react-native-notify-kit 10.7.2 → 10.8.1

package/android/src/main/java/app/notifee/core/ForegroundService.java

@@ -18,6 +18,7 @@ package app.notifee.core;
  */
 
 import android.annotation.SuppressLint;
+import android.app.ForegroundServiceStartNotAllowedException;
 import android.app.Notification;
 import android.app.NotificationChannel;
 import android.app.NotificationManager;
@@ -29,7 +30,9 @@ import android.content.pm.PackageManager;
 import android.content.pm.ServiceInfo;
 import android.os.Build;
 import android.os.Bundle;
+import android.os.Handler;
 import android.os.IBinder;
+import android.os.Looper;
 import android.os.Trace;
 import androidx.annotation.Nullable;
 import androidx.annotation.RequiresApi;
@@ -40,6 +43,13 @@ import app.notifee.core.event.NotificationEvent;
 import app.notifee.core.interfaces.MethodCallResult;
 import app.notifee.core.model.NotificationModel;
 import app.notifee.core.utility.ParcelableCompatReader;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
 
 public class ForegroundService extends Service {
   private static final String TAG = "ForegroundService";
@@ -49,9 +59,189 @@ public class ForegroundService extends Service {
       "app.notifee.core.ForegroundService.STOP";
 
   private static final Object sLock = new Object();
+  // Serializes client START acceptance with instance-targeted STOP. Notification cache fields
+  // are not lifecycle authority. Lock order is sLifecycleLock, then sLock.
+  private static final Object sLifecycleLock = new Object();
+  // Only START senders take this lock (the notification pipeline runs on its executor). Service
+  // lifecycle callbacks must never wait for a sender's Binder reply before promoting themselves.
+  private static final Object sStartDispatchLock = new Object();
+  private static final Map<String, StartRequest> sPendingStarts = new HashMap<>();
+  private static final String START_REQUEST_ID = "notifee.foregroundServiceStartRequestId";
+  private static long sRunGeneration;
+  private static ForegroundService sInstance;
+  private static Object sStopRequest;
+  private static ForegroundService sStateOwner;
+  private int mLastStartId;
+  private boolean mStopInitiated;
+  private boolean mStartCommandFailed;
+  private boolean mForegroundActive;
+  private boolean mStartCommandSatisfied;
+  private long mRunGeneration;
+  // The admission fence may advance before posting. Cached state belongs to its last successful
+  // generation until the replacement platform call returns normally.
+  private long mStateGeneration;
+  private int mRunFirstStartId;
+  private Object mRunnerToken;
+  private ForegroundEpoch mForegroundEpoch;
+  // Previously admitted metadata can collide with a successor even across run generations.
+  // These IDs only disqualify stop authority; they never establish Android epoch provenance.
+  private final Set<Integer> mTimeoutStartIds = new HashSet<>();
+  // A reentrant platform callback may still inherit an outer lifecycle monitor. Drain these
+  // publications synchronously at that call's unlocked boundary, without scheduling or waiting.
+  private static final ThreadLocal<List<Runnable>> sTimeoutPublications = new ThreadLocal<>();
+
+  private static void publishTimeoutEventsIfUnlocked() {
+    if (Thread.holdsLock(sLifecycleLock) || Thread.holdsLock(sLock)) {
+      return;
+    }
+    List<Runnable> publications = sTimeoutPublications.get();
+    if (publications != null) {
+      sTimeoutPublications.remove();
+      for (Runnable publication : publications) {
+        publication.run();
+      }
+    }
+  }
+
+  // Local publication identity, never provenance supplied by Android's timeout callback.
+  // Guarded by sLifecycleLock then sLock. Retiring consumes timeout authority even on failure.
+  private static final class ForegroundEpoch {
+    final long runGeneration;
+    final boolean ambiguousPromotion;
+    final Set<Integer> satisfiedStartIds = new HashSet<>();
+    int lastSatisfiedStartId;
+    boolean retiring;
+    boolean retired;
+
+    ForegroundEpoch(long runGeneration, boolean ambiguousPromotion, int startId) {
+      this.runGeneration = runGeneration;
+      this.ambiguousPromotion = ambiguousPromotion;
+      satisfiedStartIds.add(startId);
+      lastSatisfiedStartId = startId;
+    }
+  }
+
+  // Caller holds both locks, after the actual promotion returned normally.
+  private void commitForegroundEpoch() {
+    ForegroundEpoch previous = mForegroundEpoch;
+    mForegroundEpoch =
+        new ForegroundEpoch(
+            mRunGeneration,
+            previous != null && previous.runGeneration == mRunGeneration,
+            mLastStartId);
+  }
+
+  // Snapshot before platform IPC; a reply cannot acquire authority over a reentrant successor.
+  private static final class StopAuthority {
+    final ForegroundService owner;
+    final ForegroundEpoch epoch;
+    final long generation;
+    final long runGeneration;
+    final int startId;
+    final Object request;
+
+    StopAuthority(ForegroundService service) {
+      owner = sStateOwner;
+      epoch = service.mForegroundEpoch;
+      generation = sRunGeneration;
+      runGeneration = service.mRunGeneration;
+      startId = service.mLastStartId;
+      request = sStopRequest;
+    }
+  }
+
+  // Caller holds sLifecycleLock. Follow the lifecycle -> state lock order for both snapshots.
+  private StopAuthority captureStopAuthority() {
+    synchronized (sLock) {
+      return new StopAuthority(this);
+    }
+  }
+
+  private boolean ownsStopAuthority(StopAuthority authority) {
+    synchronized (sLock) {
+      return sInstance == this
+          && sStateOwner == authority.owner
+          && mForegroundEpoch == authority.epoch
+          && sRunGeneration == authority.generation
+          && mRunGeneration == authority.runGeneration
+          && mLastStartId == authority.startId
+          && sStopRequest == authority.request
+          && sPendingStarts.isEmpty();
+    }
+  }
+
+  // A delivered command can be physically satisfied by the existing foreground publication,
+  // even if its notification update throws. A future/unfulfilled delivery gains no authority.
+  private void recordSatisfiedStart(int startId) {
+    synchronized (sLock) {
+      ForegroundEpoch epoch = mForegroundEpoch;
+      if (sInstance == this
+          && sStateOwner == this
+          && epoch != null
+          && !epoch.retiring
+          && !epoch.retired
+          && mForegroundActive
+          && mStartCommandSatisfied
+          && mLastStartId == startId
+          && epoch.runGeneration == mRunGeneration) {
+        epoch.satisfiedStartIds.add(startId);
+        epoch.lastSatisfiedStartId = startId;
+      }
+    }
+  }
+
+  // A denied initial promotion is not a client STOP. Its recovery cannot acquire authority
+  // over a later accepted/promoted run, and is consumed by one eligible stop attempt.
+  private DeniedStartRecovery mDeniedStartRecovery;
   private static final String DEFENSIVE_CHANNEL_ID = "notifee_fg_default";
   private static final int DEFENSIVE_NOTIFICATION_ID = Integer.MAX_VALUE - 1;
 
