@hot-updater/react-native 1.1.0 → 1.1.2

package/android/src/main/java/com/hotupdater/ActivityStartGate.kt

@@ -200,7 +200,7 @@ internal class ActivityStartGate(
 // androidx.startup initializer that lifecycle-process registers. It is STARTED
 // while an activity of this process is started, and stays at INITIALIZED when
 // an app removes that initializer, so the gate then waits for the next start.
-private fun hasStartedActivity(): Boolean =
+internal fun hasStartedActivity(): Boolean =
     runCatching {
         ProcessLifecycleOwner
             .get()

package/android/src/main/java/com/hotupdater/HotUpdaterImpl.kt

@@ -29,6 +29,9 @@ class HotUpdaterImpl {
     private val installIdentity: InstallIdentityService
     private val keyValueStorage: KeyValueStorageService
 
+    // Main's update check at the launch after a crash; null for a named instance.
+    private val postCrashUpdateCheck: PostCrashUpdateCheck?
+
     // Read by native update checks on other threads while React Native sets it.
     @Volatile
     private var currentLaunchSelection: LaunchSelection? = null
@@ -70,6 +73,11 @@ class HotUpdaterImpl {
     /**
      * @param activityStartGate the gate that arms this instance's launch;
      * by default one that waits for a started activity showing one of its views
+     * @param postCrashUpdateCheck main's check after a crash, over its
+     * key-value store; by default one with main's native checker
+     * @param isDevelopmentBuild a debug build, where a crash is a RedBox
+     * during development, never a reason to check for a fix: main records no
+     * crash after its grace period and has no check after a crash
      */
     internal constructor(
         context: Context,
@@ -77,6 +85,8 @@ class HotUpdaterImpl {
         preferences: PreferencesService,
         environment: HotUpdaterInstanceEnvironment,
         activityStartGate: ActivityStartGate? = null,
+        postCrashUpdateCheck: ((KeyValueStorageService) -> PostCrashUpdateCheck)? = null,
+        isDevelopmentBuild: Boolean = BuildConfig.DEBUG,
     ) {
         this.context = context.applicationContext
         // An activity started before this process followed activities is
@@ -85,12 +95,19 @@ class HotUpdaterImpl {
         this.environment = environment
         this.bundleStorage = bundleStorage
         this.preferences = preferences
-        this.recoveryManager = HotUpdaterRecoveryManager(this.context, environment)
+        this.recoveryManager =
+            HotUpdaterRecoveryManager(this.context, environment, recordsCrashesAfterContent = !isDevelopmentBuild)
         this.activityStartGate = activityStartGate ?: createActivityStartGate(this.context, environment)
         this.releaseCatalogCache =
             ReleaseCatalogCacheService(environment.releaseCatalogCacheDirectory(this.context))
         this.installIdentity = InstallIdentityService.create(this.context)
         this.keyValueStorage = KeyValueStorageService(environment.keyValueStorageFile(this.context))
+        this.postCrashUpdateCheck =
+            if (environment.isMain && !isDevelopmentBuild) {
+                (postCrashUpdateCheck ?: ::createPostCrashUpdateCheck)(keyValueStorage)
+            } else {
+                null
+            }
     }
 
     /**
@@ -103,14 +120,36 @@ class HotUpdaterImpl {
         context: Context,
         environment: HotUpdaterInstanceEnvironment,
         activityStartGate: ActivityStartGate? = null,
+        postCrashUpdateCheck: ((KeyValueStorageService) -> PostCrashUpdateCheck)? = null,
+        isDevelopmentBuild: Boolean = BuildConfig.DEBUG,
     ) : this(
         context = context,
         bundleStorage = createBundleStorage(context, environment),
         preferences = createPreferences(context, environment),
         environment = environment,
         activityStartGate = activityStartGate,
+        postCrashUpdateCheck = postCrashUpdateCheck,
+        isDevelopmentBuild = isDevelopmentBuild,
     )
 
