@advenue/react-native 1.0.1 → 1.1.1

package/ios/vendor/Advenue/Advenue.swift

@@ -129,14 +129,11 @@ public enum Advenue {
   /// is empty or a backoff window is open.
   public static func flush() { state.submit(.flush) }
 
-  public static func notifyForeground() { state.submit(.foreground) }
+  public static func notifyForeground() { state.notifyForeground() }
 
   /// Backgrounding both closes the session and flushes: a batch stranded at the
   /// moment the app leaves the foreground may not be sent for hours.
-  public static func notifyBackground() {
-    state.submit(.background)
-    state.submit(.flush)
-  }
+  public static func notifyBackground() { state.notifyBackground() }
 
   /// Presents the ATT prompt. The app decides when; the SDK never prompts on
   /// its own.
@@ -167,10 +164,14 @@ final class AcceptedAppId: @unchecked Sendable {
     return value
   }
 
-  func set(_ appId: String) {
+  /// True the first time this app id is seen.
+  @discardableResult
+  func set(_ appId: String) -> Bool {
     lock.lock()
+    defer { lock.unlock() }
+    let changed = value != appId
     value = appId
-    lock.unlock()
+    return changed
   }
 }
 
@@ -209,17 +210,21 @@ final class FacadeState: @unchecked Sendable {
     transport: (any EventTransport)? = nil,
     sources: EnrichmentSources? = nil,
     skan skanReporter: (any SkanReporter)? = nil,
-    appVersion readVersion: () -> String? = readAppVersion
+    appVersion readVersion: () -> String? = readAppVersion,
+    launchedInBackground: () -> Bool = readLaunchedInBackground,
+    logSink: (any AdvenueLogSink)? = nil
   ) {
     // Replace-and-shut-down, never add.
     stop()
 
+    // `debug`: every swallowed failure goes through onError, so logging there
+    // covers all of them — wrapped once, before anything below captures it.
+    let (config, log) = withDebugLogging(config, sink: logSink)
+
     // The SDK resolves the app version itself (readAppVersion); a config value
     // is ignored — and said so, rather than looking like it took effect.
     if config.appVersion != nil {
-      config.onError(
-        "config.ignored:appVersion",
-        IngestError(status: 0))
+      config.onError("config.ignored:appVersion", AdvenueSetupError.appVersionIgnored)
     }
 
     // B4: kuyruk blob'u Caches dosyalarına (yedek dışı); UserDefaults'ta
@@ -230,7 +235,7 @@ final class FacadeState: @unchecked Sendable {
       store = CompositeStore(files: files)
     } else {
       store = UserDefaultsStore()
-      config.onError("store.cache_unavailable", IngestError(status: 0))
+      config.onError("store.cache_unavailable", AdvenueSetupError.cacheUnavailable)
     }
     let secure = KeychainStore()
     let uuid = SystemUUIDs()
@@ -240,7 +245,7 @@ final class FacadeState: @unchecked Sendable {
       // Deferred: the Keychain could not be read. Nothing is minted and
       // nothing starts, so no event carries an invented identifier. The next
       // launch after first unlock resolves it.
-      config.onError("identity.deferred", IngestError(status: 0))
+      config.onError("identity.deferred", AdvenueSetupError.identityDeferred)
       return
     }
 
@@ -251,14 +256,19 @@ final class FacadeState: @unchecked Sendable {
       osVersion = nil
     #endif
 
-    let eventTransport =
+    let baseTransport =
       transport
       ?? HttpTransport(
         endpoint: config.endpoint, apiKey: config.apiKey,
         signingSecret: config.signingSecret,
         // Diagnostics only: it runs after the batch is already accepted, so
         // nothing it does can turn a successful ingest into a failure.
-        onAccepted: { [acceptedAppId] appId in acceptedAppId.set(appId) })
+        onAccepted: { [acceptedAppId] appId in
+          // A key pasted from the wrong app is otherwise silent.
+          if acceptedAppId.set(appId) { log("[Advenue] ingesting into app \(appId)") }
+        })
+    let eventTransport: any EventTransport =
+      config.debug ? LoggingTransport(inner: baseTransport, log: log) : baseTransport
 