+  private static final class StartRequest {
+    final long generation;
+    final Object precedingStop;
+    boolean accepted;
+    // Dispatch acceptance is distinct from the promotion outcome and the physical instance's
+    // obligation. A denied delivered request is terminal even while its sender's reply is pending.
+    boolean promotionDenied;
+    // Null until delivery. An unfulfilled delivered request belongs to that physical instance.
+    ForegroundService instance;
+
+    StartRequest(long generation, Object precedingStop) {
+      this.generation = generation;
+      this.precedingStop = precedingStop;
+    }
+  }
+
+  private static final class DeniedStartRecovery {
+    final long generation;
+    final long runGeneration;
+    final int startId;
+    final int flags;
+    final RuntimeException denial;
+    final String requestId;
+    final String notificationId;
+    final int foregroundServiceType;
+
+    DeniedStartRecovery(
+        long generation,
+        long runGeneration,
+        int startId,
+        int flags,
+        RuntimeException denial,
+        String requestId,
+        String notificationId,
+        int foregroundServiceType) {
+      this.generation = generation;
+      this.runGeneration = runGeneration;
+      this.startId = startId;
+      this.flags = flags;
+      this.denial = denial;
+      this.requestId = requestId;
+      this.notificationId = notificationId;
+      this.foregroundServiceType = foregroundServiceType;
+    }
+  }
+
   /**
    * Tracks whether startForeground() has been called on THIS service instance. This is an instance
    * field (not static) because the static fields below track cross-invocation notification state
@@ -73,6 +263,66 @@ public class ForegroundService extends Service {
   private static Notification mCurrentNotification = null;
   private static int mCurrentHashCode = 0;
 
+  @Override
+  public void onCreate() {
+    super.onCreate();
+    synchronized (sLifecycleLock) {
+      if (sInstance != null) {
+        sInstance.mDeniedStartRecovery = null;
+      }
+      sInstance = this;
+      mRunGeneration = sRunGeneration;
+      synchronized (sLock) {
+        sStateOwner = this;
+        clearCurrentState();
+      }
+    }
+  }
+
+  @Override
+  public void onDestroy() {
+    synchronized (sLifecycleLock) {
+      mDeniedStartRecovery = null;
+      sPendingStarts.values().removeIf(request -> request.instance == this);
+      if (sInstance == this) {
+        sInstance = null;
+        if (sPendingStarts.isEmpty()) {
+          sStopRequest = null;
+        }
+      }
+      clearOwnedState();
+      mForegroundActive = false;
+      synchronized (sLock) {
+        if (sStateOwner == this) {
+          sStateOwner = null;
+        }
+      }
+    }
+    super.onDestroy();
+  }
+
+  // Caller holds sLock. Ownership is checked by clearOwnedState before any terminal cleanup.
+  private static void clearCurrentState() {
+    mCurrentNotificationId = null;
+    mCurrentForegroundServiceType = -1;
+    mCurrentNotificationBundle = null;
+    mCurrentNotification = null;
+    mCurrentHashCode = 0;
+  }
+
+  private void clearOwnedState() {
+    synchronized (sLock) {
+      if (sStateOwner == this) {
+        mDeniedStartRecovery = null;
+        clearCurrentState();
+        mRunnerToken = null;
+        if (mForegroundEpoch != null) {
+          mForegroundEpoch.retired = true;
+        }
+      }
+    }
+  }
+
   /**
    * Submits the latest foreground service notification again if the given notification ID matches
    * the active foreground service. On Android 14+, users can dismiss ongoing foreground service
@@ -82,16 +332,25 @@ public class ForegroundService extends Service {
    */
   @SuppressLint("MissingPermission")
   static boolean repostIfActive(String notificationId) {
-    synchronized (sLock) {
-      if (mCurrentNotificationId == null
-          || !mCurrentNotificationId.equals(notificationId)
-          || mCurrentNotification == null) {
-        return false;
+    try {
+      synchronized (sLifecycleLock) {
+        synchronized (sLock) {
+          if (mCurrentNotificationId == null
+              || (sStateOwner != null
+                  && sStateOwner.mForegroundEpoch != null
+                  && sStateOwner.mForegroundEpoch.retiring)
+              || !mCurrentNotificationId.equals(notificationId)
+              || mCurrentNotification == null) {
+            return false;
+          }
+          Logger.w(TAG, "Submitting dismissed foreground service notification for re-post");
+          NotificationManagerCompat.from(ContextHolder.getApplicationContext())
+              .notify(mCurrentHashCode, mCurrentNotification);
+          return true;
+        }
       }
-      Logger.w(TAG, "Submitting dismissed foreground service notification for re-post");
-      NotificationManagerCompat.from(ContextHolder.getApplicationContext())
-          .notify(mCurrentHashCode, mCurrentNotification);
-      return true;
+    } finally {
+      publishTimeoutEventsIfUnlocked();
     }
   }
 
