@hot-updater/react-native 1.1.1 → 1.1.3

package/android/src/main/java/com/hotupdater/PostCrashUpdateCheck.kt

@@ -0,0 +1,195 @@
+package com.hotupdater
+
+import android.util.Log
+import kotlinx.coroutines.runBlocking
+import org.json.JSONObject
+import java.util.concurrent.Executors
+import java.util.concurrent.atomic.AtomicBoolean
+
+/**
+ * The update check JavaScript leaves in main's key-value store for the check
+ * after a crash: native knows no server of its own. A device whose JavaScript
+ * never wrote one, such as one whose user hasn't accepted the app's privacy
+ * terms yet, has none, so native sends no request.
+ */
+internal class RecoveryCheckConfig(
+    val baseURL: String,
+    val requestHeaders: Map<String, String>,
+    val requestTimeoutMillis: Long,
+    val updateStrategy: HotUpdaterUpdateStrategy,
+) {
+    /** The check on the current channel, as JavaScript's own check makes it. */
+    fun toRequest(): NativeCheckRequest =
+        NativeCheckRequest(
+            baseURL = baseURL,
+            updateStrategy = updateStrategy,
+            requestHeaders = requestHeaders,
+            requestTimeoutMillis = requestTimeoutMillis,
+        )
+
+    /** This record as JavaScript writes it, which [parse] reads back. */
+    fun toJson(): String =
+        JSONObject()
+            .put("version", VERSION)
+            .put("baseURL", baseURL)
+            .put("requestHeaders", JSONObject(requestHeaders))
+            .put("requestTimeoutMs", requestTimeoutMillis)
+            .put("updateStrategy", updateStrategy.value)
+            .toString()
+
+    companion object {
+        const val KEY = "hot-updater/recovery-check-config"
+        private const val VERSION = 1
+        private const val DEFAULT_TIMEOUT_MS = 5_000L
+
+        /**
+         * The record of a native check of main the server answered: its
+         * headers as the request sent them ([effectiveHeaders]). Its channel
+         * is left out, as JavaScript leaves it out: the check after a crash
+         * uses the device's own.
+         */
+        fun of(request: NativeCheckRequest): RecoveryCheckConfig =
+            RecoveryCheckConfig(
+                request.baseURL,
+                effectiveHeaders(request.requestHeaders),
+                request.requestTimeoutMillis,
+                request.updateStrategy,
+            )
+
+        /**
+         * The record [value] holds, or null for a missing, unparsable,
+         * other-version, or invalid one: no absolute HTTP(S) baseURL, an
+         * unknown strategy, headers that aren't strings, or a timeout that
+         * isn't a positive number. A record JavaScript writes always has
+         * headers and a timeout; one without them takes the defaults.
+         */
+        fun parse(value: String?): RecoveryCheckConfig? {
+            val json = value?.let { runCatching { JSONObject(it) }.getOrNull() } ?: return null
+            if (json.opt("version") != VERSION) return null
+            val baseURL = json.opt("baseURL") as? String ?: return null
+            if (runCatching { requireValidBaseURL(baseURL) }.isFailure) return null
+            val strategy = json.opt("updateStrategy") as? String
+            val updateStrategy = HotUpdaterUpdateStrategy.values().firstOrNull { it.value == strategy } ?: return null
+            val headers = LinkedHashMap<String, String>()
+            if (json.has("requestHeaders")) {
+                val values = json.opt("requestHeaders") as? JSONObject ?: return null
+                values.keys().forEach { name -> headers[name] = values.opt(name) as? String ?: return null }
+            }
+            val timeout =
+                if (json.has("requestTimeoutMs")) {
+                    val number = json.opt("requestTimeoutMs") as? Number ?: return null
+                    number.toDouble().takeIf { it.isFinite() && it >= 1 }?.toLong() ?: return null
+                } else {
+                    DEFAULT_TIMEOUT_MS
+                }
+            return RecoveryCheckConfig(baseURL, headers, timeout, updateStrategy)
+        }
+    }
+}
+
+/**
+ * Main's update check at the launch after a crash. Since first content
+ * verifies a launch, a bundle whose own update flow crashes later can never
+ * fetch its fix from JavaScript; native checks once, in the background, and
