Hardening candidates: v2.30.0

[jeiel85]

Candidates surfaced by, or adjacent to, what shipped in v2.30.0 (#215 outline screen, #214 open-at + jump control). Filed at tag time as a tracker, not as blockers — v2.30.0 ships as it is.

Correctness and boundaries

• The outline drops nothing, but it flattens #### and deeper into level 3. CommonMarkPreviewAdapter.renderHeading maps node.level 1/2/else, so H4–H6 render and outline identically to H3. Now that indentation is the only level cue on the outline screen, a deeply nested note reads as flat. Un-flattening means new PreviewLineType values and preview rendering to match — deliberately out of scope for Title tree view for quick note browsing #215, tracked here. Impact: outline readability on notes using more than three heading levels.
• isLongEnoughToJump counts source lines, so a note of forty short lines gets the jump control and a note of five paragraphs that wrap to sixty screen lines does not. Line count is a proxy for "does not fit on screen", and it is wrong in both directions. A measured proxy (text length, or the text field's own content height) would track the real thing. Impact: the control appears on some notes that do not need it and misses some that do.
• The editor's jump direction is inferred from the caret, not the scroll position. BasicTextField's classic API exposes no scroll state, so "which end are you further from" reads editorState.selection.start. Scroll without moving the caret and the arrow can point the way you already are. The preview path uses the real firstVisibleItemIndex. Impact: a confusing arrow on the editor surface only; the tap still works.

Data and storage

• note_view_state rows are written for every note visited while "where I left off" is on, and never pruned except by the note's own deletion. Cascade covers deletes, but a user who turns the setting on, browses a thousand notes, and turns it off again leaves a thousand rows behind. A prune on switching the setting off — or on the next maintenance pass — would keep it honest. Impact: unbounded row growth in a database that is otherwise proportional to note count.
• The position write reads the row back before writing it, on every debounced save. One extra query per second of idle editing, to preserve the other surface's value. A cached last-known pair in composition state would avoid the read entirely. Impact: negligible today; worth revisiting if the write ever moves off the debounce.

Configuration consistency

• The store changelogs for de-DE, es-ES and fr-FR were written over the 500-character Play cap and had to be trimmed by hand. verify-release-notes.ps1 catches the overrun, and warns under 50 characters of headroom — three of six locales are in that band for v2.30.0. The warning has no teeth and the trimming is manual. Consider having the export refuse a locale that is over, and having authoring tooling show the count while writing. Impact: an avoidable round trip at every release cut; Hardening candidates: v2.26.1 #167 is the precedent where it reached CI.
• The landing pages carry a "current release" strapline that no check covers. verify-landing-versions.ps1 asserts the three version strings per page but not the neighbouring <span>, which still reads "Includes Quiet Formatting" — a feature from an earlier release. Impact: the trust ledger advertises a stale headline feature indefinitely.

Testing

• The settings screen snapshot only covers what fits above the fold at 800×600dp. Adding "Open notes at" changed nothing in settings_centered_tablet.png because the Notes & search section is below the visible area. Every settings row added since that snapshot was written is visually uncovered. Impact: visual regressions in most of the settings screen would pass CI unnoticed.
  • Done in test(settings): gate the settings rows that live below the fold (#255) #259. settings_notes_search_tablet.png, settings_data_tablet.png and settings_privacy_tablet.png now snapshot the sections that sit below the fold, recorded on the Linux runner rather than locally.
• The migration assertions for note_view_state live in AppDatabaseMigrationTest, which is instrumented and therefore not run by CI (AppIntegrationTest crashes the app process on teardown, and CI never runs it #235). The v17→v18 migration, the cascade, and the "legacy note has no row" case are all asserted and all only run when someone runs them locally. Impact: a broken migration reaches a release unless the local gate is remembered.
  • Done in test: make the instrumented suite run, and run it in CI (#235, #239) #272 (AppIntegrationTest crashes the app process on teardown, and CI never runs it #235, The instrumented UI test suite has drifted against the UI it asserts on #239). The instrumented-tests job in android-build.yml runs :app:ciAtdApi30DebugAndroidTest on an AGP managed device, so these assertions now execute on every push.
  • One limit remains, deliberately: the job is continue-on-error: true until it has been green for a while, so a broken migration is reported but does not block a merge. It has failed 3 of its last 6 runs, so promoting it to a required check is not yet the right move — but the flake belongs to the job, not to the migration.

Observability

• Nothing reports that a position restore was clamped or dropped. A note that shrank outside the app silently lands somewhere other than where it was left, which from the outside is indistinguishable from the setting not working. A one-line note in the Sync Center, or a debug log, would make it explainable. Impact: unreproducible "it forgot where I was" reports.

[jeiel85]

Audited against the tree at 9969025 (v2.31.0) as part of a sweep over every open hardening tracker. Two items were done and never ticked — the body now reflects that, with the evidence attached to each.

Closed: the below-the-fold settings snapshots (#259) and the instrumented migration assertions now running in CI (#272). The second carries a caveat worth reading — the job exists but is continue-on-error, so a broken migration is reported rather than blocked.

The other eight stand, verified in the tree:

• renderHeading still maps 1 / 2 / else, so H4–H6 remain flattened to H3.
• isLongEnoughToJump still counts \n.
• The editor's jump direction still reads editorState.selection.start; the preview path still uses the real firstVisibleItemIndex.
• NoteViewStateDao exposes only upsert and getForNote — no prune of any kind.
• The debounced write still calls getForNote before every upsert.
• Store-note length is still checked only after the files are written (also tracked in Hardening candidates: v2.29.1 #252 and Hardening candidates: v2.31.0 #262).
• The "current release" strapline still reads Quiet Formatting on all six landing pages, and verify-landing-versions.ps1 still asserts only the three version strings plus the figcaption.
• Nothing reports a clamped or dropped position restore.