+    /**
+     * Checks with main's native checker, the one its native API and resetChannel
+     * share, once a started activity of any kind shows UI: a headless launch,
+     * such as a background push, leaves the check for a launch the user sees.
+     * Its gate is created only when a check is due, so a process without one
+     * follows no activities for it ([postCrashUiGate]).
+     */
+    private fun createPostCrashUpdateCheck(storage: KeyValueStorageService): PostCrashUpdateCheck =
+        PostCrashUpdateCheck(
+            getItem = storage::getItem,
+            setItem = storage::setItem,
+            whenUiShown = { action -> postCrashUiGate(context as? Application).runWhenActivityStarted(action) },
+            check = { request ->
+                NativeUpdateCheck.checker(context, HotUpdaterInstanceEnvironment.MAIN_NAME) { this }.checkForUpdate(request)
+            },
+            isRestartProcess = { HotUpdaterProcess.isRestartProcess(context) },
+        )
+
     /**
      * Gets the app version
      * @param context Application context
@@ -190,6 +229,26 @@ class HotUpdaterImpl {
             )
         }
 
+        /**
+         * The gate of the check after a crash: any started activity counts.
+         * Created that late, it misses the start of an activity already
+         * shown, so it also counts the ones the process has seen started;
+         * an app without the ProcessLifecycleOwner initializer would
+         * otherwise wait for another activity to start.
+         */
+        internal fun postCrashUiGate(
+            application: Application?,
+            attribution: HotUpdaterRecoveryAttribution = HotUpdaterRecoveryAttribution.shared,
+            processLifecycleStarted: () -> Boolean = ::hasStartedActivity,
+            mainThread: HotUpdaterMainThread = HotUpdaterMainThread.android,
+        ): ActivityStartGate =
+            ActivityStartGate(
+                application,
+                processHasStartedActivity = { processLifecycleStarted() || attribution.startedActivities().isNotEmpty() },
+                showsReactView = { true },
+                mainThread = mainThread,
+            )
+
         /**
          * The activities already started that a gate created now checks for
          * the instance's view: a named instance's, while main counts any
@@ -303,7 +362,10 @@ class HotUpdaterImpl {
         if (HotUpdaterProcess.isRestartProcess(context)) {
             return bundleStorage.getFallbackBundleURL()
         }
-        return prepareLaunchIfNeeded().bundleUrl
+        val bundleUrl = prepareLaunchIfNeeded().bundleUrl
+        // Outside the launch's locks, after any rollback its preparation made.
+        postCrashUpdateCheck?.startIfPending()
+        return bundleUrl
     }
 
     /**
@@ -546,7 +608,7 @@ class HotUpdaterImpl {
                 return@synchronized launchSelection.launchedBundleId
             }
 
-            bundleStorage.settlePreviousLaunch { recoveryManager.consumePendingCrashRecovery() }
+            bundleStorage.settlePreviousLaunch { consumePendingCrashRecovery() }
             bundleStorage.peekLaunchBundleId()
         }
 
@@ -627,8 +689,33 @@ class HotUpdaterImpl {
             current.bundleUrl == next.bundleUrl &&
             (current.shouldRollbackOnCrash || !next.shouldRollbackOnCrash)
 
+    /**
+     * Keeps a native check's request the server answered for main's check
+     * after a crash, as JavaScript's checks do; an app that checks only
+     * natively has no other. Nothing for a named instance or in a debug
+     * build, which have no such check.
+     */
+    internal fun recordRecoveryRequest(request: NativeCheckRequest) {
+        if (postCrashUpdateCheck == null) return
+        keyValueStorage.setItem(RecoveryCheckConfig.KEY, RecoveryCheckConfig.of(request).toJson())
+    }
+
+    /**
+     * Reads and deletes the crash marker the previous launch left. One that
+     * doesn't ask to roll back means the bundle that crashed runs again, so
+     * main checks for a fix natively once a launch shows UI
+     * ([PostCrashUpdateCheck]); recorded before this launch goes on, as the
+     * marker is already gone. One that asks to roll back is settled locally,
+     * with any check an earlier crash left pending: the restored bundle
+     * passed its own first content.
+     */
+    private fun consumePendingCrashRecovery(): PendingCrashRecovery? =
+        recoveryManager.consumePendingCrashRecovery()?.also {
+            if (it.shouldRollback) postCrashUpdateCheck?.clearPending() else postCrashUpdateCheck?.markPending()
+        }
+
     private fun selectAndMonitorLaunchLocked(): PreparedLaunch {
-        val pendingRecovery = recoveryManager.consumePendingCrashRecovery()
+        val pendingRecovery = consumePendingCrashRecovery()
         val selection = bundleStorage.prepareLaunch(pendingRecovery)
         monitoredLaunch?.let { (current, launch) ->
             if (!environment.isMain && continuesLaunch(current, selection) && recoveryManager.monitorsLaunch(launch)) {