@@ -130,55 +389,405 @@ public class ForegroundService extends Service {
     intent.putExtra("notification", notification);
     intent.putExtra("notificationBundle", notificationBundle);
 
-    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-      context.startForegroundService(intent);
-    } else {
-      // TODO test this on older device
-      context.startService(intent);
+    synchronized (sStartDispatchLock) {
+      // A retry/redelivery from a previous process must not alias a new pending request.
+      String requestId = UUID.randomUUID().toString();
+      intent.putExtra(START_REQUEST_ID, requestId);
+      StartRequest request;
+      synchronized (sLifecycleLock) {
+        request = new StartRequest(sRunGeneration, sStopRequest);
+        sPendingStarts.put(requestId, request);
+      }
+      ComponentName component;
+      try {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+          component = context.startForegroundService(intent);
+        } else {
+          component = context.startService(intent);
+        }
+      } catch (RuntimeException e) {
+        synchronized (sLifecycleLock) {
+          // Only a definite platform rejection releases an undelivered obligation. An unrelated
+          // exception can be a lost Binder reply: UNKNOWN must remain held until actual delivery.
+          if (!request.accepted
+              && (e instanceof SecurityException
+                  || (Build.VERSION.SDK_INT >= Build.VERSION_CODES.S
+                      && e instanceof ForegroundServiceStartNotAllowedException))) {
+            sPendingStarts.remove(requestId);
+          }
+          scheduleStop();
+        }
+        throw e;
+      }
+      synchronized (sLifecycleLock) {
+        if (component != null) {
+          acceptStart(request);
+        } else if (!request.accepted) {
+          sPendingStarts.remove(requestId);
+        }
+        scheduleStop();
+      }
     }
   }
 
-  static void stop() {
-    Context context = ContextHolder.getApplicationContext();
-    if (context == null) {
-      Logger.e(TAG, "Application context is null; cannot stop ForegroundService.");
+  // Caller holds sLifecycleLock. Delivery itself can prove acceptance before Context returns.
+  // A late reply never cancels a STOP ordered after this START was reserved/delivered.
+  private static void acceptStart(StartRequest request) {
+    if (request.promotionDenied) {
       return;
     }
+    if (!request.accepted) {
+      request.accepted = true;
+      if (sInstance != null) {
+        sInstance.mDeniedStartRecovery = null;
+      }
+      if (sStopRequest == request.precedingStop) {
+        sStopRequest = null;
+      }
+    }
+  }
 
-    Intent intent = new Intent(context, ForegroundService.class);
-    intent.setAction(STOP_FOREGROUND_SERVICE_ACTION);
+  static void stop() {
+    synchronized (sLifecycleLock) {
+      if (sInstance == null && sPendingStarts.isEmpty()) {
+        return;
+      }
+      if (sInstance != null) {
+        sInstance.mDeniedStartRecovery = null;
+      }
+      sStopRequest = new Object();
+      sRunGeneration++;
+      scheduleStop();
+    }
+  }
+
+  // Caller holds sLifecycleLock. No START/STOP intent is dispatched here, so a stale reference
+  // cannot cold-start a service. onCreate alone is UNKNOWN: wait for a delivered command.
+  private static void scheduleStop() {
+    ForegroundService instance = sInstance;
+    Object request = sStopRequest;
+    if (instance != null && request != null) {
+      new Handler(Looper.getMainLooper()).post(() -> instance.stopIfRequested(request));
+    }
+    if (instance != null && instance.mDeniedStartRecovery != null && sPendingStarts.isEmpty()) {
+      DeniedStartRecovery recovery = instance.mDeniedStartRecovery;
+      new Handler(Looper.getMainLooper()).post(() -> instance.stopDeniedStartIfCurrent(recovery));
+    }
+  }
 
+  private void stopDeniedStartIfCurrent(DeniedStartRecovery recovery) {
     try {
-      // Call start service first with stop action
-      context.startService(intent);
-    } catch (IllegalStateException illegalStateException) {
-      Logger.w(
-          TAG,
-          "startService() threw IllegalStateException on STOP path;"
-              + " falling back to stopService()",
-          illegalStateException);
-      // try to stop with stopService command
-      context.stopService(intent);
-    } catch (Exception exception) {
-      Logger.e(TAG, "Unable to stop foreground service", exception);
+      stopDeniedStartIfCurrentLocked(recovery);
+    } finally {
+      publishTimeoutEventsIfUnlocked();
+    }
+  }
+
+  private void stopDeniedStartIfCurrentLocked(DeniedStartRecovery recovery) {
+    synchronized (sLifecycleLock) {
+      if (mDeniedStartRecovery != recovery) {
+        return;
+      }
+      synchronized (sLock) {
+        if (!ownsUnpromotedState()
+            || sRunGeneration != recovery.generation
+            || mRunGeneration != recovery.runGeneration
+            || mLastStartId != recovery.startId
+            || mStopInitiated) {
+          mDeniedStartRecovery = null;
+          return;
+        }
+      }
+      String stopOutcome = "deferred";
+      try {
+        if (sPendingStarts.isEmpty()) {
+          StopAuthority authority = captureStopAuthority();
+          // Consume before Binder IPC: refusal or failure grants no automatic retry authority.
+          mDeniedStartRecovery = null;
+          stopOutcome = "failed";
+          boolean stopped = stopSelfResult(recovery.startId);
+          stopOutcome = stopped ? "accepted" : "refused";
+          synchronized (sLock) {
+            if (stopped && ownsStopAuthority(authority) && ownsUnpromotedState()) {
+              mStopInitiated = true;
+            }
+          }
+        }
+      } finally {
+        // Preserve the promotion diagnostic even if the separate stop operation throws.
+        Logger.w(
+            TAG,
+            (recovery.requestId == null
+                    ? "Framework redelivered START promotion denied (startId="
+                    : "Tracked START PROMOTION_DENIED (cause=UNKNOWN, requestId="
+                        + recovery.requestId
+                        + ", notificationId="
+                        + recovery.notificationId
+                        + ", api="
+                        + Build.VERSION.SDK_INT
+                        + ", type="
+                        + recovery.foregroundServiceType
+                        + ", generation="
+                        + recovery.generation
+                        + ", runGeneration="
+                        + recovery.runGeneration
+                        + ", startId=")
+                + recovery.startId
+                + ", flags="
+                + recovery.flags
+                + ", stop="
+                + stopOutcome
+                + ").",
+            recovery.denial);
+      }
+    }
+  }
+
+  private void stopIfRequested(Object request) {
+    try {
+      stopIfRequestedLocked(request);
+    } finally {
+      publishTimeoutEventsIfUnlocked();
+    }
+  }
+
+  private void stopIfRequestedLocked(Object request) {
+    synchronized (sLifecycleLock) {
+      if (sInstance != this
+          || sStopRequest != request
+          || !sPendingStarts.isEmpty()
+          || mLastStartId == 0
+          || mStopInitiated
+          || mStartCommandFailed) {
+        return;
+      }
+      // Consume this request before IPC so a reentrant START cannot schedule it against its
+      // successor. Refusal/failure restores it only while the original admission still owns it.
+      sStopRequest = null;
+      StopAuthority authority = captureStopAuthority();
+      boolean stopped = false;
+      try {
+        // The framework token and startId also protect an accepted, not yet delivered START.
+        stopped = stopSelfResult(authority.startId);
+        if (stopped && ownsStopAuthority(authority)) {
+          mStopInitiated = true;
+          mForegroundActive = false;
+          clearOwnedState();
+        }
+      } finally {
+        if (!stopped && ownsStopAuthority(authority)) {
+          sStopRequest = request;
+        }
+      }
     }
   }
 
