From 72c7d3b28d1568db3e50ad26593f566b8215889f Mon Sep 17 00:00:00 2001
From: John Carlo San Pedro <johncarlo.sanpedro@immutable.com>
Date: Wed, 8 Jul 2026 17:41:54 +1200
Subject: [PATCH 1/2] fix(audience): stop mutating queued events on consent
 change (SDK-647)

Consent changes now gate only future collection; events already recorded
keep the consent level (and userId) they were captured under. Under GDPR
the applicable consent is the one in force at capture time, so there is no
need to retroactively rewrite or purge already-queued events.

- SetConsent(None) no longer purges the queue (session teardown and
  anonymous-id wipe are unchanged); previously-recorded events are sent.
- SetConsent(Full -> Anonymous) no longer strips userId / drops
  identify+alias from queued events.
- Remove now-dead EventQueue.ApplyAnonymousDowngrade and the DiskStore
  rewrite helpers.

The record-time consent gate in EnqueueChecked is retained: an in-flight
event still finalises its consent at the moment it is enqueued (Unity's
threading analog of stamping at capture time). It never rewrites events
already in the queue.
---
 .../SampleApp/Scripts/AudienceSample.cs       |  8 +-
 .../Tests/Runtime/SampleAppLiveFireTests.cs   |  5 +-
 .../Audience/Runtime/ImmutableAudience.cs     | 33 +++----
 .../Audience/Runtime/Transport/DiskStore.cs   | 92 +------------------
 .../Audience/Runtime/Transport/EventQueue.cs  | 38 ++------
 .../Tests/Runtime/Core/SessionTests.cs        | 23 +++--
 .../Tests/Runtime/ImmutableAudienceTests.cs   | 78 +++++++++-------
 .../Tests/Runtime/Transport/DiskStoreTests.cs | 84 -----------------
 8 files changed, 86 insertions(+), 275 deletions(-)

diff --git a/examples/audience/Assets/SampleApp/Scripts/AudienceSample.cs b/examples/audience/Assets/SampleApp/Scripts/AudienceSample.cs
index 8d5dfcf75..26e304251 100644
--- a/examples/audience/Assets/SampleApp/Scripts/AudienceSample.cs
+++ b/examples/audience/Assets/SampleApp/Scripts/AudienceSample.cs
@@ -176,9 +176,9 @@ private void OnSendCustomEvent() => RunAndLog("track()", () =>
 
         // ---- SDK action handlers: consent ----
 
-        // None purges the queue + clears the anonymous ID; dropping below Full
-        // clears UserId. Mirror is reset whenever the new level can no longer
-        // identify.
+        // None clears the anonymous ID and stops future collection; already-queued
+        // events are kept. Dropping below Full clears UserId. Mirror is reset
+        // whenever the new level can no longer identify.
         private void OnSetConsent(ConsentLevel level) => RunAndLog("setConsent()", () =>
         {
             var previous = ImmutableAudience.CurrentConsent;
@@ -191,7 +191,7 @@ private void OnSetConsent(ConsentLevel level) => RunAndLog("setConsent()", () =>
             };
             var effects = new List<string>();
             if (previous == ConsentLevel.None && level != ConsentLevel.None) effects.Add("queue started, session created");
-            if (level == ConsentLevel.None) effects.Add("queue purged, anonymous ID cleared");
+            if (level == ConsentLevel.None) effects.Add("tracking stopped, anonymous ID cleared (queued events kept)");
             if (!level.CanIdentify() && previous.CanIdentify()) effects.Add("userId cleared");
             if (effects.Count > 0) payload["effects"] = effects;
             OnSdkStateChanged();
diff --git a/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs b/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs
index a009c2ba0..0210ad0ec 100644
--- a/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs
+++ b/examples/audience/Assets/SampleApp/Tests/Runtime/SampleAppLiveFireTests.cs
@@ -266,7 +266,7 @@ public IEnumerator Alias_AndFlush_FlushReportsOk()
         }
 
         [UnityTest]
-        public IEnumerator SetConsent_None_PurgesQueueAndPersists()
+        public IEnumerator SetConsent_None_KeepsQueueAndPersists()
         {
             // Init at default Anonymous; enqueue an event; revoke; flush. No errors.
             yield return LoadAndInit();
@@ -276,7 +276,8 @@ public IEnumerator SetConsent_None_PurgesQueueAndPersists()
 
             yield return SetConsentVia(SampleAppUi.Buttons.ConsentNone);
 
-            // Flushing after revocation should be a no-op (queue purged). No error.
+            // Events recorded before revocation are kept (consent is determined at
+            // capture time), so flushing sends them without error.
             _root.Q<Button>(SampleAppUi.Buttons.Flush).Click();
             yield return _twoSeconds;
 
diff --git a/src/Packages/Audience/Runtime/ImmutableAudience.cs b/src/Packages/Audience/Runtime/ImmutableAudience.cs
index 58b5cb6ef..2eba4b213 100644
--- a/src/Packages/Audience/Runtime/ImmutableAudience.cs
+++ b/src/Packages/Audience/Runtime/ImmutableAudience.cs
@@ -629,20 +629,17 @@ public static void SetConsent(ConsentLevel level)
 
