v0.9.1 — native crash handler hardening

Production-audit hardening (no API/ABI change): bounds-checked ELF NOTE parsing (OOB read fix), atomic_flag async-signal-safe re-entry guard, explicit CURLOPT_SSL_VERIFYPEER/VERIFYHOST, breadcrumb slot scrub on consent-revoke/GDPR, and tombstone_version() corrected to 0.9.1. See CHANGELOG.

v0.9.0 — in-process native crash handler (experimental)

In-process async-signal-safe native crash handler (Linux/Android), opt-in via options.enable_native_crash_handler (default off).

• Catches SIGSEGV/ABRT/BUS/ILL/FPE/TRAP; write()-only dump over a pre-opened fd against a pre-captured module table (dl_iterate_phdr + NT_GNU_BUILD_ID), on a pre-allocated sigaltstack, with a re-entrance guard.
• Captures PC (+LR on ARM) as (module, build-id, offset) frames — no on-device symbolication; done server-side against uploaded symbols.
• Chains to any pre-existing handler (Unity / UGS Cloud Diagnostics), then re-raises the default so the process dies with the true signal.
• Dump picked up at the next launch and reported with crashType + osSignal; supersedes the generic unclean-shutdown, while a restored managed crash still wins.
• Fail-soft no-op on unsupported platforms (Windows SEH / iOS Mach are follow-ups). 3-OS CI green incl. a Linux fork/SIGSEGV chaining integration test.

Full notes: CHANGELOG.md.

v0.8.0 - device identity, never anonymous

Identity: never anonymous (0.8.0)

• Persistent device identity: at init the SDK acquires a stable dev_<16hex> provisional user id — derived from the machine id (Windows MachineGuid, Linux /etc/machine-id, macOS gethostuuid), hashed (FNV-1a-64) and salted per game; the raw machine id never leaves the device. Persisted in <data_dir>/identity (the file wins across launches and token rotation). Every payload now carries a user id — no more anonymous rows.
• Same-session identity upgrade: tombstone_set_user("real-id") keeps the session id and carries priorUserId on heartbeats (and any crash/bug sent meanwhile) until a beat is acked — the server merges the session's pre-auth rows under the authenticated id, scoped per session (one device can host multiple accounts).
• tombstone_set_user(NULL/"") reverts to the device id and cancels the pending merge marker.
• Steady-state payloads are byte-identical to 0.7.1. New tombstone::device_identity core unit with its own ctest suite (18 suites total). Server-side merge requires Tombstack deployed 2026-07-10 or later (older servers ignore the extra field).

v0.7.1 — locale-independent JSON formatting (fixes heartbeat loss in comma-decimal locales)

Patch release on top of v0.7.0.

Fixed: JsonWriter number formatting honored the process-global LC_NUMERIC — a host game calling setlocale(LC_NUMERIC, "de_DE") (common in localized titles) made doubles print a decimal comma, producing invalid JSON that poisoned the entire payload the number rode on: the server rejected the whole heartbeat, silently losing CCU, user metadata and frame stats for every player in that locale. Numbers are now normalized to a . decimal separator regardless of locale (the Unity SDK's CultureInfo.InvariantCulture guard, ported), with regression tests covering comma-decimal locales.

Upgrade: drop-in for 0.7.0 (no API/ABI change since 0.7.0 — the 0.7.0 ABI note still applies if coming from 0.6.x: recompile against the 0.7 header).