     let engine = AdvenueEngine(
       config: EngineConfig(
@@ -267,7 +277,7 @@ final class FacadeState: @unchecked Sendable {
         osVersion: osVersion,
         sdkVersion: String((config.sdkVersion ?? AdvenueVersion.current).prefix(32)),
         requireConsent: config.requireConsent, sessionWindowMs: config.sessionWindowMs,
-        batchSize: config.batchSize),
+        batchSize: config.batchSize, piiScrubEnabled: config.piiScrubEnabled),
       store: store, clock: SystemClock(), scheduler: TimerScheduler(), uuid: uuid,
       transport: eventTransport,
       onError: config.onError)
@@ -330,13 +340,32 @@ final class FacadeState: @unchecked Sendable {
     pendingDeepLinks = []
     lock.unlock()
 
+    // Before anything else is recorded: a launch that still owes its install
+    // stamps it now and holds every flush until the install is enqueued, so
+    // the server never sees this launch's session or events ahead of it. The
+    // hold outlives the enrichment deadline by a margin and then lapses.
+    pipe.submit(.beginInstall(holdMs: INSTALL_WINDOW_MS + INSTALL_HOLD_MARGIN_MS))
+
     // Replayed in arrival order, before the first session, so a deferred deep
     // link is attributed to the launch it belongs to.
     for url in buffered { send(url) }
-    pipe.submit(.foreground)
+    // A launch into the background (fetch, silent push, location) is not a
+    // session: the first didBecomeActive opens it instead. iOS posts no
+    // didEnterBackground for an app that never left the background, so a
+    // tracker seeded as foregrounded would swallow the user's real open.
+    let inForeground = !launchedInBackground()
+    if inForeground { pipe.submit(.foreground) }
     // Seeded to match: the line above IS this launch's foreground, so the
     // activation notification that follows must not open a second session.
-    observeLifecycle(seededInForeground: true)
+    observeLifecycle(seededInForeground: inForeground)
+
+    log(
+      "[Advenue] initialized — endpoint \(config.endpoint), "
+        + "sdk \(config.sdkVersion ?? AdvenueVersion.current), "
+        // Not "background launch": a scene-based (SwiftUI) app is still
+        // reported in the background during didFinishLaunching even when the
+        // user opened it. Either way the session opens on activation.
+        + (inForeground ? "launched active" : "not active yet, the session opens on activation"))
 
     if config.flushIntervalMs > 0 {
       let timer = DispatchSource.makeTimerSource(queue: .global(qos: .utility))
@@ -593,6 +622,12 @@ final class FacadeState: @unchecked Sendable {
     #endif
   }
 
+  /// The public lifecycle calls go through the same tracker as UIKit's signals,
+  /// so one forwarded while already foregrounded (or already backgrounded) is a
+  /// no-op instead of a session split.
+  func notifyForeground() { handle(.didBecomeActive) }
+  func notifyBackground() { handle(.didEnterBackground) }
+
   /// Applies one lifecycle signal. Public routing lives here rather than in the
   /// observer closure so a test can drive it without UIKit.
   func handle(_ signal: LifecycleSignal) {

package/ios/vendor/Advenue/AdvenueConfig.swift

@@ -8,7 +8,7 @@ public struct AdvenueConfig: Sendable {
   public var appVersion: String?
   public var requireConsent: Bool
   public var sessionWindowMs: Int64
-  /// Events per request. Matches sdk-core.
+  /// Events per request. Matches the other SDKs.
   public var batchSize: Int
   /// Auto-flush period. Zero disables the timer, which is what tests want and
   /// no shipping app does.
@@ -29,6 +29,16 @@ public struct AdvenueConfig: Sendable {
   /// Called when the SDK swallows a best-effort failure. Never receives PII.
   public var onError: @Sendable (String, any Error) -> Void
 
