[v0.4] Harden document storage reliability

[bjcdeshu]

Summary

• Bound document payloads to 5 MiB, decode UTF-8 strictly, preserve a leading BOM, and reject oversized output before opening a target stream.
• Detect external content changes before in-place saves, recheck confirmed overwrites, reject same-source Save As/Save copy targets, and verify reopened bytes.
• Persist debounced dirty snapshots and an earliest-known-good pre-write journal so provider failures and process death retain recoverable work.
• Serialize save, recovery, close, and incoming-intent transitions; reconcile session/persisted URI grants and Recent-document ownership.
• Keep save results and post-save actions in lifecycle-stable ViewModel state so slow provider completion survives Activity recreation without stale continuations.
• Add actionable Retry, Reload, Overwrite, Save copy, Recover, and Discard paths with English/Simplified Chinese parity.
• Add About/diagnostics, bundled third-party notices with a resolved-runtime audit, deterministic launcher/social asset verification, and grouped Gradle Dependabot updates.
• Add deterministic API 36 DocumentsProvider, ViewModel, Compose, permission, intent, and recreation coverage plus an emulator CI gate.

Why

Android document providers can change content, permissions, write support, and failure behavior outside Mora's process. This hardening keeps the current revision recoverable, avoids silent overwrites, and makes provider boundaries explicit without expanding Mora beyond its local-first single-document scope.

Validation

GitHub Android CI run #50 passed on head 4c8863d0a50e2ee6b21e5913d13b2ef886b43b6b:

• 119 JVM tests, 0 failures
• testDebugUnitTest lintDebug assembleDebug
• resolved Release runtime third-party notice audit
• lintRelease assembleRelease with minification, R8 mapping, resource shrinking, ephemeral signing, and release-certificate distinction checks
• 38/38 instrumentation tests on the Android 16 / API 36 emulator, 0 skipped and 0 failed
• Debug Android-test APK compilation and assembly
• byte-identical repository/bundled notices
• java tools/ExportMoraLauncherIcons.java --verify (25 assets)
• git diff --check, YAML/action syntax, resource/XML/translation checks, and secret/junk scan

Release boundary

• Version metadata remains 0.3.3 / versionCode 7.
• This PR integrates the reliability work; it is not a signed candidate, tag, or public release.
• A separate release-preparation PR must set 0.4.0-rc.1 / versionCode 8 and pass PR plus exact-main CI before an RC tag.
• The complete real-device/local/read-only/cloud-provider matrix remains mandatory before any stable v0.4 tag.

Relates to #19
Relates to #20
Relates to #21
Relates to #22
Relates to #23
Relates to #24
Relates to #25
Relates to #26

Tracks #27

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c8933180-6620-4cf6-b53b-004ab9e92342

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}