AppSessionTracker class

Session id, install/session counters, and foreground duration — one place every feature reads instead of each hand-rolling its own "first open"/"session count" bookkeeping.

One session per process: current is set once at construction (cold start) — sequence is persisted and incremented exactly once per construction, satisfying "cold start increments count exactly once" without any extra bookkeeping.

Foreground duration uses Stopwatch (real elapsed time), not nowMsClamped — a duration measurement doesn't care about wall-clock anomalies, only real elapsed time, and Stopwatch gives that directly. Time spent backgrounded is never added to it.

Resume policy: a resume that follows less than sessionTimeout of background time continues the same session (foreground duration keeps accumulating). A resume after longer than that starts a brand new session (new SessionInfo.sessionId, SessionInfo.sequence bumped, foreground duration reset) — the common "session timeout" convention most mobile analytics SDKs use.

Corrupt/negative sequence: a hand-edited or corrupted persisted sequence that reads negative is clamped to 0 before incrementing — never propagates a negative value forward, and a fresh cold start after corruption always reports at least sequence 1.

Consent gate: analyticsContext returns {} unless ConsentCategory.analytics is granted on the registered ConsentStateService (FEAT-61) — this tracker never sends anything itself, but a caller attaching this context to an analytics event must not leak session/install data before consent.