super-productivity/android/app
Johannes Millan 7483ba241b
feat(local-backup): harden mobile backups against eviction (#7901) (#7924)
* fix(local-backup): don't overwrite a good backup with empty state (#7901)

After a WebView IndexedDB eviction the live NgRx store can boot empty.
The 5-min local-backup timer would then clobber the last good copy in
durable storage (Android SQLite KeyValStore, iOS file, Electron file)
with nothing. Gate _backup() with hasMeaningfulStateData() so empty/
degraded state can never overwrite a good backup, mirroring the existing
snapshot/compaction empty-overwrite guard.

* feat(local-backup): keep a second backup generation on mobile (#7901)

A single overwritten row/file is fragile: one bad or corrupt write cycle
can erase the only copy. Add a two-generation ring on the single-slot
mobile platforms (Android KeyValStore key, iOS file) — promote the
current backup to a 'prev' slot before overwriting, and restore from the
newest usable slot, falling back to prev when the primary is corrupt or
empty. Electron already keeps rotated, timestamped backups, so it is left
unchanged.

Adds backup-ring.util (isUsableBackupStr / selectBestBackupStr) with full
unit coverage; the iOS write is split behind _writeIOSFile so the promote
ordering is testable without the Capacitor Filesystem proxy.

* fix(android): store a real timestamp in KeyValStore KEY_CREATED_AT (#7901)

ContentValues binds "time('now')" as a literal string rather than letting
SQLite evaluate it, so every row's KEY_CREATED_AT held a constant text
value instead of a write timestamp. Store System.currentTimeMillis() so
the column is actually usable for ordering/debugging.

* fix(local-backup): harden restore paths from multi-agent review (#7901)

- loadBackupIOS: return '' instead of throwing when no usable backup
  exists. askForFileStoreBackupIfAvailable runs from the fire-and-forget
  _initBackups() at startup, so a throw became an unhandled rejection; ''
  degrades to the existing import-error snack and mirrors loadBackupAndroid.
- Consolidate the Android newline escape into loadBackupAndroid (the single
  escape site) and drop the now-redundant re-escape + log line at the call
  site, removing a full-string pass on the restore path.

* feat(local-backup): restore fuller generation, show contents (#7901)

Two restore-path improvements (issue #7901 item 4):

- selectBestBackupStr now prefers the ring generation carrying MORE
  data when both slots are usable (tie -> primary). After an eviction
  the live store can boot near-empty and a 5-min backup may write that
  degraded state to the primary; the full copy survives in prev, and
  restore must surface the full one rather than the newer-but-smaller.

- The mobile restore prompt loads the backup first and names its task
  and project counts (new RESTORE_FILE_BACKUP_MOBILE string), so a user
  never blindly discards the only copy of their data. Falls back to the
  generic prompt for an unparseable blob.

Note: a 'defer backups until the restore decision resolves' guard was
considered but is already structurally guaranteed -- init() (the only
thing starting the 5-min timer) runs after the synchronous restore
confirm in _initBackups, so the timer cannot fire before the decision.

* fix(local-backup): restore the newest backup, not the larger one (#7901)

Multi-agent review of d1e03e550a flagged the restore-time "prefer the
fuller generation" heuristic as unsafe: a legitimate bulk-archive or
delete makes the newer generation smaller, producing the SAME ring shape
as a post-eviction degraded primary. Preferring the larger slot would
then silently restore the older generation and resurrect removed tasks --
a worse, more common failure than the narrow eviction gap it closed.

- Revert selectBestBackupStr to newest-usable-wins (drop backupWeight and
  the size comparison). The prev slot stays a fallback for an empty/corrupt
  newest slot only. The informed prompt (below) is what protects the
  eviction case now: the user sees a substantial backup and accepts it.
- Fix the prompt counts (summarizeBackupStr): include archived tasks so a
  heavily-archived backup doesn't read as empty, and exclude the
  always-present INBOX project so it matches hasMeaningfulStateData.
- Reword RESTORE_FILE_BACKUP_MOBILE: drop the self-contradictory "NO DATA
  ... but a backup with N tasks" framing, and use label-style counts
  ("tasks: N") so it reads correctly for a count of 1 (no ICU plurals).

Deferred follow-ups from the review: a write-time "suspicious shrink"
guard (needs threshold design) and a backup date in the prompt (needs an
Android bridge change to surface KEY_CREATED_AT; iOS has stat mtime).
2026-06-01 21:40:10 +02:00
..
src feat(local-backup): harden mobile backups against eviction (#7901) (#7924) 2026-06-01 21:40:10 +02:00
.gitignore ____MERGING SUPER PRODUCTIVITY ANDROID ____ 2024-10-11 14:11:23 +02:00
app_config.properties ____MERGING SUPER PRODUCTIVITY ANDROID ____ 2024-10-11 14:11:23 +02:00
build.gradle 18.8.0 2026-05-30 01:19:30 +02:00
capacitor.build.gradle build(android): register edge-to-edge support plugin in gradle 2026-05-28 23:54:51 +02:00
config.gradle ____MERGING SUPER PRODUCTIVITY ANDROID ____ 2024-10-11 14:11:23 +02:00
google.properties ____MERGING SUPER PRODUCTIVITY ANDROID ____ 2024-10-11 14:11:23 +02:00
proguard-rules.pro feat(droid): background sync notifications for android 2026-03-20 10:24:02 +01:00