+  /// Development aid: logs the SDK's start, every failure `onError` sees and
+  /// each accepted batch to the unified log (subsystem `io.advenue.sdk`) —
+  /// Xcode's console and Console.app. Never logs an identifier or a payload.
+  /// Leave off in production; route failures through `onError` instead.
+  public var debug: Bool
+
+  /// B1: track/install properties PII scrub. On by default; disable only
+  /// explicitly (documented risk — raw PII reaches ingest). Same as Android.
+  public var piiScrubEnabled: Bool
+
   /// Overrides the version stamped on every event. Set by a WRAPPER SDK, never
   /// by an app.
   ///
@@ -61,7 +71,9 @@ public struct AdvenueConfig: Sendable {
     conversionValues: ConversionValueConfig? = nil,
     onError: @escaping @Sendable (String, any Error) -> Void = { _, _ in },
     sdkVersion: String? = nil,
-    allowInsecureHttp: Bool = false
+    allowInsecureHttp: Bool = false,
+    debug: Bool = false,
+    piiScrubEnabled: Bool = true
   ) {
     precondition(
       allowInsecureHttp || Self.isSecureEndpoint(endpoint),
@@ -70,6 +82,7 @@ public struct AdvenueConfig: Sendable {
     self.endpoint = endpoint
     self.appVersion = appVersion
     self.requireConsent = requireConsent
+    self.debug = debug
     self.sessionWindowMs = sessionWindowMs
     self.batchSize = batchSize
     self.flushIntervalMs = flushIntervalMs
@@ -77,6 +90,7 @@ public struct AdvenueConfig: Sendable {
     self.conversionValues = conversionValues
     self.onError = onError
     self.sdkVersion = sdkVersion
+    self.piiScrubEnabled = piiScrubEnabled
   }
 }
 
@@ -85,5 +99,5 @@ public struct AdvenueConfig: Sendable {
 /// release tag unless something checks. CI does, because the first question
 /// every field report raises is which build produced the event.
 public enum AdvenueVersion {
-  public static let current = "1.0.0"
+  public static let current = "1.1.0"
 }

package/ios/vendor/Advenue/AdvenueSetupError.swift

@@ -0,0 +1,24 @@
+/// A condition met while starting the SDK, reported through `onError` under
+/// the context in parentheses. Not a transport failure — these used to arrive
+/// as `IngestError(status: 0)`, which read as an HTTP error that never
+/// happened and named no cause.
+public enum AdvenueSetupError: Error, Equatable, Sendable, CustomStringConvertible {
+  /// `config.ignored:appVersion`
+  case appVersionIgnored
+  /// `store.cache_unavailable`
+  case cacheUnavailable
+  /// `identity.deferred`
+  case identityDeferred
+
+  public var description: String {
+    switch self {
+    case .appVersionIgnored:
+      return "appVersion is read from the bundle; the config value has no effect"
+    case .cacheUnavailable:
+      return "the Caches directory is unavailable; the event queue falls back to UserDefaults"
+    case .identityDeferred:
+      return "the Keychain is unavailable (not unlocked since boot, or the app is not "
+        + "code-signed); nothing starts until the next launch that can read it"
+    }
+  }
+}

package/ios/vendor/Advenue/DebugLog.swift

@@ -0,0 +1,46 @@
+import Foundation
+import os
+
+/// Where `AdvenueConfig.debug` writes. The unified logging system in an app;
+/// a recorder in tests.
+protocol AdvenueLogSink: Sendable {
+  func log(_ message: String)
+}
+
+/// `os.Logger`, public privacy: the lines carry failure contexts, counts and
+/// the app id the server resolved — never an identifier or a payload — and a
+/// debug aid that Console.app shows as `<private>` would not be one.
+struct UnifiedLogSink: AdvenueLogSink {
+  private let logger = Logger(subsystem: "io.advenue.sdk", category: "Advenue")
+  func log(_ message: String) {
+    logger.notice("\(message, privacy: .public)")
+  }
+}
+
+/// Logs each accepted batch; failures already reach the log through the
+/// wrapped `onError` (`flush.transport`, `flush.poison`).
+struct LoggingTransport: EventTransport {
+  let inner: any EventTransport
+  let log: @Sendable (String) -> Void
+
+  func send(_ events: [ClientEvent]) async throws {
+    try await inner.send(events)
+    log("[Advenue] sent \(events.count) event(s)")
+  }
+}
+
+/// With `debug` on: the config with `onError` also writing to the log, and the
+/// log itself. Off: the config unchanged and a log that discards.
+func withDebugLogging(
+  _ config: AdvenueConfig, sink: (any AdvenueLogSink)?
+) -> (AdvenueConfig, @Sendable (String) -> Void) {
+  guard config.debug else { return (config, { _ in }) }
+  let sink = sink ?? UnifiedLogSink()
+  var logged = config
+  let report = config.onError
+  logged.onError = { context, error in
+    sink.log("[Advenue] \(context): \(error)")
+    report(context, error)
+  }
+  return (logged, { sink.log($0) })
+}

