[rorychatt]

What this is

The Mileage app (web/apps/mileage-app) on iOS, as the owner ruled on 2026-10-29 (relayed by the lead session; not yet in docs/DECISIONS.md): every native app works on Android and on iOS. Draft. The base is feat/mileage-app (PR #27, the Android app), which this branch does not change; merge this one after #27, or retarget it.

Everything below is marked in docs/spec/mobile.md: the port and its evidence are 8.8, the steps for the owner's iPhone are 9.2. Nothing here was run on an iPhone, no agent signed in to an Apple account, and nothing was built for a device.

What changed

• iOS configuration (app.config.ts, config/ios.ts): the location background mode and nothing else (no fetch, no Always, motion or full-accuracy keys), the app's own "While Using" text, NSLocalNetworkUsageDescription in every build, the bundle id from OBOP_IOS_BUNDLE_ID (test builds org.obop.mileage.test; the sign-in scheme stays org.obop.mileage). The development client's Bonjour service and URL scheme are taken out of the generated Info.plist unless OBOP_DEV_CLIENT=1.
• Release gate (vp run ios:gate): fails a build that can speak plain http, carries thinningOff, has an ATS exception of its own, declares another background mode, or carries the development client's _expo._tcp or exp+ scheme. In a test build it fails thinningOff without cleartextAllowed (the app ignores the variable then) and warns about the test bundle id with cleartextAllowed=false. Round 3: --drive (vp run ios:gate -- APP --test-build --drive, for the build of the first iPhone drive) also fails unless cleartextAllowed is true, thinningOff is true and the default server is an http:// address, and names the variable that fixes each. New in round 4: --expect-server URL and --expect-bundle-id ID (only with --drive; the server must be an http:// address and is compared as scheme, host, port and path, a trailing slash and the case of the host ignored; the bundle id is an exact match). A build that points at another address, or has another bundle id, fails with a drive build: line that names the variable (OBOP_DEFAULT_SERVER, OBOP_IOS_BUNDLE_ID), and the remedy line names both rebuild commands (vp run ios:run:device for the phone, vp run ios:build:simulator Release for a Simulator build). Used without --drive, with no value, or with an https:// server, the command stops with the usage text (exit 2). The failure "the build ignores OBOP_RECORD_THINNING because plain http is not allowed" now begins with drive build: when --drive is set, like the other three.
• iOS-safe core: Keychain class AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY on every write; "Precise Location off" is refused like Android's coarse; negative accuracy and speed are no position; fixes closer than 2 s and 50 m are dropped (thinning, on every platform); a restored backup with no key replaces the unreadable file and says so (and a failure half way no longer leaves the app stuck: the new key is stored as pending first, the opened file is closed if anything after the open throws, and a close that itself rejects or throws cannot replace the error that is on its way, closeQuietly; a plain key is never followed by a deletion, a pending key may be, when the file it meets is not a database); a reinstall starts signed out; a stored address is checked again at start; a call whose deadline passed during a suspension gets one grace period; 7 sentences have an iOS wording (including the Failed screen, which named Android's "Clear storage"); on iOS the Location Services switch is asked before the app's permission, which the system reports as denied while the switch is off.
• Test-build switch OBOP_RECORD_THINNING=off: does not thin the fixes (the store still drops implausible, not-later and stale fixes and stops at 20,000 points), so that the first iPhone drive shows what the phone delivers. Honoured only in a build that also allows plain http; the gate fails a release build that has it. vp run emulator:thinning replays the rules 2 s / 50 m, 1.5 s / 50 m and none over a trip from the server (--skip N drops the first N fixes, to vary the phase of a 1 Hz feed). Round 3: --save-points FILE writes the time and position of the fetched points as the JSON that --points reads back (it refuses to overwrite a file), and scripts/emulator/route-feed.mjs writes a clean synthetic feed. Round 4: the header of the script says the file is the owner's and gives an absolute path outside any repository (9.2 uses $env:USERPROFILE\iphone-trip-points.json), and that other start phases are run as --points FILE --skip N, not as the first line again (it refuses to overwrite); the line it prints names the absolute path; the reasons for the wx flag and the mode 0600 are in comments.
• Scripts: export:ios, ios:prebuild, ios:pods, ios:build:simulator (ad hoc signed), ios:gate, ios:run:device (not run), simulator:route, simulator:drive, scripts/ios/env.sh (the build environment, with CI unset). Round 4: env.sh sets pnpm_config_store_dir; pnpm 12.6.0 ignores the npm_config_store_dir that the file set before, so the pnpm store went to ~/Library/pnpm/store and not to ~/build/tools (checked on the Mac, below). route.mjs printed nothing on macOS and Linux; fixed. emulator:check prints the points per minute and the largest gap.
• Docs: spec 8.8, 9.2, 4.2, 12 to 15; ISSUES L42 to L48; CLAUDE.md and DEPLOY.md lines. Round 4 changed 9.2 and the 9.1 blocks it uses:
  • Every step is numbered once: A1 to A8 (the Mac and the phone), B1 to B4, C1 to C3, D1 to D3 with D3.1 to D3.5, T1 to T10, R1 to R9, P1 to P4; the cross-references follow.
  • A8 keeps a copy of the built app in ~/build/obop-keep/obopMileage.app (ditto), outside everything the clean-up removes, and gives the reinstall as xcrun devicectl device install app --device <name or identifier> <path> ("general knowledge, not tried with a phone"; the syntax is from --help on the Mac). T5, T9 and T10 now use that copy, so they no longer contradict "sign out as soon as the app is installed"; "When it is safe" is rewritten, the clean-up removes ~/build/obop-keep, and the instance on the PC is not deleted until the lead session has written that it has what it needs.
  • A5 says what a working signing step looks like, to choose the phone as the destination and build once in Xcode, and that with a team set expo run:ios does not repair a missing profile (@expo/cli 58.1.13, XcodeBuild.js lines 302 to 304 and configureCodeSigning.js lines 68 to 72).
  • D3.2 saves the route outside any repository (D3.3 says the file is the owner's) and replays it with --points FILE --skip 1 and --skip 2; report item R4 asks for those two outputs.
  • Part A is runnable as written: the placeholders are explained, OBOP_CHECK_PASSWORD is on its own line, the second window starts with cd, a restart recipe, a note that the first cargo build is long, the Mac block pulls and prints rev-parse; the gate line carries both --expect-* options. The sections and rows the text refers to are named (8.8, 4.2, 9.1, 9.2, L39 to L48), and Q37, D21 and M3 are marked as needing no action.
  • 8.8: "from 0 up to about 1.2 %", which tracks the "1.5 s = 2 s" sentence covers, which closure check made the second measurement, the history of the device identifiers, and a paragraph on what the Mac mini said without a phone.

