@@ -173,11 +173,11 @@ extension RunnerTests {
   }
 
   /// The back gesture a device takes: a hold-free 200 ms fling from 2 pt inside the leading edge to
-  /// 0.9 of the width at mid-height, synthesized on the context's screen route without reading the
-  /// tree (#4221). On an iPhone 17 Pro it popped Settings > General and a header-less React Native
+  /// 0.9 of the width at mid-height, synthesized on the context's screen route, so it is safe on a
+  /// tree XCTest cannot serialize (#4221). On an iPhone 17 Pro it popped Settings > General and a header-less React Native
   /// screen 5 times in 5 each, where XCTest's press-and-drag, which holds at the edge for at least
-  /// 0.1 s and then moves at 500 px/s, missed 2 in 10. The plan is resolved here, so the returned
-  /// dispatch runs only the fling.
+  /// 0.1 s and then moves at 500 px/s, missed 2 in 10. The plan and every tree and window read it
+  /// needs are resolved here, so the returned dispatch runs only the fling.
   static let deviceBackFlingDurationMs = 200.0
 
   @MainActor
 
@@ -128,11 +128,11 @@ extension RunnerTests {
     XCTAssertGreaterThanOrEqual(slowCaptures, 4, "settle, just-before, and after samples were all slowed")
   }
 
-  /// A device's sample cost: every capture takes 0.4 s and the contact runs 0.2 s, as a physical
-  /// iPhone's capture and fling do. The still span grows with the capture, so the pop reads as
-  /// performed.
+  /// A device's timing on the simulator's edge touch: every capture takes 0.4 s and the contact is
+  /// delayed to 0.2 s, as long as a physical iPhone's capture and fling. The still span grows with the
+  /// capture, so the pop reads as performed.
   @MainActor
-  func testInAppBackWithSlowCapturesAndAFlingLongContactIsPerformed() throws {
+  func testInAppBackWithSlowCapturesAndALongerContactIsPerformed() throws {
     let status = try launchBackFixture(["--agent-device-back-regression"])
     defer { endBackFixture() }
     let restoreCapture = try slowScreenshots(by: 0.4) {}
 
@@ -265,6 +265,42 @@ extension RunnerTests {
     XCTAssertEqual(RunnerCoordinatePressCounter.drags, 0, "the XCTest press-and-drag never ran")
   }
 
+  /// On a readable tree the device back fling does all its tree and window reads while it is prepared,
+  /// so the fling itself, which runs after the just-before sample, queries no windows and presses no
+  /// XCTest coordinate.
+  @MainActor
+  func testDeviceBackFlingOnAReadableTreeQueriesNoWindowsWhileItFlings() throws {
+    app.launch()
+    mainOwned.app = app
+    defer {
+      invalidateCachedTarget(reason: "unit_test_cleanup")
+      app.terminate()
+    }
+    let context = try XCTUnwrap(try synthesizedCoordinateContext(app: app))
+    guard !context.treeUnreadable else { return XCTFail("the fixture tree must be readable") }
+    guard case .ready(let fling) = try prepareDeviceBackFling(app: app, context: context) else {
+      return XCTFail("a readable tree resolves the fling")
+    }
+    let selector = NSSelectorFromString("allElementsBoundByIndex")
+    let query = try XCTUnwrap(class_getInstanceMethod(XCUIElementQuery.self, selector))
+    let originalQuery = method_getImplementation(query)
+    var queries = 0
+    let countedQuery = imp_implementationWithBlock({ (target: AnyObject) -> NSArray in
+      queries += 1
+      typealias Query = @convention(c) (AnyObject, Selector) -> NSArray
+      return unsafeBitCast(originalQuery, to: Query.self)(target, selector)
+    } as @convention(block) (AnyObject) -> NSArray)
+    method_setImplementation(query, countedQuery)
+    defer {
+      method_setImplementation(query, originalQuery)
+      imp_removeBlock(countedQuery)
+    }
+
+    guard case .sent = try fling() else { return XCTFail("the fling must be sent") }
+
+    XCTAssertEqual(queries, 0, "no windows query runs inside the gap")
+  }
+
   /// A synthesis that fails before its record is handed to XCTest touched nothing; one that fails
   /// after may have run.
   func testSynthesisFailureMapsByWhetherTheRecordWasDispatched() {
 
