@hot-updater/react-native 0.36.17 → 0.36.19

package/android/build.gradle

@@ -146,6 +146,9 @@ dependencies {
   }
   implementation "org.jetbrains.kotlin:kotlin-stdlib:$kotlin_version"
   implementation "androidx.lifecycle:lifecycle-runtime-ktx:2.6.1"
+  // ProcessLifecycleOwner, for an activity that started before Hot Updater was created.
+  // React Native's AppCompat already brings it at runtime.
+  implementation "androidx.lifecycle:lifecycle-process:2.6.1"
   implementation "org.jetbrains.kotlinx:kotlinx-coroutines-core:1.7.3"
   implementation "org.jetbrains.kotlinx:kotlinx-coroutines-android:1.7.3"
   implementation "org.apache.commons:commons-compress:1.27.1"

package/android/src/main/java/com/hotupdater/ActivityStartGate.kt

@@ -0,0 +1,94 @@
+package com.hotupdater
+
+import android.app.Activity
+import android.app.Application
+import android.os.Bundle
+import androidx.lifecycle.Lifecycle
+import androidx.lifecycle.ProcessLifecycleOwner
+
+/**
+ * Runs an action once this process has a started activity.
+ *
+ * A headless JS task (HeadlessJsTaskService, which background push libraries
+ * start) loads the bundle with no activity and never renders. Waiting for an
+ * activity keeps that launch from counting as one that ended before its first
+ * render.
+ *
+ * Android does not replay lifecycle callbacks to a late registration. An
+ * activity that started before this gate existed, as when a brownfield app adds
+ * React Native to an activity already on screen, is read from
+ * [processHasStartedActivity] instead.
+ */
+internal class ActivityStartGate(
+    private val application: Application?,
+    private val processHasStartedActivity: () -> Boolean = ::hasStartedActivity,
+) : Application.ActivityLifecycleCallbacks {
+    private var startedActivities = 0
+    private var pendingAction: (() -> Unit)? = null
+
+    init {
+        application?.registerActivityLifecycleCallbacks(this)
+    }
+
+    /**
+     * Runs [action] now when an activity is started, otherwise at the next
+     * activity start. It replaces an action still waiting; null cancels it.
+     * Without an application to observe, it runs [action] now.
+     */
+    fun runWhenActivityStarted(action: (() -> Unit)?) {
+        val runNow =
+            synchronized(this) {
+                val waits =
+                    application != null &&
+                        startedActivities == 0 &&
+                        !processHasStartedActivity()
+                pendingAction = action.takeIf { waits }
+                action.takeUnless { waits }
+            }
+        runNow?.invoke()
+    }
+
+    override fun onActivityStarted(activity: Activity) {
+        val action =
+            synchronized(this) {
+                startedActivities += 1
+                pendingAction.also { pendingAction = null }
+            }
+        action?.invoke()
+    }
+
+    override fun onActivityStopped(activity: Activity) {
+        synchronized(this) {
+            // An activity started before this gate existed was never counted.
+            if (startedActivities > 0) startedActivities -= 1
+        }
+    }
+
+    override fun onActivityCreated(
+        activity: Activity,
+        savedInstanceState: Bundle?,
+    ) {}
+
+    override fun onActivityResumed(activity: Activity) {}
+
+    override fun onActivityPaused(activity: Activity) {}
+
+    override fun onActivitySaveInstanceState(
+        activity: Activity,
+        outState: Bundle,
+    ) {}
+
+    override fun onActivityDestroyed(activity: Activity) {}
+}
+
+// ProcessLifecycleOwner observes activities from process start, through the
+// androidx.startup initializer that lifecycle-process registers. It is STARTED
+// while an activity of this process is started, and stays at INITIALIZED when
+// an app removes that initializer, so the gate then waits for the next start.
+private fun hasStartedActivity(): Boolean =
+    runCatching {
+        ProcessLifecycleOwner
+            .get()
+            .lifecycle.currentState
+            .isAtLeast(Lifecycle.State.STARTED)
+    }.getOrDefault(false)

package/android/src/main/java/com/hotupdater/BundleFileStorageService.kt

@@ -98,6 +98,12 @@ interface BundleStorageService {
         progressCallback: (UpdateProgressPayload) -> Unit,
     )
 
+    /**
+     * Records that the current launch of a verification-pending bundle can show UI.
+     * The next process rolls the bundle back unless first content verified it.
+     */
+    fun markLaunchStarted(launchedBundleId: String?)
+
     /**
      * Marks the current launch as successful after the first content appeared.
      */
@@ -109,7 +115,8 @@ interface BundleStorageService {
     fun notifyAppReady(): Map<String, Any?>
 
     /**
-     * Gets the crashed bundle history
+     * Gets the crashed bundle history, plus a bundle that waits for its retry after
+     * an unfinished launch while this process still refuses it (see [InterruptedLaunch])
      * @return CrashedHistory containing crashed bundles
      */
     fun getCrashHistory(): CrashedHistory
@@ -488,6 +495,16 @@ class BundleFileStorageService(
     private var hasPreparedLaunch = false
     private var currentLaunchReport: LaunchReport? = null
 
+    // Crash history is written at first content on the main thread while JS can read it.
+    private val crashedHistoryLock = Any()
+
+    // markLaunchStarted runs at an activity start, which can come while JS stages a
+    // newer bundle; both read and rewrite metadata.
+    private val stagingMetadataLock = Any()
+
+    // A bundle waiting for its retry that this process keeps refusing, see InterruptedLaunch.
+    private var retryHeldBundleId: String? = null
+
     @Volatile
     private var activeBundleMetadataSnapshot: ActiveBundleMetadataSnapshot? = null
     private val activeBundleMetadataLock = Any()
@@ -936,7 +953,14 @@ class BundleFileStorageService(
         )
     }
 
-    private fun rollbackPendingBundle(stagingBundleId: String): Boolean {
+    /**
+     * Rolls back the pending staging bundle. [unfinishedLaunch] means its launch
+     * ended before first content without a crash marker.
+     */
+    private fun rollbackPendingBundle(
+        stagingBundleId: String,
+        unfinishedLaunch: Boolean = false,
+    ): Boolean {
         val metadata = loadMetadataOrNull() ?: return false
         if (metadata.stagingBundleId != stagingBundleId) {
             return false
@@ -944,9 +968,7 @@ class BundleFileStorageService(
 
         Log.w(TAG, "Rolling back crashed staging bundle: $stagingBundleId")
 
-        val crashedHistory = loadCrashedHistory()
-        crashedHistory.addEntry(stagingBundleId)
-        saveCrashedHistory(crashedHistory)
+        recordFailedLaunch(stagingBundleId, unfinishedLaunch)
 
         val fallbackBundleId =
             metadata.stableBundleId?.takeIf { candidate ->
@@ -1034,18 +1056,103 @@ class BundleFileStorageService(
 
     private fun saveCrashedHistory(history: CrashedHistory): Boolean = history.saveToFile(getCrashedHistoryFile())
 
-    private fun isBundleInCrashedHistory(bundleId: String): Boolean = loadCrashedHistory().contains(bundleId)
+    private fun isBundleInCrashedHistory(bundleId: String): Boolean = getCrashHistory().contains(bundleId)
 
