@otakit/capacitor-updater 2.3.2 → 3.0.0

package/android/src/main/java/com/otakit/updater/UpdaterPlugin.java

@@ -13,11 +13,8 @@ import com.getcapacitor.annotation.CapacitorPlugin;
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
-import java.io.InputStream;
-import java.net.HttpURLConnection;
 import java.net.URL;
 import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
@@ -100,9 +97,13 @@ public class UpdaterPlugin extends Plugin {
 
   private BundleStore store;
   private UpdaterCoordinator coordinator;
-  private Runnable trialTimeoutRunnable;
+  private final UpdateOwner updateOwner;
+  private final DocumentReadyBridge documentReadyBridge = new DocumentReadyBridge();
+  private final ForegroundDeadline trialDeadline;
 
   private int appReadyTimeoutMs = 10_000;
+  private boolean storageReady;
+  private volatile String lifecycleState = "unknown";
   private boolean allowInsecureUrls = false;
   private Policy launchPolicy = Policy.APPLY_STAGED;
   private Policy resumePolicy = Policy.SHADOW;
@@ -126,6 +127,21 @@ public class UpdaterPlugin extends Plugin {
     java.util.regex.Pattern.compile("^[A-Za-z0-9._-]{1,64}$");
   private UpdaterCoordinator.StartupPreparation pendingStartupPreparation;
 
+  public UpdaterPlugin() {
+    this.trialDeadline = new ForegroundDeadline(mainHandler);
+    this.updateOwner = new UpdateOwner(() -> bridge != null && bridge.getWebView() != null);
+  }
+
+  UpdaterPlugin(ForegroundDeadline trialDeadline) {
+    this.trialDeadline = trialDeadline;
+    this.updateOwner = new UpdateOwner(() -> bridge != null && bridge.getWebView() != null);
+  }
+
+  UpdaterPlugin(ForegroundDeadline trialDeadline, UpdateOwner updateOwner) {
+    this.trialDeadline = trialDeadline;
+    this.updateOwner = updateOwner;
+  }
+
   @Override
   public void load() {
     super.load();
@@ -151,6 +167,7 @@ public class UpdaterPlugin extends Plugin {
     );
     this.cdnUrl = resolveCdnUrl(getConfig().getString("cdnUrl"), System.getenv("OTAKIT_CDN_URL"));
     this.appId = getConfig().getString("appId");
+    DeviceEventClient.resume(new File(getContext().getNoBackupFilesDir(), "otakit-events"));
     this.channel = trimToNull(getConfig().getString("channel"));
     this.runtimeVersion = trimToNull(getConfig().getString("runtimeVersion"));
     this.store = new BundleStore(getContext(), builtinVersion, nativeBuild, this.runtimeVersion);
@@ -160,37 +177,7 @@ public class UpdaterPlugin extends Plugin {
     this.resumePolicy = resolvePolicy(getConfig().getString("resumePolicy"), Policy.SHADOW);
     this.runtimePolicy = resolvePolicy(getConfig().getString("runtimePolicy"), Policy.IMMEDIATE);
 
-    try {
-      org.json.JSONArray rawKeys = getConfig().getConfigJSON().optJSONArray("manifestKeys");
-      if (rawKeys != null && rawKeys.length() > 0) {
-        for (int i = 0; i < rawKeys.length(); i++) {
-          org.json.JSONObject entry = rawKeys.optJSONObject(i);
-          if (entry == null) {
-            continue;
-          }
-          String kid = entry.optString("kid", null);
-          String keyBase64 = entry.optString("key", null);
-          if (kid != null && keyBase64 != null) {
-            byte[] keyBytes = android.util.Base64.decode(keyBase64, android.util.Base64.DEFAULT);
-            manifestKeys.add(new ManifestVerifier.KeyEntry(kid, keyBytes));
-          }
-        }
-        if (manifestKeys.isEmpty()) {
-          android.util.Log.e(
-            "OtaKit",
-            "manifestKeys configured but all entries are invalid. Manifest verification will reject all updates."
-          );
-          manifestKeys.add(new ManifestVerifier.KeyEntry("_invalid_", new byte[0]));
-        }
-      }
-    } catch (Exception e) {
-      android.util.Log.e(
-        "OtaKit",
-        "Failed to parse manifestKeys. Manifest verification will reject all updates.",
-        e
-      );
-      manifestKeys.add(new ManifestVerifier.KeyEntry("_invalid_", new byte[0]));
-    }
+    manifestKeys = ManifestKeyConfig.parse(getConfig().getConfigJSON());
 
