react-native-notify-kit 9.3.0 → 9.5.0

package/README.md

@@ -222,7 +222,17 @@ To modify push notification content before display (e.g., attach images), create
    }
    ```
 
-4. Run `cd ios && pod install`
+4. Implement `serviceExtensionTimeWillExpire` as a safety net. Notification Service Extensions have a ~30-second time budget; if your notification includes a large image attachment and the download is slow, the extension may be terminated before the content handler is called. Deliver a best-effort notification in the expiration handler:
+
+   ```objc
+   - (void)serviceExtensionTimeWillExpire {
+       // Deliver the notification with whatever content we have so far
+       // (e.g., without the image attachment if the download didn't finish).
+       self.contentHandler(self.bestAttemptContent);
+   }
+   ```
+
+5. Run `cd ios && pod install`
 
 ## Jest Testing
 
@@ -253,9 +263,10 @@ This fork is a complete migration to React Native's **New Architecture**:
 - **Toolchain**: Yarn 4, Node 22+, Java 17, compileSdk/targetSdk 35
 - **Single Android module** — the original Notifee shipped a pre-compiled AAR bundled inside the npm tarball under a frozen Maven coordinate; this fork compiles the core from source as part of the React Native bridge module on every consumer build. Eliminates the `FAIL_ON_PROJECT_REPOS` issue on RN 0.74+ and the Gradle cache staleness bug that could serve outdated bytecode after `yarn upgrade`.
 - **Core notification logic (NotifeeCore) is unchanged** — the public API is fully compatible with the original Notifee
-- **22 upstream bugs fixed** — see [Bugs Fixed from Upstream Notifee](#bugs-fixed-from-upstream-notifee) below
+- **30 upstream bugs fixed** — see [Bugs Fixed from Upstream Notifee](#bugs-fixed-from-upstream-notifee) below
 - **Reliable trigger notifications** — AlarmManager is the default backend instead of WorkManager, with automatic fallback when exact alarm permission is not granted
 - **New API: `setNotificationConfig()`** — opt-out flag to prevent Notifee from intercepting iOS remote notification handlers (see [New APIs](#new-apis) below)
+- **Baseline Profile** — the library AAR ships a Baseline Profile that instructs ART to AOT-compile the foreground service notification hot path at install time, eliminating JIT penalty on first invocation
 
 ## Bugs Fixed from Upstream Notifee
 
@@ -286,6 +297,13 @@ This fork fixes the following bugs that were never resolved in the original Noti
 | Stale Gradle cache could serve outdated AAR bytecode after `yarn upgrade` — same Maven coordinate reused across releases violated Gradle's coordinate-immutability assumption | Android | N/A (architectural) | 9.2.0 |
 | `EventType.DELIVERED` not emitted for `displayNotification()` in foreground (only for trigger notifications) — `notifeeTrigger != nil` guard in `willPresentNotification:` suppressed the event, breaking iOS/Android symmetry | iOS | Pre-existing | 9.3.0 |
 | Tapping a notification without explicit `pressAction` does nothing (app doesn't open) — `NotificationPendingIntent.createIntent()` creates a tap-less PendingIntent when `pressActionModelBundle` is null, especially visible on trigger notifications after app kill | Android | Pre-existing (latent) | 9.3.0 |
+| Foreground service notifications delayed up to 10 seconds on Android 12+ — library never calls `setForegroundServiceBehavior(FOREGROUND_SERVICE_IMMEDIATE)` | Android | [#272](https://github.com/invertase/notifee/issues/272), [#1242](https://github.com/invertase/notifee/issues/1242) | 9.4.0 |
+| `didReceiveNotificationResponse:` completionHandler delayed by 15 seconds via `dispatch_after`, blocking subsequent notification taps and risking handler leaks if the app is suspended during the wait | iOS | Pre-existing (TODO since 2020) | 9.4.0 |
+| `requestPermission:` silently swallows `NSError` from `requestAuthorizationWithOptions`, making MDM and parental-control authorization failures invisible to JS consumers | iOS | Pre-existing (TODO since day 1) | 9.4.0 |
+| `contentByUpdatingWithProvider:` errors suppressed via `nil` error pointer in `displayNotification:` and `createTriggerNotification:` — communication notifications with malformed SiriKit intents silently fail with nil content | iOS | Pre-existing | 9.4.0 |
+| `getBadgeCount:` completion block never called when running in an app extension, causing JS promises to hang forever in NSE handlers | iOS | Pre-existing | 9.4.0 |
+| Notification Service Extension attachment downloads had no timeout cap (default 60-second `NSURLSession` timeout exceeds iOS's ~30-second NSE budget), causing extension process kill and notification loss on slow networks | iOS | Pre-existing | 9.4.0 |
+| `cancelTriggerNotifications()` / `createTriggerNotification()` promises resolve before Room DB write completes, causing ~3% race on cancel-then-create patterns. Also fixes a previously-undocumented reboot-recovery data-loss bug in `NotifeeAlarmManager.rescheduleNotification` and an ordering bug in `NotificationManager.doScheduledWork` | Android | [#549](https://github.com/invertase/notifee/issues/549) | 9.5.0 |
 