-  @SuppressLint({"ForegroundServiceType", "MissingPermission"})
   @Override
   public int onStartCommand(Intent intent, int flags, int startId) {
+    try {
+      return onStartCommandLocked(intent, flags, startId);
+    } finally {
+      publishTimeoutEventsIfUnlocked();
+    }
+  }
+
+  private int onStartCommandLocked(Intent intent, int flags, int startId) {
+    synchronized (sLifecycleLock) {
+      // Any later delivery supersedes the recovery startId, including terminal commands.
+      mDeniedStartRecovery = null;
+      mLastStartId = startId;
+      boolean terminal =
+          intent == null || STOP_FOREGROUND_SERVICE_ACTION.equals(intent.getAction());
+      if (terminal) {
+        sRunGeneration++;
+      }
+      if (terminal && !sPendingStarts.isEmpty()) {
+        // The earlier accepted START must promote with its real notification/type first.
+        sStopRequest = new Object();
+        return START_STICKY_COMPATIBILITY;
+      }
+      if (!terminal) {
+        mStopInitiated = false;
+      }
+      String requestId = intent == null ? null : intent.getStringExtra(START_REQUEST_ID);
+      StartRequest request = sPendingStarts.get(requestId);
+      boolean frameworkRedelivery =
+          intent != null
+              && START_FOREGROUND_SERVICE_ACTION.equals(intent.getAction())
+              && Build.VERSION.SDK_INT >= Build.VERSION_CODES.S
+              && (flags & (START_FLAG_RETRY | START_FLAG_REDELIVERY)) != 0
+              && isValidStartRequestId(requestId)
+              && request == null;
+      boolean superseded = false;
+      if (!terminal) {
+        long generation = request == null ? sRunGeneration : request.generation;
+        if (request != null) {
+          request.instance = this;
+          acceptStart(request);
+        }
+        superseded = mRunFirstStartId != 0 && generation < mRunGeneration;
+        if (!superseded && mRunGeneration != generation) {
+          // Reserve the new session without retiring the previous submitted state or runner.
+          // A failed promotion must preserve them, while older deliveries remain fenced.
+          mRunGeneration = generation;
+        }
+      }
+      mStartCommandSatisfied = mForegroundActive;
+      try {
+        int result;
+        if (superseded) {
+          // A lost-reply START can arrive after a newer run. Preserve the new cache/runner. If
+          // that run already ended, still perform the old request's real promotion before teardown.
+          result = mForegroundActive ? START_NOT_STICKY : fulfillSupersededStart(intent);
+        } else {
+          result =
+              handleStartCommand(intent, flags, startId, frameworkRedelivery, requestId, request);
+        }
+        mStartCommandFailed = false;
+        if (mStartCommandSatisfied) {
+          if (!terminal && !superseded) {
+            recordSatisfiedStart(startId);
+          }
+          settleDeliveredStarts();
+        }
+        if (superseded
+            && mStartCommandSatisfied
+            && !mForegroundActive
+            && mRunnerToken == null
+            && sPendingStarts.isEmpty()
+            && sStopRequest == null) {
+          sStopRequest = new Object();
+        }
+        if (!terminal) {
+          scheduleStop();
+        }
+        return result;
+      } catch (RuntimeException e) {
+        mStartCommandFailed = !mStartCommandSatisfied;
+        if (mStartCommandSatisfied) {
+          if (!terminal && !superseded) {
+            recordSatisfiedStart(startId);
+          }
+          settleDeliveredStarts();
+        }
+        throw e;
+      }
+    }
+  }
+
+  private static boolean isValidStartRequestId(@Nullable String requestId) {
+    if (requestId == null || requestId.length() != 36) {
+      return false;
+    }
+    try {
+      return UUID.fromString(requestId).toString().equalsIgnoreCase(requestId);
+    } catch (IllegalArgumentException e) {
+      return false;
+    }
+  }
+
+  // Caller holds sLifecycleLock and sLock. Recovery cannot retire an acquired run or another owner.
+  private boolean ownsUnpromotedState() {
+    return sInstance == this
+        && sStateOwner == this
+        && !mStartForegroundCalled
+        && !mForegroundActive
+        && !mStartCommandSatisfied
+        && mRunnerToken == null
+        && mRunFirstStartId == 0
+        && mCurrentNotificationId == null
+        && mCurrentForegroundServiceType == -1
+        && mCurrentNotificationBundle == null
+        && mCurrentNotification == null
+        && mCurrentHashCode == 0;
+  }
+
+  // Caller holds both lifecycle/state locks. Revalidate the original admission after the platform
+  // attempt: a synchronous authority change must not authorize a stale request's recovery.
+  private boolean canRecoverTrackedDenial(
+      Intent intent,
+      String requestId,
+      StartRequest request,
+      long generation,
+      long runGeneration,
+      int startId) {
+    return Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM
+        && START_FOREGROUND_SERVICE_ACTION.equals(intent.getAction())
+        && isValidStartRequestId(requestId)
+        && request != null
+        && sPendingStarts.get(requestId) == request
+        && request.instance == this
+        && request.accepted
+        && !request.promotionDenied
+        && request.generation == runGeneration
+        && sRunGeneration == generation
+        && mRunGeneration == runGeneration
+        && mLastStartId == startId
+        && !mStopInitiated
+        && ownsUnpromotedState();
+  }
+
+  // A real promotion (or an already foreground instance) satisfies the physical instance's
+  // delivered obligations, including a prior ambiguous delivery. Undelivered STARTs remain held.
+  // This does not turn a posting/type exception into success: onStartCommand still rethrows it.
+  private void settleDeliveredStarts() {
+    mDeniedStartRecovery = null;
+    sPendingStarts.values().removeIf(request -> request.instance == this);
+  }
+
+  @SuppressLint({"ForegroundServiceType", "MissingPermission"})
+  private int fulfillSupersededStart(Intent intent) {
+    Bundle extras = intent.getExtras();
+    if (extras == null) {
+      return START_NOT_STICKY;
+    }
+    Notification notification =
+        ParcelableCompatReader.getParcelable(extras, "notification", Notification.class);
+    Bundle bundle = extras.getBundle("notificationBundle");
+    if (notification == null || bundle == null) {
+      return START_NOT_STICKY;
+    }
+    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
+      int type = NotificationModel.fromBundle(bundle).getAndroid().getForegroundServiceType();
+      if (type == ServiceInfo.FOREGROUND_SERVICE_TYPE_MANIFEST) {
+        type = resolveManifestServiceType();
+      }
+      if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE
+          && type == ServiceInfo.FOREGROUND_SERVICE_TYPE_NONE) {
+        ensureStartForegroundContractSatisfied(false);
+        return START_NOT_STICKY;
+      }
+      startForeground(extras.getInt("hashCode"), notification, type);
+    } else {
+      startForeground(extras.getInt("hashCode"), notification);
+    }
+    mStartForegroundCalled = true;
+    mForegroundActive = true;
+    mStartCommandSatisfied = true;
+    stopForegroundCompat();
+    return START_NOT_STICKY;
+  }
+
+  @SuppressLint({"ForegroundServiceType", "MissingPermission"})
+  private int handleStartCommand(
+      Intent intent,
+      int flags,
+      int startId,
+      boolean frameworkRedelivery,
+      String requestId,
+      StartRequest request) {
     Trace.beginSection("notifee:ForegroundService.onStartCommand");
     try {
       // Check if action is to stop the foreground service
       if (intent == null || STOP_FOREGROUND_SERVICE_ACTION.equals(intent.getAction())) {
-        ensureStartForegroundContractSatisfied();
-        stopSelf();
-        synchronized (sLock) {
-          mCurrentNotificationId = null;
-          mCurrentForegroundServiceType = -1;
-          mCurrentNotificationBundle = null;
-          mCurrentNotification = null;
-          mCurrentHashCode = 0;
+        StopAuthority authority = captureStopAuthority();
+        ensureStartForegroundContractSatisfied(true);
+        if (ownsStopAuthority(authority)
+            && stopSelfResult(authority.startId)
+            && ownsStopAuthority(authority)) {
+          mStopInitiated = true;
+          mForegroundActive = false;
+          clearOwnedState();
         }
         return Service.START_STICKY_COMPATIBILITY;
       }
@@ -198,9 +807,14 @@ public class ForegroundService extends Service {
 
