react-native-notify-kit 9.5.0 → 9.6.0

package/android/src/androidTest/java/app/notifee/core/RebootRecoveryTest.java

@@ -13,28 +13,72 @@ package app.notifee.core;
  *
  * NOT RUN IN CI.
  *
- * Instrumented regression test for caller #8 (reboot recovery anchor
- * persistence) from pre-fix-549-audit.md. Seeds five recurring trigger rows
- * with timestamps in the past, invokes NotifeeAlarmManager.rescheduleNotifications
- * via its public entry point, and asserts that every row has an advanced
- * timestamp once the reschedule completes — proving that the per-entity
- * WorkDataRepository.update(...) futures are awaited before the
- * BroadcastReceiver finish path, which is the #549 fix commit
- * 71fa20e ("fix(android): persist reboot recovery anchor updates before
- * finishing receiver").
- *
- * Run manually:
+ * Instrumented regression suite for the reboot-recovery path in
+ * NotifeeAlarmManager.rescheduleNotifications, covering three upstream
+ * issues across five test cases:
+ *
+ *   1. rescheduleNotifications_advancesEveryAnchorBeforeCompleting
+ *      (upstream invertase/notifee#549 — reboot-recovery anchor persistence
+ *      from caller #8 of pre-fix-549-audit.md). Seeds five HOURLY recurring
+ *      rows with past anchors and asserts every row has an advanced
+ *      timestamp once the reschedule completes, proving per-entity
+ *      WorkDataRepository update futures are awaited before the
+ *      BroadcastReceiver finish path. Regression guard for commit 71fa20e.
+ *
+ *   2. rescheduleNotifications_dailyTriggers_advancesStaleAnchorsToFuture
+ *      (upstream invertase/notifee#839 — DAILY trigger fails to re-fire
+ *      from day 2 onwards on Android). Seeds stale DAILY anchors, asserts
+ *      they are advanced to the future AND that an AlarmManager
+ *      PendingIntent is registered for each row (proving
+ *      scheduleTimestampTriggerNotification → setNextTimestamp →
+ *      alarmManager.set* ran in order).
+ *
+ *   3. rescheduleNotifications_staleNonRepeating_withinGracePeriod_rowIsDeleted
+ *      (upstream invertase/notifee#734 — zombie stale triggers on OEM
+ *      reboot-suppressed devices, within 24h grace period). Seeds a stale
+ *      non-repeating row 1h in the past; asserts the row is deleted after
+ *      the reschedule pass, proving the fire-once-then-delete primary
+ *      branch of handleStaleNonRepeatingTrigger ran.
+ *
+ *   4. rescheduleNotifications_staleNonRepeating_beyondGracePeriod_rowIsDeleted
+ *      (upstream invertase/notifee#734, beyond 24h grace period). Seeds a
+ *      stale non-repeating row 48h in the past; asserts the row is deleted
+ *      without firing a notification (delete-silent branch).
+ *
+ *   5. rescheduleNotifications_staleNonRepeating_displayFails_rowStillDeleted
+ *      (upstream invertase/notifee#734 resilience path, discovered via the
+ *      Step 6 smoke dry-run). Seeds a deliberately malformed non-repeating
+ *      row (no `android` sub-bundle) so NotificationManager.displayNotification
+ *      throws NullPointerException inside NotificationAndroidModel.getChannelId.
+ *      Asserts the row is STILL deleted because Futures.catchingAsync in
+ *      handleStaleNonRepeatingTrigger routes the failure through the
+ *      resilient branch that still runs deleteById.
+ *
+ * Run manually via the smoke harness (recommended — wraps gradle + copies
+ * reports + fails loud if no XML reports are found):
+ *
+ *     scripts/verify-step7-fixes.sh
+ *
+ * Or directly with Gradle. Note that `--tests` is NOT a valid command-line
+ * option on the AGP DeviceProviderInstrumentTestTask — use the
+ * instrumentation runner argument property instead:
+ *
  *     cd apps/smoke/android
  *     ./gradlew :react-native-notify-kit:connectedDebugAndroidTest \
- *         --tests app.notifee.core.RebootRecoveryTest
+ *         -Pandroid.testInstrumentationRunnerArguments.class=app.notifee.core.RebootRecoveryTest
  */
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 
+import android.app.PendingIntent;
 import android.content.Context;
+import android.content.Intent;
 import android.os.Bundle;
+import androidx.core.app.NotificationChannelCompat;
+import androidx.core.app.NotificationManagerCompat;
 import androidx.test.ext.junit.runners.AndroidJUnit4;
 import androidx.test.platform.app.InstrumentationRegistry;
 import app.notifee.core.database.WorkDataEntity;
@@ -73,11 +117,32 @@ import org.junit.runner.RunWith;
 public class RebootRecoveryTest {
 