             // Phase 1 under _initLock: atomic _state swap and _session swap.
             // Phase 2 outside the lock runs the blocking side effects (persist,
-            // dispose, purge, downgrade, backend sync, new session_start) so a
-            // concurrent Shutdown / Init / Reset isn't held waiting on them.
+            // dispose, backend sync, new session_start) so a concurrent
+            // Shutdown / Init / Reset isn't held waiting on them.
             ConsentLevel previous;
-            EventQueue? queue;
             Session? oldSession = null;
             Session? newSession = null;
-            bool downgradeFullToAnonymous = false;
 
             lock (_initLock)
             {
                 if (!_initialized) return;
 
                 config = _config;
-                queue = _queue;
                 if (config == null) return;
 
                 var previousState = _state;
@@ -664,10 +661,6 @@ public static void SetConsent(ConsentLevel level)
                     oldSession = _session;
                     _session = null;
                 }
-                else if (previous == ConsentLevel.Full && level == ConsentLevel.Anonymous)
-                {
-                    downgradeFullToAnonymous = true;
-                }
                 else if (previous == ConsentLevel.None && _session == null)
                 {
                     // Upgrade from None: allocate + publish the new Session under
@@ -693,21 +686,17 @@ public static void SetConsent(ConsentLevel level)
 
             if (level == ConsentLevel.None)
             {
+                // Events already queued keep the consent level (and userId) they
+                // were recorded with; a consent change only gates future
+                // collection (GDPR: consent is determined at capture time). The
+                // session is disposed and identity wiped so nothing new is
+                // captured, but previously-recorded events are not purged.
                 oldSession?.Dispose();
-                queue?.PurgeAll();
                 Identity.Reset(config.PersistentDataPath!);
             }
-            else if (downgradeFullToAnonymous)
-            {
-                // Synchronous: EventQueue.ApplyAnonymousDowngrade holds _drainLock
-                // while it rewrites on-disk files, blocking the in-queue drain
-                // and shutting the race with HttpTransport. See the method's comment.
-                queue?.ApplyAnonymousDowngrade();
-            }
 
             newSession?.Start();
 
-
             SyncConsentToBackend(config, level, anonymousIdForPut);
         }
 
@@ -1027,9 +1016,11 @@ internal static void ResetState()
         private static Dictionary<string, object>? SnapshotCallerDict(Dictionary<string, object>? src) =>
             src != null ? new Dictionary<string, object>(src) : null;
 
-        // Checks the current consent inside the drain lock. If consent has
-        // since dropped to None the message is discarded. If it dropped to
-        // Anonymous the userId is stripped.
+        // Finalises consent at the moment the event is recorded (enqueued),
+        // inside the drain lock. If consent has since dropped to None the
+        // message is discarded; if it dropped to Anonymous the userId is
+        // stripped. This gates the in-flight event only -- events already in
+        // the queue are never rewritten by a later consent change.
         private static void EnqueueTrack(Dictionary<string, object>? msg)
         {
             MergeUnityContext(msg);
diff --git a/src/Packages/Audience/Runtime/Transport/DiskStore.cs b/src/Packages/Audience/Runtime/Transport/DiskStore.cs
index 1b2c4d148..bee2c2c48 100644
--- a/src/Packages/Audience/Runtime/Transport/DiskStore.cs
+++ b/src/Packages/Audience/Runtime/Transport/DiskStore.cs
@@ -2,7 +2,6 @@
 
 using System;
 using System.Collections.Generic;
-using System.Diagnostics.CodeAnalysis;
 using System.IO;
 using System.Linq;
 
@@ -54,7 +53,7 @@ internal IReadOnlyList<string> ReadBatch(int maxSize)
             var result = new List<string>();
 
             // Sort by filename (ticks prefix), oldest first.
-            // Missing queue dir is empty queue. Matches DeleteAll / ApplyAnonymousDowngrade.
+            // Missing queue dir is empty queue. Matches DeleteAll.
             string[] paths;
             try { paths = Directory.GetFiles(_queueDir, "*.json"); }
             catch (DirectoryNotFoundException) { return Array.Empty<string>(); }
@@ -119,94 +118,5 @@ internal void DeleteAll()
                 TryDelete(path);
         }
 
-        // Drops queued identify/alias files, strips userId from track files.
-        // Unparseable files are deleted to fail closed.
-        internal void ApplyAnonymousDowngrade()
-        {
-            string[] paths;
-            try { paths = Directory.GetFiles(_queueDir, "*.json"); }
-            catch (DirectoryNotFoundException) { return; }
-
-            foreach (var path in paths)
-                ApplyAnonymousDowngradeToFile(path);
-        }
-
-        private void ApplyAnonymousDowngradeToFile(string path)
-        {
-            if (!TryReadMessage(path, out var msg) ||
-                !msg.TryGetValue(MessageFields.Type, out var typeObj) ||
-                !(typeObj is string type))
-            {
-                TryDelete(path);
-                return;
-            }
-
-            if (IsIdentityMessage(type))
-            {
-                TryDelete(path);
-                return;
-            }
-
-            if (type == MessageTypes.Track && TrackNeedsDowngradeToAnonymous(msg))
-                RewriteTrackForAnonymous(path, msg);
-        }
-
-        // A queued track needs rewriting on a Full -> Anonymous downgrade if it
-        // still carries a userId or a consentLevel other than "anonymous". The
-        // check keeps already-anonymous messages untouched so a fail-closed
-        // rewrite error can only ever discard events that actually had to change.
-        private static bool TrackNeedsDowngradeToAnonymous(Dictionary<string, object> msg)
-        {
-            if (msg.ContainsKey(MessageFields.UserId)) return true;
-            return !(msg.TryGetValue(MessageFields.ConsentLevel, out var cl)
-                     && cl is string s
-                     && s == ConsentLevel.Anonymous.ToLowercaseString());
-        }
-
-        private static bool IsIdentityMessage(string type) =>
-            type == MessageTypes.Identify || type == MessageTypes.Alias;
-
-        private static bool TryReadMessage(string path, [NotNullWhen(true)] out Dictionary<string, object>? msg)
-        {
-            msg = null;
-            string json;
-            try { json = File.ReadAllText(path); }
-            catch (IOException) { return false; }
-            catch (UnauthorizedAccessException) { return false; }
-
-            try { msg = JsonReader.DeserializeObject(json); }
-            catch (FormatException) { return false; }
-
-            return true;
-        }
-
-        private void RewriteTrackForAnonymous(string path, Dictionary<string, object> msg)
-        {
-            msg.Remove(MessageFields.UserId);
-            msg[MessageFields.ConsentLevel] = ConsentLevel.Anonymous.ToLowercaseString();
-
-            try
-            {
-                var rewritten = Json.Serialize(msg);
-                var tmp = path + ".tmp";
-                File.WriteAllText(tmp, rewritten);
-                try { File.Move(tmp, path); }
-                catch (IOException)
-                {
-                    File.Delete(path);
-                    File.Move(tmp, path);
-                }
-            }
-            catch (IOException)
-            {
-                // Delete rather than leave the old userId-bearing payload.
-                TryDelete(path);
-            }
-            catch (UnauthorizedAccessException)
-            {
-                TryDelete(path);
-            }
-        }
-
     }
 }
diff --git a/src/Packages/Audience/Runtime/Transport/EventQueue.cs b/src/Packages/Audience/Runtime/Transport/EventQueue.cs
index 2890542f6..30fa13a64 100644
--- a/src/Packages/Audience/Runtime/Transport/EventQueue.cs
+++ b/src/Packages/Audience/Runtime/Transport/EventQueue.cs
@@ -26,8 +26,8 @@ private readonly ConcurrentQueue<Dictionary<string, object>> _memory
         private readonly Thread _drainThread;
         private readonly ManualResetEventSlim _flushGate = new ManualResetEventSlim(false);
 
