[A-EDev]

Summary

Closes a FLOW-SYNC/2 security gap: until now a recovery key could only be replaced right after a restore, so leaked words could never be revoked. Linked devices now has a "Replace recovery words" row. It asks for confirmation (the old words stop working and the group gets new keys), then appends a recovery roster entry as spec/protocol.md "Recovery" allows at any time:

• It generates a new recovery key.
• It writes wraps of K_(e+1) for every device plus the new recovery member, not the old one, along with the history chain box.
• It removes the old recovery member.
  The new words are shown once with the existing two-word check, and the key counts as unconfirmed until that check is done.

restore() and the new replaceRecovery() share one builder for the recovery entry (linking/Recovery.kt), so the post-restore path is unchanged in behaviour. If the store can't be reached or another device's entry lands first, nothing is appended and the error shows.

Related issue

None.

Change type

• Bug fix
• Feature
• Refactor or maintenance
• Build, packaging, or CI
• Documentation

Validation

• ./gradlew --offline -Dorg.gradle.jvmargs="..." :app:testGithubDebugUnitTest --tests 'io.github.aedev.flow.sync2.*': 229 tests, 1 failure: LanSyncTest.a_listener_takes_its_last_port_only_while_it_is_free (JobCancellationException under full-suite load; this PR doesn't touch LAN). Re-run --tests '...LanSyncTest' --tests '...RecoveryTest' twice: both passed.
• New tests in RecoveryTest:
  • after a replacement, the roster holds the new recovery member and not the old one, the epoch advanced, and epoch 1 wraps exist only for A, B, the new recovery member and chain; B opens epoch 1
  • the old words can't restore (RecoveryUsed), and a hand-built restore signed by the old key is refused by the roster rules
  • a replacement that loses the race appends nothing
• ./gradlew --offline ... ktlintCheck: exit 0.
• python3 .github/scripts/nightly_notes.py --check: valid.
• ./gradlew :app:assembleGithubDebug: not run separately (the test task compiled the github debug sources).
• I manually tested the affected behavior on an Android device or emulator: not yet; part of the Phase 7 device test round.

Test device and Android version: none yet.

Risk and compatibility

No protocol change: the recovery entry and its rules are already in every app that reads the roster. Desktop gets the same action in its own PR. Starting an epoch means every device picks up a new key on its next sync, as after a removal.

• The change does not introduce secrets, private data, or unexpected telemetry.
• New user-facing text uses Android string resources.
• Dependency and lockfile changes are intentional and limited to this PR.
• Room schema changes include the required version bump and migration, or this PR does not change the Room schema.
• Breaking changes and upgrade steps are clearly documented.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.