           Object pendingEvent = null;
           boolean noneEarlyReturn = false;
+          RuntimeException deniedInitialPromotion = null;
+          int deniedForegroundServiceType = -1;
+          boolean deniedTrackedStart = false;
 
           synchronized (sLock) {
-            if (mCurrentNotificationId == null) {
+            if (mCurrentNotificationId == null
+                || mStateGeneration != mRunGeneration
+                || (mForegroundEpoch != null && mForegroundEpoch.retiring)) {
               if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
                 int foregroundServiceType =
                     notificationModel.getAndroid().getForegroundServiceType();
@@ -217,14 +831,39 @@ public class ForegroundService extends Service {
                   // Binder IPC (PackageManager + startForeground) and must not hold sLock.
                   noneEarlyReturn = true;
                 } else {
+                  boolean recoverInitialDenial = frameworkRedelivery && ownsUnpromotedState();
+                  long generation = sRunGeneration;
+                  long runGeneration = mRunGeneration;
+                  boolean recoverTrackedDenial =
+                      canRecoverTrackedDenial(
+                          intent, requestId, request, generation, runGeneration, startId);
                   Trace.beginSection("notifee:startForeground");
                   try {
                     startForeground(hashCode, notification, foregroundServiceType);
+                  } catch (RuntimeException e) {
+                    // Only the real initial promotion is exempt. Type resolution, NONE, posting,
+                    // updates and teardown retain their existing failure boundaries.
+                    boolean trackedDenial =
+                        recoverTrackedDenial
+                            && canRecoverTrackedDenial(
+                                intent, requestId, request, generation, runGeneration, startId);
+                    if (!(trackedDenial || (recoverInitialDenial && ownsUnpromotedState()))
+                        || Build.VERSION.SDK_INT < Build.VERSION_CODES.S
+                        || e.getClass() != ForegroundServiceStartNotAllowedException.class) {
+                      throw e;
+                    }
+                    deniedInitialPromotion = e;
+                    deniedForegroundServiceType = foregroundServiceType;
+                    deniedTrackedStart = trackedDenial;
                   } finally {
                     Trace.endSection();
                   }
-                  mStartForegroundCalled = true;
-                  mCurrentForegroundServiceType = foregroundServiceType;
+                  if (deniedInitialPromotion == null) {
+                    mStartForegroundCalled = true;
+                    mForegroundActive = true;
+                    mStartCommandSatisfied = true;
+                    mCurrentForegroundServiceType = foregroundServiceType;
+                  }
                 }
               } else {
                 Trace.beginSection("notifee:startForeground");
@@ -234,23 +873,51 @@ public class ForegroundService extends Service {
                   Trace.endSection();
                 }
                 mStartForegroundCalled = true;
+                mForegroundActive = true;
+                mStartCommandSatisfied = true;
               }
 
