@bota.dev/react-native-app-sdk 2.0.0-beta.13 → 2.0.0-beta.15

package/README.md

@@ -1,10 +1,14 @@
 # Bota SDK for React Native
 
-Source candidate `2.0.0-beta.13` synchronizes the five-platform SDK family.
-It includes corrected recording-control decoding, dedicated reset authorization,
-Apple error metadata and React Native deferred upload-destination recovery.
-Beta.12 remains published until this candidate completes its release gates.
+Source candidate `2.0.0-beta.15` synchronizes the five-platform SDK family.
+It includes Apple single-ATT transfer bounds and local connection ownership,
+awaitable React Native reconnect pause, and the reviewed main OTA, recording
+marker, protected-status and BYO storage changes. Beta.14 remains the published
+baseline until this candidate completes its gates.
 Native applications require a new binary.
+The managed Apple backend also matches the strict session-create request without
+an EndUser override; recording creation and native scope fences retain EndUser.
+See [request correction](../../docs/parity/v2-managed-backend.md#october-12-apple-session-request-correction).
 
 Bluetooth device SDK for Bota Pin and Bota Note applications. The 2.x candidate
 preserves the public TypeScript API of `@bota.dev/react-native-sdk@0.0.65`
@@ -29,9 +33,9 @@ adopting this source API; published-package availability is a separate gate.
 
 ## Install
 
-Published beta.12 remains available. Use the beta.13 pin below only after
+Published beta.14 remains available. Use the beta.15 pin below only after
 publication is verified; see the
-[preflight](../../release/evidence/2.0.0-beta.13-preflight.md).
+[preflight](../../release/evidence/2.0.0-beta.15-preflight.md).
 Rebuild native applications and reconnect explicitly after connection loss.
 Physical completed-resume acceptance and wider GATT recovery remain separate.
 Remove `@bota.dev/react-native-sdk` before adding the replacement; do not
@@ -39,7 +43,7 @@ co-install both. Standalone maintenance ended September 29, 2026; follow the
 [retirement and migration notice](../../docs/migrations/react-native-sdk-sunset.md).
 
 ```bash
-npm install --save-exact @bota.dev/react-native-app-sdk@2.0.0-beta.13
+npm install --save-exact @bota.dev/react-native-app-sdk@2.0.0-beta.15
 npx pod-install
 ```
 
@@ -84,6 +88,14 @@ await BotaClient.waitForBluetooth();
 The `BotaClient.devices`, `BotaClient.recordings`, and `BotaClient.ota`
 managers become available after configuration completes.
 
+Source-only workspace coordination adds
+`await BotaClient.devices.pauseAutoReconnect()`. Fence new reconnect work and
+retry rearming first, then inspect fresh device activity and disconnect idle
+connections before changing scope. This method waits for submitted reconnects;
+it does not itself disconnect. Existing `disableAutoReconnect(): void` remains
+unchanged. Published beta.14 does not include the addition; see
+[verification and delivery limits](../../docs/parity/workspace-reconnect-quiescence.md).
+
 Discovery exposes the manufacturer-advertised `macAddress` as uppercase,
 colon-separated bytes (`AA:BB:CC:DD:EE:FF`), preserving the legacy React Native
 registration contract. Compact native addresses are formatted at the RN
@@ -183,6 +195,23 @@ separate physical-device and application rollout gates.
 
 ## Documentation
 
+Unpublished source also exports `createProtectedStreamingStatusBackend` for
+read-only protected STREAMING metadata. Configure a scoped HTTPS `baseUrl`,
+optional `organizationId`, lifetime `signal` and fresh application
+`getAccessToken`; call `getStatus({ recordingId, sessionId,
+recordingGeneration, writerEpoch })`. The exact session identity is checked;
+`revision` remains a decimal string and may be `"0"`. Cancel the lifetime and
+call `dispose()` on workspace or account changes. A matching rebuilt native
+binary is required; published beta.14 lacks these methods. `sealed` means
+marker metadata only, never audio completion or permission to delete. This
+reader does not start protected capture or relay signed documents.
+See `docs/parity/protected-streaming-status.md` in the source repository.
+
+未发布源码新增上述只读状态接口，必须使用匹配的原生二进制；已发布 beta.14 不包含
+这些方法。查询校验精确会话身份，revision 保持字符串且允许 `"0"`；账号或工作空间
+变化时取消并释放。`sealed` 仅指标记元数据，不代表音频完成或允许删除；本接口不启动
+protected 采集，也不转发签名文档。
+
 See [docs.bota.dev](https://docs.bota.dev) for pairing, provisioning,
 recording transfer, WiFi, OTA, and device-management guides.
 