   private static final int SEED_COUNT = 5;
+  private static final int DAILY_SEED_COUNT = 2;
   private static final long HOUR_IN_MS = 60L * 60 * 1000;
+  private static final long DAY_IN_MS = 24 * HOUR_IN_MS;
 
   /** 5 hours before "now" — well in the past so setNextTimestamp must advance. */
   private static final long OLD_ANCHOR_OFFSET_MS = 5 * HOUR_IN_MS;
 
+  /** 2 days before "now" — stale DAILY anchor that must be advanced by reboot recovery. */
+  private static final long OLD_DAILY_ANCHOR_OFFSET_MS = 2 * DAY_IN_MS;
+
+  /** 1 hour before "now" — well inside the 24h grace period for stale non-repeating triggers. */
+  private static final long STALE_WITHIN_GRACE_OFFSET_MS = HOUR_IN_MS;
+
+  /** 48 hours before "now" — well beyond the 24h grace period. */
+  private static final long STALE_BEYOND_GRACE_OFFSET_MS = 48 * HOUR_IN_MS;
+
+  /**
+   * Channel id used by the within-grace stale-trigger test fixture. Must match a real Android
+   * notification channel created in {@link #setUp()} so {@code
+   * NotificationManager.displayNotification} can build a valid notification from the seeded Room
+   * row. Without a matching channel on Android 8+, the display path falls into the resilient
+   * catching branch (which is the subject of its own dedicated test), not the primary
+   * fire-once-then-delete path.
+   */
+  private static final String STALE_TEST_CHANNEL_ID = "reboot-recovery-stale-test-channel";
+
   private static final long POLL_DEADLINE_MS = 15_000;
   private static final long POLL_INTERVAL_MS = 100;
 
@@ -93,6 +158,15 @@ public class RebootRecoveryTest {
     ContextHolder.setApplicationContext(context.getApplicationContext());
     repo = WorkDataRepository.getInstance(context);
     repo.deleteAll().get(5, TimeUnit.SECONDS);
+
+    // Register a real notification channel the stale-trigger within-grace test can target.
+    // createNotificationChannel is idempotent — repeat calls across tests are a no-op.
+    NotificationChannelCompat channel =
+        new NotificationChannelCompat.Builder(
+                STALE_TEST_CHANNEL_ID, NotificationManagerCompat.IMPORTANCE_DEFAULT)
+            .setName("Reboot Recovery Test Channel")
+            .build();
+    NotificationManagerCompat.from(context).createNotificationChannel(channel);
   }
 
   @After
@@ -101,6 +175,17 @@ public class RebootRecoveryTest {
     for (int i = 0; i < SEED_COUNT; i++) {
       NotifeeAlarmManager.cancelNotification(testId(i));
     }
+    for (int i = 0; i < DAILY_SEED_COUNT; i++) {
+      NotifeeAlarmManager.cancelNotification(dailyTestId(i));
+    }
+    NotifeeAlarmManager.cancelNotification(staleWithinGraceTestId());
+    NotifeeAlarmManager.cancelNotification(staleBeyondGraceTestId());
+    NotifeeAlarmManager.cancelNotification(staleDisplayFailsTestId());
+    // Dismiss any notifications the within-grace tests may have posted so the device
+    // notification shade is left clean — the Room row is the test's contract, but the
+    // visible notification is a side effect we should not leave behind.
+    NotificationManagerCompat.from(context).cancel(staleWithinGraceTestId().hashCode());
+    NotificationManagerCompat.from(context).cancel(staleDisplayFailsTestId().hashCode());
     repo.deleteAll().get(5, TimeUnit.SECONDS);
   }
 
