fix: address remaining native check review comments

Author: sunnylqm

NATIVE_CHECK_FOLLOWUPS.md

@@ -125,8 +125,8 @@ Android 与 Harmony 只有任务串行化,没有按 hash 去重,也不保护已
 
 **复评补充(181952a 引入/暴露)——下载轮次时限应作为一个整体设计统一三端**:
 1. 整轮 600s deadline 只落了 Android;iOS 仍逐 URL 600s(上界
-   attempts×urls×600s,可达 90 分钟),Harmony 完全没有(慢滴 CDN 每
-   <60s 一字节即可绕过下载任务的不活动看门狗,轮次可跑数小时);
+   attempts×urls×600s,可达 90 分钟),Harmony 完全没有(慢滴 CDN 在每个
+   60 秒窗口内返回至少一个字节即可绕过下载任务的不活动看门狗,轮次可跑数小时);
 2. Android 的 deadline 在下一个下载**已发起后**才检查——超时轮次仍会
    多启动一个孤儿下载,浪费带宽且可能与 JS 重试并发写版本文件
    (修法:发起前先查);

src/__tests__/client.test.ts

@@ -1451,6 +1451,23 @@ describe('syncNativeConfig', () => {
     expect(config.afterDownload).toBe('setNeedUpdate');
   });
 
+  test('persists an explicit disabled state when the config becomes invalid', async () => {
+    const syncNativeConfig = mock(() => Promise.resolve());
+    setupClientMocks({ syncNativeConfig });
+    const { Pushy } = await importFreshClient('sync-config-disabled');
+    const client = new Pushy({ appKey: 'demo-app' });
+
+    client.setOptions({ appKey: '' });
+    await Promise.resolve();
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(syncNativeConfig).toHaveBeenCalledTimes(2);
+    expect(
+      JSON.parse((syncNativeConfig.mock.calls.at(-1) as unknown as string[])[0])
+    ).toEqual({ disabled: true });
+  });
+
   test('persists and exposes the effective overridden package version', async () => {
     const syncNativeConfig = mock(() => Promise.resolve());
     setupClientMocks({ syncNativeConfig });

src/__tests__/provider.render.test.tsx

@@ -146,6 +146,23 @@ describe('UpdateProvider rendering', () => {
     expect(mockAlert).not.toHaveBeenCalled();
   });
 
+  test('an expired app package without a bundle hash keeps its download action', async () => {
+    const client = createClient({ updateStrategy: 'alwaysAlert' });
+    client.checkUpdate.mockImplementation(async () => ({
+      expired: true,
+      update: true,
+      downloadUrl: 'https://cdn.example.com/app-release.apk',
+    }));
+
+    await renderProvider(client);
+
+    expect(client.reportInvalidUpdateOnce).not.toHaveBeenCalled();
+    expect(mockAlert).toHaveBeenCalledTimes(1);
+    const [, , buttons] = mockAlert.mock.calls[0] as any[];
+    expect(buttons).toHaveLength(1);
+    expect(buttons[0].text).toBe('alert_update_button');
+  });
+
   test('an update without a downloadable artifact is never shown as actionable', async () => {
     const client = createClient({ updateStrategy: 'alwaysAlert' });
     client.checkUpdate.mockImplementation(async () => ({

src/client.ts

@@ -96,6 +96,11 @@ const cloneServerConfig = (server: UpdateServerConfig): UpdateServerConfig => ({
   queryUrls: server.queryUrls ? [...server.queryUrls] : undefined,
 });
 
+// Persist an object (rather than an empty string) so every native bridge keeps
+// accepting the payload while the orchestrators treat the missing appKey and
+// endpoints as an explicit disabled state.
+const NATIVE_CONFIG_DISABLED_JSON = '{"disabled":true}';
+
 const excludeConfiguredEndpoints = (
   endpoints: string[],
   configuredEndpoints: string[]
@@ -339,10 +344,14 @@ export class Pushy {
   };
 
   private syncNativeConfig = () => {
-    const configJson = this.getNativeConfigJson();
-    if (!configJson) {
+    if (
+      Platform.OS === 'web' ||
+      typeof PushyModule.syncNativeConfig !== 'function'
+    ) {
       return;
     }
+    const configJson =
+      this.getNativeConfigJson() ?? NATIVE_CONFIG_DISABLED_JSON;
     // Always record the latest desired value, even when it matches the last
     // completed write. Example: A synced -> B in flight -> options revert to
     // A. Comparing only with synced(A) would drop the revert and leave native

src/provider.tsx

@@ -234,6 +234,7 @@ export const UpdateProvider = ({
         log
       );
       if (
+        !info.expired &&
         info.update &&
         (typeof info.hash !== 'string' || info.hash.length === 0)
       ) {