@@ -211,3 +240,16 @@ fresh credentials, and completes the original backend recording before native
 cleanup. Supply the initial `recoveryScope` and configure the provider before
 starting batch sync. Do not call backend completion only after the sync generator
 returns: device confirmation has already happened then.
+
+For legacy completion, preserve a pending response as numeric `status: 425`
+with `data.error.code === 'upload_verification_pending'`. The current source
+helper retries only that classification with 1–2 second jitter for two minutes;
+the queue then retains completion for a later attempt without consuming its
+upload-repair budget. The native journal's `completionPending` phase prevents
+another PUT after restart while the backend remains pending. This phase never
+permits cleanup without the exact completion ACK; only authenticated
+`integrity_failure` permits a repair upload. Scope changes and cancellation
+remain fenced. The host must honor request aborts and provide HTTP timeouts.
+This unpublished correction requires rebuilt native adapters, not just updated
+JavaScript. Timers require a live JS runtime; encrypted-v2 receipt recovery is
+unchanged. See `docs/parity/upload-recovery.md` for evidence and limits.

package/android/src/main/java/dev/bota/sdk/reactnative/BotaDeviceSDKAndroidRecordingUploads.kt

@@ -236,7 +236,7 @@ internal class BotaDeviceSDKAndroidRecordingUploads(
 
     private fun metadata(serialized: String): JSONArray {
         val tasks = JSONArray(serialized)
-        val fields = setOf("id", "recordingId", "deviceId", "recordingUuid", "localPath", "status", "retryCount", "createdAt", "updatedAt", "recoveryScope", "fileSizeBytes", "nextAttemptAt", "contentType", "contentSha256", "relayUpload")
+        val fields = setOf("id", "recordingId", "deviceId", "recordingUuid", "localPath", "status", "retryCount", "createdAt", "updatedAt", "recoveryScope", "fileSizeBytes", "nextAttemptAt", "contentType", "contentSha256", "relayUpload", "completionPending")
         val ids = mutableSetOf<String>()
         return JSONArray().apply {
             for (index in 0 until tasks.length()) {
@@ -247,7 +247,7 @@ internal class BotaDeviceSDKAndroidRecordingUploads(
                 require(validInteger(task.get("retryCount")) && task.getString("status") in setOf("pending", "uploading", "completed", "failed")) { "invalid upload recovery journal" }
                 for (key in listOf("recordingUuid", "recoveryScope", "contentType", "contentSha256")) if (task.has(key)) require(task.get(key) is String) { "invalid upload recovery journal" }
                 for (key in listOf("fileSizeBytes", "nextAttemptAt")) if (task.has(key)) require(validInteger(task.get(key))) { "invalid upload recovery journal" }
-                if (task.has("relayUpload")) require(task.get("relayUpload") is Boolean) { "invalid upload recovery journal" }
+                for (key in listOf("relayUpload", "completionPending")) if (task.has(key)) require(task.get(key) is Boolean) { "invalid upload recovery journal" }
                 for (key in listOf("createdAt", "updatedAt")) require(runCatching { java.time.Instant.parse(task.getString(key)) }.isSuccess) { "invalid upload recovery journal" }
                 put(JSONObject().apply {
                     for (key in fields) if (task.has(key)) {

package/android/src/main/java/dev/bota/sdk/reactnative/BotaDeviceSDKAndroidRecordings.kt

