1.0.2

Fixed

• First launches no longer count as two sessions. The session id used to be minted only at the
  first foreground, after install had already been recorded with no session id, and a
  session-id-less event opens its own session server-side, so every first launch produced one
  session holding install and another holding session.start. The id is now minted at
  client startup whenever a fresh session is inevitable (a first launch, or a relaunch after
  sessionTimeout), so install and every event recorded before the first foreground carry
  the same session id that session.start then adopts, and the server folds them into one
  session. The pre-minted id is persisted as unadopted: if the process dies before its first
  foreground, the next launch reuses it, so the session install opened still receives its
  session.start. Resumed sessions behave exactly as before.
• The environment correction now retries. A fresh install's very first ask can find no cached
  AppTransaction (and the fetch can fail on an offline first launch), and 1.0.1 asked
  exactly once per process, so such installs kept the appstore guess for the whole run. The
  store is re-asked at every flush until it answers, and a flush waits at most three seconds
  for it, so a slow or offline first launch cannot delay sending; a late answer corrects the
  label for everything still queued and everything that follows.
• The heartbeat's timing now survives a relaunch. The last-heartbeat stamp was memory only, so
  quitting and relaunching inside the session timeout beat again immediately and slightly
  inflated the additive presence and session-length rollups. The stamp is persisted alongside
  the last-active stamp and honored at startup, so a relaunch beats only once the heartbeat
  interval has genuinely passed.
• A test seeded with a label equal to the iOS Simulator host's own environment guess no longer
  fails there, and a formatting violation is fixed, so the whole CI matrix is green again.

Added

• Failed sends now back off. After a retryable failure (offline, 429, 5xx), automatic
  delivery waits exponentially longer between attempts, with jitter, capped at 60 seconds and
  reset by any successful send, and a numeric Retry-After on a 429 is honored as the floor
  for that wait. An explicit AppGlance.flush() still attempts immediately.

Changed

• Publishing a release is now gated on CI: the release workflow runs the full lint, build and
  test matrix first and publishes only when everything passes.
• The README and the doc comments describe the TestFlight versus App Store split as currently
  known to behave: the mapping from the store's signed AppTransaction is in place and
  covered by tests, but on-device confirmation from a real TestFlight install is still
  pending, and TestFlight installs have been observed reporting appstore in the field.