diff --git a/.gitignore b/.gitignore
index 0e7dffa5d..2b742bc74 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,4 +21,6 @@ iOS_SDK/Carthage/Build
 .build/
 
 examples/demo/App/Secrets.plist
-examples/demo/Local.xcconfig
\ No newline at end of file
+examples/demo/Local.xcconfig
+examples/demo/scripts/retry/.state/
+examples/demo/scripts/retry/__pycache__/
diff --git a/examples/demo/scripts/retry/README.md b/examples/demo/scripts/retry/README.md
new file mode 100644
index 000000000..c368f3456
--- /dev/null
+++ b/examples/demo/scripts/retry/README.md
@@ -0,0 +1,128 @@
+# Retry test harness
+
+Injects failures into the SDK's requests from the demo app, so executor retries and backoff can be
+watched and checked. A [mitmproxy](https://mitmproxy.org) addon fails only requests that carry the
+SDK's `SDK-Version` header. The demo's own REST calls and all other traffic pass through. Only
+`onesignal.com` traffic is decrypted.
+
+```bash
+brew install mitmproxy mobile-dev-inc/tap/maestro
+cd examples/demo/scripts/retry
+./retry-test.sh help
+```
+
+[Maestro](https://maestro.mobile.dev) drives the demo's UI (`tap`) through the flows in `flows/`.
+
+## Setup
+
+1. `xcrun simctl create "OneSignal Retry Test" "iPhone 17"`. The harness uses its own simulator
+   (`RETRY_TEST_DEVICE`, by name or UDID) because the other OneSignal demos share the bundle ID.
+2. `./retry-test.sh install` builds the demo and installs it there.
+3. `./retry-test.sh start` starts mitmproxy on port 8899, points the Mac's Wi-Fi/Ethernet HTTP(S)
+   proxy at it (the simulator uses the Mac's proxy), and trusts its CA on the simulator.
+4. `./retry-test.sh fresh`, then `./retry-test.sh tap allow-notifications`. The permission prompt
+   holds the app inactive, so foreground retries never fire while it is showing. `fresh` wipes the
+   demo's data without reinstalling, so the permission is kept from then on.
+5. In another terminal, `./retry-test.sh watch` follows each SDK request.
+6. When done, **`./retry-test.sh stop`** restores the Mac's proxy settings.
+
+Leave the Mac's proxy alone with `RETRY_TEST_PROXY_MODE=local` (mitmproxy captures the `App`
+process, which needs its network extension approved once). For a physical device, use
+`RETRY_TEST_PROXY_MODE=manual` and set the device's Wi-Fi proxy to the Mac, as `start` explains.
+
+## Commands
+
+| Command | Does |
+| --- | --- |
+| `fail <route> <status> [--times N] [--retry-after S] [--add]` | Fail matching requests. Status `0` drops the connection, like being offline. Without `--times` it fails until `clear`. `--add` keeps earlier rules. Applies right away. |
+| `clear` / `rules` | Remove or show the rules |
+| `report [regex]` | Per route: each attempt, the gap since the previous one, and the gap expected |
+| `reset-log` | Forget recorded attempts, for example between scenarios |
+| `tap <action> [args]` | Use the demo: `add-tag <key> <value>`, `add-alias <label> <id>`, `add-email <email>`, `login <external id> [jwt]`, `update-jwt <external id> [jwt]`, `logout`, `toggle-push`, `pause-iams`, `allow-notifications`. With `RETRY_TEST_IV_KEY` set, `login` and `update-jwt` sign a JWT when none is given |
+| `jwt <external id> [label=id] [email:addr] [sms:number]` | Print an Identity Verification JWT, valid for an hour, that claims those aliases and subscriptions |
+| `install` | Build the demo and install it on the simulator |
+| `fresh` / `relaunch` | New install without reinstalling / kill and relaunch |
+| `background` / `foreground` | Background the demo by opening Settings / bring it back |
+| `network-flap [s]` | Turn the Mac's Wi-Fi off for `s` seconds (default 10). Drops your Mac's connection too. |
+| `logs` | Stream the demo's SDK request and retry logs |
+
+Routes: `create-user`, `fetch-user`, `update-user` (tags, language, session data), `identity` (add
+alias and login's Identify User share it), `remove-alias`, `create-sub`, `update-sub`,
+`delete-sub`, `identity-by-sub`, `custom-events`, `all`.
+
+## Reading `report`
+
+```
+POST apps/<app>/users  (User executor)
+    #     time status     body      gap         expected  note
+    1     0.0s   408* edc1f203
+    2     2.8s   408* 8f1a8f24     2.8s         2.5-5.0s  executor backoff #1
+    3    11.4s   408* d85e5a15     8.6s        5.0-10.0s  executor backoff #2
+    4    31.0s   201  3a910c5a    19.6s       10.0-20.0s  executor backoff #3
+```
+
+What the SDK should do:
+
+- **Executor backoff**: 5s, doubling to 300s, times a jitter of 0.5 to 1. `Retry-After` is the
+  minimum wait (capped at 1h), and a 429 without one waits 60s.
+- **Client reattempts first**: `OneSignalClient` itself re-sends a 5xx or status 0 four times
+  (5, 15, 45, 135s) before the executor sees the failure. That count is kept per request for the
+  run, so later failures of the same request go straight to the executor backoff. Use a
+  retryable status the client does not reattempt, like **408**, to see the executor backoff right
+  away. The client resends ignore foreground and network return, so after going offline, requests
+  can wait for the next client resend (up to 135s).
+- **Every executor resends on the 5s poll**, so the window allows up to 5s more.
+- **Foreground, and network return while in the foreground, end the executor backoff early**, but
+  not `Retry-After`. `EARLY` right after those is expected. One case happens without you doing
+  anything: at cold start, the first failure often lands just before the app goes active, so the
+  second attempt follows within a second.
+- `body` is a hash of the request body. A new hash on each attempt is normal, since bodies hold
+  timestamps.
+- Attempts are grouped by method and path with IDs left out, so two requests on one route in the
+  same window (two logins, or a session update and a tag) share one series. `reset-log` between
+  scenarios, and run one action at a time.
+
+## Scenarios
+
+Run `reset-log` before each one. Unless noted, the request should succeed after the last failure,
+and nothing should need a relaunch.
+
+1. **Exponential backoff, User executor**: `fail create-user 408 --times 4`, then `fresh`. Gaps
+   should fall in the windows above, then 201.
+2. **Repo executor**: `fail update-user 408 --times 3`, then `tap add-tag k v`. The PATCH
+   retries on the next poll after each backoff.
