muvaf · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026
diff --git a/.changeset/ios-snapshot-bridge-exit-watcher.md b/.changeset/ios-snapshot-bridge-exit-watcher.md
@@ -0,0 +1,5 @@
+---
+'agent-device': patch
+---
+
+Fix the daemon retaining about 74 KB for every iOS Simulator snapshot read through the host AX bridge, which grew a long-running daemon's memory without bound. Each snapshot request registered its own exit reaction on the bridge process, and that reaction kept the request's response buffers reachable until the bridge exited. The bridge process now carries one exit reaction however many snapshots it serves.
diff --git a/.changeset/limrun-snapshot-producer.md b/.changeset/limrun-snapshot-producer.md
@@ -0,0 +1,5 @@
+---
+'agent-device': patch
+---
+
+Limrun iOS snapshots no longer use the `limrun-ios-tree` producer. Bridge captures report `simulator-ax-bridge`; captures that fall back to XCTest report `apple-runner`. If you inspect saved snapshot provenance, continue to handle the older `limrun-ios-tree` value for historical captures.
diff --git a/.changeset/orphaned-recording-start-recovery.md b/.changeset/orphaned-recording-start-recovery.md
@@ -0,0 +1,5 @@
+---
+'agent-device': patch
+---
+
+Settle an orphaned screen recording record when a new recording starts. A device that restarted mid-recording could leave its record open with a pending cleanup after the daemon's own recovery ran while the device was still booting. No claim, daemon start or stop retried it, and `record stop` on the old session could not finish it, so every later `record start` on that device refused with `cleanup-unconfirmed` until someone removed the record by hand. `record start` now settles the records on its device that it would refuse on and whose session the daemon no longer holds: it finishes each one as its own `record stop` would, and runs the exact-owner recovery, which discards what that recording left, only for a record that cannot finish. A record it cannot confirm cleaned, or one whose session is still held, still refuses, and the refusal now names that session. A record that another device left under the same session name is not recovered through the start device: the start refuses and names that device.
diff --git a/.github/actions/setup-apple-runner-build/action.yml b/.github/actions/setup-apple-runner-build/action.yml
@@ -42,7 +42,7 @@ runs:
       id: source-hash
       run: |
         set -euo pipefail
-        echo "value=${{ hashFiles('apple/runner/**', 'apple/snapshot-presentation/**', 'apple/snapshot-bridge/ForegroundApplicationGeometry.h') }}" >> "$GITHUB_OUTPUT"
+        echo "value=${{ hashFiles('apple/runner/**', 'apple/snapshot-presentation/**', 'apple/snapshot-bridge/**') }}" >> "$GITHUB_OUTPUT"
       shell: bash
 
     - name: Resolve Apple runner cache schema

diff --git a/.github/workflows/release-ios-runner.yml b/.github/workflows/release-ios-runner.yml
@@ -52,6 +52,16 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
         shell: bash
 
+      # Limrun simulators run iOS 26 and cannot reach this machine's Xcode. Xcode 26 embeds XCTest in
+      # the runner app; Xcode 27 leaves it out, and the packaging step refuses such a runner.
+      - name: Select Xcode 26
+        run: |
+          set -euo pipefail
+          XCODE_APP="$(ls -d /Applications/Xcode_26*.app | sort -V | tail -n 1)"
+          echo "DEVELOPER_DIR=${XCODE_APP}/Contents/Developer" >> "$GITHUB_ENV"
+          echo "Using ${XCODE_APP}"
+        shell: bash
+
       - name: Build iOS simulator runner
         env:
           AGENT_DEVICE_IOS_RUNNER_DERIVED_PATH: ${{ github.workspace }}/.tmp/ios-runner-derived

diff --git a/LICENSES/xdelta3-wasm.txt b/LICENSES/xdelta3-wasm.txt
@@ -0,0 +1,23 @@
+@limrun/xdelta3-wasm 0.2.0 source-file notices
+
+The published package declares Apache-2.0 but omits the license text.
+Package source: https://github.com/limrun-inc/typescript-sdk/tree/main/packages/xdelta3-wasm
+Native source: https://github.com/jmacd/xdelta/tree/7508fd2a823443b1f0173ca361620f21d62a7d37/xdelta3
+
+xdelta3 - delta compression tools and library
+   Copyright 2016 Joshua MacDonald
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+
+Full Apache-2.0 license follows in THIRD_PARTY_NOTICES.txt.
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
@@ -15,6 +15,12 @@ the package-level BSD license. These are retained in
 [`LICENSES/jpeg-js.txt`](LICENSES/jpeg-js.txt) and included with the Apache License
 2.0 in the generated notice file whenever `jpeg-js` is bundled.
 
+`@limrun/xdelta3-wasm` 0.2.0 omits license files from its npm archive. Its Apache-2.0
+license text and xdelta3 source attribution are retained through
+[`LICENSES/xdelta3-wasm.txt`](LICENSES/xdelta3-wasm.txt) and
+[`LICENSES/Apache-2.0.txt`](LICENSES/Apache-2.0.txt). The build verifies the package
+version before including these notices.
+
 ## Maestro conformance fixtures
 
 The 42 upstream flows in `scripts/maestro-conformance/corpus/upstream/` are copied

diff --git a/...ner/AgentDeviceRunner/AgentDeviceRunnerUITests/AgentDeviceRunnerUITests-Bridging-Header.h b/...ner/AgentDeviceRunner/AgentDeviceRunnerUITests/AgentDeviceRunnerUITests-Bridging-Header.h
@@ -1,9 +1,17 @@
 #import "RunnerObjCExceptionCatcher.h"
 #import "RunnerAXSnapshotBridge.h"
+#import "RunnerSimulatorEdgeTouch.h"
+#import "RunnerSnapshotBridge.h"
 #import "RunnerSynthesizedGesture.h"
 #import "RunnerSynthesizedTextEntry.h"
 #import "RunnerXCTestEventBridge.h"
 // The packaged runner omits UnitTests/. OTHER_CFLAGS defines do not reach this header.
+#if __has_include("UnitTests/RunnerSnapshotBridgeReaderRequest.h")
+#import "UnitTests/RunnerSnapshotBridgeReaderRequest.h"
+#endif
 #if __has_include("UnitTests/RunnerAXModalScopeCapture.h")
 #import "UnitTests/RunnerAXModalScopeCapture.h"
 #endif
+#if __has_include("UnitTests/RunnerEdgeContactTesting.h")
+#import "UnitTests/RunnerEdgeContactTesting.h"
+#endif