Field notes: real devices, a smarter broker, video

Wave 3 landed today: 79 files, +6,808/−126 lines across five merged branches. Findings below, all verified against the merged code.

Real iPhones are three different tools in a trenchcoat

Physical devices now appear as leasable targets behind --devices: discovery merges xcrun devicectl list devices into the simulator registry, lifecycle goes through devicectl — and interaction can't. devicectl has no screenshot or HID support, and AXe and the resident helper are simulator-only, so tap/type/observe/screenshot speak WebDriverAgent's REST protocol directly over HTTP, no Appium server. A paired-but- disconnected phone still enumerates from devicectl's cached metadata and is still leasable; connection-requiring actions fail with a clean unavailable: device not connected instead of hanging.

The broker stops guessing

The daemon grew GET /v0/status — capacity, running/parked counts, boots in flight, active/queued leases, load average, free disk, gate results — and the broker now places leases on it. Candidates rank warm-first in three tiers: a warm or booted match (a ~26 ms thaw instead of a cold boot), then hosts with boot headroom and passing gates, then everything else. Within a tier, least effective load wins — the daemon's own lease counts, which see direct-to-daemon clients the broker never granted, bumped by broker grants between probes. Queued acquires land on the shallowest daemon-reported queue. Old daemons without /v0/status keep the previous behavior unchanged.

A dashboard with no build step

/dash is a read-only fleet dashboard embedded in the daemon binary via embed.FS — vanilla JS, no node build, works offline. Targets, leases, warm-pool chips, and a journal browser with inline screenshot artifacts and export links. It listens to the existing /v0/ws events purely as invalidation signals and re-fetches the lists, falling back to a 5-second poll if the socket drops. No mutating controls: it can never thaw a parked sim, violate a boot cap, or touch an agent's lease.

SIGINT is the only clean way out of recordVideo

Per-lease video capture wraps simctl io recordVideo in a daemon-owned child tied to the lease lifecycle, ingested into the journal as segment entries. The sharp edges: SIGINT finalizes the mp4 cleanly, but a SIGKILL poisons the sim's recording service until it's shut down and rebooted; recording a non-booted sim "succeeds" with a zero-byte file, so non-Booted starts are refused outright. Defaults are conservative — 300 s / 128 MiB caps, 2 concurrent recordings, a 10 GiB free-disk floor — and restart recovery SIGINTs orphaned recorder children and salvages their spools.

The toolchain that shipped crashing binaries

Go 1.22.5 on macOS 26 builds binaries that crash on launch — the linker omits an LC_UUID load command that the OS now requires. Nothing in the build fails; the binary just dies. The fix is one env var: GOTOOLCHAIN=go1.24.5.

Open-source prep

The repo is ready to open: internal IPs and usernames scrubbed to example values across docs and site, a single-Mac quickstart (install → lease → tap → screenshot), a SECURITY.md spelling out the no-auth/tailnet-only trust model, and a git-history secret scan that came back clean.