package/ios/vendor/AdvenueCore/Backoff.swift

@@ -3,9 +3,23 @@ import Foundation
 /// A non-2xx ingest response. `isRetryable` separates a transient failure from
 /// a poison payload: retrying a 400 forever would block the queue head, and
 /// dropping a 429 would discard events over a throttle.
-public struct IngestError: Error, Equatable, Sendable {
+public struct IngestError: Error, Equatable, Sendable, CustomStringConvertible {
   public let status: Int
-  public init(status: Int) { self.status = status }
+  /// Set when no response arrived at all — DNS, refused connection, timeout,
+  /// no network. `status` is then 408 so the backoff retries it, but that 408
+  /// was never sent by a server, and logging it as one sends whoever debugs it
+  /// looking at the wrong end (F-SDK-10).
+  public let networkCause: String?
+
+  public init(status: Int, networkCause: String? = nil) {
+    self.status = status
+    self.networkCause = networkCause
+  }
+
+  public var description: String {
+    if let networkCause { return "IngestError: no response (network error: \(networkCause))" }
+    return "IngestError(status: \(status))"
+  }
 
   public var isRetryable: Bool {
     status == 408 || status == 429 || status >= 500

package/ios/vendor/AdvenueCore/Engine.swift

@@ -94,6 +94,14 @@ public actor AdvenueEngine {
     attestation: AttestationResult?, challenge: String?)?
   private var skan: SkanStateMachine?
   private var skanReporter: (any SkanReporter)?
+  /// F-SDK-3: when this launch began an install that is not recorded yet.
+  /// The install is stamped with it — the first open, not the moment the
+  /// enrichment that preceded it finished.
+  private var installStartedAtMs: Int64?
+  /// Flushes are held until the install is enqueued, so nothing reaches the
+  /// server ahead of it. Bounded: past this instant the hold lapses, because a
+  /// lost enrichment task must never strand the queue.
+  private var installHoldUntilMs: Int64?
   private var flushing = false
   private var consecutiveFailures = 0
   private var backoffUntilMs: Int64 = 0
@@ -159,6 +167,9 @@ public actor AdvenueEngine {
     }
     event.properties = config.piiScrubEnabled ? PIIScrub.scrub(properties) : properties
     queue.enqueue(event)
+    // An event is proof of life: a relaunch after an OS kill measures the gap
+    // from the last one (F-SDK-7).
+    sessions.heartbeat()
     return true
   }
 
@@ -186,6 +197,30 @@ public actor AdvenueEngine {
     appInstanceId = id
   }
 
+  /// Marks the start of a launch that still owes its install. Called by the
+  /// platform layer BEFORE the launch's foreground, while enrichment (ATT,
+  /// AdServices, attestation) runs. Adjust and AppsFlyer both hold every later
+  /// package behind the first one; this does the same, for at most `holdMs`.
+  public func beginInstall(holdMs: Int) {
+    guard !forgotten, store.string(forKey: INSTALL_SENT_KEY) != "1" else { return }
+    let now = clock.nowMs()
+    installStartedAtMs = now
+    installHoldUntilMs = now + Int64(holdMs)
+  }
+
+  /// Whether a pending install still holds flushes back.
+  private func heldForInstall() -> Bool {
+    guard let until = installHoldUntilMs else { return false }
+    if clock.nowMs() < until { return true }
+    installHoldUntilMs = nil
+    return false
+  }
+
+  private func releaseInstallHold() {
+    installStartedAtMs = nil
+    installHoldUntilMs = nil
+  }
+
   /// The first-open event, at most once per installation. Returns whether it
   /// was recorded.
   ///
@@ -202,13 +237,21 @@ public actor AdvenueEngine {
     if forgotten { return false }
     if config.requireConsent && !consent {
       installDeferred = (adservicesToken, properties, attestation, attestationChallenge)
+      // Deferred possibly for good: the events consent does allow must not
+      // wait on it. Released on consent, the install is stamped then.
+      releaseInstallHold()
       return false
     }
-    if store.string(forKey: INSTALL_SENT_KEY) == "1" { return false }
+    if store.string(forKey: INSTALL_SENT_KEY) == "1" {
+      releaseInstallHold()
+      return false
+    }
+    let installedAtMs = installStartedAtMs ?? clock.nowMs()
+    releaseInstallHold()
 
