[A-EDev]

Summary

One discarded object (signature, stream position, or content the merges can't read) aborted every sync without advancing, so one bad object from one device stopped all syncing for good. Now (spec/store.md "Untrusted input", Flow-Tube/flow-sync#75):

• Session.readObject treats a ProtocolException like a gap: that sender's log stops there and the other senders are still read.
• Session.read keeps reading later pages for the other senders; the saved cursor stays at the first page with an unread object, so it is retried next sync.
• parseBatch checks batches at read time (bad header, a record that isn't an object, a wrong-typed key, or a record the merges can't decode, through a new SyncSerialization.checkRecords) and reports PAYLOAD, so a bad batch becomes a discard instead of an exception during apply.
• Bootstrap's newestManifests skips a discarded object.

Related issue

Change type

• Bug fix
• Feature
• Refactor or maintenance
• Build, packaging, or CI
• Documentation

Validation

• ./gradlew :app:assembleGithubDebug: not run on this branch; CI builds the APK
• ./gradlew --offline :app:testGithubDebugUnitTest --tests 'io.github.aedev.flow.sync2.*' --tests 'io.github.aedev.flow.sync.*': 159 sync2 and 162 sync tests, 0 failures. New: SessionTest.a_tampered_object_stops_only_its_sender_s_log (replaces a_tampered_object_is_refused), a_batch_the_merges_cant_read_stops_only_its_sender_s_log_on_every_page, SnapshotsTest.a_new_device_starts_from_the_snapshot_behind_a_tampered_object. Before: ProtocolException: signature, JsonDecodingException, ProtocolException: signature
• ./gradlew --offline ktlintCheck: passed
• I manually tested the affected behavior on an Android device or emulator.

Test device and Android version: not device-tested yet

Risk and compatibility

Nightly note added. A bad snapshot blob of the manifest chosen at bootstrap still fails that sync (Flow Desktop has the same limit).

• The change does not introduce secrets, private data, or unexpected telemetry.
• New user-facing text uses Android string resources.
• Dependency and lockfile changes are intentional and limited to this PR.
• Room schema changes include the required version bump and migration, or this PR does not change the Room schema.
• Breaking changes and upgrade steps are clearly documented.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.