@hot-updater/react-native 1.0.0-rc.1 → 1.0.0-rc.15

package/ios/HotUpdater/Internal/BundleMetadata.swift

@@ -84,6 +84,7 @@ public struct BundleMetadata: Codable {
     var stableSelection: PersistedSelection?
     var stagingSelection: PersistedSelection?
     var verificationPending: Bool
+    var launchInProgress: Bool
     var pendingTransition: PendingBundleTransition?
     var pendingSelectionTransition: PendingSelectionTransition?
     var highestSeenCatalogs: [String: CatalogHighWater]
@@ -98,6 +99,7 @@ public struct BundleMetadata: Codable {
         case stableSelection = "stable_selection"
         case stagingSelection = "staging_selection"
         case verificationPending = "verification_pending"
+        case launchInProgress = "launch_in_progress"
         case pendingTransition = "pending_transition"
         case pendingSelectionTransition = "pending_selection_transition"
         case highestSeenCatalogs = "highest_seen_catalogs"
@@ -113,6 +115,7 @@ public struct BundleMetadata: Codable {
         stableSelection: PersistedSelection? = nil,
         stagingSelection: PersistedSelection? = nil,
         verificationPending: Bool = false,
+        launchInProgress: Bool = false,
         pendingTransition: PendingBundleTransition? = nil,
         pendingSelectionTransition: PendingSelectionTransition? = nil,
         highestSeenCatalogs: [String: CatalogHighWater] = [:],
@@ -126,6 +129,7 @@ public struct BundleMetadata: Codable {
         self.stableSelection = stableSelection
         self.stagingSelection = stagingSelection
         self.verificationPending = verificationPending
+        self.launchInProgress = launchInProgress
         self.pendingTransition = pendingTransition
         self.pendingSelectionTransition = pendingSelectionTransition
         self.highestSeenCatalogs = highestSeenCatalogs
@@ -144,6 +148,7 @@ public struct BundleMetadata: Codable {
         stagingSelection = try values.decodeIfPresent(PersistedSelection.self, forKey: .stagingSelection)
             ?? stagingBundleId.map(PersistedSelection.legacyBundle)
         verificationPending = try values.decodeIfPresent(Bool.self, forKey: .verificationPending) ?? false
+        launchInProgress = try values.decodeIfPresent(Bool.self, forKey: .launchInProgress) ?? false
         pendingTransition = try values.decodeIfPresent(PendingBundleTransition.self, forKey: .pendingTransition)
         pendingSelectionTransition = try values.decodeIfPresent(PendingSelectionTransition.self, forKey: .pendingSelectionTransition)
         highestSeenCatalogs = try values.decodeIfPresent([String: CatalogHighWater].self, forKey: .highestSeenCatalogs) ?? [:]

package/ios/HotUpdater/Internal/FileUtilities.swift

@@ -0,0 +1,64 @@
+import Foundation
+
+enum FileUtilities {
+    static func readUpToCount(from handle: FileHandle, count: Int) throws -> Data? {
+        guard count >= 0 else {
+            throw NSError(
+                domain: "FileUtilities",
+                code: 1,
+                userInfo: [NSLocalizedDescriptionKey: "Invalid read size: \(count)"]
+            )
+        }
+
+        if count == 0 {
+            return Data()
+        }
+
+        if #available(macOS 10.15.4, iOS 13.4, watchOS 6.2, tvOS 13.4, *) {
+            return try handle.read(upToCount: count)
+        }
+
+        return handle.readData(ofLength: count)
+    }
+
+    static func normalizedRelativePath(from rawPath: String) -> String? {
+        let candidate = rawPath.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard !candidate.isEmpty,
+              !candidate.contains("\0"),
+              !candidate.contains("\\"),
+              !candidate.hasPrefix("/"),
+              candidate.range(of: #"^[A-Za-z]:"#, options: .regularExpression) == nil
+        else {
+            return nil
+        }
+
+        let components = candidate.split(separator: "/").map(String.init)
+        guard !components.isEmpty,
+              components.count == candidate.split(separator: "/", omittingEmptySubsequences: false).count,
+              !components.contains(".."),
+              !components.contains(".")
+        else {
+            return nil
+        }
+
+        return components.joined(separator: "/")
+    }
+
+    static func fileURL(for relativePath: String, destinationRoot: String) throws -> URL {
+        let rootURL = URL(fileURLWithPath: destinationRoot, isDirectory: true)
+        let targetURL = rootURL.appendingPathComponent(relativePath)
+        let standardizedRoot = rootURL.standardizedFileURL.path
+        let standardizedTarget = targetURL.standardizedFileURL.path
+
+        guard standardizedTarget == standardizedRoot ||
+                standardizedTarget.hasPrefix(standardizedRoot + "/") else {
+            throw NSError(
+                domain: "FileUtilities",
+                code: 2,
+                userInfo: [NSLocalizedDescriptionKey: "Path traversal attempt detected: \(relativePath)"]
+            )
+        }
+
+        return targetURL
+    }
+}

