@goliapkg/sentori-react-native 6.4.1 → 7.0.1

package/src/__tests__/push.test.ts

@@ -44,7 +44,7 @@ function grantingNative(over: Record<string, unknown> = {}) {
 
 const realFetch = globalThis.fetch;
 
-/** Answer /v1/push/tokens with `body` under `status`. */
+/** Answer /v1/push/devices with `body` under `status`. */
 function stubFetch(status: number, body: unknown): void {
   globalThis.fetch = (() =>
     Promise.resolve({
@@ -73,7 +73,7 @@ describe('push.register', () => {
 
   it('returns the device handle when the whole flow works', async () => {
     __setNativeForTests(grantingNative());
-    stubFetch(200, { token_id: '018f0000-0000-7000-8000-000000000001', is_new: true });
+    stubFetch(200, { spToken: '018f0000-0000-7000-8000-000000000001', isNew: true });
 
     const r = await register();
 
@@ -89,7 +89,7 @@ describe('push.register', () => {
       return Promise.resolve({
         ok: true,
         status: 200,
-        json: () => Promise.resolve({ token_id: 'id-1' }),
+        json: () => Promise.resolve({ spToken: 'id-1' }),
       });
     }) as unknown as typeof fetch;
 
@@ -108,7 +108,7 @@ describe('push.register', () => {
       return Promise.resolve({
         ok: true,
         status: 200,
-        json: () => Promise.resolve({ token_id: 'id-1' }),
+        json: () => Promise.resolve({ spToken: 'id-1' }),
       });
     }) as unknown as typeof fetch;
 
@@ -209,7 +209,7 @@ describe('push.register', () => {
 // the life of the install — and a send aimed at that user reached
 // nobody and reported success.
 describe('push registration follows the person', () => {
-  /** Record every /v1/push/tokens body, so a test can say what the
+  /** Record every /v1/push/devices body, so a test can say what the
    *  server was told rather than that it was told something. */
   function recordingFetch(): Array<Record<string, unknown>> {
     const seen: Array<Record<string, unknown>> = [];
@@ -220,7 +220,7 @@ describe('push registration follows the person', () => {
       return Promise.resolve({
         ok: true,
         status: 202,
-        json: () => Promise.resolve({ spToken: 'dev-1', token_id: 'dev-1' }),
+        json: () => Promise.resolve({ spToken: 'dev-1' }),
       });
     }) as unknown as typeof fetch;
     return seen;
@@ -265,6 +265,44 @@ describe('push registration follows the person', () => {
     expect(seen[1]?.traits).toEqual({ plan: 'pro' });
   });
 
+  it('sends the identity when the person signs in while the registration is in flight', async () => {
+    // The window the test above cannot see. `register()` builds its
+    // body — with whoever is signed in at that moment, which is
+    // nobody — and only installs the identity listener once the
+    // response lands. A host that calls `user()` in between fired a
+    // listener that was not there yet, and nothing asked again: the
+    // device row kept no user, so a send aimed at that person matched
+    // no device and reported success.
+    //
+    // Registering push at launch and identifying the user right after
+    // is a few hundred milliseconds apart in a real app.
+    const seen: Array<Record<string, unknown>> = [];
+    globalThis.fetch = ((_url: string, init?: { body?: string }) => {
+      if (init?.body != null) {
+        seen.push(JSON.parse(init.body) as Record<string, unknown>);
+        // Sign in at the exact moment the first request goes out.
+        if (seen.length === 1) setUser({ id: 'usr_123', traits: { plan: 'pro' } });
+      }
+      // A request takes longer than hashing an id does, so the
+      // sign-in completes — and announces — while this is still in
+      // flight. That is the window, and a resolved promise skips it.
+      return new Promise((r) =>
+        setTimeout(
+          () => r({ ok: true, status: 202, json: () => Promise.resolve({ spToken: 'dev-1' }) }),
+          5,
+        ),
+      );
+    }) as unknown as typeof fetch;
+
+    await register();
+    await settle();
+
+    expect(seen[0]?.userKey).toBeUndefined();
+    expect(seen).toHaveLength(2);
+    expect(typeof seen[1]?.userKey).toBe('string');
+    expect(seen[1]?.traits).toEqual({ plan: 'pro' });
+  });
+
   it('does not send anything when the same person is set again', async () => {
     const seen = recordingFetch();
     await register();
@@ -322,7 +360,7 @@ describe('push survives the vendor rotating its token', () => {
       return Promise.resolve({
         ok: true,
         status: 202,
-        json: () => Promise.resolve({ spToken: 'dev-1', token_id: 'dev-1' }),
+        json: () => Promise.resolve({ spToken: 'dev-1' }),
       });
     }) as unknown as typeof fetch;
     return seen;
@@ -439,7 +477,7 @@ describe('nothing the host does can reach back into the app', () => {
       Promise.resolve({
         ok: true,
         status: 202,
-        json: () => Promise.resolve({ spToken: 'dev-1', token_id: 'dev-1' }),
+        json: () => Promise.resolve({ spToken: 'dev-1' }),
       })) as unknown as typeof fetch;
   }
 

