react-native-update 10.48.0 → 10.48.1

package/android/jni/hpatch.c

@@ -18,15 +18,6 @@
 #define  _check(v,errorType) do{ \
     if (!(v)){ if (result==kHPatch_ok) result=errorType; if (!_isInClear){ goto _clear; }; } }while(0)
 
-int hpatch_getInfo_by_mem(hpatch_singleCompressedDiffInfo* out_patinfo,
-                          const uint8_t* pat,size_t patsize){
-    hpatch_TStreamInput patStream;
-    mem_as_hStreamInput(&patStream,pat,pat+patsize);
-    if (!getSingleCompressedDiffInfo(out_patinfo,&patStream,0))
-        return kHPatch_error_info;//data error;
-    return kHPatch_ok; //ok
-}
-
 static hpatch_TDecompress* getDecompressPlugin(const char* compressType){
 #ifdef  _CompressPlugin_zlib
     if (zlibDecompressPlugin.is_can_open(compressType))
@@ -96,17 +87,6 @@ _clear:
     return result;
 }
 
-int hpatch_by_mem(const uint8_t* old,size_t oldsize,uint8_t* newBuf,size_t newsize,
-                  const uint8_t* pat,size_t patsize,const hpatch_singleCompressedDiffInfo* patInfo){
-    hpatch_TStreamInput oldStream;
-    hpatch_TStreamInput patStream;
-    hpatch_TStreamOutput newStream;
-    mem_as_hStreamInput(&oldStream,old,old+oldsize);
-    mem_as_hStreamInput(&patStream,pat,pat+patsize);
-    mem_as_hStreamOutput(&newStream,newBuf,newBuf+newsize);
-    return hpatch_by_stream(&oldStream,hpatch_FALSE,&patStream,&newStream,patInfo);
-}
-
 // HDIFF13(diffStream 产物,v2 轨道的大 bundle patch):流式应用,
 // 内存 = 解压缓存 + IO 缓冲(+ old ≤ 8MB 时的整载优化),与 single 路径同级。
 static int hpatch_v13_by_stream(const hpatch_TStreamInput* old,hpatch_BOOL isLoadOldAllToMem,

package/android/jni/hpatch.h

@@ -30,12 +30,6 @@ enum {
     kHPatch_error_new_size      =-15,
 };
 
-int hpatch_getInfo_by_mem(hpatch_singleCompressedDiffInfo* out_patinfo,
-                          const uint8_t* pat,size_t patsize);
-
-//patInfo can NULL
-int hpatch_by_mem(const uint8_t* old,size_t oldsize, uint8_t* newBuf,size_t newsize,
-                  const uint8_t* pat,size_t patsize,const hpatch_singleCompressedDiffInfo* patInfo);
 int hpatch_by_file(const char* oldfile, const char* newfile, const char* patchfile);
 
 #ifdef __cplusplus

package/android/src/main/java/cn/reactnative/modules/update/DownloadTask.java

@@ -85,12 +85,15 @@ class DownloadTask implements Runnable {
     }
 
     private void postProgress(final long received, final long total) {
+        // Cross-platform progress contract: unknown length is reported as
+        // total=0, never a raw -1 (OkHttp's contentLength for chunked/gzip).
+        final long normalizedTotal = total > 0 ? total : 0;
         mainHandler.post(new Runnable() {
             @Override
             public void run() {
                 WritableMap progress = Arguments.createMap();
                 progress.putDouble("received", received);
-                progress.putDouble("total", total);
+                progress.putDouble("total", normalizedTotal);
                 progress.putString("hash", hash);
                 UpdateEventEmitter.sendEvent("RCTPushyDownloadProgress", progress);
             }
@@ -136,6 +139,7 @@ class DownloadTask implements Runnable {
                         int percentage = (int) (received * 100.0 / contentLength + 0.5);
                         if (percentage > currentPercentage) {
                             currentPercentage = percentage;
+                            lastPostedBytes = received;
                             postProgress(received, contentLength);
                         }
                     } else if (received - lastPostedBytes >= PROGRESS_BYTES_THRESHOLD) {
@@ -149,7 +153,11 @@ class DownloadTask implements Runnable {
             if (contentLength >= 0 && received != contentLength) {
                 throw new IOException("Unexpected eof while reading downloaded update");
             }
-            postProgress(received, contentLength);
+            // Final progress event, skipped when the loop already posted this
+            // exact value (known length reaching 100% posts it in-loop).
+            if (received != lastPostedBytes) {
+                postProgress(received, contentLength);
+            }
         }
 
     }

package/android/src/main/java/cn/reactnative/modules/update/UpdateContext.java

@@ -26,8 +26,16 @@ public class UpdateContext {
     private final SharedPreferences sp;
 
     private ReactInstanceManager reactInstanceManager;
-    private boolean isUsingBundleUrl;
-    private boolean ignoreRollback;
+    // Written on the launch path, read from executor/JS threads.
+    private volatile boolean isUsingBundleUrl;
+    private volatile boolean ignoreRollback;
+    // The version whose bundle this process actually loaded (resolved in
+    // getBundleUrl). resetToPackagedBundle must not delete its directory:
+    // update assets (images/fonts) are read from it on demand at runtime, so
+    // wiping it under a silent (no-restart) reset would break every image the
+    // running app has not loaded yet. Volatile: written during launch, read
+    // from the state serial executor.
+    private volatile String launchVersion;
     private static final int STATE_OP_SWITCH_VERSION = 1;
     private static final int STATE_OP_MARK_SUCCESS = 2;
     private static final int STATE_OP_ROLLBACK = 3;
@@ -305,9 +313,11 @@ public class UpdateContext {
 
     /**
      * Reset to the bundle packaged in the binary: wipe the whole update state
-     * (so the next launch resolves to the built-in bundle) and delete every
-     * downloaded version. Only the client uuid survives — it identifies the
-     * install for gray release bucketing and must not change on reset.
+     * (so the next launch resolves to the built-in bundle) and delete the
+     * downloaded versions, keeping only the directory of the version this
+     * process is running from (a silent reset must not break its on-demand
+     * asset loads). Only the client uuid survives — it identifies the install
+     * for gray release bucketing and must not change on reset.
      */
     public void resetToPackagedBundle() {
         StateCoreResult resetState = new StateCoreResult();
@@ -329,6 +339,10 @@ public class UpdateContext {
         DownloadTaskParams params = new DownloadTaskParams();
         params.type = DownloadTaskParams.TASK_TYPE_CLEANUP;
         params.maxAgeDays = 0;
+        // Keep the directory of the version this process is running from (a
+        // silent reset would otherwise break its on-demand asset loads); the
+        // orphaned directory is removed by the next regular cleanup.
+        params.hash = launchVersion;
         params.unzipDirectory = rootDir;
         enqueue(params);
     }
@@ -435,6 +449,7 @@ public class UpdateContext {
                 currentVersion = this.rollBack();
                 continue;
             }
+            launchVersion = currentVersion;
             return bundleFile.toString();
         }
 

package/android/src/main/java/cn/reactnative/modules/update/UpdateEventEmitter.java

@@ -1,5 +1,6 @@
 package cn.reactnative.modules.update;
 
+import android.util.Log;
 import androidx.annotation.Nullable;
 import com.facebook.react.bridge.ReactApplicationContext;
 import com.facebook.react.modules.core.DeviceEventManagerModule;
@@ -28,9 +29,17 @@ final class UpdateEventEmitter {
             return;
         }
 