+3. **Retry-After**: `fail update-user 429 --times 2 --retry-after 20`, then `tap add-tag k v`. Gaps of at
+   least 20s. `background` then `foreground` during the wait must not cut it short.
+4. **429 without Retry-After**: `fail update-user 429 --times 1`, then `tap add-tag k v`. About 60s.
+5. **5xx**: `fail update-user 503 --times 6`, then `tap add-tag k v`. Four client reattempts (5, 15, 45,
+   135s), then executor backoff. Slow, about 3.5 minutes.
+6. **Offline**: `fail all 0`, then `tap add-tag k v`, `tap add-alias l i` and `tap add-email e`.
+   Wait for a few failures, then `clear`. Everything goes out by its next client resend or backoff.
+7. **Foreground ends the backoff**: `fail create-user 408 --times 6`, then `fresh`. After about
+   25s, `background`, wait, `foreground`. An attempt goes out right as the app becomes active.
+8. **Network return**: as in 7, but `network-flap 5` with the app in the foreground. An attempt goes
+   out when Wi-Fi comes back. Repeat with the app in the background: no attempt then.
+9. **Order is kept**: `fail create-user 408 --times 3`, then `fresh` and `tap login <id>` during the
+   failures. Identify User (PATCH `.../identity`) is not sent until Create User succeeds.
+10. **Fetch User**: `fail fetch-user 408 --times 3`, then `tap login <id>`.
+    Fetch User retries in the same run, and later user requests wait for it.
+11. **Kill during backoff**: `fail update-user 408`, `tap add-tag k v`, wait for two failures, `clear`,
+    then `relaunch`. The cached request is sent right after launch.
+12. **Non-retryable is not retried**: `fail update-user 400 --times 1`, then `tap add-tag k v`. One attempt,
+    no retries.
+13. **Update Subscription no longer retries every 5s**: `fail update-sub 408 --times 4`, then
+    `tap toggle-push`. Gaps grow instead of repeating every 5s.
+14. **Login/logout while failing**: `fail all 408`, `tap login b`, `tap logout`, `tap login c`, then
+    `clear`. Requests for each user go out in order, with no errors about the wrong user.
+15. **Identity Verification**: needs an app with Identity Verification on and its ES256 private
+    key. Ask the SDK team for both and keep the key outside the repo. Set the app's ID as
+    `ONESIGNAL_APP_ID` in `examples/demo/App/Secrets.plist` and `install` again, then set
+    `RETRY_TEST_IV_APP_ID=<app id>` and `RETRY_TEST_IV_KEY=<path to the key>`. `tap login <id>` now
+    signs a JWT. No anonymous Create User is sent, so in 1 and 9 the Create User comes from the
+    login. If the app has in-app messages, `tap pause-iams` first, or a message can take a `tap`.
+    Repeat 1, 2, 6 and 9. In 6, log in first with a JWT that claims the alias and email:
+    `tap login <id> "$(./retry-test.sh jwt <id> l=i email:e)"`. To see a token rejected in the middle of
+    retries, `fail create-user 408 --times 2` and log in with a token signed by another key. After
+    the 401 nothing is sent until `tap update-jwt <id>`. `report` treats a 401 or 403 as holding the
+    request, with its retry counts, only when the request carried a Bearer token. Create User keeps
+    its counts after any 4xx, since the SDK resends it on the next session.
diff --git a/examples/demo/scripts/retry/fault_proxy.py b/examples/demo/scripts/retry/fault_proxy.py
new file mode 100644
index 000000000..326d5a20f
--- /dev/null
+++ b/examples/demo/scripts/retry/fault_proxy.py
@@ -0,0 +1,126 @@
+"""
+mitmproxy addon that injects failures into OneSignal SDK requests so executor retries can be
+observed in the demo app. Driven by `retry-test.sh`; see README.md.
+
+Only requests carrying the SDK's `SDK-Version` header are touched, so the demo's own REST calls
+pass through. Every SDK request is appended to attempts.jsonl for `retry-test.sh report`.
+
+Rules are re-read whenever rules.json changes. Each rule:
+  {"id": "1f3a9c2e", "route": "update-user", "method": "PATCH", "path": "<regex>", "status": 503,
+   "retry_after": "30", "times": 3}
+`status` 0 drops the connection (the SDK sees status 0, like being offline). `times` is how many
+matching requests fail before the rule passes them through; null fails forever.
+"""
+
+import hashlib
+import json
+import os
+import re
+import time
+
+from mitmproxy import http
+
+STATE_DIR = os.environ["RETRY_TEST_STATE_DIR"]
+RULES_PATH = os.path.join(STATE_DIR, "rules.json")
+ATTEMPTS_PATH = os.path.join(STATE_DIR, "attempts.jsonl")
+
+API_PATH_PREFIX = re.compile(r"^/(api/v1/)?")
+
+
+def body_hash(raw):
+    # Key order can change between attempts of the same request, so hash the parsed JSON.
+    try:
+        raw = json.dumps(json.loads(raw), sort_keys=True).encode()
+    except ValueError:
+        pass
+    return hashlib.sha1(raw).hexdigest()[:8]
+
+
+class FaultProxy:
+    def __init__(self):
+        self.rules_mtime = None
+        self.rules = []
+        self.remaining = []
+
+    def load_rules(self):
+        try:
+            mtime = os.stat(RULES_PATH).st_mtime_ns
+        except FileNotFoundError:
+            mtime = None
+        if mtime == self.rules_mtime:
+            return
+        self.rules_mtime = mtime
+        old_remaining = {rule["id"]: left for rule, left in zip(self.rules, self.remaining) if rule.get("id")}
+        self.rules = []
+        if mtime is not None:
+            with open(RULES_PATH) as f:
+                self.rules = json.load(f)
+        # `fail --add` rewrites the earlier rules with their ids; keep the counts they have used up.
+        # Every `fail` issues a new id, so re-issuing an identical rule starts a fresh count.