@@ -146,15 +231,194 @@ public class RebootRecoveryTest {
     }
   }
 
+  /**
+   * Regression test for upstream invertase/notifee#839 — DAILY trigger fails to re-fire from day 2
+   * onwards on Android. Seeds {@value DAILY_SEED_COUNT} stale DAILY anchors, invokes reboot
+   * recovery, and asserts that every row's timestamp has been advanced into the future AND that an
+   * AlarmManager PendingIntent has been registered for each row (proving the fix path
+   * scheduleTimestampTriggerNotification → setNextTimestamp → alarmManager.set* ran in order).
+   */
+  @Test
+  public void rescheduleNotifications_dailyTriggers_advancesStaleAnchorsToFuture()
+      throws Exception {
+    long now = System.currentTimeMillis();
+    long oldAnchor = now - OLD_DAILY_ANCHOR_OFFSET_MS;
+    long minExpectedAnchor = now;
+
+    for (int i = 0; i < DAILY_SEED_COUNT; i++) {
+      repo.insert(buildDailyEntity(dailyTestId(i), oldAnchor)).get(5, TimeUnit.SECONDS);
+    }
+    assertEquals(DAILY_SEED_COUNT, repo.getAll().get(5, TimeUnit.SECONDS).size());
+
+    new NotifeeAlarmManager().rescheduleNotifications(null);
+
+    List<WorkDataEntity> rows =
+        awaitAllAnchorsAdvancedWithExpectedCount(minExpectedAnchor, DAILY_SEED_COUNT);
+
+    assertEquals("no DAILY rows lost during reboot recovery", DAILY_SEED_COUNT, rows.size());
+    for (WorkDataEntity row : rows) {
+      Bundle triggerBundle = ObjectUtils.bytesToBundle(row.getTrigger());
+      long newAnchor = ObjectUtils.getLong(triggerBundle.get("timestamp"));
+      assertTrue(
+          "DAILY row "
+              + row.getId()
+              + " must be advanced to the future: was="
+              + oldAnchor
+              + " now="
+              + newAnchor,
+          newAnchor >= minExpectedAnchor);
+      assertTrue(
+          "DAILY row " + row.getId() + " must not be advanced more than 25h ahead: " + newAnchor,
+          newAnchor < now + 25L * HOUR_IN_MS);
+    }
+
+    // Every DAILY row must have a live AlarmManager PendingIntent registered. FLAG_NO_CREATE
+    // returns null if no matching PendingIntent exists — which would mean
+    // scheduleTimestampTriggerNotification never ran or setNextTimestamp did not reach the
+    // alarmManager.set* call.
+    for (int i = 0; i < DAILY_SEED_COUNT; i++) {
+      Intent intent = new Intent(context, NotificationAlarmReceiver.class);
+      intent.putExtra("notificationId", dailyTestId(i));
+      PendingIntent pi =
+          PendingIntent.getBroadcast(
+              context,
+              dailyTestId(i).hashCode(),
+              intent,
+              PendingIntent.FLAG_NO_CREATE | PendingIntent.FLAG_MUTABLE);
+      assertNotNull(
+          "AlarmManager PendingIntent must be registered for DAILY row " + dailyTestId(i), pi);
+    }
+  }
+
+  /**
+   * Regression test for upstream invertase/notifee#734 within the 24h grace period. Seeds a stale
+   * non-repeating TIMESTAMP trigger whose fire time is 1h in the past, invokes reboot recovery, and
+   * asserts that the Room row is deleted (proving the fire-once-then-delete path ran). The
+   * late-fire itself is a side effect observable only via NotificationManagerCompat; this test
+   * asserts the Room-state contract, which is the guarantee most relevant to preventing zombie
+   * re-fire loops on every subsequent reboot.
+   */
+  @Test
+  public void rescheduleNotifications_staleNonRepeating_withinGracePeriod_rowIsDeleted()
+      throws Exception {
+    long now = System.currentTimeMillis();
+    long staleAnchor = now - STALE_WITHIN_GRACE_OFFSET_MS;