 > **Note for apps requiring guaranteed exact alarms (alarm clocks, timers, calendars):**
 > Add `<uses-permission android:name="android.permission.USE_EXACT_ALARM" />` to your app's
@@ -314,6 +332,8 @@ In addition to bug fixes, the fork makes a few opinionated default changes vs `@
 
 - **Library no longer hardcodes `foregroundServiceType` in its manifest** (since 9.1.13 — **BREAKING vs upstream**). Apps using `asForegroundService: true` on Android 14+ must declare their own `foregroundServiceType` on `app.notifee.core.ForegroundService` in their app manifest. See [Foreground Service Setup](#foreground-service-setup-android-14) below for migration instructions. Upstream hardcoded `shortService`, which caused a manifest merger failure ([#1108](https://github.com/invertase/notifee/issues/1108)) and a 3-minute timeout ANR crash ([#703](https://github.com/invertase/notifee/issues/703)).
 
+- **Foreground service notifications use `FOREGROUND_SERVICE_IMMEDIATE` by default** (since 9.4.0 — **BREAKING vs upstream**). Upstream Notifee never called `setForegroundServiceBehavior()`, causing Android 12+ to defer foreground service notification display by up to 10 seconds unless the notification qualified for a system exemption. The fork now sets `FOREGROUND_SERVICE_IMMEDIATE` by default when `asForegroundService: true`, eliminating the delay. Opt out per-notification with `foregroundServiceBehavior: AndroidForegroundServiceBehavior.DEFERRED`. Additionally, the library now pre-loads critical foreground service classes and Binder proxies on a background thread during app startup (`InitProvider.onCreate`), reducing first-display cold-start latency by ~50–100 ms. Opt out of the warmup via `<meta-data android:name="notifee_init_warmup_enabled" android:value="false" />` in your app's `AndroidManifest.xml`.
+
 - **iOS `EventType.DELIVERED` now emitted for all foreground notifications** (since 9.3.0 — **BREAKING vs upstream**). Upstream Notifee had a guard in `willPresentNotification:` that suppressed DELIVERED for notifications created via `displayNotification()` (immediate display), emitting it only for trigger notifications. Android always emitted DELIVERED in both cases. The fork removes the guard so iOS matches Android. If you registered `onForegroundEvent` listeners that did heavy work on DELIVERED assuming the event would only fire for trigger notifications, audit them — you may now receive an event per `displayNotification()` call while in foreground. **Known limitation**: trigger notifications that fire while the app is in background or killed still do not emit DELIVERED on iOS — this is a platform limitation (`willPresentNotification:` is only invoked in foreground, and iOS provides no delegate callback for background-delivered triggers). If you need delivery confirmation for background trigger notifications on iOS, check the notification's presence via `getDisplayedNotifications()` after the app returns to foreground.
 
 These changes are documented in the [CHANGELOG](CHANGELOG.md) under the release that introduced them. If you rely on any of the upstream defaults, you can either pin to the specific behavior via the opt-out flags listed above, or open an issue to discuss.
@@ -418,6 +438,52 @@ With `handleRemoteNotifications: false`:
 
 Default is `true` (backward compatible — Notifee handles everything, same as original Notifee behavior).
 