     var event = ClientEvent(
       id: uuid.next(), deviceId: config.deviceId, type: "install", name: "install",
-      timestamp: EventEncoding.iso8601(ms: clock.nowMs()), platform: config.platform)
+      timestamp: EventEncoding.iso8601(ms: installedAtMs), platform: config.platform)
     event.installationId = config.installationId
     event.appVersion = config.appVersion
     event.osVersion = config.osVersion
@@ -241,7 +284,9 @@ public actor AdvenueEngine {
       merged = properties
     }
     event.properties = config.piiScrubEnabled ? PIIScrub.scrub(merged) : merged
-    queue.enqueue(event)
+    // At the head: the session and custom events recorded while enrichment ran
+    // are already queued, and the install must reach the server before them.
+    queue.enqueueFirst(event)
 
     store.set("1", forKey: INSTALL_SENT_KEY)
     return true
@@ -377,6 +422,7 @@ public actor AdvenueEngine {
   /// behind, which is an erasure that does not erase (spec §5).
   public func forgetMe() {
     forgotten = true
+    releaseInstallHold()
     queue.clear()
     sessions.reset()
     consent = false
@@ -421,8 +467,13 @@ public actor AdvenueEngine {
   /// throws — a timer-driven call is unawaited, so a transient failure simply
   /// leaves the batch buffered for the next attempt.
   public func flush() async {
+    // The auto-flush timer is the foreground tick: it keeps the open
+    // sub-session's last activity fresh even when the app records nothing.
+    if !forgotten { sessions.heartbeat() }
     guard let transport else { return }
-    if flushing || queue.size == 0 || clock.nowMs() < backoffUntilMs { return }
+    if flushing || queue.size == 0 || clock.nowMs() < backoffUntilMs || heldForInstall() {
+      return
+    }
     flushing = true
     defer { flushing = false }
 
@@ -506,6 +557,7 @@ public enum Command: Sendable {
     reporter: any SkanReporter, configVersion: Int)
   case trackInstall(
     adservicesToken: String?, attestation: AttestationResult?, attestationChallenge: String?)
+  case beginInstall(holdMs: Int)
 }
 
 /// The ordered ingress: a synchronous, non-blocking `submit` feeding one
@@ -567,6 +619,8 @@ public final class CommandPipe: @unchecked Sendable {
         limitAdTracking: limitAdTracking)
     case .setAppInstanceId(let id):
       await engine.setAppInstanceId(id)
+    case .beginInstall(let holdMs):
+      await engine.beginInstall(holdMs: holdMs)
     case .trackInstall(let token, let attestation, let challenge):
       await engine.trackInstall(
         adservicesToken: token, attestation: attestation, attestationChallenge: challenge)

package/ios/vendor/AdvenueCore/EventQueue.swift

@@ -49,6 +49,18 @@ public final class EventQueue {
     schedulePersist()
   }
 
+  /// Puts an event at the HEAD of the queue — the install, which is the first
+  /// package of an installation and must not be preceded by the session and
+  /// custom events recorded while enrichment ran. Over the cap, the oldest
+  /// events behind it are dropped, never the event just placed.
+  public func enqueueFirst(_ event: ClientEvent) {
+    events.insert(event, at: 0)
+    if events.count > maxSize {
+      events.removeSubrange(1..<(1 + events.count - maxSize))
+    }
+    schedulePersist()
+  }
+
   public func peek(_ max: Int) -> [ClientEvent] {
     Array(events.prefix(max))
   }

package/ios/vendor/AdvenueCore/SessionTracker.swift

@@ -2,6 +2,9 @@ import Foundation
 
 public let SESSION_STATE_KEY = "advenue.session"
 public let DEFAULT_SESSION_WINDOW_MS: Int64 = 1_800_000  // 30 minutes
+/// The heartbeat persists at most this often: it runs on every recorded event,
+/// and a chatty app must not turn that into a storage write per event.
+public let SESSION_HEARTBEAT_MIN_INTERVAL_MS: Int64 = 1_000
 
