react-native-notify-kit 10.8.0 → 10.9.0

package/android/src/main/java/app/notifee/core/ForegroundService.java

@@ -33,6 +33,7 @@ import android.os.Bundle;
 import android.os.Handler;
 import android.os.IBinder;
 import android.os.Looper;
+import android.os.SystemClock;
 import android.os.Trace;
 import androidx.annotation.Nullable;
 import androidx.annotation.RequiresApi;
@@ -43,8 +44,12 @@ import app.notifee.core.event.NotificationEvent;
 import app.notifee.core.interfaces.MethodCallResult;
 import app.notifee.core.model.NotificationModel;
 import app.notifee.core.utility.ParcelableCompatReader;
+import java.util.ArrayList;
 import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.UUID;
 
 public class ForegroundService extends Service {
@@ -64,6 +69,7 @@ public class ForegroundService extends Service {
   private static final Map<String, StartRequest> sPendingStarts = new HashMap<>();
   private static final String START_REQUEST_ID = "notifee.foregroundServiceStartRequestId";
   private static long sRunGeneration;
+  private static long sStartAdmissionRevision;
   private static ForegroundService sInstance;
   private static Object sStopRequest;
   private static ForegroundService sStateOwner;
@@ -78,6 +84,141 @@ public class ForegroundService extends Service {
   private long mStateGeneration;
   private int mRunFirstStartId;
   private Object mRunnerToken;
+  private ForegroundEpoch mForegroundEpoch;
+  private ForegroundServiceRunLimitScheduler.Ticket mAlarmPoc;
+  private long mAlarmPocAttemptedRun = Long.MIN_VALUE;
+  private String mAlarmPocInstanceId;
+  // Previously admitted metadata can collide with a successor even across run generations.
+  // These IDs only disqualify stop authority; they never establish Android epoch provenance.
+  private final Set<Integer> mTimeoutStartIds = new HashSet<>();
+  // A reentrant platform callback may still inherit an outer lifecycle monitor. Drain these
+  // publications synchronously at that call's unlocked boundary, without scheduling or waiting.
+  private static final ThreadLocal<List<Runnable>> sTimeoutPublications = new ThreadLocal<>();
+
+  private static void publishTimeoutEventsIfUnlocked() {
+    if (Thread.holdsLock(sLifecycleLock) || Thread.holdsLock(sLock)) {
+      return;
+    }
+    List<Runnable> publications = sTimeoutPublications.get();
+    if (publications != null) {
+      sTimeoutPublications.remove();
+      for (Runnable publication : publications) {
+        publication.run();
+      }
+    }
+  }
+
+  // Local publication identity, never provenance supplied by Android's timeout callback.
+  // Guarded by sLifecycleLock then sLock. Retiring consumes timeout authority even on failure.
+  private static final class ForegroundEpoch {
+    final long runGeneration;
+    final long promotedElapsed = SystemClock.elapsedRealtime();
+    final boolean ambiguousPromotion;
+    final Set<Integer> satisfiedStartIds = new HashSet<>();
+    int lastSatisfiedStartId;
+    boolean retiring;
+    // A consumed voluntary alarm must not suppress a later genuine framework timeout
+    // when both native teardown attempts failed and the FGS is still active.
+    boolean voluntaryRetirement;
+    boolean retired;
+
+    ForegroundEpoch(long runGeneration, boolean ambiguousPromotion, int startId) {
+      this.runGeneration = runGeneration;
+      this.ambiguousPromotion = ambiguousPromotion;
+      satisfiedStartIds.add(startId);
+      lastSatisfiedStartId = startId;
+    }
+  }
+
+  // Caller holds both locks, after the actual promotion returned normally.
+  private boolean commitForegroundEpoch() {
+    ForegroundEpoch previous = mForegroundEpoch;
+    long generation = sRunGeneration;
+    long runGeneration = mRunGeneration;
+    int startId = mLastStartId;
+    if (mAlarmPoc != null) {
+      ForegroundServiceRunLimitScheduler.marker(
+          "ARM_RETIRED", mAlarmPoc, "promotion epoch replaced; no automatic rearm");
+    }
+    invalidateAlarmPoc();
+    // Cancellation crosses IPC/storage. Neither this commit nor its caller may overwrite
+    // a successor admitted while the old ticket was being cancelled.
+    if (sInstance != this
+        || sStateOwner != this
+        || mForegroundEpoch != previous
+        || sRunGeneration != generation
+        || mRunGeneration != runGeneration
+        || mLastStartId != startId) return false;
+    mForegroundEpoch =
+        new ForegroundEpoch(
+            mRunGeneration,
+            previous != null && previous.runGeneration == mRunGeneration,
+            mLastStartId);
+    return true;
+  }
+
+  // Snapshot before platform IPC; a reply cannot acquire authority over a reentrant successor.
+  private static final class StopAuthority {
+    final ForegroundService owner;
+    final ForegroundEpoch epoch;
+    final long generation;
+    final long runGeneration;
+    final int startId;
+    final Object request;
+
+    StopAuthority(ForegroundService service) {
+      owner = sStateOwner;
+      epoch = service.mForegroundEpoch;
+      generation = sRunGeneration;
+      runGeneration = service.mRunGeneration;
+      startId = service.mLastStartId;
+      request = sStopRequest;
+    }
+  }
+
+  // Caller holds sLifecycleLock. Follow the lifecycle -> state lock order for both snapshots.
+  private StopAuthority captureStopAuthority() {
+    synchronized (sLock) {
+      return new StopAuthority(this);
+    }
+  }
+
+  private boolean ownsStopAuthority(StopAuthority authority) {
+    synchronized (sLock) {
+      return sInstance == this
+          && sStateOwner == authority.owner
+          && mForegroundEpoch == authority.epoch
+          && sRunGeneration == authority.generation
+          && mRunGeneration == authority.runGeneration
+          && mLastStartId == authority.startId
+          && sStopRequest == authority.request
+          && sPendingStarts.isEmpty();
+    }
+  }
+
+  // A delivered command can be physically satisfied by the existing foreground publication,
+  // even if its notification update throws. A future/unfulfilled delivery gains no authority.
+  private void recordSatisfiedStart(int startId) {
+    synchronized (sLock) {
+      ForegroundEpoch epoch = mForegroundEpoch;
+      if (sInstance == this
+          && sStateOwner == this
+          && epoch != null
+          && !epoch.retiring
+          && !epoch.retired
+          && mForegroundActive
+          && mStartCommandSatisfied
+          && mLastStartId == startId
+          && epoch.runGeneration == mRunGeneration) {
+        epoch.satisfiedStartIds.add(startId);
+        epoch.lastSatisfiedStartId = startId;
+      }
+    }
+  }
+
+  // A denied initial promotion is not a client STOP. Its recovery cannot acquire authority
+  // over a later accepted/promoted run, and is consumed by one eligible stop attempt.
+  private DeniedStartRecovery mDeniedStartRecovery;
   private static final String DEFENSIVE_CHANNEL_ID = "notifee_fg_default";
   private static final int DEFENSIVE_NOTIFICATION_ID = Integer.MAX_VALUE - 1;
 