package/ios/HotUpdater/Internal/HotUpdater-Bridging-Header.h

@@ -7,7 +7,6 @@
 #import "React/RCTConstants.h"
 #import "React/RCTRootView.h"
 #import "React/RCTUtils.h" // Needed for RCTPromiseResolveBlock/RejectBlock in Swift
-#import <SSZipArchive/SSZipArchive.h>
 #import "BsdiffPatchBridge.h"
 
 @interface HotUpdaterRecoverySignalBridge : NSObject

package/ios/HotUpdater/Internal/HotUpdater.mm

@@ -274,8 +274,6 @@ extern "C" void *HotUpdaterCopyMinBundleId(void)
 
 
 // Define Notification names used for observing Swift Core
-NSNotificationName const HotUpdaterDownloadProgressUpdateNotification = @"HotUpdaterDownloadProgressUpdate";
-NSNotificationName const HotUpdaterDownloadDidFinishNotification = @"HotUpdaterDownloadDidFinish";
 NSNotificationName const HotUpdaterUpdateProgressDidChangeNotification = @"HotUpdaterUpdateProgressDidChange";
 
 @interface HotUpdaterRecoverySignalBridge : NSObject
@@ -300,8 +298,6 @@ NSNotificationName const HotUpdaterUpdateProgressDidChangeNotification = @"HotUp
 
 @implementation HotUpdater {
     bool hasListeners;
-    // Keep track of tasks ONLY for removing observers when this ObjC instance is invalidated
-    NSMutableSet<NSURLSessionTask *> *observedTasks; // Changed to NSURLSessionTask for broader compatibility if needed
 }
 
 @synthesize bridge = _bridge;
@@ -314,16 +310,10 @@ NSNotificationName const HotUpdaterUpdateProgressDidChangeNotification = @"HotUp
 - (instancetype)init {
     self = [super init];
     if (self) {
-        observedTasks = [NSMutableSet set];
-
         [[NSNotificationCenter defaultCenter] addObserver:self
                                                  selector:@selector(handleDownloadProgress:)
                                                      name:HotUpdaterUpdateProgressDidChangeNotification
                                                    object:nil];
-        [[NSNotificationCenter defaultCenter] addObserver:self
-                                                 selector:@selector(handleDownloadCompletion:)
-                                                     name:HotUpdaterDownloadDidFinishNotification
-                                                   object:nil];
 
         _lastUpdateTime = 0;
     }
@@ -349,7 +339,6 @@ NSNotificationName const HotUpdaterUpdateProgressDidChangeNotification = @"HotUp
     if (gHotUpdaterBridge == self.bridge) {
         gHotUpdaterBridge = nil;
     }
-    // Swift side should handle KVO observer removal for its tasks
     [super invalidate];
 }
 
