When sessionisation breaks on hybrid apps

A session is not a gift from the SDK. It is a policy: how long a pause may last before we say the person left. Hybrid apps violate that policy without asking. A webview reloads, the JavaScript clock resets, and App Analytics reports a second visit while the user is still staring at a paywall they opened thirty seconds ago.

We have seen background timers on Android emit a heartbeat that looks like engagement. We have seen iOS hand a webview a new anonymous ID after a memory warning. Funnel Forensics students now begin by drawing the process boundary, not the funnel. If you cannot say which process owns the session clock, you do not have a session. You have two clocks arguing.

The fix is rarely “buy a better session feature”. It is to define timeout in one place, native-side, and to treat webview events as children of that clock. It is to stop counting a JavaScript page_view as a new visit when the native shell never backgrounded.

Write the policy in the limitation note. QA can test a timeout. They cannot test a vibe. If your vendor’s default is thirty minutes, say so, and say whether you overrode it. Hybrid apps that inherit the default plus a webview default are measuring a collision.

Bring a device to Mobile Instrumentation Lab if you want this argued over a cable, not a slide.