pulse-updates 1.2.1 → 1.2.3

package/android/src/main/java/app/pulse/updates/PulseController.kt

@@ -680,6 +680,20 @@ class PulseController private constructor() {
         // Re-select the best update before reloading
         launchBestUpdate { success ->
             pulseLog(TAG, "Reload: launchBestUpdate success=$success")
+            if (!success) {
+                // Same fallback the cold-start path has always had, and for the same reason: with no
+                // launchable update left, launchAssetFile still points at whatever was running, so the
+                // host reload below would come straight back up on the bundle we are trying to leave.
+                //
+                // That is not hypothetical. Measured on a Pixel 6a (2026-08-26): an update that marks
+                // ITSELF unusable (Bastion's Layer-0 canary) marked itself FAILED, which emptied the
+                // launchable list, launchBestUpdate failed, and the app reloaded into the same broken
+                // bundle 29 times in a row — a splash screen that never resolves, which is worse than
+                // the problem it was trying to escape. Falling back to the bundle inside the APK gives
+                // the reload something good to land on.
+                pulseLogWarn(TAG, "Reload: no launchable update, falling back to embedded")
+                launchEmbedded()
+            }
             callback(success)
         }
     }
@@ -698,10 +712,27 @@ class PulseController private constructor() {
         runReaper()
     }
 
+    /**
+     * Report that THIS update is not usable, from JS.
+     *
+     * It used to only bump the failure counter, which nothing reads at selection time:
+     * launchableUpdates() filters on `status IN ('ready','embedded')`, so the update stayed
+     * selectable and the next launch booted the very bundle the caller had just declared broken.
+     * The API said "trigger rollback on next start" and did not. Now it marks the update FAILED —
+     * the same thing the native crash handler does — which is what actually takes it out of the
+     * running and falls back to the previous good update, or to the embedded one.
+     *
+     * The embedded bundle is never demoted: it is the floor, and excluding it would leave the app
+     * with nothing to launch.
+     */
     fun reportLaunchFailure(reason: String) {
         launchedUpdate?.let { update ->
             try {
                 database?.recordFailedLaunch(update.updateId)
+                if (!update.isEmbedded) {
+                    database?.setStatus(update.updateId, PulseUpdateStatus.FAILED)
+                    pulseLogWarn(TAG, "reportLaunchFailure: marked ${update.updateId} FAILED ($reason)")
+                }
             } catch (e: Exception) {
                 pulseLogWarn(TAG, "Failed to record launch failure: ${e.message}")
             }

package/ios/PulseUpdates/PulseController.swift

@@ -713,7 +713,16 @@ public final class PulseController {
     /// Reload the app with the new update
     public func reload(completion: ((Bool) -> Void)? = nil) {
         // Re-select the best update before reloading
-        launchBestUpdate { success in
+        launchBestUpdate { [weak self] success in
+            if !success {
+                // Same fallback the cold-start path has, and for the same reason: with no launchable
+                // update left, launchAssetUrl still points at whatever is running, so the reload comes
+                // straight back up on the bundle we are trying to leave. Measured on Android (Pixel 6a,
+                // 2026-08-26): an update that marked ITSELF unusable emptied the launchable list and the
+                // app reloaded into the same broken bundle 29 times — a splash that never resolves.
+                pulseLog("Reload: no launchable update, falling back to embedded")
+                self?.launchEmbedded()
+            }
             // Signal React Native to reload with the new bundle
             NotificationCenter.default.post(name: NSNotification.Name("PulseUpdatesReload"), object: nil)
             completion?(success)
@@ -769,6 +778,23 @@ public final class PulseController {
         errorRecovery?.handle(error: error)
     }
 