-    override fun getCrashHistory(): CrashedHistory = loadCrashedHistory()
+    /**
+     * The bundles this device refuses to install: crash history, plus a bundle
+     * waiting for its retry until a process that may retry it.
+     */
+    override fun getCrashHistory(): CrashedHistory =
+        synchronized(crashedHistoryLock) {
+            val history = loadCrashedHistory()
+            val interrupted = history.interruptedLaunch
+            if (interrupted != null &&
+                (!interrupted.retryReady || interrupted.bundleId == retryHeldBundleId) &&
+                !history.contains(interrupted.bundleId)
+            ) {
+                history.bundles.add(CrashedBundleEntry(interrupted.bundleId, crashedAt = System.currentTimeMillis()))
+            }
+            history
+        }
 
     override fun clearCrashHistory(): Boolean {
-        val history = CrashedHistory()
-        saveCrashedHistory(history)
+        synchronized(crashedHistoryLock) {
+            saveCrashedHistory(CrashedHistory())
+            retryHeldBundleId = null
+        }
         Log.d(TAG, "Cleared crash history")
         return true
     }
 
+    /**
+     * A crash, or a second unfinished launch of the same bundle, adds the bundle to
+     * crash history. A first unfinished launch cannot tell a hang from a user leaving
+     * early, so it leaves the bundle one retry instead.
+     */
+    private fun recordFailedLaunch(
+        bundleId: String,
+        unfinishedLaunch: Boolean,
+    ) {
+        synchronized(crashedHistoryLock) {
+            val history = loadCrashedHistory()
+            val interrupted = history.interruptedLaunch
+            if (unfinishedLaunch && interrupted?.bundleId != bundleId) {
+                Log.w(TAG, "Launch of $bundleId ended before first content; it gets one retry")
+                history.interruptedLaunch = InterruptedLaunch(bundleId)
+                retryHeldBundleId = bundleId
+            } else {
+                history.addEntry(bundleId)
+                if (interrupted?.bundleId == bundleId) {
+                    history.interruptedLaunch = null
+                }
+            }
+            saveCrashedHistory(history)
+        }
+    }
+
+    /**
+     * First content appeared, so the app works again. A bundle waiting for its retry
+     * may be installed from the next process on. This process keeps refusing it, so
+     * the session that recovered never reloads into it. Content from that bundle
+     * verifies it.
+     */
+    private fun readyInterruptedLaunchRetry(currentBundleId: String?) {
+        synchronized(crashedHistoryLock) {
+            val history = loadCrashedHistory()
+            val interrupted = history.interruptedLaunch ?: return
+            if (interrupted.bundleId == currentBundleId) {
+                history.interruptedLaunch = null
+            } else if (interrupted.retryReady) {
+                return
+            } else {
+                history.interruptedLaunch = interrupted.copy(retryReady = true)
+                retryHeldBundleId = interrupted.bundleId
+            }
+            saveCrashedHistory(history)
+        }
+    }
+
+    private fun saveNewStagingMetadata(bundleId: String): BundleMetadata =
+        synchronized(stagingMetadataLock) {
+            val currentMetadata = loadMetadataOrNull() ?: createInitialMetadata()
+            prepareMetadataForNewStagingBundle(currentMetadata, bundleId).also { saveMetadata(it) }
+        }
+
+    override fun markLaunchStarted(launchedBundleId: String?) {
+        synchronized(stagingMetadataLock) {
+            val metadata = loadMetadataOrNull() ?: return
+            if (!isVerificationPending(metadata) ||
+                metadata.launchInProgress ||
+                metadata.stagingBundleId != launchedBundleId
+            ) {
+                return
+            }
+            saveMetadata(metadata.copy(launchInProgress = true))
+        }
+    }
+
     override fun markLaunchCompleted(currentBundleId: String?) {
+        readyInterruptedLaunchRetry(currentBundleId)
         val metadata = loadMetadataOrNull() ?: return
         val stagingBundleId = metadata.stagingBundleId ?: return
         if (!metadata.verificationPending || stagingBundleId != currentBundleId) {
@@ -1115,17 +1222,13 @@ class BundleFileStorageService(
         if (!hasPreparedLaunch) {
             val metadata = loadMetadataOrNull()
             if (metadata?.verificationPending == true && metadata.launchInProgress) {
-                metadata.stagingBundleId?.let { rollbackPendingBundle(it) }
+                metadata.stagingBundleId?.let { rollbackPendingBundle(it, unfinishedLaunch = true) }
             }
         }
         hasPreparedLaunch = true
 
+        // A launch is recorded only once it can show UI (markLaunchStarted).
         val selection = selectLaunch()
-        if (selection.shouldRollbackOnCrash) {
-            loadMetadataOrNull()?.let { metadata ->
-                saveMetadata(metadata.copy(launchInProgress = true))
-            }
-        }
         Log.d(
             TAG,
             "prepareLaunch: bundleId=${selection.launchedBundleId} shouldRollback=${selection.shouldRollbackOnCrash} url=${selection.bundleUrl}",
@@ -1204,9 +1307,7 @@ class BundleFileStorageService(
                 finalBundleDir.setLastModified(System.currentTimeMillis())
 
                 // Update metadata: set as staging
-                val currentMetadata = loadMetadataOrNull() ?: createInitialMetadata()
-                val updatedMetadata = prepareMetadataForNewStagingBundle(currentMetadata, bundleId)
-                saveMetadata(updatedMetadata)
+                val updatedMetadata = saveNewStagingMetadata(bundleId)
 
                 // Set bundle URL for backwards compatibility
                 setBundleURL(existingBundleFile.absolutePath)
@@ -1437,9 +1538,7 @@ class BundleFileStorageService(
                     Log.d(TAG, "Setting bundle as staging: $bundlePath")
 
                     // Update metadata: set new bundle as staging
-                    val currentMetadata = loadMetadataOrNull() ?: createInitialMetadata()
-                    val updatedMetadata = prepareMetadataForNewStagingBundle(currentMetadata, bundleId)
-                    saveMetadata(updatedMetadata)
+                    val updatedMetadata = saveNewStagingMetadata(bundleId)
 
                     // Also update HotUpdaterBundleURL for backwards compatibility
                     // This will point to the staging bundle that will be loaded
@@ -1800,9 +1899,7 @@ class BundleFileStorageService(
 
             finalBundleDir.setLastModified(System.currentTimeMillis())
 
