@@ -152,7 +152,8 @@ jobs:
       # The iPad leg runs a named selection: the smallest set that can execute the off-phone half of
       # the sole-screen rule — the admission boundary itself, the refusal when the display box a
       # synthesized turn swaps cannot be read and the app is not proven full-screen (#4091), one
-      # hostile-tree command that must reach synthesis, and `back`'s route witness.
+      # hostile-tree command that must reach synthesis, and `back`'s route witness: it swipes and
+      # verifies through the route that opens after a rejected query.
       # Geometry and error cases live in the host-runnable evidence matrix instead. `xcodebuild`
       # exits 0 when a selection matches nothing, so the reporter below asserts the executed count
       # against this lane's reach (`XCTEST_LANE=nightly-ipad`, derived by check:xctest-selection).
@@ -172,8 +173,7 @@ jobs:
             -only-testing:AgentDeviceRunnerUITests/RunnerTests/testSoleScreenDisplayIDIsNamedOnlyForAnAppThatFillsItsScreen \
             -only-testing:AgentDeviceRunnerUITests/RunnerTests/testTapRefusesBeforeDispatchWhenTheSoleDisplayCannotBeMeasured \
             -only-testing:AgentDeviceRunnerUITests/RunnerTests/testLongPressOnAnUnserializableTreeIsSynthesizedOnTheSoleScreen \
-            -only-testing:AgentDeviceRunnerUITests/RunnerTests/testInAppBackAfterARejectedQueryTapsThroughTheRouteThatOpens \
-            -only-testing:AgentDeviceRunnerUITests/RunnerTests/testInAppBackAfterARejectedQueryWithUnprovableForegroundTapsThroughTheWindow \
+            -only-testing:AgentDeviceRunnerUITests/RunnerTests/testInAppBackAfterARejectedQuerySwipesAndVerifiesOnTheRouteThatOpens \
             -resultBundlePath "$RESULT_BUNDLE_PATH" 2>&1 | tee .tmp/xctest-nightly/runner.log
 
       # Best-effort and never the job's verdict on its own; the step below is what asserts.
 
@@ -43,6 +43,7 @@ @interface AgentDeviceRunnerFixtureViewController () <UNUserNotificationCenterDe
 // Held for the app's lifetime: a window nobody retained would be gone before the test queried it.
 @property(nonatomic, strong) UIWindow *secondWindow;
 @property(nonatomic, strong) UILabel *navigationBackStatus;
+@property(nonatomic, strong) NSTimer *animationTimer;
 @property(nonatomic, strong) UILabel *maskedToggleStatus;
 @property(nonatomic, strong) UILabel *maskedDeliveryStatus;
 @property(nonatomic, strong) UILabel *maskedTextLengthStatus;
@@ -205,6 +206,12 @@ - (BOOL)textFieldShouldReturn:(UITextField *)textField {
 
 @implementation AgentDeviceRunnerFixtureViewController
 
+// `--hide-status-bar` stands in for a landscape iPhone, full-screen video, or an RN screen that hides
+// its status bar.
+- (BOOL)prefersStatusBarHidden {
+  return [NSProcessInfo.processInfo.arguments containsObject:@"--hide-status-bar"];
+}
+
 // An animation that never ends is what "busy" looks like to XCTest while it decides whether the app
 // may receive an event: the app keeps reporting work in flight, which is the state that cost an alert
 // command its whole deadline in #2546. It stops the moment an alert button is answered, since that
@@ -544,8 +551,12 @@ - (void)updateMaskedToggleStatus {
       [NSString stringWithFormat:@"presses=%lu", (unsigned long)self.maskedTogglePresses];
 }
 
-- (void)navigationBackPressed {
-  self.navigationBackStatus.text = @"Back performed";
+- (void)navigationBackSwiped:(UIScreenEdgePanGestureRecognizer *)recognizer {
+  if (recognizer.state == UIGestureRecognizerStateEnded) {
+    // A back navigation redraws most of the screen, so the fixture repaints all of it too.
+    self.view.backgroundColor = UIColor.systemTealColor;
+    self.navigationBackStatus.text = @"Back performed";
+  }
 }
 
 - (void)agentDeviceWillAttachToWindow:(UIWindow *)window {
@@ -569,34 +580,42 @@ - (void)viewDidLoad {
 
   UILabel *label = self.label;
 