-        // Serialises drain vs PurgeAll / ApplyAnonymousDowngrade. Without it, a
-        // TryDequeue'd event could hit disk after DeleteAll already cleared it.
+        // Serialises drain vs PurgeAll. Without it, a TryDequeue'd event could
+        // hit disk after DeleteAll already cleared it.
         private readonly object _drainLock = new object();
 
         private volatile bool _disposed;
@@ -71,11 +71,13 @@ internal void Enqueue(Dictionary<string, object>? msg)
         }
 
         // Queues the message under the drain lock. The caller supplies a
-        // transform that runs while the lock is held; it can edit the
-        // message or return null to drop it. Running under the lock means
-        // PurgeAll and ApplyAnonymousDowngrade can't slip in mid-decision, so
-        // a Track that races a consent downgrade gets its userId stripped or
-        // the message dropped before it reaches the queue.
+        // transform that runs while the lock is held; it can edit the message
+        // or return null to drop it. The transform stamps consent at the moment
+        // of recording: a Track that races a consent downgrade gets its userId
+        // stripped or the message dropped before it enters the queue. Running
+        // under the lock also keeps PurgeAll (consent reset via Reset) from
+        // slipping in mid-decision. Events already in the queue are never
+        // rewritten by a later consent change.
         internal void EnqueueChecked(
             Dictionary<string, object>? msg,
             Func<Dictionary<string, object>, Dictionary<string, object>?>? transform)
@@ -105,7 +107,7 @@ internal void FlushSync()
         }
 
         // Discards every pending event, in-memory and on disk. Used on
-        // consent revocation.
+        // Reset (logout) to drop the previous user's unsent events.
         internal void PurgeAll()
         {
             // Hold _drainLock so the background drain can't sneak a TryDequeue'd
@@ -118,26 +120,6 @@ internal void PurgeAll()
             }
         }
 
-        // Synchronous: a Task.Run offload would race HttpTransport, which
-        // does not take _drainLock, opening a window where userId-bearing
-        // track files could ship during the rewrite.
-        internal void ApplyAnonymousDowngrade()
-        {
-            lock (_drainLock)
-            {
-                // Drain any pending in-memory events first so they hit disk and
-                // get the same filtering as everything already persisted.
-                while (_memory.TryDequeue(out var msg))
-                {
-                    try { _store.Write(Json.Serialize(msg)); }
-                    catch (IOException) { /* best-effort */ }
-                    catch (UnauthorizedAccessException) { /* best-effort */ }
-                }
-
-                _store.ApplyAnonymousDowngrade();
-            }
-        }
-
         // Flushes all pending events to disk and stops the drain thread.
         // Safe to call multiple times.
         internal void Shutdown()
diff --git a/src/Packages/Audience/Tests/Runtime/Core/SessionTests.cs b/src/Packages/Audience/Tests/Runtime/Core/SessionTests.cs
index a3f948a29..58cd8888a 100644
--- a/src/Packages/Audience/Tests/Runtime/Core/SessionTests.cs
+++ b/src/Packages/Audience/Tests/Runtime/Core/SessionTests.cs
@@ -774,10 +774,9 @@ private AudienceConfig MakeConfig(ConsentLevel consent = ConsentLevel.Anonymous)
         }
 