@@ -85,6 +226,11 @@ public class ForegroundService extends Service {
     final long generation;
     final Object precedingStop;
     boolean accepted;
+    // Dispatch acceptance is distinct from the promotion outcome and the physical instance's
+    // obligation. A denied delivered request is terminal even while its sender's reply is pending.
+    boolean promotionDenied;
+    ForegroundServiceRunLimitScheduler.Request alarmPoc;
+    ForegroundEpoch alarmPocEpoch;
     // Null until delivery. An unfulfilled delivered request belongs to that physical instance.
     ForegroundService instance;
 
@@ -94,6 +240,36 @@ public class ForegroundService extends Service {
     }
   }
 
+  private static final class DeniedStartRecovery {
+    final long generation;
+    final long runGeneration;
+    final int startId;
+    final int flags;
+    final RuntimeException denial;
+    final String requestId;
+    final String notificationId;
+    final int foregroundServiceType;
+
+    DeniedStartRecovery(
+        long generation,
+        long runGeneration,
+        int startId,
+        int flags,
+        RuntimeException denial,
+        String requestId,
+        String notificationId,
+        int foregroundServiceType) {
+      this.generation = generation;
+      this.runGeneration = runGeneration;
+      this.startId = startId;
+      this.flags = flags;
+      this.denial = denial;
+      this.requestId = requestId;
+      this.notificationId = notificationId;
+      this.foregroundServiceType = foregroundServiceType;
+    }
+  }
+
   /**
    * Tracks whether startForeground() has been called on THIS service instance. This is an instance
    * field (not static) because the static fields below track cross-invocation notification state
@@ -119,6 +295,10 @@ public class ForegroundService extends Service {
   public void onCreate() {
     super.onCreate();
     synchronized (sLifecycleLock) {
+      if (sInstance != null) {
+        sInstance.mDeniedStartRecovery = null;
+        sInstance.invalidateAlarmPoc();
+      }
       sInstance = this;
       mRunGeneration = sRunGeneration;
       synchronized (sLock) {
@@ -131,6 +311,8 @@ public class ForegroundService extends Service {
   @Override
   public void onDestroy() {
     synchronized (sLifecycleLock) {
+      invalidateAlarmPoc();
+      mDeniedStartRecovery = null;
       sPendingStarts.values().removeIf(request -> request.instance == this);
       if (sInstance == this) {
         sInstance = null;
@@ -159,12 +341,20 @@ public class ForegroundService extends Service {
   }
 
   private void clearOwnedState() {
+    ForegroundServiceRunLimitScheduler.Ticket ticket = null;
     synchronized (sLock) {
       if (sStateOwner == this) {
+        ticket = revokeAlarmPoc();
+        mDeniedStartRecovery = null;
         clearCurrentState();
         mRunnerToken = null;
+        if (mForegroundEpoch != null) {
+          mForegroundEpoch.retired = true;
+        }
       }
     }
+    // Finish A's local retirement before cancellation can synchronously admit a successor.
+    if (ticket != null) ForegroundServiceRunLimitScheduler.cancel(ticket);
   }
 
   /**
@@ -176,20 +366,68 @@ public class ForegroundService extends Service {
    */
   @SuppressLint("MissingPermission")
   static boolean repostIfActive(String notificationId) {
-    synchronized (sLock) {
-      if (mCurrentNotificationId == null
-          || !mCurrentNotificationId.equals(notificationId)
-          || mCurrentNotification == null) {
-        return false;
+    try {
+      synchronized (sLifecycleLock) {
+        synchronized (sLock) {
+          if (mCurrentNotificationId == null
+              || (sStateOwner != null
+                  && sStateOwner.mForegroundEpoch != null
+                  && sStateOwner.mForegroundEpoch.retiring)
+              || !mCurrentNotificationId.equals(notificationId)
+              || mCurrentNotification == null) {
+            return false;
+          }
+          Logger.w(TAG, "Submitting dismissed foreground service notification for re-post");
+          NotificationManagerCompat.from(ContextHolder.getApplicationContext())
+              .notify(mCurrentHashCode, mCurrentNotification);
+          return true;
+        }
       }
-      Logger.w(TAG, "Submitting dismissed foreground service notification for re-post");
-      NotificationManagerCompat.from(ContextHolder.getApplicationContext())
-          .notify(mCurrentHashCode, mCurrentNotification);
-      return true;
+    } finally {
+      publishTimeoutEventsIfUnlocked();
     }
   }
 