@@ -153,11 +153,14 @@ contact, and one more sample, taken right before the swipe, must still match the
 | Platform | Resolved before the last sample | Left in the gap | Contact allowance |
 | --- | --- | --- | --- |
 | Simulator | the edge-touch plan, its display, and the HID touchscreen sender | the 100 ms edge contact | 0.2 s |
-| Device | the synthesized fling plan (2 pt inside the leading edge to 0.9 of the width, no hold), which reads no tree | the 200 ms fling | 0.4 s |
+| Device | the synthesized fling plan (2 pt inside the leading edge to 0.9 of the width, no hold), with every tree and window read it needs | the 200 ms fling | 0.4 s |
+
+On both, every tree and window read happens during that preparation, before the just-before sample.
 
 Settling takes at most 8 samples, so the wait before the swipe is at most 1.75 s of delays plus
 eight captures, then the preparation and the last sample: about 2.6 s with the 0.1 s captures of a
-local simulator, and about 5 s with the 0.4 s captures of a physical iPhone. Usually a still screen
+local simulator, and about 5 s with the 0.4 s captures measured on one physical iPhone (iPhone 17 Pro,
+iOS 27.0.1; https://github.com/callstack/agent-device/pull/4460#issuecomment-6828546541). Usually a still screen
 settles after 3 samples.
 
 Only a change from the last sample to the sample after the swipe counts, and only when the time
 
@@ -124,7 +124,7 @@ iOS Simulator launch behavior:
 Back, orientation, and hardware buttons:
 
 - `back` uses app-owned back navigation: the back keyevent on Android, the visible back control on macOS, and the Siri Remote Menu button on tvOS. `--in-app` names this default explicitly.
-- On iOS, `back` is the left-edge back swipe, with or without `--in-app` or `--system`. It succeeds only when the app's screen, drawn as a 48×96 grayscale grid with its top 7 rows left out (in portrait, the status bar and Dynamic Island band, whether the status bar is shown or hidden; in landscape the iPhone status bar is hidden and the Dynamic Island sits at a side edge, outside those rows), differs in more than 1% of the remaining cells by more than 24 of 256 levels. A small spinner usually stays under that; a larger animation can still count as a change. The change counted is the one between the sample taken immediately before the swipe and the one taken about 0.25 s after it, so a screen that changes on its own inside that gap, after it looked still, can be misread as a back navigation; verify with `snapshot` when the screen has auto-advancing content. Before it swipes, it waits for the screen to stop changing: up to 8 samples 0.25 s apart, which is 1.75 s plus eight screen captures: about 2.6 s on a simulator and about 5 s on a physical iPhone.
+- On iOS, `back` is the left-edge back swipe, with or without `--in-app` or `--system`. It succeeds only when the app's screen, drawn as a 48×96 grayscale grid with its top 7 rows left out (in portrait, the status bar and Dynamic Island band, whether the status bar is shown or hidden; in landscape the iPhone status bar is hidden and the Dynamic Island sits at a side edge, outside those rows), differs in more than 1% of the remaining cells by more than 24 of 256 levels. A small spinner usually stays under that; a larger animation can still count as a change. The change counted is the one between the sample taken immediately before the swipe and the one taken about 0.25 s after it, so a screen that changes on its own inside that gap, after it looked still, can be misread as a back navigation; verify with `snapshot` when the screen has auto-advancing content. Before it swipes, it waits for the screen to stop changing: up to 8 samples 0.25 s apart, which is 1.75 s plus eight screen captures: about 2.6 s on a simulator, and about 5 s on a physical iPhone, based on the 0.4 s capture measured on one iPhone 17 Pro with iOS 27.0.1 ([PR #4460 evidence](https://github.com/callstack/agent-device/pull/4460#issuecomment-6828546541)).
 - `reason: back_swipe_no_change`: the swipe was sent and the screen did not change. Press the visible back or close control.
 - `reason: back_swipe_unverified`: the swipe may or may not have navigated, because the screen kept changing before the swipe, the swipe took longer than the screen had been still, or the screen could not be sampled after it. Check with `snapshot`.
 - `reason: back_swipe_not_dispatched`: the swipe was refused before any touch went down, so nothing reached the device.