@@ -520,14 +509,6 @@ RCT_EXPORT_MODULE();
      }
  }
 
-- (void)handleDownloadCompletion:(NSNotification *)notification {
-      NSURLSessionTask *task = notification.object; // Task that finished
-      RCTLogInfo(@"[HotUpdater.mm] Received download completion notification for task: %@", task.originalRequest.URL);
-      // Swift side handles KVO observer removal internally now when task finishes.
-      // No specific cleanup needed here based on this notification anymore.
-}
-
-
 #pragma mark - React Native Events (Keep as is)
 
 - (NSArray<NSString *> *)supportedEvents {
@@ -594,20 +575,17 @@ RCT_EXPORT_MODULE();
     if (params.bundleId()) {
         paramDict[@"bundleId"] = params.bundleId();
     }
-    if (params.fileUrl()) {
-        paramDict[@"fileUrl"] = params.fileUrl();
-    }
-    if (params.fileHash()) {
-        paramDict[@"fileHash"] = params.fileHash();
-    }
     if (params.manifestUrl()) {
         paramDict[@"manifestUrl"] = params.manifestUrl();
     }
     if (params.manifestFileHash()) {
         paramDict[@"manifestFileHash"] = params.manifestFileHash();
     }
-    if (params.changedAssets()) {
-        paramDict[@"changedAssets"] = params.changedAssets();
+    if (params.archiveUrl()) {
+        paramDict[@"archiveUrl"] = params.archiveUrl();
+    }
+    if (params.assets()) {
+        paramDict[@"assets"] = params.assets();
     }
     if (params.channel()) {
         paramDict[@"channel"] = params.channel();

package/ios/HotUpdater/Internal/HotUpdaterImpl.swift

@@ -17,6 +17,18 @@ private func hotUpdaterUpdateSignalLaunchStateSymbol(
 @_silgen_name("HotUpdaterPerformRecoveryReload")
 private func hotUpdaterPerformRecoveryReloadSymbol() -> ObjCBool
 
+@_silgen_name("HotUpdaterMarkFailedRuntime")
+private func hotUpdaterMarkFailedRuntime()
+
+@_silgen_name("HotUpdaterIsFailedRuntime")
+private func hotUpdaterIsFailedRuntime() -> ObjCBool
+
+@_silgen_name("HotUpdaterInstallRecoveryHooks")
+private func hotUpdaterInstallRecoveryHooks()
+
+@_silgen_name("HotUpdaterAfterSurfaceStarts")
+private func hotUpdaterAfterSurfaceStarts(_ action: @convention(block) @escaping () -> Void)
+
 @_silgen_name("HotUpdaterCopyMinBundleId")
 private func hotUpdaterCopyMinBundleIdSymbol() -> UnsafeMutableRawPointer
 
@@ -49,6 +61,21 @@ private func hotUpdaterGetMinBundleId() -> String {
     private static let DEFAULT_CHANNEL = "production"
     private static let CHANNEL_STORAGE_KEY = "HotUpdaterChannel"
 
+    private static func parseSafeByteSize(_ value: Any?) -> Int64? {
+        guard let number = value as? NSNumber,
+              String(cString: number.objCType) != "c" else {
+            return nil
+        }
+        let doubleValue = number.doubleValue
+        guard doubleValue.isFinite,
+              doubleValue >= 0,
+              doubleValue <= 9_007_199_254_740_991,
+              doubleValue.rounded(.towardZero) == doubleValue else {
+            return nil
+        }
+        return Int64(doubleValue)
+    }
+
     // MARK: - Initialization
 