+  // Internal smoke entrypoint, deliberately absent from Notifee/React Native public APIs.
+  static void startAlarmPoc(
+      int hashCode,
+      Notification notification,
+      Bundle notificationBundle,
+      String run,
+      long requestedDurationMs) {
+    start(
+        hashCode,
+        notification,
+        notificationBundle,
+        new ForegroundServiceRunLimitScheduler.Request(
+            ContextHolder.getApplicationContext(), run, requestedDurationMs));
+  }
+
   static void start(int hashCode, Notification notification, Bundle notificationBundle) {
+    app.notifee.core.model.NotificationAndroidModel android =
+        NotificationModel.fromBundle(notificationBundle).getAndroid();
+    Long duration = android.getForegroundServiceBestEffortStopAfterMs();
+    ForegroundServiceRunLimitScheduler.Request request = null;
+    if (duration != null) {
+      // The model rejects this too; keep the platform guard explicit at API-specific calls.
+      if (Build.VERSION.SDK_INT < 35) {
+        throw new IllegalArgumentException(
+            "notification.android.foregroundServiceBestEffortStopAfterMs requires API 35+");
+      }
+      int type = android.getForegroundServiceType();
+      if (type == ServiceInfo.FOREGROUND_SERVICE_TYPE_MANIFEST) type = resolveManifestServiceType();
+      request =
+          ForegroundServiceRunLimitScheduler.publicRequest(
+              ContextHolder.getApplicationContext(), duration, type);
+    }
+    start(hashCode, notification, notificationBundle, request);
+  }
+
+  private static void start(
+      int hashCode,
+      Notification notification,
+      Bundle notificationBundle,
+      ForegroundServiceRunLimitScheduler.Request alarmPoc) {
     Context context = ContextHolder.getApplicationContext();
     if (context == null) {
       Logger.e(TAG, "Application context is null; cannot start ForegroundService.");
@@ -230,8 +468,35 @@ public class ForegroundService extends Service {
       intent.putExtra(START_REQUEST_ID, requestId);
       StartRequest request;
       synchronized (sLifecycleLock) {
+        if (alarmPoc != null
+            && (!sPendingStarts.isEmpty()
+                || (sInstance != null
+                    && (sInstance.mForegroundActive || sInstance.mRunnerToken != null)))) {
+          if (!alarmPoc.publicOption)
+            throw new IllegalStateException("Diagnostic arming requires a new quiescent run");
+          // Repeating the same option on an owned same-ID update is accepted without rearming.
+          // Enabling/changing it during an existing run or unresolved START is rejected
+          // pre-dispatch.
+          synchronized (sLock) {
+            ForegroundService owner = sInstance;
+            String id = NotificationModel.fromBundle(notificationBundle).getId();
+            if (!sPendingStarts.isEmpty()
+                || owner == null
+                || owner.mAlarmPoc == null
+                || !owner.ownsAlarmPoc(owner.mAlarmPoc)
+                || !id.equals(mCurrentNotificationId)
+                || alarmPoc.duration != owner.mAlarmPoc.duration) {
+              throw new IllegalArgumentException(
+                  "notification.android.foregroundServiceBestEffortStopAfterMs cannot be enabled or"
+                      + " changed during an active/pending run; stop and start a new run");
+            }
+          }
+          alarmPoc = null;
+        }
         request = new StartRequest(sRunGeneration, sStopRequest);
+        request.alarmPoc = alarmPoc;
         sPendingStarts.put(requestId, request);
+        sStartAdmissionRevision++;
       }
       ComponentName component;
       try {
@@ -268,8 +533,14 @@ public class ForegroundService extends Service {
   // Caller holds sLifecycleLock. Delivery itself can prove acceptance before Context returns.
   // A late reply never cancels a STOP ordered after this START was reserved/delivered.
   private static void acceptStart(StartRequest request) {
+    if (request.promotionDenied) {
+      return;
+    }
     if (!request.accepted) {
       request.accepted = true;
+      if (sInstance != null) {
+        sInstance.mDeniedStartRecovery = null;
+      }
       if (sStopRequest == request.precedingStop) {
         sStopRequest = null;
       }
@@ -281,8 +552,14 @@ public class ForegroundService extends Service {
       if (sInstance == null && sPendingStarts.isEmpty()) {
         return;
       }
+      if (sInstance != null) {
+        sInstance.mDeniedStartRecovery = null;
+      }
+      // Order STOP before cancellation IPC/storage: a reentrant later START must observe
+      // and be able to supersede this request, rather than inherit an outer stale STOP.
       sStopRequest = new Object();
       sRunGeneration++;
+      if (sInstance != null) sInstance.invalidateAlarmPoc();
       scheduleStop();
     }
   }
@@ -295,9 +572,89 @@ public class ForegroundService extends Service {
     if (instance != null && request != null) {
       new Handler(Looper.getMainLooper()).post(() -> instance.stopIfRequested(request));
     }
+    if (instance != null && instance.mDeniedStartRecovery != null && sPendingStarts.isEmpty()) {
+      DeniedStartRecovery recovery = instance.mDeniedStartRecovery;
+      new Handler(Looper.getMainLooper()).post(() -> instance.stopDeniedStartIfCurrent(recovery));
+    }
+  }
+
+  private void stopDeniedStartIfCurrent(DeniedStartRecovery recovery) {
+    try {
+      stopDeniedStartIfCurrentLocked(recovery);
+    } finally {
+      publishTimeoutEventsIfUnlocked();
+    }
+  }
+
+  private void stopDeniedStartIfCurrentLocked(DeniedStartRecovery recovery) {
+    synchronized (sLifecycleLock) {
+      if (mDeniedStartRecovery != recovery) {
+        return;
+      }
+      synchronized (sLock) {
+        if (!ownsUnpromotedState()
+            || sRunGeneration != recovery.generation
+            || mRunGeneration != recovery.runGeneration
+            || mLastStartId != recovery.startId
+            || mStopInitiated) {
+          mDeniedStartRecovery = null;
+          return;
+        }
+      }
+      String stopOutcome = "deferred";
+      try {
+        if (sPendingStarts.isEmpty()) {
+          StopAuthority authority = captureStopAuthority();
+          // Consume before Binder IPC: refusal or failure grants no automatic retry authority.
+          mDeniedStartRecovery = null;
+          stopOutcome = "failed";
+          boolean stopped = stopSelfResult(recovery.startId);
+          stopOutcome = stopped ? "accepted" : "refused";
+          synchronized (sLock) {
+            if (stopped && ownsStopAuthority(authority) && ownsUnpromotedState()) {
+              mStopInitiated = true;
+            }
+          }
+        }
+      } finally {
+        // Preserve the promotion diagnostic even if the separate stop operation throws.
+        Logger.w(
+            TAG,
+            (recovery.requestId == null
+                    ? "Framework redelivered START promotion denied (startId="
+                    : "Tracked START PROMOTION_DENIED (cause=UNKNOWN, requestId="
+                        + recovery.requestId
+                        + ", notificationId="
+                        + recovery.notificationId
+                        + ", api="
+                        + Build.VERSION.SDK_INT
+                        + ", type="
+                        + recovery.foregroundServiceType
+                        + ", generation="
+                        + recovery.generation
+                        + ", runGeneration="
+                        + recovery.runGeneration
+                        + ", startId=")
+                + recovery.startId
+                + ", flags="
+                + recovery.flags
+                + ", stop="
+                + stopOutcome
+                + ").",
+            recovery.denial);
+      }
+    }
   }
 
   private void stopIfRequested(Object request) {
+    try {
+      stopIfRequestedLocked(request);
+    } finally {
+      publishTimeoutEventsIfUnlocked();
+    }
+  }
+
+  private void stopIfRequestedLocked(Object request) {
     synchronized (sLifecycleLock) {
       if (sInstance != this
           || sStopRequest != request
@@ -307,24 +664,60 @@ public class ForegroundService extends Service {
           || mStartCommandFailed) {
         return;
       }
-      // The framework token and startId also protect against a start we have not yet received.
-      if (stopSelfResult(mLastStartId)) {
-        mStopInitiated = true;
-        sStopRequest = null;
-        mForegroundActive = false;
-        clearOwnedState();
+      // Consume this request before IPC so a reentrant START cannot schedule it against its
+      // successor. Refusal/failure restores it only while the original admission still owns it.
+      sStopRequest = null;
+      StopAuthority authority = captureStopAuthority();
+      boolean stopped = false;
+      try {
+        // The framework token and startId also protect an accepted, not yet delivered START.
+        stopped = stopSelfResult(authority.startId);
+        if (stopped && ownsStopAuthority(authority)) {
+          mStopInitiated = true;
+          mForegroundActive = false;
+          clearOwnedState();
+        }
+      } finally {
+        if (!stopped && ownsStopAuthority(authority)) {
+          sStopRequest = request;
+        }
       }
     }
   }
 