@@ -106,6 +106,7 @@ internal data class BotaEncryptedUploadV2Recording(
     val durationMs: String,
     val plaintextLength: String,
     val storageFormat: Int,
+    val markersRequired: Boolean = false,
 )
 
 internal data class BotaEncryptedUploadV2Capability(
@@ -225,6 +226,7 @@ internal fun BotaEncryptedUploadV2Recording.toWritableMap(): WritableMap = Argum
     putString("durationMs", durationMs)
     putString("plaintextLength", plaintextLength)
     putInt("storageFormat", storageFormat)
+    putBoolean("markersRequired", markersRequired)
 }
 
 private fun BotaEncryptedUploadV2Capability.toWritableMap(): WritableMap = Arguments.createMap().apply {
@@ -779,6 +781,7 @@ internal fun EncryptedUploadV2Recording.toBridgeValue(): BotaEncryptedUploadV2Re
         durationMs.toString(),
         plaintextLength.toString(),
         storageFormat.toInt(),
+        markersRequired,
     )
 
 private fun EncryptedUploadV2CapabilitySnapshot.toBridgeValue(): BotaEncryptedUploadV2Capability {

package/android/src/main/java/dev/bota/sdk/reactnative/BotaDeviceSDKModule.kt

@@ -786,6 +786,7 @@ private fun ReadableMap.toEncryptedUploadV2Recording(): EncryptedUploadV2Recordi
         if (hasKey("storageFormat") && !isNull("storageFormat")) {
             getDouble("storageFormat").toUnsignedInt().also { require(it <= 255u) }.toUByte()
         } else 3u,
+        hasKey("markersRequired") && !isNull("markersRequired") && getBoolean("markersRequired"),
     )
 }
 

package/android/src/main/java/dev/bota/sdk/reactnative/upload/BotaUploadV2BackendModule.kt

@@ -13,6 +13,8 @@ import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.launch
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.CoroutineStart
 import org.json.JSONObject
 
 @ReactModule(name = BotaUploadV2BackendModule.NAME)
@@ -24,6 +26,11 @@ internal class BotaUploadV2BackendModule(context: ReactApplicationContext) : Nat
       putString("requestId", requestId); putString("operationId", operationId)
     })
   }
+  private val byo = ByoBridgeDriver(File(context.noBackupFilesDir, "BotaSDKByo")) { requestId, operationId ->
+    emitOnCredentialsRequested(Arguments.createMap().apply {
+      putString("requestId", requestId); putString("operationId", operationId)
+    })
+  }
   private val upload = NativeUpload(
     UploadJournal(File(context.noBackupFilesDir, "BotaSDKUploadV2"), object : JournalDurability {
       override fun syncDirectory(directory: File) {
@@ -35,31 +42,58 @@ internal class BotaUploadV2BackendModule(context: ReactApplicationContext) : Nat
       }
     }), BackendUploadHttp(), credentials::request, BotaDeviceSDKEncryptedUploadV2Materials::readAuthNonce,
   )
+  private val statusReader = UploadStreamingStatus()
+  private val statusJobs = mutableMapOf<String, Job>()
   @Volatile private var destroyed = false
 
