@onekeyfe/react-native-app-update 3.0.65 → 3.0.67

package/android/build.gradle

@@ -142,6 +142,11 @@ dependencies {
   // own GPG public key + BouncyCastle verify implementation.
   implementation project(":onekeyfe_react-native-bundle-crypto")
 
+  // Shared 8-range concurrent downloader (segment-file model). app-update no
+  // longer carries its own copy of ConcurrentRangeDownloader — it consumes the
+  // single shared implementation here, same as react-native-bundle-update.
+  implementation project(":onekeyfe_react-native-range-downloader")
+
   implementation "com.squareup.okhttp3:okhttp:4.12.0"
   implementation "com.squareup.okio:okio:3.9.0"
   implementation "androidx.core:core-ktx:1.15.0"

package/android/src/main/java/com/margelo/nitro/reactnativeappupdate/ReactNativeAppUpdate.kt

@@ -28,6 +28,11 @@ import java.util.concurrent.atomic.AtomicBoolean
 import java.util.concurrent.atomic.AtomicInteger
 import java.util.concurrent.atomic.AtomicLong
 import com.margelo.nitro.reactnativebundlecrypto.BundleCryptoCore
+// Shared 8-range concurrent downloader (segment-file model, no whole-file
+// pre-allocation). Previously app-update bundled its own private copy; it now
+// consumes the single shared implementation in react-native-range-downloader
+// so a fix lands once for both APK and JS-bundle downloads.
+import com.margelo.nitro.reactnativerangedownloader.ConcurrentRangeDownloader
 
 private data class Listener(
     val id: Double,
@@ -40,6 +45,12 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
     companion object {
         private const val CHANNEL_ID = "updateApp"
         private const val NOTIFICATION_ID = 1
+
+        // Must match ConcurrentRangeDownloader's default segmentCount: the
+        // concurrent downloader writes sibling segment files
+        // "<partial>.seg0".."<partial>.seg${N-1}", and Phase 2 below scans this
+        // range to detect an in-flight concurrent download.
+        private const val CONCURRENT_SEGMENT_COUNT = 8
     }
 
     private val listeners = CopyOnWriteArrayList<Listener>()
@@ -68,10 +79,21 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
         listeners.removeAll { it.id == id }
     }
 
-    private fun getApkCacheDir(): File {
+    /**
+     * Directory for downloaded APK artifacts (.apk / .partial / .segN / .asc).
+     *
+     * Uses filesDir, NOT cacheDir: cacheDir is system-reclaimable — under
+     * storage pressure Android can purge it or make it unwritable mid-download,
+     * surfacing as EROFS/ENOSPC when opening a new segment file. filesDir is
+     * persistent app data and is the same location react-native-bundle-update
+     * downloads to. It is still installable: the APK is handed to the system
+     * installer via FileProvider, whose <paths> exposes this dir
+     * (see res/xml/app_update_file_paths.xml: <files-path name="apks_files" .../>).
+     */
+    private fun getApkDownloadDir(): File {
         val context = NitroModules.applicationContext
             ?: throw SecurityException("Application context unavailable")
-        val apkDir = File(context.cacheDir, "apks")
+        val apkDir = File(context.filesDir, "apks")
         if (!apkDir.exists()) apkDir.mkdirs()
         return apkDir
     }
@@ -97,7 +119,7 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
         val file = if (stripped.startsWith("/")) {
             File(stripped)
         } else {
-            File(getApkCacheDir(), stripped)
+            File(getApkDownloadDir(), stripped)
         }
 