+        self.remaining = [
+            old_remaining[rule["id"]] if rule.get("id") in old_remaining else rule.get("times")
+            for rule in self.rules
+        ]
+        print(f"[fault] rules: {json.dumps(self.rules) if self.rules else 'none, passing everything'}")
+
+    def match(self, flow):
+        path = API_PATH_PREFIX.sub("", flow.request.path.split("?")[0])
+        for i, rule in enumerate(self.rules):
+            if rule.get("method") and rule["method"] != flow.request.method:
+                continue
+            if not re.search(rule["path"], path):
+                continue
+            if self.remaining[i] is not None:
+                if self.remaining[i] <= 0:
+                    continue
+                self.remaining[i] -= 1
+            return rule
+        return None
+
+    def request(self, flow: http.HTTPFlow):
+        if "onesignal.com" not in flow.request.pretty_host or "SDK-Version" not in flow.request.headers:
+            return
+        self.load_rules()
+        rule = self.match(flow)
+        flow.metadata["fault_rule"] = rule
+        if rule is None:
+            return
+        if rule["status"] == 0:
+            self.record(flow, 0, rule)
+            flow.kill()
+            return
+        headers = {"Content-Type": "application/json"}
+        if rule.get("retry_after") is not None:
+            headers["Retry-After"] = str(rule["retry_after"])
+        body = json.dumps({"errors": [{"title": f"Injected by fault_proxy ({rule['route']})"}]})
+        flow.response = http.Response.make(rule["status"], body, headers)
+
+    def response(self, flow: http.HTTPFlow):
+        if "fault_rule" not in flow.metadata:
+            return
+        self.record(flow, flow.response.status_code, flow.metadata["fault_rule"])
+
+    def error(self, flow: http.HTTPFlow):
+        if "fault_rule" in flow.metadata and flow.metadata["fault_rule"] is None:
+            self.record(flow, 0, None)
+
+    def record(self, flow, status, rule):
+        path = API_PATH_PREFIX.sub("", flow.request.path.split("?")[0])
+        entry = {
+            "t": time.time(),
+            "method": flow.request.method,
+            "path": path,
+            "status": status,
+            "injected": rule is not None,
+            "retry_after": rule.get("retry_after") if rule else None,
+            "body": body_hash(flow.request.raw_content or b""),
+            "bearer": flow.request.headers.get("Authorization", "").startswith("Bearer "),
+        }
+        with open(ATTEMPTS_PATH, "a") as f:
+            f.write(json.dumps(entry) + "\n")
+        tag = "INJECTED" if rule else "passed"
+        stamp = time.strftime("%H:%M:%S", time.localtime(entry["t"]))
+        print(f"[fault] {stamp} {status:>3} {tag:<8} {flow.request.method:<6} {path} body={entry['body']}", flush=True)
+
+
+addons = [FaultProxy()]
diff --git a/examples/demo/scripts/retry/flows/_scroll-to.yaml b/examples/demo/scripts/retry/flows/_scroll-to.yaml
new file mode 100644
index 000000000..96eea8d6a
--- /dev/null
+++ b/examples/demo/scripts/retry/flows/_scroll-to.yaml
@@ -0,0 +1,11 @@
+appId: ${APP_ID}
+---
+- scrollUntilVisible:
+    element:
+      id: app_section
+    direction: UP
+    speed: 100
+- scrollUntilVisible:
+    element:
+      id: ${TARGET}
+    centerElement: true
diff --git a/examples/demo/scripts/retry/flows/add-alias.yaml b/examples/demo/scripts/retry/flows/add-alias.yaml
new file mode 100644
index 000000000..0c7fe63aa
--- /dev/null
+++ b/examples/demo/scripts/retry/flows/add-alias.yaml
@@ -0,0 +1,16 @@
+appId: ${APP_ID}
+---
+- runFlow:
+    file: _scroll-to.yaml
+    env:
+      TARGET: add_alias_button
+- tapOn:
+    id: add_alias_button
+- tapOn:
+    id: alias_label_input
+- inputText: ${KEY}
+- tapOn:
+    id: alias_id_input
+- inputText: ${VALUE}
+- tapOn:
+    id: singlepair_confirm_button
diff --git a/examples/demo/scripts/retry/flows/add-email.yaml b/examples/demo/scripts/retry/flows/add-email.yaml
new file mode 100644
index 000000000..c04e1cc9d
--- /dev/null
+++ b/examples/demo/scripts/retry/flows/add-email.yaml
@@ -0,0 +1,13 @@
+appId: ${APP_ID}
+---
+- runFlow:
+    file: _scroll-to.yaml
+    env:
+      TARGET: add_email_button
+- tapOn:
+    id: add_email_button
+- tapOn:
+    id: email_input
+- inputText: ${VALUE}
+- tapOn:
+    id: singleinput_confirm_button
diff --git a/examples/demo/scripts/retry/flows/add-tag.yaml b/examples/demo/scripts/retry/flows/add-tag.yaml
new file mode 100644
index 000000000..bc3ef29ef
--- /dev/null
+++ b/examples/demo/scripts/retry/flows/add-tag.yaml
@@ -0,0 +1,16 @@
+appId: ${APP_ID}
+---
+- runFlow:
+    file: _scroll-to.yaml
+    env:
+      TARGET: add_tag_button
+- tapOn:
+    id: add_tag_button
+- tapOn:
+    id: tag_key_input
+- inputText: ${KEY}
+- tapOn:
+    id: tag_value_input
+- inputText: ${VALUE}
+- tapOn:
+    id: singlepair_confirm_button
diff --git a/examples/demo/scripts/retry/flows/allow-notifications.yaml b/examples/demo/scripts/retry/flows/allow-notifications.yaml
new file mode 100644
index 000000000..ab66b53ba
--- /dev/null
+++ b/examples/demo/scripts/retry/flows/allow-notifications.yaml
@@ -0,0 +1,6 @@
+appId: ${APP_ID}
+---
+- launchApp
+- tapOn:
+    text: Allow
+    optional: true
diff --git a/examples/demo/scripts/retry/flows/login.yaml b/examples/demo/scripts/retry/flows/login.yaml
new file mode 100644
index 000000000..ebf7de802
--- /dev/null
+++ b/examples/demo/scripts/retry/flows/login.yaml
@@ -0,0 +1,20 @@
+appId: ${APP_ID}
+---
+- runFlow:
+    file: _scroll-to.yaml
+    env:
+      TARGET: login_user_button
+- tapOn:
+    id: login_user_button
+- tapOn:
+    id: login_user_id_input
+- inputText: ${VALUE}
+- runFlow:
+    when:
+      true: ${JWT != ''}
+    commands:
+      - tapOn:
+          id: login_user_jwt_input
+      - inputText: ${JWT}
+- tapOn:
+    id: singleinput_confirm_button
diff --git a/examples/demo/scripts/retry/flows/logout.yaml b/examples/demo/scripts/retry/flows/logout.yaml
new file mode 100644
index 000000000..0399a8482
--- /dev/null
+++ b/examples/demo/scripts/retry/flows/logout.yaml
@@ -0,0 +1,8 @@
+appId: ${APP_ID}
+---
+- runFlow:
+    file: _scroll-to.yaml
+    env:
+      TARGET: logout_user_button
+- tapOn:
+    id: logout_user_button
diff --git a/examples/demo/scripts/retry/flows/pause-iams.yaml b/examples/demo/scripts/retry/flows/pause-iams.yaml
new file mode 100644
index 000000000..790e495e7
--- /dev/null
+++ b/examples/demo/scripts/retry/flows/pause-iams.yaml
@@ -0,0 +1,8 @@
+appId: ${APP_ID}
+---
+- runFlow:
+    file: _scroll-to.yaml
+    env:
+      TARGET: pause_iam_toggle
+- tapOn:
+    id: pause_iam_toggle
diff --git a/examples/demo/scripts/retry/flows/toggle-push.yaml b/examples/demo/scripts/retry/flows/toggle-push.yaml
new file mode 100644
index 000000000..9a6c01020
--- /dev/null
+++ b/examples/demo/scripts/retry/flows/toggle-push.yaml
@@ -0,0 +1,8 @@
+appId: ${APP_ID}
+---
+- runFlow:
+    file: _scroll-to.yaml
+    env:
+      TARGET: push_enabled_toggle
+- tapOn:
+    id: push_enabled_toggle
diff --git a/examples/demo/scripts/retry/flows/update-jwt.yaml b/examples/demo/scripts/retry/flows/update-jwt.yaml
new file mode 100644
index 000000000..92290a4d0
--- /dev/null
+++ b/examples/demo/scripts/retry/flows/update-jwt.yaml
@@ -0,0 +1,18 @@
+appId: ${APP_ID}
+---
+- runFlow:
+    file: _scroll-to.yaml
+    env:
+      TARGET: update_user_jwt_button
+- tapOn:
+    id: update_user_jwt_button
+# Prefilled with the external id the SDK asked about.