   private fun invoke(promise: Promise, block: suspend () -> Any?) {
     work.launch {
       try { demand(!destroyed, "CANCELLED"); promise.resolve(block()) }
       catch (error: Exception) {
-        val code = (error as? UploadFailure)?.code ?: "BOTA_UPLOAD_NATIVE"
+        val code = (error as? dev.bota.sdk.ByoStorageException)?.message ?: (error as? UploadFailure)?.code ?: "BOTA_UPLOAD_NATIVE"
         promise.reject(code, code, null)
       }
     }
   }
+  override fun syncByo(inputJSON: String, promise: Promise) = invoke(promise) { byo.sync(inputJSON) }
+  override fun cancelByo(operationId: String, promise: Promise) = invoke(promise) { byo.cancel(operationId); null }
+  override fun readProtectedStreamingStatus(requestId: String, inputJSON: String, promise: Promise) {
+    val job = work.launch(start = CoroutineStart.LAZY) {
+      try { demand(!destroyed, "CANCELLED"); promise.resolve(statusReader.read(inputJSON)) }
+      catch (_: Exception) { promise.reject("BOTA_STREAM_STATUS_FAILED", "BOTA_STREAM_STATUS_FAILED", null) }
+    }
+    job.invokeOnCompletion { error ->
+      synchronized(statusJobs) { if (statusJobs[requestId] === job) statusJobs.remove(requestId) }
+      if (error != null) promise.reject("BOTA_STREAM_STATUS_FAILED", "BOTA_STREAM_STATUS_FAILED", null)
+    }
+    synchronized(statusJobs) {
+      if (destroyed || statusJobs.containsKey(requestId)) {
+        job.cancel(); return
+      }
+      statusJobs[requestId] = job
+    }
+    job.start()
+  }
+  override fun cancelProtectedStreamingStatus(requestId: String, promise: Promise) {
+    synchronized(statusJobs) { statusJobs[requestId]?.cancel() }
+    promise.resolve(null)
+  }
   override fun prepare(inputJSON: String, promise: Promise) = invoke(promise) {
     JSONObject(upload.prepare(inputJSON)).toString()
   }
   override fun cancel(operationId: String, promise: Promise) = invoke(promise) { upload.cancel(operationId); null }
   override fun complete(operationId: String, promise: Promise) = invoke(promise) { upload.complete(operationId); null }
   override fun resolveCredentials(requestId: String, token: String, promise: Promise) = invoke(promise) {
-    credentials.resolve(requestId, token); null
+    credentials.resolve(requestId, token); byo.resolve(requestId, token); null
   }
   override fun rejectCredentials(requestId: String, promise: Promise) = invoke(promise) {
-    credentials.reject(requestId); null
+    credentials.reject(requestId); byo.reject(requestId); null
   }
   override fun invalidate() {
     destroyed = true
     upload.cancelAll()
+    work.launch { byo.stop() }
+    synchronized(statusJobs) { statusJobs.values.toList().forEach { it.cancel() }; statusJobs.clear() }
     // Dispatched identity-creating requests must drain into their original journal.
     super.invalidate()
   }