         // Reads every queued event file. Returns an empty array when the
-        // queue directory has not been created yet (SetConsent(None) purges
-        // it, Init with ConsentLevel.None never writes one) so tests can
-        // assert "no such event" without a DirectoryNotFoundException crash
-        // masking the real signal.
+        // queue directory has not been created yet (Init with ConsentLevel.None
+        // never writes one) so tests can assert "no such event" without a
+        // DirectoryNotFoundException crash masking the real signal.
         private string[] ReadQueueFiles()
         {
             var queueDir = Path.Combine(_testDir, "imtbl_audience", "queue");
@@ -920,20 +919,20 @@ public void Reset_ConsentNone_DoesNotStartSession()
         [Test]
         public void SetConsent_AnonymousToNone_DoesNotEmitSessionEnd()
         {
-            // Consent revocation purges the queue and disposes the session.
-            // Session.Dispose fires End → Track("session_end"), but by the
-            // time End runs the consent level has already been flipped to
-            // None, so CanTrack gates the track call. No session_end event
-            // should appear on disk. Regression guard: a future reorder of
-            // "flip consent" vs "dispose session" would silently leak a
-            // session_end that the consent-revocation promise forbids.
+            // Consent revocation disposes the session. Session.Dispose fires
+            // End → Track("session_end"), but by the time End runs the consent
+            // level has already been flipped to None, so CanTrack gates the
+            // track call. No session_end event should be recorded. Regression
+            // guard: a future reorder of "flip consent" vs "dispose session"
+            // would silently record a session_end that the consent-revocation
+            // promise forbids.
             ImmutableAudience.Init(MakeConfig(ConsentLevel.Anonymous));
             ImmutableAudience.SetConsent(ConsentLevel.None);
             ImmutableAudience.Shutdown();
 
             Assert.IsFalse(
                 ReadQueueFiles().Any(c => c.Contains("\"session_end\"")),
-                "SetConsent(None) must not leak a session_end event past the queue purge");
+                "SetConsent(None) must not record a session_end event after revocation");
         }
 
         private class KeepOnDiskHandler : System.Net.Http.HttpMessageHandler
diff --git a/src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs b/src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs
index 771251981..3316c7556 100644
--- a/src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs
+++ b/src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs
@@ -891,36 +891,40 @@ public void Reset_DiscardsQueuedEventsOnDisk()
         }
 
         // -----------------------------------------------------------------
-        // SetConsent: purge + persistence
+        // SetConsent: queue retention + persistence
         // -----------------------------------------------------------------
 
         [Test]
-        public void SetConsent_DowngradeToNone_PurgesQueueOnDiskAndInMemory()
+        public void SetConsent_DowngradeToNone_KeepsQueuedEvents()
         {
             ImmutableAudience.Init(MakeConfig());
 
             ImmutableAudience.Track("event_under_old_consent");
 
             var queueDir = AudiencePaths.QueueDir(_testDir);
-            // Force memory → disk so we can verify the purge wipes both layers.
             ImmutableAudience.FlushQueueToDiskForTesting();
-            Assert.Greater(Directory.GetFiles(queueDir, "*.json").Length, 0,
+            var before = Directory.GetFiles(queueDir, "*.json").Length;
+            Assert.Greater(before, 0,
                 "precondition: events queued before downgrade exist on disk");
 
             ImmutableAudience.SetConsent(ConsentLevel.None);
 
-            Assert.AreEqual(0, Directory.GetFiles(queueDir, "*.json").Length,
-                "downgrade to None must purge queued events from disk so they can't leak after revocation");
+            // A consent change gates only future collection; events already
+            // recorded keep the consent they were captured under and are not
+            // purged (GDPR: consent is determined at capture time).
+            Assert.AreEqual(before, Directory.GetFiles(queueDir, "*.json").Length,
+                "downgrade to None must not purge already-queued events");
         }
 
         [Test]
-        public void SetConsent_DowngradeToNone_DropsInFlightTrack_ThatRacesThePurge()
+        public void SetConsent_DowngradeToNone_DropsInFlightTrack_RecordedAfterRevocation()
         {
             // Reproduces the window where a Track call observed consent=Anonymous,
             // built its message, and is about to enqueue, while a concurrent
-            // SetConsent(None) sets consent and purges. Without the re-check inside
-            // the drain lock, the enqueue lands after the purge and the event leaks
-            // to disk past revocation.
+            // SetConsent(None) revokes consent. The event is recorded (enqueued)
+            // after revocation, so the record-time consent gate inside the drain
+            // lock must drop it. Without the re-check, the enqueue lands post-
+            // revocation and the event is recorded despite consent being None.
             ImmutableAudience.Init(MakeConfig(ConsentLevel.Anonymous));
 
             // Drain the game_launch that Init auto-fires so the assertion below is
@@ -930,7 +934,7 @@ public void SetConsent_DowngradeToNone_DropsInFlightTrack_ThatRacesThePurge()
             foreach (var f in Directory.GetFiles(queueDir, "*.json")) File.Delete(f);
 
             // Gate the Track thread so it's poised to enqueue at the moment SetConsent
-            // completes its purge. We approximate the race by kicking Track off a
+            // flips consent to None. We approximate the race by kicking Track off a
             // threadpool thread and racing SetConsent after a tiny stagger; if the
             // re-check is missing, this leaks deterministically under contention over
             // repeated runs.
@@ -954,7 +958,7 @@ public void SetConsent_DowngradeToNone_DropsInFlightTrack_ThatRacesThePurge()
                 : 0;
 
             Assert.AreEqual(0, leaked,
-                "Track that raced SetConsent(None) must not leak past the purge");
+                "Track that raced SetConsent(None) must not be recorded after revocation");
         }
 