-  // Keep the fixture behind a launch argument so normal runner snapshots remain unchanged.
+  // Keep the fixture behind a launch argument so normal runner snapshots remain unchanged. A
+  // left-edge pan stands in for UIKit's interactive pop: it begins only for an edge-masked touch.
   if ([NSProcessInfo.processInfo.arguments containsObject:@"--agent-device-back-regression"]) {
     self.navigationBackStatus = label;
     label.accessibilityIdentifier = @"agent-device-back-status";
-    if ([NSProcessInfo.processInfo.arguments containsObject:@"--navigation-bar"]) {
-      UINavigationBar *bar = [[UINavigationBar alloc] initWithFrame:CGRectMake(0, 62, self.view.bounds.size.width, 44)];
-      UINavigationItem *item = [[UINavigationItem alloc] initWithTitle:@"Thread"];
-      item.leftBarButtonItem = [[UIBarButtonItem alloc] initWithTitle:@"Go back" style:UIBarButtonItemStylePlain target:self action:@selector(navigationBackPressed)];
-      bar.items = @[item];
-      [self.view addSubview:bar];
-    } else {
-      // The control must sit under the point the runner's top-leading fallback aims at, whose
-      // bounds are known: x lands at most 44 from the frame's leading edge, y at
-      // clamp(safeTopInset + 22, 56, 96). Anchoring to the view's leading (not the safe-area's)
-      // keeps the button under x=44 on a landscape iPhone, where the side inset would otherwise
-      // start a safe-area anchor past it; the safe-area top plus 12 with a 64-pt height spans the
-      // whole clamped y range for every inset an iPhone or iPad reports.
-      UIButton *back = [UIButton buttonWithType:UIButtonTypeSystem];
-      back.translatesAutoresizingMaskIntoConstraints = NO;
-      [back setTitle:@"Go back" forState:UIControlStateNormal];
-      [back addTarget:self action:@selector(navigationBackPressed) forControlEvents:UIControlEventTouchUpInside];
-      [self.view addSubview:back];
-      [NSLayoutConstraint activateConstraints:@[
-        [back.leadingAnchor constraintEqualToAnchor:self.view.leadingAnchor constant:12],
-        [back.topAnchor constraintEqualToAnchor:self.view.safeAreaLayoutGuide.topAnchor constant:12],
-        [back.widthAnchor constraintEqualToConstant:88],
-        [back.heightAnchor constraintEqualToConstant:64],
-      ]];
+    UIScreenEdgePanGestureRecognizer *edgePan =
+        [[UIScreenEdgePanGestureRecognizer alloc] initWithTarget:self action:@selector(navigationBackSwiped:)];
+    edgePan.edges = UIRectEdgeLeft;
+    [self.view addGestureRecognizer:edgePan];
+    // `--animating` keeps the whole screen changing on its own, as a launch that is still rendering:
+    // 16 bands take independent random shades, so no two samples of the screen match.
+    if ([NSProcessInfo.processInfo.arguments containsObject:@"--animating"]) {
+      NSMutableArray<UIView *> *bands = [NSMutableArray array];
+      CGRect bounds = self.view.bounds;
+      for (NSUInteger index = 0; index < 16; index++) {
+        UIView *band = [[UIView alloc] initWithFrame:CGRectMake(
+            0, bounds.size.height * index / 16, bounds.size.width, bounds.size.height / 16)];
+        band.autoresizingMask = UIViewAutoresizingFlexibleWidth;
+        [self.view insertSubview:band atIndex:0];
+        [bands addObject:band];
+      }
+      [self.animationTimer invalidate];
+      self.animationTimer = [NSTimer scheduledTimerWithTimeInterval:0.05 repeats:YES block:^(NSTimer *timer) {
+        for (UIView *band in bands) {
+          band.backgroundColor = [UIColor colorWithWhite:arc4random_uniform(256) / 255.0 alpha:1];
+        }
+      }];
+    }
+    // `--slow-toggle` repaints the whole screen every 0.5 s, slower than one verification delay, as
+    // a carousel does: one quiet pair of samples must not pass it for settled.
+    if ([NSProcessInfo.processInfo.arguments containsObject:@"--slow-toggle"]) {
+      __weak UIView *view = self.view;
+      [self.animationTimer invalidate];
+      self.animationTimer = [NSTimer scheduledTimerWithTimeInterval:0.5 repeats:YES block:^(NSTimer *timer) {
+        view.backgroundColor = [view.backgroundColor isEqual:UIColor.blackColor] ? UIColor.whiteColor : UIColor.blackColor;
+      }];
     }
   }
 
