fix: wrap vault backup initial read in try/catch to survive Android Keystore key invalidation

app/core/BackupVault/backupVault.test.ts

@@ -186,6 +186,32 @@ describe('backupVault file', () => {
       expect(response).toEqual(mockedSuccessResponse);
     });
 
+    it('should still succeed if reading the existing backup throws (e.g. Android Keystore key invalidation)', async () => {
+      const newVault = 'new-vault';
+
+      // Simulate a stale entry already in the keychain
+      await setInternetCredentials(
+        VAULT_BACKUP_KEY,
+        VAULT_BACKUP_KEY,
+        dummyPassword,
+      );
+
+      // Simulate Android Keystore throwing on the read
+      (getInternetCredentials as jest.Mock).mockImplementationOnce(() => {
+        throw new Error('Android Keystore key permanently invalidated');
+      });
+
+      const keyringState: KeyringControllerState = {
+        vault: newVault,
+        keyrings: [],
+        isUnlocked: false,
+      };
+
+      const response = await backupVault(keyringState);
+
+      expect(response).toEqual({ success: true, vault: newVault });
+    });
+
     it('should reset vault before backup', async () => {
       const mockedSuccessResponse = { success: true };
 

app/core/BackupVault/backupVault.ts

@@ -65,7 +65,21 @@ export async function backupVault(
 
   try {
     // Does a primary backup exist?
-    const existingBackup = await getInternetCredentials(VAULT_BACKUP_KEY);
+    // Wrapped in its own try/catch because Android Keystore key invalidation
+    // (e.g. biometric enrollment change, Android 16 behavioural change) causes
+    // getInternetCredentials to throw rather than return false/undefined.
+    // If the read fails we treat it as "no existing backup" so the fresh
+    // backup can still be written below.
+    let existingBackup;
+    try {
+      existingBackup = await getInternetCredentials(VAULT_BACKUP_KEY);
+    } catch (readError) {
+      Logger.log(
+        readError,
+        'backupVault: failed to read existing backup, proceeding with fresh backup',
+      );
+      await clearAllVaultBackups();
+    }
 
     // An existing backup exists, backup it to the temp key
     if (existingBackup && existingBackup.password) {