package/android/src/main/java/dev/bota/sdk/reactnative/upload/ByoBridgeDriver.kt

@@ -0,0 +1,79 @@
+package dev.bota.sdk.reactnative.upload
+
+import dev.bota.sdk.*
+import dev.bota.sdk.model.*
+import java.io.File
+import java.util.UUID
+import kotlinx.coroutines.*
+import org.json.JSONObject
+
+/** RN passes only identity metadata; all signed material and audio remain native. */
+internal class ByoBridgeDriver(private val root: File,private val emit: (String,String)->Unit) {
+    private val lock=Any()
+    private val tasks=mutableMapOf<String,Job>()
+    private val cancelled=mutableSetOf<String>()
+    private var stopped=false
+    private data class Pending(val owner: String,val value: CompletableDeferred<String>)
+    private val pending=mutableMapOf<String,Pending>()
+    private fun check(id: String)=synchronized(lock) {demand(!stopped && id !in cancelled && tasks.containsKey(id),"CANCELLED")}
+    suspend fun sync(json: String): String=coroutineScope {
+        demand(json.toByteArray().size<=8192,"INVALID_INPUT")
+        val input=JSONObject(json);val id=input.getString("operationId")
+        val job=currentCoroutineContext()[Job]!!
+        synchronized(lock) {
+            demand(id.startsWith("byo-") && id.length<=64 && !stopped && id !in cancelled && !tasks.containsKey(id),"INVALID_INPUT")
+            tasks[id]=job
+        }
+        try {
+            val value=input.getJSONObject("device");val scope=input.getJSONObject("scope");val recording=input.optJSONObject("recording")
+            val type=when(value.getString("deviceType")) {"bota_pin"->DeviceType.BotaPin;"bota_pin_4g"->DeviceType.BotaPin4G;"bota_note"->DeviceType.BotaNote;else->fail("INVALID_INPUT")}
+            demand(value.getString("connectionState")=="connected" && value.getInt("mtu") in 23..517,"INVALID_INPUT")
+            val device=ConnectedDevice(value.getString("id"),value.getString("serialNumber"),type,value.getString("firmwareVersion"),
+                if(value.isNull("hardwareRevision")) null else value.optString("hardwareRevision"),
+                value.getBoolean("isProvisioned"),ConnectionState.Connected,value.getInt("mtu"))
+            val binding=scope.getLong("bindingGeneration");val generation=recording?.getLong("generation") ?: 0
+            demand(binding in 1..0xffffffffL && generation in 0..0xffffffffL,"INVALID_INPUT")
+            val options=ByoStorageOptions(scope.getString("baseUrl"),scope.getString("scopeKey"),scope.getString("organizationId"),
+                scope.getString("projectId"),scope.getString("deviceId"),scope.getString("environment"),binding.toUInt(),root,
+                {token(id)},{currentCoroutineContext().ensureActive();check(id)})
+            if(input.getString("mode")=="list") {
+                val values=BotaDeviceClient.shared.recordings.listByoRecordings(device,options);check(id)
+                org.json.JSONArray(values.map {JSONObject().put("uuid",it.uuid).put("generation",it.generation.toLong())}).toString()
+            } else {
+                demand(input.getString("mode")=="stream" || (input.getString("mode")=="sync" && recording!=null),"INVALID_INPUT")
+                val selected=recording?.let {ByoRecording(it.getString("uuid"),generation.toUInt())}
+                val result=if(input.getString("mode")=="stream") BotaDeviceClient.shared.recordings.streamByoRecording(device,selected,options)
+                    else BotaDeviceClient.shared.recordings.syncByoRecording(device,requireNotNull(selected),options)
+                check(id)
+                JSONObject().put("recordingId",result.recordingId).put("uploadSessionId",result.uploadSessionId).toString()
+            }
+        } finally {
+            synchronized(lock) {tasks.remove(id);cancelled.remove(id)
+                pending.filterValues {it.owner==id}.keys.toList().forEach {pending.remove(it)?.value?.cancel()}}
+        }
+    }
+    private suspend fun token(id: String): String {
+        check(id);val request=UUID.randomUUID().toString();val value=CompletableDeferred<String>()
+        synchronized(lock) {check(id);pending[request]=Pending(id,value)}
+        try {emit(request,id);return withTimeout(30_000) {value.await()}.also {check(id)}}
+        finally {synchronized(lock) {pending.remove(request)}}
+    }
+    fun resolve(request: String,token: String) {
+        val entry=synchronized(lock) {pending.remove(request)} ?: return
+        if(token.isNotEmpty() && token.length<=16384 && token.all {it.code in 33..126}) entry.value.complete(token)
+        else entry.value.completeExceptionally(UploadFailure("BOTA_UPLOAD_CREDENTIALS"))
+    }
+    fun reject(request: String) {synchronized(lock) {pending.remove(request)}?.value?.completeExceptionally(UploadFailure("BOTA_UPLOAD_CREDENTIALS"))}
+    suspend fun cancel(id: String) {
+        val task=synchronized(lock) {
+            if(!id.startsWith("byo-") || id.length>64) return
+            if(cancelled.size>=128) stopped=true else cancelled.add(id)
+            tasks[id]
+        }
+        task?.cancelAndJoin()
+    }
+    suspend fun stop() {
+        val current=synchronized(lock) {stopped=true;tasks.values.toList()}
+        current.forEach {it.cancel()};current.forEach {it.join()}
+    }
+}

