fix(storage): degrade to `MemoryOnlyProvider` once the IDB heal budget is exhausted by sosek108 · Pull Request #854 · Expensify/react-native-onyx

sosek108 · 2026-10-01T12:25:05Z

Details

Follow-up to #853. That PR made UnknownError: Internal error. go through the connection layer's FATAL heal. A heal reopens the connection, which is the same thing a reload does. For users whose database stays broken across connections (the user in the linked issue failed init on 5 reloads in a row), the heal budget runs out. After that, Onyx keeps sending every read and write to a dead IndexedDB for the rest of the session.

With this PR, once the budget is exhausted, createStore rethrows the error as IndexedDB heal budget exhausted: <original message>, with the original error as cause. classifyIDBError maps that wording to UNAVAILABLE. That class already does what we need:

the storage layer (lib/storage/index.ts) swaps in MemoryOnlyProvider, and
retryOperation skips the retry quietly.

The app keeps working for the session with in-memory storage, so data from OpenApp and later writes can be read back. Nothing persists across reloads, but persistence was already broken for these users.

The switch also happens earlier, at init. When Storage.getAll in initializeWithDefaultKeyStates fails FATAL, the connection layer has already reopened once and the read still failed. OnyxUtils boots with defaults as before, and now also calls the new Storage.degradeToMemoryOnly(error). Without this, the first writes after boot (the OpenApp burst) would each fail against IndexedDB until the budget ran out, and get dropped. The session already runs on defaults at that point, so writing it into a database we could not read gains nothing.

The budget-exhausted path still covers a database that breaks after a good init. It only fires after 3 failed reopen attempts with no successful operation in between. A one-off FATAL still heals as before and keeps IndexedDB.

The heal budget exhausted alert now carries errorMessage. Together with the Falling back to only using cache log, it shows in VictoriaLogs how many sessions end up on memory-only, and for which error.

Related Issues

Expensify/App#102272

Linked E/App PR

Expensify/App#103208

Automated Tests

classifyErrorTest: the heal-exhausted wording classifies as UNAVAILABLE.
createStoreTest: once the budget is spent, the rejection carries the new message and the original DOMException as cause, and classifies as UNAVAILABLE.
tryOrDegradePerformanceTest: a heal-exhausted rejection swaps the provider to MemoryOnlyProvider, and a later write and read round-trip through it.
tryOrDegradePerformanceTest: degradeToMemoryOnly swaps the provider to MemoryOnlyProvider.
onyxUtilsTest: an init read failing with UnknownError: Internal error. calls degradeToMemoryOnly, and one failing with an unclassified error does not.

Manual Tests

To be verified against the linked E/App PR.

Author Checklist

Screenshots/Videos

Android: Native

Android: mWeb Chrome

iOS: Native

Nagranie.z.ekranu.2026-10-8.o.10.33.15.mov

iOS: mWeb Safari

MacOS: Chrome / Safari

Nagranie.z.ekranu.2026-10-8.o.11.59.18.mov

…rror

…names

sosek108 · 2026-10-06T08:06:04Z

@fabioh8010 I've aligned the code to your feedback. I've refactored the IDBKeyValProvider so there is no error string repetition

fabioh8010 · 2026-10-06T12:25:18Z

@@ -0,0 +1,7 @@
+/** Messages of errors thrown by the IndexedDB provider itself, matched by `classifyIDBError` as UNAVAILABLE. */


"matched by classifyIDBError as UNAVAILABLE." is this right?

Yes, both messages are classified as StorageErrorClass.UNAVAILABLE (missing engine and spent heal budget both mean the store is gone for the session). I reworded the comment to name the class explicitly so it doesn't read as the key is unavailable