+    String id = staleWithinGraceTestId();
+
+    repo.insert(buildNonRepeatingEntity(id, staleAnchor)).get(5, TimeUnit.SECONDS);
+    assertEquals(1, repo.getAll().get(5, TimeUnit.SECONDS).size());
+
+    new NotifeeAlarmManager().rescheduleNotifications(null);
+
+    // Poll until the row is gone. The reschedule path fires a transformAsync:
+    //   NotificationManager.displayNotification(...) → WorkDataRepository.deleteById(id)
+    // so we observe the deletion as the terminal side effect.
+    awaitRowDeleted(id);
+    assertTrue(
+        "stale non-repeating row must be removed from Room after reboot recovery",
+        repo.getWorkDataById(id).get(5, TimeUnit.SECONDS) == null);
+  }
+
+  /**
+   * Regression test for upstream invertase/notifee#734 resilience path (discovered via the Step 6
+   * smoke dry-run). Seeds a deliberately malformed non-repeating trigger — missing the {@code
+   * android} sub-bundle entirely, which causes {@code NotificationAndroidModel.getChannelId} to
+   * throw {@link NullPointerException} when {@code NotificationManager.displayNotification} tries
+   * to build a notification from it. The resilience guarantee is that {@code
+   * handleStaleNonRepeatingTrigger} must STILL delete the Room row even when the late-fire fails,
+   * otherwise the zombie re-fire loop (which Bundle A of #734 is supposed to break) simply moves
+   * from "row with valid bundle" to "row with corrupt bundle" and keeps re-appearing on every
+   * reboot.
+   *
+   * <p>In production this scenario is reachable when a consumer upgrades from an older library
+   * version whose serialized Room state has a different shape than the current model expects, when
+   * a notification channel has been deleted between scheduling and recovery, when a
+   * SecurityException is thrown deep inside the display chain on a restrictive OEM device, or for
+   * any other reason a previously-validated notification payload can no longer be displayed.
+   */
+  @Test
+  public void rescheduleNotifications_staleNonRepeating_displayFails_rowStillDeleted()
+      throws Exception {
+    long now = System.currentTimeMillis();
+    long staleAnchor = now - STALE_WITHIN_GRACE_OFFSET_MS;
+    String id = staleDisplayFailsTestId();
+
+    repo.insert(buildMalformedNonRepeatingEntity(id, staleAnchor)).get(5, TimeUnit.SECONDS);
+    assertEquals(1, repo.getAll().get(5, TimeUnit.SECONDS).size());
+
+    new NotifeeAlarmManager().rescheduleNotifications(null);
+
+    // The resilient chain is:
+    //   displayNotification
+    //     → CATCHING Exception (narrowed in Step 7 to let Error propagate)
+    //     → Futures.immediateFuture(null)
+    //     → deleteById
+    // So even though the first step explodes on NullPointerException, the deleteById continuation
+    // still runs. We observe the same terminal state as the happy path: the Room row is gone.
+    awaitRowDeleted(id);
+    assertTrue(
+        "malformed stale row must still be deleted after late-fire failure — the #734 resilience"
+            + " path in handleStaleNonRepeatingTrigger may be broken",
+        repo.getWorkDataById(id).get(5, TimeUnit.SECONDS) == null);
+  }
+
+  /**
+   * Regression test for upstream invertase/notifee#734 beyond the 24h grace period. Seeds a stale
+   * non-repeating TIMESTAMP trigger whose fire time is 48h in the past, invokes reboot recovery,
+   * and asserts that the Room row is deleted WITHOUT the notification being fired (delete-silent
+   * path). This path avoids showing stale content to users whose devices were off or whose app was