     /**
@@ -59,12 +86,9 @@ private func hotUpdaterGetMinBundleId() -> String {
         let isolationKey = HotUpdaterImpl.getIsolationKey()
         let preferences = VersionedPreferencesService()
         let downloadService = URLSessionDownloadService()
-        let decompressService = DecompressService()
-
         let bundleStorage = BundleFileStorageService(
             fileSystem: fileSystem,
             downloadService: downloadService,
-            decompressService: decompressService,
             preferences: preferences,
             isolationKey: isolationKey,
             builtInBundleIdProvider: { HotUpdaterImpl.minBundleId() }
@@ -219,7 +243,7 @@ private func hotUpdaterGetMinBundleId() -> String {
     /**
      * Updates the bundle from JavaScript bridge.
      * This method acts as the primary error boundary for all bundle operations.
-     * @param params Dictionary with bundleId and fileUrl parameters
+     * @param params Dictionary with bundleId, manifest, and asset parameters
      * @param resolve Promise resolve callback
      * @param reject Promise reject callback
      */
@@ -243,36 +267,40 @@ private func hotUpdaterGetMinBundleId() -> String {
                 return
             }
 
-            let fileUrlString = data["fileUrl"] as? String ?? ""
-
-            var fileUrl: URL? = nil
-            if !fileUrlString.isEmpty {
-                guard let url = URL(string: fileUrlString) else {
-                    let error = NSError(domain: "HotUpdater", code: 0,
-                                       userInfo: [NSLocalizedDescriptionKey: "Invalid 'fileUrl' provided: \(fileUrlString)"])
-                    reject("INVALID_FILE_URL", error.localizedDescription, error)
-                    return
-                }
-                fileUrl = url
+            guard let manifestFileHash = data["manifestFileHash"] as? String,
+                  !manifestFileHash.isEmpty else {
+                let error = NSError(domain: "HotUpdater", code: 0,
+                                   userInfo: [NSLocalizedDescriptionKey: "Missing manifest file hash"])
+                reject("INVALID_MANIFEST", error.localizedDescription, error)
+                return
             }
-
-            // Extract fileHash if provided
-            let fileHash = data["fileHash"] as? String
-            let manifestFileHash = data["manifestFileHash"] as? String
             let channel = data["channel"] as? String
             let manifestUrlString = data["manifestUrl"] as? String ?? ""
-            var manifestUrl: URL? = nil
-            if !manifestUrlString.isEmpty {
-                guard let url = URL(string: manifestUrlString) else {
+            guard let manifestUrl = URL(string: manifestUrlString) else {
+                let error = NSError(domain: "HotUpdater", code: 0,
+                                   userInfo: [NSLocalizedDescriptionKey: "Invalid 'manifestUrl' provided: \(manifestUrlString)"])
+                reject("INVALID_FILE_URL", error.localizedDescription, error)
+                return
+            }
+            let archiveUrl: URL?
+            if let archiveUrlString = data["archiveUrl"] as? String {
+                guard let parsedArchiveUrl = URL(string: archiveUrlString) else {
                     let error = NSError(domain: "HotUpdater", code: 0,
-                                       userInfo: [NSLocalizedDescriptionKey: "Invalid 'manifestUrl' provided: \(manifestUrlString)"])
+                                       userInfo: [NSLocalizedDescriptionKey: "Invalid 'archiveUrl' provided: \(archiveUrlString)"])
                     reject("INVALID_FILE_URL", error.localizedDescription, error)
                     return
                 }
-                manifestUrl = url
+                archiveUrl = parsedArchiveUrl
+            } else {
+                archiveUrl = nil
             }
-            let changedAssetsPayload = data["changedAssets"] as? [String: [String: Any]]
-            let changedAssets = changedAssetsPayload?.reduce(into: [String: ChangedAssetDescriptor]()) { partialResult, entry in
+            guard let assetsPayload = data["assets"] as? [String: [String: Any]] else {
+                let error = NSError(domain: "HotUpdater", code: 0,
+                                   userInfo: [NSLocalizedDescriptionKey: "Missing manifest assets"])
+                reject("INVALID_MANIFEST", error.localizedDescription, error)
+                return
+            }
+            let assets = assetsPayload.reduce(into: [String: ChangedAssetDescriptor]()) { partialResult, entry in
                 guard let fileHash = entry.value["fileHash"] as? String,
                       !fileHash.isEmpty
                 else {
@@ -296,7 +324,8 @@ private func hotUpdaterGetMinBundleId() -> String {
                         baseBundleId: baseBundleId,
                         baseFileHash: baseFileHash,
                         patchFileHash: patchFileHash,
-                        patchUrl: patchUrl
+                        patchUrl: patchUrl,
+                        byteSize: Self.parseSafeByteSize(payload["byteSize"])
                     )
                 }
                 let filePayload = entry.value["file"] as? [String: Any]
@@ -327,10 +356,10 @@ private func hotUpdaterGetMinBundleId() -> String {
             // Extract progress callback if provided
             let progressCallback = data["progressCallback"] as? RCTResponseSenderBlock
 