package/android/src/main/java/com/hotupdater/HotUpdaterRecoveryAttribution.kt

@@ -60,7 +60,8 @@ internal class HotUpdaterRecoveryAttribution(
             } else {
                 rootViewsIn(decorView).map { rootView ->
                     val runtime = runCatching { rootView.currentReactContext }.getOrNull()
-                    HotUpdaterDecorRoots.Root(rootView.rootViewTag, runCatching { runtime?.sourceURL }.getOrNull(), runtime)
+                    // A call, not `rootViewTag`: Kotlin 2.2 has no property for a getter the Kotlin `ReactRoot` declares.
+                    HotUpdaterDecorRoots.Root(rootView.getRootViewTag(), runCatching { runtime?.sourceURL }.getOrNull(), runtime)
                 }
             }
         }

package/android/src/main/java/com/hotupdater/HotUpdaterRecoveryManager.kt

@@ -38,6 +38,9 @@ internal class HotUpdaterRecoveryManager(
     context: Context,
     environment: HotUpdaterInstanceEnvironment = HotUpdaterInstanceEnvironment.main,
     private val mainThread: HotUpdaterMainThread = HotUpdaterMainThread.android,
+    // Main keeps recording crashes after its grace period ([stopMonitoring]);
+    // a debug build doesn't, as a RedBox is no reason to check for a fix.
+    private val recordsCrashesAfterContent: Boolean = true,
 ) {
     private val appContext = context.applicationContext
     private val name = environment.name
@@ -253,19 +256,32 @@ internal class HotUpdaterRecoveryManager(
         }
     }
 
-    /** Ends the grace period of the launch of [generation], unless a newer launch started. */
+    /**
+     * Ends the grace period of the launch of [generation], unless a newer
+     * launch started. Main's verified launch stays live for the rest of the
+     * process: a later crash still writes its marker, which never asks to
+     * roll back but tells the next launch to check for a fix natively, since
+     * the bundle's own update check may be what crashes.
+     */
     private fun stopMonitoring(generation: Long) {
         synchronized(lock) {
             if (generation != this.generation) return
             stopTask = null
             releaseRecoveryWatchdog()
-            Log.d(TAG, "Stopping crash monitoring for current launch of $name")
-            launchState.stop()
             contentAppearedCallback = null
             crashOfAnotherInstanceCallback = null
             recoveryRestartCallback = null
             runtimeActivityCallback = null
             chargedCallback = null
+            if (isMain && recordsCrashesAfterContent && launchState.hasContentAppeared()) {
+                // The hooks installed on main's host stay, and the native
+                // slot keeps the verified bundle.
+                Log.d(TAG, "Stopping crash monitoring for current launch of $name; later crashes are still recorded")
+                updateNativeLaunchStateLocked()
+                return
+            }
+            Log.d(TAG, "Stopping crash monitoring for current launch of $name")
+            launchState.stop()
             liveManagers.remove(name, this)
             updateNativeLaunchStateLocked()
         }
@@ -543,7 +559,9 @@ internal class HotUpdaterRecoveryManager(
             crashMarkerFile.absolutePath,
             launch?.bundleId,
             launch?.unverified == true || (charged && launch?.shouldRollback == true),
-            isMain,
+            // A debug build's main records no crash after its grace period,
+            // a signal included.
+            isMain && recordsCrashesAfterContent,
         )
     }
 
@@ -689,7 +707,11 @@ internal class HotUpdaterRecoveryManager(
         private val attribution: HotUpdaterRecoveryAttribution
             get() = HotUpdaterRecoveryAttribution.shared
 
-        /** The manager of each instance whose launch is monitored. */
+        /**
+         * The manager of each instance whose launch is monitored, and main's
+         * once its launch is verified, which records crashes until the
+         * process ends ([stopMonitoring]).
+         */
         private val liveManagers = ConcurrentHashMap<String, HotUpdaterRecoveryManager>()
 
         private val signalHandlerLock = Any()

package/android/src/main/java/com/hotupdater/HotUpdaterRestartActivity.kt

@@ -1,12 +1,15 @@
 package com.hotupdater
 
 import android.app.Activity
+import android.app.ActivityManager
 import android.app.ActivityOptions
+import android.content.Context
 import android.content.Intent
 import android.os.Bundle
 import android.os.Handler
 import android.os.Looper
 import android.os.Process
+import android.os.SystemClock
 import android.util.Log
 
 class HotUpdaterRestartActivity : Activity() {
@@ -28,6 +31,17 @@ class HotUpdaterRestartActivity : Activity() {
             Process.killProcess(targetPid)
         }
 