+- tapOn:
+    id: update_jwt_external_id_input
+- eraseText
+- inputText: ${KEY}
+- tapOn:
+    id: update_jwt_token_input
+- inputText: ${VALUE}
+- tapOn:
+    id: singlepair_confirm_button
diff --git a/examples/demo/scripts/retry/make_jwt.py b/examples/demo/scripts/retry/make_jwt.py
new file mode 100644
index 000000000..2ec0e9a4e
--- /dev/null
+++ b/examples/demo/scripts/retry/make_jwt.py
@@ -0,0 +1,61 @@
+"""
+Prints an Identity Verification JWT, signed ES256 with openssl so no extra packages are needed.
+Usage: make_jwt.py <private key pem> <app id> <external id> [label=id] [email:addr] [sms:number]
+Aliases, emails and SMS numbers the SDK adds must be claimed in the token.
+"""
+
+import base64
+import json
+import subprocess
+import sys
+import time
+
+# Identity Verification only accepts tokens whose exp is within an hour of now.
+LIFETIME = 3600
+
+
+def b64(data):
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
+
+
+def der_to_raw(der):
+    """openssl emits an ASN.1 DER signature, JWS wants r || s."""
+    i = 3 if der[1] & 0x80 else 2
+    parts = []
+    for _ in range(2):
+        length = der[i + 1]
+        parts.append(int.from_bytes(der[i + 2:i + 2 + length], "big").to_bytes(32, "big"))
+        i += 2 + length
+    return b"".join(parts)
+
+
+def main():
+    if len(sys.argv) < 4:
+        sys.exit(__doc__.strip())
+    key, app_id, external_id, *extra = sys.argv[1:]
+    identity = {"external_id": external_id}
+    subscriptions = []
+    for arg in extra:
+        kind, sep, value = arg.partition(":")
+        if sep and kind in ("email", "sms"):
+            subscriptions.append({"type": "Email" if kind == "email" else "SMS", "token": value})
+        elif "=" in arg:
+            label, value = arg.split("=", 1)
+            identity[label] = value
+        else:
+            sys.exit(f"unrecognized claim: {arg}")
+    claims = {"iss": app_id, "exp": int(time.time()) + LIFETIME, "identity": identity}
+    if subscriptions:
+        claims["subscriptions"] = subscriptions
+
+    header = b64(json.dumps({"alg": "ES256", "typ": "JWT"}).encode())
+    signing_input = f"{header}.{b64(json.dumps(claims).encode())}"
+    der = subprocess.run(
+        ["openssl", "dgst", "-sha256", "-sign", key],
+        input=signing_input.encode(), capture_output=True, check=True,
+    ).stdout
+    print(f"{signing_input}.{b64(der_to_raw(der))}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/examples/demo/scripts/retry/report.py b/examples/demo/scripts/retry/report.py
new file mode 100644
index 000000000..a31847c91
--- /dev/null
+++ b/examples/demo/scripts/retry/report.py
@@ -0,0 +1,161 @@
+"""
+Prints each SDK route's attempts from attempts.jsonl with the gap since the previous attempt, and
+the gap the SDK should have waited. Usage: report.py <attempts.jsonl> [route regex]
+
+Expected gaps model the SDK's two retry layers:
+  - OneSignalClient re-sends a 5xx or status 0 up to 4 times itself (5, 15, 45, 135s). The count
+    lives on the request object, so a request only gets those once per run.
+  - Then the executor backs off: 5s doubling to 300s, times jitter in [0.5, 1]. Retry-After, or
+    60s for a 429 without one, is the minimum. Executors resend on the operation repo's 5s poll,
+    so up to 5s more is allowed.
+Attempts are grouped by method and path with IDs stripped, so separate requests on one route in
+the same window (two logins, a session update and a tag) share one series.
+A foreground or network return ends an executor backoff early, so short gaps after those are fine.
+Only 200, 201 and 202 are success. 400, 402, 404, 409 and 410 end a request, so the same body sent
+again is unexpected. A 401 or 403 on a request signed with a Bearer token holds it, with its retry
+counts, until a new JWT is set; an unsigned one ends it. Create User never ends: after any of these
+it pauses the repo and resends the same request, with its counts, on the next session.
+After a hold or Create User pause, a different body is taken as a new request and resets the counts. That is a guess
+from the body hash, which is all the log has to tell requests apart.
+"""
+
+import json
+import math
+import re
+import sys
+from collections import OrderedDict
+
+CLIENT_DELAYS = [5, 15, 45, 135]
+POLL_SLACK = 5.5
+CLOCK_SLACK = 1.0
+SUCCESS = (200, 201, 202)
+NOT_RETRYABLE = (400, 401, 402, 403, 404, 409, 410)
+HELD = (401, 403)
+
+
+CREATE_USER = re.compile(r"^POST apps/[^/]+/users$")
+
+
+def is_hold(entry):
+    return entry["status"] in HELD and bool(entry.get("bearer"))
+
+
+def is_session_resend(entry):
+    return entry["status"] in NOT_RETRYABLE and bool(CREATE_USER.search(f"{entry['method']} {entry['path']}"))
+
+
+def keeps_request(entry):
+    return is_hold(entry) or is_session_resend(entry)
+
+# Login's Identify User shares PATCH .../identity with Add Aliases, so it is labeled a repo executor.