+## Advanced / Troubleshooting
+
+### Manual warmup control
+
+The library automatically pre-warms the foreground service notification path during app startup via `InitProvider`. **Most apps do not need to do anything extra.** However, in certain edge cases the automatic warmup may not be sufficient:
+
+- **Lazy-loaded library** — if `react-native-notify-kit` is code-split or lazy-loaded, `InitProvider` runs but the TurboModule/JS bridge side isn't initialized yet.
+- **Post-splash-screen warmup** — apps that want to defer warmup to after the splash screen instead of during `Application.onCreate()`.
+- **Low-end devices** — rare cases where the `InitProvider` warmup hasn't finished by the time the user triggers the first notification.
+
+For these cases, call `prewarmForegroundService()` at a moment of your choosing:
+
+```typescript
+import notifee from 'react-native-notify-kit';
+
+// Call after splash screen, during onboarding, or before the user
+// is likely to trigger a foreground service notification.
+await notifee.prewarmForegroundService();
+```
+
+**Key facts:**
+
+- **Idempotent** — safe to call multiple times; class loading after the first call is a no-op from ART's perspective.
+- **iOS no-op** — resolves immediately on iOS (Android-only optimization).
+- **Does NOT start a foreground service** — it only performs class loading and Binder proxy warming. No Google Play policy risk.
+- **Best-effort** — internal failures are logged and swallowed; the promise always resolves.
+
+To verify whether calling this method provides a measurable benefit for your app, capture a Perfetto trace with the `notifee:*` trace sections enabled and compare the `notifee:displayNotification` duration with and without the prewarm call.
+
+### Regenerating the Baseline Profile
+
+The library ships a Baseline Profile (`packages/react-native/android/src/main/baseline-prof.txt`) that instructs ART to AOT-compile the notification hot path at install time. This profile should be regenerated after significant changes to the notification display code path.
+
+**Prerequisites:**
+
+- A physical device connected via adb (Pixel 9 Pro XL with Android 16+ recommended) or a running emulator with API 33+
+- The smoke app must be buildable (`yarn install` in the repo root)
+
+**Command:**
+
+```bash
+bash scripts/generate-baseline-profile.sh
+```
+
+The script runs the macrobenchmark test in `apps/smoke/android/baselineprofile/`, captures the profile on the connected device, filters it to library-only rules, and copies it to the library's `src/main/baseline-prof.txt`. Review the generated file for unexpected entries, then commit it.
+
 ## Documentation
 
 The upstream Notifee documentation remains the best reference for the public API and platform guides used by this fork.

package/android/build.gradle

@@ -139,6 +139,10 @@ dependencies {
 
   api 'org.greenrobot:eventbus:3.3.1' // https://github.com/greenrobot/EventBus/releases
 
+  // ProfileInstaller bootstraps baseline profiles on devices that do not receive
+  // cloud-compiled profiles from Play Store (sideloads, debug builds).
+  api 'androidx.profileinstaller:profileinstaller:1.4.1'
+
   // --- Bridge dependencies ---
   implementation 'androidx.lifecycle:lifecycle-process:2.3.1'
   //noinspection GradleDynamicVersion
@@ -147,6 +151,7 @@ dependencies {
   // --- Test dependencies ---
   testImplementation 'junit:junit:4.13.2' // https://github.com/junit-team/junit4/releases
   testImplementation 'org.robolectric:robolectric:4.14.1' // https://github.com/robolectric/robolectric/releases
+  testImplementation 'org.mockito:mockito-core:5.19.0' // https://github.com/mockito/mockito/releases
   androidTestImplementation 'androidx.test.ext:junit:1.1.3' // https://developer.android.com/jetpack/androidx/releases/test
   androidTestImplementation 'androidx.test.espresso:espresso-core:3.4.0' // see above
   androidTestImplementation "androidx.room:room-testing:$room_version"

package/android/proguard-rules.pro

@@ -19,6 +19,7 @@
 # InitProvider is subclassed by the RN bridge module (NotifeeInitProvider).
 # R8 must not finalize its methods, otherwise the bridge cannot override onCreate().
 -keep class app.notifee.core.InitProvider { *; }
+-keep class app.notifee.core.WarmupHelper { *; }
 -keeppackagenames app.notifee.core.**
 
 # --- Annotations ---

package/android/src/androidTest/java/app/notifee/core/DoScheduledWorkOrderingTest.java