-              if (!noneEarlyReturn) {
+              if (!noneEarlyReturn && deniedInitialPromotion == null) {
+                commitForegroundEpoch();
                 mCurrentNotificationId = notificationId;
                 mCurrentNotificationBundle = bundle;
                 mCurrentNotification = notification;
                 mCurrentHashCode = hashCode;
+                mStateGeneration = mRunGeneration;
+                mRunFirstStartId = mLastStartId;
+                final Object runnerToken = new Object();
+                final long runnerGeneration = mRunGeneration;
+                mRunnerToken = runnerToken;
                 // On headless task complete
                 final MethodCallResult<Void> methodCallResult =
                     (e, aVoid) -> {
-                      stopForegroundCompat();
-                      synchronized (sLock) {
-                        mCurrentNotificationId = null;
-                        mCurrentForegroundServiceType = -1;
-                        mCurrentNotificationBundle = null;
-                        mCurrentNotification = null;
-                        mCurrentHashCode = 0;
+                      Runnable complete =
+                          () -> {
+                            try {
+                              synchronized (sLifecycleLock) {
+                                if (sInstance == this
+                                    && mRunnerToken == runnerToken
+                                    && sRunGeneration == runnerGeneration
+                                    && mForegroundEpoch != null
+                                    && !mForegroundEpoch.retiring
+                                    && !mForegroundEpoch.retired) {
+                                  ForegroundEpoch epoch = mForegroundEpoch;
+                                  stopForegroundCompat();
+                                  if (sInstance == this
+                                      && mForegroundEpoch == epoch
+                                      && mRunnerToken == runnerToken) {
+                                    clearOwnedState();
+                                  }
+                                }
+                              }
+                            } finally {
+                              publishTimeoutEventsIfUnlocked();
+                            }
+                          };
+                      if (Looper.myLooper() == Looper.getMainLooper()) {
+                        complete.run();
+                      } else {
+                        new Handler(Looper.getMainLooper()).post(complete);
                       }
                     };
 
@@ -258,6 +925,8 @@ public class ForegroundService extends Service {
               }
             } else {
               if (mCurrentNotificationId.equals(notificationId)) {
+                ForegroundEpoch updateEpoch = mForegroundEpoch;
+                long updateGeneration = sRunGeneration;
                 // Before API 31, updating the service's registered notification requires
                 // startForeground(). API 31+ processes a same-ID notify() against the foreground
                 // service record. Keep that path for an unchanged type: repeating
@@ -291,11 +960,27 @@ public class ForegroundService extends Service {
                   } finally {
                     Trace.endSection();
                   }
-                  mStartForegroundCalled = true;
                 } else {
                   NotificationManagerCompat.from(ContextHolder.getApplicationContext())
                       .notify(mCurrentHashCode, notification);
                 }
+                // A timeout or successor may have retired/replaced the publication during IPC.
+                // A normal return cannot reacquire its cache, runner or promotion authority.
+                if (!ownsTimeoutEpoch(updateEpoch)
+                    || updateEpoch == null
+                    || updateEpoch.retiring
+                    || updateEpoch.retired
+                    || mLastStartId != startId
+                    || mRunGeneration != updateEpoch.runGeneration
+                    || sRunGeneration != updateGeneration) {
+                  return START_NOT_STICKY;
+                }
+                if (shouldStartForeground) {
+                  mStartForegroundCalled = true;
+                  mForegroundActive = true;
+                  mStartCommandSatisfied = true;
+                  commitForegroundEpoch();
+                }
                 // The platform call returned normally, so cache the latest submitted state for
                 // re-post and timeout. A normal return does not acknowledge display.
                 mCurrentForegroundServiceType = foregroundServiceType;
@@ -309,10 +994,32 @@ public class ForegroundService extends Service {
             }
           }
 
+          if (deniedInitialPromotion != null) {
+            // Release sLock before stop Binder IPC. Terminalize only the exact denied request;
+            // this is not a successful promotion and cannot fulfill any other delivered START.
+            if (deniedTrackedStart) {
+              request.promotionDenied = true;
+              sPendingStarts.remove(requestId, request);
+            }
+            DeniedStartRecovery recovery =
+                new DeniedStartRecovery(
+                    sRunGeneration,
+                    mRunGeneration,
+                    startId,
+                    flags,
+                    deniedInitialPromotion,
+                    deniedTrackedStart ? requestId : null,
+                    notificationId,
+                    deniedForegroundServiceType);
+            mDeniedStartRecovery = recovery;
+            stopDeniedStartIfCurrent(recovery);
+            return START_NOT_STICKY;
+          }
+
           // Handle NONE early return outside the lock — the helper performs Binder IPC
           // (PackageManager query + startForeground) that must not hold sLock.
           if (noneEarlyReturn) {
-            ensureStartForegroundContractSatisfied();
+            ensureStartForegroundContractSatisfied(false);
             return START_NOT_STICKY;
           }
 
