Audit follow-up: Analytics impression tracker leaks listeners and history monkey patches

Parent epic: #36004

Finding

The analytics SDK impression tracker reportedly registers listeners and monkey-patches history.pushState / history.replaceState, but cleanup() does not undo all of them. The report says the sibling activity tracker has a better cleanup pattern.

Report references: libs/sdk/analytics/.../dot-analytics.impression-tracker.ts:217-283, libs/sdk/analytics/.../dot-analytics.impression-tracker.ts:479-506

Potential impact

Long-lived customer SPAs may accumulate listeners/patch layers over time, causing duplicate tracking, memory growth, or unexpected history behavior.

Suggested validation

Initialize and cleanup the impression tracker repeatedly in a SPA harness and inspect listener counts, patched history functions, and duplicate event behavior.

Possible fix

Mirror the activity tracker cleanup pattern: restore original history methods and unregister all listeners during cleanup().

Caveat

This was AI-found by Claude from .scratch/audit/REPORT.md. Please perform secondary validation of correctness, severity, and value before actioning.

Start with libs/sdk/analytics/.../dot-analytics.impression-tracker.ts lines 217-283 and 479-506, then compare the sibling activity tracker’s cleanup pattern. Repeatedly initialize and clean up the impression tracker in a SPA harness, checking listener counts, history methods, and duplicate events; done means cleanup restores the original history methods and unregisters all listeners.