Round 5 (the last one; the fourth closure check found only hand-over defects and one test gap):

• 9.2 and the hand-over file: the final Mac clean-up names both profile folders (~/Library/MobileDevice/Provisioning Profiles and ~/Library/Developer/Xcode/UserData/Provisioning Profiles; look in both, delete what is there; on the Mac mini, before any signing, neither folder exists, only ~/Library/Developer/Xcode/UserData itself does, checked with ls on 2026-10-30, so the folders are looked at again after the sign-out); the kept copy of the app (~/build/obop-keep) has its own paragraph and timing (after the last use, T10), the Apple ID block says it is not part of it and what an early clean-up costs (T5, T9 and T10 need a rebuild with a new sign-in); one sentence before the Mac block says to replace <LAN> and the other words in angle brackets together with the brackets; "Untrusted Developer" or "Unable to Verify App" after a reinstall is the install and not a failed test (A8); the PC stays on, awake, at the same address through T7 to T10 until the lead session has what it needs; D3 is done before the trip of any extra test is submitted, else --trip ID (an option of both scripts, read from server-lib.mjs); the gate facts are listed in the order it prints them; after seven days the app "can no longer be installed or no longer starts", counted from the profile that Xcode makes in A5.
• 8.8 and 9.2: the --expect-* options were run on a real Release Simulator build by the fourth closure check (the device path was not); the "Incompatible device" clause belongs to the first closure check, and the full simulator identifiers worked in every run that used them (the second, third and fourth checks).
• gate.test.ts: a bundle id that only starts with, or ends with, the expected one (org.obop.mileage.test2, org.obop.mileage.test.extra, com.org.obop.mileage.test against org.obop.mileage.test) fails, in a unit case and a command case; one test is renamed to say what it checks. Nothing under src/, web/packages or crates/ changed in round 5.

