fix(audience-session): clamp livePause in ComputeEngagedSecondsLocked

Cursor Bugbot finding on c43044a.

Resume() clamps pauseDuration ≥ 0 for wall-clock rewinds, but the
mirror calculation in ComputeEngagedSecondsLocked did not. If the
clock rewinds while the session is still paused and End fires (e.g.
Shutdown while backgrounded with NTP pulling time back), livePause
goes negative. Being subtracted, it inflated engagedSeconds past the
wall-clock window. The final engagedSeconds ≥ 0 clamp caught
negatives but not over-credit.

Mirror the Resume-side clamp: livePause < 0 → 0.

Added End_ClockRewindsWhilePaused_DoesNotInflateDuration as a
regression guard. 10s before pause, clock rewinds 5s while paused,
End fires — duration must stay within the 5s wall-clock window.
Without the clamp the test reports 15s.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ImmutableJeffrey

src/Packages/Audience/Runtime/Core/Session.cs

@@ -342,6 +342,12 @@ private long ComputeEngagedSecondsLocked()
         {
             var now = _getUtcNow();
             var livePause = _pausedAt.HasValue ? now - _pausedAt.Value : TimeSpan.Zero;
+            // Clamp: mirrors the Resume() guard. If the clock rewinds while the
+            // session is still paused and End / EmitEndAndSeal fires (e.g.
+            // Shutdown while backgrounded), livePause would be negative and,
+            // being subtracted, would inflate engagedSeconds past the wall-clock
+            // window. The final ≥0 clamp catches negatives but not inflation.
+            if (livePause < TimeSpan.Zero) livePause = TimeSpan.Zero;
             var engagedSeconds = ((now - _sessionStart) - _accumulatedPause - livePause).TotalSeconds;
             if (engagedSeconds < 0) return 0;
             return (long)Math.Round(engagedSeconds, MidpointRounding.AwayFromZero);

src/Packages/Audience/Tests/Runtime/Core/SessionTests.cs

@@ -363,6 +363,35 @@ public void End_ClockRewindsSinceStart_ClampsDurationToZero()
                 "negative engaged time from a wall-clock rewind must clamp to zero");
         }
 
+        [Test]
+        public void End_ClockRewindsWhilePaused_DoesNotInflateDuration()
+        {
+            // Wall-clock rewinds while the session is still paused (e.g. the
+            // app is backgrounded and NTP corrects backwards before Shutdown
+            // fires End). Without the livePause ≥ 0 clamp in
+            // ComputeEngagedSecondsLocked, livePause goes negative and,
+            // being subtracted, inflates duration past the wall-clock window
+            // — the final engagedSeconds ≥ 0 clamp only catches negatives,
+            // not over-credit. Sabotage: removing the livePause clamp lets
+            // this test report 15s instead of the ≤ 5s wall-clock window.
+            var now = new DateTime(2026, 4, 20, 12, 0, 0, DateTimeKind.Utc);
+            DateTime Clock() => now;
+
+            using var session = new Session(MockTrack, performanceSnapshot: null, getUtcNow: Clock);
+            session.Start();
+
+            now = now.AddSeconds(10);
+            session.Pause();
+
+            now = now.AddSeconds(-5); // clock rewinds 5s while paused
+            session.End();
+
+            var sessionEnd = _events.Last(e => e.name == "session_end");
+            var duration = (long)sessionEnd.props["durationSec"];
+            Assert.LessOrEqual(duration, 5L,
+                "clock rewind while paused must not over-credit engagement past the wall-clock window");
+        }
+
         [Test]
         public void End_AfterShortPause_ReportsDurationMinusPause()
         {