   @Override
   public int onStartCommand(Intent intent, int flags, int startId) {
+    try {
+      return onStartCommandLocked(intent, flags, startId);
+    } finally {
+      publishTimeoutEventsIfUnlocked();
+    }
+  }
+
+  private int onStartCommandLocked(Intent intent, int flags, int startId) {
     synchronized (sLifecycleLock) {
+      // Any later delivery supersedes the recovery startId, including terminal commands.
+      mDeniedStartRecovery = null;
       mLastStartId = startId;
       boolean terminal =
           intent == null || STOP_FOREGROUND_SERVICE_ACTION.equals(intent.getAction());
       if (terminal) {
-        sRunGeneration++;
+        long generation = ++sRunGeneration;
+        long admission = sStartAdmissionRevision;
+        long runGeneration = mRunGeneration;
+        ForegroundEpoch epoch = mForegroundEpoch;
+        invalidateAlarmPoc();
+        // This terminal delivery predates every START accepted during cancellation, including
+        // an undelivered obligation whose startId/epoch cannot yet reveal the new admission.
+        if (sInstance != this
+            || sStateOwner != this
+            || sRunGeneration != generation
+            || sStartAdmissionRevision != admission
+            || mRunGeneration != runGeneration
+            || mForegroundEpoch != epoch
+            || mLastStartId != startId) {
+          return START_STICKY_COMPATIBILITY;
+        }
       }
       if (terminal && !sPendingStarts.isEmpty()) {
         // The earlier accepted START must promote with its real notification/type first.
@@ -336,6 +729,13 @@ public class ForegroundService extends Service {
       }
       String requestId = intent == null ? null : intent.getStringExtra(START_REQUEST_ID);
       StartRequest request = sPendingStarts.get(requestId);
+      boolean frameworkRedelivery =
+          intent != null
+              && START_FOREGROUND_SERVICE_ACTION.equals(intent.getAction())
+              && Build.VERSION.SDK_INT >= Build.VERSION_CODES.S
+              && (flags & (START_FLAG_RETRY | START_FLAG_REDELIVERY)) != 0
+              && isValidStartRequestId(requestId)
+              && request == null;
       boolean superseded = false;
       if (!terminal) {
         long generation = request == null ? sRunGeneration : request.generation;
@@ -347,6 +747,7 @@ public class ForegroundService extends Service {
         if (!superseded && mRunGeneration != generation) {
           // Reserve the new session without retiring the previous submitted state or runner.
           // A failed promotion must preserve them, while older deliveries remain fenced.
+          invalidateAlarmPoc();
           mRunGeneration = generation;
         }
       }
@@ -358,11 +759,16 @@ public class ForegroundService extends Service {
           // that run already ended, still perform the old request's real promotion before teardown.
           result = mForegroundActive ? START_NOT_STICKY : fulfillSupersededStart(intent);
         } else {
-          result = handleStartCommand(intent, flags, startId);
+          result =
+              handleStartCommand(intent, flags, startId, frameworkRedelivery, requestId, request);
         }
         mStartCommandFailed = false;
         if (mStartCommandSatisfied) {
+          if (!terminal && !superseded) {
+            recordSatisfiedStart(startId);
+          }
           settleDeliveredStarts();
+          if (!terminal && !superseded) maybeArmAlarmPoc(request);
         }
         if (superseded
             && mStartCommandSatisfied
@@ -379,6 +785,9 @@ public class ForegroundService extends Service {
       } catch (RuntimeException e) {
         mStartCommandFailed = !mStartCommandSatisfied;
         if (mStartCommandSatisfied) {
+          if (!terminal && !superseded) {
+            recordSatisfiedStart(startId);
+          }
           settleDeliveredStarts();
         }
         throw e;
@@ -386,10 +795,63 @@ public class ForegroundService extends Service {
     }
   }
 
+  private static boolean isValidStartRequestId(@Nullable String requestId) {
+    if (requestId == null || requestId.length() != 36) {
+      return false;
+    }
+    try {
+      return UUID.fromString(requestId).toString().equalsIgnoreCase(requestId);
+    } catch (IllegalArgumentException e) {
+      return false;
+    }
+  }
+
+  // Caller holds sLifecycleLock and sLock. Recovery cannot retire an acquired run or another owner.
+  private boolean ownsUnpromotedState() {
+    return sInstance == this
+        && sStateOwner == this
+        && !mStartForegroundCalled
+        && !mForegroundActive
+        && !mStartCommandSatisfied
+        && mRunnerToken == null
+        && mRunFirstStartId == 0
+        && mCurrentNotificationId == null
+        && mCurrentForegroundServiceType == -1
+        && mCurrentNotificationBundle == null
+        && mCurrentNotification == null
+        && mCurrentHashCode == 0;
+  }
+
+  // Caller holds both lifecycle/state locks. Revalidate the original admission after the platform
+  // attempt: a synchronous authority change must not authorize a stale request's recovery.
+  private boolean canRecoverTrackedDenial(
+      Intent intent,
+      String requestId,
+      StartRequest request,
+      long generation,
+      long runGeneration,
+      int startId) {
+    return Build.VERSION.SDK_INT >= Build.VERSION_CODES.VANILLA_ICE_CREAM
+        && START_FOREGROUND_SERVICE_ACTION.equals(intent.getAction())
+        && isValidStartRequestId(requestId)
+        && request != null
+        && sPendingStarts.get(requestId) == request
+        && request.instance == this
+        && request.accepted
+        && !request.promotionDenied
+        && request.generation == runGeneration
+        && sRunGeneration == generation
+        && mRunGeneration == runGeneration
+        && mLastStartId == startId
+        && !mStopInitiated
+        && ownsUnpromotedState();
+  }
+
   // A real promotion (or an already foreground instance) satisfies the physical instance's
   // delivered obligations, including a prior ambiguous delivery. Undelivered STARTs remain held.
   // This does not turn a posting/type exception into success: onStartCommand still rethrows it.
   private void settleDeliveredStarts() {
+    mDeniedStartRecovery = null;
     sPendingStarts.values().removeIf(request -> request.instance == this);
   }
 
@@ -427,13 +889,22 @@ public class ForegroundService extends Service {
   }
 
   @SuppressLint({"ForegroundServiceType", "MissingPermission"})
-  private int handleStartCommand(Intent intent, int flags, int startId) {
+  private int handleStartCommand(
+      Intent intent,
+      int flags,
+      int startId,
+      boolean frameworkRedelivery,
+      String requestId,
+      StartRequest request) {
     Trace.beginSection("notifee:ForegroundService.onStartCommand");
     try {
       // Check if action is to stop the foreground service
       if (intent == null || STOP_FOREGROUND_SERVICE_ACTION.equals(intent.getAction())) {
+        StopAuthority authority = captureStopAuthority();
         ensureStartForegroundContractSatisfied(true);
-        if (stopSelfResult(startId)) {
+        if (ownsStopAuthority(authority)
+            && stopSelfResult(authority.startId)
+            && ownsStopAuthority(authority)) {
           mStopInitiated = true;
           mForegroundActive = false;
           clearOwnedState();
@@ -456,9 +927,14 @@ public class ForegroundService extends Service {
 