 /// A session lifecycle event. Values are numbers, strings and bools only.
 public struct SessionEvent: Equatable, Sendable {
@@ -20,6 +23,10 @@ struct SessionState: Codable {
   var activeStart: Int64?
   var firstForegroundAt: Int64
   var timeSpentMs: Int64
+  /// The last moment the open sub-session was known to be alive (F-SDK-7).
+  /// Absent in state written before it existed, which reads as "alive at
+  /// activeStart".
+  var lastActiveAt: Int64?
 }
 
 /// Platform-agnostic session state machine. Pure: it persists state and
@@ -30,6 +37,11 @@ public final class SessionTracker {
   private let clock: Clock
   private let windowMs: Int64
   private let uuid: UUIDSource
+  /// True once THIS process opened the current sub-session (X-SDK-1). Never
+  /// persisted: a relaunched process starts false, so its tracks and flushes
+  /// before `handleForeground()` cannot keep the dead process's sub-session
+  /// alive and move its kill time to the relaunch.
+  private var ownsOpenSubSession = false
 
   public init(store: KeyValueStore, clock: Clock, windowMs: Int64, uuid: UUIDSource) {
     self.store = store
@@ -40,7 +52,10 @@ public final class SessionTracker {
 
   /// Drops the in-memory cache so a wiped store cannot be resurrected by a
   /// later lifecycle call (GDPR erasure).
-  public func reset() { cached = nil }
+  public func reset() {
+    cached = nil
+    ownsOpenSubSession = false
+  }
 
   private func load() -> SessionState? {
     if let cached { return cached }
@@ -58,14 +73,67 @@ public final class SessionTracker {
     store.set(String(decoding: data, as: UTF8.self), forKey: SESSION_STATE_KEY)
   }
 
-  /// Foreground transition, including cold start. Returns the events to emit:
-  /// none for a sub-session, one `session_start` for a new session, or a
-  /// synthetic `session_end` FOLLOWED BY the start when the previous session
-  /// was still open — the OS killed the app before it could background. The
-  /// order is load-bearing: a consumer must never see two sessions open.
+  /// Refreshes the open sub-session's last known activity. Called by the
+  /// engine on every recorded event and every flush — the auto-flush timer is
+  /// the foreground tick. It is what a relaunch after an OS kill measures the
+  /// gap from, the role Adjust's `lastActivity` plays.
+  ///
+  /// A no-op until this process has run `handleForeground()`: only the process
+  /// that opened the sub-session may extend it. Otherwise an event or flush in a
+  /// relaunched process (iOS `didFinishLaunching` runs before
+  /// `didBecomeActive`; push and background wakes) would stamp the killed
+  /// sub-session alive "now" and count the dead time as active (X-SDK-1).
+  public func heartbeat() {
+    guard ownsOpenSubSession else { return }
+    guard var state = load(), let activeStart = state.activeStart else { return }
+    let now = clock.nowMs()
+    if now - (state.lastActiveAt ?? activeStart) < SESSION_HEARTBEAT_MIN_INTERVAL_MS { return }
+    state.lastActiveAt = now
+    save(state)
+  }
+
+  /// Foreground transition, including cold start. Returns the events to emit,
+  /// in order:
+  ///
+  /// - a synthetic `session_end` first when a sub-session was still open — the
+  ///   OS killed the app before it could background. It is closed at its last
+  ///   heartbeat, not at the relaunch: the time the app was dead is not active
+  ///   time. A consumer must never see two sessions open, so it comes first.
+  /// - then, measured from the background (or that kill time): nothing for a
+  ///   sub-session inside the window, or a `session_start` for a new session.
+  ///
+  /// A kill is not a session boundary by itself (F-SDK-7). Adjust's rule — a
+  /// new session only after the session interval of inactivity — applies to a
+  /// relaunch exactly as it does to a return from the background.
   public func handleForeground() -> [SessionEvent] {
-    let state = load()
     let now = clock.nowMs()
+    guard var state = load(), let activeStart = state.activeStart else {
+      return resume(after: load(), now: now)
+    }
+
+    let killTime = min(now, max(activeStart, state.lastActiveAt ?? activeStart))
+    let activeMs = max(0, killTime - activeStart)
+    let timeSpentMs = state.timeSpentMs + activeMs
+    let end = SessionEvent(
+      name: "session_end",
+      properties: [
+        "sessionId": .string(state.sessionId),
+        "sessionNumber": .int(state.sessionNumber),
+        "subSession": .int(state.subSessionCount),
+        "activeMs": .int(Int(activeMs)),
+        "timeSpentMs": .int(Int(timeSpentMs)),
+        "sessionLengthMs": .int(Int(max(0, killTime - state.firstForegroundAt))),
+        "synthetic": .bool(true),
+      ])
+    state.lastBackgroundAt = killTime
+    state.activeStart = nil
+    state.lastActiveAt = nil
+    state.timeSpentMs = timeSpentMs
+    return [end] + resume(after: state, now: now)
+  }
+
+  /// The foreground decision once no sub-session is open.
+  private func resume(after state: SessionState?, now: Int64) -> [SessionEvent] {
     let gap: Int64? = state?.lastBackgroundAt.map { now - $0 }
 