         // Validate the resolved path is within the app's cache or files directory
@@ -147,16 +169,17 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
             .followSslRedirects(false)
             .build()
         val request = Request.Builder().url(ascUrl).build()
-        val response = client.newCall(request).execute()
-        if (!response.isSuccessful) return null
         val content = StringBuilder()
         val maxAscSize = 10 * 1024
-        val body = response.body ?: return null
-        BufferedReader(InputStreamReader(body.byteStream())).use { reader ->
-            var line: String?
-            while (reader.readLine().also { line = it } != null) {
-                content.append(line).append("\n")
-                if (content.length > maxAscSize) return null
+        client.newCall(request).execute().use { response ->
+            if (!response.isSuccessful) return null
+            val body = response.body ?: return null
+            BufferedReader(InputStreamReader(body.byteStream())).use { reader ->
+                var line: String?
+                while (reader.readLine().also { line = it } != null) {
+                    content.append(line).append("\n")
+                    if (content.length > maxAscSize) return null
+                }
             }
         }
         val ascContent = content.toString()
@@ -482,10 +505,24 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                         expectedSize > 0 && existingSize > expectedSize -> {
                             OneKeyLog.warn("AppUpdate", "downloadAPK: existing APK larger than expected, deleting")
                             downloadedFile.delete()
+                            // Oversized final means local state is untrustworthy. A stale
+                            // single-stream .partial and any sibling .segN left by an earlier
+                            // concurrent run could otherwise be picked up below and reused —
+                            // wipe them so this restarts cleanly from byte zero.
+                            if (partialFile.exists()) partialFile.delete()
+                            for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
                         }
                         expectedSize > 0 && existingSize < expectedSize -> {
                             OneKeyLog.info("AppUpdate", "downloadAPK: existing APK smaller than expected, promoting to .partial for resume")
                             if (partialFile.exists()) partialFile.delete()
+                            // Drop any sibling .segN BEFORE the promotion. The promoted final
+                            // must become a clean single-stream resume cursor: if .segN
+                            // survived, Phase 2's hasConcurrentSegments check would fire and
+                            // the concurrent downloader would treat this legacy .partial as a
+                            // concat committed-cursor, risking a mixed file. With no .segN,
+                            // Phase 2 takes the single-stream size-based path and Range-resumes
+                            // from the partial's length.
+                            for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
                             if (!downloadedFile.renameTo(partialFile)) {
                                 OneKeyLog.warn("AppUpdate", "downloadAPK: rename to .partial failed, deleting stale final")
                                 downloadedFile.delete()
@@ -502,6 +539,10 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                                     OneKeyLog.info("AppUpdate", "downloadAPK: existing APK hash mismatch, deleting and re-downloading")
                                     downloadedFile.delete()
                                     if (partialFile.exists()) partialFile.delete()
+                                    // Final was stale → start from byte zero. Wipe any
+                                    // sibling .segN left by an earlier concurrent run so
+                                    // it can't be mistaken for trustworthy in-flight bytes.
+                                    for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
                                 }
                                 ApkVerifyOutcome.Indeterminate -> {
                                     // ASC could not be fetched (offline) or could
@@ -520,23 +561,21 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
 