           Object pendingEvent = null;
           boolean noneEarlyReturn = false;
+          RuntimeException deniedInitialPromotion = null;
+          int deniedForegroundServiceType = -1;
+          boolean deniedTrackedStart = false;
 
           synchronized (sLock) {
-            if (mCurrentNotificationId == null || mStateGeneration != mRunGeneration) {
+            if (mCurrentNotificationId == null
+                || mStateGeneration != mRunGeneration
+                || (mForegroundEpoch != null && mForegroundEpoch.retiring)) {
               if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q) {
                 int foregroundServiceType =
                     notificationModel.getAndroid().getForegroundServiceType();
@@ -475,16 +951,39 @@ public class ForegroundService extends Service {
                   // Binder IPC (PackageManager + startForeground) and must not hold sLock.
                   noneEarlyReturn = true;
                 } else {
+                  boolean recoverInitialDenial = frameworkRedelivery && ownsUnpromotedState();
+                  long generation = sRunGeneration;
+                  long runGeneration = mRunGeneration;
+                  boolean recoverTrackedDenial =
+                      canRecoverTrackedDenial(
+                          intent, requestId, request, generation, runGeneration, startId);
                   Trace.beginSection("notifee:startForeground");
                   try {
                     startForeground(hashCode, notification, foregroundServiceType);
+                  } catch (RuntimeException e) {
+                    // Only the real initial promotion is exempt. Type resolution, NONE, posting,
+                    // updates and teardown retain their existing failure boundaries.
+                    boolean trackedDenial =
+                        recoverTrackedDenial
+                            && canRecoverTrackedDenial(
+                                intent, requestId, request, generation, runGeneration, startId);
+                    if (!(trackedDenial || (recoverInitialDenial && ownsUnpromotedState()))
+                        || Build.VERSION.SDK_INT < Build.VERSION_CODES.S
+                        || e.getClass() != ForegroundServiceStartNotAllowedException.class) {
+                      throw e;
+                    }
+                    deniedInitialPromotion = e;
+                    deniedForegroundServiceType = foregroundServiceType;
+                    deniedTrackedStart = trackedDenial;
                   } finally {
                     Trace.endSection();
                   }
-                  mStartForegroundCalled = true;
-                  mForegroundActive = true;
-                  mStartCommandSatisfied = true;
-                  mCurrentForegroundServiceType = foregroundServiceType;
+                  if (deniedInitialPromotion == null) {
+                    mStartForegroundCalled = true;
+                    mForegroundActive = true;
+                    mStartCommandSatisfied = true;
+                    mCurrentForegroundServiceType = foregroundServiceType;
+                  }
                 }
               } else {
                 Trace.beginSection("notifee:startForeground");
@@ -498,7 +997,10 @@ public class ForegroundService extends Service {
                 mStartCommandSatisfied = true;
               }
 
-              if (!noneEarlyReturn) {
+              if (!noneEarlyReturn && deniedInitialPromotion == null) {
+                if (!commitForegroundEpoch()) return START_NOT_STICKY;
+                if (request != null && request.alarmPoc != null)
+                  request.alarmPocEpoch = mForegroundEpoch;
                 mCurrentNotificationId = notificationId;
                 mCurrentNotificationBundle = bundle;
                 mCurrentNotification = notification;
@@ -513,13 +1015,25 @@ public class ForegroundService extends Service {
                     (e, aVoid) -> {
                       Runnable complete =
                           () -> {
-                            synchronized (sLifecycleLock) {
-                              if (sInstance == this
-                                  && mRunnerToken == runnerToken
-                                  && sRunGeneration == runnerGeneration) {
-                                stopForegroundCompat();
-                                clearOwnedState();
+                            try {
+                              synchronized (sLifecycleLock) {
+                                if (sInstance == this
+                                    && mRunnerToken == runnerToken
+                                    && sRunGeneration == runnerGeneration
+                                    && mForegroundEpoch != null
+                                    && !mForegroundEpoch.retiring
+                                    && !mForegroundEpoch.retired) {
+                                  ForegroundEpoch epoch = mForegroundEpoch;
+                                  stopForegroundCompat();
+                                  if (sInstance == this
+                                      && mForegroundEpoch == epoch
+                                      && mRunnerToken == runnerToken) {
+                                    clearOwnedState();
+                                  }
+                                }
                               }
+                            } finally {
+                              publishTimeoutEventsIfUnlocked();
                             }
                           };
                       if (Looper.myLooper() == Looper.getMainLooper()) {
@@ -533,6 +1047,8 @@ public class ForegroundService extends Service {
               }
             } else {
               if (mCurrentNotificationId.equals(notificationId)) {
+                ForegroundEpoch updateEpoch = mForegroundEpoch;
+                long updateGeneration = sRunGeneration;
                 // Before API 31, updating the service's registered notification requires
                 // startForeground(). API 31+ processes a same-ID notify() against the foreground
                 // service record. Keep that path for an unchanged type: repeating
@@ -566,13 +1082,27 @@ public class ForegroundService extends Service {
                   } finally {
                     Trace.endSection();
                   }
-                  mStartForegroundCalled = true;
-                  mForegroundActive = true;
-                  mStartCommandSatisfied = true;
                 } else {
                   NotificationManagerCompat.from(ContextHolder.getApplicationContext())
                       .notify(mCurrentHashCode, notification);
                 }
+                // A timeout or successor may have retired/replaced the publication during IPC.
+                // A normal return cannot reacquire its cache, runner or promotion authority.
+                if (!ownsTimeoutEpoch(updateEpoch)
+                    || updateEpoch == null
+                    || updateEpoch.retiring
+                    || updateEpoch.retired
+                    || mLastStartId != startId
+                    || mRunGeneration != updateEpoch.runGeneration
+                    || sRunGeneration != updateGeneration) {
+                  return START_NOT_STICKY;
+                }
+                if (shouldStartForeground) {
+                  mStartForegroundCalled = true;
+                  mForegroundActive = true;
+                  mStartCommandSatisfied = true;
+                  if (!commitForegroundEpoch()) return START_NOT_STICKY;
+                }
                 // The platform call returned normally, so cache the latest submitted state for
                 // re-post and timeout. A normal return does not acknowledge display.
                 mCurrentForegroundServiceType = foregroundServiceType;
@@ -586,6 +1116,28 @@ public class ForegroundService extends Service {
             }
           }
 