         [Test]
@@ -963,10 +967,10 @@ public void SetConsent_DowngradeToNone_StressTest_NoLeak()
             // The single-shot race test above can pass trivially if Track finishes
             // before SetConsent starts on a fast machine. This stress variant runs
             // the race many times with many concurrent Track threads so at least
-            // some iterations are guaranteed to land the enqueue inside the
-            // _state=None/PurgeAll window.
+            // some iterations are guaranteed to land the enqueue after _state has
+            // flipped to None.
             //
-            // Without the EnqueueChecked re-check, this test leaks events
+            // Without the EnqueueChecked re-check, this test records events
             // reproducibly. With the fix, zero leaks across all iterations.
             const int iterations = 200;
             const int trackersPerIteration = 4;
@@ -1148,14 +1152,18 @@ public void SetConsent_ConcurrentUpgradeFromNone_StartsOneSession_StressTest()
         public void SetConsent_DowngradeToAnonymous_StressTest_NoUserIdLeak()
         {
             // Full → Anonymous race: Track reads _state with userId still set,
-            // then SetConsent flips _state to Anonymous and calls
-            // ApplyAnonymousDowngrade (one-shot rewrite). If Track's enqueue
-            // lands after the rewrite, the msg with userId is not stripped.
+            // then SetConsent flips _state to Anonymous. If Track's enqueue lands
+            // after the flip, the record-time consent gate must strip the userId
+            // so the event is recorded under the consent in force at enqueue.
             //
             // With the ConsentState + EnqueueChecked transform in place, Track's
             // transform runs under _drainLock and strips userId when current state
             // is not Full. Zero leaks across all iterations.
             //
+            // Note: this covers the in-flight enqueue race only. Events already
+            // recorded before the downgrade keep the userId/consent they were
+            // captured with and are intentionally not rewritten.
+            //
             // Sabotage: remove the `m.Remove(MessageFields.UserId)` in
             // EnqueueTrack and this test leaks reproducibly.
             const int iterations = 200;
@@ -2054,7 +2062,7 @@ public void Shutdown_ReleasesInitLock_BeforeBlockingTeardown()
         // -----------------------------------------------------------------
 
         [Test]
-        public void FullToAnonymous_StripsUserIdFromQueuedTrackAndDropsIdentifyAlias()
+        public void FullToAnonymous_KeepsQueuedIdentifyAliasAndUserId()
         {
             ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
 
@@ -2067,21 +2075,25 @@ public void FullToAnonymous_StripsUserIdFromQueuedTrackAndDropsIdentifyAlias()
             ImmutableAudience.SetConsent(ConsentLevel.Anonymous);
 
             var queueDir = AudiencePaths.QueueDir(_testDir);
-            var files = Directory.GetFiles(queueDir, "*.json");
+            var msgs = Directory.GetFiles(queueDir, "*.json")
+                .Select(f => JsonReader.DeserializeObject(File.ReadAllText(f)))
+                .ToList();
 
-            foreach (var f in files)
-            {
-                var msg = JsonReader.DeserializeObject(File.ReadAllText(f));
-                var type = (string)msg["type"];
-                Assert.AreNotEqual("identify", type, "identify must be purged on Full -> Anonymous");
-                Assert.AreNotEqual("alias", type, "alias must be purged on Full -> Anonymous");
-                if (type == "track")
-                {
-                    Assert.IsFalse(msg.ContainsKey("userId"), "userId must be stripped from queued track on Full -> Anonymous");
-                    Assert.AreEqual("anonymous", msg["consentLevel"],
-                        "consentLevel must be downgraded to anonymous on queued track");
-                }
-            }
+            // Events recorded under Full keep the identity and consent they were
+            // captured with; a downgrade only gates future collection and must
+            // not rewrite or drop already-queued events.
+            Assert.IsTrue(msgs.Any(m => (string)m["type"] == "identify"),
+                "queued identify must be retained on Full -> Anonymous");
+            Assert.IsTrue(msgs.Any(m => (string)m["type"] == "alias"),
+                "queued alias must be retained on Full -> Anonymous");
+
+            var track = msgs.First(m => (string)m["type"] == "track"
+                && m.ContainsKey("eventName")
+                && (string)m["eventName"] == "tracked_before_downgrade");
+            Assert.AreEqual("player_steam", track["userId"],
+                "queued track must keep the userId it was captured with under Full");
+            Assert.AreEqual("full", track["consentLevel"],
+                "queued track must keep the consentLevel it was captured with under Full");
         }
 
         [Test]
diff --git a/src/Packages/Audience/Tests/Runtime/Transport/DiskStoreTests.cs b/src/Packages/Audience/Tests/Runtime/Transport/DiskStoreTests.cs
index a6b7e2cc2..268aa4275 100644
--- a/src/Packages/Audience/Tests/Runtime/Transport/DiskStoreTests.cs
+++ b/src/Packages/Audience/Tests/Runtime/Transport/DiskStoreTests.cs
@@ -160,89 +160,5 @@ public void CrashRecovery_PicksUpFilesFromPreviousRun()
 