     if (manifestKeys.isEmpty() && HostedManifestKeys.matchesManagedManifestUrl(cdnUrl)) {
       manifestKeys.addAll(HostedManifestKeys.createDefaultKeys());
@@ -231,13 +218,17 @@ public class UpdaterPlugin extends Plugin {
     this.appReadyTimeoutMs = Math.max(1000, getConfig().getInt("appReadyTimeout", 10_000));
     this.checkIntervalMs = getConfig().getInt("checkInterval", 600_000);
 
-    pruneIncompatibleBundles();
-
-    UpdaterCoordinator.StartupPreparation startup = coordinator.normalizeStartupState(
-      this::isBundleUsable
-    );
-    coordinator.cleanupBundles(startup.cleanupBundleIds);
-    pendingStartupPreparation = startup;
+    try {
+      pruneIncompatibleBundles();
+      UpdaterCoordinator.StartupPreparation startup = coordinator.normalizeStartupState(
+        this::isBundleUsable
+      );
+      cleanupInBackground(startup.cleanupBundleIds);
+      pendingStartupPreparation = startup;
+      storageReady = true;
+    } catch (Exception error) {
+      android.util.Log.e("OtaKit", "Cannot persist startup recovery; keeping builtin", error);
+    }
   }
 
   @Override
@@ -249,6 +240,12 @@ public class UpdaterPlugin extends Plugin {
   @Override
   protected void handleOnResume() {
     super.handleOnResume();
+    lifecycleState = "foreground";
+    trialDeadline.setForeground(true);
+    if (bridge != null) DeviceEventClient.resume(
+      new File(getContext().getNoBackupFilesDir(), "otakit-events")
+    );
+    if (!storageReady) return;
     if (coldStartInProgress) {
       coldStartInProgress = false;
       return;
@@ -256,6 +253,20 @@ public class UpdaterPlugin extends Plugin {
     handleResume();
   }
 
+  @Override
+  protected void handleOnPause() {
+    lifecycleState = "background";
+    trialDeadline.setForeground(false);
+    super.handleOnPause();
+  }
+
+  @Override
+  protected void handleOnDestroy() {
+    updateOwner.close();
+    trialDeadline.cancel();
+    super.handleOnDestroy();
+  }
+
   private boolean shouldSkipCheckInterval() {
     if (checkIntervalMs <= 0) return false;
     long lastCheck = store.getPrefs().getLong(KEY_LAST_CHECK_TIMESTAMP, 0);
@@ -285,9 +296,14 @@ public class UpdaterPlugin extends Plugin {
 
     if (startup.activationPath != null && !startup.activationPath.isEmpty()) {
       try {
+        if (startup.trial != null) installReadinessBridge(startup.trial);
         applyServerBasePathSynchronously(startup.activationPath);
       } catch (Exception e) {
         android.util.Log.w("OtaKit", "startup activation failed", e);
+        if (startup.trial != null) {
+          rollbackCurrentBundle(startup.trial, "activation_failed");
+          return;
+        }
       }
     }
 
@@ -295,8 +311,8 @@ public class UpdaterPlugin extends Plugin {
       sendDeviceEvent(startup.eventPayload);
     }
 