-            NSLog("[HotUpdaterImpl] updateBundle called with bundleId: \(bundleId), fileUrl: \(fileUrl?.absoluteString ?? "nil"), fileHash: \(fileHash ?? "nil")")
+            NSLog("[HotUpdaterImpl] updateBundle called with bundleId: \(bundleId), manifestUrl: \(manifestUrl.absoluteString)")
 
             // Heavy work is delegated to bundle storage service with safe error handling
-            bundleStorage.updateBundle(bundleId: bundleId, fileUrl: fileUrl, fileHash: fileHash, manifestUrl: manifestUrl, manifestFileHash: manifestFileHash, changedAssets: changedAssets, progressHandler: { payload in
+            bundleStorage.updateBundle(bundleId: bundleId, manifestUrl: manifestUrl, manifestFileHash: manifestFileHash, archiveUrl: archiveUrl, assets: assets, progressHandler: { payload in
                 DispatchQueue.main.async {
                     NotificationCenter.default.post(
                         name: .updateProgressDidChange,
@@ -532,7 +561,6 @@ private func hotUpdaterGetMinBundleId() -> String {
         "DIRECTORY_CREATION_FAILED",
         "DOWNLOAD_FAILED",
         "INCOMPLETE_DOWNLOAD",
-        "EXTRACTION_FORMAT_ERROR",
         "INVALID_BUNDLE",
         "INSUFFICIENT_DISK_SPACE",
         "SIGNATURE_VERIFICATION_FAILED",
@@ -545,6 +573,11 @@ private func hotUpdaterGetMinBundleId() -> String {
     // MARK: - Rollback Support
 
     public func notifyAppReady() -> [String: Any] {
+        // A failed runtime can finish queued native calls while recovery starts.
+        // Keep its readiness loop from consuming the new launch's report.
+        if hotUpdaterIsFailedRuntime().boolValue {
+            return ["status": "PENDING"]
+        }
         return bundleStorage.notifyAppReady()
     }
 
@@ -597,7 +630,7 @@ private func hotUpdaterGetMinBundleId() -> String {
 
     /**
      * Gets the current active bundle ID from bundle storage.
-     * Reads manifest.json first and falls back to the legacy BUNDLE_ID file.
+     * Reads the required OTA manifest.json.
      * Built-in bundle fallback is handled in JS.
      */
     public func getBundleId() -> String? {
@@ -672,6 +705,7 @@ final class HotUpdaterRecoveryManager: NSObject {
     private var handlersInstalled = false
     private var isMonitoring = false
     private var recoveryRequested = false
+    private var monitoringGeneration = 0
     private var currentBundleId: String?
     private var shouldRollbackOnCrash = false
     private var contentAppearedCallback: ((String?) -> Void)?
@@ -709,6 +743,10 @@ final class HotUpdaterRecoveryManager: NSObject {
         shouldRollback: Bool,
         onContentAppeared: @escaping (String?) -> Void
     ) {
+        objc_sync_enter(self)
+        defer { objc_sync_exit(self) }
+
+        monitoringGeneration += 1
         currentBundleId = bundleId
         shouldRollbackOnCrash = shouldRollback
         recoveryRequested = false
@@ -719,6 +757,7 @@ final class HotUpdaterRecoveryManager: NSObject {
         stopMonitoringWorkItem = nil
 