package/android/src/main/java/dev/bota/sdk/reactnative/upload/NativeUpload.kt

@@ -257,13 +257,29 @@ internal class NativeUpload(
         else -> fail("INVALID_DOCUMENT")
       }
       timestamp(selected.string("expires_at"))
-      val authorization = opaque(selected.string("authorization_base64"), 408, selected.string("authorization_sha256"))
+      var authorization = opaque(selected.string("authorization_base64"), 408, selected.string("authorization_sha256"))
+      if (input.recording.markersRequired) {
+        val path = sessionPath() + "/markers/authorization"
+        val admission = try {
+          retry { request(path + "?owner_revision=" + pointer!!.ownerRevision) }
+        } catch (error: UploadFailure) {
+          if (error.code != "BOTA_UPLOAD_HTTP_404" || selected.optString("state") !in setOf("", "created", "staging", "staged")) throw error
+          retry { request(path, JSONObject().put("owner_revision", pointer!!.ownerRevision)
+            .put("request_uuid", pointer!!.sessionId)) }
+        }
+        demand(admission.string("profile") == "recording-markers/1", "INVALID_DOCUMENT")
+        authorization += opaque(admission.string("context_base64"), 176)
+        authorization += opaque(admission.string("authorization_base64"), 280, admission.string("authorization_sha256"))
+      }
       val material = EncryptedUploadV2Material(
         materialId = UUID.randomUUID().toString(), recordingId = input.recording.uuid,
         uploadSessionId = UUID.fromString(pointer!!.sessionId), ownerRevision = pointer!!.ownerRevision!!.toUInt(),
         policy = nativePolicy, authorization = authorization,
         stagingRequest = { evidence -> callbacks.withLock { staging(evidence) } },
         submitManifest = { bytes, evidence -> callbacks.withLock { manifest(bytes, evidence) } },
+        submitMarkers = if (input.recording.markersRequired) { documents, evidence ->
+          callbacks.withLock { markers(documents, evidence) }
+        } else null,
         finalize = { evidence -> callbacks.withLock { finalize(evidence) } },
         completionReceipt = { evidence -> callbacks.withLock {
           verifyEvidence(evidence)
@@ -349,6 +365,15 @@ internal class NativeUpload(
       uploadCiphertext = false
       sendManifest = false
     }
+    private suspend fun markers(documents: List<ByteArray>, evidence: EncryptedUploadV2TransferEvidence) {
+      verifyEvidence(evidence)
+      demand(input.recording.markersRequired && documents.size in 2..4097 && documents[0].size == 200 &&
+        documents.drop(1).all { it.size in 216..402 }, "INVALID_DOCUMENT")
+      val pages = org.json.JSONArray()
+      documents.drop(1).forEach { pages.put(encoded(it)) }
+      retry { request(sessionPath() + "/markers/batch", JSONObject().put("owner_revision", pointer!!.ownerRevision)
+        .put("seal_base64", encoded(documents[0])).put("pages_base64", pages)) }
+    }
     private suspend fun finalize(evidence: EncryptedUploadV2TransferEvidence) {
       verifyEvidence(evidence)
       for (poll in 0 until 60) {
@@ -356,7 +381,10 @@ internal class NativeUpload(
         applyStatus(status)
         if (status.string("state") == "published") {
           demand(status.integer("plaintext_length") == input.recording.plaintextLength, "INVALID_DOCUMENT")
-          receipt = opaque(status.string("completion_receipt_base64"), 336, status.string("completion_receipt_sha256"))
+          val audio = opaque(status.string("completion_receipt_base64"), 336, status.string("completion_receipt_sha256"))
+          receipt = if (input.recording.markersRequired) audio + opaque(
+            (status.opt("marker_completion_receipt_base64") as? String ?: fail("INVALID_DOCUMENT")), 296,
+            (status.opt("marker_completion_receipt_sha256") as? String ?: fail("INVALID_DOCUMENT"))) else audio
           return
         }
         wait(2000, operation)

package/android/src/main/java/dev/bota/sdk/reactnative/upload/UploadModels.kt

@@ -78,15 +78,18 @@ internal data class UploadScope(
 internal data class UploadRecording(
   val uuid: String, val generation: Long, val ciphertextLength: Long, val ciphertextSha256: String,
   val startedAtMs: Long, val durationMs: Long, val plaintextLength: Long, val storageFormat: Long,
+  val markersRequired: Boolean = false,
 ) {
   fun identity(): List<Any> = listOf(uuid, generation, ciphertextLength.toString(), ciphertextSha256,
-    startedAtMs.toString(), durationMs.toString(), plaintextLength.toString(), storageFormat)
+    startedAtMs.toString(), durationMs.toString(), plaintextLength.toString(), storageFormat) +
+    if (markersRequired) listOf(true) else emptyList()
 
