[v0.4] Harden document storage reliability

[bjcdeshu]

Summary

• Bound document payloads to 5 MiB, decode UTF-8 strictly, preserve a leading BOM, and reject oversized output before opening a target stream.
• Detect external content changes before in-place saves, recheck confirmed overwrites, reject same-source Save As/Save copy targets, and verify reopened bytes.
• Persist debounced dirty snapshots and an earliest-known-good pre-write journal so provider failures and process death retain recoverable work.
• Serialize save, recovery, close, and incoming-intent transitions; reconcile session/persisted URI grants and Recent-document ownership.
• Add actionable Retry, Reload, Overwrite, Save copy, Recover, and Discard paths with English/Simplified Chinese parity.
• Add About/diagnostics, bundled third-party notices with a resolved-runtime audit, deterministic launcher/social asset verification, and grouped Gradle Dependabot updates.
• Add deterministic API 36 DocumentsProvider, ViewModel, Compose, permission, intent, and recreation coverage plus an emulator CI gate.

Why

Android document providers can change content, permissions, write support, and failure behavior outside Mora's process. This hardening keeps the current revision recoverable, avoids silent overwrites, and makes provider boundaries explicit without expanding Mora beyond its local-first single-document scope.

Validation

GitHub Android CI run #47 passed on the published head:

• 118 JVM tests, 0 failures
• testDebugUnitTest lintDebug assembleDebug
• resolved Release runtime third-party notice audit
• lintRelease assembleRelease with minification, R8 mapping, resource shrinking, ephemeral signing, and release-certificate distinction checks
• 35/35 instrumentation tests on the Android 16 / API 36 emulator, 0 skipped and 0 failed
• Debug Android-test APK compilation and assembly
• byte-identical repository/bundled notices
• java tools/ExportMoraLauncherIcons.java --verify (25 assets)
• git diff --check, YAML/action syntax, resource/XML/translation checks, and secret/junk scan

Release boundary

• Version metadata remains 0.3.3 / versionCode 7.
• This is a draft development PR, not a signed candidate, tag, merge, or public release.
• The documented real-device/local/read-only/cloud-provider matrix remains mandatory before any stable v0.4 tag.
• Known non-data-loss follow-up: if an Activity is recreated while a slow provider save is still active, dirty state remains safe but delivery of the final Retry/Save-copy UI result should move from the disposed composition into lifecycle-stable ViewModel state.

Relates to #19
Relates to #20
Relates to #21
Relates to #22
Relates to #23
Relates to #24
Relates to #25
Relates to #26

Tracks #27

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b1c4cf82-801b-43f9-adc3-3aefb49e72e5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}