+USER_EXECUTOR = re.compile(r"^POST apps/[^/]+/users$|^GET apps/[^/]+/users/by/[^/]+/[^/]+$|^GET apps/[^/]+/subscriptions/[^/]+/user/identity$")
+# Leaves out the in-app message fetch under users/by/, which has retries of its own.
+EXECUTOR_ROUTE = re.compile(r"^(?!.*/iams$)apps/[^/]+/(users(/by/.*)?|subscriptions/[^/]+(/user/identity)?|custom_events)$")
+ID_SEGMENT = re.compile(r"(by/[^/]+/|subscriptions/)[^/]+")
+
+
+def route_key(entry):
+    path = ID_SEGMENT.sub(r"\1:id", entry["path"])
+    return f"{entry['method']} {path}"
+
+
+def is_user_executor(entry):
+    return bool(USER_EXECUTOR.search(f"{entry['method']} {entry['path']}"))
+
+
+def executor_window(failures, status, retry_after):
+    exponential = min(5 * 2 ** (failures - 1), 300)
+    low, high = exponential * 0.5, exponential
+    floor = None
+    if retry_after is not None:
+        try:
+            floor = float(retry_after)
+        except ValueError:
+            floor = None
+        floor = 60 if floor is None or not math.isfinite(floor) or floor < 0 else min(floor, 3600)
+    elif status == 429:
+        floor = 60
+    if floor is not None:
+        low, high = max(low, floor), max(high, floor)
+    return low, high, floor is not None
+
+
+def main():
+    path = sys.argv[1]
+    route_filter = re.compile(sys.argv[2]) if len(sys.argv) > 2 else None
+    groups = OrderedDict()
+    with open(path) as f:
+        for line in f:
+            if line.strip():
+                entry = json.loads(line)
+                groups.setdefault(route_key(entry), []).append(entry)
+
+    if not groups:
+        print("No SDK requests recorded yet.")
+        return
+
+    for key, entries in groups.items():
+        if route_filter and not route_filter.search(key):
+            continue
+        if not EXECUTOR_ROUTE.search(entries[0]["path"]):
+            continue
+        repo = not is_user_executor(entries[0])
+        print(f"\n{key}  ({'repo executor' if repo else 'User executor'})")
+        print(f"  {'#':>3} {'time':>8} {'status':>6} {'body':>8} {'gap':>8} {'expected':>16}  note")
+        client_retries = 0
+        executor_failures = 0
+        expected = None
+        ended = None
+        start = entries[0]["t"]
+        for i, entry in enumerate(entries):
+            gap = entry["t"] - entries[i - 1]["t"] if i else None
+            note = ""
+            if expected and gap is not None:
+                low, high, kind = expected
+                if gap < low:
+                    note = f"EARLY ({kind})"
+                    if kind.startswith("executor") and not kind.endswith("Retry-After"):
+                        note += "; fine if right after a foreground or network return"
+                elif gap > high + CLOCK_SLACK:
+                    note = f"LATE ({kind})"
+                else:
+                    note = kind
+            elif ended and is_hold(ended) and entry.get("body") == ended["body"]:
+                note = f"resend after held {ended['status']}; fine once a new JWT is set"
+            elif ended and is_session_resend(ended) and entry.get("body") == ended["body"]:
+                note = f"resend after {ended['status']}; fine if on a new session"
+            elif ended and entry.get("body") == ended["body"]:
+                note = f"UNEXPECTED resend after {ended['status']}"
+            elif ended:
+                note = f"new request after {ended['status']}"
+            elif gap is not None:
+                note = "new attempt after success"
+            expected_text = f"{expected[0]:.1f}-{expected[1]:.1f}s" if expected else ""
+            gap_text = f"{gap:.1f}s" if gap is not None else ""
+            mark = "*" if entry["injected"] else " "
+            print(f"  {i + 1:>3} {entry['t'] - start:>7.1f}s {entry['status']:>5}{mark} {entry.get('body', ''):>8} {gap_text:>8} {expected_text:>16}  {note}")
+
+            status = entry["status"]
+            if ended and keeps_request(ended) and entry.get("body") != ended["body"]:
+                client_retries = executor_failures = 0
+            ended = entry if status in NOT_RETRYABLE else None
+            if keeps_request(entry):
+                expected = None
+            elif status in SUCCESS or status in NOT_RETRYABLE:
+                client_retries = executor_failures = 0
+                expected = None
+            elif (status >= 500 or status == 0) and client_retries < len(CLIENT_DELAYS):
+                delay = CLIENT_DELAYS[client_retries]
+                client_retries += 1
+                expected = (delay, delay, "client reattempt")
+            else:
+                executor_failures += 1
+                low, high, has_floor = executor_window(executor_failures, status, entry.get("retry_after"))
+                high += POLL_SLACK
+                kind = f"executor backoff #{executor_failures}"
+                expected = (low, high, kind + (", Retry-After" if has_floor else ""))
+    print("\n* = failure injected by the proxy")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/examples/demo/scripts/retry/retry-test.sh b/examples/demo/scripts/retry/retry-test.sh
new file mode 100755
index 000000000..1f553c858
--- /dev/null
+++ b/examples/demo/scripts/retry/retry-test.sh
@@ -0,0 +1,357 @@
+#!/usr/bin/env bash
+# Fault-injection harness for manually testing SDK request retries in the demo app.
+# Run `./retry-test.sh help` or see README.md.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+STATE_DIR="${RETRY_TEST_STATE_DIR:-$SCRIPT_DIR/.state}"
+RULES="$STATE_DIR/rules.json"
+ATTEMPTS="$STATE_DIR/attempts.jsonl"
+PROXY_LOG="$STATE_DIR/proxy.log"
+PID_FILE="$STATE_DIR/proxy.pid"
+SAVED_PROXY="$STATE_DIR/saved-proxy"
+PORT="${RETRY_TEST_PORT:-8899}"
+# `system` points the Mac's HTTP(S) proxy at mitmproxy (the simulator uses the Mac's settings).
+# `local` uses mitmproxy's local capture of the `App` process instead, which needs its macOS
+# network extension approved once, but leaves the Mac's proxy alone.
+# `manual` only listens; point a physical device's Wi-Fi proxy at this Mac yourself.