@@ -341,7 +1048,11 @@ public class ForegroundService extends Service {
   @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
   @Override
   public void onTimeout(int startId) {
-    handleTimeout(startId, -1);
+    try {
+      handleTimeout(startId, -1, true);
+    } finally {
+      publishTimeoutEventsIfUnlocked();
+    }
   }
 
   /**
@@ -351,7 +1062,11 @@ public class ForegroundService extends Service {
   @RequiresApi(Build.VERSION_CODES.VANILLA_ICE_CREAM)
   @Override
   public void onTimeout(int startId, int fgsType) {
-    handleTimeout(startId, fgsType);
+    try {
+      handleTimeout(startId, fgsType, false);
+    } finally {
+      publishTimeoutEventsIfUnlocked();
+    }
   }
 
   @RequiresApi(Build.VERSION_CODES.Q)
@@ -402,6 +1117,15 @@ public class ForegroundService extends Service {
 
   @SuppressWarnings("deprecation")
   private void stopForegroundCompat() {
+    ForegroundEpoch epoch = mForegroundEpoch;
+    removeForegroundNotification();
+    if (sInstance == this && sStateOwner == this && mForegroundEpoch == epoch) {
+      mForegroundActive = false;
+    }
+  }
+
+  @SuppressWarnings("deprecation")
+  private void removeForegroundNotification() {
     if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
       stopForeground(STOP_FOREGROUND_REMOVE);
     } else {
@@ -420,7 +1144,7 @@ public class ForegroundService extends Service {
    * on API 29-33 and to {@code FOREGROUND_SERVICE_TYPE_NONE} on API 34+. This method is an instance
    * method that uses {@code this} as context (always valid inside a running Service) and returns
    * the raw declared value without any API-level mapping, which is what the proactive manifest
-   * check in {@link #ensureStartForegroundContractSatisfied()} needs.
+   * check in {@link #ensureStartForegroundContractSatisfied(boolean)} needs.
    *
    * @return the raw {@code foregroundServiceType} bitmask from the manifest, or 0 if the service is
    *     not declared or has no explicit type
@@ -485,10 +1209,12 @@ public class ForegroundService extends Service {
    * @throws RuntimeException if the manifest is missing required {@code foregroundServiceType}
    *     declarations on API 34+, or if the defensive {@code startForeground()} call fails for a
    *     non-platform-permission reason. {@link SecurityException} is handled as a best-effort stop
-   *     because API 34+ can deny while-in-use types when the app is backgrounded.
+   *     because API 34+ can deny while-in-use types when the app is backgrounded. A terminal
+   *     STOP/null also logs and tolerates the API 31+ promotion denial specifically; that policy
+   *     does not apply to NONE or to an earlier unfulfilled accepted START.
    */
   @SuppressLint({"ForegroundServiceType", "MissingPermission"})
-  private void ensureStartForegroundContractSatisfied() {
+  private void ensureStartForegroundContractSatisfied(boolean terminalStop) {
     if (mStartForegroundCalled) {
       return;
     }
@@ -516,66 +1242,191 @@ public class ForegroundService extends Service {
       }
     }
 
+    ensureDefensiveChannel();
+    Notification placeholder =
+        new NotificationCompat.Builder(this, DEFENSIVE_CHANNEL_ID)
+            .setSmallIcon(android.R.drawable.ic_dialog_info)
+            .build();
+    // Resolve the safe declared type before entering the promotion-only exception boundary.
+    int defensiveTypes =
+        Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE
+            ? selectDefensiveForegroundServiceType(declaredTypes)
+            : 0;
     try {
-      ensureDefensiveChannel();
-      Notification placeholder =
-          new NotificationCompat.Builder(this, DEFENSIVE_CHANNEL_ID)
-              .setSmallIcon(android.R.drawable.ic_dialog_info)
-              .build();
       if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
-        // The STOP/null defensive placeholder does not represent the real workload. Prefer a
-        // declared type without while-in-use runtime restrictions before falling back to the
-        // manifest-declared mask.
-        int defensiveTypes = selectDefensiveForegroundServiceType(declaredTypes);
         startForeground(DEFENSIVE_NOTIFICATION_ID, placeholder, defensiveTypes);
       } else {
         startForeground(DEFENSIVE_NOTIFICATION_ID, placeholder);
       }
-      mStartForegroundCalled = true;
-      stopForegroundCompat();
     } catch (SecurityException e) {
       Logger.w(
           TAG,
           "Defensive startForeground() was denied by Android while stopping the service; "
               + "continuing with stopSelf() to avoid a fatal app crash.",
           e);
+      return;
     } catch (Exception e) {
+      // NONE and unrelated IllegalStateException/type failures remain observable.
+      if (terminalStop
+          && Build.VERSION.SDK_INT >= Build.VERSION_CODES.S
+          && e instanceof ForegroundServiceStartNotAllowedException) {
+        Logger.w(
+            TAG,
+            "Defensive startForeground() was not allowed by Android while stopping; "
+                + "continuing with stopSelf().",
+            e);
+        return;
+      }
       String msg =
           "react-native-notify-kit: defensive startForeground() failed. "
               + "This indicates an inconsistent service state and the process cannot recover.";
       Logger.e(TAG, msg, e);
       throw new RuntimeException(msg, e);
     }
+    mStartForegroundCalled = true;
+    mForegroundActive = true;
+    mStartCommandSatisfied = true;
+    stopForegroundCompat();
   }
 
-  private void handleTimeout(int startId, int fgsType) {
-    Logger.e(
-        TAG,
-        "Foreground service timed out (startId="
-            + startId
-            + ", type="
-            + fgsType
-            + "). Stopping service.");
+  // Caller holds sLifecycleLock. Platform calls may synchronously reenter lifecycle callbacks.
+  private boolean ownsTimeoutEpoch(ForegroundEpoch epoch) {
+    synchronized (sLock) {
+      return sInstance == this && sStateOwner == this && mForegroundEpoch == epoch;
+    }
+  }
 
