mismatch; ToastOverlay lives in MainActivity under that modal.

Expected behavior

An error toast is visible while the passphrase sheet is still open, matching iOS:

• Title: Error (common__error)
• Body: "That passphrase opens a different wallet. Enter the one you paired this wallet with." (hardware__passphrase_mismatch)

Signing remains blocked. The sheet stays so the user can retry.

Steps to Reproduce

1. Pair a Trezor hidden wallet (passphrase) and fund it.
2. Force-quit Bitkit (or otherwise drop the Trezor session) so the passphrase is no longer in the live session.
3. Start Transfer → Spending from that hidden hardware wallet.
4. On the sign step, the passphrase sheet appears.
5. Enter a wrong passphrase and tap Continue.
6. Observe: transfer does not sign, sheet stays, no toast on top of the sheet.
7. Tap Cancel. The toast is then visible on the sign screen behind the dismissed sheet.

Logs / Screenshots / Recordings

• Device recording: toast is hidden while the passphrase sheet is open; it appears after Cancel.

Screen_Recording_20260817_144604_Bitkit.Regtest.mp4

Bitkit Version

2.4.0 (dev build after #1142, 2026-08-14)

Device / OS

Samsung (Galaxy S22), physical device

Reproducibility

Always

Additional context

• Environment: regtest / local Trezor (physical Safe 7 and/or emulator) during cross-platform QA of iOS #662 vs Android #1142.
• Funds are not at risk: mismatch is rejected before sign.
• Non-blocking for shipping the iOS port; track as a follow-up.
• Recording confirms this is z-order, not a missing toast send.
• Likely fix: render the toast inside the passphrase sheet (or an inline error on the sheet, same as the connect-flow error), so it is not covered by ModalBottomSheet.
• iOS counterpart works via ToastWindowManager (separate window above sheets) in SpendingHwSign → app.toast(.passphraseMismatch).
• Related code: TransferViewModel.handleHardwarePassphraseFailure, SpendingHwSignScreen + HwPassphrasePromptSheet, MainActivity ToastOverlay.
• Related: epic #998; feature #1060.