+PROXY_MODE="${RETRY_TEST_PROXY_MODE:-system}"
+BUNDLE_ID="${RETRY_TEST_BUNDLE_ID:-com.onesignal.example}"
+# Other demos (Cordova, Capacitor, ...) share the bundle ID, so give the harness its own simulator.
+DEVICE_NAME="${RETRY_TEST_DEVICE:-OneSignal Retry Test}"
+IV_APP_ID="${RETRY_TEST_IV_APP_ID:-}"
+IV_KEY="${RETRY_TEST_IV_KEY:-}"
+CA_CERT="$HOME/.mitmproxy/mitmproxy-ca-cert.pem"
+
+export RETRY_TEST_STATE_DIR="$STATE_DIR"
+mkdir -p "$STATE_DIR"
+
+die() { echo "error: $*" >&2; exit 1; }
+
+# Sets DEVICE to the UDID of DEVICE_NAME (a simulator name or UDID), booting it if needed.
+resolve_device() {
+  DEVICE="$(xcrun simctl list devices -j | python3 -c '
+import json, sys
+want = sys.argv[1]
+devices = [d for r in json.load(sys.stdin)["devices"].values() for d in r if d.get("isAvailable")]
+match = [d for d in devices if want in (d["udid"], d["name"])]
+print(" ".join((match[0]["udid"], match[0]["state"])) if match else "")
+' "$DEVICE_NAME")"
+  [[ -n "$DEVICE" ]] || die "no simulator named '$DEVICE_NAME'. Create it with: xcrun simctl create '$DEVICE_NAME' 'iPhone 17'"
+  local state="${DEVICE#* }"
+  DEVICE="${DEVICE%% *}"
+  if [[ "$state" != "Booted" ]]; then
+    xcrun simctl boot "$DEVICE"
+    open -a Simulator --args -CurrentDeviceUDID "$DEVICE"
+  fi
+}
+
+route_rule() {
+  # Prints "<method> <path regex>" for a route name. Paths are relative to https://api.onesignal.com/.
+  case "$1" in
+    create-user)    echo "POST ^apps/[^/]+/users$" ;;
+    fetch-user)     echo "GET ^apps/[^/]+/users/by/[^/]+/[^/]+$" ;;
+    update-user)    echo "PATCH ^apps/[^/]+/users/by/[^/]+/[^/]+$" ;;
+    identity)       echo "PATCH /identity$" ;;
+    remove-alias)   echo "DELETE /identity/[^/]+$" ;;
+    create-sub)     echo "POST /subscriptions$" ;;
+    update-sub)     echo "PATCH ^apps/[^/]+/subscriptions/[^/]+$" ;;
+    delete-sub)     echo "DELETE ^apps/[^/]+/subscriptions/[^/]+$" ;;
+    identity-by-sub) echo "GET /user/identity$" ;;
+    custom-events)  echo "POST /custom_events$" ;;
+    all)            echo "- ." ;;
+    *) die "unknown route '$1'. Routes: create-user fetch-user update-user identity remove-alias create-sub update-sub delete-sub identity-by-sub custom-events all" ;;
+  esac
+}
+
+proxy_running() { [[ -f "$PID_FILE" ]] && kill -0 "$(cat "$PID_FILE")" 2>/dev/null; }
+
+network_service() {
+  local iface
+  iface="$(route -n get default 2>/dev/null | awk '/interface:/ {print $2}')"
+  [[ -n "$iface" ]] || die "no default network route"
+  networksetup -listnetworkserviceorder | awk -v dev="$iface" '
+    /^\([0-9]+\)/ { sub(/^\([0-9]+\) /, ""); name = $0 }
+    $0 ~ "Device: " dev "\\)" { print name; exit }'
+}
+
+set_system_proxy() {
+  local service
+  service="$(network_service)"
+  [[ -n "$service" ]] || die "could not map the default interface to a network service"
+  # A start after a crashed proxy would otherwise save our own redirect as the original settings.
+  [[ -f "$SAVED_PROXY" ]] || {
+    echo "$service"
+    networksetup -getwebproxy "$service" | awk -F': ' '/^(Enabled|Server|Port)/ {print $2}' | paste -sd' ' -
+    networksetup -getsecurewebproxy "$service" | awk -F': ' '/^(Enabled|Server|Port)/ {print $2}' | paste -sd' ' -
+  } > "$SAVED_PROXY"
+  networksetup -setwebproxy "$service" 127.0.0.1 "$PORT"
+  networksetup -setsecurewebproxy "$service" 127.0.0.1 "$PORT"
+  echo "Pointed '$service' HTTP(S) proxy at 127.0.0.1:$PORT (restored by 'stop')."
+}
+
+restore_system_proxy() {
+  [[ -f "$SAVED_PROXY" ]] || return 0
+  local service web secure
+  { read -r service; read -r web; read -r secure; } < "$SAVED_PROXY"
+  restore_one() {
+    local kind="$1" enabled server port
+    read -r enabled server port <<< "$2"
+    if [[ "$enabled" == "Yes" && -n "$server" ]]; then
+      networksetup "-set${kind}" "$service" "$server" "$port"
+    else
+      networksetup "-set${kind}state" "$service" off
+    fi
+  }
+  restore_one webproxy "$web"
+  restore_one securewebproxy "$secure"
+  rm -f "$SAVED_PROXY"
+  echo "Restored '$service' proxy settings."
+}
+
+install_ca() {
+  for _ in $(seq 1 50); do [[ -f "$CA_CERT" ]] && break; sleep 0.1; done
+  [[ -f "$CA_CERT" ]] || die "mitmproxy CA not generated at $CA_CERT"
+  resolve_device
+  xcrun simctl keychain "$DEVICE" add-root-cert "$CA_CERT"
+  echo "Trusted the mitmproxy CA on '$DEVICE_NAME'."
+}
+
+cmd_start() {
+  command -v mitmdump >/dev/null || die "mitmdump not found. Install with: brew install mitmproxy"
+  proxy_running && die "proxy already running (pid $(cat "$PID_FILE")). Run '$0 stop' first."
+  : > "$ATTEMPTS"
+  [[ -f "$RULES" ]] || echo "[]" > "$RULES"
+  # Loopback only, unless a physical device has to reach it.
+  local mode_args=(--listen-host 127.0.0.1 --listen-port "$PORT")
+  [[ "$PROXY_MODE" == "manual" ]] && mode_args=(--listen-port "$PORT")
+  [[ "$PROXY_MODE" == "local" ]] && mode_args=(--mode "local:App")
+  # Only onesignal.com is decrypted; everything else on the Mac is tunnelled untouched.
