--source wifi on macOS produces no data (helper not installed; data redacted without Location Services) #2090

On macOS 27 --source wifi starts, reports live_unverified, and shows nothing. MEASURED in a supervised session on 2026-10-01. wifi-densepose-wifiscan is byte-identical at 03a89793.

• --source wifi and the auto probe shell out to a mac_wifi helper on PATH (wifiscan macos_scanner.rs:38-70). Nothing builds or installs it; the only source is archive/v1/src/sensing/mac_wifi.swift.
• Built with swiftc -O (Command Line Tools, Swift 6.4), mac_wifi --scan-once returns "ssid":"" and "bssid":"00:00:00:00:00:00". rssi, noise, channel and tx_rate are real.
• The helper never requests location authorization (no CLLocationManager), so the terminal never appears in Location Services and can't be granted.
• sensing-server --source wifi: wifi=true, status wifi/live_unverified, but /api/v1/sensing/latest stays empty, with no error logged. resolve_bssid drops observations whose BSSID is zero and SSID blank.
• --source auto with the helper on PATH and no frames did not latch onto wifi. It served simulated data with UDP bound, so auto can't pick wifi on macOS today.

I prototyped two options, both rebased on 03a89793:

1. Keep the redacted connected link (rssi and noise are real) with a synthetic stable BSSID, log once when the helper is missing, and keep UDP bound under auto+wifi (ADR-025 Amendment 1).
2. A small ad-hoc-signed MacWifi.app that requests Location Services and is launched via LaunchServices (ADR-025 Amendment 2, stacked on option 1). After I allowed the prompt, a scan launched with open returned a real SSID/BSSID, while a direct exec stayed redacted. The grant resets on every ad-hoc rebuild.

Both are on my fork: option 1 at main...aepod:RuView:fix/macos-wifi-redacted-link, option 2 at at/macos-wifi-location-helper. The other option is to deprecate the macOS wifi source and fail fast with a clear message. Which direction do you prefer?