What was run

PC, on the head of this branch (8f1a3e0; the last change to code is cf0b72a, a test in gate.test.ts; round 4 changed code in 11f958d and 1727c0d; the other commits are documents). The counts below were taken on ba27130; 8f1a3e0 changes docs/spec/mobile.md only, so the tests are unchanged and were not re-run for it:

• vp test in web/apps/mileage-app: 30 files, 424 passed, 1 skipped (a symlink case that Windows cannot make; on the Mac it ran). web/packages/client: 156 passed, 10 skipped (not mine). ui-native: 15 passed. trip-core: 26 passed (these three at 451f2b1; nothing in those packages changed after it, round 5 included).
• vp check in the app: 114 files formatted, no lint errors in 112 files. At the web root vp check reported 3 unformatted generated files that this branch does not touch (as in round 2; not re-run in round 4).
• vp run export:ios, vp run export:android, vp run check:sdk: pass (at 451f2b1).
• The gate with the new options, from hand-made files (--info-plist-json, --app-config): a match exits 0 ("gate passed (test build)"); another server exits 1 and another bundle id exits 1, each with a FAIL drive build: line naming the variable and the remedy line; --expect-server without --drive exits 2; --expect-bundle-id with no value exits 2. The unit tests (54 in gate.test.ts) run the same cases and more.
• vp run emulator:thinning -- --save-points FILE against a stand-in HTTP server (round 3) and in unit tests: it saved 241 points, printed the table, and a second run refused to overwrite the file. Against a real instance it was run by the third closure check of a3ad91d (reported to me, not run by me): it saved all 248 points, and the replay worked from the file after the instance's data was removed.
• How the tests were checked. In round 4 each new rule was broken on purpose and the test file that should catch it was run: 16 hand-made changes to the gate and the command (the server or the bundle id never compared, a trailing slash or the path mattering, no "as expected" line, a remedy that names one command only, the prefix missing or always present, the options allowed without --drive or with an https:// server, the command not passing the options on, a flag taken as a value), 2 to --save-points (the skipped points saved, the relative name announced) and 1 to env.sh (the variable that pnpm ignores): all 19 failed the test file. After the test fix below, the relative-name change was run again against the new test and fails it. The scripts are in the session's scratch folder, not in the repository. Earlier rounds: 19 changes in round 3 (all failed the test files), four changes to the close paths of open-outbox.ts (a fifth, a plain await file.close() inside closeQuietly, is not caught and is equivalent under async), and the lead's closure check ran 24 of 25 mutations caught (the one that survived is the line in native/store.ts that joins thinningFor(extra) to createSqlStore, which no unit test can reach without expo modules).
• Round 5: the exact match of the bundle id was weakened three ways, in gate-lib.mjs, and gate.test.ts was run: startsWith, includes and endsWith instead of !==. Before the new cases the startsWith version survived the tests of 6583184 (every test stayed green); with the new cases all three fail the file (2, 2 and 1 tests). The script is in the session's scratch folder, not in the repository.
• The iOS placeholder check compares empty strings today (none of the 7 iOS sentences or their base sentences has a placeholder); it can fail only when one is added.

Mac mini (macOS 27.0, Xcode 27.1), synced with git pull --ff-only each time:

• vp test and vp check on ba27130 (same code as 8f1a3e0): 30 files, 425 passed, no lint errors; gate.test.ts alone 54 passed. The first Mac run, on 451f2b1, failed one test (422 passed): the new test of a relative --save-points name compared the printed path with the path of the temporary folder, and on macOS that folder is reached through the link /var while the script prints /private/var. The script was right and the test too strict; 1727c0d compares the printed path (absolute, and the same file by realpath), and the Mac run on 1727c0d passed all 423. The PC cannot show this: Windows has no such link.
• The gate with the new options through the real command, vp run ios:gate -- APP ..., over a hand-made folder shaped like an app (an Info.plist converted with plutil and EXConstants.bundle/app.config): a match 0 (also with a trailing slash on the address), another server 1, another bundle id 1, without --drive 2, a missing value 2 (also when another option follows), an https:// address after --expect-server 2, --drive without the options 0. Not run on a real Release build.
• xcrun devicectl list devices printed one device, iPhone 18 Pro, state shutdown, Reality simulated; xcrun devicectl device install app --help printed the usage devicectl device install app --device <uuid|ecid|serial_number|udid|name|dns_name> <path> ...; xcrun devicectl --version printed 651.13.5. pnpm store path (pnpm 12.6.0): ~/Library/pnpm/store/v11 with npm_config_store_dir, PNPM_STORE_DIR, NPM_CONFIG_STORE_DIR, npm_config_store-dir or pnpm_config_store-dir set, and ~/build/tools/pnpm-store/v11 with pnpm_config_store_dir or --store-dir; vp install with pnpm_config_store_dir reported "Content-addressable store is at: /Users/rorymac/build/tools/pnpm-store/v11". A stray tail -f of an earlier round was stopped; ~/build/mileage-ios/out/ was kept.
• Earlier rounds, unchanged: five Release builds for the Simulator on 2026-10-30 with Info.plist read by plutil and the gate run on each (a test build with the thinning off, the same again, a plain build, a build with OBOP_DEV_CLIENT=1 that the gate fails on the exp+obop-mileage scheme, and a test build after that); the strip phase of expo-dev-launcher deletes only _expo._tcp, never the exp+ scheme, and in an incremental build it runs before the plist is processed. Round 3, on c405891: a test build made with the four variables exported passed --test-build --drive (exit 0); an incremental vp run ios:build:simulator Release of the same app in a shell without them wrote cleartextAllowed false, no default server and the thinning on, passed the ordinary --test-build gate with the one warning (exit 0) and failed --drive (exit 1) with the three facts and the remedy. The Simulator drive (simulator:drive) was run after the code of round 3 by the third closure check, on a3ad91d: 6 tests, ** TEST SUCCEEDED **, 248 points, -0.26%. Nothing was driven on 8f1a3e0, because rounds 4 and 5 changed no code that runs in the app or in the drive (round 4: the gate and its option handling, env.sh, the header and comments of the replay script, and tests; round 5: documents and one test; nothing under src/, web/packages or crates/). The fourth closure check ran the gate with --test-build --drive --expect-server ... --expect-bundle-id ... on a real Release Simulator test build (head 6583184): exit 0 with the two "as expected" lines for the right server and bundle id; exit 1 with the drive build: lines and the remedy for a wrong host, port, path and bundle id; exit 2 for a missing value and for the options without --drive; the ditto copy of the app was identical (diff -r), passed codesign --verify --deep --strict and the gate. The same options on a build for a device are not run. Details in 8.8.