+  mitmdump "${mode_args[@]}" \
+    --allow-hosts '^(.+\.)?onesignal\.com(:443)?$' \
+    --set connection_strategy=lazy \
+    --set termlog_verbosity=warn \
+    -s "$SCRIPT_DIR/fault_proxy.py" > "$PROXY_LOG" 2>&1 &
+  echo $! > "$PID_FILE"
+  sleep 1
+  proxy_running || { cat "$PROXY_LOG"; die "mitmdump exited"; }
+  echo "mitmdump running (pid $(cat "$PID_FILE")), log: $PROXY_LOG"
+  case "$PROXY_MODE" in
+    system) set_system_proxy; install_ca ;;
+    local) install_ca ;;
+    manual)
+      echo "Set the device's Wi-Fi HTTP proxy to $(ipconfig getifaddr en0 2>/dev/null || echo '<this Mac>'):$PORT,"
+      echo "then open http://mitm.it on the device to install and trust the CA." ;;
+    *) die "unknown RETRY_TEST_PROXY_MODE '$PROXY_MODE'" ;;
+  esac
+  echo "Relaunch the demo app so it picks up the proxy: $0 relaunch"
+}
+
+cmd_stop() {
+  if proxy_running; then
+    kill "$(cat "$PID_FILE")" && echo "Stopped mitmdump."
+  fi
+  rm -f "$PID_FILE"
+  restore_system_proxy
+}
+
+write_rules() {
+  # write_rules <json array>; written atomically so the addon never reads a partial file.
+  echo "$1" > "$RULES.tmp" && mv "$RULES.tmp" "$RULES"
+}
+
+cmd_fail() {
+  local route="${1:-}" status="${2:-}"
+  [[ -n "$route" && -n "$status" ]] || die "usage: $0 fail <route> <status|0> [--times N] [--retry-after S] [--add]"
+  shift 2
+  local times="null" retry_after="null" add=false
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --times) times="$2"; shift 2 ;;
+      --retry-after) retry_after="\"$2\""; shift 2 ;;
+      --add) add=true; shift ;;
+      *) die "unknown option $1" ;;
+    esac
+  done
+  [[ "$status" == "0" && "$retry_after" != "null" ]] && die "--retry-after needs an HTTP status; status 0 sends no response"
+  local rule method path
+  rule="$(route_rule "$route")" || exit 1
+  read -r method path <<< "$rule"
+  [[ "$method" == "-" ]] && method=""
+  python3 - "$RULES" "$add" "$route" "$method" "$path" "$status" "$times" "$retry_after" > "$RULES.tmp" <<'PY'
+import json, sys, uuid
+rules_path, add, route, method, path, status, times, retry_after = sys.argv[1:]
+rules = json.load(open(rules_path)) if add == "true" else []
+rules.append({"id": uuid.uuid4().hex[:8], "route": route, "method": method or None, "path": path, "status": int(status),
+              "times": json.loads(times), "retry_after": json.loads(retry_after)})
+print(json.dumps(rules))
+PY
+  mv "$RULES.tmp" "$RULES"
+  echo "Rules now: $(cat "$RULES")"
+}
+
+cmd_clear() {
+  write_rules "[]"
+  echo "Cleared all rules; requests pass through."
+}
+
+cmd_reset_log() { : > "$ATTEMPTS"; echo "Cleared recorded attempts."; }
+
+cmd_network_flap() {
+  # NWPathMonitor in the simulator follows the Mac's interfaces, so turning Wi-Fi off and on
+  # exercises the "network returned while foregrounded" trigger.
+  local seconds="${1:-10}" device
+  device="$(networksetup -listallhardwareports | awk '/Hardware Port: Wi-Fi/ {getline; print $2}')"
+  [[ -n "$device" ]] || die "no Wi-Fi interface found"
+  echo "Wi-Fi ($device) off for ${seconds}s..."
+  trap "networksetup -setairportpower '$device' on" EXIT
+  trap 'exit 130' INT TERM
+  networksetup -setairportpower "$device" off
+  sleep "$seconds"
+  networksetup -setairportpower "$device" on
+  trap - EXIT INT TERM
+  echo "Wi-Fi back on."
+}
+
+cmd_fresh() {
+  # Wipes the demo's data and app-group containers so the SDK starts as a new install (Create
+  # User and so on), without uninstalling, so an already granted notification permission is kept
+  # and the permission prompt does not hold the app inactive.
+  local data group plist
+  resolve_device
+  data="$(xcrun simctl get_app_container "$DEVICE" "$BUNDLE_ID" data)" || die "demo app not installed on '$DEVICE_NAME'. Run '$0 install'."
+  xcrun simctl terminate "$DEVICE" "$BUNDLE_ID" 2>/dev/null || true
+  # Preferences go through the simulator's cfprefsd, which would write its cached copy back.
+  for plist in "$data"/Library/Preferences/*.plist; do
+    [[ -f "$plist" ]] && xcrun simctl spawn "$DEVICE" defaults delete "${plist%.plist}" 2>/dev/null || true
+  done
+  rm -rf "${data:?}/Documents/"* "${data:?}/Library/Caches/"* "${data:?}/Library/Preferences/"* "${data:?}/tmp/"*
+  while read -r _ group; do
+    [[ -d "$group" ]] || continue
+    for plist in "$group"/Library/Preferences/*.plist; do
+      [[ -f "$plist" ]] && xcrun simctl spawn "$DEVICE" defaults delete "${plist%.plist}" 2>/dev/null || true
+    done
+    rm -rf "${group:?}/"*
+  done < <(xcrun simctl get_app_container "$DEVICE" "$BUNDLE_ID" groups 2>/dev/null)
+  echo "Cleared demo app data."
+  xcrun simctl launch "$DEVICE" "$BUNDLE_ID"
+}
+
+cmd_install() {
+  resolve_device
+  local root="$SCRIPT_DIR/../../../.." derived="$STATE_DIR/DerivedData"
+  xcodebuild build -quiet \
+    -workspace "$root/iOS_SDK/OneSignalSDK.xcworkspace" -scheme App -configuration Debug \
+    -destination "id=$DEVICE" -derivedDataPath "$derived"
+  xcrun simctl install "$DEVICE" "$derived/Build/Products/Debug-iphonesimulator/App.app"
+  echo "Installed the demo app on '$DEVICE_NAME'. Next: $0 fresh, then $0 tap allow-notifications"
+}
+
+cmd_tap() {
+  # Drives the demo's UI through Maestro flows in flows/, using the demo's accessibility IDs.