 
@@ -155,13 +155,15 @@ static inline void RunnerWaitUntil(uint64_t startTicks, double offsetMs) {
 
 // Owns one edge contact from touch-down to its terminal event. The cancel event is built before
 // touch-down; after touch-down, every exit dispatches either the touch-up or that cancel event.
-// Returns nil on success, or the reason the contact did not complete.
+// Returns nil on success, or the reason the contact did not complete. `touchDown` turns true once
+// the touch-down is dispatched, so a caller can tell a contact that never began from one that ended.
 static inline NSString * _Nullable RunnerDispatchEdgeContact(
   const RunnerHIDFunctions *functions,
   CFTypeRef client,
   uint64_t sender,
   NSArray<NSDictionary<NSString *, NSNumber *> *> *samples,
-  CGSize screenSize
+  CGSize screenSize,
+  BOOL *touchDown
 ) {
   double durationMs = samples.lastObject[@"offsetMs"].doubleValue;
   CGPoint start = RunnerPointAtOffset(samples, 0, screenSize);
@@ -179,6 +181,7 @@ static inline NSString * _Nullable RunnerDispatchEdgeContact(
   }
   uint64_t startTicks = mach_absolute_time();
   RunnerDispatchAndRelease(functions, client, down);
+  *touchDown = YES;
   NSString *failure = nil;
   for (double offsetMs = RunnerFrameIntervalMs; offsetMs < durationMs + RunnerFrameIntervalMs;
        offsetMs += RunnerFrameIntervalMs) {
 
@@ -11,15 +11,25 @@ NS_ASSUME_NONNULL_BEGIN
 // XCTest synthesized touches never carry the digitizer edge mask that UIKit reads.
 @interface RunnerSimulatorEdgeTouch : NSObject
 
-// The touch goes to the touchscreen of the display that hosts the app: `resolvedWindow`'s display,
-// or the sole screen when it is nil, as for XCTest synthesis. `samples` is the ordered
-// { x, y, offsetMs } path of one contact in portrait screen points, and `screenSize` is that
-// screen's portrait size in points. The call returns after the contact lifts.
-// Returns nil on success, or the reason the touch could not be dispatched.
-+ (NSString * _Nullable)dispatchWithApplication:(id)application
+// Resolves everything the touch needs before its contact: the display that hosts the app
+// (`resolvedWindow`'s display, or the sole screen when it is nil, as for XCTest synthesis), the
+// IOKit HID entry points, and that display's touchscreen sender. Returns nil with `failure` set
+// when any of them is missing; nothing has been sent then.
++ (nullable instancetype)prepareWithApplication:(id)application
                                  resolvedWindow:(id _Nullable)resolvedWindow
-                                        samples:(NSArray<NSDictionary<NSString *, NSNumber *> *> *)samples
-                                     screenSize:(CGSize)screenSize;
+                                        failure:(NSString * _Nullable __autoreleasing * _Nonnull)failure
+  NS_SWIFT_NAME(prepare(application:resolvedWindow:failure:));
+
+- (instancetype)init NS_UNAVAILABLE;
+
+// Runs one contact. `samples` is the ordered { x, y, offsetMs } path of the contact in portrait
+// screen points, and `screenSize` is that screen's portrait size in points. The call returns after
+// the contact lifts. Returns nil on success, or the reason the touch could not be dispatched.
+// `touchDown` is YES once the contact went down, so a failure with it NO reached nothing.
+- (NSString * _Nullable)dispatchSamples:(NSArray<NSDictionary<NSString *, NSNumber *> *> *)samples
+                             screenSize:(CGSize)screenSize
+                              touchDown:(BOOL *)touchDown
+  NS_SWIFT_NAME(dispatch(samples:screenSize:touchDown:));
 
 @end
 
 
@@ -69,36 +69,69 @@
   return failure;
 }
 
-@implementation RunnerSimulatorEdgeTouch
+@implementation RunnerSimulatorEdgeTouch {
+  RunnerHIDFunctions _functions;
+  CFTypeRef _client;
+  uint64_t _sender;
+}
 