iOS Simulator against a throwaway instance (ASWebAuthenticationSession sign-in, trips with the Home button, the server's check of the points, reinstall, restored backup, simctl terminate and simctl launch mid-trip (not a force-quit by a finger: that stays for the iPhone, T2), plain http over the LAN, a plain build that refuses http). Reference 4,000 m; the length by the server's formula is 3,989.44 m:

route	thinning	points	distance	against 4,000 m
one fix per 100 m (first run)	on	42, seq 1 to 42	3,989.44 m	-0.26%
one fix per 100 m (review)	on	41	3,989.44 m	-0.26%
one fix per 100 m (fix round, fresh device)	on	42	3,989.44 m	-0.26%
one fix per second (first run)	on	121	3,944.51 m	-1.39% (failed 1.0%)
one fix per second (review, twice)	on	121	3,989.44 m	-0.26%
one fix per second (fix round)	on	122	3,989.44 m	-0.26%
one fix per second (fix round)	off	248	3,989.44 m	-0.26%

The first 1 Hz run's -1.39% was first explained as the chords across the route's corners and as the price of the 2 s rule. That explanation was wrong and is withdrawn: the route has 4 corners, not 40, and the later runs did not repeat the figure. Replaying the rule over the 248 unthinned fixes after dropping the first K of them (vp run emulator:thinning -- ... --skip K, K = 0 to 5; reproduced from a file of the trip's points, the instance being gone) costs 0, 0, 1.14%, 0, 1.15% and 0% of the length of the fixes it was given: the cost depends on a phase of the 1 Hz feed that nobody chose, and the first run's figure is read as the bad phase (an inference; its phase was not recorded).

The clean-feed series. A clean synthetic 1 Hz feed along the route (node scripts/emulator/route-feed.mjs feed.json, 241 fixes, 100 m legs at 16.667 m/s, then vp run emulator:thinning -- --points feed.json --skip K; a unit test pins the figures) falls short of the fixes it was given by 0.00, 1.15, 0.00, 1.16, 0.00 and 1.17% for K = 0 to 5, with 121, 120, 120, 119, 119 and 118 points kept (the same for 1.5 s and 2 s on this feed): in the even phases the rule keeps the three corners and the last fix, and in the odd ones it loses three corner chords of 9.7 m each and the last step of 16.6 m. A second real measurement, by the second closure check (head 1c52c90, 2026-10-30, a fresh device, a test build with the thinning off; 248 points over 241 s, 3,989.44 m; the trip was not kept): it replays for 2 s / 50 m to 121, 120, 120, 120, 119 and 119 points kept and a shortfall of 0.00, 1.13, 1.13, 0.00, 1.14 and 0.00%, and for 1.5 s / 50 m to 121, 121, 120, 120, 119 and 119 points and 0.00, 0.00, 1.13, 0.00, 1.14 and 0.00% (so on that trip 1.5 s and 2 s differ for K = 1; on the clean feed and on this session's 248-point trip they give the same distance). The real series and the clean one differ from each other and nothing shows why: their track files were not kept, and the clean feed reproduces the mechanism and not these exact numbers. What these runs support: on this route at 1 Hz the rule costs from 0 up to about 1.2%, depending on a phase that nobody chose. What they do not support: a price per corner, a price of 2 s, or a reason to prefer 1.5 s. Nothing was changed to make any figure pass, and none of these runs is evidence for or against 2 s: that is left to the first iPhone drive (L44).