-        reactContext
-            .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter.class)
-            .emit(eventName, params);
+        try {
+            reactContext
+                .getJSModule(DeviceEventManagerModule.RCTDeviceEventEmitter.class)
+                .emit(eventName, params);
+        } catch (RuntimeException e) {
+            // The instance can be torn down between the check above and the
+            // emit (this SDK itself triggers reloads); sendEvent runs on the
+            // main thread, so a throw here would crash the app for a lost
+            // progress tick.
+            Log.w("pushy", "sendEvent " + eventName + " failed: " + e.getMessage());
+        }
     }
 
     @SuppressWarnings("deprecation")

package/android/src/main/java/cn/reactnative/modules/update/UpdateModuleSupport.java

@@ -5,6 +5,7 @@ import static androidx.core.content.FileProvider.getUriForFile;
 import android.content.Intent;
 import android.net.Uri;
 import android.os.Build;
+import android.util.Log;
 import com.facebook.react.bridge.ReactApplicationContext;
 import java.io.File;
 import java.util.HashMap;
@@ -35,7 +36,16 @@ final class UpdateModuleSupport {
         }
 
         constants.put("uuid", updateContext.getKv("uuid"));
-        constants.put("supportedDiffVersion", NativeUpdateCore.supportedDiffVersion());
+        int supportedDiffVersion = 0;
+        try {
+            supportedDiffVersion = NativeUpdateCore.supportedDiffVersion();
+        } catch (UnsatisfiedLinkError e) {
+            // A mismatched librnupdate.so (stale manual copy / build cache)
+            // must not crash startup via getConstants; 0 simply means "no v2
+            // diff track" and the server degrades gracefully.
+            Log.e("pushy", "supportedDiffVersion missing from librnupdate.so", e);
+        }
+        constants.put("supportedDiffVersion", supportedDiffVersion);
         return constants;
     }
 

package/cpp/patch_core/hbc_transform.cpp

@@ -95,7 +95,11 @@ bool TransformHbcInPlace(
     }
     for (uint32_t f = 0; f < s.deltaFieldCount; ++f) {
       const HbcDeltaField& field = s.deltaFields[f];
-      if (field.bits < 1 || field.bits > 32 || field.bit + field.bits > 32 ||
+      // bit 必须单独设上界:bit=0xFFFFFFFF 时 bit+bits 的 uint32 求和会回绕
+      // 绕过 >32 检查,改写阶段的 << bit 就成了移位量 ≥32 的 UB。
+      // bits≥1 时合法 bit 必 ≤31。
+      if (field.bits < 1 || field.bits > 32 || field.bit > 31 ||
+          field.bit + field.bits > 32 ||
           static_cast<uint64_t>(field.byte) + 4 > s.entrySize) {
         return false;
       }

package/cpp/patch_core/hbc_transform_wire.cpp

@@ -151,6 +151,12 @@ bool ParseDeltaField(Cursor* c, HbcDeltaField* out) {
       !ParseUInt(c, &out->bits)) {
     return false;
   }
+  // 语义范围在解析层就拒绝(与 TransformHbcInPlace 的校验双保险):
+  // 位域必须落在一个 32 位字内,bit>31 的值没有任何合法用途。
+  if (out->bits < 1 || out->bits > 32 || out->bit > 31 ||
+      out->bit + out->bits > 32) {
+    return false;
+  }
   return Consume(c, ']');
 }
 

package/cpp/patch_core/tests/hbc_transform_test.cpp

@@ -2,8 +2,11 @@
 // 1) 与 JS 参考实现(react-native-update-cli src/utils/hbcTransform.ts)
 //    做 golden 对拍——fixtures/*.t.hbc 由 JS 实现生成;
 // 2) 可逆性 property check;
-// 3) 非法输入/非法描述表拒绝(buffer 必须保持原样)。
+// 3) 非法输入/非法描述表拒绝(buffer 必须保持原样);
+// 4) wire 解析器(ParseHbcTransformMeta/BuildLayout)的正向/负向直测——
+//    它解析的是随 patch 下发的不可信输入,拒绝分支必须逐条有覆盖。
 #include "../hbc_transform.h"
+#include "../hbc_transform_wire.h"
 
 #include <cstdio>
 #include <cstring>
@@ -13,9 +16,12 @@
 
 namespace {
 
+using pushy::hbc::BuildLayout;
 using pushy::hbc::HbcDeltaField;
 using pushy::hbc::HbcLayoutDesc;
 using pushy::hbc::HbcSectionDesc;
+using pushy::hbc::HbcTransformMeta;
+using pushy::hbc::ParseHbcTransformMeta;
 using pushy::hbc::TransformHbcInPlace;
 
