[hideouts-io]

Summary

Package installation consumes a successfully inspected private copy. Confirmation captures package, target and developer-package option; original and copy are revalidated before the captured backend consumes it. Pending, failed, changed and unsupported packages cannot authorize installation. Signature/package inspection runs on a dedicated Dispatch queue, and cancellation retains its worker and copy until native validation returns and cleanup finishes.

The explicit hosted native test requires malformed-package denial, valid recovery, exact confirmation/Cancel, late delivery of cancelled completed A after B becomes current, and normal Quit. Its first unfinished-reader case now declines Quit through the actual Cancel button and requires an uncancelled reader, retained copy and later eligible preparation. A second launch exercises Quit Anyway, the unchanged eight-second refusal while cleanup still owns a reader, blocked re-selection, real release/validation/cleanup, recovery and another normal Quit. The full native sequence remains a required candidate gate.

The Debug connector holds a genuine SecStaticCode handle before validation, with a fixed finite lease and failure teardown. It does not establish overlap with the uninterruptible C validity call. Strict/all-architecture/nested-code validation remains enabled. Native file-panel queries retain observed identifiers, unique matches, bounded waits and real interactions. Long target labels declare a bounded width and middle truncation to address the confirmed minimum-width toolbar overflow.

The fixture host prepares two distinct signed simulator apps and malformed archive bytes. It independently requires six actual preparation paths absent, three original input hashes unchanged, unchanged simulator inventory and exact owner-bound cleanup. Static preparation-phase and post-boot consumer-delivery metadata preserve existing command arguments, deadlines, parsing, identity and cleanup gates without logging payloads or target identifiers. Delivery counts do not establish child-output production or exit time.

The new headless signed-bundle integration deliberately fails its caller only after a genuine native reader owns a handle and private copy. Structured teardown cancels the child, calls existing finishAfterFailure, preserves the typed caller error and drains the group. It independently observes the child's actual CancellationError, successful native validation, exact directory removal with ENOENT, and unchanged bytes in the three known original fixture files. An unexpected usable preparation records a test issue before identity-aware cleanup. The existing explicit-release case remains in place.

The post-boot query now has bounded helper/direct-child lifecycle observations and one brief sample per owned query/helper. Parent, UID, birth identity and executable metadata are checked; identity changes and unavailable captures remain explicit. Only fixed stack-category counts leave the private sample files. Cancellation uses an uncancelled owned-command consumer and joins actual sampler exit before raw-file cleanup or later fixture commands. Sampling perturbs scheduling; PID checks cannot make external attachment atomic. Original query arguments, environment, 60-second deadline, grace, parsing and full owner-bound cleanup/inventory gates remain unchanged. No production runner behavior change is inferred from missing consumer bytes.

The newest change addresses a confirmed minimum-width toolbar defect: after selecting the long owned simulator name, all app toolbar controls moved into overflow at 900 points, so a subsequent launch could not expose the target picker. The complete menu now has a 220-point bound with horizontal compression, and the three primary actions use icon-only visual labels while retaining their accessible titles and identifiers. The native test immediately requires picker visibility/hittability after real selection on both launches; no fallback interaction, larger window, longer wait or skipped assertion is used.

Verification

Candidate: 939b853796b85c35ed16f7b84c3ff967851f8b9b (tree 9acf10ce69258234e4e66738d57510474079063d). The latest checkpoint changes ContentView and one native post-selection assertion: seven additions, three removals.

Local Xcode 27.2 / Swift 6.4.2, headless:

• nice -n 10 swift build -j 2 -Xswiftc -warnings-as-errors: passed.
• nice -n 10 swift test --build-system native --disable-automatic-resolution --parallel -j 2 -Xswiftc -warnings-as-errors: 279 tests / 42 suites passed in 6.793 seconds; opt-in coverage remains separate.
• nice -n 10 xcodebuild -project iOSDeveloperToolkit.xcodeproj -scheme iOSDeveloperToolkit -configuration Debug -destination 'platform=macOS,arch=arm64' -jobs 2 build-for-testing: passed using existing per-target warnings-as-errors.
• codesign --verify --deep --strict --verbose=2 on the built Debug app: passed.
• The earlier global warnings override attempt failed in NIOConcurrencyHelpers because it conflicts with its suppress-warnings flag; no dependency or build settings were altered.
• The unchanged diagnostic helper compiled with swiftc -swift-version 6 -warnings-as-errors -parse-as-library; real process probes passed fast completion, dual sample capture, primary timeout preservation and actual query exit during sampling with sampler exit joined before return.
• Independent source review and whitespace checks passed. No local desktop, simulator, physical-device or VoiceOver activity was used.