             Assert.AreEqual(1, batch.Count, "crash-surviving file should be picked up on next init");
         }
-
-        [Test]
-        public void ApplyAnonymousDowngrade_DeletesIdentifyAndAlias_StripsUserIdFromTrack()
-        {
-            _store.Write("{\"type\":\"identify\",\"anonymousId\":\"a\",\"userId\":\"u\"}");
-            _store.Write("{\"type\":\"alias\",\"fromId\":\"a\",\"toId\":\"u\"}");
-            _store.Write("{\"type\":\"track\",\"eventName\":\"x\",\"anonymousId\":\"a\",\"userId\":\"u\",\"consentLevel\":\"full\"}");
-            _store.Write("{\"type\":\"track\",\"eventName\":\"y\",\"anonymousId\":\"a\",\"consentLevel\":\"full\"}");
-
-            _store.ApplyAnonymousDowngrade();
-
-            var remaining = _store.ReadBatch(100);
-            Assert.AreEqual(2, remaining.Count, "identify and alias files should be deleted");
-
-            foreach (var path in remaining)
-            {
-                var json = File.ReadAllText(path);
-                var msg = JsonReader.DeserializeObject(json);
-                Assert.AreEqual("track", msg["type"]);
-                Assert.IsFalse(msg.ContainsKey("userId"), "userId must be stripped from queued track messages");
-                // consentLevel must be normalised to anonymous, even for the track
-                // that never carried a userId (full-but-unidentified).
-                Assert.AreEqual("anonymous", msg["consentLevel"],
-                    "consentLevel must be downgraded to anonymous on queued track messages");
-            }
-        }
-
-        [Test]
-        public void ApplyAnonymousDowngrade_TrackWithoutConsentLevel_GainsAnonymous()
-        {
-            // A track persisted by a pre-consentLevel build (no consentLevel field)
-            // is normalised to anonymous on downgrade rather than left unset.
-            _store.Write("{\"type\":\"track\",\"eventName\":\"legacy\",\"anonymousId\":\"a\"}");
-
-            _store.ApplyAnonymousDowngrade();
-
-            var remaining = _store.ReadBatch(10);
-            Assert.AreEqual(1, remaining.Count);
-            var msg = JsonReader.DeserializeObject(File.ReadAllText(remaining[0]));
-            Assert.AreEqual("anonymous", msg["consentLevel"]);
-        }
-
-        [Test]
-        public void ApplyAnonymousDowngrade_PurchaseValue_RoundsTripsExactlyForRealisticPrices()
-        {
-            // Pinning test: the JsonReader -> Json.Serialize rewrite path
-            // turns decimals into doubles. Assert that the realistic range of
-            // Purchase.Value amounts (typical two-decimal prices, free item,
-            // AAA-tier bundle) survives the rewrite without drift.
-            string[] realisticAmounts = { "0.99", "4.99", "9.99", "19.99", "49.99", "99.99", "149.99" };
-
-            foreach (var amount in realisticAmounts)
-            {
-                // Fresh store per iteration to keep assertions clean.
-                TearDown();
-                SetUp();
-
-                var json = "{\"type\":\"track\",\"eventName\":\"purchase\",\"anonymousId\":\"a\",\"userId\":\"u\","
-                    + "\"properties\":{\"currency\":\"USD\",\"value\":" + amount + "}}";
-                _store.Write(json);
-
-                _store.ApplyAnonymousDowngrade();
-
-                var rewritten = _store.ReadBatch(10);
-                Assert.AreEqual(1, rewritten.Count);
-                var rewrittenJson = File.ReadAllText(rewritten[0]);
-                StringAssert.Contains("\"value\":" + amount, rewrittenJson,
-                    $"Purchase.Value {amount} must round-trip exactly through the downgrade rewrite");
-            }
-        }
-
-        [Test]
-        public void ApplyAnonymousDowngrade_DeletesMalformedFiles()
-        {
-            // Seed the queue directory with a file that is not valid JSON so the
-            // downgrade cannot leave it to potentially leak identified data.
-            var queueDir = AudiencePaths.QueueDir(_testDir);
-            var badName = $"{DateTime.UtcNow.Ticks}_{Guid.NewGuid():N}.json";
-            File.WriteAllText(Path.Combine(queueDir, badName), "{not valid json");
-
-            _store.ApplyAnonymousDowngrade();
-
-            Assert.AreEqual(0, _store.ReadBatch(10).Count, "malformed file must not survive downgrade");
-        }
     }
 }

From 9cecb3fdaa593d3491f509d28bcee0ef14469fa2 Mon Sep 17 00:00:00 2001
From: Natalie Bunduwongse <natalie.bunduwongse@immutable.com>
Date: Fri, 10 Jul 2026 10:06:38 +1200
Subject: [PATCH 2/2] fix(audience): make consent-race tests deterministic
 instead of thread-scheduling-dependent

The three SetConsent-vs-Track race tests relied on ManualResetEventSlim/Barrier
handoffs to make a tracker thread's enqueue land after SetConsent's state flip.
In practice the signalling thread always got a scheduling head start, so the
enqueue consistently completed before the flip -- failing deterministically
in CI regardless of iteration count. Replaced with a GatedEvent (IEvent whose
ToProperties blocks) that pins the race window precisely: Track snapshots
state and parks mid-flight, SetConsent runs to completion, then the tracker
is released, guaranteeing every enqueue lands after the flip.
---
 .../Tests/Runtime/ImmutableAudienceTests.cs   | 216 +++++++++---------
 1 file changed, 107 insertions(+), 109 deletions(-)

diff --git a/src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs b/src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs
index 3316c7556..52a9f1780 100644
--- a/src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs
+++ b/src/Packages/Audience/Tests/Runtime/ImmutableAudienceTests.cs
@@ -916,6 +916,34 @@ public void SetConsent_DowngradeToNone_KeepsQueuedEvents()
                 "downgrade to None must not purge already-queued events");
         }
 
+        // Blocks inside ToProperties -- called by Track after it has already
+        // snapshotted _state but before the message is built and enqueued --
+        // until the test signals Proceed. This pins the race window deterministically
+        // instead of hoping a real thread loses a scheduling race against SetConsent.
+        private class GatedEvent : IEvent
+        {
+            private readonly ManualResetEventSlim _ready = new ManualResetEventSlim(false);
+            private readonly ManualResetEventSlim _proceed = new ManualResetEventSlim(false);
+
+            public string EventName { get; }
+
+            public GatedEvent(string eventName) => EventName = eventName;
+
+            public Dictionary<string, object> ToProperties()
+            {
+                _ready.Set();
+                _proceed.Wait(TimeSpan.FromSeconds(5));
+                return new Dictionary<string, object>();
+            }
+
+            // Blocks until Track has captured the pre-flip state and is
+            // parked in ToProperties, poised to build and enqueue.
+            public void WaitUntilReady() =>
+                Assert.IsTrue(_ready.Wait(TimeSpan.FromSeconds(5)), "Track did not reach the gate in time");
+
+            public void Proceed() => _proceed.Set();
+        }
+
         [Test]
         public void SetConsent_DowngradeToNone_DropsInFlightTrack_RecordedAfterRevocation()
         {
@@ -933,20 +961,15 @@ public void SetConsent_DowngradeToNone_DropsInFlightTrack_RecordedAfterRevocatio
             var queueDir = AudiencePaths.QueueDir(_testDir);
             foreach (var f in Directory.GetFiles(queueDir, "*.json")) File.Delete(f);
 