-            val currentMetadata = loadMetadataOrNull() ?: createInitialMetadata()
-            val updatedMetadata = prepareMetadataForNewStagingBundle(currentMetadata, bundleId)
-            saveMetadata(updatedMetadata)
+            val updatedMetadata = saveNewStagingMetadata(bundleId)
             setBundleURL(finalIndexFile.absolutePath)
 
             tempDir.deleteRecursively()

package/android/src/main/java/com/hotupdater/BundleMetadata.kt

@@ -129,12 +129,48 @@ data class CrashedBundleEntry(
         }
 }
 
+/**
+ * A bundle whose launch ended before first content without a crash, waiting
+ * for its one retry. Such a launch cannot tell a hang from a user leaving
+ * early, so the bundle is offered again instead of entering crash history.
+ * A second unfinished launch of it adds it there.
+ *
+ * [retryReady] turns true once a later launch shows content. The retry
+ * starts with the next process, so the session that recovered never reloads
+ * into the same bundle.
+ */
+data class InterruptedLaunch(
+    val bundleId: String,
+    val retryReady: Boolean = false,
+) {
+    companion object {
+        fun fromJson(json: JSONObject): InterruptedLaunch? =
+            if (json.isNull("bundleId")) {
+                null
+            } else {
+                json.getString("bundleId").takeIf { it.isNotEmpty() }?.let { bundleId ->
+                    InterruptedLaunch(
+                        bundleId = bundleId,
+                        retryReady = json.optBoolean("retryReady", false),
+                    )
+                }
+            }
+    }
+
+    fun toJson(): JSONObject =
+        JSONObject().apply {
+            put("bundleId", bundleId)
+            put("retryReady", retryReady)
+        }
+}
+
 /**
  * History of crashed bundles
  */
 data class CrashedHistory(
     val bundles: MutableList<CrashedBundleEntry> = mutableListOf(),
     val maxHistorySize: Int = DEFAULT_MAX_HISTORY_SIZE,
+    var interruptedLaunch: InterruptedLaunch? = null,
 ) {
     companion object {
         private const val TAG = "CrashedHistory"
@@ -150,6 +186,7 @@ data class CrashedHistory(
             return CrashedHistory(
                 bundles = bundles,
                 maxHistorySize = json.optInt("maxHistorySize", DEFAULT_MAX_HISTORY_SIZE),
+                interruptedLaunch = json.optJSONObject("interruptedLaunch")?.let(InterruptedLaunch::fromJson),
             )
         }
 
@@ -175,6 +212,7 @@ data class CrashedHistory(
             bundles.forEach { bundlesArray.put(it.toJson()) }
             put("bundles", bundlesArray)
             put("maxHistorySize", maxHistorySize)
+            interruptedLaunch?.let { put("interruptedLaunch", it.toJson()) }
         }
 
     fun saveToFile(file: File): Boolean =
@@ -222,6 +260,7 @@ data class CrashedHistory(
 
     fun clear() {
         bundles.clear()
+        interruptedLaunch = null
     }
 }
 

package/android/src/main/java/com/hotupdater/HotUpdaterImpl.kt

@@ -1,6 +1,7 @@
 package com.hotupdater
 
 import android.app.ActivityOptions
+import android.app.Application
 import android.content.Context
 import android.content.Intent
 import android.os.Process
@@ -16,6 +17,7 @@ class HotUpdaterImpl {
     private val bundleStorage: BundleStorageService
     private val preferences: PreferencesService
     private val recoveryManager: HotUpdaterRecoveryManager
+    private val activityStartGate: ActivityStartGate
     private var currentLaunchSelection: LaunchSelection? = null
 
     /**
@@ -29,6 +31,7 @@ class HotUpdaterImpl {
         this.context = context.applicationContext
         this.bundleStorage = bundleStorage
         this.preferences = preferences
+        this.activityStartGate = ActivityStartGate(this.context as? Application)
         this.recoveryManager = HotUpdaterRecoveryManager(this.context)
     }
 
@@ -439,6 +442,16 @@ class HotUpdaterImpl {
 
         val pendingRecovery = recoveryManager.consumePendingCrashRecovery()
         val selection = bundleStorage.prepareLaunch(pendingRecovery)
+        // A headless JS task, such as a background push, loads the bundle without
+        // an activity and never renders. Only a launch with an activity may leave
+        // an unfinished launch for the next process to roll back.
+        activityStartGate.runWhenActivityStarted(
+            if (selection.shouldRollbackOnCrash) {
+                { bundleStorage.markLaunchStarted(selection.launchedBundleId) }
+            } else {
+                null
+            },
+        )
         recoveryManager.startMonitoring(
             bundleId = selection.launchedBundleId,
             shouldRollback = selection.shouldRollbackOnCrash,

package/android/src/test/java/com/hotupdater/ActivityStartGateTest.kt

@@ -0,0 +1,118 @@
+package com.hotupdater
+
+import android.app.Activity
+import android.app.Application
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class ActivityStartGateTest {
+    private val activity = Activity()
+
+    @Test
+    fun `headless launch waits for the first activity start`() {
+        val application = RecordingApplication()
+        val gate = createGate(application)
+        var runs = 0
+
+        gate.runWhenActivityStarted { runs += 1 }
+        assertEquals(0, runs)
+
+        application.startActivity()
+        application.startActivity()
+        assertEquals(1, runs)
+    }
+
+    @Test
+    fun `launch with a started activity runs at once`() {
+        val application = RecordingApplication()
+        val gate = createGate(application)
+        var runs = 0
+
+        application.startActivity()
+        gate.runWhenActivityStarted { runs += 1 }
+        assertEquals(1, runs)
+    }
+
+    @Test
+    fun `stopped activity waits for the next start`() {
+        val application = RecordingApplication()
+        val gate = createGate(application)
+        var runs = 0
+
+        application.startActivity()
+        application.stopActivity()
+        gate.runWhenActivityStarted { runs += 1 }
+        assertEquals(0, runs)
+
+        application.startActivity()
+        assertEquals(1, runs)
+    }
+
+    @Test
+    fun `stop of an activity started before the gate keeps later starts counted`() {
+        val application = RecordingApplication()
+        val gate = createGate(application)
+        var runs = 0
+
+        application.stopActivity()
+        application.startActivity()
+        gate.runWhenActivityStarted { runs += 1 }
+
+        assertEquals(1, runs)
+    }
+
+    @Test
+    fun `next launch replaces or cancels the waiting one`() {
+        val application = RecordingApplication()
+        val gate = createGate(application)
+        val runs = mutableListOf<String>()
+
+        gate.runWhenActivityStarted { runs += "first" }
+        gate.runWhenActivityStarted { runs += "reload" }
+        application.startActivity()
+        application.stopActivity()
+        gate.runWhenActivityStarted { runs += "verified" }
+        gate.runWhenActivityStarted(null)
+        application.startActivity()
+
+        assertEquals(listOf("reload"), runs)
+    }
+
+    @Test
+    fun `activity started before the gate runs at once`() {
+        // A brownfield app adds React Native to an activity already on screen,
+        // and Android does not replay that start to a late registration.
+        val application = RecordingApplication()
+        var runs = 0
+
+        createGate(application, startedBefore = true).runWhenActivityStarted { runs += 1 }
+
+        assertEquals(1, runs)
+    }
+
+    @Test
+    fun `runs at once without an application to observe`() {
+        var runs = 0
+
+        createGate(null).runWhenActivityStarted { runs += 1 }
+
+        assertEquals(1, runs)
+    }
+
+    private fun createGate(
+        application: Application?,
+        startedBefore: Boolean = false,
+    ) = ActivityStartGate(application) { startedBefore }
+
+    private inner class RecordingApplication : Application() {
+        private val callbacks = mutableListOf<ActivityLifecycleCallbacks>()
+
+        override fun registerActivityLifecycleCallbacks(callback: ActivityLifecycleCallbacks) {
+            callbacks += callback
+        }
+
+        fun startActivity() = callbacks.forEach { it.onActivityStarted(activity) }
+
+        fun stopActivity() = callbacks.forEach { it.onActivityStopped(activity) }
+    }
+}

package/android/src/test/java/com/hotupdater/BundleFileStorageServiceTest.kt

@@ -68,6 +68,7 @@ class BundleFileStorageServiceTest {
         val firstLaunch = firstProcess.prepareLaunch(null)
         assertEquals("hung-bundle", firstLaunch.launchedBundleId)
         assertTrue(firstLaunch.shouldRollbackOnCrash)
+        firstProcess.markLaunchStarted("hung-bundle")
 
         assertEquals("hung-bundle", firstProcess.prepareLaunch(null).launchedBundleId)
         assertFalse(firstProcess.getCrashHistory().contains("hung-bundle"))
@@ -88,6 +89,224 @@ class BundleFileStorageServiceTest {
         assertEquals(nextLaunch.launchedBundleId, thirdProcess.prepareLaunch(null).launchedBundleId)
     }
 