@@ -0,0 +1,234 @@
+package app.notifee.core;
+
+/*
+ * Copyright (c) 2016-present Invertase Limited & Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this library except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * ---
+ *
+ * NOT RUN IN CI.
+ *
+ * Instrumented regression test for caller #5 (NotificationManager.doScheduledWork
+ * delete-then-completer ordering) from pre-fix-549-audit.md. Seeds a single
+ * one-time trigger row, invokes doScheduledWork via a real
+ * CallbackToFutureAdapter.Completer, and asserts both ordering (delete DAO
+ * call returned strictly before completer.set fired) and side-effect
+ * (the row is gone from Room after the test).
+ *
+ * Observation mechanism:
+ *
+ * - TimingWorkDataRepository (in package app.notifee.core.database) subclasses
+ *   WorkDataRepository via the @VisibleForTesting package-private constructor
+ *   and records the nanoTime at which deleteById's future completes.
+ * - The production singleton is swapped to the TimingWorkDataRepository
+ *   instance via reflection before the test runs and restored in @After.
+ * - completerSetNanos is captured via a directExecutor listener on the
+ *   resultFuture returned by CallbackToFutureAdapter.getFuture — this runs
+ *   synchronously on the thread that called completer.set(...).
+ *
+ * Run manually:
+ *     cd apps/smoke/android
+ *     ./gradlew :react-native-notify-kit:connectedDebugAndroidTest \
+ *         --tests app.notifee.core.DoScheduledWorkOrderingTest
+ */
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import android.content.Context;
+import android.os.Bundle;
+import androidx.concurrent.futures.CallbackToFutureAdapter;
+import androidx.core.app.NotificationChannelCompat;
+import androidx.core.app.NotificationManagerCompat;
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+import androidx.test.platform.app.InstrumentationRegistry;
+import androidx.work.Data;
+import androidx.work.ListenableWorker;
+import app.notifee.core.database.TimingWorkDataRepository;
+import app.notifee.core.database.WorkDataEntity;
+import app.notifee.core.database.WorkDataRepository;
+import app.notifee.core.utility.ObjectUtils;
+import com.google.common.util.concurrent.ListenableFuture;
+import com.google.common.util.concurrent.MoreExecutors;
+import java.lang.reflect.Field;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.concurrent.atomic.AtomicReference;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(AndroidJUnit4.class)
+public class DoScheduledWorkOrderingTest {
+
+  private static final String TEST_ID = "do-scheduled-work-ordering-test";
+  private static final String TEST_CHANNEL_ID = "do-scheduled-work-ordering-test-channel";
+
+  private Context context;
+  private WorkDataRepository realRepo;
+  private TimingWorkDataRepository timingRepo;
+  private Field singletonField;
+
+  @Before
+  public void setUp() throws Exception {
+    context = InstrumentationRegistry.getInstrumentation().getTargetContext();
+    ContextHolder.setApplicationContext(context.getApplicationContext());
+
+    // Prime the production singleton and seed the row via the real DB.
+    realRepo = WorkDataRepository.getInstance(context);
+    realRepo.deleteAll().get(5, TimeUnit.SECONDS);
+
+    // Create a channel for the displayNotification call inside doScheduledWork.
+    // Use NotificationManagerCompat directly — Notifee.getInstance() would
+    // require Notifee SDK initialization which is not available in
+    // instrumented tests.
+    NotificationManagerCompat.from(context)
+        .createNotificationChannel(
+            new NotificationChannelCompat.Builder(
+                    TEST_CHANNEL_ID, NotificationManagerCompat.IMPORTANCE_DEFAULT)
+                .setName("DoScheduledWorkOrderingTest")
+                .build());
+
+    // Build the timing-instrumented repo that wraps the SAME DAO as the real
+    // singleton. Because NotifeeCoreDatabase.getDatabase(context) is itself a
+    // singleton, realRepo and timingRepo read/write the same underlying Room
+    // tables — seeding via realRepo is visible to timingRepo and vice versa.
+    // The factory lives in the database package because the constructor and
+    // the NotifeeCoreDatabase accessors are package-private.
+    timingRepo = TimingWorkDataRepository.createForProductionDb(context);
+
+    // Swap the singleton so NotificationManager.doScheduledWork's delete path
+    // (WorkDataRepository.getInstance(ctx).deleteById(...)) goes through the
+    // timing instrumentation.
+    singletonField = WorkDataRepository.class.getDeclaredField("mInstance");
+    singletonField.setAccessible(true);
+    singletonField.set(null, timingRepo);
+  }
+
+  @After
+  public void tearDown() throws Exception {
+    if (singletonField != null) {
+      singletonField.set(null, realRepo);
+    }
+    if (realRepo != null) {
+      realRepo.deleteAll().get(5, TimeUnit.SECONDS);
+    }
+    // Best-effort: dismiss any notification the test displayed.
+    androidx.core.app.NotificationManagerCompat.from(context).cancelAll();
+  }
+
+  @Test