+ * stages what it finds for the next launch, with no reload.
+ *
+ * A crash leaves its marker, which the next launch's preparation consumes:
+ * [markPending] records that in the key-value store, so a launch that ends
+ * before the check finishes, or shows no UI, leaves it for the next launch
+ * that does. [startIfPending] then runs the check once per process, after the
+ * launch is prepared and outside its locks, once a started activity shows UI.
+ *
+ * @param whenUiShown runs its action once this process shows UI, at once
+ * when it already does; on the main thread
+ * @param check checks with main's native checker, which queues the plugin
+ * events JavaScript replays
+ * @param background runs work off the thread React Native starts on
+ */
+internal class PostCrashUpdateCheck(
+    private val getItem: (String) -> String?,
+    private val setItem: (String, String?) -> Unit,
+    private val whenUiShown: ((() -> Unit) -> Unit),
+    private val check: suspend (NativeCheckRequest) -> HotUpdaterUpdate?,
+    private val isRestartProcess: () -> Boolean,
+    private val background: (Runnable) -> Unit = defaultBackground,
+) {
+    private val started = AtomicBoolean(false)
+
+    /** Main's launch preparation consumed a crash marker that doesn't ask to roll back. */
+    fun markPending() {
+        setItem(PENDING_KEY, PENDING_VALUE)
+    }
+
+    /**
+     * Main's launch preparation consumed a marker that asks to roll back: the
+     * rollback settles that crash locally, and a check an earlier crash left
+     * pending with it.
+     */
+    fun clearPending() {
+        setItem(PENDING_KEY, null)
+    }
+
+    /**
+     * Starts the check when a crash left it pending and this process hasn't
+     * run it yet. Returns at once: reading the store is left to [background].
+     */
+    fun startIfPending() {
+        if (started.get()) return
+        background(
+            Runnable {
+                // Hot Updater's restart process only relaunches the app.
+                if (isRestartProcess()) return@Runnable
+                if (getItem(PENDING_KEY) != PENDING_VALUE) return@Runnable
+                // Without a server there is nothing to ask, and the check
+                // waits for a launch whose JavaScript left one.
+                if (RecoveryCheckConfig.parse(getItem(RecoveryCheckConfig.KEY)) == null) {
+                    log("skipped no config")
+                    return@Runnable
+                }
+                // A launch without the flag must not use up the process's check.
+                if (!started.compareAndSet(false, true)) return@Runnable
+                whenUiShown { background(Runnable { run() }) }
+            },
+        )
+    }
+
+    private fun run() {
+        // Read again: JavaScript may have saved a newer one while the app came up.
+        val config = RecoveryCheckConfig.parse(getItem(RecoveryCheckConfig.KEY))
+        if (config == null) {
+            log("skipped no config")
+            return
+        }
+        log("started")
+        try {
+            val update = runBlocking { check(config.toRequest()) }
+            when {
+                update == null -> log("no update")
+                runBlocking { update.updateBundle() } -> log("staged ${update.id}")
+                else -> log("skipped superseded")
+            }
+        } catch (error: Exception) {
+            log("failed ${error.message ?: error.javaClass.simpleName}")
+        } finally {
+            // The attempt finished, whatever it found; a process that died
+            // during it leaves the flag for the next launch to try again.
+            setItem(PENDING_KEY, null)
+        }
+    }
+
+    private fun log(status: String) {
+        Log.i(TAG, "[HotUpdaterRecovery] Post-crash update check: $status")
+    }
+
+    companion object {
+        const val PENDING_KEY = "hot-updater/recovery-check-pending"
+        private const val PENDING_VALUE = "1"
+        private const val TAG = "HotUpdaterRecovery"
+
+        private val executor by lazy {
+            Executors.newSingleThreadExecutor { task -> Thread(task, "HotUpdaterPostCrashCheck").apply { isDaemon = true } }
+        }
+
+        private val defaultBackground: (Runnable) -> Unit = { task -> executor.execute(task) }
+    }
+}