                 // Phase 2 — pick up an in-flight partial.
                 //
-                // A concurrent (multi-range) partial is pre-allocated to the FULL
-                // size up front (RandomAccessFile.setLength(total)) and tracks the
-                // real, durably-written cursor only in its sidecar
-                // "<partial>.progress" manifest — the .partial itself is zero-filled
-                // past the real data. The size-based classification below is blind
-                // to that: it would see partialSize == expectedSize and try to
-                // promote+SHA-verify a mostly-zeroed file, hit HashMismatch, and
-                // DELETE it — nuking every interrupted concurrent download back to
-                // byte 0. So when the manifest exists, skip the size-based
+                // The concurrent (multi-range) downloader stores in-flight bytes in
+                // sibling segment files "<partial>.seg0".."<partial>.segN" — NOT in
+                // the .partial (the .partial only ever holds real, fully-assembled
+                // bytes, written by the concurrent downloader's final concat or by
+                // the single-stream path). When any segment file exists, an
+                // interrupted concurrent download owns the slot: skip the size-based
                 // promote/discard branches entirely and let the concurrent
-                // downloader below own the file: it resumes from the manifest (or
-                // returns FALLBACK and hands the bytes back to single-stream).
-                // The path must match exactly what ConcurrentRangeDownloader writes:
-                // File("$partialFilePath.progress").
-                val hasConcurrentManifest = buildFile("$partialFilePath.progress").exists()
+                // downloader below resume (it picks up each .segN, or returns
+                // FALLBACK and hands the bytes back to single-stream). The segment
+                // path must match exactly what ConcurrentRangeDownloader writes:
+                // File("$partialFilePath.seg$i").
+                val hasConcurrentSegments =
+                    (0 until CONCURRENT_SEGMENT_COUNT).any { buildFile("$partialFilePath.seg$it").exists() }
                 var partialBytes = 0L
-                if (partialFile.exists() && !hasConcurrentManifest) {
+                if (partialFile.exists() && !hasConcurrentSegments) {
                     val partialSize = partialFile.length()
                     when {
                         expectedSize > 0 && partialSize == expectedSize -> {
@@ -568,6 +607,8 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                         expectedSize > 0 && partialSize > expectedSize -> {
                             OneKeyLog.warn("AppUpdate", "downloadAPK: stale partial (>expected $partialSize/$expectedSize), discarding")
                             partialFile.delete()
+                            // Partial bytes are untrustworthy → restart from zero; drop any sibling .segN too.
+                            for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
                         }
                         partialSize > 0 -> {
                             partialBytes = partialSize
@@ -605,7 +646,14 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                     val concurrentOutcome = ConcurrentRangeDownloader(
                         httpClient = concurrentClient,
                         log = { msg -> OneKeyLog.info("AppUpdate", msg) },
-                    ).download(url, partialFilePath) { transferred, total ->
+                        // MUST be the ABSOLUTE path. partialFilePath is just a
+                        // file NAME ("<apk>.partial"); the downloader does
+                        // File(path) on it, which resolves a relative name
+                        // against the process CWD ("/") and writes the segment
+                        // files to the read-only root fs → EROFS. Resolve it to
+                        // the real apks dir (filesDir/apks) first, exactly like
+                        // react-native-bundle-update passes an absolute path.
+                    ).download(url, partialFile.absolutePath) { transferred, total ->
                         if (total > 0) {
                             val p = ((transferred * 100) / total).toInt().coerceIn(0, 100)
                             // Only the thread that advances the percent emits; a
@@ -694,6 +742,8 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                                 // anyone reading the error.
                                 OneKeyLog.warn("AppUpdate", "downloadAPK: 416 recovery hash mismatch — server build changed mid-download")
                                 if (partialFile.exists()) partialFile.delete()
+                                // Server build changed → these bytes are worthless; drop sibling .segN too.
+                                for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
                                 throw java.io.IOException("Server build changed mid-download (size matches but hash differs)")
                             }
                             PromoteOutcome.Deferred -> {
@@ -710,6 +760,8 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                     }
                     OneKeyLog.warn("AppUpdate", "downloadAPK: HTTP 416 (range not satisfiable), discarding partial and failing attempt")
                     if (partialFile.exists()) partialFile.delete()
+                    // Partial discarded as unusable → drop sibling .segN too so the next attempt starts clean.
+                    for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
                     throw Exception("HTTP 416 (range not satisfiable)")
                 }
 
@@ -728,6 +780,8 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 if (expectsResume && !serverWillResume) {
                     OneKeyLog.warn("AppUpdate", "downloadAPK: requested Range but server returned 200, restarting from scratch")
                     if (partialFile.exists()) partialFile.delete()
+                    // Restarting from byte zero → drop any sibling .segN too.
+                    for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
                     partialBytes = 0L
                 }
 