package/src/handlers/network.ts

@@ -1,6 +1,6 @@
 // Network instrumentation — v1 role: feed the signal ring (`http`
-// signals) and detect the slow_api warn scenario (design.md §3,
-// category C: 「转圈不完」server-side flavour). The span/breadcrumb
+// signals) and detect the slow_api warn scenario (category C:
+// 「转圈不完」server-side flavour). The span/breadcrumb
 // machinery this file used to drive is gone with the APM vocabulary.
 //
 // Mini-spec (slow_api): a completed request slower than 3 s emits

package/src/index.ts

@@ -1,4 +1,4 @@
-// @goliapkg/sentori-react-native — the 8-verb surface (design.md §4).
+// @goliapkg/sentori-react-native — the 8-verb surface.
 //
 //   sentori.init(config)   sentori.user(u)      sentori.context(patch)
 //   sentori.error(err)     sentori.warn(name)   sentori.trace(name)

package/src/init.ts

@@ -1,5 +1,5 @@
 // sentori.init(config) — the single configuration entry point
-// (design.md §4). Synchronous, never throws; a bad config degrades
+// Synchronous, never throws; a bad config degrades
 // every verb to a no-op with one console.warn, never a crash
 // (failure-isolation iron rule).
 
@@ -69,7 +69,7 @@ export const init = safeFn('init', (config: InitConfig): void => {
   installNetworkHandler();
   installLifecycleHandler();
 
-  // Warn-scenario detectors (design.md §3 minimum set). rage_tap
+  // Warn-scenario detectors, the minimum set. rage_tap
   // rides the RageTapCapture component; the rest start here.
   if (config.detect?.longFreeze !== false) startLongTaskMonitor();
 

package/src/long-task-monitor.ts

@@ -1,4 +1,4 @@
-// long_freeze — detected warn scenario (design.md §3, category B:
+// long_freeze — detected warn scenario (category B:
 // 「app 卡住了 / 死了几秒」), JS-thread side.
 //
 // Mini-spec: a setInterval(50 ms) tick measures wall-clock drift.

package/src/mobile-vitals.ts

@@ -1,5 +1,5 @@
-// slow_cold_start — detected warn scenario (design.md §3, category
-// C: 「启动过慢」).
+// slow_cold_start — detected warn scenario (category C:
+// 「启动过慢」).
 //
 // Mini-spec: the native side measures launch → JS-ready (iOS
 // mach_absolute_time / Android Process.getStartElapsedRealtime);