package/ios/HotUpdater/Internal/BundleFileStorageService.swift

@@ -421,6 +421,7 @@ class BundleFileStorageService: BundleStorageService {
     private let builtInBundleIdProvider: () -> String
     private let builtInAssetResolver: BuiltInAssetResolver
     private let updateStrategyProvider: () -> UpdateStrategy
+    private let metadataWriter: (BundleMetadata, URL) -> Bool
     private let releaseStateLock = NSRecursiveLock()
 
     /// App-wide: every instance's storage reads the same install identity
@@ -787,7 +788,10 @@ class BundleFileStorageService: BundleStorageService {
                 builtInBundleIdProvider: @escaping () -> String = { "" },
                 builtInAssetResolver: BuiltInAssetResolver? = nil,
                 updateStrategyProvider: (() -> UpdateStrategy)? = nil,
-                downloadRetryDelay: TimeInterval = 1) {
+                downloadRetryDelay: TimeInterval = 1,
+                metadataWriter: @escaping (BundleMetadata, URL) -> Bool = { metadata, file in
+                    metadata.save(to: file)
+                }) {
 
         self.fileSystem = fileSystem
         self.downloadRetryDelay = downloadRetryDelay
@@ -802,6 +806,7 @@ class BundleFileStorageService: BundleStorageService {
             defaultBundle: { instance.bundle }
         )
         self.updateStrategyProvider = updateStrategyProvider ?? { instance.updateStrategy() }
+        self.metadataWriter = metadataWriter
 
         // Create queue for file operations
         self.fileOperationQueue = DispatchQueue(label: "com.hotupdater.fileoperations",
@@ -859,7 +864,7 @@ class BundleFileStorageService: BundleStorageService {
         }
         var updatedMetadata = metadata
         updatedMetadata.isolationKey = isolationKey
-        return updatedMetadata.save(to: file)
+        return metadataWriter(updatedMetadata, file)
     }
 
     private func loadLaunchReport() -> LaunchReport? {
@@ -1368,6 +1373,8 @@ class BundleFileStorageService: BundleStorageService {
     /// ended before first content without a crash marker.
     @discardableResult
     private func rollbackPendingBundle(_ stagingId: String, unfinishedLaunch: Bool = false) -> Bool {
+        releaseStateLock.lock()
+        defer { releaseStateLock.unlock() }
         guard var metadata = loadMetadataOrNull(), metadata.stagingBundleId == stagingId else {
             return false
         }
@@ -1443,6 +1450,8 @@ class BundleFileStorageService: BundleStorageService {
     }
 
     private func applyPendingRecoveryIfNeeded(_ pendingRecovery: PendingCrashRecovery?) {
+        releaseStateLock.lock()
+        defer { releaseStateLock.unlock() }
         guard let metadata = loadMetadataOrNull(),
               let stagingBundleId = metadata.stagingBundleId,
               pendingRecovery?.shouldRollback == true,
@@ -2001,6 +2010,8 @@ class BundleFileStorageService: BundleStorageService {
     }
 