+    @Test
+    fun `headless staging launch stays pending on the next cold start`() {
+        val rootDir = temporaryFolder.newFolder()
+        val preferences = InMemoryPreferencesService()
+        listOf("stable-bundle", "staged-bundle").forEach { bundleId ->
+            val directory = createBundleDir(rootDir, bundleId)
+            writeFile(directory, "index.android.bundle")
+            writeManifest(directory, listOf("index.android.bundle"))
+        }
+        writeMetadata(
+            rootDir,
+            BundleMetadata(
+                isolationKey = TEST_ISOLATION_KEY,
+                stableBundleId = "stable-bundle",
+                stagingBundleId = "staged-bundle",
+                verificationPending = true,
+            ),
+        )
+        // Issue #1468: a headless JS task (a background FCM message) prepares the
+        // launch without an activity, so first content never appears.
+        val headlessLaunch = createService(rootDir, preferences).prepareLaunch(null)
+        assertEquals("staged-bundle", headlessLaunch.launchedBundleId)
+        assertTrue(headlessLaunch.shouldRollbackOnCrash)
+
+        // The OS reclaims the cached process, then the user opens the app.
+        val nextProcess = createService(rootDir, preferences)
+        val nextLaunch = nextProcess.prepareLaunch(null)
+        assertEquals("staged-bundle", nextLaunch.launchedBundleId)
+        assertTrue(nextLaunch.shouldRollbackOnCrash)
+        assertFalse(nextProcess.getCrashHistory().contains("staged-bundle"))
+        assertEquals("STABLE", nextProcess.notifyAppReady()["status"])
+    }
+
+    @Test
+    fun `launch start records only the pending staged bundle`() {
+        val rootDir = temporaryFolder.newFolder()
+        val preferences = InMemoryPreferencesService()
+        listOf("stable-bundle", "staged-bundle").forEach { bundleId ->
+            val directory = createBundleDir(rootDir, bundleId)
+            writeFile(directory, "index.android.bundle")
+            writeManifest(directory, listOf("index.android.bundle"))
+        }
+        writeMetadata(
+            rootDir,
+            BundleMetadata(
+                isolationKey = TEST_ISOLATION_KEY,
+                stableBundleId = "stable-bundle",
+                stagingBundleId = "staged-bundle",
+                verificationPending = true,
+            ),
+        )
+        val process = createService(rootDir, preferences)
+        process.prepareLaunch(null)
+
+        // The activity can start after JS staged another bundle, or after first
+        // content already verified this one.
+        process.markLaunchStarted("stable-bundle")
+        assertFalse(loadMetadata(rootDir)!!.launchInProgress)
+        process.markLaunchCompleted("staged-bundle")
+        process.markLaunchStarted("staged-bundle")
+        assertFalse(loadMetadata(rootDir)!!.launchInProgress)
+
+        val nextLaunch = createService(rootDir, preferences).prepareLaunch(null)
+        assertEquals("staged-bundle", nextLaunch.launchedBundleId)
+        assertFalse(nextLaunch.shouldRollbackOnCrash)
+    }
+
+    // Issue #1469: a launch that ends before first content without a crash marker
+    // may be a user leaving early rather than a hang.
+    @Test
+    fun `unfinished launch retries the bundle once before crash history`() =
+        runBlocking {
+            val rootDir = temporaryFolder.newFolder()
+            val preferences = InMemoryPreferencesService()
+            leaveUnfinishedLaunch(rootDir, preferences)
+
+            // The next process still rolls back at once and reports RECOVERED.
+            val recovered = createService(rootDir, preferences)
+            assertEquals("stable-bundle", recovered.prepareLaunch(null).launchedBundleId)
+            assertEquals("RECOVERED", recovered.notifyAppReady()["status"])
+            assertFalse(loadCrashedHistory(rootDir).contains("retried-bundle"))
+            assertEquals(InterruptedLaunch("retried-bundle"), loadCrashedHistory(rootDir).interruptedLaunch)
+            // The session that recovered refuses the bundle, even after first content.
+            recovered.markLaunchCompleted("stable-bundle")
+            assertTrue(recovered.getCrashHistory().contains("retried-bundle"))
+            assertEquals("BUNDLE_IN_CRASHED_HISTORY", updateError(recovered, "retried-bundle")?.code)
+
+            // A later process may install it again.
+            val retrying = createService(rootDir, preferences)
+            assertEquals("stable-bundle", retrying.prepareLaunch(null).launchedBundleId)
+            assertFalse(retrying.getCrashHistory().contains("retried-bundle"))
+            stageRetriedBundle(rootDir)
+
+            // The retry ends before first content too: now crash history keeps it.
+            val retryLaunch = createService(rootDir, preferences)
+            assertEquals("retried-bundle", retryLaunch.prepareLaunch(null).launchedBundleId)
+            retryLaunch.markLaunchStarted("retried-bundle")
+            val next = createService(rootDir, preferences)
+            assertEquals("stable-bundle", next.prepareLaunch(null).launchedBundleId)
+            assertEquals("RECOVERED", next.notifyAppReady()["status"])
+            assertTrue(loadCrashedHistory(rootDir).contains("retried-bundle"))
+            assertNull(loadCrashedHistory(rootDir).interruptedLaunch)
+            next.markLaunchCompleted("stable-bundle")
+            val later = createService(rootDir, preferences)
+            later.prepareLaunch(null)
+            assertEquals("BUNDLE_IN_CRASHED_HISTORY", updateError(later, "retried-bundle")?.code)
+        }
+
+    @Test
+    fun `retried bundle that reaches first content is verified`() {
+        val rootDir = temporaryFolder.newFolder()
+        val preferences = InMemoryPreferencesService()
+        leaveUnfinishedLaunch(rootDir, preferences)
+        val recovered = createService(rootDir, preferences)
+        recovered.prepareLaunch(null)
+        recovered.markLaunchCompleted("stable-bundle")
+        createService(rootDir, preferences).prepareLaunch(null)
+        stageRetriedBundle(rootDir)
+
+        val retryLaunch = createService(rootDir, preferences)
+        assertEquals("retried-bundle", retryLaunch.prepareLaunch(null).launchedBundleId)
+        retryLaunch.markLaunchCompleted("retried-bundle")
+
+        assertTrue(loadCrashedHistory(rootDir).bundles.isEmpty())
+        assertNull(loadCrashedHistory(rootDir).interruptedLaunch)
+        val next = createService(rootDir, preferences).prepareLaunch(null)
+        assertEquals("retried-bundle", next.launchedBundleId)
+        assertFalse(next.shouldRollbackOnCrash)
+    }
+
+    @Test
+    fun `retry waits for a session that showed content`() {
+        val rootDir = temporaryFolder.newFolder()
+        val preferences = InMemoryPreferencesService()
+        leaveUnfinishedLaunch(rootDir, preferences)
+
+        // A headless process consumes the unfinished launch and never renders.
+        val headless = createService(rootDir, preferences)
+        assertEquals("stable-bundle", headless.prepareLaunch(null).launchedBundleId)
+        assertTrue(headless.getCrashHistory().contains("retried-bundle"))
+
+        // The user's next open is the first session that recovered.
+        val opened = createService(rootDir, preferences)
+        opened.prepareLaunch(null)
+        assertTrue(opened.getCrashHistory().contains("retried-bundle"))
+        opened.markLaunchCompleted("stable-bundle")
+        assertTrue(opened.getCrashHistory().contains("retried-bundle"))
+
+        val later = createService(rootDir, preferences)
+        later.prepareLaunch(null)
+        assertFalse(later.getCrashHistory().contains("retried-bundle"))
+    }
+
+    @Test
+    fun `retry readies after content from the built-in bundle`() {
+        val rootDir = temporaryFolder.newFolder()
+        val preferences = InMemoryPreferencesService()
+        leaveUnfinishedLaunch(rootDir, preferences, stableBundleId = null)
+        val recovered = createService(rootDir, preferences)
+        recovered.prepareLaunch(null)
+
+        // First content of the built-in bundle reports no bundle ID.
+        recovered.markLaunchCompleted(null)
+
+        val later = createService(rootDir, preferences)
+        later.prepareLaunch(null)
+        assertFalse(later.getCrashHistory().contains("retried-bundle"))
+    }
+
+    @Test
+    fun `crash of a retried bundle adds it to crash history`() {
+        val rootDir = temporaryFolder.newFolder()
+        val preferences = InMemoryPreferencesService()
+        leaveUnfinishedLaunch(rootDir, preferences)
+        val recovered = createService(rootDir, preferences)
+        recovered.prepareLaunch(null)
+        recovered.markLaunchCompleted("stable-bundle")
+        createService(rootDir, preferences).prepareLaunch(null)
+        stageRetriedBundle(rootDir)
+        assertEquals("retried-bundle", createService(rootDir, preferences).prepareLaunch(null).launchedBundleId)
+
+        // That launch crashed before first content and left a crash marker.
+        val next =
+            createService(rootDir, preferences)
+                .prepareLaunch(PendingCrashRecovery(launchedBundleId = "retried-bundle", shouldRollback = true))
+
+        assertEquals("stable-bundle", next.launchedBundleId)
+        assertTrue(loadCrashedHistory(rootDir).contains("retried-bundle"))
+        assertNull(loadCrashedHistory(rootDir).interruptedLaunch)
+    }
+
+    @Test
+    fun `clearing crash history drops a waiting retry`() {
+        val rootDir = temporaryFolder.newFolder()
+        val preferences = InMemoryPreferencesService()
+        leaveUnfinishedLaunch(rootDir, preferences)
+        val recovered = createService(rootDir, preferences)
+        recovered.prepareLaunch(null)
+
+        assertTrue(recovered.clearCrashHistory())
+
+        assertFalse(recovered.getCrashHistory().contains("retried-bundle"))
+        assertNull(loadCrashedHistory(rootDir).interruptedLaunch)
+    }
+
+    @Test
+    fun `malformed retry record keeps crash history`() {
+        val rootDir = temporaryFolder.newFolder()
+        File(bundleStoreDir(rootDir), CrashedHistory.CRASHED_HISTORY_FILENAME).writeText(
+            """{"bundles":[{"bundleId":"crashed-bundle","crashedAt":1}],"maxHistorySize":10,"interruptedLaunch":{}}""",
+        )
+
+        val history = createService(rootDir).getCrashHistory()
+
+        assertEquals(listOf("crashed-bundle"), history.bundles.map { it.bundleId })
+        assertNull(history.interruptedLaunch)
+    }
+
     @Test
     fun `resolveBundleFile uses single manifest bundle at root`() {
         val rootDir = temporaryFolder.newFolder("root-manifest-bundle")
@@ -458,6 +677,60 @@ class BundleFileStorageServiceTest {
             TEST_ISOLATION_KEY,
         )
 