package/src/push.ts

@@ -10,7 +10,7 @@
 //      asynchronously and lands in the native buffer.
 //   3. Poll `pushDrainState()` at 200 ms ticks for up to 8 s waiting
 //      for the token.
-//   4. POST `/v1/push/tokens` with `kind: 'apns' | 'fcm'` — the
+//   4. POST `/v1/push/devices` with `kind: 'apns' | 'fcm'` — the
 //      server's field name; sending `provider` here earned a 422 for
 //      every registration this SDK ever attempted — plus
 //      `nativeToken`, `userKey`, and `env` on iOS only (FCM is a
@@ -73,7 +73,7 @@ let _onTap: PushRegisterOptions['onTap'] = undefined
 // v2.26 — confirmed delivery ack pipeline. msgIds extracted from
 // received pushes are queued here and flushed to the server every
 // 5 s. Server-side `push_sends.acked_at` flips from NULL to
-// wall-clock on first ack. See docs/roadmap/v2.26.md.
+// wall-clock on first ack.
 const ACK_FLUSH_INTERVAL_MS = 5000
 let _ackQueue: string[] = []
 let _ackFlushInterval: ReturnType<typeof setInterval> | null = null
@@ -202,7 +202,13 @@ export async function register(opts: PushRegisterOptions = {}): Promise<PushRegi
     // successful registration as `server-rejected`.
     safely('onToken', () => opts.onToken?.(ipt))
     bindBufferDrain(opts.onMessage, opts.onTap)
-    // From here on, signing in or out updates the row by itself.
+    // From here on, signing in or out updates the row by itself —
+    // including a sign-in that happened while this registration was
+    // still in flight, which announced to nobody and which `scope`
+    // replays as this listener is installed. It is replayed rather
+    // than read here because `user()` publishes its key a tick after
+    // the call, and a read at an arbitrary moment can catch a person
+    // half-described.
     onIdentityChange(reRegisterAfterIdentityChange)
     return { ok: true, ipt }
   } catch (e) {
@@ -235,11 +241,31 @@ function fail(
  * token. Nothing here throws and nothing here is awaited by the host:
  * `user()` is synchronous and stays that way.
  */
+/** One string standing for "who this device belongs to", used only to
+ *  answer "has it changed since the last request".
+ *
+ *  Keys sorted: two objects holding the same pairs stringify in
+ *  insertion order, so the same person described by two differently
+ *  built objects would compare unequal — reporting a change that did
+ *  not happen and sending a registration per call of a verb a host may
+ *  call on every screen, which is the cost this comparison exists to
+ *  avoid. Matches `identityString` in the Swift and Kotlin SDKs. */
+function identityKey(
+  userKey: string | null | undefined,
+  traits: Record<string, unknown> | null | undefined,
+): string {
+  const rendered = Object.keys(traits ?? {})
+    .sort()
+    .map((k) => `${k}=${String((traits as Record<string, unknown>)[k])}`)
+    .join('\u0001')
+  return `${userKey ?? '-'}\u0000${rendered}`
+}
+
 function reRegisterAfterIdentityChange(): void {
   const token = _lastNativeToken
   const cfg = tryGetRuntimeConfig()
   if (token == null || cfg == null) return
-  const identity = JSON.stringify([currentUserKey() ?? null, currentUserTraits() ?? null])
+  const identity = identityKey(currentUserKey(), currentUserTraits())
   if (identity === _lastSentIdentity) return
   _lastSentIdentity = identity
   void registerWithServer(cfg, token, _lastOptions).catch((e: unknown) => {
@@ -262,7 +288,7 @@ class PushRegisterError extends Error {
 }
 
 /**
- * Revoke the cached handle (DELETE /v1/push/tokens/{ipt}) +
+ * Revoke the cached handle (DELETE /v1/push/devices/{ipt}) +
  * unregister locally. Idempotent — repeat calls are no-ops.
  */
 export async function unregister(): Promise<void> {
@@ -270,7 +296,7 @@ export async function unregister(): Promise<void> {
   const ipt = _cachedIpt ?? (await readPersistedIpt())
   if (cfg && ipt) {
     try {
-      await fetch(joinUrl(cfg.ingestUrl, `/v1/push/tokens/${ipt}`), {
+      await fetch(joinUrl(cfg.ingestUrl, `/v1/push/devices/${ipt}`), {
         method: 'DELETE',
         headers: { authorization: `Bearer ${cfg.token}` },
       })
@@ -346,6 +372,11 @@ async function registerWithServer(
     : typeof __DEV__ !== 'undefined' && __DEV__
       ? 'sandbox'
       : 'production'
+  // Read once. The body and the record of what the body carried have
+  // to describe the same person, and two reads of a value the host
+  // can change between them do not.
+  const userKeyNow = currentUserKey()
+  const traitsNow = currentUserTraits()
   // `kind`, not `provider` — the server's field name, which this
   // sent for a year as `provider` and got a 422 for every time.
   const body: Record<string, unknown> = {
@@ -358,7 +389,7 @@ async function registerWithServer(
     // The same salted identity hash every event carries, so the
     // dashboard can address this device by the user who hit an
     // issue. Absent until the host calls `sentori.user()`.
-    userKey: currentUserKey(),
+    userKey: userKeyNow,
   }
   if (env != null) body.env = env
   // `metadata` was an advertised option that no line of this file
@@ -372,9 +403,14 @@ async function registerWithServer(
   // a build channel called "pro" cannot answer a send aimed at the pro
   // plan. Absent leaves whatever the row already had; `{}` clears it,
   // which is what signing out sends.
-  const traits = currentUserTraits()
-  if (traits != null) body.traits = traits
-  const res = await fetch(joinUrl(cfg.ingestUrl, '/v1/push/tokens'), {
+  if (traitsNow != null) body.traits = traitsNow
+  // What this request puts on the wire, recorded before it goes.
+  // `reRegisterAfterIdentityChange` reads it back to decide whether
+  // the person has changed since — including while this very request
+  // was in flight, which is the window a host hits by calling
+  // `sentori.user()` right after `register()`.
+  _lastSentIdentity = identityKey(userKeyNow, traitsNow)
+  const res = await fetch(joinUrl(cfg.ingestUrl, '/v1/push/devices'), {
     method: 'POST',
     headers: {
       authorization: `Bearer ${cfg.token}`,
@@ -383,16 +419,16 @@ async function registerWithServer(
     body: JSON.stringify(body),
   })
   if (!res.ok) {
-    throw new PushRegisterError('server-rejected', `/v1/push/tokens HTTP ${res.status}`)
+    throw new PushRegisterError('server-rejected', `/v1/push/devices HTTP ${res.status}`)
   }
   // The handle is the device_tokens row id — a uuid, which is what
   // the revoke and send routes take. It was parsed here as an
   // `ipt_*` string that no server has ever returned.
-  const json = (await res.json()) as { token_id?: string }
-  if (typeof json.token_id !== 'string' || json.token_id.length === 0) {
+  const json = (await res.json()) as { spToken?: string }
+  if (typeof json.spToken !== 'string' || json.spToken.length === 0) {
     throw new PushRegisterError('server-rejected', 'server did not return a device token id')
   }
-  return json.token_id
+  return json.spToken
 }
 