     private func selectLaunch(bundle: Bundle) -> LaunchSelection {
+        releaseStateLock.lock()
+        defer { releaseStateLock.unlock() }
         guard let metadata = loadMetadataOrNull() else {
             return LaunchSelection(
                 bundleURL: getFallbackBundleURL(bundle: bundle),
@@ -2081,6 +2092,8 @@ class BundleFileStorageService: BundleStorageService {
         // Cleared before the rollbacks below, so the launch reports their RECOVERED.
         saveLaunchReport(nil)
         applyPendingRecoveryIfNeeded(pendingRecovery())
+        releaseStateLock.lock()
+        defer { releaseStateLock.unlock() }
         // Only a new storage instance consumes an unfinished launch. Repeated bundle
         // lookups or bridge reloads in this process must not reject its own launch.
         if let metadata = loadMetadataOrNull(),
@@ -3019,6 +3032,10 @@ class BundleFileStorageService: BundleStorageService {
     func markLaunchCompleted(bundleId: String?) {
         // Before the guard: content from the built-in bundle (nil) also counts.
         readyInterruptedLaunchRetry(bundleId)
+        // A Release selection can commit at the same time, from a native update
+        // check or JavaScript; neither may save over the other's read.
+        releaseStateLock.lock()
+        defer { releaseStateLock.unlock() }
         guard let bundleId,
               var metadata = loadMetadataOrNull(),
               metadata.verificationPending,
@@ -3200,6 +3217,8 @@ class BundleFileStorageService: BundleStorageService {
     }
 
     func resetChannel() -> Result<Bool, Error> {
+        releaseStateLock.lock()
+        defer { releaseStateLock.unlock() }
         guard case .success = setBundleURL(localPath: nil) else {
             return .failure(BundleStorageError.unknown(nil))
         }

package/ios/HotUpdater/Internal/HotUpdaterImpl.swift

@@ -149,6 +149,20 @@ private func hotUpdaterGetMinBundleId() -> String {
     private let recoveryManager: HotUpdaterRecoveryManager
     private let releaseCatalogCache: ReleaseCatalogCacheService
     private let keyValueStorage: KeyValueStorageService
+    /// Main only: the native update check of the first launch with UI after
+    /// a crash. None in a development build.
+    private let postCrashUpdateCheck: HotUpdaterPostCrashUpdateCheck?
+
+    /// A development build, where a crash is a RedBox during development,
+    /// never a reason to check for a fix: main records no crash after its
+    /// watch and never checks after one.
+    static let isDevelopmentBuild: Bool = {
+        #if DEBUG
+        return true
+        #else
+        return false
+        #endif
+    }()
     // Read by native update checks on other threads while React Native sets it.
     private let launchSelectionLock = NSLock()
     private var launchSelectionValue: LaunchSelection?
@@ -282,6 +296,13 @@ private func hotUpdaterGetMinBundleId() -> String {
         self.recoveryManager = recoveryManager
         self.releaseCatalogCache = releaseCatalogCache
         self.keyValueStorage = keyValueStorage
+        self.postCrashUpdateCheck = environment.isMain && !HotUpdaterImpl.isDevelopmentBuild
+            ? HotUpdaterPostCrashUpdateCheck(
+                storage: keyValueStorage,
+                whenShown: HotUpdaterImpl.whenAppIsActive,
+                check: HotUpdaterImpl.checkAfterCrash
+            )
+            : nil
         super.init()
         recoveryManager.onRollbackCharged = { [weak self] in
             self?.invalidateLaunchPreparation()
@@ -382,6 +403,11 @@ private func hotUpdaterGetMinBundleId() -> String {
             HotUpdaterMainBundle.shared.note(bundle)
         }
         let bundleURL = prepareLaunchIfNeeded(bundle: bundle).bundleURL
+        // After the launch lock is released: the check reads the launch
+        // through it, and never holds up React Native's start.
+        if environment.isMain, self === HotUpdaterNativeUpdateBridge.sharedImpl {
+            postCrashUpdateCheck?.startIfNeeded()
+        }
         if !environment.isMain, let bundleURL {
             // The runtime started with this URL finds this impl by it.
             HotUpdaterNativeUpdateBridge.router.record(launchURL: bundleURL, name: environment.name)
@@ -995,7 +1021,7 @@ private func hotUpdaterGetMinBundleId() -> String {
             // Settles what the previous process left first, so the check reads the
             // selection, launch state, and crash history this launch will use.
             // Each instance consumes only its own crash marker.
-            bundleStorage.settlePreviousLaunch(pendingRecovery: { self.recoveryManager.consumePendingCrashRecovery() })
+            bundleStorage.settlePreviousLaunch(pendingRecovery: { self.consumePendingCrashRecovery() })
             return bundleStorage.peekLaunchBundleId()
         }
     }
@@ -1054,7 +1080,7 @@ private func hotUpdaterGetMinBundleId() -> String {
         // retry replaces it.
         let (selection, generation, epoch) = launchEpoch.prepareCurrent(
             prepare: {
-                let pendingRecovery = recoveryManager.consumePendingCrashRecovery()
+                let pendingRecovery = consumePendingCrashRecovery()
                 return bundleStorage.prepareLaunch(bundle: bundle, pendingRecovery: pendingRecovery)
             },
             startMonitoring: { selection in
@@ -1084,6 +1110,61 @@ private func hotUpdaterGetMinBundleId() -> String {
         return selection
     }
 