 int g_failures = 0;
@@ -193,6 +199,154 @@ void TestRejections(const std::string& dir) {
     const HbcLayoutDesc badLayout = {19, bad, 1};
     CHECK(!TransformHbcInPlace(buf.data(), buf.size(), badLayout, false));
   }
+  // CP2-1 回归:bit=0xFFFFFFFF 时 bit+bits 的 uint32 求和回绕为 0,
+  // 曾绕过 >32 检查进入改写阶段(移位量 ≥32 的 UB)。必须拒绝且不改字节。
+  {
+    std::vector<uint8_t> buf = good;
+    const std::vector<uint8_t> before = buf;
+    const HbcDeltaField badField[] = {{0, 0xffffffffu, 1}};
+    const HbcSectionDesc bad[] = {{5, 4, badField, 1}};
+    const HbcLayoutDesc badLayout = {19, bad, 1};
+    CHECK(!TransformHbcInPlace(buf.data(), buf.size(), badLayout, false));
+    CHECK(buf == before);
+  }
+  // bit=31 本身合法,但 bit+bits=33 不回绕也必须拒绝
+  {
+    std::vector<uint8_t> buf = good;
+    const HbcDeltaField badField[] = {{0, 31, 2}};
+    const HbcSectionDesc bad[] = {{5, 4, badField, 1}};
+    const HbcLayoutDesc badLayout = {19, bad, 1};
+    CHECK(!TransformHbcInPlace(buf.data(), buf.size(), badLayout, false));
+  }
+  // 非法描述表:bits=0
+  {
+    std::vector<uint8_t> buf = good;
+    const HbcDeltaField badField[] = {{0, 0, 0}};
+    const HbcSectionDesc bad[] = {{5, 4, badField, 1}};
+    const HbcLayoutDesc badLayout = {19, bad, 1};
+    CHECK(!TransformHbcInPlace(buf.data(), buf.size(), badLayout, false));
+  }
+}
+
+// ---- wire 解析器直测 ----
+
+std::string ReadTextFileOrDie(const std::string& path) {
+  const std::vector<uint8_t> raw = ReadFileOrDie(path);
+  return std::string(raw.begin(), raw.end());
+}
+
+void TestWireParser(const std::string& dir) {
+  // 正向:真实 fixture 解析 + BuildLayout 后与手写 kLayoutV96 等效
+  // (对 v96.hbc 变换产物与 golden 逐字节一致 = 端到端等效性证明)
+  {
+    HbcTransformMeta meta;
+    CHECK(ParseHbcTransformMeta(ReadTextFileOrDie(dir + "v96.meta.json"), &meta));
+    CHECK(meta.v == 1);
+    CHECK(meta.hbcVersion == 96);
+    CHECK(meta.headerCountFields == 19);
+    CHECK(meta.sections.size() == 15);
+    std::vector<HbcSectionDesc> scratch;
+    const HbcLayoutDesc layout = BuildLayout(meta, &scratch);
+    std::vector<uint8_t> buf = ReadFileOrDie(dir + "v96.hbc");
+    CHECK(TransformHbcInPlace(buf.data(), buf.size(), layout, false));
+    CHECK(buf == ReadFileOrDie(dir + "v96.t.hbc"));
+  }
+
+  const std::string minimalLayout =
+      R"("layout":{"counts":19,"sections":[[5,4,[]]]})";
+  const std::string minimal =
+      R"({"v":1,"hbcVersion":96,)" + minimalLayout + "}";
+
+  // 正向:最小合法输入;未知键(各种值形态)被跳过;边界位域 [0,31,1] 合法
+  {
+    HbcTransformMeta meta;
+    CHECK(ParseHbcTransformMeta(minimal, &meta));
+    CHECK(ParseHbcTransformMeta(
+        R"({"v":1,"hbcVersion":96,"future":{"a":[1,"s\"x",true,null],"b":-1.5e3},)" +
+            minimalLayout + "}",
+        &meta));
+    CHECK(ParseHbcTransformMeta(
+        R"({"v":1,"hbcVersion":96,"layout":{"counts":19,"sections":[[5,4,[[0,31,1]]]]}})",
+        &meta));
+    CHECK(meta.sections[0].deltaFields[0].bit == 31);
+  }
+
+  // 负向:每条拒绝分支单测,解析必须返回 false
+  const char* rejects[] = {
+      // 非 JSON / 结构破损
+      "not json",
+      "",
+      "{",
+      R"({"v":1,"hbcVersion":96})", // 缺 layout
+      R"({"v":1,"layout":{"counts":19,"sections":[[5,4,[]]]}})", // 缺 hbcVersion
+      R"({"hbcVersion":96,"layout":{"counts":19,"sections":[[5,4,[]]]}})", // 缺 v
+      R"({"v":1,"hbcVersion":96,"layout":{"counts":19}})", // 缺 sections
+      R"({"v":1,"hbcVersion":96,"layout":{"sections":[[5,4,[]]]}})", // 缺 counts
+      R"({"v":1,"hbcVersion":96,"layout":{"counts":19,"sections":[]}})", // 空 sections
+      R"({"v":1,"hbcVersion":96,"layout":{"counts":0,"sections":[[5,4,[]]]}})", // counts=0
+      R"({"v":1,"hbcVersion":96,"layout":[1,2]})", // layout 非对象
+      // 尾部多余内容
+      R"({"v":1,"hbcVersion":96,"layout":{"counts":19,"sections":[[5,4,[]]]}} x)",
+      // 键含转义(本格式的键不允许反斜杠;raw string 里 \x 就是两个字符)
+      R"({"v\x":1,"v":1,"hbcVersion":96,"layout":{"counts":19,"sections":[[5,4,[]]]}})",
+      // ParseUInt 溢出(>0xffffffff)与负数
+      R"({"v":4294967296,"hbcVersion":96,"layout":{"counts":19,"sections":[[5,4,[]]]}})",
+      R"({"v":-1,"hbcVersion":96,"layout":{"counts":19,"sections":[[5,4,[]]]}})",
+      // 位域语义:CP2-1 的 bit 溢出、bit+bits>32、bits=0、bits=33
+      R"({"v":1,"hbcVersion":96,"layout":{"counts":19,"sections":[[5,4,[[0,4294967295,1]]]]}})",
+      R"({"v":1,"hbcVersion":96,"layout":{"counts":19,"sections":[[5,4,[[0,31,2]]]]}})",
+      R"({"v":1,"hbcVersion":96,"layout":{"counts":19,"sections":[[5,4,[[0,0,0]]]]}})",
+      R"({"v":1,"hbcVersion":96,"layout":{"counts":19,"sections":[[5,4,[[0,0,33]]]]}})",
+      // delta field 元组长度不对
+      R"({"v":1,"hbcVersion":96,"layout":{"counts":19,"sections":[[5,4,[[0,0]]]]}})",
+  };
+  for (const char* json : rejects) {
+    HbcTransformMeta meta;
+    if (ParseHbcTransformMeta(json, &meta)) {
+      std::fprintf(stderr, "FAIL: wire parser accepted: %s\n", json);
+      ++g_failures;
+    }
+  }
+
+  // 负向:输入尺寸上限(64KB)
+  {
+    std::string huge = minimal;
+    huge.insert(1, std::string(65 * 1024, ' '));
+    HbcTransformMeta meta;
+    CHECK(!ParseHbcTransformMeta(huge, &meta));
+  }
+  // 负向:未知键的值嵌套深度超限(kMaxDepth=8)
+  {
+    std::string deep = R"({"v":1,"hbcVersion":96,"x":)";
+    for (int i = 0; i < 12; ++i) deep += '[';
+    deep += '1';
+    for (int i = 0; i < 12; ++i) deep += ']';
+    deep += ',' + minimalLayout + "}";
+    HbcTransformMeta meta;
+    CHECK(!ParseHbcTransformMeta(deep, &meta));
+  }
+  // 负向:sections 超过 64 个
+  {
+    std::string many = R"({"v":1,"hbcVersion":96,"layout":{"counts":19,"sections":[)";
+    for (int i = 0; i < 65; ++i) {
+      if (i) many += ',';
+      many += "[5,4,[]]";
+    }
+    many += "]}}";
+    HbcTransformMeta meta;
+    CHECK(!ParseHbcTransformMeta(many, &meta));
+  }
+  // 负向:单段 deltaFields 超过 8 个
+  {
+    std::string many = R"({"v":1,"hbcVersion":96,"layout":{"counts":19,"sections":[[5,64,[)";
+    for (int i = 0; i < 9; ++i) {
+      if (i) many += ',';
+      many += "[0,0,8]";
+    }
+    many += "]]]}}";
+    HbcTransformMeta meta;
+    CHECK(!ParseHbcTransformMeta(many, &meta));
+  }
 }
 
 } // namespace
@@ -210,6 +364,7 @@ int main(int argc, char** argv) {
   TestGoldenPair(fixturesDir, "v98.hbc", "v98.t.hbc", kLayoutV98);
   TestGoldenPair(fixturesDir, "v98b.hbc", "v98b.t.hbc", kLayoutV98Late);
   TestRejections(fixturesDir);
+  TestWireParser(fixturesDir);
 
   // 变体互斥:19 槽布局作用于 20 槽文件(或反之)必须被结构校验拒绝
   {

package/harmony/pushy/src/main/cpp/CMakeLists.txt

@@ -5,12 +5,6 @@ set(CMAKE_C_STANDARD 11)
 set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
-set(PUSHY_MODULE_ROOT ${CMAKE_CURRENT_SOURCE_DIR}/../../..)
-set(PUSHY_ABI ${CMAKE_OHOS_ARCH_ABI})
-if(NOT PUSHY_ABI)
-    set(PUSHY_ABI ${OHOS_ARCH})
-endif()
-set(PREBUILT_RNUPDATE_PATH ${PUSHY_MODULE_ROOT}/libs/${PUSHY_ABI}/librnupdate.so)
 set(CMAKE_VERBOSE_MAKEFILE on)
 
 set(REPO_ROOT ${CMAKE_CURRENT_SOURCE_DIR}/../../../../../)
@@ -24,44 +18,42 @@ if(NOT EXISTS ${PATCH_CORE_DIR}/patch_core.cpp)
     set(PATCH_CORE_DIR ${STAGED_NATIVE_DIR}/patch_core)
 endif()
 