+          if (deniedInitialPromotion != null) {
+            // Release sLock before stop Binder IPC. Terminalize only the exact denied request;
+            // this is not a successful promotion and cannot fulfill any other delivered START.
+            if (deniedTrackedStart) {
+              request.promotionDenied = true;
+              sPendingStarts.remove(requestId, request);
+            }
+            DeniedStartRecovery recovery =
+                new DeniedStartRecovery(
+                    sRunGeneration,
+                    mRunGeneration,
+                    startId,
+                    flags,
+                    deniedInitialPromotion,
+                    deniedTrackedStart ? requestId : null,
+                    notificationId,
+                    deniedForegroundServiceType);
+            mDeniedStartRecovery = recovery;
+            stopDeniedStartIfCurrent(recovery);
+            return START_NOT_STICKY;
+          }
+
           // Handle NONE early return outside the lock — the helper performs Binder IPC
           // (PackageManager query + startForeground) that must not hold sLock.
           if (noneEarlyReturn) {
@@ -618,7 +1170,11 @@ public class ForegroundService extends Service {
   @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
   @Override
   public void onTimeout(int startId) {
-    handleTimeout(startId, -1);
+    try {
+      handleTimeout(startId, -1, true);
+    } finally {
+      publishTimeoutEventsIfUnlocked();
+    }
   }
 
   /**
@@ -628,7 +1184,11 @@ public class ForegroundService extends Service {
   @RequiresApi(Build.VERSION_CODES.VANILLA_ICE_CREAM)
   @Override
   public void onTimeout(int startId, int fgsType) {
-    handleTimeout(startId, fgsType);
+    try {
+      handleTimeout(startId, fgsType, false);
+    } finally {
+      publishTimeoutEventsIfUnlocked();
+    }
   }
 
   @RequiresApi(Build.VERSION_CODES.Q)
@@ -679,12 +1239,20 @@ public class ForegroundService extends Service {
 
   @SuppressWarnings("deprecation")
   private void stopForegroundCompat() {
+    ForegroundEpoch epoch = mForegroundEpoch;
+    removeForegroundNotification();
+    if (sInstance == this && sStateOwner == this && mForegroundEpoch == epoch) {
+      mForegroundActive = false;
+    }
+  }
+
+  @SuppressWarnings("deprecation")
+  private void removeForegroundNotification() {
     if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
       stopForeground(STOP_FOREGROUND_REMOVE);
     } else {
       stopForeground(true);
     }
-    mForegroundActive = false;
   }
 
   /**
@@ -843,36 +1411,412 @@ public class ForegroundService extends Service {
     stopForegroundCompat();
   }
 
-  private void handleTimeout(int startId, int fgsType) {
-    Logger.e(
-        TAG,
-        "Foreground service timed out (startId="
+  // Caller holds sLifecycleLock. Platform calls may synchronously reenter lifecycle callbacks.
+  private boolean ownsTimeoutEpoch(ForegroundEpoch epoch) {
+    synchronized (sLock) {
+      return sInstance == this && sStateOwner == this && mForegroundEpoch == epoch;
+    }
+  }
+
+  private void retireTimeoutEpoch(ForegroundEpoch epoch) {
+    synchronized (sLock) {
+      if (ownsTimeoutEpoch(epoch)) {
+        mForegroundActive = false;
+        clearOwnedState();
+      }
+    }
+  }
+
+  @RequiresApi(Build.VERSION_CODES.UPSIDE_DOWN_CAKE)
+  private void handleTimeout(int startId, int fgsType, boolean shortServiceCallback) {
+    Bundle notificationBundle;
+    ForegroundEpoch epoch;
+    ForegroundServiceRunLimitScheduler.Ticket timeoutAlarm;
+    RuntimeException primary = null;
+    String demotionOutcome = "failed";
+    String stopOutcome = "deferred";
+    synchronized (sLifecycleLock) {
+      final boolean stopAuthorized;
+      final int stopId;
+      final Object stopRequest = sStopRequest;
+      synchronized (sLock) {
+        epoch = mForegroundEpoch;
+        int callbackType =
+            shortServiceCallback ? ServiceInfo.FOREGROUND_SERVICE_TYPE_SHORT_SERVICE : fgsType;
+        if (sInstance != this
+            || sStateOwner != this
+            || epoch == null
+            || (epoch.retiring && !epoch.voluntaryRetirement)
+            || epoch.retired
+            || !mForegroundActive
+            || (mRunFirstStartId != 0 && startId < mRunFirstStartId)
+            || callbackType <= 0
+            || mCurrentForegroundServiceType <= 0
+            || (callbackType & mCurrentForegroundServiceType) == 0) {
+          return;
+        }
+        // Matching IDs are library authority only. A repeated platform promotion within the
+        // same run can expose coincident metadata, so it never upgrades ambiguous provenance.
+        stopAuthorized =
+            !epoch.ambiguousPromotion
+                && !mTimeoutStartIds.contains(startId)
+                && epoch.satisfiedStartIds.contains(startId);
+        stopId = epoch.lastSatisfiedStartId;
+        notificationBundle =
+            mCurrentNotificationBundle == null ? null : new Bundle(mCurrentNotificationBundle);
+        mTimeoutStartIds.add(startId);
+        epoch.retiring = true;
+        epoch.voluntaryRetirement = false;
+        timeoutAlarm = revokeAlarmPoc();
+      }
+
+      // Nothing that posts an event, converts a model or retires owned evidence precedes this.
+      try {
+        removeForegroundNotification();
+        demotionOutcome = "returned"; // Normal Binder return is not an AMS acknowledgement.
+        retireTimeoutEpoch(epoch);
+      } catch (RuntimeException failure) {
+        primary = failure;
+      }
+
+      if (stopAuthorized
+          && ownsTimeoutEpoch(epoch)
+          && epoch.runGeneration == mRunGeneration
+          && epoch.runGeneration == sRunGeneration
+          && sStopRequest == stopRequest
+          && sPendingStarts.isEmpty()
+          && mLastStartId == stopId
+          && stopId != 0
+          && !mStartCommandFailed
+          && !mStopInitiated) {
+        try {
+          stopOutcome = "failed";
+          StopAuthority authority = captureStopAuthority();
+          boolean stopped = stopSelfResult(stopId);
+          stopOutcome = stopped ? "accepted" : "refused";
+          if (stopped && ownsTimeoutEpoch(epoch) && ownsStopAuthority(authority)) {
+            mStopInitiated = true;
+            retireTimeoutEpoch(epoch);
+          }
+        } catch (RuntimeException failure) {
+          if (primary == null) primary = failure;
+          else if (primary != failure) primary.addSuppressed(failure);
+        }
+      }
+    }
+
+    if (timeoutAlarm != null) ForegroundServiceRunLimitScheduler.cancel(timeoutAlarm);
+
+    // Consume publication authority once, including when a reentrant caller still owns locks.
+    final RuntimeException timeoutFailure = primary;
+    final String diagnostic =
+        "Foreground timeout (startId="
             + startId
             + ", type="
             + fgsType
-            + "). Stopping service.");
+            + ", runGeneration="
+            + epoch.runGeneration
+            + ", demotion="
+            + demotionOutcome
+            + ", stop="
+            + stopOutcome
+            + ").";
+    List<Runnable> publications = sTimeoutPublications.get();
+    if (publications == null) {
+      publications = new ArrayList<>();
+      sTimeoutPublications.set(publications);
+    }
+    publications.add(
+        () -> {
+          if (notificationBundle != null) {
+            try {
+              NotificationModel model = NotificationModel.fromBundle(notificationBundle);
+              Bundle extras = new Bundle();
+              extras.putInt("startId", startId);
+              extras.putInt("fgsType", fgsType);
+              EventBus.post(
+                  new NotificationEvent(NotificationEvent.TYPE_FG_TIMEOUT, model, extras));
+            } catch (RuntimeException failure) {
+              if (timeoutFailure != null && timeoutFailure != failure)
+                timeoutFailure.addSuppressed(failure);
+              Logger.w(TAG, "Timeout event publication failed", failure);
+            }
+          }
+          // Preserve the existing error LogEvent, but only after the essential teardown and
+          // timeout publication. Its failure cannot replace a primary platform exception.
+          try {
+            if (timeoutFailure == null) Logger.e(TAG, diagnostic);
+            else Logger.e(TAG, diagnostic, timeoutFailure);
+          } catch (RuntimeException failure) {
+            if (timeoutFailure != null && timeoutFailure != failure)
+              timeoutFailure.addSuppressed(failure);
+            Logger.w(TAG, "Timeout diagnostic publication failed", failure);
+          }
+        });
+    publishTimeoutEventsIfUnlocked();
+    if (primary != null) throw primary;
+  }
 