@@ -744,10 +798,20 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 if (serverWillResume) {
                     val rangeStart = rangeMatch?.groupValues?.getOrNull(1)?.toLongOrNull()
                     if (rangeStart == null || rangeStart != partialBytes) {
-                        OneKeyLog.warn("AppUpdate", "downloadAPK: 206 Content-Range start mismatch (header='${response.header("Content-Range")}', requested=$partialBytes); treating as full restart")
+                        // This 206 body is a slice starting at the wrong offset (CDN bug /
+                        // proxy rewrite). It is NOT a full file, so we must not consume it as
+                        // one — doing so would write mis-aligned bytes (caught only later at
+                        // SHA/GPG, after a bogus "downloaded" event). Wipe the partial + any
+                        // .segN so the next attempt starts clean from byte zero, close the
+                        // bad response, and throw a retryable error. The outer
+                        // catch(Exception) emits update/error and rethrows; finally resets
+                        // isDownloading, so this won't wedge.
+                        val contentRangeHeader = response.header("Content-Range")
+                        OneKeyLog.warn("AppUpdate", "downloadAPK: 206 Content-Range start mismatch (header='$contentRangeHeader', requested=$partialBytes); discarding partial and retrying from scratch")
                         if (partialFile.exists()) partialFile.delete()
-                        partialBytes = 0L
-                        serverWillResume = false
+                        for (i in 0 until CONCURRENT_SEGMENT_COUNT) buildFile("$partialFilePath.seg$i").delete()
+                        response.close()
+                        throw java.io.IOException("206 Content-Range start mismatch (header='$contentRangeHeader', requested=$partialBytes); discarded partial, retry from scratch")
                     }
                 }
 
@@ -866,33 +930,37 @@ class ReactNativeAppUpdate : HybridReactNativeAppUpdateSpec() {
                 .followSslRedirects(false)
                 .build()
             val request = Request.Builder().url(ascFileUrl).build()
-            val response = client.newCall(request).execute()
-
-            if (!response.isSuccessful) {
-                OneKeyLog.error("AppUpdate", "downloadASC: HTTP error, statusCode=${response.code}")
-                throw Exception(response.code.toString())
-            }
-
-            OneKeyLog.info("AppUpdate", "downloadASC: HTTP 200, reading ASC content...")
+            // Wrap in .use so the Response (and its connection) is released on every
+            // exit path — including the !isSuccessful / empty-body / oversize throws,
+            // which previously leaked the connection back to the pool unclosed.
+            val ascContent = client.newCall(request).execute().use { response ->
+                if (!response.isSuccessful) {
+                    OneKeyLog.error("AppUpdate", "downloadASC: HTTP error, statusCode=${response.code}")
+                    throw Exception(response.code.toString())
+                }
 
-            val content = StringBuilder()
-            val maxAscSize = 10 * 1024 // 10 KB max for ASC files
-            val body = response.body ?: throw Exception("Empty ASC response body")
-            BufferedReader(InputStreamReader(body.byteStream())).use { reader ->
-                var line: String?
-                while (reader.readLine().also { line = it } != null) {
-                    content.append(line).append("\n")
-                    if (content.length > maxAscSize) {
-                        OneKeyLog.error("AppUpdate", "downloadASC: ASC file exceeds max size ($maxAscSize bytes)")
-                        throw Exception("ASC file exceeds maximum allowed size")
+                OneKeyLog.info("AppUpdate", "downloadASC: HTTP 200, reading ASC content...")
+
+                val content = StringBuilder()
+                val maxAscSize = 10 * 1024 // 10 KB max for ASC files
+                val body = response.body ?: throw Exception("Empty ASC response body")
+                BufferedReader(InputStreamReader(body.byteStream())).use { reader ->
+                    var line: String?
+                    while (reader.readLine().also { line = it } != null) {
+                        content.append(line).append("\n")
+                        if (content.length > maxAscSize) {
+                            OneKeyLog.error("AppUpdate", "downloadASC: ASC file exceeds max size ($maxAscSize bytes)")
+                            throw Exception("ASC file exceeds maximum allowed size")
+                        }
                     }
                 }
-            }
 
-            val ascContent = content.toString()
-            if (ascContent.isEmpty()) {
-                OneKeyLog.error("AppUpdate", "downloadASC: ASC content is empty")
-                throw Exception("Empty ASC file")
+                val parsed = content.toString()
+                if (parsed.isEmpty()) {
+                    OneKeyLog.error("AppUpdate", "downloadASC: ASC content is empty")
+                    throw Exception("Empty ASC file")
+                }
+                parsed
             }
 
