Small sharp edge noted in #261's review, non-blocking there. preserveUnreadableStore snapshots with overwrite: false, so the first unreadable store wins the single backup slot forever. The comment justifies first-wins, but the case that actually matters runs the other way: a store rejected for a version mismatch is not corrupt, it is a file a newer build could still read, and if an older or partial write later produces a genuinely corrupt store, the valuable snapshot (the readable one) is the one that cannot be taken because the slot is occupied.
Cheap fixes: suffix snapshots with the store version or a timestamp so they never contend, or let a version-mismatch snapshot overwrite a corruption snapshot but not the reverse. Either keeps the guarantee that no path deletes the only copy of a session.
Small sharp edge noted in #261's review, non-blocking there. preserveUnreadableStore snapshots with overwrite: false, so the first unreadable store wins the single backup slot forever. The comment justifies first-wins, but the case that actually matters runs the other way: a store rejected for a version mismatch is not corrupt, it is a file a newer build could still read, and if an older or partial write later produces a genuinely corrupt store, the valuable snapshot (the readable one) is the one that cannot be taken because the slot is occupied.
Cheap fixes: suffix snapshots with the store version or a timestamp so they never contend, or let a version-mismatch snapshot overwrite a corruption snapshot but not the reverse. Either keeps the guarantee that no path deletes the only copy of a session.