+    /// Keeps a native check's request the server answered for main's check
+    /// after a crash, as JavaScript's checks do; an app that checks only
+    /// natively has no other. Nothing for a named instance or in a
+    /// development build, which have no such check.
+    func recordRecoveryRequest(_ request: NativeCheckRequest) {
+        guard postCrashUpdateCheck != nil, let json = HotUpdaterRecoveryCheckConfig.json(for: request) else { return }
+        keyValueStorage.setItem(HotUpdaterRecoveryCheckConfig.storageKey, value: json)
+    }
+
+    /// This instance's crash marker; for main outside a development build,
+    /// a marker that doesn't roll back also leaves the post-crash update
+    /// check pending.
+    private func consumePendingCrashRecovery() -> PendingCrashRecovery? {
+        guard let postCrashUpdateCheck else {
+            return recoveryManager.consumePendingCrashRecovery()
+        }
+        return postCrashUpdateCheck.consumeMarker { recoveryManager.consumePendingCrashRecovery() }
+    }
+
+    /// Runs `action` once the app is active: a launch without UI, such as a
+    /// silent push, leaves the post-crash check to a later foreground.
+    private static func whenAppIsActive(_ action: @escaping () -> Void) {
+        DispatchQueue.main.async {
+            if UIApplication.shared.applicationState == .active {
+                action()
+                return
+            }
+            NSLog("[HotUpdaterRecovery] Post-crash update check: skipped until the app becomes active")
+            // Boxed: the observer block may not capture a mutable variable.
+            let registration = HotUpdaterObserverRegistration()
+            registration.token = NotificationCenter.default.addObserver(
+                forName: UIApplication.didBecomeActiveNotification,
+                object: nil,
+                queue: .main
+            ) { _ in
+                guard let token = registration.token else { return }
+                NotificationCenter.default.removeObserver(token)
+                registration.token = nil
+                action()
+            }
+        }
+    }
+
+    /// Main's native check of the current channel, which stages an update it
+    /// finds for the next launch; no reload.
+    private static func checkAfterCrash(
+        _ request: NativeCheckRequest
+    ) async throws -> HotUpdaterPostCrashUpdateCheck.Outcome {
+        let checker = HotUpdaterNativeUpdateBridge.checker(impl: HotUpdaterNativeUpdateBridge.sharedImpl)
+        guard let update = try await checker.checkForUpdate(request) else {
+            return .noUpdate
+        }
+        return try await update.updateBundle() ? .staged(bundleId: update.bundleId) : .superseded
+    }
+
     // A background launch, such as a silent push, may never render. Only a
     // launch in the foreground may leave an unfinished launch for the next
     // process to roll back.
@@ -1132,6 +1213,12 @@ private func hotUpdaterGetMinBundleId() -> String {
     }
 }
 