chatgpt-codex-connector · 2026-10-08T10:01:55Z

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

mountiny

Changes look good but waiting for testing and checklist from @mkhutornyi

mkhutornyi · 2026-10-09T15:51:38Z

Reviewer Checklist

I have verified the author checklist is complete (all boxes are checked off).
I verified the correct issue is linked in the ### Fixed Issues section above
I verified testing steps are clear and they cover the changes made in this PR
- I verified the steps for local testing are in the Tests section
- I verified the steps for Staging and/or Production testing are in the QA steps section
- I verified the steps cover any possible failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
- I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
I checked that screenshots or videos are included for tests on all platforms
I included screenshots or videos for tests on all platforms
I verified that the composer does not automatically focus or open the keyboard on mobile unless explicitly intended. This includes checking that returning the app from the background does not unexpectedly open the keyboard.
I verified tests pass on all platforms & I tested again on:
- Android: HybridApp
- Android: mWeb Chrome
- iOS: HybridApp
- iOS: mWeb Safari
- MacOS: Chrome / Safari
If there are any errors in the console that are unrelated to this PR, I either fixed them (preferred) or linked to where I reported them in Slack
I verified proper code patterns were followed (see Reviewing the code)
- I verified that comments were added to code that is not self explanatory
- I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
- I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
I verified that this PR follows the guidelines as stated in the Review Guidelines
I verified other components that can be impacted by these changes have been tested, and I retested again (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar have been tested & I retested again)
If a new component is created I verified that:
- A similar component doesn't exist in the codebase
- All props are defined accurately
- The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
- The only data being stored in the state is data necessary for rendering and nothing else
- The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
If a new CSS style is added I verified that:
- A similar style doesn't already exist
- The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG)
If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
- I verified that all the inputs inside a form are aligned with each other.
- I added Design label and/or tagged @Expensify/design so the design team can review the changes.
If the PR adds or modifies the UI:
- I asked an AI agent to review the changes for accessibility issues and addressed its findings.
- I tested with a screen reader (VoiceOver on macOS) and verified all new/changed elements are reachable with a logical focus order.
- I verified all new/changed elements have meaningful accessible names and roles.
- I verified state changes are announced (e.g. checked/unchecked, expanded/collapsed, selected).
For any bug fix or new feature in this PR, I verified that sufficient unit tests are included to prevent regressions in this flow.
If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
I have checked off every checkbox in the PR reviewer checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: HybridApp

Android: mWeb Chrome

iOS: HybridApp

iOS: mWeb Safari

MacOS: Chrome / Safari

test1.mov

test2.mov

mkhutornyi · 2026-10-09T16:21:37Z

        return provider;
    },

+    degradeToMemoryOnly: (error) => degradePerformance(error),


degradePerformance can run many times

Consider adding if (provider === MemoryOnlyProvider) return; at the start of this function

I made the fix you suggested

mkhutornyi · 2026-10-09T16:22:14Z

            Logger.logAlert(`Failed to load data from storage during init. The app will boot with default key states only. Error: ${error}`);

+            if (Storage.classifyError(error) === StorageErrorClass.FATAL) {
+                Storage.degradeToMemoryOnly(error);


degradeToMemoryOnly can receive something that isn't an Error

The value caught at startup is passed in as is.
A string rejection that is classified as FATAL from its text produces the log line Error: undefined Stack: undefined, which loses the only diagnostic for the switch.

I made a fix like you suggested

mkhutornyi · 2026-10-09T16:23:20Z

+                        errorMessage,
                    });
-                } else if (errorClass === StorageErrorClass.UNKNOWN) {
+                    throw new Error(`${IDBErrorMessage.HEAL_EXHAUSTED}: ${errorMessage}`, {cause: error});


HEAL_EXHAUSTED is detected by matching text in the error message

Consider using dedicated name such as IDBHealExhaustedError, checked by name

Fixed like you suggested

mkhutornyi · 2026-10-09T16:44:36Z

A tab on memory-only storage loses data when another tab writes

react-native-onyx/lib/storage/InstanceSync/index.web.ts

Line 127 in 467a05a

storage.multiGet(keys).then((pairs) => onStorageKeysChanged(pairs));

After a tab switches to memory-only storage, cross-tab sync still reads changed keys from that tab's own storage. That storage is now the empty in-memory store, so it returns undefined and Onyx.ts#L79 overwrites the cached value with it.

On main, this can't happen with a broken IndexedDB. Storage never switches to memory, so other tabs' writes fail before any sync event is sent. With this PR, writes succeed in memory and the sync events go out.

Example: two tabs both fall back to memory. Send a message in tab B, and in tab A that chat's messages vanish until reload.

