Skip retry for unrecoverable IndexedDB blob-write errors + instrument failing writes

[elirangoshen]

Details

Follow-up from the Onyx storage-error re-check (Expensify/App#87844). After the March fixes shipped, the March top-3 errors collapsed as intended — but DataError: Failed to write blobs grew from 1.9% → ~93% of all Onyx storage errors and is now the dominant one (Expensify/App#87871).

Root cause. Chromium wraps any IndexedDB value whose serialized size exceeds 64 KB into an external blob file (MIME application/vnd.blink-idb-value-wrapper). The IDB provider stores raw values (store.put(value, key)), so large Onyx writes take this path, and DataError: Failed to write blobs is thrown when that blob-file write fails — IOError (the file write failed) or InvalidBlob (dangling blob reference). Batch writes (multiSetWithRetry) dominate because they are the most likely to contain a >64 KB value, and one bad blob rejects the whole transaction.

The classifier didn't recognize this error, so it fell into UNKNOWN and was bounded-retried 5×, with the Failed to save to storage … retryAttempt N/5 line logging once per attempt — ~6 log lines per failure before the write was silently dropped. Prod logs show this is futile: the retryAttempt histogram is flat from 0/5 to 5/5 (~99.7% exhaust all 5 retries and still fail), and it does not correlate with quota/disk-full — it's a Chromium blob-write fault, not storage pressure.

Changes:

1. New storage-error class StorageErrorClass.UNRECOVERABLE (lib/storage/errors.ts) — an engine-level write fault or permanently-invalid payload that no retry, reopen, or eviction can fix, and that must not crash the caller (unlike INVALID_DATA, which throws).
2. Classify failed to write blobs → UNRECOVERABLE (lib/storage/providers/IDBKeyValProvider/classifyError.ts). The connection layer (createStore) already rethrows any non-TRANSIENT/FATAL class quietly (no reopen), and retryOperation gets a branch that logs one skip line and resolves — no 5× retry, no throw, no eviction.
3. Instrumentation (summarizeFailedWritePayload in lib/OnyxUtils.ts) — on UNRECOVERABLE blob failures, logs the failing key(s) and each value's approximate serialized size (never the values themselves): pairs: N. over64KB: M. largest: [key=bytesB, …]. This is diagnostic: it confirms whether the failing writes are the >64 KB ones and identifies which keys, so we can target follow-up work (e.g. chunking specific large collections).

Net effect: log volume drops from ~6× to ~2× per failure, with zero lost successful writes (retries weren't succeeding anyway).

CAPACITY was considered and rejected (no disk pressure to relieve; eviction would delete cached user data for a Chromium engine fault). FATAL/TRANSIENT were rejected (they trigger wasteful DB reopens). INVALID_DATA was rejected (it throws).

⚠️ Note: this stops Onyx from amplifying and silently losing on the error; it does not fix the underlying Chromium blob-write failure (browser-side). The instrumentation is intended to gather the key/size data needed to decide the deeper fix.

Related Issues

Expensify/App#87871

Linked E/App PR

Test branch pinning E/App to this PR's HEAD: callstack-internal/Expensify-App@eliran/2397-idb-blob-write-errors-test (onyx pinned to git+https://github.com/callstack-internal/react-native-onyx.git#9b9aba708a408af226563deff6add1e6035e9ea0). E/App PR: Expensify/App#95586

Automated Tests

Added tests/unit/storage/providers/classifyIDBErrorTest.ts covering classifyIDBError:

• Failed to write blobs (IOError) → UNRECOVERABLE
• Failed to write blobs (InvalidBlob) → UNRECOVERABLE
• QuotaExceededError → CAPACITY
• internal error opening backing store → FATAL
• unrecognized error → UNKNOWN

Manual Tests

The underlying Chromium blob-write failure can't be reliably reproduced on demand, so verify the classification/handling behavior:

1. In a web build, force the classifier to see the error (e.g. temporarily throw new DOMException('Failed to write blobs (IOError)', 'DataError') from an IDB write, or unit-simulate via classifyIDBError).
2. Confirm the operation is not retried 5× — you should see a single Storage operation skipped retry; unrecoverable errors cannot be recovered by retrying … log line, followed by the pairs: … over64KB: … largest: […] payload summary.
3. Confirm no Attempted to set invalid data … throw, no eviction, and no IDB heal … reopen logs for this error.
4. Confirm normal (small, successful) writes are unaffected.

Author Checklist

• I linked the correct issue in the ### Related Issues section above
• I linked the corresponding Expensify/App PR in the ### Linked E/App PR section above, and verified this change against it (E/App CI passed and manual testing completed)
• I wrote clear testing steps that cover the changes made in this PR
  • I added steps for local testing in the Tests section
  • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
• I included screenshots or videos for tests on all platforms
• I ran the tests on all platforms & verified they passed on:
  • Android / native
  • Android / Chrome
  • iOS / native
  • iOS / Safari
  • MacOS / Chrome / Safari
• I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
• I followed proper code patterns (see Reviewing the code)
  • I verified that any callback methods that were added or modified are named for what the method does and never what callback they handle (i.e. toggleReport and not onIconClick)
  • I verified that the left part of a conditional rendering a React component is a boolean and NOT a string, e.g. myBool && <MyComponent />.
  • I verified that comments were added to code that is not self explanatory
  • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
  • I verified proper file naming conventions were followed for any new files or renamed files. All non-platform specific files are named after what they export and are not named "index.js". All platform-specific files are named for the platform the code supports as outlined in the README.
  • I verified the JSDocs style guidelines (in STYLE.md) were followed
• If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
• I followed the guidelines as stated in the Review Guidelines
• I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
• I verified all code is DRY (the PR doesn't include any logic written more than once, with the exception of tests)
• I verified any variables that can be defined as constants (ie. in CONST.js or at the top of the file that uses the constant) are defined as such
• I verified that if a function's arguments changed that all usages have also been updated correctly
• If a new component is created I verified that:
  • A similar component doesn't exist in the codebase
  • All props are defined accurately and each prop has a /** comment above it */
  • The file is named correctly
  • The component has a clear name that is non-ambiguous and the purpose of the component can be inferred from the name alone
  • The only data being stored in the state is data necessary for rendering and nothing else
  • If we are not using the full Onyx data that we loaded, I've added the proper selector in order to ensure the component only re-renders when the data it is using changes
  • For Class Components, any internal methods passed to components event handlers are bound to this properly so there are no scoping issues (i.e. for onClick={this.submit} the method this.submit should be bound to this in the constructor)
  • Any internal methods bound to this are necessary to be bound (i.e. avoid this.submit = this.submit.bind(this); if this.submit is never passed to a component event handler like onClick)
  • All JSX used for rendering exists in the render method
  • The component has the minimum amount of code necessary for its purpose, and it is broken down into smaller components in order to separate concerns and functions
• If any new file was added I verified that:
  • The file has a description of what it does and/or why is needed at the top of the file if the code is not self explanatory
• If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
• If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.
• I have checked off every checkbox in the PR author checklist, including those that don't apply to this PR.

Screenshots/Videos

Android: Native

Android: mWeb Chrome

iOS: Native

iOS: mWeb Safari

MacOS: Chrome / Safari