 function bindBufferDrain(
@@ -567,7 +603,7 @@ async function drainAckQueue(): Promise<void> {
   // the user flow.
   for (const msgId of batch) {
     try {
-      await fetch(joinUrl(cfg.ingestUrl, `/v1/push/sends/${msgId}/ack`), {
+      await fetch(joinUrl(cfg.ingestUrl, `/v1/push/deliveries/${msgId}/ack`), {
         body: JSON.stringify({ eventType: 'received', sessionId: _sessionId }),
         headers: {
           authorization: `Bearer ${cfg.token}`,

package/src/rage-tap.tsx

@@ -1,5 +1,5 @@
-// rage_tap — the first detected warn scenario (design.md §3,
-// category A: 「我按了没反应/反复按」).
+// rage_tap — the first detected warn scenario (category A:
+// 「我按了没反应/反复按」).
 //
 // Wrap the app root (next to ErrorBoundary) with
 // `<RageTapCapture>{children}</RageTapCapture>`. Bubble-phase

package/src/scope.ts

@@ -23,14 +23,31 @@ let _traits: Record<string, unknown> | undefined;
 // this file; the arrow has to point one way.
 let _onIdentityChange: (() => void) | undefined;
 
+/** An identity change that happened while nobody was listening.
+ *  Push installs its listener only once a registration has landed, so
+ *  a host that signs someone in while that request is in flight
+ *  announced to an empty room — and nothing announces it again. */
+let _missedAnnounce = false;
+
 /** Register interest in identity changes. Only push does. */
 export const onIdentityChange = (fn: (() => void) | undefined): void => {
   _onIdentityChange = fn;
+  if (fn != null && _missedAnnounce) {
+    _missedAnnounce = false;
+    announce();
+  }
 };
 
 const announce = (): void => {
+  if (_onIdentityChange == null) {
+    // Replayed by `onIdentityChange` when someone starts listening.
+    // Deliberately not a queue: identity is a current value, not a
+    // stream, so one flag replays the latest and no more.
+    _missedAnnounce = true;
+    return;
+  }
   try {
-    _onIdentityChange?.();
+    _onIdentityChange();
   } catch {
     // NEVER rule: whatever the listener does, user() returns.
   }
@@ -95,5 +112,6 @@ export const __resetForTests = (): void => {
   _traits = undefined;
   _context = {};
   _onIdentityChange = undefined;
+  _missedAnnounce = false;
   _hashGeneration++;
 };

package/src/transport.ts

@@ -1,6 +1,6 @@
 // Event transport — the only place the SDK talks to the network.
 //
-// Quiet by default, complete when it matters (design.md §4): events
+// Quiet by default, complete when it matters: events
 // batch on a 5 s timer or a 10-deep queue, whichever first; assert
 // pass-counts piggyback on whatever batch goes out next (never their
 // own request); failures back off and finally persist to an offline
@@ -20,7 +20,7 @@ const STORAGE_KEY = '@sentori/pending';
 const MAX_PERSISTED = 1000;
 