   companion object {
     fun parse(json: JSONObject): UploadRecording = UploadRecording(uuid(json.string("uuid")),
       json.integer("generation", 1, 4294967295), json.decimal("ciphertextLength", 1),
       hashString(json.string("ciphertextSha256")), json.decimal("startedAtMs"), json.decimal("durationMs"),
-      json.decimal("plaintextLength"), json.integer("storageFormat", 3, 3)).also {
+      json.decimal("plaintextLength"), json.integer("storageFormat", 3, 3),
+      if (json.has("markersRequired")) (json.get("markersRequired") as? Boolean ?: fail("INVALID_DOCUMENT")) else false).also {
       demand(it.startedAtMs + it.durationMs <= 8640000000000000L)
     }
   }

package/android/src/main/java/dev/bota/sdk/reactnative/upload/UploadStreamingStatus.kt

@@ -0,0 +1,67 @@
+package dev.bota.sdk.reactnative.upload
+
+import java.io.IOException
+import java.util.concurrent.TimeUnit
+import kotlin.coroutines.resume
+import kotlin.coroutines.resumeWithException
+import kotlinx.coroutines.suspendCancellableCoroutine
+import okhttp3.Call
+import okhttp3.Callback
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.Response
+import org.json.JSONObject
+
+/** Read-only native HTTP boundary. Never sends opaque server fields over RN. */
+internal class UploadStreamingStatus(private val client: OkHttpClient = OkHttpClient.Builder()
+  .followRedirects(false).followSslRedirects(false).retryOnConnectionFailure(false)
+  .connectTimeout(20, TimeUnit.SECONDS).readTimeout(30, TimeUnit.SECONDS).callTimeout(45, TimeUnit.SECONDS).build()) {
+  suspend fun read(input: String): String {
+    val json = sanitized("INVALID_INPUT") { JSONObject(input) }
+    val url = json.optString("url")
+    val token = json.optString("token")
+    val org = json.optString("organizationId")
+    demand(url.matches(Regex("https://[A-Za-z0-9.-]+(?::[0-9]+)?(?:/[A-Za-z0-9_-]+)+/recordings/rec_[A-Za-z0-9_-]+/streaming-status\\?session_id=[0-9a-f-]{36}")), "INVALID_INPUT")
+    demand(token.length in 1..16384 && token.all { it.code in 33..126 } &&
+      (org.isEmpty() || org.matches(Regex("[A-Za-z0-9_-]{1,128}"))), "INVALID_INPUT")
+    val request = Request.Builder().url(url).get().header("Authorization", "Bearer $token")
+      .header("Accept", "application/json").apply { if (org.isNotEmpty()) header("X-Organization-Id", org) }.build()
+    val call = client.newCall(request)
+    return suspendCancellableCoroutine { continuation ->
+      continuation.invokeOnCancellation { call.cancel() }
+      call.enqueue(object : Callback {
+        override fun onFailure(call: Call, e: IOException) {
+          if (continuation.isActive) continuation.resumeWithException(UploadFailure("BOTA_UPLOAD_TRANSPORT"))
+        }
+        override fun onResponse(call: Call, response: Response) {
+          val result = runCatching {
+            response.use {
+              demand(response.code == 200 && response.request.url == request.url, "HTTP_${response.code}")
+              val body = response.body ?: fail("INVALID_DOCUMENT")
+              demand(body.contentLength() <= 16384, "INVALID_DOCUMENT")
+              val source = body.source(); source.request(16385)
+              demand(source.buffer.size <= 16384, "INVALID_DOCUMENT")
+              scalarStatus(source.readUtf8())
+            }
+          }
+          if (continuation.isActive) result.fold({ continuation.resume(it) },
+            { continuation.resumeWithException(if (it is UploadFailure) it else UploadFailure("BOTA_UPLOAD_INVALID_DOCUMENT")) })
+        }
+      })
+    }
+  }
+
+  companion object {
+    private val stringFields = setOf("profile", "recording_id", "session_id", "writer_epoch", "revision", "state")
+    private val numberFields = setOf("recording_generation", "received_count", "contiguous_sequence")
+    fun scalarStatus(body: String): String {
+      val json = sanitized("INVALID_DOCUMENT") { JSONObject(body) }
+      demand(json.keys().asSequence().toSet() == stringFields + numberFields + setOf("expected_count", "authorization_expired"), "INVALID_DOCUMENT")
+      stringFields.forEach { demand(json.get(it) is String && (json.get(it) as String).length <= 160, "INVALID_DOCUMENT") }
+      numberFields.forEach { demand(json.get(it) is Number, "INVALID_DOCUMENT") }
+      demand(json.isNull("expected_count") || json.get("expected_count") is Number, "INVALID_DOCUMENT")
+      demand(json.get("authorization_expired") is Boolean, "INVALID_DOCUMENT")
+      return json.toString()
+    }
+  }
+}

