[abelonogov-ld]

Third in the event-durability stack, on top of #536. Recorded events go to an on-disk log rather than an in-memory buffer, so an application that dies moments after recording one still reports it: the next run delivers what the last one left behind.

What changes

EventStore is a new on-disk log, with capacity, framing, interrupted-log recovery, and multi-process safety. NullEventStore stands in where the platform gave the SDK nowhere to write, which is the behaviour the SDK had before.

Recording no longer encodes on the caller's thread. An evaluation appends to a held run and updates a counter; a commit turns the whole run into bytes at once. Recording a custom or identify event is a commit point, because an application reporting something it chose to report is saying it matters more than the microseconds it costs. Evaluations commit once pendingCommitThreshold of them accumulate, when a delivery starts, or on flush.

LDConfig.eventPersistence lets the application choose whether a commit point runs on the caller's thread (.immediate), off it (.deferred), or not at all (.disabled).

Delivery sends batches oldest first and stops at the first retryable failure, so the rest keep their place in the log instead of the SDK spending the session's requests on a service that is refusing them.

Reconciling with tier 2

Tier 2 replaced the delivery gate this branch was built on, so the merge had to pick one design rather than keep both.

Coalescing comes from tier 2: flushes arriving before a delivery starts join it, one already started is never joined, and nothing holds the drain back while a retry runs. What tier 2 did not need is a way to keep an in-flight batch from being sent twice — it empties its buffer before publishing, so a second delivery finds nothing. Here a batch stays on disk until its response arrives, which is what isDelivering guarded.

batchesInFlight takes its place. A delivery claims the batches it lists and releases them once it has an answer, so a later delivery still runs and still sends what it closed for itself; only the batches already on their way are left out. A caller whose own events are all that remain unsent is answered true, which is exactly the contract tier 2 documents: an answer is about the batch the caller's own delivery took, never one an earlier delivery lost.

The loss flag is now taken once per delivery rather than once per caller, so everyone joined to it hears about a loss instead of only whoever was answered first, and a scheduled delivery with no waiters leaves it for the caller who is owed it. This branch had also fixed the duplicate event reporter independently; that now comes from #537, so the local copy is gone.

Verification

• 824 tests pass on iOS; macOS and tvOS build. No new SwiftLint violations.
• The in-flight claim is load-bearing: removing the filter fails 5 tests, including does not send a batch again when a delivery is asked for while one is in flight.
• DiagnosticReporterSpec.testRetries flaked once under load and passed on re-run; it has a 0.1 s timeout and is unrelated to these changes.

---

Note

Overview
Summary
Introduces a disk-backed event processing pipeline with DirectEventProcessor, EventStore, DiskEventLog, and coordinated components (EventCommitter, EventDeliveryScheduler, AnalyticsEventSender, OutboundEventBuffer, BackgroundEventDelivery) so analytics batches survive process death, recover safely, and respect byte/age budgets.

Configuration & API
Adds EventPersistence modes plus eventCapacityBytes, eventMaxAge, and eventDeliveryDelay, raises default eventCapacity, and exposes matching Objective-C surfaces. LDClient now wires eventProcessor instead of EventReporter, delays diagnostics until the processor’s launch gate opens, and centralizes background commit/delivery handling without blocking the instances queue. Flush APIs, docs, and Obj-C shims were rewritten to commit to disk, bypass backoff when required, and report aggregated outcomes.

Infrastructure
Extends CRC helpers, HTTP response parsing for retry semantics, BackgroundActivity/SystemCapabilities platform hooks, regenerated mocks (EventProcessorMock, manual DiagnosticCachingMock), and comprehensive Quick/Nimble coverage (EventStoreSpec, BackgroundEventDeliverySpec, EventProcessorOutcomesSpec, renamed DirectEventProcessorSpec).

^{Reviewed by Cursor Bugbot for commit 3f8bab5. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Failed in-memory close drops events

Low Severity

If assembleBody fails while closing staged frames into in-memory batches, the remaining frames are uncounted and discarded instead of being put back. Those events are not reported as lost, so a later flush can still return success. This is the close path used when persistence is off or a write has already failed.

 

^{Reviewed by Cursor Bugbot for commit 7bebd16. Configure here.}

[cursor]

Current version of PR was reviewed by /review-bugbot with additional instructions on Nov 5, 23:10 PST. It flagged 0 findings.

^{Bugbot on commit bcbde8a is skipped.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3f8bab5. Configure here.}

[cursor]

Close overlaps a concurrent client start

Medium Severity

close() now clears instances before internalClose() runs, so another thread can observe get() as nil and call start() while the old clients are still committing and delivering. Two EventStores then share one directory: the new client can recover and send a batch the closing client is still posting, duplicating events. Previously start() waited on instancesQueue until teardown finished, so this overlap could not happen.

 

^{Reviewed by Cursor Bugbot for commit 3f8bab5. Configure here.}