+  public void doScheduledWork_deleteCompletesBeforeCompleterSet() throws Exception {
+    // Seed the row that doScheduledWork will read, display, and then delete.
+    WorkDataEntity seed = buildSeedEntity(TEST_ID);
+    timingRepo.insert(seed).get(5, TimeUnit.SECONDS);
+    assertEquals(1, timingRepo.getAll().get(5, TimeUnit.SECONDS).size());
+
+    // Build a real Completer via CallbackToFutureAdapter so we can wait on the
+    // returned future and record the moment at which completer.set(...) fires.
+    AtomicReference<CallbackToFutureAdapter.Completer<ListenableWorker.Result>> completerRef =
+        new AtomicReference<>();
+    ListenableFuture<ListenableWorker.Result> resultFuture =
+        CallbackToFutureAdapter.getFuture(
+            completer -> {
+              completerRef.set(completer);
+              return "DoScheduledWorkOrderingTest";
+            });
+    CallbackToFutureAdapter.Completer<ListenableWorker.Result> completer = completerRef.get();
+    assertNotNull("Completer must be populated synchronously by getFuture", completer);
+
+    // The listener records completerSetNanos AND counts down the latch, giving
+    // the test a happens-before barrier to await on. resultFuture.get() alone
+    // is insufficient — Guava only guarantees that .get() returns after the
+    // future is marked done, not after all listeners have fired, so the test
+    // could race the listener on a cached-threadpool scheduler.
+    AtomicLong completerSetNanos = new AtomicLong();
+    CountDownLatch completerListenerRan = new CountDownLatch(1);
+    resultFuture.addListener(
+        () -> {
+          completerSetNanos.compareAndSet(0, System.nanoTime());
+          completerListenerRan.countDown();
+        },
+        MoreExecutors.directExecutor());
+
+    // Build the Data payload doScheduledWork expects.
+    Data data =
+        new Data.Builder()
+            .putString("id", TEST_ID)
+            .putString(Worker.KEY_WORK_REQUEST, Worker.WORK_REQUEST_ONE_TIME)
+            .build();
+
+    // Invoke the production entry point. Futures are chained internally; the
+    // resultFuture resolves when completer.set(...) fires.
+    NotificationManager.doScheduledWork(data, completer);
+
+    // Wait for the work to report completion. 15s is generous — the whole chain
+    // (Room read → displayNotification → Room delete → completer.set) usually
+    // takes <200ms on a Pixel 9 Pro XL warm.
+    ListenableWorker.Result result = resultFuture.get(15, TimeUnit.SECONDS);
+    assertEquals(ListenableWorker.Result.success(), result);
+
+    // Explicitly wait for the listener to have fired — see comment at the
+    // listener registration above for why resultFuture.get() alone is racy.
+    assertTrue(
+        "completer.set listener must fire within 5s of resultFuture completing",
+        completerListenerRan.await(5, TimeUnit.SECONDS));
+
+    long deleteNanos = timingRepo.firstDeleteCompletionNanos.get();
+    long completerNanos = completerSetNanos.get();
+
+    assertTrue("delete DAO call must actually have completed", deleteNanos > 0);
+    assertTrue("completer.set must actually have fired", completerNanos > 0);
+    assertTrue(
+        "delete must complete strictly before completer.set — otherwise "
+            + "WorkManager could start a new work instance that reads the stale row "
+            + "(pre-#549 behavior). deleteNanos="
+            + deleteNanos
+            + " completerNanos="
+            + completerNanos
+            + " deltaNanos="
+            + (completerNanos - deleteNanos),
+        deleteNanos < completerNanos);
+
+    // Side-effect assertion: the row must be gone.
+    assertNull(
+        "row must be deleted from Room after doScheduledWork completes",
+        timingRepo.getWorkDataById(TEST_ID).get(5, TimeUnit.SECONDS));
+    assertTrue(
+        "Room must contain no entries after doScheduledWork completes",
+        timingRepo.getAll().get(5, TimeUnit.SECONDS).isEmpty());
+  }
+
+  private static WorkDataEntity buildSeedEntity(String id) {
+    Bundle notificationBundle = new Bundle();
+    notificationBundle.putString("id", id);
+    notificationBundle.putString("title", "DoScheduledWorkOrderingTest");
+    Bundle androidBundle = new Bundle();
+    androidBundle.putString("channelId", TEST_CHANNEL_ID);
+    // A smallIcon is required by Android's NotificationManager.fixNotification —
+    // a notification without one throws IllegalArgumentException. The
+    // androidTest res/drawable/test_icon.xml is a transparent placeholder that
+    // exists only in the test APK.
+    androidBundle.putString("smallIcon", "test_icon");
+    notificationBundle.putBundle("android", androidBundle);
+
+    Bundle triggerBundle = new Bundle();
+    triggerBundle.putInt("type", 0); // TIMESTAMP
+    triggerBundle.putLong("timestamp", System.currentTimeMillis());
+
+    return new WorkDataEntity(
+        id,
+        ObjectUtils.bundleToBytes(notificationBundle),
+        ObjectUtils.bundleToBytes(triggerBundle),
+        false /* withAlarmManager — WorkManager path */);
+  }
+}