+    private fun loadCrashedHistory(rootDir: File): CrashedHistory =
+        CrashedHistory.loadFromFile(File(bundleStoreDir(rootDir), CrashedHistory.CRASHED_HISTORY_FILENAME))
+
+    // Stages retried-bundle over stable-bundle, or over the built-in bundle, and
+    // leaves a launch of it that ended before first content.
+    private fun leaveUnfinishedLaunch(
+        rootDir: File,
+        preferences: InMemoryPreferencesService,
+        stableBundleId: String? = "stable-bundle",
+    ) {
+        listOfNotNull(stableBundleId, "retried-bundle").forEach { bundleId ->
+            val directory = createBundleDir(rootDir, bundleId)
+            writeFile(directory, "index.android.bundle")
+            writeManifest(directory, listOf("index.android.bundle"))
+        }
+        writeMetadata(
+            rootDir,
+            BundleMetadata(
+                isolationKey = TEST_ISOLATION_KEY,
+                stableBundleId = stableBundleId,
+                stagingBundleId = "retried-bundle",
+                verificationPending = true,
+            ),
+        )
+        val launch = createService(rootDir, preferences)
+        assertEquals("retried-bundle", launch.prepareLaunch(null).launchedBundleId)
+        launch.markLaunchStarted("retried-bundle")
+    }
+
+    // What an install of retried-bundle over the recovered stable bundle leaves.
+    private fun stageRetriedBundle(rootDir: File) {
+        val directory = createBundleDir(rootDir, "retried-bundle")
+        writeFile(directory, "index.android.bundle")
+        writeManifest(directory, listOf("index.android.bundle"))
+        writeMetadata(
+            rootDir,
+            BundleMetadata(
+                isolationKey = TEST_ISOLATION_KEY,
+                stableBundleId = "stable-bundle",
+                stagingBundleId = "retried-bundle",
+                verificationPending = true,
+            ),
+        )
+    }
+
+    // The crash history check runs before any download.
+    private suspend fun updateError(
+        service: BundleFileStorageService,
+        bundleId: String,
+    ): HotUpdaterException? =
+        runCatching {
+            service.updateBundle(bundleId, "https://example.com/$bundleId.zip", null, null, null, null) {}
+        }.exceptionOrNull() as? HotUpdaterException
+
     private fun writeFile(
         rootDir: File,
         relativePath: String,

package/android/src/test/java/com/hotupdater/HotUpdaterImplTest.kt

@@ -185,6 +185,8 @@ class HotUpdaterImplTest {
             progressCallback: (UpdateProgressPayload) -> Unit,
         ) = Unit
 