+        // The kill is asynchronous. An activity started while the system still
+        // has the old process registered is handed to it and lost with it
+        // ("removed with pending start"), which leaves the app closed. The wait
+        // stays in onCreate: a Theme.NoDisplay activity must finish before
+        // onResume, and once finished this process may no longer start one.
+        awaitProcessExit(
+            isAlive = { targetPid > 0 && isProcessRegistered(targetPid) },
+            sleep = { Thread.sleep(it) },
+            now = SystemClock::uptimeMillis,
+        )
+
         val options = ActivityOptions.makeCustomAnimation(this, 0, 0)
         startActivity(launchIntent, options.toBundle())
         finishWithoutAnimation()
@@ -37,6 +51,11 @@ class HotUpdaterRestartActivity : Activity() {
         Handler(Looper.getMainLooper()).postDelayed({ killCurrentProcess() }, PROCESS_KILL_DELAY_MS)
     }
 
+    private fun isProcessRegistered(pid: Int): Boolean {
+        val activityManager = getSystemService(Context.ACTIVITY_SERVICE) as? ActivityManager ?: return false
+        return activityManager.runningAppProcesses.orEmpty().any { it.pid == pid }
+    }
+
     private fun finishWithoutAnimation() {
         finish()
     }
@@ -58,7 +77,27 @@ class HotUpdaterRestartActivity : Activity() {
     companion object {
         private const val TAG = "HotUpdaterRestart"
         private const val PROCESS_KILL_DELAY_MS = 100L
+        private const val PROCESS_EXIT_POLL_MS = 25L
+
+        /** How long the relaunch waits for the old process; it starts anyway after. */
+        internal const val PROCESS_EXIT_TIMEOUT_MS = 2_000L
         const val EXTRA_PACKAGE_NAME = "hot_updater.package_name"
         const val EXTRA_TARGET_PID = "hot_updater.target_pid"
+
+        /**
+         * Returns once [isAlive] is false, checking every
+         * [PROCESS_EXIT_POLL_MS], and at the latest once
+         * [PROCESS_EXIT_TIMEOUT_MS] passed. At once when it is already gone.
+         */
+        internal fun awaitProcessExit(
+            isAlive: () -> Boolean,
+            sleep: (Long) -> Unit,
+            now: () -> Long,
+        ) {
+            val deadline = now() + PROCESS_EXIT_TIMEOUT_MS
+            while (isAlive() && now() < deadline) {
+                sleep(PROCESS_EXIT_POLL_MS)
+            }
+        }
     }
 }

package/android/src/main/java/com/hotupdater/NativeUpdateCheck.kt

@@ -23,6 +23,8 @@ internal class HotUpdaterImplUpdateCheckState(
 
     override fun getFingerprintHash(): String? = impl.getFingerprintHash()
 
+    override fun recordRecoveryRequest(request: NativeCheckRequest) = impl.recordRecoveryRequest(request)
+
     override fun getCrashHistory(): List<String> = impl.getCrashHistory()
 
     override fun getActiveUpdateState(): ActiveSelections {

package/android/src/main/java/com/hotupdater/NativeUpdateChecker.kt

@@ -124,6 +124,9 @@ internal interface UpdateCheckState {
 
     fun removeReleaseCatalogCache(partition: String): Boolean
 
+    /** The server answered [request]: main keeps it for its check after a crash, as JavaScript's checks do. */
+    fun recordRecoveryRequest(request: NativeCheckRequest) {}
+
     fun getStorageItem(key: String): String?
 
     fun setStorageItem(
@@ -562,7 +565,7 @@ internal class NativeUpdateChecker(
                 ReleaseCatalogScope.Fingerprint(platform = PLATFORM, channelKey = channelKey, fingerprintHash = strategyValue)
             }
         val strategyPath = if (strategy == ReleaseStrategy.APP_VERSION) "app-version" else "fingerprint"
-        val catalog =
+        val answer =
             catalogClient.fetchReleaseCatalog(
                 baseURL = input.baseURL,
                 url =
@@ -572,11 +575,13 @@ internal class NativeUpdateChecker(
                 requestHeaders = options.requestHeaders,
                 requestTimeoutMillis = options.requestTimeoutMillis,
             )
-                // The server says this scope has no catalog yet: no update, not a failure.
-                ?: return null
-        if (!ReleaseCatalogs.hasExpectedScope(catalog.scopeKey, expectedScope)) {
+        if (answer != null && !ReleaseCatalogs.hasExpectedScope(answer.scopeKey, expectedScope)) {
             throw InvalidUpdateResponseException("Received an invalid Release catalog")
         }
+        // The server answered with a valid catalog, or with none yet.
+        state.recordRecoveryRequest(options)
+        // The server says this scope has no catalog yet: no update, not a failure.
+        val catalog = answer ?: return null
         val catalogId = catalog.catalogId
         val scopeKey = catalog.scopeKey
 