-    if (startup.trialBundleId != null) {
-      scheduleTrialTimeout(startup.trialBundleId);
+    if (startup.trial != null) {
+      scheduleTrialTimeout(startup.trial);
     } else {
       cancelTrialTimeout();
     }
@@ -319,7 +335,7 @@ public class UpdaterPlugin extends Plugin {
         if (hasStagedBundle) {
           resolveCurrentRuntimeKey();
           try {
-            if (!applyStaged(false)) {
+            if (!applyStaged()) {
               android.util.Log.w(
                 "OtaKit",
                 "Failed to apply a valid staged bundle during runtime handling"
@@ -334,7 +350,7 @@ public class UpdaterPlugin extends Plugin {
           DownloadResolution result = downloadLatest(false, null);
           resolveCurrentRuntimeKey();
           if (result.isForcedStaged()) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -343,7 +359,7 @@ public class UpdaterPlugin extends Plugin {
           DownloadResolution result = downloadLatest(false, null);
           resolveCurrentRuntimeKey();
           if (result.isForcedStaged()) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -355,7 +371,7 @@ public class UpdaterPlugin extends Plugin {
             return;
           }
           resolveCurrentRuntimeKey();
-          requireApplyStaged(true);
+          requireApplyStaged();
         });
         return;
     }
@@ -367,7 +383,7 @@ public class UpdaterPlugin extends Plugin {
         return;
       case APPLY_STAGED:
         try {
-          if (applyStaged(false)) {
+          if (applyStaged()) {
             return;
           }
         } catch (Exception e) {
@@ -377,7 +393,7 @@ public class UpdaterPlugin extends Plugin {
         executeAutomaticUpdate("launch apply-staged fallback", () -> {
           DownloadResolution result = downloadLatest(false, null);
           if (result.isForcedStaged()) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -385,7 +401,7 @@ public class UpdaterPlugin extends Plugin {
         executeAutomaticUpdate("launch shadow", () -> {
           DownloadResolution result = downloadLatest(false, null);
           if (result.isForcedStaged()) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -393,7 +409,7 @@ public class UpdaterPlugin extends Plugin {
         executeAutomaticUpdate("launch immediate", () -> {
           DownloadResolution result = downloadLatest(false, null);
           if ("staged".equals(result.kind)) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -406,12 +422,12 @@ public class UpdaterPlugin extends Plugin {
         return;
       case APPLY_STAGED:
         executeAutomaticUpdate("resume apply-staged", () -> {
-          if (applyStaged(true)) {
+          if (applyStaged()) {
             return;
           }
           DownloadResolution result = downloadLatest(true, null);
           if (result.isForcedStaged()) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -419,7 +435,7 @@ public class UpdaterPlugin extends Plugin {
         executeAutomaticUpdate("resume shadow", () -> {
           DownloadResolution result = downloadLatest(true, null);
           if (result.isForcedStaged()) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -427,7 +443,7 @@ public class UpdaterPlugin extends Plugin {
         executeAutomaticUpdate("resume immediate", () -> {
           DownloadResolution result = downloadLatest(false, null);
           if ("staged".equals(result.kind)) {
-            requireApplyStaged(true);
+            requireApplyStaged();
           }
         });
         return;
@@ -441,7 +457,10 @@ public class UpdaterPlugin extends Plugin {
     }
     executor.execute(() -> {
       try {
+        ensureOwnerActive();
         operation.run();
+      } catch (java.util.concurrent.CancellationException ignored) {
+        // The owning bridge went away; this is not a failed update attempt.
       } catch (Exception e) {
         android.util.Log.w("OtaKit", label + " failed", e);
       } finally {
@@ -539,7 +558,7 @@ public class UpdaterPlugin extends Plugin {
     }
     executor.execute(() -> {
       try {
-        requireApplyStaged(true);
+        requireApplyStaged();
       } catch (Exception e) {
         call.reject("apply failed: " + e.getMessage());
       } finally {
@@ -558,7 +577,7 @@ public class UpdaterPlugin extends Plugin {
       try {
         DownloadResolution result = downloadLatest(false, null);
         if ("staged".equals(result.kind)) {
-          requireApplyStaged(true);
+          requireApplyStaged();
           return;
         }
         call.resolve();
@@ -572,18 +591,24 @@ public class UpdaterPlugin extends Plugin {
 
   @PluginMethod
   public void notifyAppReady(PluginCall call) {
-    cancelTrialTimeout();
-    UpdaterCoordinator.NotifyReadyPreparation preparation = coordinator.prepareNotifyAppReady();
-    coordinator.cleanupBundles(preparation.cleanupBundleIds);
-    if (preparation.eventPayload != null) {
-      sendDeviceEvent(preparation.eventPayload);
-      // eventPayload is non-null only on a genuine trial -> success transition,
-      // so repeat notifyAppReady() calls never double-emit.
-      JSObject appliedData = new JSObject();
-      appliedData.put("bundle", store.getCurrentBundle().toJSObject());
-      emitEvent("updateApplied", appliedData);
-    }
-    call.resolve();
+    mainHandler.post(() -> {
+      try {
+        UpdaterCoordinator.NotifyReadyPreparation preparation = updateOwner.run(() ->
+          coordinator.prepareNotifyAppReady(call.getString("_otakitActivationId"))
+        );
+        cleanupInBackground(preparation.cleanupBundleIds);
+        if (preparation.eventPayload != null) {
+          cancelTrialTimeout();
+          sendDeviceEvent(preparation.eventPayload);
+          JSObject appliedData = new JSObject();
+          appliedData.put("bundle", store.getCurrentBundle().toJSObject());
+          emitEvent("updateApplied", appliedData);
+        }
+        call.resolve();
+      } catch (Exception error) {
+        call.reject("Could not persist update readiness: " + error.getMessage(), error);
+      }
+    });
   }
 