-    Bundle notifBundle;
-    synchronized (sLifecycleLock) {
-      // shortService can report the first START of this run after same-ID updates. Reject only
-      // callbacks from an earlier run, not earlier STARTs within the current run.
-      if (sInstance != this || (mRunFirstStartId != 0 && startId < mRunFirstStartId)) {
+  // All diagnostic authority is subordinate to the existing lifecycle/epoch registry.
+  // Caller holds sLifecycleLock; nested state checks always take sLock second.
+  private void invalidateAlarmPoc() {
+    ForegroundServiceRunLimitScheduler.Ticket ticket = revokeAlarmPoc();
+    if (ticket != null) ForegroundServiceRunLimitScheduler.cancel(ticket);
+  }
+
+  private ForegroundServiceRunLimitScheduler.Ticket revokeAlarmPoc() {
+    ForegroundServiceRunLimitScheduler.Ticket ticket = mAlarmPoc;
+    mAlarmPoc = null;
+    if (ticket != null) ticket.valid = false;
+    return ticket;
+  }
+
+  private void maybeArmAlarmPoc(StartRequest request) {
+    if (request == null || request.alarmPoc == null || Build.VERSION.SDK_INT < 35) return;
+    synchronized (sLock) {
+      ForegroundEpoch epoch = mForegroundEpoch;
+      if ((!request.alarmPoc.publicOption && mAlarmPocAttemptedRun == mRunGeneration)
+          || request.alarmPocEpoch != epoch) {
+        ForegroundServiceRunLimitScheduler.marker(
+            "ARM_REJECTED", null, "no new diagnostic promotion/run");
         return;
       }
-      synchronized (sLock) {
-        notifBundle = sStateOwner == this ? mCurrentNotificationBundle : null;
-        clearOwnedState();
+      mAlarmPocAttemptedRun = mRunGeneration;
+      if (sInstance != this
+          || sStateOwner != this
+          || epoch == null
+          || epoch.retiring
+          || epoch.retired
+          || !mForegroundActive
+          || !mStartCommandSatisfied
+          || epoch.runGeneration != mRunGeneration
+          || sRunGeneration != mRunGeneration
+          || epoch.lastSatisfiedStartId != mLastStartId
+          || mStopInitiated
+          || mCurrentForegroundServiceType != ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC) {
+        ForegroundServiceRunLimitScheduler.marker(
+            "ARM_REJECTED", null, "requires current single dataSync epoch");
+        return;
+      }
+      ForegroundServiceRunLimitScheduler.Ticket ticket = null;
+      try {
+        // Promotion has already returned; no ledger/GC I/O is added to default START latency.
+        if (request.alarmPoc.publicOption) ForegroundServiceRunLimitScheduler.collectOrphans(this);
+        ticket =
+            new ForegroundServiceRunLimitScheduler.Ticket(
+                this,
+                epoch,
+                sRunGeneration,
+                mRunGeneration,
+                request.alarmPoc,
+                epoch.promotedElapsed);
+        // Ticket construction reads boot identity through a platform API. Revalidate after it.
+        if (sInstance != this
+            || sStateOwner != this
+            || mForegroundEpoch != epoch
+            || epoch.retiring
+            || epoch.retired
+            || sRunGeneration != ticket.generation
+            || mRunGeneration != ticket.runGeneration) {
+          ForegroundServiceRunLimitScheduler.cancel(ticket);
+          return;
+        }
+        mAlarmPoc = ticket;
+        if (!ForegroundServiceRunLimitScheduler.arm(ticket) || !ownsAlarmPoc(ticket)) {
+          if (mAlarmPoc == ticket) mAlarmPoc = null;
+          ForegroundServiceRunLimitScheduler.cancel(ticket);
+        }
+      } catch (org.json.JSONException | RuntimeException failure) {
+        // Construction/storage may have admitted B reentrantly. Cleanup belongs only to A.
+        if (ticket != null) {
+          if (mAlarmPoc == ticket) mAlarmPoc = null;
+          ForegroundServiceRunLimitScheduler.cancel(ticket);
+        }
+        ForegroundServiceRunLimitScheduler.marker("ARM_FAILED", ticket, failure.toString());
       }
-      stopForegroundCompat();
-      stopSelf(startId);
     }
+  }
 