             OneKeyLog.info("AppUpdate", "downloadASC: ASC content size=${ascContent.length} bytes")
@@ -1207,7 +1275,8 @@ n2DMz6gqk326W6SFynYtvuiXo7wG4Cmn3SuIU8xfv9rJqunpZGYchMd7nZektmEJ
             OneKeyLog.warn("AppUpdate", "$tag: application context unavailable, skipping file cleanup")
             return
         }
-        val apkDir = File(context.cacheDir, "apks")
+        // Must match getApkDownloadDir() (filesDir/apks).
+        val apkDir = File(context.filesDir, "apks")
         if (!apkDir.exists()) {
             OneKeyLog.info("AppUpdate", "$tag: apks cache directory does not exist, nothing to clean")
             return

package/android/src/main/res/xml/app_update_file_paths.xml

@@ -1,4 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <paths>
+    <!-- Primary APK download location (filesDir/apks). MUST match getApkDownloadDir(). -->
+    <files-path name="apks_files" path="apks/" />
+    <!-- Legacy location: an APK already downloaded into cacheDir/apks by an older
+         build can still be exposed to the installer during the transition. -->
     <cache-path name="apks" path="apks/" />
 </paths>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onekeyfe/react-native-app-update",
-  "version": "3.0.65",
+  "version": "3.0.67",
   "description": "react-native-app-update",
   "main": "./lib/module/index.js",
   "types": "./lib/typescript/src/index.d.ts",

package/android/src/main/java/com/margelo/nitro/reactnativeappupdate/ConcurrentRangeDownloader.kt