+        override fun markLaunchStarted(launchedBundleId: String?) = Unit
+
         override fun markLaunchCompleted(currentBundleId: String?) = Unit
 
         override fun notifyAppReady(): Map<String, Any?> = mapOf("status" to "STABLE")

package/ios/HotUpdater/Internal/BundleFileStorageService.swift

@@ -277,6 +277,7 @@ public protocol BundleStorageService {
     func updateBundle(bundleId: String, fileUrl: URL?, fileHash: String?, manifestUrl: URL?, manifestFileHash: String?, changedAssets: [String: ChangedAssetDescriptor]?, progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<Bool, Error>) -> Void)
 
     // Rollback support
+    func markLaunchStarted(bundleId: String?)
     func markLaunchCompleted(bundleId: String?)
     func notifyAppReady() -> [String: Any]
     func getCrashHistory() -> CrashedHistory
@@ -351,6 +352,13 @@ class BundleFileStorageService: BundleStorageService {
 
     private var hasPreparedLaunch = false
     private var currentLaunchReport: LaunchReport?
+    // Crash history is written at first content on the main thread while JavaScript can read it.
+    private let crashedHistoryLock = NSLock()
+    // A bundle waiting for its retry that this process keeps refusing, see InterruptedLaunch.
+    private var retryHeldBundleId: String?
+    // markLaunchStarted can run when the app enters the foreground while JavaScript
+    // stages a newer bundle; both read and rewrite metadata.
+    private let stagingMetadataLock = NSLock()
     private let activeBundleMetadataLock = NSLock()
     private var activeBundleMetadataSnapshot: ActiveBundleMetadataSnapshot?
 
@@ -1128,15 +1136,15 @@ class BundleFileStorageService: BundleStorageService {
         )
     }
 
+    /// Rolls back the pending staging bundle. `unfinishedLaunch` means its launch
+    /// ended before first content without a crash marker.
     @discardableResult
-    private func rollbackPendingBundle(_ stagingId: String) -> Bool {
+    private func rollbackPendingBundle(_ stagingId: String, unfinishedLaunch: Bool = false) -> Bool {
         guard var metadata = loadMetadataOrNull(), metadata.stagingBundleId == stagingId else {
             return false
         }
 
-        var crashedHistory = loadCrashedHistory()
-        crashedHistory.addEntry(stagingId)
-        let _ = saveCrashedHistory(crashedHistory)
+        recordFailedLaunch(stagingId, unfinishedLaunch: unfinishedLaunch)
 
         let fallbackBundleId = metadata.stableBundleId.flatMap { candidate in
             if case .success(let storeDir) = bundleStoreDir() {
@@ -1617,15 +1625,11 @@ class BundleFileStorageService: BundleStorageService {
            metadata.verificationPending,
            metadata.launchInProgress,
            let stagingBundleId = metadata.stagingBundleId {
-            rollbackPendingBundle(stagingBundleId)
+            rollbackPendingBundle(stagingBundleId, unfinishedLaunch: true)
         }
         hasPreparedLaunch = true
-        let selection = selectLaunch(bundle: bundle)
-        if selection.shouldRollbackOnCrash, var metadata = loadMetadataOrNull() {
-            metadata.launchInProgress = true
-            _ = saveMetadata(metadata)
-        }
-        return selection
+        // A launch is recorded only once it can show UI (markLaunchStarted).
+        return selectLaunch(bundle: bundle)
     }
     
     // MARK: - Bundle Update
@@ -1640,8 +1644,7 @@ class BundleFileStorageService: BundleStorageService {
      */
     func updateBundle(bundleId: String, fileUrl: URL?, fileHash: String?, manifestUrl: URL?, manifestFileHash: String?, changedAssets: [String: ChangedAssetDescriptor]?, progressHandler: @escaping (UpdateProgressPayload) -> Void, completion: @escaping (Result<Bool, Error>) -> Void) {
         // Check if bundle is in crashed history
-        let crashedHistory = loadCrashedHistory()
-        if crashedHistory.contains(bundleId) {
+        if getCrashHistory().contains(bundleId) {
             NSLog("[BundleStorage] Bundle '\(bundleId)' is in crashed history, rejecting update")
             completion(.failure(BundleStorageError.bundleInCrashedHistory(bundleId)))
             return
@@ -1699,9 +1702,7 @@ class BundleFileStorageService: BundleStorageService {
                         let setResult = self.setBundleURL(localPath: bundlePath)
                         switch setResult {
                         case .success:
-                            let currentMetadata = self.loadMetadataOrNull() ?? self.createInitialMetadata()
-                            let updatedMetadata = self.prepareMetadataForNewStagingBundle(currentMetadata, bundleId: bundleId)
-                            let _ = self.saveMetadata(updatedMetadata)
+                            let updatedMetadata = self.saveNewStagingMetadata(bundleId)
                             NSLog("[BundleStorage] Set staging bundle (cached): \(bundleId), verificationPending: true")
 
                             self.emitArchiveProgress(
@@ -2131,9 +2132,7 @@ class BundleFileStorageService: BundleStorageService {
                 )
                 switch self.setBundleURL(localPath: finalBundlePath) {
                 case .success:
-                    let currentMetadata = self.loadMetadataOrNull() ?? self.createInitialMetadata()
-                    let updatedMetadata = self.prepareMetadataForNewStagingBundle(currentMetadata, bundleId: bundleId)
-                    let _ = self.saveMetadata(updatedMetadata)
+                    let updatedMetadata = self.saveNewStagingMetadata(bundleId)
                     self.cleanupTemporaryFiles([tempDirectory])
                     self.scheduleCleanupOldBundles(
                         bundleIdsToKeep: [currentBundleId, updatedMetadata.stableBundleId, bundleId].compactMap { $0 }
@@ -2469,9 +2468,7 @@ class BundleFileStorageService: BundleStorageService {
                         NSLog("[BundleStorage] Successfully set bundle URL: \(finalBundlePath)")
 
                         // 13) Set staging metadata for rollback support
-                        let currentMetadata = self.loadMetadataOrNull() ?? self.createInitialMetadata()
-                        let updatedMetadata = self.prepareMetadataForNewStagingBundle(currentMetadata, bundleId: bundleId)
-                        let _ = self.saveMetadata(updatedMetadata)
+                        let updatedMetadata = self.saveNewStagingMetadata(bundleId)
                         NSLog("[BundleStorage] Set staging bundle: \(bundleId), verificationPending: true")
 
                         // 14) Clean up the temporary directory
@@ -2542,7 +2539,32 @@ class BundleFileStorageService: BundleStorageService {
     /**
      * Marks the current launch as successful after the first content appeared.
      */
+    private func saveNewStagingMetadata(_ bundleId: String) -> BundleMetadata {
+        stagingMetadataLock.lock()
+        defer { stagingMetadataLock.unlock() }
+        let currentMetadata = loadMetadataOrNull() ?? createInitialMetadata()
+        let updatedMetadata = prepareMetadataForNewStagingBundle(currentMetadata, bundleId: bundleId)
+        _ = saveMetadata(updatedMetadata)
+        return updatedMetadata
+    }
+
+    func markLaunchStarted(bundleId: String?) {
+        stagingMetadataLock.lock()
+        defer { stagingMetadataLock.unlock() }
+        guard let bundleId,
+              var metadata = loadMetadataOrNull(),
+              metadata.verificationPending,
+              !metadata.launchInProgress,
+              metadata.stagingBundleId == bundleId else {
+            return
+        }
+        metadata.launchInProgress = true
+        _ = saveMetadata(metadata)
+    }
+
     func markLaunchCompleted(bundleId: String?) {
+        // Before the guard: content from the built-in bundle (nil) also counts.
+        readyInterruptedLaunchRetry(bundleId)
         guard let bundleId,
               var metadata = loadMetadataOrNull(),
               metadata.verificationPending,
@@ -2569,11 +2591,20 @@ class BundleFileStorageService: BundleStorageService {
     }
 
