fix(sentry): make exit telemetry lossless and stop cross-process clobbering

[gmaclennan]

Post-merge review fixes for the Phase 6/7a exit-reason telemetry (#72). A code review after the merge found a cluster of correctness bugs in the collection pipeline — three of which undermined the headline metrics the feature exists to produce.

Android

Records were silently consumed without being reported. Three paths shared one root cause: collect() advanced the last_seen high-water mark before capture, and capture silently no-ops on an uninitialised Sentry hub.

• The main process collected at Application.onCreate, but main-process sentry-android only comes up when JS-side Sentry.init runs (manifest sets io.sentry.auto-init=false) — so main-process exit records were dropped on essentially every cold start.
• The FGS ran the collector even with diagnosticsEnabled=false, consuming records a user opting in later could never see.

Fix: collection no-ops (leaving records pending) until Sentry.isEnabled(), the main process waits up to 2 minutes for the JS-triggered init, and the high-water mark advances only after the capture loop (at-least-once; duplicates absorbed by the stable message grouping). Both callers snapshot the previous session's anchors (AnchorSnapshot) before stamping their own, so collection can run arbitrarily late without reading current-run values.

comapeo.fgs.killed_in_background was systematically false in the dominant kill→relaunch flow: the relaunch's replayed ON_START zeroed backgrounded_at before the FGS (started only after foregrounding) read it. Fix: ON_START now stamps a paired foregrounded_at anchor instead of clearing; the decoder treats an exit as in-background when the last stamp before its timestamp was a background. Neither stamp is ever cleared, so the answer is correct however late collection runs.

Cross-process SharedPreferences clobbering. Both processes wrote the same prefs file, and SharedPreferences rewrites the whole file from a per-process cache — one process's write could revert or erase the other's anchors, high-water marks, or even the Sentry toggles. Fix: one anchors file per process (com.comapeo.core.anchors.<proc>) with exactly one writer each; the FGS reads the main file read-only. Writes use commit=true so the backgrounded_at stamp survives a SIGKILL right after backgrounding (the exact window this feature measures). Note: the file move resets the high-water mark once — the first run on this code re-initialises it and emits nothing, then reporting resumes.

Shared record window. getHistoricalProcessExitReasons(pkg, 0, 10) returns the newest 10 records across all processes of the package, so FGS churn (START_STICKY restart loops) could evict main-process death records before they were ever seen. Fix: query without a cap (the OS bounds retention at ~16 per package) and keep the newest 10 per process after filtering.

Smaller cleanups: ExitReasonTags.levelFor returns SentryLevel directly (was a string re-parsed by a second when-block that silently degraded unknown values to INFO), and the FGS process name is derived at runtime via a shared helper instead of a literal copy of the manifest's android:process — a rename can no longer silently break the record filter.

iOS

• Double-counted foreground OOM/watchdog deaths: sentry-cocoa's watchdog-termination tracking (enabled by default) already reports these as errors, so the foreground memory_resource_limit / app_watchdog MetricKit buckets are demoted to warning — same policy the crash buckets already followed. Background buckets stay error (the SDK heuristic only covers foreground deaths).
• Unbounded event bursts: app-usage-tier per-exit duplication is now capped at 10 events per window+bucket — counts are 24h cumulative totals and benign buckets (background normal_app_exit) reach the hundreds, burning quota in a burst on every daily payload. window_count keeps the exact count; query sum(window_count) when exactness matters.

Docs (docs/sentry-integration.md §7.5.1/§7.5.2) updated to match.

Tests

• Android JVM: 27 pass, including new coverage for the high-water return-don't-persist contract, the per-process cap, and the fg/bg-stamp-vs-exit-timestamp ordering (incl. the relaunch regression case).
• iOS package: 103 pass, including new coverage for the per-cohort level split and the duplication cap.

🤖 Generated with Claude Code