   @PluginMethod
@@ -658,17 +683,38 @@ public class UpdaterPlugin extends Plugin {
       throw new IllegalStateException("Missing appId in plugin config");
     }
 
-    return ManifestClient.fetchLatest(
-      cdnUrl,
-      appId,
-      channel,
-      runtimeVersion,
-      allowInsecureUrls,
-      manifestKeys
+    String checkId = "check-" + java.util.UUID.randomUUID();
+    return CheckFailure.observe(
+      () -> {
+        ManifestClient.LatestManifest latest = ManifestClient.fetchLatest(
+          cdnUrl,
+          appId,
+          channel,
+          runtimeVersion,
+          allowInsecureUrls,
+          manifestKeys
+        );
+        ensureOwnerActive();
+        return latest;
+      },
+      failure -> {
+        ensureOwnerActive();
+        sendDeviceEvent(
+          "check_error",
+          null,
+          runtimeVersion,
+          channel,
+          null,
+          failure.detail,
+          checkId,
+          failure.phase
+        );
+      }
     );
   }
 
   private CheckResolution checkLatest(boolean respectInterval, String channel) throws Exception {
+    ensureOwnerActive();
     String targetChannel = resolveTargetChannel(channel);
     if (respectInterval && shouldSkipCheckInterval()) {
       android.util.Log.d("OtaKit", "Skipping resume check: checkInterval has not elapsed");
@@ -750,6 +796,17 @@ public class UpdaterPlugin extends Plugin {
     String targetChannel
   ) throws Exception {
     if (!isCompatibleRuntime(latest.runtimeVersion)) {
+      ensureOwnerActive();
+      sendDeviceEvent(
+        "check_error",
+        latest.version,
+        runtimeVersion,
+        targetChannel,
+        latest.releaseId,
+        "runtime_mismatch",
+        "check-" + java.util.UUID.randomUUID(),
+        "check"
+      );
       throw new IllegalStateException(
         "Manifest runtimeVersion does not match the installed app runtime"
       );
@@ -785,15 +842,7 @@ public class UpdaterPlugin extends Plugin {
   }
 
   private boolean isExpiredURLError(Exception e) {
-    String msg = e.getMessage();
-    if (msg == null) return false;
-    msg = msg.toLowerCase();
-    return (
-      msg.contains("403") ||
-      msg.contains("410") ||
-      msg.contains("forbidden") ||
-      msg.contains("expired")
-    );
+    return DownloadRetry.isExpiredUrlFailure(e);
   }
 
   private BundleInfo downloadAndStage(
@@ -806,6 +855,9 @@ public class UpdaterPlugin extends Plugin {
     String releaseId,
     ManifestClient.ManifestEncryption encryption
   ) throws Exception {
+    ensureOwnerActive();
+    String installationId = BundleStore.newInstallationId();
+    String phase = "admission";
     // Check disk space before downloading
     if (expectedSize > 0) {
       // zip + extracted + buffer; encrypted bundles keep an extra decrypted
@@ -820,7 +872,9 @@ public class UpdaterPlugin extends Plugin {
           runtimeVersion,
           channel,
           releaseId,
-          "insufficient_disk_space"
+          "insufficient_disk_space",
+          installationId,
+          phase
         );
         emitEvent(
           "downloadFailed",
@@ -835,15 +889,22 @@ public class UpdaterPlugin extends Plugin {
     File extractedDirectory = null;
 
     try {
+      phase = "transfer";
       downloadedZip = downloadZip(url);
+      ensureOwnerActive();
       // The manifest sha256 covers the downloaded object as-is — the
       // ciphertext when the bundle is encrypted.
-      if (!HashUtils.verify(downloadedZip, expectedSha256)) {
-        throw new IllegalStateException("Downloaded bundle hash mismatch");
-      }
+      phase = "integrity";
+      HashUtils.verifyDownload(
+        downloadedZip,
+        expectedSha256,
+        expectedSize > 0 ? expectedSize : -1,
+        "bundle"
+      );
 