-if(EXISTS ${PREBUILT_RNUPDATE_PATH})
-    add_library(rnupdate SHARED IMPORTED GLOBAL)
-    set_target_properties(rnupdate PROPERTIES IMPORTED_LOCATION ${PREBUILT_RNUPDATE_PATH})
-else()
-    # When building the HAR itself, native sources are compiled from the repo checkout.
-    set(HDIFFPATCH_DIR ${ANDROID_JNI_DIR}/HDiffPatch)
-    set(LZMA_DIR ${ANDROID_JNI_DIR}/lzma)
-    set(HDP_SOURCES
-         ${CMAKE_CURRENT_SOURCE_DIR}/pushy.cpp
-         ${PATCH_CORE_DIR}/archive_patch_core.cpp
-         ${PATCH_CORE_DIR}/hbc_transform.cpp
-         ${PATCH_CORE_DIR}/hbc_transform_wire.cpp
-         ${PATCH_CORE_DIR}/patch_core.cpp
-         ${PATCH_CORE_DIR}/state_core.cpp
-         ${ANDROID_JNI_DIR}/hpatch.c
-         ${HDIFFPATCH_DIR}/libHDiffPatch/HPatch/patch.c
-         ${HDIFFPATCH_DIR}/file_for_patch.c
-         ${LZMA_DIR}/C/LzmaDec.c
-         ${LZMA_DIR}/C/Lzma2Dec.c
-    )
+# Always compile from source. A prebuilt-import branch used to live here, but
+# it had no symbol verification: a stale libs/<abi>/librnupdate.so missing a
+# newly added export (e.g. getSupportedDiffVersion) would silently ship and
+# crash getConstants at runtime.
+set(HDIFFPATCH_DIR ${ANDROID_JNI_DIR}/HDiffPatch)
+set(LZMA_DIR ${ANDROID_JNI_DIR}/lzma)
+set(HDP_SOURCES
+     ${CMAKE_CURRENT_SOURCE_DIR}/pushy.cpp
+     ${PATCH_CORE_DIR}/archive_patch_core.cpp
+     ${PATCH_CORE_DIR}/hbc_transform.cpp
+     ${PATCH_CORE_DIR}/hbc_transform_wire.cpp
+     ${PATCH_CORE_DIR}/patch_core.cpp
+     ${PATCH_CORE_DIR}/state_core.cpp
+     ${ANDROID_JNI_DIR}/hpatch.c
+     ${HDIFFPATCH_DIR}/libHDiffPatch/HPatch/patch.c
+     ${HDIFFPATCH_DIR}/file_for_patch.c
+     ${LZMA_DIR}/C/LzmaDec.c
+     ${LZMA_DIR}/C/Lzma2Dec.c
+)
 
-    add_library(rnupdate SHARED
-        ${HDP_SOURCES}
-    )
+add_library(rnupdate SHARED
+    ${HDP_SOURCES}
+)
 
-    target_include_directories(rnupdate PRIVATE
-         ${CMAKE_CURRENT_SOURCE_DIR}
-         ${PATCH_CORE_DIR}
-         ${ANDROID_JNI_DIR}
-         ${HDIFFPATCH_DIR}
-         ${HDIFFPATCH_DIR}/libHDiffPatch/HPatch
-         ${LZMA_DIR}/C
-    )
+target_include_directories(rnupdate PRIVATE
+     ${CMAKE_CURRENT_SOURCE_DIR}
+     ${PATCH_CORE_DIR}
+     ${ANDROID_JNI_DIR}
+     ${HDIFFPATCH_DIR}
+     ${HDIFFPATCH_DIR}/libHDiffPatch/HPatch
+     ${LZMA_DIR}/C
+)
 
-    target_link_libraries(rnupdate PUBLIC
-        libace_napi.z.so
-    )
-endif()
+target_link_libraries(rnupdate PUBLIC
+    libace_napi.z.so
+)
 
 if(TARGET rnoh)
     add_library(rnoh_pushy SHARED

package/harmony/pushy/src/main/cpp/pushy.cpp

@@ -70,7 +70,9 @@ std::string GetString(napi_env env, napi_value value, bool* ok) {
     return std::string();
   }
 
-  std::string result(length, '\0');
+  // length + 1 so NAPI's terminating '\0' lands inside owned storage instead
+  // of the string's past-the-end terminator slot (formally UB to write).
+  std::string result(length + 1, '\0');
   size_t written = 0;
   if (napi_get_value_string_utf8(
           env, value, result.data(), length + 1, &written) != napi_ok) {
@@ -738,9 +740,13 @@ napi_value ApplyPatchFromFileSource(napi_env env, napi_callback_info info) {
             auto* w = static_cast<ApplyPatchWork*>(data);
             w->status = pushy::patch::ApplyPatchFromFileSource(w->options);
           },
-          [](napi_env cb_env, napi_status, void* data) {
+          [](napi_env cb_env, napi_status status, void* data) {
             auto* w = static_cast<ApplyPatchWork*>(data);
-            if (w->status.ok) {
+            if (status != napi_ok) {
+              // Cancelled/aborted before execute ran: w->status is
+              // meaningless; still settle the promise so it never hangs.
+              RejectDeferredWithMessage(cb_env, w->deferred, "async work aborted");
+            } else if (w->status.ok) {
               napi_value undefined_value = nullptr;
               napi_get_undefined(cb_env, &undefined_value);
               napi_resolve_deferred(cb_env, w->deferred, undefined_value);
@@ -826,9 +832,11 @@ napi_value CleanupOldEntries(napi_env env, napi_callback_info info) {
             w->status = pushy::patch::CleanupOldEntries(
                 w->root_dir, w->keep_current, w->keep_previous, w->max_age_days);
           },
-          [](napi_env cb_env, napi_status, void* data) {
+          [](napi_env cb_env, napi_status status, void* data) {
             auto* w = static_cast<CleanupWork*>(data);
-            if (w->status.ok) {
+            if (status != napi_ok) {
+              RejectDeferredWithMessage(cb_env, w->deferred, "async work aborted");
+            } else if (w->status.ok) {
               napi_value undefined_value = nullptr;
               napi_get_undefined(cb_env, &undefined_value);
               napi_resolve_deferred(cb_env, w->deferred, undefined_value);

package/harmony/pushy/src/main/ets/DownloadTask.ts

@@ -395,8 +395,15 @@ export class DownloadTask {
             resolve();
           })
           .catch(async error => {
-            await closeWriter();
+            // reject 必须先于 closeWriter：此时 watchdog 已清除，若 close
+            // 也失败（同一磁盘故障的常见连锁）而 reject 未执行，下载 Promise
+            // 将永久挂起——正是 HM-2 要消灭的症状。
             reject(error);
+            try {
+              await closeWriter();
+            } catch (closeErr: any) {
+              console.error('closeWriter failed after write error:', closeErr);
+            }
           });
       });
     });
@@ -461,7 +468,6 @@ export class DownloadTask {
         },
       );
 
