Harden watch sync and App Group storage

Shared/FuelStore.swift

@@ -419,13 +419,37 @@ struct FuelStore {
     static let watchRefreshHandledKey = "fuelboard.watchRefreshHandled" // TimeInterval (seconds since 1970)
     static let relaySourceKey = "fuelboard.relaySource"      // String — "api" | "csv"
     static let stationCountKey = "fuelboard.stationCount"    // String — station count
-    static let dataUpdatedKey = "fuelboard.dataUpdated"      // String — govUK dataset update time
+    static let dataUpdatedKey = "fuelboard.dataUpdated"      // govUK dataset update time
+
+    // Large shared payloads belong in the App Group container, not
+    // UserDefaults/CFPreferences (which has a roughly 4 MB limit).
+    static let stationsFileName = "fuelboard.stations.json"
+
+    static func appGroupFileURL(_ name: String) -> URL? {
+        FileManager.default
+            .containerURL(forSecurityApplicationGroupIdentifier: appGroupSuite)?
+            .appendingPathComponent(name, isDirectory: false)
+    }
+
+    static func loadAppGroupFile(_ name: String) -> Data? {
+        guard let url = appGroupFileURL(name) else { return nil }
+        return try? Data(contentsOf: url)
+    }
+
+    @discardableResult
+    static func saveAppGroupFile(_ data: Data, name: String) -> Bool {
+        guard let url = appGroupFileURL(name) else { return false }
+        do {
+            try data.write(to: url, options: .atomic)
+            return true
+        } catch {
+            return false
+        }
+    }
 
     // MARK: Stations
-    // The full-UK dataset (~2.9 MB) lives in app-group UserDefaults only —
-    // keychain is for small values and cannot hold it. Read order is
-    // defaults-first for stations (keychain may hold a legacy small set from
-    // older builds; the full country dump always wins).
+    // The full-UK dataset is stored as an App Group file. UserDefaults is
+    // reserved for small preferences and has a roughly 4 MB total limit.
 
     /// Stations from `stations` tied with `price` for `fuel` (within 0.01p),
     /// sorted nearest-first from `lat`/`lng`. Used to offer multiple
@@ -444,10 +468,19 @@ struct FuelStore {
     }
 
     static func loadStations() -> [FuelStation] {
+        if let data = loadAppGroupFile(stationsFileName),
+           let stations = try? JSONDecoder().decode([FuelStation].self, from: data),
+           !stations.isEmpty {
+            return stations.map(sanitized)
+        }
+        // Migrate the legacy App Group UserDefaults value once.
         if let defaults = UserDefaults(suiteName: appGroupSuite),
            let data = defaults.data(forKey: stationsKey),
            let stations = try? JSONDecoder().decode([FuelStation].self, from: data),
            !stations.isEmpty {
+            if saveAppGroupFile(data, name: stationsFileName) {
+                defaults.removeObject(forKey: stationsKey)
+            }
             return stations.map(sanitized)
         }
         if let data = keychainData(service: stationsKey),
@@ -468,8 +501,7 @@ struct FuelStore {
 
     static func saveStations(_ stations: [FuelStation]) {
         if let data = try? JSONEncoder().encode(stations) {
-            UserDefaults(suiteName: appGroupSuite)?.set(data, forKey: stationsKey)
-            // Intentionally NOT written to keychain — 2.9 MB exceeds its limits.
+            _ = saveAppGroupFile(data, name: stationsFileName)
         }
     }
 

Shared/MirrorFuelProvider.swift

@@ -37,10 +37,11 @@ struct MirrorFuelProvider: FuelPriceProviding {
     /// surfaced via `LiveChainProvider.latestMeta` in Settings → About.
     static var latestMeta: RelayMeta?
 
-    /// App-group cache of the last fetched FULL dump, keyed by snapshot day.
+    /// App-group file cache of the last fetched FULL dump, keyed by snapshot day.
     /// The mirror pushes once/day, so between pushes the app reuses the
     /// cached dump instead of re-downloading ~2.8 MB at every 12 h gate.
     static let liveDumpCacheKey = "fuelboard.liveDumpCache"
+    static let liveDumpCacheFileName = "fuelboard.liveDumpCache.json"
 
     struct DumpCache: Codable {
         let day: String
@@ -48,18 +49,26 @@ struct MirrorFuelProvider: FuelPriceProviding {
     }
 
     static func loadDumpCache() -> DumpCache? {
+        if let raw = FuelStore.loadAppGroupFile(liveDumpCacheFileName),
+           let cache = try? JSONDecoder().decode(DumpCache.self, from: raw) {
+            return cache
+        }
+
+        // Migrate the legacy UserDefaults cache when present.
         guard let defaults = UserDefaults(suiteName: FuelStore.appGroupSuite),
               let raw = defaults.data(forKey: liveDumpCacheKey),
               let cache = try? JSONDecoder().decode(DumpCache.self, from: raw) else {
             return nil
         }
+        if FuelStore.saveAppGroupFile(raw, name: liveDumpCacheFileName) {
+            defaults.removeObject(forKey: liveDumpCacheKey)
+        }
         return cache
     }
 
     static func saveDumpCache(day: String, data: Data) {
-        guard let defaults = UserDefaults(suiteName: FuelStore.appGroupSuite),
-              let raw = try? JSONEncoder().encode(DumpCache(day: day, data: data)) else { return }
-        defaults.set(raw, forKey: liveDumpCacheKey)
+        guard let raw = try? JSONEncoder().encode(DumpCache(day: day, data: data)) else { return }
+        _ = FuelStore.saveAppGroupFile(raw, name: liveDumpCacheFileName)
     }
 
     /// True when the cached dump is already the freshest the mirror has —