diff --git a/.agents/skills/change-maple-ci/SKILL.md b/.agents/skills/change-maple-ci/SKILL.md
index 37592218a..0ca6cec9e 100644
--- a/.agents/skills/change-maple-ci/SKILL.md
+++ b/.agents/skills/change-maple-ci/SKILL.md
@@ -127,7 +127,7 @@ fields in `lanes.py` are authoritative.
 | Label | Adds | Use when |
 | --- | --- | --- |
 | `ci:windows` | The native updater tests and the full Windows suite (Windows Clippy already runs on every Agent PR) | Path, filesystem, process or terminal code behaves differently on Windows |
-| `ci:package` | Unsigned Agent packages and Research desktop bundles on all three OSes, plus the Research Dev macOS app | Packaging or release scripts, flakes, toolchains, or bundled assets, entitlements or updater metadata change |
+| `ci:package` | Unsigned Agent packages and Research desktop bundles on all three OSes, plus the Research Dev macOS app | Packaging or release scripts, flakes, toolchains, or bundled assets, entitlements or updater metadata change. Also a gpui/zed revision bump, an Xcode pin change or an edit to the Metal Toolchain actions: PR lanes build gpui with runtime shaders, and only the macOS rehearsal compiles them before master's signed build |
 | `ci:ios`, `ci:android` | The Research iOS simulator or Android build | Research changes reach native mobile code or mobile-only plugins that their paths do not select |
 | `ci:research-dev-macos` | The unsigned Research Dev app | Research Dev OAuth profile work |
 | `ci:eif` | Dev and prod OpenSecret EIF candidates (`os-eif`) | The selector misses a measured input. Works only on a same-repository PR to `master` that edits no PCR approval |
diff --git a/.agents/skills/change-maple-ci/references/changing-ci.md b/.agents/skills/change-maple-ci/references/changing-ci.md
index d1c7c8cb1..46cdfeef4 100644
--- a/.agents/skills/change-maple-ci/references/changing-ci.md
+++ b/.agents/skills/change-maple-ci/references/changing-ci.md
@@ -23,6 +23,7 @@ Paths are relative to the repository root. `scripts/ci/lanes.py` and
 | `submodules` | Recursive submodules with full blobless history (Nix needs `revCount`) |
 | `hook` | Pre-commit component that runs the same checks locally |
 | `restore` | Read-only restore of a cache another workflow writes |
+| `requires` | Lanes whose jobs this lane's special job needs. The planner adds them to every plan that selects the lane, dispatches included; a required lane has no paths, labels, gate or OpenSecret selector of its own and runs on no event its requirers lack, so nothing else selects it (lint). `metal-toolchain` is the example: GitHub's xcode-27 image exports Xcode's Metal Toolchain for `agent-package-macos` |
 
 Event sets:
 
@@ -99,6 +100,8 @@ Its id is the lane's `job`. Checked by `plan.py lint` and the policy tests:
 - `runs-on` exactly `${{ vars.<VARIABLE> || '<label>' }}` when the runner has
   an override variable, otherwise the plain label; `timeout-minutes` equals
   the lane's `timeout` (lint).
+- A lane with `requires` has its own job, whose `needs:` lists each required
+  lane's job (lint).
 - `ci-ok` needs it (test 8); a new runner label is declared in
   `.github/actionlint.yaml` (test 9 and lint); checkouts use
   `persist-credentials: false` (test 3).
@@ -132,7 +135,7 @@ The `Runner` constants at the top of `lanes.py` are authoritative.
 | `MACOS` (Blacksmith macOS) | `CI_MACOS_RUNNER` |
 | `WINDOWS` (Blacksmith Windows) | `CI_WINDOWS_RUNNER` |
 | `GITHUB_WINDOWS` (`maple-windows-2025-16core`) | `CI_WINDOWS_GITHUB_RUNNER`, read only by special jobs |
-| `GITHUB`, `GITHUB_WINDOWS_FREE`, `EIF_BUILDER`, inline `ubuntu-24.04-arm` | none |
+| `GITHUB`, `GITHUB_WINDOWS_FREE`, `GITHUB_XCODE` (`xcode-27`), `EIF_BUILDER`, inline `ubuntu-24.04-arm` | none |
 
 - Matrix lanes resolve their runner when `plan` runs. A new matrix variable
   must be passed in the `plan` step's `env`; `lint` checks this.
@@ -159,7 +162,10 @@ The `Runner` constants at the top of `lanes.py` are authoritative.