         installHandlersIfNeeded()
+        hotUpdaterInstallRecoveryHooks()
         registerObservers()
         installSignalHandlersIfNeeded()
         hotUpdaterUpdateSignalLaunchState(bundleId, shouldRollback: shouldRollback)
@@ -726,9 +765,8 @@ final class HotUpdaterRecoveryManager: NSObject {
 
     func handleUncaughtException(_ exception: NSException) {
         writeCrashMarker()
-        if requestRecoveryReloadIfNeeded() {
-            return
-        }
+        // An uncaught native exception cannot safely continue in this process.
+        // Preserve the marker so the next launch can select the safe bundle.
         previousUncaughtExceptionHandler?(exception)
     }
 
@@ -742,16 +780,22 @@ final class HotUpdaterRecoveryManager: NSObject {
         previousUncaughtExceptionHandler = NSGetUncaughtExceptionHandler()
 
         RCTSetFatalHandler { [weak self] error in
-            self?.writeCrashMarker()
-            if self?.requestRecoveryReloadIfNeeded() != true {
-                self?.previousFatalHandler?(error)
+            guard !hotUpdaterIsFailedRuntime().boolValue else { return }
+            if self?.requestRecoveryReloadIfNeeded(onFailure: {
+                self?.forwardFatalError(error)
+            }) != true {
+                self?.writeCrashMarker()
+                self?.forwardFatalError(error)
             }
         }
 
         RCTSetFatalExceptionHandler { [weak self] exception in
-            self?.writeCrashMarker()
-            if self?.requestRecoveryReloadIfNeeded() != true {
-                self?.previousFatalExceptionHandler?(exception)
+            guard !hotUpdaterIsFailedRuntime().boolValue else { return }
+            if self?.requestRecoveryReloadIfNeeded(onFailure: {
+                self?.forwardFatalException(exception)
+            }) != true {
+                self?.writeCrashMarker()
+                self?.forwardFatalException(exception)
             }
         }
 
@@ -759,6 +803,33 @@ final class HotUpdaterRecoveryManager: NSObject {
         handlersInstalled = true
     }
 
+    private func forwardFatalError(_ error: Error?) {
+        if let previousFatalHandler {
+            previousFatalHandler(error)
+        } else {
+            let handler = RCTGetFatalHandler()
+            RCTSetFatalHandler(nil)
+            RCTFatal(error)
+            // React Native's DEBUG default handler can return.
+            if RCTGetFatalHandler() == nil {
+                RCTSetFatalHandler(handler)
+            }
+        }
+    }
+
+    private func forwardFatalException(_ exception: NSException?) {
+        if let previousFatalExceptionHandler {
+            previousFatalExceptionHandler(exception)
+        } else {
+            let handler = RCTGetFatalExceptionHandler()
+            RCTSetFatalExceptionHandler(nil)
+            RCTFatalException(exception)
+            if RCTGetFatalExceptionHandler() == nil {
+                RCTSetFatalExceptionHandler(handler)
+            }
+        }
+    }
+
     private func installSignalHandlersIfNeeded() {
         guard !signalHandlersInstalled else {
             return
@@ -777,7 +848,7 @@ final class HotUpdaterRecoveryManager: NSObject {
         unregisterObservers()
         NotificationCenter.default.addObserver(
             self,
-            selector: #selector(handleJavaScriptDidFailToLoad),
+            selector: #selector(handleJavaScriptDidFailToLoad(_:)),
             name: NSNotification.Name.RCTJavaScriptDidFailToLoad,
             object: nil
         )
@@ -802,15 +873,25 @@ final class HotUpdaterRecoveryManager: NSObject {
         )
     }
 