Android regression: expo prebuild --platform android at the base and at the head gives byte-identical project files (the review), and the release APKs differ only in the JavaScript bundle and the embedded config. Two runs of the 41-waypoint route on the emulator: this session's build from the range up to 6a1dafb gave 56 points, 3,989.35 m, -0.27% (as recorded in the first text of this pull request; no log was kept); the review's build of head 1e29576 gave 70 points, 3,981.64 m (-0.20% against 3,989.44 m), 11.5 points a minute, smallest gap 3.003 s, and the base 82 points, 3,985.53 m. The thinning acts on Android too, but the 5 s interval of expo-location means the 2 s rule does not act in the normal case. Details in 8.8, "What was run on Android".

Checked only by unit tests, or only by reading

• The close paths of src/core/open-outbox.ts (a close that rejects, a close that throws synchronously, a double close, the close after a failed note write) and the deletion of a pending key: a fake database file only. The Simulator drive of the closure check passed through the success path of this file on a first start; no failure path was ever run on a Simulator or a phone.
• The link in src/native/store.ts that gives thinningFor(extra) to createSqlStore: no unit test reaches it. Only the Simulator drive (248 points stored with the thinning off) and the smallest-gap check of 9.2 step D3.2 guard it.
• The --drive gate with --expect-server and --expect-bundle-id on an app built for an iPhone: not run. With the options it ran on hand-made files, on a hand-made app folder and, in the fourth closure check, on a real Release build for the Simulator; without them it ran on Release builds for the Simulator.
• The 9.2 line that finds the built app (find ~/Library/Developer/Xcode/DerivedData -maxdepth 6 -path '*Release-iphoneos/obopMileage.app') and echo $? after the gate: no build for a device was ever made, so the line never found anything; that Expo puts the app in the standard DerivedData folder is read from the CLI's source.
• The PC block of Part A as it is written now (the worktree path D:\git\SpaceCorps\obop-wt\ios in the owner's copy, New-Item, target\debug\obop.exe, the restart recipe, the second window starting with cd): not run in that form on the owner's PC.
• The reinstall with xcrun devicectl device install app (A8) and ditto of the app: the syntax is from --help on the Mac mini; it was never run with a phone, and ditto was checked on a signed macOS app, not on the iPhone app.
• --save-points and the replay from the saved file were run against a real instance by the third closure check; the exact 9.2 line ($env:USERPROFILE\iphone-trip-points.json on Windows, then --points ... --skip 1 and --skip 2) was not run in that form.
• The Devices page sentence in 9.1, 9.2 and the hand-over: read from the code (Customize.tsx, Security.tsx, devices.rs), not seen in a browser.
• Every Apple and Xcode step of 9.2 (Trust, Developer Mode, the Apple ID and the Personal Team, signing and what a working signing step looks like, the profile and its seven days, the removal of the certificate): written from general knowledge, never run; no agent signed in to an Apple account.

Not verified (the iPhone test, 9.2)

Recording with the phone locked for 10 and 30 minutes under "While Using" (the decisive test; if it fails the fallbacks of 4.2 need an owner ruling), the local network prompt and a refusal of it, Low Power Mode, Allow Once, a force-quit by a finger, Precise Location off and Location Services off on a phone (unit-tested only), a real GPS, the battery, a device build and the free team's signing, vp run ios:run:device and the phone-name form of its argument. Not covered by any step of 9.2: the Keychain read while the phone is locked (a recording never reads the Keychain again; it needs a process that starts while locked), fetch with redirect: "manual" on the 400 path, the stored-address recheck of a release build, the deadline of a call after the app was suspended (unit-tested only), VoiceOver, dark mode and text sizes beyond Home, iPad.

Decisions of the lead session (the owner can override)

"While Using" only; AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY; no ATS exception; test bundle id org.obop.mileage.test (Q37 has the point); reinstall signs out, a restored backup is recovered with a notice; store items out of scope; the server needs no change for iOS. Open: the thinning gap, chosen after the first iPhone drive.

🤖 Generated with Claude Code