-+ (NSString * _Nullable)dispatchWithApplication:(id)application
++ (nullable instancetype)prepareWithApplication:(id)application
                                  resolvedWindow:(id _Nullable)resolvedWindow
-                                        samples:(NSArray<NSDictionary<NSString *, NSNumber *> *> *)samples
-                                     screenSize:(CGSize)screenSize {
-  if (samples.count < 2 || screenSize.width <= 0 || screenSize.height <= 0) {
-    return @"an edge touch needs at least two samples and a measured screen";
-  }
+                                        failure:(NSString * _Nullable __autoreleasing * _Nonnull)failure {
+  *failure = nil;
   NSUInteger displayID = 0;
   id soleScreen = nil;
   NSString *displayError = resolvedWindow == nil
     ? RunnerResolveSoleScreen(application, &soleScreen, &displayID)
     : RunnerResolveWindowDisplayID(resolvedWindow, &displayID);
-  if (displayError != nil) return displayError;
+  if (displayError != nil) {
+    *failure = displayError;
+    return nil;
+  }
   RunnerHIDFunctions functions = {0};
-  NSString *failure = RunnerResolveHIDFunctions(&functions);
-  if (failure != nil) return failure;
+  NSString *hidError = RunnerResolveHIDFunctions(&functions);
+  if (hidError != nil) {
+    *failure = hidError;
+    return nil;
+  }
   CFTypeRef client = functions.createClient(kCFAllocatorDefault);
-  if (client == NULL) return @"simulator HID dispatch is unavailable: no event system client";
+  if (client == NULL) {
+    *failure = @"simulator HID dispatch is unavailable: no event system client";
+    return nil;
+  }
   uint64_t sender = 0;
-  failure = RunnerResolveTouchscreenSender(&functions, client, displayID, &sender);
-  if (failure != nil) {
+  NSString *senderError = RunnerResolveTouchscreenSender(&functions, client, displayID, &sender);
+  if (senderError != nil) {
     CFRelease(client);
-    return failure;
+    *failure = senderError;
+    return nil;
   }
-
-  failure = RunnerDispatchEdgeContact(&functions, client, sender, samples, screenSize);
+  RunnerSimulatorEdgeTouch *touch = [[self alloc] initWithFunctions:functions client:client sender:sender];
   CFRelease(client);
-  return failure;
+  return touch;
+}
+
+- (instancetype)initWithFunctions:(RunnerHIDFunctions)functions client:(CFTypeRef)client sender:(uint64_t)sender {
+  if ((self = [super init])) {
+    _functions = functions;
+    _client = CFRetain(client);
+    _sender = sender;
+  }
+  return self;
+}
+
+- (void)dealloc {
+  CFRelease(_client);
+}
+
+- (NSString * _Nullable)dispatchSamples:(NSArray<NSDictionary<NSString *, NSNumber *> *> *)samples
+                             screenSize:(CGSize)screenSize
+                              touchDown:(BOOL *)touchDown {
+  *touchDown = NO;
+  if (samples.count < 2 || screenSize.width <= 0 || screenSize.height <= 0) {
+    return @"an edge touch needs at least two samples and a measured screen";
+  }
+  return RunnerDispatchEdgeContact(&_functions, _client, _sender, samples, screenSize, touchDown);
 }
 
 @end
 
@@ -15,7 +15,7 @@ extension CommandType {
       .appState, .pasteboardWrite, .activate, .terminate, .targetReset, .shutdown:
       return .none
     case .tap, .longPress, .drag, .type, .swipe, .scroll, .findText, .querySelector, .readText,
-      .snapshot, .backInApp, .backSystem, .gesture, .gestureViewport, .appSwitcher,
+      .snapshot, .backInApp, .gesture, .gestureViewport, .appSwitcher,
       .keyboardDismiss, .sequence:
       return .appWindows
     case .screenshot, .recordStart:
 
@@ -548,24 +548,12 @@ extension RunnerTests {
       )
 #endif
     case .backInApp:
-      switch try tapInAppBackControl(app: activeApp) {
+      switch try performInAppBack(app: activeApp) {
       case .performed:
         return Response(ok: true, data: DataPayload(message: "backInApp"))
-      case .unavailable:
-        return Response(
-          ok: false,
-          error: ErrorPayload(message: "in-app back control is not available")
-        )
-      case .unverified(let error):
-        // The fallback gesture ran but the display refused to be sampled. Reporting the typed refusal
-        // keeps an unknown outcome from being laundered into a definitive "no back control" (#2728).
+      case .refused(let error), .unconfirmed(let error):
         return Response(ok: false, error: error)
       }
-    case .backSystem:
-      if try performSystemBackAction(app: activeApp) {
-        return Response(ok: true, data: DataPayload(message: "backSystem"))
-      }
-      return Response(ok: false, error: ErrorPayload(message: "system back is not available"))
     case .home:
       pressHomeButton()
       return Response(ok: true, data: DataPayload(message: "home"))