@@ -1,362 +0,0 @@
-package com.margelo.nitro.reactnativeappupdate
-
-import okhttp3.OkHttpClient
-import okhttp3.Request
-import java.io.File
-import java.io.RandomAccessFile
-import java.util.concurrent.Executors
-import java.util.concurrent.atomic.AtomicBoolean
-import java.util.concurrent.atomic.AtomicLong
-import java.util.concurrent.atomic.AtomicReference
-
-/**
- * Splits a Range-capable download into [segmentCount] byte ranges fetched in
- * parallel, each written directly into its own offset of ONE pre-allocated
- * `.partial` file (no merge pass, 1x disk). A sidecar `<partial>.progress`
- * manifest records each segment's durably-written cursor so an interrupted
- * download resumes by re-requesting only the unfinished tail of each segment.
- *
- * Mirrors the desktop DesktopApiBundleUpdate concurrent path. This class is
- * intentionally free of Android/OneKey dependencies (logging is injected) so
- * it can be unit/type-checked standalone.
- *
- * LOAD-BEARING: the caller's whole-file SHA256 + GPG verify performed AFTER
- * promotion is the final correctness backstop for this concurrent path and must
- * NEVER be skipped. Resume here is best-effort (ETag-gated; no ETag => fresh
- * start), and concurrent stitching of ranges has no per-segment integrity
- * check — a mismatched or mixed file is only ever caught by that downstream
- * whole-file verify. Removing it would let a corrupt/mixed APK reach install.
- *
- * Invariant: the manifest is only meaningful as metadata for an existing
- * `.partial`. Either both exist (resume) or neither does (fresh) — any other
- * combination is treated as "no resumable state".
- */
-internal class ConcurrentRangeDownloader(
-    private val httpClient: OkHttpClient,
-    private val segmentCount: Int = 8,
-    private val minConcurrentBytes: Long = 2L * 1024 * 1024,
-    private val maxPartRetry: Int = 3,
-    private val manifestFlushBytes: Long = 4L * 1024 * 1024,
-    private val log: (String) -> Unit = {},
-) {
-    enum class Outcome {
-        /** `.partial` is fully on disk; caller should promote (rename) + verify. */
-        COMPLETED,
-
-        /** Concurrency unusable — caller should use its single-stream path. */
-        FALLBACK,
-    }
-
-    /** Thrown internally when a segment proves concurrency can't be used. */
-    private class FallbackException(message: String) : Exception(message)
-
-    private class Part(val index: Int, val start: Long, val end: Long, @Volatile var done: Long) {
-        val length: Long get() = end - start + 1
-    }
-
-    private class Probe(val totalSize: Long, val etag: String?, val supportsRange: Boolean)
-
-    /**
-     * Fills [partialFilePath] completely with the resource at [url] using
-     * concurrent ranges. See [Outcome]. Throws on a transient/IO error after
-     * per-segment retries, leaving the partial + manifest in place so a later
-     * attempt resumes.
-     */
-    fun download(
-        url: String,
-        partialFilePath: String,
-        onProgress: (transferred: Long, total: Long) -> Unit,
-    ): Outcome {
-        val partialFile = File(partialFilePath)
-        val manifestFile = File("$partialFilePath.progress")
-
-        // A bare `.partial` with no manifest is a single-stream leftover; let
-        // the caller's single-stream path resume it instead of discarding it.
-        if (partialFile.exists() && !manifestFile.exists()) {
-            log("concurrent: single-stream partial present, deferring to single-stream")
-            return Outcome.FALLBACK
-        }
-
-        val probe = probe(url) ?: return Outcome.FALLBACK
-        if (!probe.supportsRange || probe.totalSize < minConcurrentBytes) {
-            log("concurrent: not eligible (supportsRange=${probe.supportsRange}, size=${probe.totalSize})")
-            return Outcome.FALLBACK
-        }
-        val total = probe.totalSize
-        val etag = probe.etag
-
-        partialFile.parentFile?.let { if (!it.exists()) it.mkdirs() }
-        dropOrphanManifest(partialFile, manifestFile)
-        val parts = loadOrInitManifest(manifestFile, partialFile, total, etag)
-
-        val transferred = AtomicLong(parts.sumOf { it.done })
-        onProgress(transferred.get(), total)
-
-        val aborted = AtomicBoolean(false)
-        val fallback = AtomicBoolean(false)
-        val firstError = AtomicReference<Exception?>(null)
-        val lastFlushed = LongArray(parts.size) { parts[it].done }
-
-        val pool = Executors.newFixedThreadPool(minOf(segmentCount, parts.size))
-        try {
-            val futures = parts.map { part ->
-                pool.submit {
-                    try {
-                        downloadPart(url, etag, partialFile, part, aborted) { delta ->
-                            val t = transferred.addAndGet(delta)
-                            synchronized(lastFlushed) {
-                                if (part.done - lastFlushed[part.index] >= manifestFlushBytes) {
-                                    lastFlushed[part.index] = part.done
-                                    flushManifest(manifestFile, total, etag, parts)
-                                }
-                            }
-                            onProgress(t, total)
-                        }
-                    } catch (e: FallbackException) {
-                        fallback.set(true)
-                        aborted.set(true)