 // Pinned to package.json by a test — bump both together.
-const SDK_VERSION = '6.4.1';
+const SDK_VERSION = '7.0.1';
 
 let _queue: WireEvent[] = [];
 let _assertStats = new Map<string, AssertStat>();

package/src/verbs.ts

@@ -1,4 +1,4 @@
-// The five event verbs (design.md §4). Everything here is
+// The five event verbs. Everything here is
 // synchronous, never throws, and returns the client-minted event id
 // — the zero-cost iron rule made code.
 //
@@ -36,7 +36,7 @@ import { countAssert, enqueue } from './transport';
 declare const __DEV__: boolean | undefined;
 
 /** Serialize any Error instances found in the data argument — the
- *  error-in-data convention (design.md §4): a caught-but-noteworthy
+ *  error-in-data convention: a caught-but-noteworthy
  *  exception needs no special API. One level deep is enough; nested
  *  containers of errors are an anti-pattern we don't reward. */
 const serializeData = (data?: EventData): Record<string, unknown> | undefined => {
@@ -220,7 +220,7 @@ export const assert = safeFn(
 
 export const probe = safeFn('probe', (ref: string, data?: EventData): string => {
   // A tripwire: reaching this call IS the signal. Never throws,
-  // never changes control flow (design.md §4).
+  // never changes control flow.
   return emit('probe', { name: ref, data });
 });
 