+/// A one-shot notification observer's token, which its own block removes.
+/// Main thread only.
+private final class HotUpdaterObserverRegistration {
+    var token: NSObjectProtocol?
+}
+
 /// One instance's crash recovery: consumes its marker at launch, watches its
 /// launch until 10 seconds after its first content, and for main, reloads
 /// in-process when its JavaScript fails before first content. The state lives
@@ -1356,9 +1443,15 @@ private final class HotUpdaterSignalCrashSlots: HotUpdaterCrashSlotSink {
 final class HotUpdaterRecoveryHub: NSObject {
     static let shared = HotUpdaterRecoveryHub()
 
-    let coordinator = HotUpdaterRecoveryCoordinator(sink: HotUpdaterSignalCrashSlots())
+    let coordinator = HotUpdaterRecoveryCoordinator(
+        sink: HotUpdaterSignalCrashSlots(),
+        recordsCrashesAfterWatch: !HotUpdaterImpl.isDevelopmentBuild
+    )
     /// The launch each runtime runs, by its module.
     private let runtimeLaunches = HotUpdaterRuntimeLaunches()
+    /// Content that appeared in the background, until the foreground.
+    private let backgroundContent = HotUpdaterBackgroundContent()
+    private var backgroundContentObservers: [NSObjectProtocol] = []
 
     override init() {
         super.init()
@@ -1688,6 +1781,17 @@ final class HotUpdaterRecoveryHub: NSObject {
 
     @objc private func handleContentDidAppear(_ notification: Notification) {
         let view = notification.object as AnyObject?
+        // React Native posts content on the main thread, where UIApplication
+        // is read. Content the app shows in the background verifies nothing
+        // until the app comes to the foreground (`HotUpdaterBackgroundContent`).
+        if Thread.isMainThread, UIApplication.shared.applicationState == .background {
+            holdUntilForeground(view)
+            return
+        }
+        contentAppeared(view)
+    }
+
+    private func contentAppeared(_ view: AnyObject?) {
         let owner = owner(of: view)
         // A view no runtime claims is main's, as it always was, unless a
         // named runtime that has no module yet may have shown it.
@@ -1723,6 +1827,24 @@ final class HotUpdaterRecoveryHub: NSObject {
         }
     }
 
+    /// Main thread only.
+    private func holdUntilForeground(_ view: AnyObject?) {
+        guard backgroundContent.hold(view) else { return }
+        backgroundContentObservers = [
+            UIApplication.willEnterForegroundNotification,
+            UIApplication.didBecomeActiveNotification,
+        ].map { name in
+            NotificationCenter.default.addObserver(forName: name, object: nil, queue: .main) { [weak self] _ in
+                guard let self else { return }
+                self.backgroundContentObservers.forEach { NotificationCenter.default.removeObserver($0) }
+                self.backgroundContentObservers = []
+                for view in self.backgroundContent.takeAll() {
+                    self.contentAppeared(view)
+                }
+            }
+        }
+    }
+
     /// Credits the content held for runtimes that had no module yet. Main
     /// thread only.
     private func releaseHeldContent() {