       File zipToExtract = downloadedZip;
       if (encryption != null) {
+        phase = "decrypt";
         byte[] kek = bundleKeys.get(encryption.kid);
         if (kek == null) {
           throw new IllegalStateException("no matching bundle key (kid " + encryption.kid + ")");
@@ -866,6 +927,7 @@ public class UpdaterPlugin extends Plugin {
         zipToExtract = decryptedZip;
       }
 
+      phase = "extract";
       extractedDirectory = new File(
         getContext().getCacheDir(),
         "otakit-extract-" + System.currentTimeMillis()
@@ -877,10 +939,11 @@ public class UpdaterPlugin extends Plugin {
       zipUtils.extractSecurely(zipToExtract, extractedDirectory);
       File bundleRoot = resolveBundleRoot(extractedDirectory);
 
-      String bundleId = buildBundleId(version, releaseId, expectedSha256);
+      phase = "install";
+      String bundleId = installationId;
       File destination = coordinator.bundleDirectory(bundleId);
       if (destination.exists()) {
-        deleteRecursively(destination);
+        throw new IllegalStateException("Bundle installation directory already exists");
       }
       moveDirectory(bundleRoot, destination);
 
@@ -895,22 +958,35 @@ public class UpdaterPlugin extends Plugin {
         channel,
         releaseId
       );
-      java.util.List<String> cleanupBundleIds = coordinator.stageDownloadedBundle(info);
+      phase = "stage";
+      java.util.List<String> cleanupBundleIds = stageOwnedBundle(info);
       coordinator.cleanupBundles(cleanupBundleIds);
 
-      sendDeviceEvent("downloaded", version, runtimeVersion, channel, releaseId, null);
+      sendDeviceEvent(
+        "downloaded",
+        version,
+        runtimeVersion,
+        channel,
+        releaseId,
+        null,
+        installationId,
+        phase
+      );
       JSObject stagedData = new JSObject();
       stagedData.put("bundle", info.toJSObject());
       emitEvent("updateStaged", stagedData);
       return info;
     } catch (Exception e) {
+      if (e instanceof java.util.concurrent.CancellationException) throw e;
       sendDeviceEvent(
         "download_error",
         version,
         runtimeVersion,
         channel,
         releaseId,
-        e.getMessage()
+        e.getMessage(),
+        installationId,
+        phase
       );
       emitEvent(
         "downloadFailed",
@@ -918,6 +994,9 @@ public class UpdaterPlugin extends Plugin {
       );
       throw e;
     } finally {
+      if (installationId != null) coordinator.cleanupBundles(
+        java.util.Collections.singletonList(installationId)
+      );
       if (downloadedZip != null && downloadedZip.exists()) {
         //noinspection ResultOfMethodCallIgnored
         downloadedZip.delete();
@@ -935,35 +1014,7 @@ public class UpdaterPlugin extends Plugin {
   }
 
   private File downloadZip(URL url) throws Exception {
-    ManifestClient.requireHTTPS(url, allowInsecureUrls);
-    HttpURLConnection connection = (HttpURLConnection) url.openConnection();
-    try {
-      connection.setRequestMethod("GET");
-      connection.setConnectTimeout(15_000);
-      connection.setReadTimeout(60_000);
-
-      int status = connection.getResponseCode();
-      if (status < 200 || status >= 300) {
-        throw new IllegalStateException("Download failed with HTTP " + status);
-      }
-
-      File destination = File.createTempFile("otakit-", ".zip", getContext().getCacheDir());
-
-      try (
-        InputStream input = connection.getInputStream();
-        FileOutputStream output = new FileOutputStream(destination)
-      ) {
-        byte[] buffer = new byte[8192];
-        int read;
-        while ((read = input.read(buffer)) > 0) {
-          output.write(buffer, 0, read);
-        }
-      }
-
-      return destination;
-    } finally {
-      connection.disconnect();
-    }
+    return FileDownloader.download(url, getContext().getCacheDir(), allowInsecureUrls);
   }
 
   private File resolveBundleRoot(File extractedDirectory) throws Exception {
@@ -983,61 +1034,92 @@ public class UpdaterPlugin extends Plugin {
     throw new IllegalStateException("Bundle archive does not contain index.html");
   }
 
