Improve RealContentScopeScripts.getScript()

[anikiki]

Task/Issue URL: https://app.asana.com/1/137249556945/project/1200581511062568/task/1216821003646786?focus=true
Tech Design URL (if applicable):
API Proposals URL(s) (if applicable):

Description

Reduces the per-navigation cost of getScript() without changing its output, behind the optimizeContentScopeInjection kill-switch (DefaultFeatureValue.INTERNAL). Every input is still read on every call, so nothing can go stale — the savings are all downstream, in skipping work whose inputs didn't change and doing the rest more cheaply.

Optimized path:

• Plugin config() and preferences() accumulate into StringBuilders instead of reassigning a String per plugin, which copied the whole accumulator each time — quadratic in the assembled config size, across ~22 plugins, on the main thread.
• The contentScope JSON is rebuilt only when the assembled config or the exception list actually changed, reusing the already-serialized exceptions instead of re-serializing and re-comparing per call.
• runBlocking is skipped entirely when no contentScope experiment is active — getActiveExperiments() returns only enabled toggles, so the result is then a constant.
• Toggle.getCohort() is called once per toggle instead of twice; it can enrol to self-heal a stale cohort, so the second call wasn't a free read.
• The feature flag is read once per call rather than at each use site, so a flag flip can't mix the two paths mid-call.
• Messaging parameters and the version/platform constants are assembled once, and the messaging parameters are embedded when building the preferences JSON instead of being substituted from a placeholder during assembly.

An earlier revision cached the assembled plugin config and invalidated it on privacy-config persistence.
That was removed: a feature repo that hasn't finished its async load reports its default JSON rather than an
empty string, so the startup stabilisation latch could settle on defaults and serve them for the rest of the
process.

Deliberately unchanged: allow list, unprotected temporary, plugin config() and preferences(), cohorts and
desktop mode are evaluated on every call, so config-driven and user-facing settings (GPC, forced zoom,
allowlisting) apply immediately.

Rollback: with the flag off, every call runs optimized = false end to end through the original helpers —
throwaway Moshi instances, the original quadratic parameter assembly, the original cohort filter/map, and the
chained-replace assembly. The legacy path is byte-and-behaviour identical to before and is deleted with the
flag once rollout completes. whenOptimizeInjectionEnabledThenOutputIsByteIdenticalToFallbackPath compares
the two paths in full, and two further tests pin the freeze via the per-flag getCohort() and
appBuildConfig read counts.

Steps to test this PR

• Tests are passing.

flag ON (default on internal)

• Fresh install, browse several pages in a row, confirm protections stay applied.
• Override the privacy config from dev settings, confirm a config-driven change takes effect.
• Toggle GPC in Settings, reload, confirm globalPrivacyControlValue takes effect (sec-gpc: 1 is not
  sent when GPC is off).
• Toggle Accessibility → force zoom, reload, confirm behaviour changes.
• Tap the shield to allowlist a site, confirm protections drop, then re-protect it.
• Switch to desktop site and confirm the change is reflected.

Rollback is clean

• Turn the flag OFF, restart, repeat the above. Behaviour must be identical to develop.
• Flip it back ON without restarting, load a page, confirm protections are still correct.

NO UI changes

---

Note

Medium Risk
Changes how often privacy-config-driven script JSON is rebuilt and when plugin config updates apply (persist vs startup latch), which could affect protection behavior if invalidation or settling logic is wrong; legacy path preserved behind a kill-switch.

Overview
Adds an optimized getScript() path behind optimizeContentScopeInjection, while keeping the prior logic as getLegacyScript() for rollback.

Caching & invalidation: Assembled plugin config() is cached and only rebuilt when onPrivacyConfigPersisted() sets pluginConfigNeedsRebuild, or during startup until the config stabilizes (empty configs never latch). RealContentScopeScripts now implements PrivacyConfigCallbackPlugin; onPrivacyConfigDownloaded() is intentionally a no-op.

Per-call work: Allow list, plugin preferences(), desktop mode, and cohorts still update every navigation. Content-scope JSON is rebuilt only when cached plugin config or unprotected-temporary exceptions change. Messaging secrets, version/platform strings, reusable Moshi adapters, and single-pass template assembly are reused on the optimized path; cohort reads go from two getCohort() calls to one per toggle.

Flag behavior: Mid-session flag flips route entirely through one path; legacy sets pluginConfigNeedsRebuild so switching back to optimized does not resurrect stale plugin config.

^{Reviewed by Cursor Bugbot for commit 1d54e28. Bugbot is set up for automated code reviews on this repo. Configure here.}

[anikiki]

• Stop resolving contentScope experiments on every navigation #9351
• Move ContentScopeScripts inbound JS messages off the JavaBridge thread #9350
• Drop defensive CopyOnWriteArrayList from the optimized RealContentScopeScripts #9347
• Improve RealContentScopeScripts.getScript() #9335 👈 (View in Graphite)
• develop

This stack of pull requests is managed by Graphite. Learn more about stacking.