-                        firstError.compareAndSet(null, e)
-                    } catch (e: Exception) {
-                        aborted.set(true)
-                        firstError.compareAndSet(null, e)
-                    }
-                }
-            }
-            futures.forEach { it.get() }
-        } finally {
-            pool.shutdownNow()
-        }
-
-        if (fallback.get()) {
-            // Stale/unusable bytes — clear before the caller falls back.
-            discard(partialFile, manifestFile)
-            return Outcome.FALLBACK
-        }
-        val err = firstError.get()
-        if (err != null) {
-            // Transient — persist progress so the next attempt resumes, then bubble up.
-            flushManifest(manifestFile, total, etag, parts)
-            throw err
-        }
-        val got = parts.sumOf { it.done }
-        if (got < total) {
-            flushManifest(manifestFile, total, etag, parts)
-            throw java.io.IOException("Concurrent download incomplete ($got/$total)")
-        }
-
-        // Success: `.partial` is fully filled. The manifest's job is done and it
-        // must never outlive the `.partial` it describes (caller is about to
-        // promote it), so drop it now.
-        manifestFile.delete()
-        log("concurrent: completed ($total bytes)")
-        return Outcome.COMPLETED
-    }
-
-    // Single round-trip probe: a one-byte Range request that confirms Range
-    // support and captures total size + ETag. The caller's OkHttp client has
-    // redirects DISABLED (followRedirects(false)/followSslRedirects(false)), so
-    // a 3xx is not a 200/206 and probe() returns null -> Outcome.FALLBACK; the
-    // single-stream path (also redirect-disabled) then handles it.
-    // TODO: if APK origins ever start issuing redirects, decide deliberately
-    // whether to enable followSslRedirects(true) (HTTPS-only) here; until then
-    // redirecting origins simply fall back to single-stream.
-    private fun probe(url: String): Probe? {
-        return try {
-            val req = Request.Builder().url(url).addHeader("Range", "bytes=0-0").build()
-            httpClient.newCall(req).execute().use { response ->
-                val etag = response.header("ETag")
-                when (response.code) {
-                    206 -> {
-                        val total = response.header("Content-Range")
-                            ?.let { Regex("""bytes \d+-\d+/(\d+)""").find(it)?.groupValues?.getOrNull(1)?.toLongOrNull() }
-                        if (total != null) Probe(total, etag, true) else Probe(0, etag, false)
-                    }
-                    200 -> {
-                        // Server ignored Range — single-stream only.
-                        val len = response.body?.contentLength() ?: -1L
-                        Probe(if (len > 0) len else 0, etag, false)
-                    }
-                    else -> null
-                }
-            }
-        } catch (e: Exception) {
-            log("concurrent: probe failed: ${e.javaClass.simpleName}")
-            null
-        }
-    }
-
-    private fun dropOrphanManifest(partialFile: File, manifestFile: File) {
-        if (!partialFile.exists() && manifestFile.exists()) {
-            log("concurrent: dropping orphan manifest")
-            manifestFile.delete()
-        }
-    }
-
-    private fun discard(partialFile: File, manifestFile: File) {
-        // Manifest first so it never outlives the partial it describes.
-        manifestFile.delete()
-        partialFile.delete()
-    }
-
-    // Resume from a manifest whose size/ETag still match, else (re)create a
-    // fresh pre-allocated partial + manifest. Manifest is removed before the
-    // partial is (re)created, and written only after the partial exists.
-    private fun loadOrInitManifest(
-        manifestFile: File,
-        partialFile: File,
-        total: Long,
-        etag: String?,
-    ): List<Part> {
-        if (manifestFile.exists() && partialFile.exists()) {
-            val parsed = parseManifest(manifestFile, total, etag, partialFile.length())
-            if (parsed != null) {
-                log("concurrent: resuming, transferred=${parsed.sumOf { it.done }}/$total")
-                return parsed
-            }
-        }
-        discard(partialFile, manifestFile)
-        RandomAccessFile(partialFile, "rw").use { it.setLength(total) }
-        val parts = ArrayList<Part>()
-        val chunk = (total + segmentCount - 1) / segmentCount
-        var i = 0
-        while (i < segmentCount) {
-            val start = i * chunk
-            if (start >= total) break
-            val end = minOf(start + chunk - 1, total - 1)
-            parts.add(Part(parts.size, start, end, 0))
-            i += 1
-        }
-        writeManifest(manifestFile, total, etag, parts)
-        return parts
-    }
-
-    // Manifest format (dependency-free, internal): line 0 "<size>|<etag>",
-    // then one "<index>,<start>,<end>,<done>" line per segment.
-    private fun writeManifest(manifestFile: File, total: Long, etag: String?, parts: List<Part>) {
-        val sb = StringBuilder()
-        sb.append(total).append('|').append(etag ?: "").append('\n')
-        for (p in parts) {
-            sb.append(p.index).append(',').append(p.start).append(',')
-                .append(p.end).append(',').append(p.done).append('\n')
-        }