     /**
-     * Returns the crashed bundle history.
+     * Returns the bundles this device refuses to install: crash history, plus a
+     * bundle waiting for its retry until a process that may retry it.
      * @return The crashed history object
      */
     func getCrashHistory() -> CrashedHistory {
-        return loadCrashedHistory()
+        crashedHistoryLock.lock()
+        defer { crashedHistoryLock.unlock() }
+        var history = loadCrashedHistory()
+        if let interrupted = history.interruptedLaunch,
+           !interrupted.retryReady || interrupted.bundleId == retryHeldBundleId,
+           !history.contains(interrupted.bundleId) {
+            history.bundles.append(CrashedBundleEntry(bundleId: interrupted.bundleId))
+        }
+        return history
     }
 
     /**
@@ -2581,11 +2612,57 @@ class BundleFileStorageService: BundleStorageService {
      * @return true if clearing was successful
      */
     func clearCrashHistory() -> Bool {
+        crashedHistoryLock.lock()
+        defer { crashedHistoryLock.unlock() }
         var history = loadCrashedHistory()
         history.clear()
+        retryHeldBundleId = nil
         return saveCrashedHistory(history)
     }
 
+    /// A crash, or a second unfinished launch of the same bundle, adds the bundle
+    /// to crash history. A first unfinished launch cannot tell a hang from a user
+    /// leaving early, so it leaves the bundle one retry instead.
+    private func recordFailedLaunch(_ bundleId: String, unfinishedLaunch: Bool) {
+        crashedHistoryLock.lock()
+        defer { crashedHistoryLock.unlock() }
+        var history = loadCrashedHistory()
+        let interrupted = history.interruptedLaunch
+        if unfinishedLaunch, interrupted?.bundleId != bundleId {
+            NSLog("[BundleStorage] Launch of \(bundleId) ended before first content; it gets one retry")
+            history.interruptedLaunch = InterruptedLaunch(bundleId: bundleId)
+            retryHeldBundleId = bundleId
+        } else {
+            history.addEntry(bundleId)
+            if interrupted?.bundleId == bundleId {
+                history.interruptedLaunch = nil
+            }
+        }
+        _ = saveCrashedHistory(history)
+    }
+
+    /// First content appeared, so the app works again. A bundle waiting for its
+    /// retry may be installed from the next process on. This process keeps
+    /// refusing it, so the session that recovered never reloads into it. Content
+    /// from that bundle verifies it.
+    private func readyInterruptedLaunchRetry(_ currentBundleId: String?) {
+        crashedHistoryLock.lock()
+        defer { crashedHistoryLock.unlock() }
+        var history = loadCrashedHistory()
+        guard let interrupted = history.interruptedLaunch else {
+            return
+        }
+        if interrupted.bundleId == currentBundleId {
+            history.interruptedLaunch = nil
+        } else if interrupted.retryReady {
+            return
+        } else {
+            history.interruptedLaunch?.retryReady = true
+            retryHeldBundleId = interrupted.bundleId
+        }
+        _ = saveCrashedHistory(history)
+    }
+
     /**
      * Gets the base URL for the current active bundle directory
      * Returns the file:// URL to the bundle directory without trailing slash

package/ios/HotUpdater/Internal/BundleMetadata.swift

@@ -120,6 +120,37 @@ public struct CrashedBundleEntry: Codable {
     }
 }
 
+// MARK: - InterruptedLaunch
+
+/// A bundle whose launch ended before first content without a crash, waiting
+/// for its one retry. Such a launch cannot tell a hang from a user leaving
+/// early, so the bundle is offered again instead of entering crash history.
+/// A second unfinished launch of it adds it there.
+///
+/// `retryReady` turns true once a later launch shows content. The retry starts
+/// with the next process, so the session that recovered never reloads into the
+/// same bundle.
+public struct InterruptedLaunch: Codable {
+    let bundleId: String
+    var retryReady: Bool
+
+    enum CodingKeys: String, CodingKey {
+        case bundleId
+        case retryReady
+    }
+
+    init(bundleId: String, retryReady: Bool = false) {
+        self.bundleId = bundleId
+        self.retryReady = retryReady
+    }
+
+    public init(from decoder: Decoder) throws {
+        let values = try decoder.container(keyedBy: CodingKeys.self)
+        bundleId = try values.decode(String.self, forKey: .bundleId)
+        retryReady = try values.decodeIfPresent(Bool.self, forKey: .retryReady) ?? false
+    }
+}
+
 // MARK: - CrashedHistory
 
 /// History of crashed bundles
@@ -129,10 +160,30 @@ public struct CrashedHistory: Codable {
 
     var bundles: [CrashedBundleEntry]
     var maxHistorySize: Int
+    var interruptedLaunch: InterruptedLaunch?
+
+    enum CodingKeys: String, CodingKey {
+        case bundles
+        case maxHistorySize
+        case interruptedLaunch
+    }
 
-    init(bundles: [CrashedBundleEntry] = [], maxHistorySize: Int = CrashedHistory.defaultMaxHistorySize) {
+    init(
+        bundles: [CrashedBundleEntry] = [],
+        maxHistorySize: Int = CrashedHistory.defaultMaxHistorySize,
+        interruptedLaunch: InterruptedLaunch? = nil
+    ) {
         self.bundles = bundles
         self.maxHistorySize = maxHistorySize
+        self.interruptedLaunch = interruptedLaunch
+    }
+
+    public init(from decoder: Decoder) throws {
+        let values = try decoder.container(keyedBy: CodingKeys.self)
+        bundles = try values.decode([CrashedBundleEntry].self, forKey: .bundles)
+        maxHistorySize = try values.decode(Int.self, forKey: .maxHistorySize)
+        // A malformed retry record must not drop the crash history.
+        interruptedLaunch = try? values.decodeIfPresent(InterruptedLaunch.self, forKey: .interruptedLaunch)
     }
 
     static func load(from file: URL) -> CrashedHistory {
@@ -196,6 +247,7 @@ public struct CrashedHistory: Codable {
 
     mutating func clear() {
         bundles.removeAll()
+        interruptedLaunch = nil
     }
 }
 

package/ios/HotUpdater/Internal/HotUpdaterImpl.swift

@@ -1,5 +1,6 @@
 import Foundation
 import React
+import UIKit
 
 private func hotUpdaterUncaughtExceptionHandler(_ exception: NSException) {
     HotUpdaterRecoveryManager.shared.handleUncaughtException(exception)
@@ -35,6 +36,7 @@ private func hotUpdaterPerformRecoveryReload() -> Bool {
     private let cohortService: CohortService
     private let recoveryManager: HotUpdaterRecoveryManager
     private var currentLaunchSelection: LaunchSelection?
+    private var launchStartObservers: [NSObjectProtocol] = []
 
