What broke

A headless Anki client bootstrapped an empty collection by logging in and calling the official package's download method. The implementation did not first resolve the hosted service's collection shard. The download failed before any notes arrived.

How it showed

The hosted request returned HttpError { code: 400, context: "missing original size", source: None }. Login had succeeded. The same package and download wrapper had worked against a local sync server.

What was watching

Integration tests used the real package and its bundled sync server. They checked bootstrap, incremental sync, and preservation of a second client's review history. That server had no hosted shard redirect to exercise. The operator observed the error on the first authorized bootstrap against the hosted service.

Where it sits

This runtime failure crossed a routing boundary absent from the local stand-in. Integration tests were present but did not cover that boundary. A contract test now checks propagation of the endpoint from the handshake to the download call.

What we did

Bootstrap now performs the sync handshake and copies its returned endpoint into the authentication object before downloading. The direction remains a literal download-only argument. The hosted bootstrap then completed through the official package without a custom HTTP fallback or full upload. A separate report describes the same error and includes an unused shard endpoint in its reproduction.

What now fails loudly

The contract test supplies an endpoint in the handshake response and records the subsequent download arguments. It requires that endpoint and a false upload flag. Removing endpoint propagation makes the assertion fail. The integration tests continue to exercise the local server and review-preservation path.