-        manifestFile.writeText(sb.toString())
-    }
-
-    @Synchronized
-    private fun flushManifest(manifestFile: File, total: Long, etag: String?, parts: List<Part>) {
-        try {
-            writeManifest(manifestFile, total, etag, parts)
-        } catch (e: Exception) {
-            log("concurrent: manifest flush failed: ${e.javaClass.simpleName}")
-        }
-    }
-
-    private fun parseManifest(manifestFile: File, total: Long, etag: String?, partialSize: Long): List<Part>? {
-        return try {
-            val lines = manifestFile.readText().trim().split('\n')
-            if (lines.isEmpty()) return null
-            val head = lines[0].split('|')
-            val savedSize = head.getOrNull(0)?.toLongOrNull() ?: return null
-            val savedEtag = head.getOrNull(1)?.takeIf { it.isNotEmpty() }
-            // Object must be identical to what's on disk and on the CDN.
-            if (savedSize != total || partialSize != total) return null
-            // Without an ETag we have no strong validator that the bytes already
-            // on disk belong to the SAME build as the one the CDN is serving now.
-            // A same-size-but-different build (common during a staged rollout)
-            // would otherwise resume by stitching old + new bytes into one file.
-            // The downstream whole-file SHA256 + GPG verify WOULD reject that
-            // mixed file, but only after we've wasted the whole download. So treat
-            // an ETag-less manifest as untrustworthy across restarts: bail out
-            // here and let the caller start fresh.
-            // (If a weaker validator is ever wanted, persist+compare Last-Modified
-            // instead of dropping outright.)
-            if (etag == null || savedEtag == null) return null
-            if (etag != savedEtag) return null
-            val parts = ArrayList<Part>()
-            for (idx in 1 until lines.size) {
-                val cols = lines[idx].split(',')
-                if (cols.size != 4) return null
-                val i = cols[0].toIntOrNull() ?: return null
-                val s = cols[1].toLongOrNull() ?: return null
-                val e = cols[2].toLongOrNull() ?: return null
-                var d = cols[3].toLongOrNull() ?: return null
-                val segLen = e - s + 1
-                if (d < 0) d = 0
-                if (d > segLen) d = segLen
-                parts.add(Part(i, s, e, d))
-            }
-            if (parts.isEmpty()) null else parts
-        } catch (e: Exception) {
-            log("concurrent: manifest parse failed: ${e.javaClass.simpleName}")
-            null
-        }
-    }
-
-    // Download [start+done, end] of [part] into its own RandomAccessFile handle
-    // (each segment gets its own fd so concurrent positioned writes don't race),
-    // resuming from part.done and retrying transient failures in place.
-    private fun downloadPart(
-        url: String,
-        etag: String?,
-        partialFile: File,
-        part: Part,
-        aborted: AtomicBoolean,
-        onBytes: (delta: Long) -> Unit,
-    ) {
-        var retry = 0
-        while (true) {
-            if (aborted.get()) throw java.io.IOException("aborted")
-            val rangeStart = part.start + part.done
-            if (rangeStart > part.end) return
-            try {
-                fetchSegment(url, etag, partialFile, part, rangeStart, aborted, onBytes)
-                return
-            } catch (e: FallbackException) {
-                throw e
-            } catch (e: Exception) {
-                if (aborted.get() || retry >= maxPartRetry) throw e
-                retry += 1
-                log("concurrent: segment ${part.index} retry $retry: ${e.javaClass.simpleName}")
-            }
-        }
-    }
-
-    private fun fetchSegment(
-        url: String,
-        etag: String?,
-        partialFile: File,
-        part: Part,
-        rangeStart: Long,
-        aborted: AtomicBoolean,
-        onBytes: (delta: Long) -> Unit,
-    ) {
-        val builder = Request.Builder().url(url)
-            .addHeader("Range", "bytes=$rangeStart-${part.end}")
-        // If-Range: a mismatched ETag makes the CDN reply 200 (full body)
-        // instead of 206, which we treat as a fallback signal.
-        if (etag != null) builder.addHeader("If-Range", etag)
-        httpClient.newCall(builder.build()).execute().use { response ->
-            if (response.code == 200) {
-                throw FallbackException("server returned 200 to a Range request")
-            }
-            if (response.code != 206) {
-                throw java.io.IOException("HTTP ${response.code}")
-            }
-            val body = response.body ?: throw java.io.IOException("Empty segment body")
-            RandomAccessFile(partialFile, "rw").use { raf ->
-                raf.seek(rangeStart)
-                body.byteStream().use { input ->
-                    val buffer = ByteArray(8192)
-                    while (true) {
-                        if (aborted.get()) throw java.io.IOException("aborted")
-                        val read = input.read(buffer)
-                        if (read == -1) break
-                        raf.write(buffer, 0, read)
-                        part.done += read
-                        onBytes(read.toLong())
-                    }
-                }
-            }
-        }
-    }
-}