package/android/src/androidTest/java/app/notifee/core/RebootRecoveryTest.java

@@ -0,0 +1,204 @@
+package app.notifee.core;
+
+/*
+ * Copyright (c) 2016-present Invertase Limited & Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this library except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * ---
+ *
+ * NOT RUN IN CI.
+ *
+ * Instrumented regression test for caller #8 (reboot recovery anchor
+ * persistence) from pre-fix-549-audit.md. Seeds five recurring trigger rows
+ * with timestamps in the past, invokes NotifeeAlarmManager.rescheduleNotifications
+ * via its public entry point, and asserts that every row has an advanced
+ * timestamp once the reschedule completes — proving that the per-entity
+ * WorkDataRepository.update(...) futures are awaited before the
+ * BroadcastReceiver finish path, which is the #549 fix commit
+ * 71fa20e ("fix(android): persist reboot recovery anchor updates before
+ * finishing receiver").
+ *
+ * Run manually:
+ *     cd apps/smoke/android
+ *     ./gradlew :react-native-notify-kit:connectedDebugAndroidTest \
+ *         --tests app.notifee.core.RebootRecoveryTest
+ */
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+import android.content.Context;
+import android.os.Bundle;
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+import androidx.test.platform.app.InstrumentationRegistry;
+import app.notifee.core.database.WorkDataEntity;
+import app.notifee.core.database.WorkDataRepository;
+import app.notifee.core.utility.ObjectUtils;
+import java.util.List;
+import java.util.concurrent.TimeUnit;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+/**
+ * ⚠️ WARNING — DESTRUCTIVE INSTRUMENTED TEST ⚠️
+ *
+ * <p>This test calls {@code WorkDataRepository.getInstance(context)}, which returns the production
+ * singleton backed by the on-disk {@code notifee_core_database}. The {@code @Before} and
+ * {@code @After} hooks call {@code deleteAll()} on that database.
+ *
+ * <p>If you run this test on a device that has REAL scheduled notifee notifications (your personal
+ * phone, a shared QA device, a customer's device), THOSE NOTIFICATIONS WILL BE SILENTLY DELETED.
+ * There is no undo.
+ *
+ * <p>Run this test only on:
+ *
+ * <ul>
+ *   <li>Throwaway emulators
+ *   <li>Dedicated test devices
+ *   <li>Devices where you have explicitly verified that no production notifee state exists
+ * </ul>
+ *
+ * <p>A structural fix (migrate to an in-memory Room database for tests) is the correct long-term
+ * solution but is out of scope for the #549 fix PR.
+ */
+@RunWith(AndroidJUnit4.class)
+public class RebootRecoveryTest {
+
+  private static final int SEED_COUNT = 5;
+  private static final long HOUR_IN_MS = 60L * 60 * 1000;
+
+  /** 5 hours before "now" — well in the past so setNextTimestamp must advance. */
+  private static final long OLD_ANCHOR_OFFSET_MS = 5 * HOUR_IN_MS;
+
+  private static final long POLL_DEADLINE_MS = 15_000;
+  private static final long POLL_INTERVAL_MS = 100;
+
+  private Context context;
+  private WorkDataRepository repo;
+
+  @Before
+  public void setUp() throws Exception {
+    context = InstrumentationRegistry.getInstrumentation().getTargetContext();
+    // Ensure ContextHolder is populated — production code paths inside
+    // NotifeeAlarmManager call ContextHolder.getApplicationContext() and
+    // WorkDataRepository.getInstance(getApplicationContext()).
+    ContextHolder.setApplicationContext(context.getApplicationContext());
+    repo = WorkDataRepository.getInstance(context);
+    repo.deleteAll().get(5, TimeUnit.SECONDS);
+  }
+
+  @After
+  public void tearDown() throws Exception {
+    // Cancel every real alarm the test scheduled so the device is left clean.
+    for (int i = 0; i < SEED_COUNT; i++) {
+      NotifeeAlarmManager.cancelNotification(testId(i));
+    }
+    repo.deleteAll().get(5, TimeUnit.SECONDS);
+  }
+
+  @Test
+  public void rescheduleNotifications_advancesEveryAnchorBeforeCompleting() throws Exception {
+    long now = System.currentTimeMillis();
