[A-EDev]

Summary

A device that bootstraps (has read nothing yet) took the newest snapshot of each link, and if one of that snapshot's blobs was missing or didn't verify or decrypt, the whole sync run failed and kept failing. spec/protocol.md "Reading a link from its snapshot" says to take the newest snapshot it can open, and store.md "Contain one bad item" says one bad item shouldn't stop the rest.

Session.bootstrap now collects every covering snapshot manifest of each wanted link. It tries them newest first and keeps the first whose blobs, epoch key and vv hashes all open. A link with no usable snapshot is treated like a link with no snapshot (read from each log's first object, as before), and when no link has one, bootstrap returns null as before. Network errors still fail the run.

Cost: bootstrap now verifies every log object it holds to find the older manifests, instead of stopping at the newest one per link. This happens once per new device.

No user-visible change worth a nightly note (it removes a sync failure that needed a corrupted store).

Related issue

None.

Change type

• Bug fix
• Feature
• Refactor or maintenance
• Build, packaging, or CI
• Documentation

Validation

• New test SnapshotsTest.a_new_device_falls_back_to_an_older_snapshot_when_a_blob_is_bad:
  • setup: two snapshots, the oldest log object gone, and the newer snapshot's blob first deleted, then corrupted;
  • check: a new reader gets all three records.
    It failed before the fix (ProtocolException at SnapshotsTest.kt:182, with app/src/main stashed) and passes after.
• ./gradlew --offline -Dorg.gradle.jvmargs="..." :app:testGithubDebugUnitTest (full suite): 4876 tests, 0 failures, 46 skipped.
• ./gradlew --offline ... ktlintCheck: exit 0.
• ./gradlew :app:assembleGithubDebug: not run separately (the test task compiled the github debug sources).
• I manually tested the affected behavior on an Android device or emulator: not yet; part of the Phase 7 device test round.

Test device and Android version: none yet.

Risk and compatibility

Bootstrap only. When the newest snapshot opens, the result is the same as before.

• The change does not introduce secrets, private data, or unexpected telemetry.
• New user-facing text uses Android string resources.
• Dependency and lockfile changes are intentional and limited to this PR.
• Room schema changes include the required version bump and migration, or this PR does not change the Room schema.
• Breaking changes and upgrade steps are clearly documented.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.