Suggested fix: ignore sync events (or skip undefined values) once the provider is MemoryOnlyProvider.

mkhutornyi

No App issues found.
Worth checking #854 (comment) before merge

mountiny · 2026-10-12T14:57:02Z

@fabioh8010 @sosek108 can you check the review comment, please?

sosek108 · 2026-10-13T07:18:11Z

@mkhutornyi for I've applied your suggested fixes (alongside with #854 (comment)).

Ready for review

Degrade to MemoryOnlyProvider once the IDB heal budget is exhausted

d145c34

melvin-bot Bot assigned sosek108 Oct 1, 2026

sosek108 mentioned this pull request Oct 1, 2026

[Onyx] Edge on Windows: every IndexedDB read and write fails with UnknownError: Internal error., leaving the web app unusable Expensify/App#102272

Open

Degrade to MemoryOnlyProvider when the init read fails with a FATAL e…

f86b7e5

…rror

fabioh8010 mentioned this pull request Oct 5, 2026

[Tracking] Onyx Improvements Expensify/App#80355

Open

comments clean up

7b8795c

fabioh8010 reviewed Oct 5, 2026

View reviewed changes

Comment thread lib/storage/providers/IDBKeyValProvider/classifyError.ts Outdated

Comment thread lib/storage/providers/IDBKeyValProvider/classifyError.ts Outdated

sosek108 added 3 commits October 6, 2026 09:38

add comment line

96d0006

refactor the InbKeyVal provider so there are no repetitions of error …

b6ac2eb

…names

API docs

05a8674

fabioh8010 reviewed Oct 6, 2026

View reviewed changes

sosek108 added 2 commits October 6, 2026 16:40

typo fix

606493d

fix comment

b2d31b1

sosek108 mentioned this pull request Oct 6, 2026

[Onyx bump] Pin react-native-onyx to IDB memory-only fallback fix Expensify/App#103208

Draft

1 of 45 tasks

sosek108 requested a review from fabioh8010 October 7, 2026 11:26

Use UNAVAILABLE error constant in createStore tests

467a05a

sosek108 marked this pull request as ready for review October 8, 2026 10:01

sosek108 requested a review from a team as a code owner October 8, 2026 10:01

melvin-bot Bot requested review from amyevans and removed request for a team and fabioh8010 October 8, 2026 10:02

amyevans previously approved these changes Oct 8, 2026

View reviewed changes

amyevans requested a review from mountiny October 8, 2026 14:07

fabioh8010 approved these changes Oct 9, 2026

View reviewed changes

mountiny requested a review from mkhutornyi October 9, 2026 15:47

mountiny previously approved these changes Oct 9, 2026

View reviewed changes

mkhutornyi reviewed Oct 9, 2026

View reviewed changes

mkhutornyi approved these changes Oct 9, 2026

View reviewed changes

sosek108 added 3 commits October 13, 2026 09:08

degradePerformance can be run only once

9cbf4c6

degradeToMemoryOnly now accepts unknown instead of Error.

293b4ba

error name used for comparisons

57b9405

sosek108 dismissed stale reviews from mountiny and amyevans via 57b9405 October 13, 2026 07:14

stop accepting syncs when MemoryProvider only

74ed9d2

		@@ -0,0 +1,7 @@
		/** Messages of errors thrown by the IndexedDB provider itself, matched by `classifyIDBError` as UNAVAILABLE. */

Conversation

sosek108 commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Related Issues

Linked E/App PR

Automated Tests

Manual Tests

Author Checklist

Screenshots/Videos

Uh oh!

Uh oh!

Uh oh!

sosek108 commented Oct 6, 2026

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot commented Oct 8, 2026

Uh oh!

mountiny left a comment

Choose a reason for hiding this comment

Uh oh!

mkhutornyi commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviewer Checklist

Screenshots/Videos

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

mkhutornyi commented Oct 9, 2026

A tab on memory-only storage loses data when another tab writes

Uh oh!

mkhutornyi left a comment

Choose a reason for hiding this comment

Uh oh!

mountiny commented Oct 12, 2026

Uh oh!

sosek108 commented Oct 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

sosek108 commented Oct 1, 2026 •

edited

Loading

mkhutornyi commented Oct 9, 2026 •

edited

Loading