+    long oldAnchor = now - OLD_ANCHOR_OFFSET_MS;
+    long minExpectedAnchor = now; // every anchor must move strictly into the future
+
+    // Seed SEED_COUNT entities, each a recurring hourly alarm with the old anchor.
+    for (int i = 0; i < SEED_COUNT; i++) {
+      repo.insert(buildEntity(testId(i), oldAnchor)).get(5, TimeUnit.SECONDS);
+    }
+    assertEquals(SEED_COUNT, repo.getAll().get(5, TimeUnit.SECONDS).size());
+
+    // Invoke the real reboot-recovery entry point. PendingResult is null because
+    // this test is not driven by a BroadcastReceiver goAsync() scope; the fix
+    // guards every finish() call with a null-check, so passing null exercises
+    // the same future chain without actually broadcasting anything.
+    new NotifeeAlarmManager().rescheduleNotifications(null);
+
+    // Poll for completion. The reschedule fires several async stages
+    // (getScheduledNotifications → per-entity update → allAsList → withTimeout),
+    // so we cannot directly latch on "done". Instead we observe the side
+    // effect: every row's timestamp must have been moved into the future.
+    List<WorkDataEntity> rows = awaitAllAnchorsAdvanced(minExpectedAnchor);
+
+    assertEquals("no rows lost during reboot recovery", SEED_COUNT, rows.size());
+    for (WorkDataEntity row : rows) {
+      Bundle triggerBundle = ObjectUtils.bytesToBundle(row.getTrigger());
+      long newAnchor = ObjectUtils.getLong(triggerBundle.get("timestamp"));
+      assertTrue(
+          "row "
+              + row.getId()
+              + " must have an advanced anchor: was="
+              + oldAnchor
+              + " now="
+              + newAnchor,
+          newAnchor >= oldAnchor + HOUR_IN_MS);
+      assertTrue(
+          "row " + row.getId() + " anchor must be in the future: " + newAnchor,
+          newAnchor >= minExpectedAnchor);
+    }
+  }
+
+  /**
+   * Polls {@link WorkDataRepository#getAll()} until every row has a timestamp at or after {@code
+   * minExpectedAnchor}, or fails on timeout.
+   */
+  private List<WorkDataEntity> awaitAllAnchorsAdvanced(long minExpectedAnchor) throws Exception {
+    long deadline = System.currentTimeMillis() + POLL_DEADLINE_MS;
+    while (System.currentTimeMillis() < deadline) {
+      List<WorkDataEntity> rows = repo.getAll().get(5, TimeUnit.SECONDS);
+      if (rows.size() == SEED_COUNT && allAdvanced(rows, minExpectedAnchor)) {
+        return rows;
+      }
+      Thread.sleep(POLL_INTERVAL_MS);
+    }
+    fail(
+        "reboot recovery did not advance every anchor within "
+            + POLL_DEADLINE_MS
+            + "ms — the fix in commit 71fa20e may be broken");
+    return null; // unreachable
+  }
+
+  private static boolean allAdvanced(List<WorkDataEntity> rows, long minExpectedAnchor) {
+    for (WorkDataEntity row : rows) {
+      Bundle trigger = ObjectUtils.bytesToBundle(row.getTrigger());
+      long ts = ObjectUtils.getLong(trigger.get("timestamp"));
+      if (ts < minExpectedAnchor) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  /** Build a recurring-hourly trigger entity with the given id and initial anchor. */
+  private static WorkDataEntity buildEntity(String id, long anchorMs) {
+    Bundle notificationBundle = new Bundle();
+    notificationBundle.putString("id", id);
+    notificationBundle.putString("title", "RebootRecoveryTest " + id);
+
+    Bundle triggerBundle = new Bundle();
+    triggerBundle.putInt("type", 0); // TIMESTAMP
+    triggerBundle.putLong("timestamp", anchorMs);
+    triggerBundle.putInt("repeatFrequency", 0); // HOURLY
+    Bundle alarmManagerBundle = new Bundle();
+    alarmManagerBundle.putInt("type", 3); // SET_EXACT_AND_ALLOW_WHILE_IDLE
+    triggerBundle.putBundle("alarmManager", alarmManagerBundle);
+
+    return new WorkDataEntity(
+        id,
+        ObjectUtils.bundleToBytes(notificationBundle),
+        ObjectUtils.bundleToBytes(triggerBundle),
+        true /* withAlarmManager */);
+  }
+
+  private static String testId(int i) {
+    return "reboot-recovery-test-" + i;
+  }
+}