     private static let DEFAULT_CHANNEL = "production"
     private static let CHANNEL_STORAGE_KEY = "HotUpdaterChannel"
@@ -482,12 +484,49 @@ private func hotUpdaterPerformRecoveryReload() -> Bool {
 
         let pendingRecovery = recoveryManager.consumePendingCrashRecovery()
         let selection = bundleStorage.prepareLaunch(bundle: bundle, pendingRecovery: pendingRecovery)
+        markLaunchStartedInForeground(selection)
         recoveryManager.startMonitoring(bundleId: selection.launchedBundleId, shouldRollback: selection.shouldRollbackOnCrash) { [weak self] launchedBundleId in
             self?.bundleStorage.markLaunchCompleted(bundleId: launchedBundleId)
         }
         currentLaunchSelection = selection
         return selection
     }
+
+    // A background launch, such as a silent push, may never render. Only a
+    // launch in the foreground may leave an unfinished launch for the next
+    // process to roll back.
+    private func markLaunchStartedInForeground(_ selection: LaunchSelection) {
+        let bundleId = selection.shouldRollbackOnCrash ? selection.launchedBundleId : nil
+        let mark = { [weak self] in
+            guard let self else { return }
+            self.removeLaunchStartObservers()
+            guard let bundleId else { return }
+            guard UIApplication.shared.applicationState == .background else {
+                self.bundleStorage.markLaunchStarted(bundleId: bundleId)
+                return
+            }
+            self.launchStartObservers = [
+                UIApplication.willEnterForegroundNotification,
+                UIApplication.didBecomeActiveNotification,
+            ].map { name in
+                NotificationCenter.default.addObserver(forName: name, object: nil, queue: .main) { [weak self] _ in
+                    self?.removeLaunchStartObservers()
+                    self?.bundleStorage.markLaunchStarted(bundleId: bundleId)
+                }
+            }
+        }
+        // UIApplication is read on the main thread.
+        if Thread.isMainThread {
+            mark()
+        } else {
+            DispatchQueue.main.async(execute: mark)
+        }
+    }
+
+    private func removeLaunchStartObservers() {
+        launchStartObservers.forEach { NotificationCenter.default.removeObserver($0) }
+        launchStartObservers = []
+    }
 }
 
 @objcMembers

package/ios/HotUpdater/Internal/URLSessionDownloadService.swift

@@ -26,6 +26,32 @@ protocol DownloadService {
 enum DownloadError: Error {
     case incompleteDownload(expected: Int64, actual: Int64)
     case invalidContentLength
+
+    /// The size of the file a successful response leaves, or nil when the
+    /// response does not tell. A 206 answers a range: when the system resumes
+    /// an interrupted background download, `expectedContentLength` counts
+    /// only the resumed range while the file holds every byte, so the size is
+    /// the total in `Content-Range: bytes <first>-<last>/<total>`.
+    static func expectedFileSize(for response: URLResponse?) -> Int64? {
+        if let httpResponse = response as? HTTPURLResponse,
+           httpResponse.statusCode == 206 {
+            guard let contentRange = httpResponse.value(forHTTPHeaderField: "Content-Range"),
+                  let separator = contentRange.lastIndex(of: "/"),
+                  let total = Int64(
+                      contentRange[contentRange.index(after: separator)...]
+                          .trimmingCharacters(in: .whitespaces)
+                  ),
+                  total > 0 else {
+                return nil
+            }
+            return total
+        }
+        guard let expectedContentLength = response?.expectedContentLength,
+              expectedContentLength > 0 else {
+            return nil
+        }
+        return expectedContentLength
+    }
 }
 
 // Task state for persistence and recovery
@@ -161,7 +187,7 @@ extension URLSessionDownloadService: URLSessionDownloadDelegate {
         }
 
         // Verify file size
-        let expectedSize = downloadTask.response?.expectedContentLength ?? -1
+        let expectedSize = DownloadError.expectedFileSize(for: downloadTask.response)
         let actualSize: Int64?
         do {
             let attributes = try FileManager.default.attributesOfItem(atPath: location.path)
@@ -171,7 +197,7 @@ extension URLSessionDownloadService: URLSessionDownloadDelegate {
             actualSize = nil
         }
 
-        if expectedSize > 0, let actualSize = actualSize, actualSize != expectedSize {
+        if let expectedSize, let actualSize, actualSize != expectedSize {
             NSLog("[DownloadService] Download incomplete: \(actualSize) / \(expectedSize) bytes")
             // Delete incomplete file
             try? FileManager.default.removeItem(at: location)

package/lib/commonjs/sdkVersion.js

@@ -4,5 +4,5 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.HOT_UPDATER_SDK_VERSION = void 0;
-const HOT_UPDATER_SDK_VERSION = exports.HOT_UPDATER_SDK_VERSION = "0.36.17";
+const HOT_UPDATER_SDK_VERSION = exports.HOT_UPDATER_SDK_VERSION = "0.36.19";
 //# sourceMappingURL=sdkVersion.js.map

package/lib/module/sdkVersion.js

@@ -1,4 +1,4 @@
 "use strict";
 
-export const HOT_UPDATER_SDK_VERSION = "0.36.17";
+export const HOT_UPDATER_SDK_VERSION = "0.36.19";
 //# sourceMappingURL=sdkVersion.js.map

package/lib/typescript/commonjs/sdkVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const HOT_UPDATER_SDK_VERSION = "0.36.17";
+export declare const HOT_UPDATER_SDK_VERSION = "0.36.19";
 //# sourceMappingURL=sdkVersion.d.ts.map

package/lib/typescript/module/sdkVersion.d.ts

@@ -1,2 +1,2 @@
-export declare const HOT_UPDATER_SDK_VERSION = "0.36.17";
+export declare const HOT_UPDATER_SDK_VERSION = "0.36.19";
 //# sourceMappingURL=sdkVersion.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hot-updater/react-native",
-  "version": "0.36.17",
+  "version": "0.36.19",
   "description": "React Native OTA solution for self-hosted",
   "source": "./src/index.ts",
   "main": "./lib/commonjs/index.js",
@@ -131,14 +131,14 @@
     "react-native-builder-bob": "0.41.0",
     "@typescript/native": "npm:typescript@^7.0.2",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "hot-updater": "0.36.17"
+    "hot-updater": "0.36.19"
   },
   "dependencies": {
     "use-sync-external-store": "1.5.0",
-    "@hot-updater/cli-tools": "0.36.17",
-    "@hot-updater/core": "0.36.17",
-    "@hot-updater/plugin-core": "0.36.17",
-    "@hot-updater/js": "0.36.17"
+    "@hot-updater/cli-tools": "0.36.19",
+    "@hot-updater/core": "0.36.19",
+    "@hot-updater/js": "0.36.19",
+    "@hot-updater/plugin-core": "0.36.19"
   },
   "scripts": {
     "build": "node ./scripts/sync-sdk-version.mjs run -- bob build && tsc -p plugin/tsconfig.build.json",

package/src/sdkVersion.ts

@@ -1 +1 @@
-export const HOT_UPDATER_SDK_VERSION = "0.36.17";
+export const HOT_UPDATER_SDK_VERSION = "0.36.19";