package/ios/HotUpdater/Internal/HotUpdaterLaunchRecovery.swift

@@ -83,7 +83,10 @@ protocol HotUpdaterCrashSlotSink: AnyObject {
 /// selected in the foreground, and its fatal before first content reloads it
 /// in-process. A named launch counts as started only once a view of its
 /// runtime is shown, since a runtime warmed up without UI must not be rolled
-/// back at the next start.
+/// back at the next start. After its watch ends, main still writes its marker
+/// on a crash of its own or of the process, without rollback: its next launch
+/// then checks for a fix natively, since this bundle's JavaScript may crash
+/// before it can.
 final class HotUpdaterRecoveryCoordinator {
     /// Native crash markers the signal handler can write, main's included.
     /// More instances than this still roll back an unfinished launch at their
@@ -142,6 +145,23 @@ final class HotUpdaterRecoveryCoordinator {
         fileprivate(set) var isCharged = false
         /// The directory of `markerURL` was created.
         fileprivate var hasMarkerDirectory = false
+
+        /// Main only, outside development builds: a crash after its watch
+        /// ended still writes its marker (`recordsCrashesAfterWatch`).
+        fileprivate var recordsAfterWatch = false
+
+        /// Whether a crash now writes this launch's marker: while it is
+        /// watched, and for main for the rest of the process once it
+        /// launched, so the next launch knows to check for a fix
+        /// (`HotUpdaterPostCrashUpdateCheck`).
+        fileprivate var recordsCrashes: Bool {
+            isMonitoring || (recordsAfterWatch && generation > 0)
+        }
+        /// The bundle a marker of this launch names: main's selected bundle
+        /// once its watch ended, which cleared `bundleId`.
+        fileprivate var markerBundleId: String? {
+            recordsAfterWatch && !isMonitoring ? selectedBundleId : bundleId
+        }
     }
 
     enum RecoveryRequest: Equatable {
@@ -251,9 +271,18 @@ final class HotUpdaterRecoveryCoordinator {
     /// verified and the next start would roll it back.
     static let heldContentBound: TimeInterval = 10
 
-    init(sink: HotUpdaterCrashSlotSink, now: @escaping () -> TimeInterval = { ProcessInfo.processInfo.systemUptime }) {
+    /// Main's crashes after its watch ended write its marker. A development
+    /// build turns this off: a RedBox is no reason to check for a fix.
+    private let recordsCrashesAfterWatch: Bool
+
+    init(
+        sink: HotUpdaterCrashSlotSink,
+        now: @escaping () -> TimeInterval = { ProcessInfo.processInfo.systemUptime },
+        recordsCrashesAfterWatch: Bool = true
+    ) {
         self.sink = sink
         self.now = now
+        self.recordsCrashesAfterWatch = recordsCrashesAfterWatch
     }
 
     // MARK: - Instances
@@ -267,6 +296,7 @@ final class HotUpdaterRecoveryCoordinator {
                 return launch
             }
             let launch = Launch(name: name, markerURL: markerURL, storage: storage)
+            launch.recordsAfterWatch = launch.isMain && recordsCrashesAfterWatch
             launches[name] = launch
             return launch
         }
@@ -737,7 +767,8 @@ final class HotUpdaterRecoveryCoordinator {
         !launch.isMain && launch.isMonitoring && launch.isAwaitingContent && !launch.hasResolvedRuntime
     }
 
-    /// Ends the grace period after first content.
+    /// Ends the grace period after first content. Main's crashes are still
+    /// recorded afterwards, without rollback, naming the bundle it runs.
     func finishMonitoring(name: String, generation: Int) {
         withLock {
             guard let launch = launches[name], launch.generation == generation else { return }
@@ -873,7 +904,9 @@ final class HotUpdaterRecoveryCoordinator {
                 writeMarker(launch)
             }
             let claim = attribute(to: owner)
-            if launch.isMonitoring, !markerFirst {
+            // Main's marker is written after its watch ended too, without
+            // rollback.
+            if launch.recordsCrashes, !markerFirst {
                 writeMarker(launch)
             }
             return claim
@@ -1119,7 +1152,7 @@ final class HotUpdaterRecoveryCoordinator {
         charging {
             if let attributedName, let launch = launches[attributedName] {
                 // Not a later launch of the claimed instance.
-                if launch.isMonitoring, launch.generation == attributedGeneration {
+                if launch.recordsCrashes, launch.generation == attributedGeneration {
                     writeMarker(launch)
                 }
                 return
@@ -1191,9 +1224,9 @@ final class HotUpdaterRecoveryCoordinator {
 