-            // Gate the Track thread so it's poised to enqueue at the moment SetConsent
-            // flips consent to None. We approximate the race by kicking Track off a
-            // threadpool thread and racing SetConsent after a tiny stagger; if the
-            // re-check is missing, this leaks deterministically under contention over
-            // repeated runs.
-            var trackStarted = new ManualResetEventSlim(false);
-            var trackTask = Task.Run(() =>
-            {
-                trackStarted.Set();
-                ImmutableAudience.Track("racing_event");
-            });
+            // Track snapshots _state (Anonymous) then parks in ToProperties.
+            // SetConsent(None) runs to completion while it's parked, so the
+            // enqueue that follows Proceed() is guaranteed to land after the flip.
+            var evt = new GatedEvent("racing_event");
+            var trackTask = Task.Run(() => ImmutableAudience.Track(evt));
 
-            trackStarted.Wait();
+            evt.WaitUntilReady();
             ImmutableAudience.SetConsent(ConsentLevel.None);
+            evt.Proceed();
             trackTask.Wait(TimeSpan.FromSeconds(5));
 
             // Flush any residue that a faulty Enqueue may have pushed to memory.
@@ -964,67 +987,51 @@ public void SetConsent_DowngradeToNone_DropsInFlightTrack_RecordedAfterRevocatio
         [Test]
         public void SetConsent_DowngradeToNone_StressTest_NoLeak()
         {
-            // The single-shot race test above can pass trivially if Track finishes
-            // before SetConsent starts on a fast machine. This stress variant runs
-            // the race many times with many concurrent Track threads so at least
-            // some iterations are guaranteed to land the enqueue after _state has
-            // flipped to None.
+            // Multi-tracker variant of the single-shot test above: several
+            // Track calls all park mid-flight (post state-snapshot, pre-enqueue)
+            // simultaneously, then SetConsent(None) runs to completion before
+            // any of them is released, so every enqueue lands after the flip
+            // and must be dropped -- also exercising concurrent contention on
+            // EventQueue's drain lock.
             //
             // Without the EnqueueChecked re-check, this test records events
-            // reproducibly. With the fix, zero leaks across all iterations.
-            const int iterations = 200;
+            // reproducibly. With the fix, zero leaks.
             const int trackersPerIteration = 4;
 
-            for (int iter = 0; iter < iterations; iter++)
-            {
-                ImmutableAudience.Init(MakeConfig(ConsentLevel.Anonymous));
-
-                // Clear game_launch so only race events can leak.
-                ImmutableAudience.FlushQueueToDiskForTesting();
-                var queueDir = AudiencePaths.QueueDir(_testDir);
-                if (Directory.Exists(queueDir))
-                    foreach (var f in Directory.GetFiles(queueDir, "*.json")) File.Delete(f);
-
-                // All trackers spin up and block on the barrier so they all release
-                // simultaneously. The main thread joins the barrier too and fires
-                // SetConsent immediately after release, maximising contention.
-                var barrier = new Barrier(trackersPerIteration + 1);
-                var trackers = new Task[trackersPerIteration];
-                for (int t = 0; t < trackersPerIteration; t++)
-                {
-                    trackers[t] = Task.Run(() =>
-                    {
-                        barrier.SignalAndWait();
-                        ImmutableAudience.Track("race_stress");
-                    });
-                }
+            ImmutableAudience.Init(MakeConfig(ConsentLevel.Anonymous));
 
-                barrier.SignalAndWait();
-                ImmutableAudience.SetConsent(ConsentLevel.None);
-                Task.WaitAll(trackers, TimeSpan.FromSeconds(5));
+            // Clear game_launch so only race events can leak.
+            ImmutableAudience.FlushQueueToDiskForTesting();
+            var queueDir = AudiencePaths.QueueDir(_testDir);
+            if (Directory.Exists(queueDir))
+                foreach (var f in Directory.GetFiles(queueDir, "*.json")) File.Delete(f);
 
-                // Anything the drain loop hasn't picked up yet → force it.
-                ImmutableAudience.FlushQueueToDiskForTesting();
+            var events = new GatedEvent[trackersPerIteration];
+            var trackers = new Task[trackersPerIteration];
+            for (int t = 0; t < trackersPerIteration; t++)
+            {
+                var evt = new GatedEvent("race_stress");
+                events[t] = evt;
+                trackers[t] = Task.Run(() => ImmutableAudience.Track(evt));
+            }
 
-                int leaked = 0;
-                if (Directory.Exists(queueDir))
-                {
-                    leaked = Directory.GetFiles(queueDir, "*.json")
-                        .Select(File.ReadAllText)
-                        .Count(c => c.Contains("\"race_stress\""));
-                }
+            foreach (var evt in events) evt.WaitUntilReady();
+            ImmutableAudience.SetConsent(ConsentLevel.None);
+            foreach (var evt in events) evt.Proceed();
+            Task.WaitAll(trackers, TimeSpan.FromSeconds(5));
 
-                if (leaked > 0)
-                {
-                    Assert.Fail(
-                        $"iteration {iter}: {leaked} race_stress events leaked past SetConsent(None)");
-                }
+            // Anything the drain loop hasn't picked up yet → force it.
+            ImmutableAudience.FlushQueueToDiskForTesting();
 