-    Bundle notifBundle;
+  private void retireTimeoutEpoch(ForegroundEpoch epoch) {
     synchronized (sLock) {
-      notifBundle = mCurrentNotificationBundle;
-      mCurrentNotificationId = null;
-      mCurrentForegroundServiceType = -1;
-      mCurrentNotificationBundle = null;
-      mCurrentNotification = null;
-      mCurrentHashCode = 0;
+      if (ownsTimeoutEpoch(epoch)) {
+        mForegroundActive = false;
+        clearOwnedState();
+      }
     }
+  }
 
-    stopForegroundCompat();
-    stopSelf(startId);
+  @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
+  private void handleTimeout(int startId, int fgsType, boolean shortServiceCallback) {
+    Bundle notificationBundle;
+    ForegroundEpoch epoch;
+    RuntimeException primary = null;
+    String demotionOutcome = "failed";
+    String stopOutcome = "deferred";
+    synchronized (sLifecycleLock) {
+      final boolean stopAuthorized;
+      final int stopId;
+      final Object stopRequest = sStopRequest;
+      synchronized (sLock) {
+        epoch = mForegroundEpoch;
+        int callbackType =
+            shortServiceCallback ? ServiceInfo.FOREGROUND_SERVICE_TYPE_SHORT_SERVICE : fgsType;
+        if (sInstance != this
+            || sStateOwner != this
+            || epoch == null
+            || epoch.retiring
+            || epoch.retired
+            || !mForegroundActive
+            || (mRunFirstStartId != 0 && startId < mRunFirstStartId)
+            || callbackType <= 0
+            || mCurrentForegroundServiceType <= 0
+            || (callbackType & mCurrentForegroundServiceType) == 0) {
+          return;
+        }
+        // Matching IDs are library authority only. A repeated platform promotion within the
+        // same run can expose coincident metadata, so it never upgrades ambiguous provenance.
+        stopAuthorized =
+            !epoch.ambiguousPromotion
+                && !mTimeoutStartIds.contains(startId)
+                && epoch.satisfiedStartIds.contains(startId);
+        stopId = epoch.lastSatisfiedStartId;
+        notificationBundle =
+            mCurrentNotificationBundle == null ? null : new Bundle(mCurrentNotificationBundle);
+        mTimeoutStartIds.add(startId);
+        epoch.retiring = true;
+      }
 
-    if (notifBundle != null) {
-      NotificationModel model = NotificationModel.fromBundle(notifBundle);
-      Bundle extras = new Bundle();
-      extras.putInt("startId", startId);
-      extras.putInt("fgsType", fgsType);
-      EventBus.post(new NotificationEvent(NotificationEvent.TYPE_FG_TIMEOUT, model, extras));
+      // Nothing that posts an event, converts a model or retires owned evidence precedes this.
+      try {
+        removeForegroundNotification();
+        demotionOutcome = "returned"; // Normal Binder return is not an AMS acknowledgement.
+        retireTimeoutEpoch(epoch);
+      } catch (RuntimeException failure) {
+        primary = failure;
+      }
+
+      if (stopAuthorized
+          && ownsTimeoutEpoch(epoch)
+          && epoch.runGeneration == mRunGeneration
+          && epoch.runGeneration == sRunGeneration
+          && sStopRequest == stopRequest
+          && sPendingStarts.isEmpty()
+          && mLastStartId == stopId
+          && stopId != 0
+          && !mStartCommandFailed
+          && !mStopInitiated) {
+        try {
+          stopOutcome = "failed";
+          StopAuthority authority = captureStopAuthority();
+          boolean stopped = stopSelfResult(stopId);
+          stopOutcome = stopped ? "accepted" : "refused";
+          if (stopped && ownsTimeoutEpoch(epoch) && ownsStopAuthority(authority)) {
+            mStopInitiated = true;
+            retireTimeoutEpoch(epoch);
+          }
+        } catch (RuntimeException failure) {
+          if (primary == null) primary = failure;
+          else if (primary != failure) primary.addSuppressed(failure);
+        }
+      }
+    }
+
+    // Consume publication authority once, including when a reentrant caller still owns locks.
+    final RuntimeException timeoutFailure = primary;
+    final String diagnostic =
+        "Foreground timeout (startId="
+            + startId
+            + ", type="
+            + fgsType
+            + ", runGeneration="
+            + epoch.runGeneration
+            + ", demotion="
+            + demotionOutcome
+            + ", stop="
+            + stopOutcome
+            + ").";
+    List<Runnable> publications = sTimeoutPublications.get();
+    if (publications == null) {
+      publications = new ArrayList<>();
+      sTimeoutPublications.set(publications);
     }
+    publications.add(
+        () -> {
+          if (notificationBundle != null) {
+            try {
+              NotificationModel model = NotificationModel.fromBundle(notificationBundle);
+              Bundle extras = new Bundle();
+              extras.putInt("startId", startId);
+              extras.putInt("fgsType", fgsType);
+              EventBus.post(
+                  new NotificationEvent(NotificationEvent.TYPE_FG_TIMEOUT, model, extras));
+            } catch (RuntimeException failure) {
+              if (timeoutFailure != null && timeoutFailure != failure)
+                timeoutFailure.addSuppressed(failure);
+              Logger.w(TAG, "Timeout event publication failed", failure);
+            }
+          }
+          // Preserve the existing error LogEvent, but only after the essential teardown and
+          // timeout publication. Its failure cannot replace a primary platform exception.
+          try {
+            if (timeoutFailure == null) Logger.e(TAG, diagnostic);
+            else Logger.e(TAG, diagnostic, timeoutFailure);
+          } catch (RuntimeException failure) {
+            if (timeoutFailure != null && timeoutFailure != failure)
+              timeoutFailure.addSuppressed(failure);
+            Logger.w(TAG, "Timeout diagnostic publication failed", failure);
+          }
+        });
+    publishTimeoutEventsIfUnlocked();
+    if (primary != null) throw primary;
   }
 }