+  command -v maestro >/dev/null || die "maestro not found. Install with: brew install mobile-dev-inc/tap/maestro"
+  local action="${1:-}" env=()
+  case "$action" in
+    add-tag|add-alias) [[ $# -eq 3 ]] || die "usage: $0 tap $action <key> <value>"; env=(-e "KEY=$2" -e "VALUE=$3") ;;
+    add-email) [[ $# -eq 2 ]] || die "usage: $0 tap $action <value>"; env=(-e "VALUE=$2") ;;
+    login)
+      [[ $# -eq 2 || $# -eq 3 ]] || die "usage: $0 tap login <external id> [jwt]"
+      local jwt="${3:-}"
+      [[ -z "$jwt" && -n "$IV_KEY" ]] && { jwt="$(cmd_jwt "$2")" || exit 1; }
+      env=(-e "VALUE=$2" -e "JWT=$jwt") ;;
+    update-jwt)
+      [[ $# -eq 2 || $# -eq 3 ]] || die "usage: $0 tap update-jwt <external id> [jwt]"
+      local token="${3:-}"
+      [[ -n "$token" ]] || { token="$(cmd_jwt "$2")" || exit 1; }
+      env=(-e "KEY=$2" -e "VALUE=$token") ;;
+    logout|toggle-push|pause-iams|allow-notifications) ;;
+    *) die "usage: $0 tap <add-tag|add-alias|add-email|login|update-jwt|logout|toggle-push|pause-iams|allow-notifications> [args]" ;;
+  esac
+  resolve_device
+  local status=0
+  MAESTRO_CLI_NO_ANALYTICS=1 MAESTRO_CLI_ANALYSIS_NOTIFICATION_DISABLED=true \
+    maestro --device "$DEVICE" test -e "APP_ID=$BUNDLE_ID" ${env[@]+"${env[@]}"} "$SCRIPT_DIR/flows/$action.yaml" \
+    | { grep -E '^ *(>|[A-Z].*(COMPLETED|FAILED|WARNED))' || true; } || status=$?
+  [[ $status -eq 0 ]] || die "flow '$action' failed (maestro exit $status)"
+}
+
+cmd_jwt() {
+  [[ -n "$IV_APP_ID" && -n "$IV_KEY" ]] || die "set RETRY_TEST_IV_APP_ID and RETRY_TEST_IV_KEY (path to the app's private key)"
+  [[ -r "$IV_KEY" ]] || die "can't read $IV_KEY"
+  python3 "$SCRIPT_DIR/make_jwt.py" "$IV_KEY" "$IV_APP_ID" "$@"
+}
+
+cmd_logs() {
+  resolve_device
+  xcrun simctl spawn "$DEVICE" log stream --level debug --style compact \
+    --predicate 'process == "App" AND (eventMessage CONTAINS[c] "request" OR eventMessage CONTAINS[c] "retry" OR eventMessage CONTAINS[c] "re-attempt")'
+}
+
+usage() {
+  cat <<EOF
+Usage: $0 <command>
+
+Proxy
+  start                     Start mitmproxy, point the proxy at it, trust its CA on the simulator
+  stop                      Stop mitmproxy and restore proxy settings
+  trust-ca                  Trust the mitmproxy CA on the simulator
+
+Faults (take effect immediately, no relaunch needed)
+  fail <route> <status> [--times N] [--retry-after S] [--add]
+                            Fail matching SDK requests. Status 0 drops the connection.
+                            --times N: fail N times, then pass. Default: until cleared.
+                            --add: keep existing rules instead of replacing them.
+  clear                     Remove all rules
+  rules                     Show current rules
+
+Observe
+  watch                     Follow every SDK request as it passes the proxy
+  report [route regex]      Gaps between attempts per route vs. the expected backoff
+  reset-log                 Forget recorded attempts
+  logs                      Stream the demo app's SDK request/retry logs
+
+App / environment
+  install                   Build the demo app and install it on the simulator
+  tap <action> [args]       Drive the demo's UI with Maestro:
+                              add-tag <key> <value>, add-alias <label> <id>, add-email <email>,
+                              login <external id> [jwt], update-jwt <external id> [jwt], logout,
+                              toggle-push, pause-iams, allow-notifications
+                            With RETRY_TEST_IV_KEY set, login and update-jwt sign a JWT when none is given.
+  jwt <external id> [label=id] [email:addr] [sms:number]
+                            Print an Identity Verification JWT claiming those aliases and subscriptions
+  relaunch                  Kill and relaunch the demo app
+  fresh                     Wipe the demo app's data (new SDK user) and relaunch, keeping the
+                            notification permission. Allow the prompt once after installing.
+  background | foreground   Send the demo app to the background, or bring it back
+  network-flap [seconds]    Turn the Mac's Wi-Fi off and back on (default 10s)
+
+Routes: create-user fetch-user update-user identity remove-alias create-sub update-sub
+        delete-sub identity-by-sub custom-events all
+Env: RETRY_TEST_DEVICE ($DEVICE_NAME), RETRY_TEST_PORT ($PORT),
+     RETRY_TEST_PROXY_MODE ($PROXY_MODE), RETRY_TEST_BUNDLE_ID ($BUNDLE_ID),
+     RETRY_TEST_IV_APP_ID and RETRY_TEST_IV_KEY (Identity Verification app and its private key path)
+EOF
+}
+
+case "${1:-help}" in
+  start) cmd_start ;;
+  stop) cmd_stop ;;
+  trust-ca) install_ca ;;
+  fail) shift; cmd_fail "$@" ;;
+  clear) cmd_clear ;;
+  rules) cat "$RULES" 2>/dev/null || echo "[]" ;;
+  watch) tail -n +1 -F "$PROXY_LOG" | grep --line-buffered '^\[fault\]' ;;
+  report) shift; python3 "$SCRIPT_DIR/report.py" "$ATTEMPTS" "$@" ;;
+  reset-log) cmd_reset_log ;;
+  logs) cmd_logs ;;
+  fresh) cmd_fresh ;;
+  install) cmd_install ;;
+  tap) shift; cmd_tap "$@" ;;
+  jwt) shift; cmd_jwt "$@" ;;
+  relaunch) resolve_device; xcrun simctl terminate "$DEVICE" "$BUNDLE_ID" 2>/dev/null || true; xcrun simctl launch "$DEVICE" "$BUNDLE_ID" ;;
+  background) resolve_device; xcrun simctl launch "$DEVICE" com.apple.Preferences >/dev/null && echo "Demo app backgrounded." ;;
+  foreground) resolve_device; xcrun simctl launch "$DEVICE" "$BUNDLE_ID" >/dev/null && echo "Demo app foregrounded." ;;
+  network-flap) shift; cmd_network_flap "$@" ;;
+  help|-h|--help) usage ;;
+  *) usage; exit 1 ;;
+esac