-  private boolean applyStaged(boolean reloadAfterApply) throws Exception {
+  private boolean applyStaged() throws Exception {
+    java.util.concurrent.atomic.AtomicBoolean applied =
+      new java.util.concurrent.atomic.AtomicBoolean();
+    runOnMainSynchronously(() -> applied.set(updateOwner.run(this::applyStagedOnMain)));
+    return applied.get();
+  }
+
+  private java.util.List<String> stageOwnedBundle(BundleInfo bundle) throws Exception {
+    AtomicReference<java.util.List<String>> cleanup = new AtomicReference<>();
+    runOnMainSynchronously(() ->
+      cleanup.set(updateOwner.run(() -> coordinator.stageDownloadedBundle(bundle)))
+    );
+    return cleanup.get();
+  }
+
+  private void ensureOwnerActive() throws Exception {
+    runOnMainSynchronously(() -> updateOwner.run(() -> null));
+  }
+
+  private void cleanupInBackground(java.util.List<String> ids) {
+    if (!ids.isEmpty()) executor.execute(() -> coordinator.cleanupBundles(ids));
+  }
+
+  private void installReadinessBridge(UpdaterCoordinator.Trial trial) {
+    documentReadyBridge.install(bridge.getWebView(), bridge.getAppUrl(), trial.activationId);
+  }
+
+  private boolean applyStagedOnMain() throws Exception {
+    DocumentReadyBridge.preflight(bridge.getWebView(), bridge.getAppUrl());
     UpdaterCoordinator.ApplyPreparation preparation = coordinator.prepareApplyStaged(
       this::isCompatibleRuntime,
       this::isBundleUsable
     );
-    coordinator.cleanupBundles(preparation.cleanupBundleIds);
+    cleanupInBackground(preparation.cleanupBundleIds);
     if (!preparation.didApply()) {
       return false;
     }
 
-    applyServerBasePathSynchronously(preparation.activationPath);
-    if (reloadAfterApply) {
-      reloadWebViewSynchronously();
+    try {
+      if (preparation.trial != null) installReadinessBridge(preparation.trial);
+      applyServerBasePathSynchronously(preparation.activationPath);
+    } catch (Exception error) {
+      if (preparation.trial != null) rollbackCurrentBundle(preparation.trial, "activation_failed");
+      throw error;
     }
 
     cancelTrialTimeout();
-    if (preparation.trialBundleId != null) {
-      scheduleTrialTimeout(preparation.trialBundleId);
+    if (preparation.trial != null) {
+      scheduleTrialTimeout(preparation.trial);
     }
     return true;
   }
 
-  private void requireApplyStaged(boolean reloadAfterApply) throws Exception {
-    if (!applyStaged(reloadAfterApply)) {
+  private void requireApplyStaged() throws Exception {
+    if (!applyStaged()) {
       throw new IllegalStateException("Expected a staged bundle to be ready for apply");
     }
   }
 
-  private void scheduleTrialTimeout(String bundleId) {
-    cancelTrialTimeout();
-    trialTimeoutRunnable = () -> {
-      if (coordinator.isCurrentTrialBundle(bundleId)) {
-        rollbackCurrentBundle("notify_timeout", true);
-      }
-    };
-    mainHandler.postDelayed(trialTimeoutRunnable, appReadyTimeoutMs);
+  private void scheduleTrialTimeout(UpdaterCoordinator.Trial trial) {
+    trialDeadline.start(appReadyTimeoutMs, () -> rollbackCurrentBundle(trial, "notify_timeout"));
   }
 
   private void cancelTrialTimeout() {
-    if (trialTimeoutRunnable != null) {
-      mainHandler.removeCallbacks(trialTimeoutRunnable);
-      trialTimeoutRunnable = null;
-    }
+    trialDeadline.cancel();
   }
 
