[hideouts-io]

Problem and behavior

Installed Apps could retain an earlier device's inventory or action while selection changed. Launch and Remove now capture the row, target and inventory generation. Selection/refresh invalidates stale confirmations, preparation and execution require matching ownership, and obsolete results cannot replace the current inventory. A failed refresh retains the previous rows and owner with stale actions disabled. Cancelled simulator discovery cannot replace a completed snapshot, and the target picker fits the minimum window width while retaining full menu names.

Native acceptance

A standalone CI host creates two owner-registered simulators with A-only, B-only and shared apps. It verifies B's identity and successful inventory read, shuts down only B, and requires a real nonzero shutdown-state listapps result. The sandboxed UI runner then drives the app's ordinary controls. Explicit Debug acceptance excludes physical discovery and exposes only the owned targets.

The test verifies the actual error/recovery values, retained A rows/source/owner and disabled stale controls, production B Start/reload, explicit removal Cancel, confirmed B-only removal with A/B isolation, rejection of an actually delivered late successful A reply while preserving B selection/provenance, and confirmation dismissal after genuine owned-A loss. Cleanup freshly verifies both UUIDs and exact owned names absent.

Read-only Debug UI-test diagnostics observe actual app/main/key-window readiness. A unique identified name cell must be reachable with positive geometry inside the main window; one real click must produce native selection. Diagnostics never set focus or selection, and ordinary bindings are unchanged. The earlier Demo failure's historical focus cause remains unproven; its inside-cell click was retained as evidence. Exact native error assertions read checked StaticText values.

Verification at 27b3654a7e064b906d237d04c2414d1b475766e8

• CI passed all four groups: strict package 265 reported tests/41 suites and three CLI smoke commands; 17 ordinary Demo UI tests; two real-simulator tests; unpublished universal arm64/x86_64 app/CLI packaging, signing and ZIP/checksum verification.
• Explicit native acceptance passed 1/1, zero failures/skips, in 530.941 seconds. The real shutdown read exited 149. Actual typed error values and all ownership/recovery/cancellation assertions passed. All 18 native readiness snapshots and six after-click selections matched; Demo also recorded correct one-click selection. Fresh cleanup passed. All 34 rendered layout PNGs and 21 native/Demo screenshots fully decoded.
• Current Swift/Actions CodeQL, extraction gate, both uploads and strict aggregate passed. Actual Swift SARIF reports execution success, zero extraction diagnostics including level-none, and zero unresolved AST metric. All eight changed production files have located successful extraction. Located coverage is 106/131 tracked Swift files: Sources 78/78, App 25/27, Tests 3/26. The 437 locationless successes were not credited. The fixture host is listed but not extracted; test-source/imported-module semantics remain incomplete. Analysis used a test-merge tree identical to the candidate.
• Dependency review passed.
• Local frozen full-parallel package execution passed 265 reported tests/41 suites with eight expected opt-in skips. Swift Testing's completed text summary is authoritative; the separate XCTest XML contains no cases. Final Xcode 27.2 strict app/UI-test compilation, fixture-host compilation, strict/deep bundle signature verification and independent combined-diff review passed. No local app/UI, simulator or physical-device operation ran.

Remaining gates

The PR remains draft and unmerged. Additional reconnect/modal cases, VoiceOver, representative physical compatibility and final release/distribution acceptance remain separate. No private evidence or telemetry is added.