feat(experiment-tag): share RTBT session across subdomains with rolling timeout

[tyiuhc]

Summary

Reworks the behavioral-targeting (RTBT) SessionManager so that current_session conditions work across subdomains, mirroring Amplitude Analytics' session model.

Previously the RTBT session lived in sessionStorage, which is scoped per-tab and per-origin. That fragmented sessions across subdomains (and even tabs), so current_session targeting could never match events fired on a different subdomain.

Changes

• Root-domain cookie storage — session id + lastEventTime are persisted in a cookie scoped to the registrable domain (resolved with a new synchronous getTopLevelDomainSync probe in util/cookie.ts), so the session is shared across subdomains and tabs.
• Rolling inactivity timeout — the session rotates after 30 minutes of inactivity (same default as Analytics), configurable via the new WebExperimentConfig.rtbtSessionTimeout.
• Activity = any Amplitude event — recordActivity() is called at the top of BehavioralTargetingManager.trackEvent, upstream of the persistedEvents allowlist filter, so any observed event keeps the session alive (not just RTBT-relevant events). Reads use getCurrentSessionId() which does not extend the session.
• Graceful fallback — when cookie I/O is blocked (private browsing, ITP), detected via a write-back check, the session degrades to an in-memory per-page session instead of throwing.
• getOrCreateSessionId() is kept as a backwards-compatible alias.

Related PRs

Part of the cross-subdomain behavioral-targeting effort: #333 (RTBT relay protocol + RelayClient), #334 (dual-write events to relay), and #335 (wire relay iframe). The root-domain cookie reuses the same registrable-domain approach as #332 (cross-subdomain web_exp_id_v2 identity). This change is independent of the relay PRs (based on main) but pairs with them so a shared current_session matches across subdomains.

Test plan

• SessionManager unit tests: cookie persistence, cross-instance sharing, rolling timeout (extend vs rotate), configurable timeout, start-time, clear, and in-memory fallback.
• Updated event-storage / integration / evaluator suites to clear the session cookie between tests.
• Full experiment-tag suite green (174 tests), eslint + prettier clean.
• Manual cross-subdomain verification (set a current_session rule, fire events on a.example.com, confirm match on b.example.com).

Made with Cursor

[linear-code]

WEB-132