Current CI passed all four jobs at actual test-merge ec00fb7d45be933418430063209cb0f0704657e5, whose tree matches this candidate:

• Package: 279 tests / 42 suites passed in 17.449 seconds, including both real reader lifetime cases; CLI smokes passed.
• Ordinary UI: 16 passed, zero failed, one expected explicit-native opt-in skip. The internal QoS warning remains separate.
• Explicit native package acceptance: one passed, zero failed, zero skipped; actual case time 533.262 seconds. Both launches, direct picker access after selecting the long target, held-reader Quit Cancel and later valid preparation, malformed denial/recovery, confirmation Cancel, late cancelled A disposal with B preserved, first normal Quit, unfinished-reader Quit Anyway/eight-second refusal, re-selection denial, actual release/validation/cleanup, recovery and final normal Quit all ran.
• Independent verification found all six recorded private preparation paths absent, all three original input hashes unchanged and unchanged simulator inventory. Fresh discovery verified exact owner-bound simulator absence and removed its fixture directory.
• Both held-reader native screenshots and alert accessibility trees show the 222-pixel picker plus running indicator and compact primary controls, without the former overflow popup; accessible titles remain present.
• Artifact 14086938663 matched its published digest and contained actual result summaries and the matching six-path native receipt. All 17 native and 34 layout PNGs decoded and drew into full raster contexts.
• All 17 pages rendered at each actual window size, 1180×677 and 900×612. The VM clamped the requested default height. Offscreen layout exports omit sidebar rows, while native captures contain sidebar content; geometry success does not resolve that capture coverage gap.
• Real simulator 2/2 passed in 509.147 seconds. DVT Logging through xctrace exceeded its 183-second deadline and remained explicitly unverified.
• Unpublished universal Release packaging, signed-app and ZIP verification passed.
• Post-boot discovery returned in 59.964 seconds with 33,551 consumer-delivered stdout bytes and a real final result. Both bounded samples timed out; metadata observed the owned child, but no hosted stack counts were available. The prior timeout's cause is unproven.

Current Swift/Actions CodeQL passed all five jobs, including both processed uploads. All 12 exact-head checks are completed successfully.

• Actual checkout ec00fb7d45be933418430063209cb0f0704657e5 has this candidate's tree. Swift code-scanning analysis 2165492208 and Actions analysis 2165329223 match that revision and pull-request merge ref, with empty API error/warning fields.
• Actual Swift SARIF has zero extraction-error descriptors across all 1,055 execution notifications, including level: none; zero warning/error/configuration notifications and zero unresolved AST nodes. Root independently verified the artifact/SARIF hashes and parsed the actual file.
• Located extraction is Sources 80/80, App 24/26 and Tests 3/27: 107/133 primary files, 138 repository-wide. All 13 cumulative changed production files, including ContentView, are located. UI tests, changed test files and both fixture scripts lack located extraction evidence; imported-module semantics remain partial. Compilation, real-process probes and runtime tests remain separate evidence.
• One existing swift/redos finding at ThreatIntelligence.swift:152 has the same location and fingerprint as the earlier candidate. Actions has zero results.

Remaining validation

This PR remains draft and unmerged. The current scripted native, integrity, cleanup, geometry and required GitHub checks pass. No merge or release has been performed.

Armed-before-hold teardown, natural 180-second expiry, actual uninterruptible C-call overlap, representative physical signing/provisioning/CoreDevice/native IPA installation, coordinated VoiceOver and distribution remain separate. Offscreen sidebar capture needs a fidelity check; DVT Logging and the intermittent post-boot query remain coverage/reliability limits. Original query arguments, environment, deadline, full ownership and cleanup checks remain unchanged.