-      refreshWatchdog();
       const responseCode = await httpRequest.requestInStream(params.url, {
         method: http.RequestMethod.GET,
         readTimeout: 60000,
@@ -474,6 +480,11 @@ export class DownloadTask {
         throw Error(`Server error: ${responseCode}`);
       }
 
+      // watchdog 到这里才首次启动：requestInStream 阶段已有 connect/readTimeout
+      // 覆盖；若提早启动，连接超过 60s 时 inactivityPromise 会在 race 尚无订阅者
+      // 时 reject（unhandled rejection），且 promise 一经 reject 无法复活——
+      // 即使随后数据正常流入，race 也必然以 "Download stalled" 失败。
+      refreshWatchdog();
       await Promise.race([dataEndPromise, inactivityPromise]);
       const stats = await fileIo.stat(params.targetFile);
       const fileSize = stats.size;

package/harmony/pushy/src/main/ets/UpdateContext.ts

@@ -27,6 +27,10 @@ export class UpdateContext {
   private static DEBUG: boolean = false;
   private static isUsingBundleUrl: boolean = false;
   private static ignoreRollback: boolean = false;
+  // 本进程实际加载的热更版本（getBundleUrl 解析成功时记录）。
+  // resetToPackagedBundle 不能删它的目录：热更包内的图片等资源是运行时按需
+  // 读盘的，静默（不重启）reset 若删掉会导致后续所有未加载过的资源失败。
+  private static launchVersion: string = '';
   private static cachedPackageVersion: string = '';
   private static cachedBuildTime: string = '';
   // 单例：确保 bundle provider 与 TurboModule 共用同一份 preferences 内存状态，
@@ -296,9 +300,26 @@ export class UpdateContext {
     return params;
   }
 
+  // 串行化下载/补丁任务与破坏性清理（reset 的全量删除）：Android 靠单线程
+  // download executor 天然串行，Harmony 的 NAPI 任务跑在 libuv worker 池上，
+  // 若不排队，reset 的 RemovePathRecursively 可能与正在写入的解压/打补丁并发，
+  // 产出"bundle 在、资源半删"的目录且可能被后续 switchVersion 激活。
+  private taskChain: Promise<void> = Promise.resolve();
+
+  private enqueueSerialTask<T>(job: () => Promise<T>): Promise<T> {
+    const run = this.taskChain.then(job);
+    this.taskChain = run.then(
+      () => undefined,
+      () => undefined,
+    );
+    return run;
+  }
+
   private async executeTask(params: DownloadTaskParams): Promise<void> {
-    const downloadTask = new DownloadTask(this.context);
-    await downloadTask.execute(params);
+    await this.enqueueSerialTask(() => {
+      const downloadTask = new DownloadTask(this.context);
+      return downloadTask.execute(params);
+    });
   }
 
   public syncStateWithBinaryVersion(
@@ -374,14 +395,17 @@ export class UpdateContext {
 
   /**
    * 恢复到二进制内置包：清空整个更新状态机（下次启动即回内置 bundle）并删除
-   * 全部已下载版本。仅保留 uuid —— 它标识安装实例、用于灰度分桶，reset 不应改变。
+   * 已下载版本——仅保留当前运行版本的目录（静默 reset 不能破坏运行中 bundle
+   * 的按需资源加载）。uuid 保留 —— 它标识安装实例、用于灰度分桶，reset 不应改变。
    */
   public resetToPackagedBundle(): void {
     this.trace('resetToPackagedBundle:before');
-    const state = this.getStateSnapshot();
+    // 实时读取二进制身份（与 Android/iOS 对齐），而非 preferences 快照：
+    // meta.json 读取失败时快照可能为空，reset 持久化空值会让下次启动误判
+    // binary 变更多做一轮 cleanUp+persist。
     const resetState: StateCoreResult = {
-      packageVersion: state.packageVersion,
-      buildTime: state.buildTime,
+      packageVersion: this.getPackageVersion(),
+      buildTime: this.getBuildTime(),
       currentVersion: '',
       lastVersion: '',
       firstTime: false,
@@ -409,12 +433,18 @@ export class UpdateContext {
     this.persistState(resetState, { clearFirstLoadMarker: true });
     UpdateContext.ignoreRollback = false;
 
-    // maxAgeDays=0 且不保留任何版本：全量删除下载目录内容（后台线程，尽力而为）
-    NativePatchCore.cleanupOldEntries(this.rootDir, '', '', 0).catch(
-      (error: Object) => {
-        console.error('reset cleanup failed:', error);
-      },
-    );
+    // maxAgeDays=0：删除下载目录内容，仅保留当前运行版本的目录（残留目录由
+    // 下次常规清理回收）。挂到串行任务链尾，避免与在飞的解压/打补丁并发。
+    this.enqueueSerialTask(() =>
+      NativePatchCore.cleanupOldEntries(
+        this.rootDir,
+        UpdateContext.launchVersion,
+        '',
+        0,
+      ),
+    ).catch((error: Object) => {
+      console.error('reset cleanup failed:', error);
+    });
     this.trace('resetToPackagedBundle:after');
   }
 
@@ -558,6 +588,7 @@ export class UpdateContext {
           version = this.rollBack();
           continue;
         }
+        UpdateContext.launchVersion = version;
         return bundleFile;
       } catch (e) {
         console.error('Failed to access bundle file:', e);

package/ios/RCTPushy/RCTPushy.mm

@@ -64,6 +64,12 @@ typedef NS_ENUM(NSInteger, PushyType) {
 };
 
 static std::atomic<bool> ignoreRollback{false};
+// The version whose bundle this process actually loaded (resolved in
+// +bundleURL). resetToPackagedBundle must not delete its directory: update
+// assets (images/fonts) are read from it on demand at runtime, so wiping it
+// under a silent (no-restart) reset would break every image the running app
+// has not loaded yet. Guarded by the state lock.
+static NSString *pushyLaunchVersion = nil;
 
 // Serializes every read-modify-write of the persisted update state. The state
 // machine itself is a pure function (state_core), but callers run on different
@@ -305,6 +311,7 @@ RCT_EXPORT_MODULE(RCTPushy);
                 [visitedVersions addObject:loadVersion];
                 NSString *bundlePath = [[downloadDir stringByAppendingPathComponent:loadVersion] stringByAppendingPathComponent:BUNDLE_FILE_NAME];
                 if ([[NSFileManager defaultManager] fileExistsAtPath:bundlePath isDirectory:NULL]) {
+                    pushyLaunchVersion = loadVersion;
                     resolvedURL = [NSURL fileURLWithPath:bundlePath];
                     return;
                 } else {
@@ -380,7 +387,16 @@ RCT_EXPORT_MODULE(RCTPushy);
 {
     self = [super init];
     if (self) {
-        _fileQueue = dispatch_queue_create("cn.reactnative.pushy.file", DISPATCH_QUEUE_SERIAL);
+        // One process-wide serial queue, not per-instance: a bridge reload can
+        // briefly keep two RCTPushy instances alive, and destructive file work
+        // (resetToPackagedBundle's full cleanup) must stay serialized with the
+        // other instance's unzip/patch jobs.
+        static dispatch_queue_t sharedFileQueue;
+        static dispatch_once_t onceToken;
+        dispatch_once(&onceToken, ^{
+            sharedFileQueue = dispatch_queue_create("cn.reactnative.pushy.file", DISPATCH_QUEUE_SERIAL);
+        });
+        _fileQueue = sharedFileQueue;
     }
     return self;
 }
@@ -522,11 +538,15 @@ RCT_EXPORT_METHOD(resetToPackagedBundle:(RCTPromiseResolveBlock)resolve
                   rejecter:(RCTPromiseRejectBlock)reject)
 {
     // Reset to the bundle packaged in the binary: wipe the whole update state
-    // (so the next launch resolves to the built-in bundle) and delete every
-    // downloaded version. Only the client uuid survives — it identifies the
-    // install for gray release bucketing and must not change on reset.
+    // (so the next launch resolves to the built-in bundle) and delete the
+    // downloaded versions, keeping only the directory of the version this
+    // process is running from (a silent reset must not break its on-demand
+    // asset loads). Only the client uuid survives — it identifies the install
+    // for gray release bucketing and must not change on reset.
+    __block NSString *keepVersion = nil;
     PushyWithStateLock(^{
         NSUserDefaults *defaults = PushyDefaults();
+        keepVersion = pushyLaunchVersion;
 