     private func chargeUnattributedCrash() {
         for launch in launches.values {
-            // Main writes while it watches its launch, as it always has; a
-            // marker of a verified launch carries `shouldRollback: false`.
-            if launch.isMain ? launch.isMonitoring : launch.crashCountsAgainstLaunch {
+            // Main writes for the whole process once it launched; a marker
+            // of a verified launch carries `shouldRollback: false`.
+            if launch.isMain ? launch.recordsCrashes : launch.crashCountsAgainstLaunch {
                 writeMarker(launch)
             }
         }
@@ -1204,7 +1237,7 @@ final class HotUpdaterRecoveryCoordinator {
     /// `onRollbackCharged` once the charge finishes (`charging`).
     private func writeMarker(_ launch: Launch) {
         HotUpdaterCrashMarker.write(
-            bundleId: launch.bundleId,
+            bundleId: launch.markerBundleId,
             shouldRollback: launch.shouldRollback,
             to: launch.markerURL
         )
@@ -1256,7 +1289,17 @@ final class HotUpdaterRecoveryCoordinator {
         guard let slot = launch.slot else { return }
         let flag = launch.crashCountsAgainstLaunch
         slotFlags[slot] = flag
-        sink.updateSlot(slot, markerPath: launch.markerURL.path, bundleId: launch.bundleId, shouldRollback: flag)
+        // Main's slot writes on any signal, and keeps naming its bundle
+        // after its watch ended. A development build's names no marker once
+        // the watch ended, so a signal then records nothing either: an empty
+        // path is a slot the signal handler skips.
+        let recordsNow = !launch.isMain || launch.isMonitoring || launch.recordsAfterWatch
+        sink.updateSlot(
+            slot,
+            markerPath: recordsNow ? launch.markerURL.path : "",
+            bundleId: launch.markerBundleId,
+            shouldRollback: flag
+        )
         if !launch.hasMarkerDirectory {
             try? FileManager.default.createDirectory(
                 at: launch.markerURL.deletingLastPathComponent(),
@@ -1551,3 +1594,40 @@ final class HotUpdaterRuntimeLaunches {
     }
 }
 
+/// First content that appeared while the app was in the background, such as
+/// the root view a silent push's launch creates. Nobody sees it, so it
+/// verifies no launch until the app comes to the foreground: the old
+/// architecture posts content for a root view even when the headless App
+/// renders nothing, which would otherwise verify a staged bundle no one saw.
+/// A view torn down before then verifies nothing.
+final class HotUpdaterBackgroundContent {
+    private struct Entry {
+        weak var view: AnyObject?
+        let hasView: Bool
+    }
+
+    private let lock = NSLock()
+    private var entries: [Entry] = []
+
+    /// Holds `view`'s content for the foreground. Returns true for the first
+    /// one held, when the caller starts waiting for the foreground.
+    func hold(_ view: AnyObject?) -> Bool {
+        lock.lock()
+        defer { lock.unlock() }
+        entries.append(Entry(view: view, hasView: view != nil))
+        return entries.count == 1
+    }
+
+    /// The content held, once: the views still alive, and nil for content
+    /// that came without a view.
+    func takeAll() -> [AnyObject?] {
+        lock.lock()
+        let taken = entries
+        entries = []
+        lock.unlock()
+        return taken.compactMap { entry -> AnyObject?? in
+            if !entry.hasView { return .some(nil) }
+            return entry.view.map { .some($0) }
+        }
+    }
+}

package/ios/HotUpdater/Internal/HotUpdaterNativeUpdates.swift

@@ -24,6 +24,8 @@ final class HotUpdaterImplUpdateHost: NativeUpdateHost {
 
     func fingerprintHash() -> String? { impl.getFingerprintHash() }
 
+    func recordRecoveryRequest(_ request: NativeCheckRequest) { impl.recordRecoveryRequest(request) }
+
     func crashHistory() -> [String] { impl.getCrashHistory() }
 
     func activeUpdateState() -> [String: Any] { impl.getActiveUpdateState() }