+   * killed long enough that the original notification is no longer relevant.
+   */
+  @Test
+  public void rescheduleNotifications_staleNonRepeating_beyondGracePeriod_rowIsDeleted()
+      throws Exception {
+    long now = System.currentTimeMillis();
+    long staleAnchor = now - STALE_BEYOND_GRACE_OFFSET_MS;
+    String id = staleBeyondGraceTestId();
+
+    repo.insert(buildNonRepeatingEntity(id, staleAnchor)).get(5, TimeUnit.SECONDS);
+    assertEquals(1, repo.getAll().get(5, TimeUnit.SECONDS).size());
+
+    new NotifeeAlarmManager().rescheduleNotifications(null);
+
+    awaitRowDeleted(id);
+    assertTrue(
+        "stale non-repeating row must be removed from Room after reboot recovery",
+        repo.getWorkDataById(id).get(5, TimeUnit.SECONDS) == null);
+  }
+
+  /** Polls {@link WorkDataRepository#getWorkDataById(String)} until it returns {@code null}. */
+  private void awaitRowDeleted(String id) throws Exception {
+    long deadline = System.currentTimeMillis() + POLL_DEADLINE_MS;
+    while (System.currentTimeMillis() < deadline) {
+      WorkDataEntity row = repo.getWorkDataById(id).get(5, TimeUnit.SECONDS);
+      if (row == null) {
+        return;
+      }
+      Thread.sleep(POLL_INTERVAL_MS);
+    }
+    fail(
+        "stale non-repeating row "
+            + id
+            + " was not deleted within "
+            + POLL_DEADLINE_MS
+            + "ms — the #734 fix in rescheduleNotification may be broken");
+  }
+
   /**
    * Polls {@link WorkDataRepository#getAll()} until every row has a timestamp at or after {@code
    * minExpectedAnchor}, or fails on timeout.
    */
   private List<WorkDataEntity> awaitAllAnchorsAdvanced(long minExpectedAnchor) throws Exception {
+    return awaitAllAnchorsAdvancedWithExpectedCount(minExpectedAnchor, SEED_COUNT);
+  }
+
+  private List<WorkDataEntity> awaitAllAnchorsAdvancedWithExpectedCount(
+      long minExpectedAnchor, int expectedCount) throws Exception {
     long deadline = System.currentTimeMillis() + POLL_DEADLINE_MS;
     while (System.currentTimeMillis() < deadline) {
       List<WorkDataEntity> rows = repo.getAll().get(5, TimeUnit.SECONDS);
-      if (rows.size() == SEED_COUNT && allAdvanced(rows, minExpectedAnchor)) {
+      if (rows.size() == expectedCount && allAdvanced(rows, minExpectedAnchor)) {
         return rows;
       }
       Thread.sleep(POLL_INTERVAL_MS);
@@ -201,4 +465,105 @@ public class RebootRecoveryTest {
   private static String testId(int i) {
     return "reboot-recovery-test-" + i;
   }
+
+  /** Build a recurring-daily trigger entity with the given id and initial anchor. */
+  private static WorkDataEntity buildDailyEntity(String id, long anchorMs) {
+    Bundle notificationBundle = new Bundle();
+    notificationBundle.putString("id", id);
+    notificationBundle.putString("title", "RebootRecoveryTest daily " + id);
+
+    Bundle triggerBundle = new Bundle();
+    triggerBundle.putInt("type", 0); // TIMESTAMP
+    triggerBundle.putLong("timestamp", anchorMs);
+    triggerBundle.putInt("repeatFrequency", 1); // DAILY
+    Bundle alarmManagerBundle = new Bundle();
+    alarmManagerBundle.putInt("type", 3); // SET_EXACT_AND_ALLOW_WHILE_IDLE
+    triggerBundle.putBundle("alarmManager", alarmManagerBundle);
+
+    return new WorkDataEntity(
+        id,
+        ObjectUtils.bundleToBytes(notificationBundle),
+        ObjectUtils.bundleToBytes(triggerBundle),
+        true /* withAlarmManager */);
+  }
+
+  private static String dailyTestId(int i) {
+    return "reboot-recovery-daily-test-" + i;
+  }
+
+  /**
+   * Build a one-shot (non-repeating) TIMESTAMP trigger entity with a well-formed {@code android}