         // A default-constructed State is exactly the reset state (no current /
         // last version, first_time=false, first_time_ok=true); keep the binary
@@ -548,10 +568,11 @@ RCT_EXPORT_METHOD(resetToPackagedBundle:(RCTPromiseResolveBlock)resolve
     });
 
     dispatch_async(_fileQueue, ^{
-        // maxAgeDays=0 and no versions to keep: remove every downloaded entry.
+        // maxAgeDays=0: remove every downloaded entry except the running
+        // version's directory (cleaned up by the next regular cleanup).
         pushy::patch::Status status = pushy::patch::CleanupOldEntries(
             PushyToStdString([RCTPushy downloadDir]),
-            "",
+            PushyToStdString(keepVersion),
             "",
             0
         );
@@ -883,6 +904,13 @@ RCT_EXPORT_METHOD(resetToPackagedBundle:(RCTPromiseResolveBlock)resolve
             NSError *unzipError = error;
             if (!succeeded && unzipError == nil) {
                 unzipError = PushyErrorWithCode(pushy::error_codes::kPatchFailed, @"unzip failed");
+            } else if (unzipError != nil && unzipError.userInfo[PushyErrorCodeKey] == nil) {
+                // SSZipArchive's own NSError (corrupt zip, bad magic, ...) has
+                // no stable code; without one, downloadUpdate's fallback would
+                // classify it as DOWNLOAD_FAILED even though the download
+                // succeeded — keep the classification deterministic.
+                unzipError = PushyErrorWithCode(pushy::error_codes::kPatchFailed,
+                                                unzipError.localizedDescription ?: @"unzip failed");
             }
             completionHandler(unzipError);
         }];

package/ios/RCTPushy/RCTPushyDownloader.mm

@@ -45,9 +45,12 @@ completionHandler:(void (^)(NSString *path, NSError *error))completionHandler
 
     NSURLSessionConfiguration *sessionConfig = [NSURLSessionConfiguration defaultSessionConfiguration];
     // Avoid hanging forever on a stalled connection (default resource timeout
-    // is 7 days). These are generous enough for large bundles on slow networks.
+    // is 7 days). The 30s idle timeout matches Android's readTimeout and is
+    // what actually catches a stalled transfer; the total-duration cap matches
+    // Android's 10min callTimeout — 300s made a 30MB full package on a slow
+    // (<100KB/s) network fail on iOS while succeeding on Android.
     sessionConfig.timeoutIntervalForRequest = 30;
-    sessionConfig.timeoutIntervalForResource = 300;
+    sessionConfig.timeoutIntervalForResource = 600;
     self.session = [NSURLSession sessionWithConfiguration:sessionConfig
                                                  delegate:self
                                             delegateQueue:nil];
@@ -89,6 +92,12 @@ totalBytesExpectedToWrite:(int64_t)totalBytesExpectedToWrite
     // Normalize an unknown total (NSURLSessionTransferSizeUnknown == -1) to 0 so
     // the JS side does not compute a negative/NaN percentage.
     long long total = totalBytesExpectedToWrite > 0 ? totalBytesExpectedToWrite : 0;
+    if (totalBytesWritten > total) {
+        // Encoded responses (gzip): the expected total counts compressed bytes
+        // while written counts decompressed ones, so the percentage would run
+        // past 100%. Treat the total as unknown instead.
+        total = 0;
+    }
     if (total > 0) {
         int percentage = (int)((totalBytesWritten * 100.0 / total) + 0.5);
         if (percentage <= self.lastReportedPercentage) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "react-native-update",
-  "version": "10.48.0",
+  "version": "10.48.1",
   "description": "react-native hot update",
   "main": "src/index",
   "types": "src/index.ts",