Verified by CI on Windows (MSVC /W4 /WX), Ubuntu (GCC) and macOS (Clang) — all 17 ctest suites.

v0.7.0 — StartSession gate, user metadata, frame stats, Retry-After, pre-init buffering

Unity-0.15-parity pass for the Tombstack Native SDK (C99 ABI, C++17 core). Five new capabilities:

• StartSession first-beat gate — tombstone_start_session() + auto_start_session option (default on = unchanged behavior). Turn it off, set identity/environment/metadata, then start: the FIRST heartbeat carries the real player instead of anonymous/production. Crash & bug reports still send while gated.
• User metadata — tombstone_set_user_metadata (≤16 pairs, key ≤64 / value ≤512, server-mirrored clamps); delivered on heartbeats with change-detection (only when differing from the last acked map).
• Frame stats — tombstone_report_frame(frame_ms) (⚠ milliseconds; not async-signal-safe): allocation-free accumulator emitting fpsAvg / slowFramePct (>33.4 ms) / hitchCount (>250 ms) / worstFrameMs per heartbeat — same fields and thresholds as the Unity SDK, so native and Unity frame data are comparable in the same dashboards.
• Retry-After honoring — 429/503 responses with a Retry-After header extend the backoff (max of ladder vs header, capped 300 s).
• Pre-init buffering — breadcrumbs/events/metrics/identity/environment/metadata/consent calls before tombstone_init are buffered (bounded) and replayed in order at init; explicit Set* beats the init option.

ABI note — recompile required: the options struct grew (auto_start_session); consumers must recompile against the 0.7 header.

Verified by CI on Windows (MSVC /W4 /WX), Ubuntu (GCC) and macOS (Clang) — 17 ctest suites including new StartGate latch, pre-init replay, frame-stats math, Retry-After parsing and multithread hammer tests.

Build from source (one CMake invocation): cmake -S . -B build && cmake --build build. Requires libcurl (FetchContent fallback included).

Scope note: the SDK reports crashes you hand it plus unclean-shutdown detection — automatic SEH/signal handlers and minidump capture are Phase 2.

v0.6.0 — device specs, fleet labels, deployment environments

Unity-parity wire features for the Tombstack Native SDK (C99 ABI, C++17 core):

• Device specs — tombstone_set_device (model/CPU/GPU/RAM/VRAM/screen/engine…); attached to crashes & bug reports and rides heartbeats until one is acked (powers hardware profiles + hardware retention cohorts on the dashboard).
• Deployment environments — tombstone_set_environment (or the init option); stamped on every payload; drives the dashboard environment filter.
• Fleet labels — tombstone_set_server_info(region, hostname) for dedicated-server heartbeats.
• Dedicated-server identity — tombstone_mark_dedicated_server flips the role to server without a match (registers in the Fleet view; excluded from CCU billing).

Build from source (one CMake invocation, CI-proven on Windows/Linux/macOS): cmake -S . -B build && cmake --build build. Requires libcurl (FetchContent fallback included).

Scope note: the SDK reports crashes you hand it (tombstone_report_crash) plus unclean-shutdown detection on next launch — automatic SEH/signal handlers and minidump capture are Phase 2.

Tombstone Native SDK v0.5.0

Fulfilment-nonce carry (S1), ingest HMAC request signing (S3, X-Tombstone-Signature), auto RTT metric + per-name sampling (K1), set_level breadcrumb (K2), diagnostics API (K3). CI green on Windows/Linux/macOS.

Tombstone Native SDK v0.4.1

Audit fixes: heartbeat now carries role/serverId/matchId (dedicated servers register in Fleet + match/server-targeted log-pulls are honored); worker batch drainer guarded against host-terminating throws; report_crash pre-flushes buffered events/metrics. CI green on Windows/Linux/macOS.

Tombstone Native SDK v0.4.0

Log-pull control plane: tombstone_request_player_logs + tombstone_on_anomalous_disconnect (server-triggered + automatic player-log retrieval), and transparent client honoring of pull requests delivered on the heartbeat ack (consent-gated, off-thread, fail-soft). CI green on Windows/Linux/macOS.

Tombstone Native SDK v0.3.0

Event + metric batching: tombstone_track_metric + bounded drop-oldest buffers (cap 256) flushed off-thread on count/age/shutdown to /ingest/events:batch and /ingest/metrics:batch. Each item keeps its own occurredAtIso; the envelope carries sentAtIso. Crashes/bugs/heartbeats remain individual + write-ahead durable. Zero idle allocation; CI green on Windows/Linux/macOS.