+   * sub-bundle pointing at {@link #STALE_TEST_CHANNEL_ID}. Used by the within-grace and
+   * beyond-grace tests that exercise the primary decision-tree branches of {@code
+   * handleStaleNonRepeatingTrigger}.
+   */
+  private static WorkDataEntity buildNonRepeatingEntity(String id, long anchorMs) {
+    Bundle notificationBundle = new Bundle();
+    notificationBundle.putString("id", id);
+    notificationBundle.putString("title", "RebootRecoveryTest stale " + id);
+
+    // Without this, NotificationAndroidModel.getChannelId NPEs inside the display path
+    // (mNotificationAndroidBundle is null). Production notifications never reach this
+    // code path without a channelId because the TypeScript validators require it, but
+    // test fixtures that bypass the JS layer must synthesize the shape manually.
+    Bundle androidBundle = new Bundle();
+    androidBundle.putString("channelId", STALE_TEST_CHANNEL_ID);
+    notificationBundle.putBundle("android", androidBundle);
+
+    Bundle triggerBundle = new Bundle();
+    triggerBundle.putInt("type", 0); // TIMESTAMP
+    triggerBundle.putLong("timestamp", anchorMs);
+    triggerBundle.putInt("repeatFrequency", -1); // non-repeating
+    Bundle alarmManagerBundle = new Bundle();
+    alarmManagerBundle.putInt("type", 3); // SET_EXACT_AND_ALLOW_WHILE_IDLE
+    triggerBundle.putBundle("alarmManager", alarmManagerBundle);
+
+    return new WorkDataEntity(
+        id,
+        ObjectUtils.bundleToBytes(notificationBundle),
+        ObjectUtils.bundleToBytes(triggerBundle),
+        true /* withAlarmManager */);
+  }
+
+  /**
+   * Build a deliberately malformed non-repeating TIMESTAMP trigger entity that will cause {@code
+   * NotificationManager.displayNotification} to throw {@link NullPointerException} inside {@code
+   * NotificationAndroidModel.getChannelId}. Used by {@link
+   * #rescheduleNotifications_staleNonRepeating_displayFails_rowStillDeleted} to prove the {@code
+   * Futures.catchingAsync} resilience branch in {@code handleStaleNonRepeatingTrigger} deletes the
+   * Room row even when the late-fire fails. The malformation — omitting the {@code android}
+   * sub-bundle — matches the shape a corrupted-upgrade Room row could take in production.
+   */
+  private static WorkDataEntity buildMalformedNonRepeatingEntity(String id, long anchorMs) {
+    Bundle notificationBundle = new Bundle();
+    notificationBundle.putString("id", id);
+    notificationBundle.putString("title", "RebootRecoveryTest malformed " + id);
+    // INTENTIONALLY NO android sub-bundle — this is the failure shape.
+
+    Bundle triggerBundle = new Bundle();
+    triggerBundle.putInt("type", 0); // TIMESTAMP
+    triggerBundle.putLong("timestamp", anchorMs);
+    triggerBundle.putInt("repeatFrequency", -1); // non-repeating
+    Bundle alarmManagerBundle = new Bundle();
+    alarmManagerBundle.putInt("type", 3); // SET_EXACT_AND_ALLOW_WHILE_IDLE
+    triggerBundle.putBundle("alarmManager", alarmManagerBundle);
+
+    return new WorkDataEntity(
+        id,
+        ObjectUtils.bundleToBytes(notificationBundle),
+        ObjectUtils.bundleToBytes(triggerBundle),
+        true /* withAlarmManager */);
+  }
+
+  private static String staleWithinGraceTestId() {
+    return "reboot-recovery-stale-within-grace-test";
+  }
+
+  private static String staleBeyondGraceTestId() {
+    return "reboot-recovery-stale-beyond-grace-test";
+  }
+
+  private static String staleDisplayFailsTestId() {
+    return "reboot-recovery-stale-display-fails-test";
+  }
 }

