[OskarEichler]

Description

One Line Summary

Synchronize dictionary insertion, lookup, consumption and invalidation across native delivery callbacks and React module calls. Consume before scheduling display, keep SDK/display calls outside the lock, and remove the unused prevention dictionary.

Compatibility and observable changes

No automatic timeout or display policy change. Suppressed notifications remain deferred; explicit display still runs on the main queue. No public signature or native dependency changes.

Details

Motivation

The source audit reproduced the failure paths described below. This PR contains only the associated fix; unrelated audit changes are in separate PRs.

Scope

• ios/RCTOneSignal/RCTOneSignalEventEmitter.mm

Testing

Six compiled Objective-C/Foundation cases using actual method bodies and an instrumented dictionary; three reproduce overlapping baseline accesses. Native SDK 5.5.6 forwards delivery directly from the notification callback, while React uses a separate module method queue. Device end-to-end push delivery is not claimed.

Each code/tooling fix was also applied independently to upstream commit a70312207cf094ac361eaa9196c317acb175c2cd and passed its targeted external actual-source diagnostics. Documentation snippets were checked separately. Native diagnostic harnesses use bridge/SDK doubles and are not an end-to-end push test.

On the combined audit branch:

• Existing SDK suite: 5 files, 262 tests pass; unchanged 95% coverage thresholds pass.
• vp check: formatting, lint and type checks pass; native Spotless check passes.
• Both example apps: Android Debug and unsigned iOS Simulator builds pass.
• Both example apps: iOS and Android production Metro bundles pass.

No checked-in test files were added or modified; regression evidence comes from external diagnostic harnesses and the existing suite. No physical-device, live notification delivery, Appium/BrowserStack, or release-workflow execution is claimed. The no-location example's stale native lock was updated locally to resolve the current SDK for verification; generated locks are not part of this PR.

Checklist

• Required description sections completed.
• Scope and observable/API behavior explained.
• Diff reviewed and targeted regression checks run.
• Automated checks and device-testing limitations documented.