-    if (notifBundle != null) {
-      NotificationModel model = NotificationModel.fromBundle(notifBundle);
-      Bundle extras = new Bundle();
-      extras.putInt("startId", startId);
-      extras.putInt("fgsType", fgsType);
-      EventBus.post(new NotificationEvent(NotificationEvent.TYPE_FG_TIMEOUT, model, extras));
+  String alarmPocInstanceId() {
+    if (mAlarmPocInstanceId == null) mAlarmPocInstanceId = UUID.randomUUID().toString();
+    return mAlarmPocInstanceId;
+  }
+
+  private boolean ownsAlarmPoc(ForegroundServiceRunLimitScheduler.Ticket ticket) {
+    return Build.VERSION.SDK_INT >= 35
+        && sInstance == this
+        && sStateOwner == this
+        && ticket.owner == this
+        && mAlarmPoc == ticket
+        && ticket.valid
+        && ticket.epoch == mForegroundEpoch
+        && sRunGeneration == ticket.generation
+        && mRunGeneration == ticket.runGeneration
+        && mForegroundEpoch != null
+        && mForegroundEpoch.runGeneration == ticket.runGeneration
+        && !mForegroundEpoch.retiring
+        && !mForegroundEpoch.retired
+        && mForegroundActive
+        && mCurrentForegroundServiceType == ServiceInfo.FOREGROUND_SERVICE_TYPE_DATA_SYNC
+        && mStartCommandSatisfied
+        && mLastStartId != 0
+        && mLastStartId == mForegroundEpoch.lastSatisfiedStartId
+        && !mStartCommandFailed
+        && !mStopInitiated;
+  }
+
+  static void receiveAlarmPoc(Intent intent) {
+    try {
+      synchronized (sLifecycleLock) {
+        ForegroundService owner = sInstance;
+        if (owner == null) {
+          ForegroundServiceRunLimitScheduler.marker(
+              "NO_MATCHING_LIVE_INSTANCE", null, "cold delivery");
+          return;
+        }
+        owner.expireAlarmPoc(intent);
+      }
+    } finally {
+      publishTimeoutEventsIfUnlocked();
+    }
+  }
+
+  private void expireAlarmPoc(Intent intent) {
+    final ForegroundServiceRunLimitScheduler.Ticket ticket;
+    final ForegroundEpoch epoch;
+    final StopAuthority stop;
+    final Bundle notificationBundle;
+    final long deliveredElapsed;
+    String demotionOutcome = "failed";
+    String stopOutcome = "deferred";
+    synchronized (sLock) {
+      ticket = mAlarmPoc;
+      if (ticket == null
+          || !ownsAlarmPoc(ticket)
+          || !ForegroundServiceRunLimitScheduler.matches(ticket, intent)) {
+        ForegroundServiceRunLimitScheduler.marker(
+            "ALARM_STALE", null, "no matching live authority");
+        return;
+      }
+      ForegroundServiceRunLimitScheduler.marker("ALARM_DELIVERED", ticket, "native receiver");
+      if (!ForegroundServiceRunLimitScheduler.ledgerMatches(ticket)) {
+        if (mAlarmPoc == ticket) invalidateAlarmPoc();
+        ForegroundServiceRunLimitScheduler.marker(
+            "LEDGER_INVALID", ticket, "no teardown authority");
+        return;
+      }
+      long now = SystemClock.elapsedRealtime();
+      if (now < ticket.deadline) {
+        ForegroundServiceRunLimitScheduler.marker("ALARM_EARLY", ticket, "no demotion");
+        return;
+      }
+      if (now > ticket.deadline) {
+        ForegroundServiceRunLimitScheduler.marker(
+            "ALARM_LATE", ticket, "delayMs=" + (now - ticket.deadline));
+      }
+      // Boot/ledger validation crosses platform APIs. It cannot transfer the old alarm's
+      // authority to a successor that appeared while those calls were in progress.
+      if (!ownsAlarmPoc(ticket)) {
+        ForegroundServiceRunLimitScheduler.marker(
+            "ALARM_STALE", ticket, "owner changed during validation");
+        return;
+      }
+      epoch = mForegroundEpoch;
+      stop = captureStopAuthority();
+      deliveredElapsed = now;
+      notificationBundle =
+          mCurrentNotificationBundle == null ? null : new Bundle(mCurrentNotificationBundle);
+      mAlarmPoc = null;
+      ticket.valid = false;
+      epoch.retiring = true;
+      epoch.voluntaryRetirement = true;
+    }
+    try {
+      ForegroundServiceRunLimitScheduler.marker(
+          "DEMOTION_ATTEMPTED",
+          ticket,
+          "REMOVE notificationId="
+              + mCurrentNotificationId
+              + " startId="
+              + stop.startId
+              + " satisfiedStartId="
+              + epoch.lastSatisfiedStartId
+              + " pendingStarts="
+              + sPendingStarts.size());
+      try {
+        removeForegroundNotification();
+        demotionOutcome = "returned";
+        ForegroundServiceRunLimitScheduler.marker(
+            "DEMOTION_RETURNED", ticket, "not an AMS acknowledgement");
+        retireTimeoutEpoch(epoch);
+      } catch (RuntimeException failure) {
+        ForegroundServiceRunLimitScheduler.marker("DEMOTION_FAILED", ticket, failure.toString());
+      }
+      if (ownsTimeoutEpoch(epoch)
+          && epoch.runGeneration == mRunGeneration
+          && epoch.runGeneration == sRunGeneration
+          && ownsStopAuthority(stop)
+          && mLastStartId == epoch.lastSatisfiedStartId
+          && mLastStartId != 0
+          && !mStartCommandFailed
+          && !mStopInitiated) {
+        try {
+          stopOutcome = "failed";
+          boolean stopped = stopSelfResult(stop.startId);
+          stopOutcome = stopped ? "accepted" : "refused";
+          ForegroundServiceRunLimitScheduler.marker(
+              stopped ? "STOP_ACCEPTED" : "STOP_REFUSED", ticket, "startId=" + stop.startId);
+          if (stopped && ownsTimeoutEpoch(epoch) && ownsStopAuthority(stop)) {
+            mStopInitiated = true;
+            retireTimeoutEpoch(epoch);
+          }
+        } catch (RuntimeException failure) {
+          ForegroundServiceRunLimitScheduler.marker("STOP_FAILED", ticket, failure.toString());
+        }
+      } else {
+        ForegroundServiceRunLimitScheduler.marker(
+            "STOP_DEFERRED", ticket, "pending/unknown START or ownership changed");
+      }
+      ForegroundServiceRunLimitScheduler.marker(
+          "NATIVE_FINAL_STATE",
+          ticket,
+          "sameEpoch="
+              + ownsTimeoutEpoch(epoch)
+              + " foregroundActive="
+              + mForegroundActive
+              + " stopInitiated="
+              + mStopInitiated
+              + " pendingStarts="
+              + sPendingStarts.size());
+    } finally {
+      ForegroundServiceRunLimitScheduler.cancel(ticket);
+    }
+    if (ticket.publicOption && notificationBundle != null) {
+      Bundle metadata = new Bundle();
+      metadata.putLong("requestedDurationMs", ticket.duration);
+      metadata.putLong("deadlineElapsed", ticket.deadline);
+      metadata.putLong("deliveredElapsed", deliveredElapsed);
+      metadata.putString("demotion", demotionOutcome);
+      metadata.putString("conditionalStop", stopOutcome);
+      List<Runnable> publications = sTimeoutPublications.get();
+      if (publications == null) {
+        publications = new ArrayList<>();
+        sTimeoutPublications.set(publications);
+      }
+      publications.add(
+          () -> {
+            try {
+              Bundle extras = new Bundle();
+              extras.putBundle("foregroundServiceRunLimit", metadata);
+              EventBus.post(
+                  new NotificationEvent(
+                      NotificationEvent.TYPE_FG_RUN_LIMIT_REACHED,
+                      NotificationModel.fromBundle(notificationBundle),
+                      extras));
+            } catch (RuntimeException failure) {
+              ForegroundServiceRunLimitScheduler.marker("EVENT_FAILED", ticket, failure.toString());
+            }
+          });
     }
   }
 }