-                ImmutableAudience.ResetState();
-                // Clean state for next iteration so consent isn't carried via disk.
-                if (Directory.Exists(AudiencePaths.AudienceDir(_testDir)))
-                    Directory.Delete(AudiencePaths.AudienceDir(_testDir), recursive: true);
+            int leaked = 0;
+            if (Directory.Exists(queueDir))
+            {
+                leaked = Directory.GetFiles(queueDir, "*.json")
+                    .Select(File.ReadAllText)
+                    .Count(c => c.Contains("\"race_stress\""));
             }
+
+            Assert.AreEqual(0, leaked, "race_stress events must not be recorded after SetConsent(None)");
         }
 
         [Test]
@@ -1151,14 +1158,18 @@ public void SetConsent_ConcurrentUpgradeFromNone_StartsOneSession_StressTest()
         [Test]
         public void SetConsent_DowngradeToAnonymous_StressTest_NoUserIdLeak()
         {
-            // Full → Anonymous race: Track reads _state with userId still set,
-            // then SetConsent flips _state to Anonymous. If Track's enqueue lands
-            // after the flip, the record-time consent gate must strip the userId
-            // so the event is recorded under the consent in force at enqueue.
+            // Full → Anonymous race: several Track calls snapshot _state with
+            // userId still set, then park mid-flight (post-snapshot, pre-enqueue)
+            // via GatedEvent. SetConsent(Anonymous) flips _state to completion
+            // while they're parked, so every enqueue that follows is guaranteed
+            // to land after the flip and the record-time consent gate must strip
+            // the userId so the event is recorded under the consent in force at
+            // enqueue.
             //
             // With the ConsentState + EnqueueChecked transform in place, Track's
             // transform runs under _drainLock and strips userId when current state
-            // is not Full. Zero leaks across all iterations.
+            // is not Full. Also exercises concurrent contention on the drain lock
+            // across multiple simultaneously-released trackers.
             //
             // Note: this covers the in-flight enqueue race only. Events already
             // recorded before the downgrade keep the userId/consent they were
@@ -1166,56 +1177,43 @@ public void SetConsent_DowngradeToAnonymous_StressTest_NoUserIdLeak()
             //
             // Sabotage: remove the `m.Remove(MessageFields.UserId)` in
             // EnqueueTrack and this test leaks reproducibly.
-            const int iterations = 200;
             const int trackersPerIteration = 4;
             const string testUserId = "user_race_stress";
 
-            for (int iter = 0; iter < iterations; iter++)
-            {
-                ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
-                ImmutableAudience.Identify(testUserId, IdentityType.Steam);
-
-                // Clear Init events so only race events can leak.
-                ImmutableAudience.FlushQueueToDiskForTesting();
-                var queueDir = AudiencePaths.QueueDir(_testDir);
-                if (Directory.Exists(queueDir))
-                    foreach (var f in Directory.GetFiles(queueDir, "*.json")) File.Delete(f);
-
-                var barrier = new Barrier(trackersPerIteration + 1);
-                var trackers = new Task[trackersPerIteration];
-                for (int t = 0; t < trackersPerIteration; t++)
-                {
-                    trackers[t] = Task.Run(() =>
-                    {
-                        barrier.SignalAndWait();
-                        ImmutableAudience.Track("race_stress");
-                    });
-                }
+            ImmutableAudience.Init(MakeConfig(ConsentLevel.Full));
+            ImmutableAudience.Identify(testUserId, IdentityType.Steam);
 
-                barrier.SignalAndWait();
-                ImmutableAudience.SetConsent(ConsentLevel.Anonymous);
-                Task.WaitAll(trackers, TimeSpan.FromSeconds(5));
+            // Clear Init events so only race events can leak.
+            ImmutableAudience.FlushQueueToDiskForTesting();
+            var queueDir = AudiencePaths.QueueDir(_testDir);
+            if (Directory.Exists(queueDir))
+                foreach (var f in Directory.GetFiles(queueDir, "*.json")) File.Delete(f);
 
-                ImmutableAudience.FlushQueueToDiskForTesting();
+            var events = new GatedEvent[trackersPerIteration];
+            var trackers = new Task[trackersPerIteration];
+            for (int t = 0; t < trackersPerIteration; t++)
+            {
+                var evt = new GatedEvent("race_stress");
+                events[t] = evt;
+                trackers[t] = Task.Run(() => ImmutableAudience.Track(evt));
+            }
 
-                int userIdLeaks = 0;
-                if (Directory.Exists(queueDir))
-                {
-                    userIdLeaks = Directory.GetFiles(queueDir, "*.json")
-                        .Select(File.ReadAllText)
-                        .Count(c => c.Contains($"\"{testUserId}\""));
-                }
+            foreach (var evt in events) evt.WaitUntilReady();
+            ImmutableAudience.SetConsent(ConsentLevel.Anonymous);
+            foreach (var evt in events) evt.Proceed();
+            Task.WaitAll(trackers, TimeSpan.FromSeconds(5));
 
-                if (userIdLeaks > 0)
-                {
-                    Assert.Fail(
-                        $"iteration {iter}: {userIdLeaks} track events retained userId past SetConsent(Anonymous)");
-                }
+            ImmutableAudience.FlushQueueToDiskForTesting();
 
-                ImmutableAudience.ResetState();
-                if (Directory.Exists(AudiencePaths.AudienceDir(_testDir)))
-                    Directory.Delete(AudiencePaths.AudienceDir(_testDir), recursive: true);
+            int userIdLeaks = 0;
+            if (Directory.Exists(queueDir))
+            {
+                userIdLeaks = Directory.GetFiles(queueDir, "*.json")
+                    .Select(File.ReadAllText)
+                    .Count(c => c.Contains($"\"{testUserId}\""));
             }
+
+            Assert.AreEqual(0, userIdLeaks, "track events must not retain userId past SetConsent(Anonymous)");
         }
 
         [Test]