package/android/src/main/java/app/notifee/core/AlarmPermissionBroadcastReceiver.java

@@ -5,21 +5,32 @@ import static android.app.AlarmManager.ACTION_SCHEDULE_EXACT_ALARM_PERMISSION_ST
 import android.content.BroadcastReceiver;
 import android.content.Context;
 import android.content.Intent;
-import android.util.Log;
 
 public class AlarmPermissionBroadcastReceiver extends BroadcastReceiver {
+  private static final String TAG = "AlarmPermissionReceiver";
+
   @Override
   public void onReceive(Context context, Intent intent) {
+    if (!ACTION_SCHEDULE_EXACT_ALARM_PERMISSION_STATE_CHANGED.equals(intent.getAction())) {
+      return;
+    }
 
-    if (intent.getAction().equals(ACTION_SCHEDULE_EXACT_ALARM_PERMISSION_STATE_CHANGED)) {
-      PendingResult pendingResult = goAsync();
-      Log.i("AlarmPermissionReceiver", "Received alarm permission state changed event");
-
+    PendingResult pendingResult = goAsync();
+    // See RebootBroadcastReceiver for the rationale behind this guard.
+    boolean asyncHandoffSucceeded = false;
+    try {
+      Logger.i(TAG, "Received alarm permission state changed event");
       if (ContextHolder.getApplicationContext() == null) {
         ContextHolder.setApplicationContext(context.getApplicationContext());
       }
-
       new NotifeeAlarmManager().rescheduleNotifications(pendingResult);
+      asyncHandoffSucceeded = true;
+    } catch (Throwable t) {
+      Logger.e(TAG, "Failed to reschedule notifications after permission change", t);
+    } finally {
+      if (!asyncHandoffSucceeded && pendingResult != null) {
+        pendingResult.finish();
+      }
     }
   }
 }

package/android/src/main/java/app/notifee/core/InitProvider.java

@@ -26,9 +26,11 @@ import android.content.pm.ProviderInfo;
 import android.database.Cursor;
 import android.net.Uri;
 import android.os.Trace;
+import android.provider.Settings;
 import androidx.annotation.CallSuper;
 import androidx.annotation.NonNull;
 import androidx.annotation.Nullable;
+import androidx.annotation.VisibleForTesting;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 
@@ -64,8 +66,15 @@ public class InitProvider extends ContentProvider {
       }
 
       Context appContext = ContextHolder.getApplicationContext();
-      if (appContext != null && isWarmupEnabled(appContext)) {
-        dispatchWarmup(appContext);
+      if (appContext != null) {
+        if (isWarmupEnabled(appContext)) {
+          dispatchWarmup(appContext);
+        }
+        // Fix for upstream invertase/notifee#734: recover scheduled alarms on every app init
+        // when a reboot has occurred since the last run. Runs unconditionally (not gated by
+        // the warmup metadata flag) because this is recovery, not optimisation. Always on a
+        // background thread to keep app startup clean.
+        dispatchBootCheck(appContext);
       }
     } finally {
       Trace.endSection();
@@ -100,6 +109,104 @@ public class InitProvider extends ContentProvider {
     executor.shutdown();
   }
 