package/src/client.ts

@@ -40,7 +40,12 @@ import {
   testUrls,
 } from './utils';
 import i18n from './i18n';
-import { toUpdateError, UpdateError, UpdateErrorCode } from './error';
+import {
+  asUpdateErrorCode,
+  toUpdateError,
+  UpdateError,
+  UpdateErrorCode,
+} from './error';
 import { dedupeEndpoints, executeEndpointFallback } from './endpoint';
 import {
   resolveServerEventHash,
@@ -104,6 +109,10 @@ const defaultClientOptions: ClientOptions = {
 export const sharedState: {
   progressHandlers: Record<string, EmitterSubscription>;
   downloadingTasks: Record<string, Promise<string | undefined>>;
+  // Progress callbacks per hash: concurrent downloadUpdate callers of the
+  // same hash each register theirs here instead of the second one being
+  // silently dropped by the in-flight dedup.
+  progressCallbacks: Record<string, Set<(data: ProgressData) => void>>;
   downloadedHash?: string;
   toHash?: string;
   apkStatus: 'downloading' | 'downloaded' | null;
@@ -112,6 +121,7 @@ export const sharedState: {
 } = {
   progressHandlers: {},
   downloadingTasks: {},
+  progressCallbacks: {},
   downloadedHash: undefined,
   apkStatus: null,
   marked: false,
@@ -325,6 +335,7 @@ export class Pushy {
     }
   };
   private errorListeners = new Set<UpdateErrorListener>();
+  private emittedErrors = new WeakSet<Error>();
   /**
    * Subscribe to every error the client reports (regardless of throwError).
    * Returns an unsubscribe function.
@@ -335,6 +346,15 @@ export class Pushy {
       this.errorListeners.delete(listener);
     };
   };
+  /**
+   * Whether this exact error object already went through emitError (and was
+   * therefore delivered to onError subscribers). Lets UI layers decide if a
+   * caught error still needs surfacing — checking `e.code` is not enough,
+   * since axios/system errors carry their own code without ever entering the
+   * pipeline.
+   */
+  wasEmitted = (e: unknown): boolean =>
+    e instanceof Error && this.emittedErrors.has(e);
   /**
    * Single exit point for errors: reports to the logger (with the stable
    * code) and notifies onError listeners. Whether to also throw stays with
@@ -348,7 +368,15 @@ export class Pushy {
       data,
     }: { message?: string; data?: Record<string, string | number> } = {},
   ) => {
-    this.report({ type, message, code: error.code, data });
+    this.emittedErrors.add(error);
+    this.report({
+      type,
+      message,
+      code: error.code,
+      // Structured context from the error (e.g. HTTP status) reaches the
+      // logger; explicit data wins on key conflicts.
+      data: error.extra ? { ...error.extra, ...data } : data,
+    });
     for (const listener of this.errorListeners) {
       try {
         listener(error, type);
@@ -502,7 +530,10 @@ export class Pushy {
         }
       } catch (e) {
         sharedState.applyingUpdate = false;
-        const err = toUpdateError(e, 'SWITCH_VERSION_FAILED');
+        // A throw from the user's beforeReload hook is business-code failure,
+        // not an update-pipeline one: give it a distinct code so telemetry
+        // excludes it from the server-side patch-health stats.
+        const err = toUpdateError(e, 'USER_HOOK_ERROR');
         this.emitError(err, 'errorSwitchVersion', {
           data: { newVersion: hash },
         });
@@ -563,9 +594,20 @@ export class Pushy {
       this.lastChecking &&
       now - this.lastChecking < 1000 * 5
     ) {
-      const result = await this.lastRespJson;
-      this.notifyAfterCheckUpdate({ status: 'completed', result });
-      return result;
+      try {
+        const result = await this.lastRespJson;
+        this.notifyAfterCheckUpdate({ status: 'completed', result });
+        return result;
+      } catch (e: any) {
+        // The shared in-flight check failed. Its initiating call reports it
+        // through emitError/throw; this call must still honor its own
+        // contract — afterCheckUpdate always fires and throwError applies —
+        // without double-reporting the same error.
+        const err = toUpdateError(e, 'CHECK_FAILED');
+        this.notifyAfterCheckUpdate({ status: 'error', error: err });
+        this.throwIfEnabled(err);
+        return undefined;
+      }
     }
     this.lastChecking = now;
     const fetchBody: Record<string, any> = {
@@ -655,6 +697,10 @@ export class Pushy {
     const existingTask = sharedState.downloadingTasks[hash];
     if (existingTask) {
       log(`download for hash ${hash} already in progress, reusing it`);
+      // The second caller's progress callback must still fire.
+      if (onDownloadProgress) {
+        sharedState.progressCallbacks[hash]?.add(onDownloadProgress);
+      }
       return existingTask;
     }
     const task = this.performDownload(updateInfo, onDownloadProgress);
@@ -682,38 +728,42 @@ export class Pushy {
     if (!hash) {
       return;
     }
-    if (sharedState.progressHandlers[hash]) {
-      return;
-    }
     const patchStartTime = Date.now();
+    // One native listener per hash dispatching to a callback set, so
+    // concurrent callers deduped onto this task can each observe progress
+    // (they register via downloadUpdate).
+    const progressCallbacks = new Set<(data: ProgressData) => void>();
     if (onDownloadProgress) {
-      const wrapProgress = (data: ProgressData) => {
-        onDownloadProgress({
-          ...data,
-          progress: computeProgress(data.received, data.total),
-        });
+      progressCallbacks.add(onDownloadProgress);
+    }
+    sharedState.progressCallbacks[hash] = progressCallbacks;
+    const dispatchProgress = (data: ProgressData) => {
+      const callbacks = sharedState.progressCallbacks[hash];
+      if (!callbacks || callbacks.size === 0) {
+        return;
+      }
+      const payload = {
+        ...data,
+        progress: computeProgress(data.received, data.total),
       };
-      // @ts-expect-error harmony not in existing platforms
-      if (Platform.OS === 'harmony') {
-        sharedState.progressHandlers[hash] = DeviceEventEmitter.addListener(
-          'RCTPushyDownloadProgress',
-          (progressData: ProgressData) => {
-            if (progressData.hash === hash) {
-              wrapProgress(progressData);
-            }
-          },
-        );
-      } else {
-        sharedState.progressHandlers[hash] =
-          pushyNativeEventEmitter.addListener(
-            'RCTPushyDownloadProgress',
-            (progressData: ProgressData) => {
-              if (progressData.hash === hash) {
-                wrapProgress(progressData);
-              }
-            },
-          );
+      callbacks.forEach(callback => callback(payload));
+    };
+    const onNativeProgress = (progressData: ProgressData) => {
+      if (progressData.hash === hash) {
+        dispatchProgress(progressData);
       }
+    };
+    // @ts-expect-error harmony not in existing platforms
+    if (Platform.OS === 'harmony') {
+      sharedState.progressHandlers[hash] = DeviceEventEmitter.addListener(
+        'RCTPushyDownloadProgress',
+        onNativeProgress,
+      );
+    } else {
+      sharedState.progressHandlers[hash] = pushyNativeEventEmitter.addListener(
+        'RCTPushyDownloadProgress',
+        onNativeProgress,
+      );
     }
     const maxRetries = Math.max(0, Math.floor(this.options.maxRetries ?? 3));
     let succeeded = '';
@@ -804,7 +854,14 @@ export class Pushy {
               message: e.message,
             });
             errorMessages.push(errorMessage);
-            lastError = Error(errorMessage);
+            // Keep the i18n message for display, but preserve the native
+            // rejection's stable code (e.g. PATCH_FAILED vs DOWNLOAD_FAILED —
+            // telemetry classifies on it) and the original error as cause.
+            lastError = new UpdateError(
+              errorMessage,
+              asUpdateErrorCode(e?.code) ?? 'DOWNLOAD_FAILED',
+              { cause: e },
+            );
             log(errorMessage);
           }
         } else if (!url && strategy.devNoopWhenNoUrl && __DEV__) {
@@ -820,6 +877,7 @@ export class Pushy {
       sharedState.progressHandlers[hash].remove();
       delete sharedState.progressHandlers[hash];
     }
+    delete sharedState.progressCallbacks[hash];
     if (!succeeded) {
       const message = errorMessages.join(';');
       if (lastError) {
@@ -946,10 +1004,22 @@ export class Pushy {
     }
   };
   restartApp = async () => {
-    if (!(await this.runBeforeReload({ type: 'restartApp' }))) {
-      return;
+    try {
+      if (!(await this.runBeforeReload({ type: 'restartApp' }))) {
+        return;
+      }
+    } catch (e) {
+      const err = toUpdateError(e, 'USER_HOOK_ERROR');
+      this.emitError(err, 'errorRestart');
+      throw err;
+    }
+    try {
+      return await PushyModule.restartApp();
+    } catch (e) {
+      const err = toUpdateError(e, 'RESTART_FAILED');
+      this.emitError(err, 'errorRestart');
+      throw err;
     }
-    return PushyModule.restartApp();
   };
   /**
    * Reset to the bundle packaged in the binary: wipes every downloaded update
@@ -965,6 +1035,11 @@ export class Pushy {
   resetToPackagedBundle = async (options?: {
     restart?: boolean;
   }): Promise<boolean> => {
+    if (!assertWeb()) {
+      // On web PushyModule is a Proxy of noops, so the feature-detect below
+      // would report a false success.
+      return false;
+    }
     if (typeof PushyModule.resetToPackagedBundle !== 'function') {
       // The JS layer can arrive via hot update onto an older binary whose
       // native module predates this method.
@@ -987,10 +1062,18 @@ export class Pushy {
     // The downloaded versions are gone; drop JS bookkeeping referring to them
     // so a stale downloadedHash cannot be switched to.
     sharedState.downloadedHash = undefined;
+    sharedState.toHash = undefined;
     sharedState.marked = false;
     this.report({ type: 'reset' });
     if (options?.restart) {
-      await this.restartApp();
+      try {
+        await this.restartApp();
+      } catch (e: any) {
+        // The reset itself succeeded and the restart failure was already
+        // reported through the pipeline; the boolean must still say "state
+        // is reset".
+        log('restart after reset failed:', e?.message || e);
+      }
     }
     return true;
   };