-    @objc private func handleJavaScriptDidFailToLoad() {
-        if requestRecoveryReloadIfNeeded() {
+    @objc private func handleJavaScriptDidFailToLoad(_ notification: Notification) {
+        let error = notification.userInfo?["error"] as? NSError ?? NSError(
+            domain: "HotUpdaterRecovery",
+            code: 1,
+            userInfo: [NSLocalizedDescriptionKey: "JavaScript bundle failed to load"]
+        )
+        if requestRecoveryReloadIfNeeded(onFailure: { [weak self] in
+            self?.forwardFatalError(error)
+        }) {
             return
         }
         unregisterObservers()
     }
 
     @objc private func handleContentDidAppear() {
-        guard isMonitoring else {
+        objc_sync_enter(self)
+        defer { objc_sync_exit(self) }
+
+        guard isMonitoring, !recoveryRequested else {
             return
         }
 
@@ -820,14 +901,19 @@ final class HotUpdaterRecoveryManager: NSObject {
         hotUpdaterUpdateSignalLaunchState(currentBundleId, shouldRollback: false)
 
         stopMonitoringWorkItem?.cancel()
+        let generation = monitoringGeneration
         let workItem = DispatchWorkItem { [weak self] in
-            self?.finishMonitoring()
+            self?.finishMonitoring(generation: generation)
         }
         stopMonitoringWorkItem = workItem
         DispatchQueue.main.asyncAfter(deadline: .now() + .seconds(10), execute: workItem)
     }
 
-    private func finishMonitoring() {
+    private func finishMonitoring(generation: Int) {
+        objc_sync_enter(self)
+        defer { objc_sync_exit(self) }
+        guard monitoringGeneration == generation else { return }
+
         isMonitoring = false
         recoveryRequested = false
         stopMonitoringWorkItem = nil
@@ -837,31 +923,40 @@ final class HotUpdaterRecoveryManager: NSObject {
         hotUpdaterUpdateSignalLaunchState(nil, shouldRollback: false)
     }
 
-    private func requestRecoveryReloadIfNeeded() -> Bool {
+    private func requestRecoveryReloadIfNeeded(onFailure: @escaping () -> Void) -> Bool {
+        objc_sync_enter(self)
+        defer { objc_sync_exit(self) }
+
         guard isMonitoring, shouldRollbackOnCrash else {
             return false
         }
 
-        objc_sync_enter(self)
+        hotUpdaterMarkFailedRuntime()
         if recoveryRequested {
-            objc_sync_exit(self)
             return true
         }
         recoveryRequested = true
-        objc_sync_exit(self)
+        writeCrashMarker()
 
         let bundleId = currentBundleId
-        DispatchQueue.main.async { [weak self] in
+        let generation = monitoringGeneration
+        hotUpdaterAfterSurfaceStarts { [weak self] in
             guard let self else {
                 return
             }
 
+            objc_sync_enter(self)
+            let isCurrentLaunch = self.monitoringGeneration == generation
+            objc_sync_exit(self)
+            guard isCurrentLaunch else { return }
+
             let started = hotUpdaterPerformRecoveryReload()
             if !started {
                 objc_sync_enter(self)
                 self.recoveryRequested = false
                 objc_sync_exit(self)
                 NSLog("[HotUpdaterRecovery] Failed to trigger recovery reload")
+                onFailure()
             } else {
                 NSLog("[HotUpdaterRecovery] Triggered recovery reload for bundleId=\(bundleId ?? "nil")")
             }
@@ -871,6 +966,9 @@ final class HotUpdaterRecoveryManager: NSObject {
     }
 
     private func writeCrashMarker() {
+        objc_sync_enter(self)
+        defer { objc_sync_exit(self) }
+
         guard isMonitoring else {
             return
         }

package/ios/HotUpdater/Internal/NotificationExtension.swift

@@ -1,7 +1,5 @@
 import Foundation
 
 extension Notification.Name {
-    static let downloadProgressUpdate = Notification.Name("HotUpdaterDownloadProgressUpdate")
-    static let downloadDidFinish = Notification.Name("HotUpdaterDownloadDidFinish")
     static let updateProgressDidChange = Notification.Name("HotUpdaterUpdateProgressDidChange")
 }