+    /// Mark THIS update unusable, from JS.
+    ///
+    /// The recovery pipeline only marks a failure when content never appeared, and even then it just
+    /// bumps the counter — which nothing reads when picking what to launch (the selection filters on
+    /// status). So an update the app itself declares broken stayed selectable and came back on the
+    /// next start. Flipping the status is what actually takes it out of the running.
+    ///
+    /// The embedded bundle is never demoted: it is the floor, and excluding it would leave nothing
+    /// to launch.
+    public func markLaunchFailed(_ reason: String) {
+        guard let update = launchedUpdate, !update.isEmbedded else { return }
+        try? database?.recordFailedLaunch(updateId: update.updateId)
+        try? database?.setStatus(.failed, forUpdateId: update.updateId)
+        reportEvent("launch_failure", updateId: update.updateId)
+        pulseLog("markLaunchFailed: marked \(update.updateId) failed (\(reason))")
+    }
+
     /// Report a fatal exception for error recovery handling
     public func reportException(_ exception: NSException) {
         errorRecovery?.handle(exception: exception)

package/ios/PulseUpdates/PulseUpdates.swift

@@ -219,6 +219,10 @@ public class PulseUpdates: RCTEventEmitter {
     func reportLaunchFailure(_ reason: String,
                              resolve: @escaping RCTPromiseResolveBlock,
                              reject: @escaping RCTPromiseRejectBlock) {
+        // Both halves: the recovery pipeline still sees the error (it drives its own policy), and the
+        // update is marked FAILED so the next selection actually skips it — which is what this API
+        // has always claimed to do.
+        PulseController.shared.markLaunchFailed(reason)
         let error = NSError(domain: "PulseUpdates", code: -1, userInfo: [NSLocalizedDescriptionKey: reason])
         PulseController.shared.reportError(error)
         resolve(nil)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-updates",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "OTA updates for React Native - lightweight alternative to expo-updates",
   "main": "lib/commonjs/index.js",
   "module": "lib/module/index.js",

package/scripts/publish.mjs

@@ -1174,20 +1174,36 @@ export function findLatestGeneratedAndroidCapabilitySource(projectRoot = process
   if (!fs.existsSync(buildRoot)) return null;
 
   const candidates = [];
+  const variantOf = (candidatePath) => {
+    const normal = candidatePath.replaceAll('\\', '/');
+    return normal.match(/\/react\/([^/]+)\/index\.android\.bundle/)?.[1]
+      || normal.match(/\/intermediates\/assets\/([^/]+)\//)?.[1]
+      || null;
+  };
   const visit = (directory) => {
     for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
       const fullPath = path.join(directory, entry.name);
       if (entry.isDirectory()) visit(fullPath);
       else if (entry.isFile() && entry.name === 'index.android.bundle.packager.map') {
-        candidates.push({ path: fullPath, modifiedAt: fs.statSync(fullPath).mtimeMs });
+        candidates.push({ path: fullPath, modifiedAt: fs.statSync(fullPath).mtimeMs, map: true, variant: variantOf(fullPath) });
       } else if (entry.isFile() && entry.name === 'index.android.bundle' && !isHermesBytecode(fullPath)) {
-        candidates.push({ path: fullPath, modifiedAt: fs.statSync(fullPath).mtimeMs });
+        candidates.push({ path: fullPath, modifiedAt: fs.statSync(fullPath).mtimeMs, map: false, variant: variantOf(fullPath) });
       }
     }
   };
   visit(buildRoot);
   candidates.sort((a, b) => b.modifiedAt - a.modifiedAt);
-  return candidates[0]?.path || null;
+  const latest = candidates[0];
+  if (!latest) return null;
+
+  // Gradle writes the minified bundle after its packager map. Choosing only by mtime therefore
+  // selects the bundle, where R8/Metro have erased the canonical native binding call sites, and
+  // reports a dangerous empty capability set. For the newest build variant, the packager map is
+  // authoritative because it retains every original module in sourcesContent.
+  const matchingMap = latest.variant
+    ? candidates.find((candidate) => candidate.map && candidate.variant === latest.variant)
+    : null;
+  return matchingMap?.path || latest.path;
 }