package/src/error.ts

@@ -21,6 +21,9 @@ export type UpdateErrorCode =
   | 'STORAGE_PERMISSION_REJECTED'
   | 'STORAGE_PERMISSION_ERROR'
   | 'APK_DOWNLOAD_FAILED'
+  // A throw from a user-provided hook (e.g. beforeReload) — not an update
+  // pipeline failure, and excluded from server-side patch-health telemetry.
+  | 'USER_HOOK_ERROR'
   // Native codes (see cpp/patch_core/error_codes.h)
   | 'INVALID_OPTIONS'
   | 'PATCH_FAILED'
@@ -30,6 +33,41 @@ export type UpdateErrorCode =
   | 'INVALID_HASH_INFO'
   | 'UNSUPPORTED_PLATFORM';
 
+const KNOWN_CODES = new Set<string>([
+  'MODULE_NOT_LOADED',
+  'APPKEY_REQUIRED',
+  'NO_ENDPOINTS',
+  'HTTP_STATUS',
+  'CHECK_FAILED',
+  'DOWNLOAD_FAILED',
+  'SWITCH_VERSION_FAILED',
+  'MARK_SUCCESS_FAILED',
+  'APK_INSTALL_PENDING',
+  'STORAGE_PERMISSION_REJECTED',
+  'STORAGE_PERMISSION_ERROR',
+  'APK_DOWNLOAD_FAILED',
+  'USER_HOOK_ERROR',
+  'INVALID_OPTIONS',
+  'PATCH_FAILED',
+  'FILE_OPERATION_FAILED',
+  'RESTART_FAILED',
+  'RESET_FAILED',
+  'INVALID_HASH_INFO',
+  'UNSUPPORTED_PLATFORM',
+]);
+
+/**
+ * Narrow an arbitrary `code` property (axios' ERR_NETWORK, Node's
+ * ECONNREFUSED, RN's default EUNSPECIFIED, ...) to our stable set; anything
+ * else is treated as absent so it never leaks into telemetry aggregation.
+ */
+export const asUpdateErrorCode = (
+  code: unknown,
+): UpdateErrorCode | undefined =>
+  typeof code === 'string' && KNOWN_CODES.has(code)
+    ? (code as UpdateErrorCode)
+    : undefined;
+
 export class UpdateError extends Error {
   code: UpdateErrorCode;
   cause?: unknown;
@@ -50,9 +88,11 @@ export class UpdateError extends Error {
 
 /**
  * Attach a code to an unknown thrown value. An existing Error keeps its
- * identity (message, stack, and any code already assigned upstream) so callers
- * comparing the caught error to the original still match; non-Error values are
- * wrapped.
+ * identity (message, stack, and any known code already assigned upstream) so
+ * callers comparing the caught error to the original still match; non-Error
+ * values are wrapped. A foreign `code` (axios/system errors) is overwritten
+ * with ours; a frozen/sealed Error that rejects the assignment is wrapped
+ * instead (identity is lost only in that edge case).
  */
 export const toUpdateError = (
   e: unknown,
@@ -60,8 +100,13 @@ export const toUpdateError = (
 ): UpdateError => {
   if (e instanceof Error) {
     const err = e as UpdateError;
-    if (!err.code) {
-      err.code = code;
+    if (!asUpdateErrorCode(err.code)) {
+      try {
+        err.code = code;
+      } catch {}
+      if (err.code !== code) {
+        return new UpdateError(err.message, code, { cause: err });
+      }
     }
     return err;
   }

package/src/provider.tsx

@@ -152,10 +152,12 @@ export const UpdateProvider = ({
         ]);
         return true;
       } catch (e: any) {
-        // Client pipeline errors carry a code and were already surfaced via
-        // the onError subscription; errors thrown by user hooks
-        // (afterDownloadUpdate) bypass the pipeline and are surfaced here.
-        if (!e?.code) {
+        // Client pipeline errors were already surfaced via the onError
+        // subscription; errors thrown by user hooks (afterDownloadUpdate)
+        // bypass the pipeline and are surfaced here. Asking the client
+        // instead of checking `e.code` matters: axios/system errors carry
+        // their own code without ever entering the pipeline.
+        if (!client.wasEmitted(e)) {
           setLastError(e);
           alertError(client.t('update_failed'), e.message);
         }
@@ -186,10 +188,10 @@ export const UpdateProvider = ({
       try {
         rootInfo = await client.checkUpdate(extra);
       } catch (e: any) {
-        // Client pipeline errors carry a code and were already surfaced via
-        // the onError subscription; errors thrown by user hooks
-        // (beforeCheckUpdate) bypass the pipeline and are surfaced here.
-        if (!e?.code) {
+        // Client pipeline errors were already surfaced via the onError
+        // subscription; errors thrown by user hooks (beforeCheckUpdate)
+        // bypass the pipeline and are surfaced here (see wasEmitted).
+        if (!client.wasEmitted(e)) {
           setLastError(e);
           alertError(client.t('error_update_check_failed'), e.message);
         }
@@ -403,15 +405,21 @@ export const UpdateProvider = ({
       if (!url) {
         return;
       }
-      const params = new URL(url).searchParams;
-      const payload = {
-        type: params.get('type'),
-        data: params.get('data'),
-      };
-      parseTestPayload(payload);
+      try {
+        const params = new URL(url).searchParams;
+        const payload = {
+          type: params.get('type'),
+          data: params.get('data'),
+        };
+        parseTestPayload(payload);
+      } catch (e: any) {
+        // A malformed deep link (new URL throws) must not become an
+        // unhandled rejection / a throw inside the 'url' event handler.
+        log('parseLinking: invalid url', e?.message || e);
+      }
     };
 
-    Linking.getInitialURL().then(parseLinking);
+    Linking.getInitialURL().then(parseLinking).catch(noop);
     const linkingHandler = ({ url }: { url: string }) => {
       parseLinking(url);
     };

package/src/telemetry.ts

@@ -43,7 +43,12 @@ export const resolveServerEventType = (
     case 'errorUpdate':
       return code === 'PATCH_FAILED' ? 'patch_fail' : 'download_fail';
     case 'errorSwitchVersion':
-      return 'patch_fail';
+      // Activation failures are patch-health signals, but a throw from a
+      // user hook (beforeReload) or a restart-mechanics failure is not —
+      // those must not poison the stats driving the rollback safety net.
+      return code === 'USER_HOOK_ERROR' || code === 'RESTART_FAILED'
+        ? undefined
+        : 'patch_fail';
     case 'markSuccess':
       return 'mark_success';
     case 'rollback':

package/src/type.ts

@@ -57,6 +57,7 @@ export type EventType =
   | 'errorMarkSuccess'
   | 'reset'
   | 'errorReset'
+  | 'errorRestart'
   | 'errorSwitchVersion'
   | 'downloadingApk'
   | 'rejectStoragePermission'