package/android/src/androidTest/java/app/notifee/core/database/TimingWorkDataRepository.java

@@ -0,0 +1,56 @@
+package app.notifee.core.database;
+
+/*
+ * Copyright (c) 2016-present Invertase Limited & Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this library except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * ---
+ *
+ * Test-only WorkDataRepository subclass that captures the wall-clock nanoTime
+ * at which deleteById(id)'s underlying DAO call completes. Lives in the
+ * database package so it can call the @VisibleForTesting package-private
+ * WorkDataRepository(WorkDataDao, ListeningExecutorService) constructor.
+ * Consumers (e.g. DoScheduledWorkOrderingTest) instantiate via the public
+ * constructor below and inject this instance into the production singleton
+ * via reflection.
+ */
+
+import android.content.Context;
+import com.google.common.util.concurrent.ListenableFuture;
+import com.google.common.util.concurrent.ListeningExecutorService;
+import com.google.common.util.concurrent.MoreExecutors;
+import java.util.concurrent.atomic.AtomicLong;
+
+public class TimingWorkDataRepository extends WorkDataRepository {
+
+  /** nanoTime when the FIRST deleteById future completed. 0 if never called. */
+  public final AtomicLong firstDeleteCompletionNanos = new AtomicLong();
+
+  public TimingWorkDataRepository(WorkDataDao dao, ListeningExecutorService executor) {
+    super(dao, executor);
+  }
+
+  /**
+   * Factory that wraps the production {@link NotifeeCoreDatabase} DAO and executor, so that reads
+   * and writes share the same underlying Room tables as the production singleton.
+   */
+  public static TimingWorkDataRepository createForProductionDb(Context context) {
+    return new TimingWorkDataRepository(
+        NotifeeCoreDatabase.getDatabase(context).workDao(),
+        NotifeeCoreDatabase.databaseWriteListeningExecutor);
+  }
+
+  @Override
+  public ListenableFuture<Void> deleteById(String id) {
+    ListenableFuture<Void> f = super.deleteById(id);
+    f.addListener(
+        () -> firstDeleteCompletionNanos.compareAndSet(0, System.nanoTime()),
+        MoreExecutors.directExecutor());
+    return f;
+  }
+}