     if state == nil || gap == nil || gap! >= windowMs {
@@ -75,40 +143,27 @@ public final class SessionTracker {
         SessionState(
           sessionId: sessionId, sessionNumber: sessionNumber, lastBackgroundAt: nil,
           subSessionCount: 1, activeStart: now, firstForegroundAt: now, timeSpentMs: 0))
+      ownsOpenSubSession = true
 
-      let start = SessionEvent(
-        name: "session_start",
-        properties: [
-          "sessionId": .string(sessionId),
-          "sessionNumber": .int(sessionNumber),
-          "subSession": .int(1),
-          "isFirstSession": .bool(sessionNumber == 1),
-          "timeSinceLastSessionMs": .int(Int(gap ?? 0)),
-        ])
-
-      if let prior = state, let activeStart = prior.activeStart {
-        let killTime = prior.lastBackgroundAt ?? now
-        let activeMs = max(0, killTime - activeStart)
-        let end = SessionEvent(
-          name: "session_end",
+      return [
+        SessionEvent(
+          name: "session_start",
           properties: [
-            "sessionId": .string(prior.sessionId),
-            "sessionNumber": .int(prior.sessionNumber),
-            "subSession": .int(prior.subSessionCount),
-            "activeMs": .int(Int(activeMs)),
-            "timeSpentMs": .int(Int(prior.timeSpentMs + activeMs)),
-            "sessionLengthMs": .int(Int(max(0, killTime - prior.firstForegroundAt))),
-            "synthetic": .bool(true),
+            "sessionId": .string(sessionId),
+            "sessionNumber": .int(sessionNumber),
+            "subSession": .int(1),
+            "isFirstSession": .bool(sessionNumber == 1),
+            "timeSinceLastSessionMs": .int(Int(gap ?? 0)),
           ])
-        return [end, start]
-      }
-      return [start]
+      ]
     }
 
     var updated = state!
     updated.subSessionCount += 1
     updated.activeStart = now
+    updated.lastActiveAt = nil
     save(updated)
+    ownsOpenSubSession = true
     return []
   }
 
@@ -123,8 +178,10 @@ public final class SessionTracker {
     let timeSpentMs = state.timeSpentMs + activeMs
     state.lastBackgroundAt = now
     state.activeStart = nil
+    state.lastActiveAt = nil
     state.timeSpentMs = timeSpentMs
     save(state)
+    ownsOpenSubSession = false
     return SessionEvent(
       name: "session_end",
       properties: [