+  /**
+   * Dispatches the BOOT_COUNT cold-start recovery check on a background thread. Mirrors {@link
+   * #dispatchWarmup} so that app startup stays free of I/O. Fix for upstream invertase/notifee#734.
+   */
+  private static void dispatchBootCheck(final Context context) {
+    ExecutorService executor =
+        Executors.newSingleThreadExecutor(
+            r -> {
+              Thread t = new Thread(r, "notifee-boot-check");
+              t.setDaemon(true);
+              t.setPriority(Thread.MIN_PRIORITY);
+              return t;
+            });
+
+    executor.submit(() -> runBootCheck(context));
+    executor.shutdown();
+  }
+
+  /**
+   * Reads {@code Settings.Global.BOOT_COUNT} and compares it against the last-known value stored in
+   * {@link Preferences}. If a reboot has occurred since the last app run — or if BOOT_COUNT cannot
+   * be read (custom ROMs, emulators, exotic vendors) — invokes {@link
+   * NotifeeAlarmManager#rescheduleNotifications(android.content.BroadcastReceiver.PendingResult)}
+   * to recover any AlarmManager triggers that may not have been re-armed by {@code
+   * RebootBroadcastReceiver} on OEM devices that suppress {@code BOOT_COMPLETED}.
+   *
+   * <p>Package-private for direct invocation from Robolectric unit tests.
+   */
+  static void runBootCheck(Context context) {
+    try {
+      int currentBootCount = readBootCount(context);
+      int lastKnownBootCount =
+          Preferences.getSharedInstance().getIntValue(Preferences.LAST_KNOWN_BOOT_COUNT_KEY, -1);
+
+      boolean shouldReschedule = shouldRescheduleAfterBoot(currentBootCount, lastKnownBootCount);
+
+      if (currentBootCount == -1 && lastKnownBootCount == -1) {
+        Logger.i(TAG, "BOOT_COUNT unavailable on first run; running conservative reschedule");
+      } else if (currentBootCount == -1) {
+        Logger.i(TAG, "BOOT_COUNT unavailable; running conservative reschedule to be safe");
+      } else if (lastKnownBootCount == -1) {
+        Logger.i(TAG, "First run: recording BOOT_COUNT baseline " + currentBootCount);
+      } else if (currentBootCount != lastKnownBootCount) {
+        Logger.i(
+            TAG,
+            "Boot detected since last run ("
+                + lastKnownBootCount
+                + " -> "
+                + currentBootCount
+                + "), rescheduling");
+      }
+
+      // Only persist real values. Writing -1 would erase a prior real baseline
+      // and cause every subsequent init to run a conservative reschedule.
+      if (currentBootCount != -1) {
+        Preferences.getSharedInstance()
+            .setIntValue(Preferences.LAST_KNOWN_BOOT_COUNT_KEY, currentBootCount);
+      }
+
+      if (shouldReschedule) {
+        new NotifeeAlarmManager().rescheduleNotifications(null);
+      }
+    } catch (Throwable t) {
+      Logger.e(TAG, "Cold-start reschedule check failed", t);
+    }
+  }
+
+  private static int readBootCount(Context context) {
+    try {
+      return Settings.Global.getInt(context.getContentResolver(), Settings.Global.BOOT_COUNT, -1);
+    } catch (Throwable t) {
+      Logger.w(TAG, "Failed to read Settings.Global.BOOT_COUNT", t);
+      return -1;
+    }
+  }
+
+  /**
+   * Pure decision function for BOOT_COUNT-based cold-start recovery. Returns {@code true} when the
+   * current init should trigger a reschedule pass, {@code false} otherwise.
+   *
+   * <ul>
+   *   <li>{@code currentBootCount == -1} → BOOT_COUNT unavailable; reschedule conservatively.
+   *   <li>{@code lastKnownBootCount == -1} → first run; record baseline without rescheduling.
+   *   <li>{@code currentBootCount != lastKnownBootCount} → reboot detected; reschedule.
+   *   <li>Otherwise → same boot as last run; no-op.
+   * </ul>
+   */
+  @VisibleForTesting
+  static boolean shouldRescheduleAfterBoot(int currentBootCount, int lastKnownBootCount) {
+    if (currentBootCount == -1) {
+      return true;
+    }
+    if (lastKnownBootCount == -1) {
+      return false;
+    }
+    return currentBootCount != lastKnownBootCount;
+  }
+
   @Nullable
   @Override
   public Cursor query(