 - The Agent release key's hash is a step output from
   `scripts/ci/cargo_graph_key.py`, not `hashFiles`. C4 runs that step, with
   the script working and failing, so an empty or misnamed output cannot turn
-  the exact key into a family prefix.
+  the exact key into a family prefix. The macOS build also passes
+  `scripts/ci/apple-toolchain.json`, as the macOS lanes list it in
+  `cache_files`: an Xcode upgrade must not restore objects built against the
+  previous SDK.
 - Turn off implicit saves on PR paths: setup-bun `no-cache: true` and no
   Magic Nix Cache (both checked), and Trivy `cache: "false"` (convention).
 - After a lockfile change, master's first save deletes the lane's target
@@ -252,6 +258,9 @@ selected or nightly; run it yourself after doc edits.
 `just lane <id>` runs exactly what CI runs. Limits:
 
 - macOS lanes need macOS and the pinned Xcode (`scripts/ci/select-xcode.py`).
+  The Agent's Clippy and native suite build gpui with `runtime_shaders`, so
+  they need no Metal Toolchain; the packaging rehearsal compiles the shaders
+  and needs it (`xcodebuild -downloadComponent MetalToolchain`).
 - Windows lanes need Windows with the toolchain from
   `.github/actions/setup-agent-windows`.
 - `os-sdk-e2e` needs PostgreSQL on `127.0.0.1:5432` with the credentials in
diff --git a/.agents/skills/change-maple-ci/references/debugging.md b/.agents/skills/change-maple-ci/references/debugging.md
index 915e46d47..b3c62bbd9 100644
--- a/.agents/skills/change-maple-ci/references/debugging.md
+++ b/.agents/skills/change-maple-ci/references/debugging.md
@@ -15,7 +15,7 @@ Start with the facts the run already has:
 | --- | --- | --- |
 | Push a commit | Yes | Code fixes; also picks up new labels and variables |
 | **Re-run all jobs** | Yes: `plan` reads the PR's current labels and repository variables | After adding a label, or changing `CI_QUARANTINE` or a `CI_*_RUNNER` variable. GitHub offers it only on a finished run: cancel a running PR run first, never a master run |
-| **Re-run failed jobs** | No: reuses the old `plan` outputs (lanes, matrix runners, quarantine) | Infrastructure flakes in a lane |
+| **Re-run failed jobs** | No: reuses the old `plan` outputs (lanes, matrix runners, quarantine) | Infrastructure flakes in a lane. A job that imports the Metal Toolchain (`agent-package-macos`) re-run more than a day later fails at the download, because the `metal-toolchain` artifact lives one day: re-run `metal-toolchain` too, or all jobs |
 | Dispatch `ci.yml` | Its own plan from the `lanes` input | Running lanes on a branch outside a PR. It never saves caches |
 
 Adding a label never starts a run by itself. That is deliberate: a label
@@ -32,7 +32,7 @@ the cancellation to finish, so rapid re-pushes each add some delay.
 | Signature | Cause | Response |
 | --- | --- | --- |
 | Nix setup fails: `HTTP error 416`, `SSL_read`, or "is required, but there is no substituter" | Transient `cache.nixos.org` error. Setup has no automatic retry | Re-run the failed job |
-| "lost communication with the server", or a job that vanished mid-run | Lost runner | Re-run failed jobs. On `agent-desktop-build.yml` (signed builds), ask the release owner first; a re-run in the same run keeps the build number |
+| "lost communication with the server", or a job that vanished mid-run | Lost runner | Re-run failed jobs. On `agent-desktop-build.yml` (signed builds), ask the release owner first; a re-run in the same run keeps the build number. A macOS build re-run more than a day later also needs **Export the Metal Toolchain** re-run, since its artifact lives one day |
 | `plan` fails with `lane selection failed` on a PR | A label read through `gh api` failed, or the event payload was unusable | **Re-run all jobs** |
 | `plan` fails on every event, master included | `CI_QUARANTINE` names an unknown lane or `repo` | Fix or clear the variable |
 | `plan` succeeds but selects every lane | An unclassified path, or no usable diff (new branch, force-push) | Own or mark inert the path in `lanes.py`; `plan.py lint` lists it |
@@ -62,7 +62,8 @@ the cancellation to finish, so rapid re-pushes each add some delay.
   lanes save only from the 04:17 UTC nightly run. A labelled run right after
   a lockfile change restores by prefix and is slower.