package/android/src/main/java/com/hotupdater/PostCrashUpdateCheck.kt

@@ -0,0 +1,195 @@
+package com.hotupdater
+
+import android.util.Log
+import kotlinx.coroutines.runBlocking
+import org.json.JSONObject
+import java.util.concurrent.Executors
+import java.util.concurrent.atomic.AtomicBoolean
+
+/**
+ * The update check JavaScript leaves in main's key-value store for the check
+ * after a crash: native knows no server of its own. A device whose JavaScript
+ * never wrote one, such as one whose user hasn't accepted the app's privacy
+ * terms yet, has none, so native sends no request.
+ */
+internal class RecoveryCheckConfig(
+    val baseURL: String,
+    val requestHeaders: Map<String, String>,
+    val requestTimeoutMillis: Long,
+    val updateStrategy: HotUpdaterUpdateStrategy,
+) {
+    /** The check on the current channel, as JavaScript's own check makes it. */
+    fun toRequest(): NativeCheckRequest =
+        NativeCheckRequest(
+            baseURL = baseURL,
+            updateStrategy = updateStrategy,
+            requestHeaders = requestHeaders,
+            requestTimeoutMillis = requestTimeoutMillis,
+        )
+
+    /** This record as JavaScript writes it, which [parse] reads back. */
+    fun toJson(): String =
+        JSONObject()
+            .put("version", VERSION)
+            .put("baseURL", baseURL)
+            .put("requestHeaders", JSONObject(requestHeaders))
+            .put("requestTimeoutMs", requestTimeoutMillis)
+            .put("updateStrategy", updateStrategy.value)
+            .toString()
+
+    companion object {
+        const val KEY = "hot-updater/recovery-check-config"
+        private const val VERSION = 1
+        private const val DEFAULT_TIMEOUT_MS = 5_000L
+
+        /**
+         * The record of a native check of main the server answered: its
+         * headers as the request sent them ([effectiveHeaders]). Its channel
+         * is left out, as JavaScript leaves it out: the check after a crash
+         * uses the device's own.
+         */
+        fun of(request: NativeCheckRequest): RecoveryCheckConfig =
+            RecoveryCheckConfig(
+                request.baseURL,
+                effectiveHeaders(request.requestHeaders),
+                request.requestTimeoutMillis,
+                request.updateStrategy,
+            )
+
+        /**
+         * The record [value] holds, or null for a missing, unparsable,
+         * other-version, or invalid one: no absolute HTTP(S) baseURL, an
+         * unknown strategy, headers that aren't strings, or a timeout that
+         * isn't a positive number. A record JavaScript writes always has
+         * headers and a timeout; one without them takes the defaults.
+         */
+        fun parse(value: String?): RecoveryCheckConfig? {
+            val json = value?.let { runCatching { JSONObject(it) }.getOrNull() } ?: return null
+            if (json.opt("version") != VERSION) return null
+            val baseURL = json.opt("baseURL") as? String ?: return null
+            if (runCatching { requireValidBaseURL(baseURL) }.isFailure) return null
+            val strategy = json.opt("updateStrategy") as? String
+            val updateStrategy = HotUpdaterUpdateStrategy.values().firstOrNull { it.value == strategy } ?: return null
+            val headers = LinkedHashMap<String, String>()
+            if (json.has("requestHeaders")) {
+                val values = json.opt("requestHeaders") as? JSONObject ?: return null
+                values.keys().forEach { name -> headers[name] = values.opt(name) as? String ?: return null }
+            }
+            val timeout =
+                if (json.has("requestTimeoutMs")) {
+                    val number = json.opt("requestTimeoutMs") as? Number ?: return null
+                    number.toDouble().takeIf { it.isFinite() && it >= 1 }?.toLong() ?: return null
+                } else {
+                    DEFAULT_TIMEOUT_MS
+                }
+            return RecoveryCheckConfig(baseURL, headers, timeout, updateStrategy)
+        }
+    }
+}
+
+/**
+ * Main's update check at the launch after a crash. Since first content
+ * verifies a launch, a bundle whose own update flow crashes later can never
+ * fetch its fix from JavaScript; native checks once, in the background, and
