update docs

docs/mibapi/README.md

@@ -48,6 +48,11 @@ Cookie: mbmodel=IOS-1.0; xxid=<session_xxid>; IBSID=<session_xxid>; mbnonce=<non
 
 These values come from the login flow — `xxid` and `nonceGenerator` from the DH key exchange response.
 
+**Cookie notes:**
+
+- `time-tracker=597` is a **hardcoded constant** in the client. Every WebView client (transfers, contacts, cards, activity, etc.) sends the literal value `597` — it is not computed or rotated.
+- `mbnonce` is the **unmodified `nonceGenerator` string** from the key-exchange response. It does **not** carry a freshly-computed per-request nonce. The actual per-request nonce (derived via the algorithm in [01-encryption.md](01-encryption.md)) only appears inside the encrypted payloads of `sfunc=n` calls on the encrypted API — WebView endpoints have no nonce field.
+
 ### WebView AJAX Headers
 
 All AJAX `POST` calls also require:
@@ -59,7 +64,20 @@ Origin: https://faisamobilex-wv.mib.com.mv
 Content-Type: application/x-www-form-urlencoded; charset=UTF-8
 ```
 
-The `Referer` value varies per endpoint (documented per endpoint).
+The `Referer` value varies per endpoint (documented per endpoint). A few endpoints (notably activity history, [10-activity-history.md](10-activity-history.md)) omit both `Referer` and `Origin`.
+
+---
+
+## Session Expiry Detection
+
+A MIB session is considered expired when **either** condition is met (`MibLoginFlow.kt:248-274`):
+
+| Signal | Source |
+|---|---|
+| HTTP **`419`** status | Encrypted API or any WebView endpoint |
+| JSON `reasonCode == "505"` in a decrypted response body | Encrypted API |
+
+On detection the client auto-recovers by re-running the login flow using stored credentials, refreshes `xxid` + `nonceGenerator` in the in-flight payload, and retries the original request once. Callers receive the retried response transparently. If the recovery itself hits expiry again it surfaces a `SessionExpiredException`.
 
 ### WebView User-Agent
 
@@ -82,6 +100,7 @@ Mozilla/5.0 (Linux; Android {version}; wv) AppleWebKit/537.36 (KHTML, like Gecko
 | 7 | [07-profile.md](07-profile.md) | Personal profile (HTML scrape) |
 | 8 | [08-transfer.md](08-transfer.md) | Account lookup and fund transfer |
 | 9 | [09-contacts.md](09-contacts.md) | Beneficiary management |
+| 10 | [10-activity-history.md](10-activity-history.md) | Activity / audit log |
 
 ---