 - **Agent master builds.** The exact-key release cache misses when a
-  third-party package, a dependency edge or `flake.lock` changes (a version
+  third-party package, a dependency edge, `flake.lock` or, for macOS,
+  `scripts/ci/apple-toolchain.json` changes (a version
   bump of workspace or path crates keeps it), and fat LTO bounds the link. The
   master Agent build is slow by design; it does not gate PRs.
 - **Queued jobs.** If `agent-lint` or `agent-test` sit queued while other
@@ -70,7 +71,7 @@ the cancellation to finish, so rapid re-pushes each add some delay.
   variable `CI_LINUX_HEAVY_RUNNER=blacksmith-16vcpu-ubuntu-2404` (same
   vendor, so caches still work) and unset it afterwards. For the 8-vCPU
   lanes, `CI_LINUX_RUNNER=blacksmith-16vcpu-ubuntu-2404` keeps Blacksmith's
-  store. In a Blacksmith-wide outage use `ubuntu-latest` (or `macos-26`,
+  store. In a Blacksmith-wide outage use `ubuntu-latest` (or `xcode-27`,
   `windows-2025`): cold, saves nothing, slower.
   - Matrix lanes take their runner from `plan`, so re-plan: cancel a PR run,
     then **Re-run all jobs**. Never cancel a master run; the variable applies
diff --git a/.agents/skills/change-maple-ci/references/design.md b/.agents/skills/change-maple-ci/references/design.md
index 7e6307a1a..a8455957d 100644
--- a/.agents/skills/change-maple-ci/references/design.md
+++ b/.agents/skills/change-maple-ci/references/design.md
@@ -176,7 +176,9 @@ and the others have no better fallback.
   prefix fallback could carry a removed crate's build output into a signed
   binary. `scripts/ci/cargo_graph_key.py` hashes the Agent's `flake.lock` and
   every third-party package and dependency edge in its `Cargo.lock`, but not
-  the versions of workspace and path crates. Cargo rebuilds those anyway, so a
+  the versions of workspace and path crates; the macOS builder also hashes
+  `scripts/ci/apple-toolchain.json`, so an Xcode pin change makes its next
+  build cold. Cargo rebuilds the local crates anyway, so a
   version bump of them, the commonest Agent lockfile change, keeps the fat-LTO
   build warm. Any other lockfile change makes it fully cold; that cost is
   known and accepted. Only Prod pushes save it; the nightly Dev and dispatch
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 571459b27..8b5c0d6e8 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -3,8 +3,10 @@ self-hosted-runner:
   labels:
     - blacksmith-16vcpu-ubuntu-2404-arm
     - blacksmith-8vcpu-windows-2025
-    - blacksmith-6vcpu-macos-26
+    - blacksmith-6vcpu-macos-27
     - blacksmith-8vcpu-ubuntu-2404
     - blacksmith-32vcpu-ubuntu-2404
     # GitHub-hosted larger runner (org runner group "Maple"); actionlint only knows standard labels.
     - maple-windows-2025-16core
+    # GitHub-hosted Xcode 27 image; newer than the pinned actionlint label list.
+    - xcode-27
diff --git a/.github/actions/export-metal-toolchain/action.yml b/.github/actions/export-metal-toolchain/action.yml
new file mode 100644
index 000000000..1fff63bcb
--- /dev/null
+++ b/.github/actions/export-metal-toolchain/action.yml
@@ -0,0 +1,30 @@
+name: Export the Metal Toolchain
+description: >-
+  Download the selected Xcode's Metal Toolchain and upload it as this run's
+  one-day `metal-toolchain` artifact. Blacksmith's macOS image has no Metal
+  Toolchain and cannot download it (its MobileAsset catalog fetch fails), so a
+  GitHub xcode-27 job exports it and the Blacksmith jobs import it. Run it after
+  selecting the pinned Xcode.
+runs:
+  using: composite
+  steps:
+    - name: Download and export the Metal Toolchain
+      shell: bash
+      run: |
+        set -euo pipefail
+        export_dir="$RUNNER_TEMP/metal-toolchain"
+        mkdir -p "$export_dir"
+        xcodebuild -downloadComponent metalToolchain -exportPath "$export_dir"
+        # Keep symlinks and modes intact; artifacts flatten them.
+        tar -C "$export_dir" -cf "$RUNNER_TEMP/metal-toolchain.tar" .