+ * stages what it finds for the next launch, with no reload.
+ *
+ * A crash leaves its marker, which the next launch's preparation consumes:
+ * [markPending] records that in the key-value store, so a launch that ends
+ * before the check finishes, or shows no UI, leaves it for the next launch
+ * that does. [startIfPending] then runs the check once per process, after the
+ * launch is prepared and outside its locks, once a started activity shows UI.
+ *
+ * @param whenUiShown runs its action once this process shows UI, at once
+ * when it already does; on the main thread
+ * @param check checks with main's native checker, which queues the plugin
+ * events JavaScript replays
+ * @param background runs work off the thread React Native starts on
+ */
+internal class PostCrashUpdateCheck(
+    private val getItem: (String) -> String?,
+    private val setItem: (String, String?) -> Unit,
+    private val whenUiShown: ((() -> Unit) -> Unit),
+    private val check: suspend (NativeCheckRequest) -> HotUpdaterUpdate?,
+    private val isRestartProcess: () -> Boolean,
+    private val background: (Runnable) -> Unit = defaultBackground,
+) {
+    private val started = AtomicBoolean(false)
+
+    /** Main's launch preparation consumed a crash marker that doesn't ask to roll back. */
+    fun markPending() {
+        setItem(PENDING_KEY, PENDING_VALUE)
+    }
+
+    /**
+     * Main's launch preparation consumed a marker that asks to roll back: the
+     * rollback settles that crash locally, and a check an earlier crash left
+     * pending with it.
+     */
+    fun clearPending() {
+        setItem(PENDING_KEY, null)
+    }
+
+    /**
+     * Starts the check when a crash left it pending and this process hasn't
+     * run it yet. Returns at once: reading the store is left to [background].
+     */
+    fun startIfPending() {
+        if (started.get()) return
+        background(
+            Runnable {
+                // Hot Updater's restart process only relaunches the app.
+                if (isRestartProcess()) return@Runnable
+                if (getItem(PENDING_KEY) != PENDING_VALUE) return@Runnable
+                // Without a server there is nothing to ask, and the check
+                // waits for a launch whose JavaScript left one.
+                if (RecoveryCheckConfig.parse(getItem(RecoveryCheckConfig.KEY)) == null) {
+                    log("skipped no config")
+                    return@Runnable
+                }
+                // A launch without the flag must not use up the process's check.
+                if (!started.compareAndSet(false, true)) return@Runnable
+                whenUiShown { background(Runnable { run() }) }
+            },
+        )
+    }
+
+    private fun run() {
+        // Read again: JavaScript may have saved a newer one while the app came up.
+        val config = RecoveryCheckConfig.parse(getItem(RecoveryCheckConfig.KEY))
+        if (config == null) {
+            log("skipped no config")
+            return
+        }
+        log("started")
+        try {
+            val update = runBlocking { check(config.toRequest()) }
+            when {
+                update == null -> log("no update")
+                runBlocking { update.updateBundle() } -> log("staged ${update.id}")
+                else -> log("skipped superseded")
+            }
+        } catch (error: Exception) {
+            log("failed ${error.message ?: error.javaClass.simpleName}")
+        } finally {
+            // The attempt finished, whatever it found; a process that died
+            // during it leaves the flag for the next launch to try again.
+            setItem(PENDING_KEY, null)
+        }
+    }
+
+    private fun log(status: String) {
+        Log.i(TAG, "[HotUpdaterRecovery] Post-crash update check: $status")
+    }
+
+    companion object {
+        const val PENDING_KEY = "hot-updater/recovery-check-pending"
+        private const val PENDING_VALUE = "1"
+        private const val TAG = "HotUpdaterRecovery"
+
+        private val executor by lazy {
+            Executors.newSingleThreadExecutor { task -> Thread(task, "HotUpdaterPostCrashCheck").apply { isDaemon = true } }
+        }
+
+        private val defaultBackground: (Runnable) -> Unit = { task -> executor.execute(task) }
+    }
+}