package/android/src/test/java/dev/bota/sdk/reactnative/BotaDeviceSDKAndroidRecordingUploadsTest.kt

@@ -8,6 +8,7 @@ import okhttp3.OkHttpClient
 import okhttp3.Protocol
 import okhttp3.Response
 import okhttp3.ResponseBody.Companion.toResponseBody
+import org.json.JSONArray
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
@@ -96,6 +97,26 @@ class BotaDeviceSDKAndroidRecordingUploadsTest {
         assertEquals("failed", tasks.getJSONObject(0).getString("status"))
     }
 
+    @Test
+    fun completionPendingPersistsWithoutAuthorizingRelease() = runTest {
+        val fixture = UploadFixture()
+        var barriers = 0
+        val uploads = BotaDeviceSDKAndroidRecordingUploads(fixture.queueFile, syncDirectory = { barriers++ })
+        // This metadata test injects the directory barrier so it also runs on
+        // Windows; separate durability tests exercise the real POSIX barrier.
+        val journal = fixture.journal("pending").replace(fixture.recordingFile.path, fixture.recordingFile.path.replace("\\", "\\\\"))
+        uploads.saveQueue(journal.replace("\"status\":\"pending\"", "\"status\":\"pending\",\"completionPending\":true"))
+        val stored = JSONArray(uploads.loadQueue()).getJSONObject(0)
+        assertTrue(stored.getBoolean("completionPending"))
+        assertTrue(barriers > 0)
+        assertTrue(runCatching { uploads.release("task-1", fixture.recordingFile.path) }.isFailure)
+        assertTrue(fixture.recordingFile.exists())
+        for (invalid in listOf("\"true\"", "1")) {
+            assertTrue(runCatching { uploads.saveQueue(journal.replace("\"status\":\"pending\"", "\"status\":\"pending\",\"completionPending\":$invalid")) }.isFailure)
+            assertTrue(JSONArray(uploads.loadQueue()).getJSONObject(0).getBoolean("completionPending"))
+        }
+    }
+
     @Test
     fun releaseRequiresExactCompletedJournalAndIsIdempotent() = runTest {
         val fixture = UploadFixture()
@@ -140,6 +161,8 @@ class BotaDeviceSDKAndroidRecordingUploadsTest {
             "\"createdAt\":\"2026-09-24T00:00:00Z\"" to "\"createdAt\":\"invalid\"",
             "\"status\":\"completed\"" to "\"status\":\"completed\",\"fileSizeBytes\":\"4\"",
             "\"status\":\"completed\"" to "\"status\":\"completed\",\"recoveryScope\":123",
+            "\"status\":\"completed\"" to "\"status\":\"completed\",\"completionPending\":\"true\"",
+            "\"status\":\"completed\"" to "\"status\":\"completed\",\"completionPending\":1",
         )) {
             val fixture = UploadFixture()
             val contents = fixture.journal("completed").replace(old, invalid)