-  private void rollbackCurrentBundle(String reason, boolean shouldReload) {
-    cancelTrialTimeout();
-    UpdaterCoordinator.RollbackPreparation preparation = coordinator.prepareRollback(
-      reason,
-      this::isBundleUsable
-    );
+  private void rollbackCurrentBundle(UpdaterCoordinator.Trial expectedTrial, String reason) {
+    UpdaterCoordinator.RollbackPreparation preparation;
+    try {
+      preparation = updateOwner.run(() ->
+        coordinator.prepareRollback(expectedTrial, reason, this::isBundleUsable)
+      );
+    } catch (java.util.concurrent.CancellationException ignored) {
+      cancelTrialTimeout();
+      return;
+    } catch (Exception error) {
+      android.util.Log.e("OtaKit", "Cannot persist rollback", error);
+      scheduleTrialTimeout(expectedTrial);
+      return;
+    }
     if (!preparation.didRollback) {
       return;
     }
-    coordinator.cleanupBundles(preparation.cleanupBundleIds);
+    cancelTrialTimeout();
+    cleanupInBackground(preparation.cleanupBundleIds);
     if (preparation.eventPayload != null) {
       sendDeviceEvent(preparation.eventPayload);
       emitEvent(
@@ -1056,9 +1138,6 @@ public class UpdaterPlugin extends Plugin {
 
     try {
       applyServerBasePathSynchronously(preparation.activationPath);
-      if (shouldReload) {
-        reloadWebViewSynchronously();
-      }
     } catch (Exception e) {
       android.util.Log.w("OtaKit", "rollback activation failed", e);
     }
@@ -1069,20 +1148,12 @@ public class UpdaterPlugin extends Plugin {
       if (bridge == null) {
         throw new IllegalStateException("Bridge not available for activation");
       }
-      if (path == null || path.isEmpty()) {
-        bridge.setServerAssetPath(BUILTIN_ASSET_PATH);
-      } else {
-        bridge.setServerBasePath(path);
-      }
-    });
-  }
-
-  private void reloadWebViewSynchronously() throws Exception {
-    runOnMainSynchronously(() -> {
-      if (bridge == null || bridge.getWebView() == null) {
-        throw new IllegalStateException("WebView not available for reload");
-      }
-      bridge.getWebView().reload();
+      WebViewActivation.activate(
+        path,
+        BUILTIN_ASSET_PATH,
+        bridge::setServerBasePath,
+        bridge::setServerAssetPath
+      );
     });
   }
 
@@ -1170,6 +1241,9 @@ public class UpdaterPlugin extends Plugin {
    */
   private BundleInfo assembleAndStage(ManifestClient.LatestManifest manifest, String targetChannel)
     throws Exception {
+    ensureOwnerActive();
+    String installationId = BundleStore.newInstallationId();
+    String phase = "admission";
     // Same conservative disk-space guard as the zip path.
     if (manifest.size > 0) {
       long requiredSpace = (long) (manifest.size * 2.5);
@@ -1180,7 +1254,9 @@ public class UpdaterPlugin extends Plugin {
           manifest.runtimeVersion,
           targetChannel,
           manifest.releaseId,
-          "insufficient_disk_space"
+          "insufficient_disk_space",
+          installationId,
+          phase
         );
         emitEvent(
           "downloadFailed",
@@ -1202,6 +1278,7 @@ public class UpdaterPlugin extends Plugin {
     );
 
     try {
+      phase = "delta";
       if (manifest.files == null || manifest.files.isEmpty()) {
         throw new IllegalStateException("Delta manifest is missing its file list");
       }
@@ -1214,10 +1291,11 @@ public class UpdaterPlugin extends Plugin {
       assembler.seedFromBuiltinIfNeeded(getContext(), BUILTIN_ASSET_PATH, store.getNativeBuild());
       assembler.assemble(manifest.files, assembleDirectory, getContext());
 
-      String bundleId = buildBundleId(manifest.version, manifest.releaseId, manifest.sha256);
+      phase = "install";
+      String bundleId = installationId;
       File destination = coordinator.bundleDirectory(bundleId);
       if (destination.exists()) {
-        deleteRecursively(destination);
+        throw new IllegalStateException("Bundle installation directory already exists");
       }
       moveDirectory(assembleDirectory, destination);
 