package/ios/PRIVACY_AND_REVIEW.md

@@ -1,122 +0,0 @@
-# iOS Main Thread Sampler — Privacy & App Store Review Notes
-
-> **Status:** Phase 29 sub-A step 1. Documents the Mach + pthread + dyld
-> APIs the upcoming `SentoriThreadSampler.swift` will call, the App
-> Store review risk for each, and the privacy boundary. Written before
-> the Swift implementation lands so we can rule API choices in or out
-> before writing code we'd later need to rip out.
-
-## Why we need this
-
-`SentoriHangWatchdog.swift` currently captures
-`Thread.callStackSymbols` from the watchdog thread itself, not from
-main, because main is wedged when we want to sample it. The captured
-stack therefore points into our own timer machinery, which is useless
-for diagnosing the user's hang. (The file's own comment at line 100
-flags this as a stop-gap.)
-
-To get the actual wedged main-thread frames we have to walk a remote
-thread's frame pointer chain — main is alive but not running our
-code, so we resolve it via Mach + pthread APIs. This document checks
-those APIs against App Store Review Guideline 2.5.1 ("Apps must use
-only public APIs") before we commit to them.
-
-## API inventory
-
-### Public, App Store-safe
-
-| API | Header | Purpose | Risk |
-|---|---|---|---|
-| `pthread_main_np()` | `<pthread.h>` | bool: am I on main? Sanity-check before sampling. | none |
-| `pthread_self()` | `<pthread.h>` | get current pthread for `pthread_mach_thread_np`. | none |
-| `pthread_mach_thread_np(pthread_t)` | `<pthread.h>` | pthread → mach port. The `_np` suffix is Apple's mark for "non-portable extension"; it's a public API, just not POSIX-portable. | none |
-| `mach_task_self()` | `<mach/mach.h>` | this process's task port. We pass our own task only; we never look up another. | none |
-| `thread_get_state(thread, ARM_THREAD_STATE64, ...)` | `<mach/thread_act.h>` | read main thread's PC / FP / SP / LR. Same call sentry-cocoa, Firebase Crashlytics, and Bugsnag use. | low — public Mach API; reviewers expect to see it from crash-reporter SDKs. |
-| `vm_read_overwrite(self_task, addr, size, dst, ...)` | `<mach/vm_map.h>` | safe (no SIGSEGV) read of own-process memory. We restrict to `mach_task_self()` and small reads (each frame is two pointers). | low — public; flagged only when used to read other processes' memory. |
-| `_dyld_image_count()` / `_dyld_get_image_header()` / `_dyld_get_image_vmaddr_slide()` / `_dyld_get_image_uuid()` | `<mach-o/dyld.h>` | LC_UUID for dSYM matching, ASLR slide for offset calc. Public dyld API. | none |
-
-### Explicitly NOT used (private API risk)
-
-| API | Why we don't use it |
-|---|---|
-| `_pthread_main_thread_np` (underscore prefix) | private alias of `pthread_main_np()`; underscore prefix in Apple SDK = SPI, rejection-grade. |
-| `task_threads(other_task, ...)` cross-task | requires `task-port` entitlement and is reviewer-flagged. We only ever look at our own task. |
-| `task_for_pid` | gated by entitlement; not appropriate for our same-process use. |
-| `__platform_call_*` / `kdebug_trace` / signal hooking | private. |
-| `_dyld_register_func_for_*` introspection beyond UUID | not needed for stack walking. |
-
-## Why this is App Store safe
-
-Direct prior art shipping the same call set, no review issues:
-
-- **sentry-cocoa** — uses `thread_get_state` + `vm_read_overwrite` for
-  slow-frame and ANR sampling, in millions of apps.
-- **Firebase Crashlytics** — same primitives for ANR + hang capture.
-- **Bugsnag**, **Embrace** — likewise.
-- **Apple's MetricKit** (`MXCallStackTree`) walks call stacks via the
-  same public Darwin primitives. Apple themselves consume this
-  surface.
-
-Apple's stance: Review Guideline 2.5.1 forbids non-public APIs, but
-"non-public" means undocumented / underscore-prefixed / not in the
-public SDK. All calls in the public-safe table above are documented
-in Apple's developer reference and shipped in `<mach/...>` /
-`<pthread.h>` / `<mach-o/dyld.h>` headers that come with Xcode by
-default.
-
-## Privacy considerations
-
-What we capture per hang event:
-
-- Up to 64 PC values (program counter addresses) from the main
-  thread's frame pointer chain.
-- The `LC_UUID` of each loaded image and its ASLR vmaddr slide, so
-  the server can match PCs back to a dSYM (Phase 22 sub-B field).
-- Hang duration in milliseconds (already captured today).
-
-What we explicitly do NOT capture:
-
-- Other processes' memory. We only pass `mach_task_self()` to
-  `vm_read_overwrite`.
-- Function arguments, local variables, or register contents — PC
-  only, never the rest of the `arm_thread_state64_t` struct.
-- Heap content, NSString contents, user-typed text, PII.
-- Continuous-rate samples. Sampling fires only on a detected hang
-  (≥ 2s main-thread block) and is one-shot per hang (see watchdog
-  `reportedThisHang` flag at `SentoriHangWatchdog.swift:54`).
-
-Symbolication happens **server-side** against the uploaded dSYM
-(`server/src/symbolicate.rs`). On-device,
-`frames[].instructionAddress` is an ASLR-slid pointer with no
-semantic content until paired with the dSYM.
-
-For the user-facing privacy doc (what data Sentori collects and why),
-see `docs/legal/privacy.md`.
-
-## Rejection contingency
-
-If Apple Review ever rejects with reference to `vm_read_overwrite` or
-`thread_get_state`:
-
-1. Confirm sentry-cocoa / Firebase / Bugsnag are still shipping the
-   same call set. They're the canary; rejection there means a policy
-   change everyone needs to handle.
-2. Switch to `backtrace()` from `<execinfo.h>` — pure libc, walks
-   only the *current* thread, which is the watchdog thread, not
-   main. Lower fidelity (back where we started), zero risk.
-3. Last resort: ship without main-thread sampler; emit hang events
-   with empty `frames[]` and `tags.source = "sentori.hangWatchdog.no-sampler"`
-   so the dashboard can flag the gap. Feature degrades, doesn't
-   break.
-
-## Implementation references
-
-- `sdk/react-native/ios/SentoriThreadSampler.swift` — to be created in
-  Phase 29 sub-A step 2: `captureMainThreadFrames(maxFrames: Int = 64) -> [(pc: UInt64, fp: UInt64)]`
-- `sdk/react-native/ios/SentoriHangWatchdog.swift` — current
-  `Thread.callStackSymbols` capture (line 108) replaced by sampler
-  call in step 4.
-- `server/src/symbolicate.rs` — dSYM lookup + frame resolution
-  (existing, Phase 22 sub-B).
-- `docs/protocol.md` — `frames[].instructionAddress` + `debugId` +
-  `arch` field definitions (existing, Phase 22 sub-B).