@@ -1247,7 +1325,8 @@ public class UpdaterPlugin extends Plugin {
         targetChannel,
         manifest.releaseId
       );
-      java.util.List<String> cleanupBundleIds = coordinator.stageDownloadedBundle(info);
+      phase = "stage";
+      java.util.List<String> cleanupBundleIds = stageOwnedBundle(info);
       coordinator.cleanupBundles(cleanupBundleIds);
 
       pruneDeltaCache(assembler);
@@ -1258,20 +1337,25 @@ public class UpdaterPlugin extends Plugin {
         manifest.runtimeVersion,
         targetChannel,
         manifest.releaseId,
-        null
+        null,
+        installationId,
+        phase
       );
       JSObject stagedData = new JSObject();
       stagedData.put("bundle", info.toJSObject());
       emitEvent("updateStaged", stagedData);
       return info;
     } catch (Exception e) {
+      if (e instanceof java.util.concurrent.CancellationException) throw e;
       sendDeviceEvent(
         "download_error",
         manifest.version,
         manifest.runtimeVersion,
         targetChannel,
         manifest.releaseId,
-        e.getMessage()
+        e.getMessage(),
+        installationId,
+        phase
       );
       emitEvent(
         "downloadFailed",
@@ -1285,6 +1369,9 @@ public class UpdaterPlugin extends Plugin {
       );
       throw e;
     } finally {
+      if (installationId != null) coordinator.cleanupBundles(
+        java.util.Collections.singletonList(installationId)
+      );
       if (assembleDirectory.exists()) {
         try {
           deleteRecursively(assembleDirectory);
@@ -1388,36 +1475,6 @@ public class UpdaterPlugin extends Plugin {
     }
   }
 
-  private String buildBundleId(String version, String releaseId, String sha256) throws Exception {
-    String trimmed = version == null ? "" : version.trim();
-    String normalized = trimmed.replaceAll("[^A-Za-z0-9._-]", "-");
-    normalized = normalized.replaceAll("-{2,}", "-");
-    normalized = normalized.replaceAll("^[\\-.]+|[\\-.]+$", "");
-    if (normalized.isEmpty()) {
-      normalized = "bundle";
-    }
-    if (normalized.length() > 64) {
-      normalized = normalized.substring(0, 64);
-    }
-
-    String identitySource = trimToNull(releaseId);
-    if (identitySource == null) {
-      identitySource = trimToNull(sha256);
-    }
-    if (identitySource == null) {
-      identitySource = trimmed;
-    }
-
-    MessageDigest digest = MessageDigest.getInstance("SHA-256");
-    byte[] hash = digest.digest(identitySource.getBytes(StandardCharsets.UTF_8));
-    StringBuilder suffix = new StringBuilder();
-    for (int i = 0; i < 6; i++) {
-      suffix.append(String.format("%02x", hash[i]));
-    }
-
-    return normalized + "-" + suffix;
-  }
-
   private String resolveIngestUrl(String configured, String env) {
     String configuredValue = trimToNull(configured);
     if (configuredValue != null) {
@@ -1539,6 +1596,19 @@ public class UpdaterPlugin extends Plugin {
     String channel,
     String releaseId,
     String detail
+  ) {
+    sendDeviceEvent(action, bundleVersion, runtimeVersion, channel, releaseId, detail, null, null);
+  }
+
+  private void sendDeviceEvent(
+    String action,
+    String bundleVersion,
+    String runtimeVersion,
+    String channel,
+    String releaseId,
+    String detail,
+    String attemptId,
+    String phase
   ) {
     sendDeviceEvent(
       new UpdaterCoordinator.DeviceEventPayload(
@@ -1547,7 +1617,9 @@ public class UpdaterPlugin extends Plugin {
         runtimeVersion,
         channel,
         releaseId,
-        detail
+        detail,
+        attemptId,
+        phase
       )
     );
   }
@@ -1557,12 +1629,12 @@ public class UpdaterPlugin extends Plugin {
       return;
     }
     String normalizedBundleVersion = trimToNull(payload.bundleVersion);
-    if (normalizedBundleVersion == null) {
+    if (normalizedBundleVersion == null && !"check_error".equals(payload.action)) {
       android.util.Log.w("OtaKit", "Skipping device event without bundleVersion");
       return;
     }
     String normalizedReleaseId = trimToNull(payload.releaseId);
-    if (normalizedReleaseId == null) {
+    if (normalizedReleaseId == null && !"check_error".equals(payload.action)) {
       android.util.Log.w("OtaKit", "Skipping device event without releaseId");
       return;
     }
@@ -1581,7 +1653,10 @@ public class UpdaterPlugin extends Plugin {
       trimToNull(payload.runtimeVersion),
       normalizedReleaseId,
       nativeBuild,
-      payload.detail
+      payload.detail,
+      payload.attemptId,
+      payload.phase,
+      lifecycleState
     );
   }