+    - name: Upload the Metal Toolchain
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      with:
+        name: metal-toolchain
+        path: ${{ runner.temp }}/metal-toolchain.tar
+        if-no-files-found: error
+        # Re-run all jobs uploads it again under the same name.
+        overwrite: true
+        # Apple's toolchain, re-hosted only for this run's jobs.
+        retention-days: 1
+        compression-level: 0
diff --git a/.github/actions/import-metal-toolchain/action.yml b/.github/actions/import-metal-toolchain/action.yml
new file mode 100644
index 000000000..058617264
--- /dev/null
+++ b/.github/actions/import-metal-toolchain/action.yml
@@ -0,0 +1,34 @@
+name: Import the Metal Toolchain
+description: >-
+  Install the Metal Toolchain that this run's metal-toolchain job exported, so
+  gpui can compile its Metal shaders on Blacksmith's macOS image. A runner whose
+  Xcode already has it (GitHub's xcode-27 image, during a failover) skips the
+  import. Run it after selecting the pinned Xcode.
+runs:
+  using: composite
+  steps:
+    # The artifact lives one day. A later "Re-run failed jobs" finds it gone: re-run the
+    # metal-toolchain job (Export the Metal Toolchain) so its dependents re-run with it.
+    - name: Download the exported Metal Toolchain
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      with:
+        name: metal-toolchain
+        path: ${{ runner.temp }}/metal-toolchain-artifact
+    - name: Import the Metal Toolchain
+      shell: bash
+      run: |
+        set -euo pipefail
+        # Capture first: grep -q could close the pipe while xcodebuild still writes.
+        component="$(xcodebuild -showComponent metalToolchain 2>/dev/null || true)"
+        if grep -q '^Status: installed' <<<"$component"; then
+          echo "The selected Xcode already has its Metal Toolchain."
+        else
+          import_dir="$RUNNER_TEMP/metal-toolchain"
+          mkdir -p "$import_dir"
+          tar -C "$import_dir" -xf "$RUNNER_TEMP/metal-toolchain-artifact/metal-toolchain.tar"
+          bundle="$(find "$import_dir" -maxdepth 1 \( -name '*.exportedBundle' -o -name '*.dmg' \) -print -quit)"
+          test -n "$bundle"
+          xcodebuild -importComponent metalToolchain -importPath "$bundle" \
+            || sudo xcodebuild -importComponent metalToolchain -importPath "$bundle"
+        fi
+        xcrun -sdk macosx metal --version
diff --git a/.github/workflows/agent-desktop-build.yml b/.github/workflows/agent-desktop-build.yml
index c0c529a58..473e50f18 100644
--- a/.github/workflows/agent-desktop-build.yml
+++ b/.github/workflows/agent-desktop-build.yml
@@ -51,11 +51,31 @@ jobs:
         # Dispatch, the nightly run, an unusable push base and selector errors all build.
         run: python3 scripts/ci/plan.py only agent-desktop >> "$GITHUB_OUTPUT"
 
+  # Blacksmith's macOS image cannot download Xcode's Metal Toolchain, so GitHub's
+  # xcode-27 image exports it for the macOS build, which compiles gpui's shaders.
+  metal-toolchain:
+    name: Export the Metal Toolchain
+    needs: changes
+    if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false') && github.repository == 'MaplePrivacyLabs/Maple' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }}
+    runs-on: xcode-27
+    permissions:
+      contents: read
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Select pinned Xcode
+        working-directory: .
+        run: python3 scripts/ci/select-xcode.py
+      - uses: ./.github/actions/export-metal-toolchain
+
   macos-build:
     name: Build macOS binary (${{ matrix.variant }})
-    needs: changes
+    needs: [changes, metal-toolchain]
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false') && github.repository == 'MaplePrivacyLabs/Maple' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }}
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     permissions:
       contents: read
     timeout-minutes: 120
@@ -82,17 +102,18 @@ jobs:
       - name: Select pinned Xcode
         working-directory: .
         run: python3 scripts/ci/select-xcode.py
+      - uses: ./.github/actions/import-metal-toolchain
       - name: Hash the Agent's third-party dependency graph and toolchain
         id: graph
-        run: python3 ../../scripts/ci/cargo_graph_key.py Cargo.lock flake.lock >> "$GITHUB_OUTPUT"
+        run: python3 ../../scripts/ci/cargo_graph_key.py Cargo.lock flake.lock ../../scripts/ci/apple-toolchain.json >> "$GITHUB_OUTPUT"
       - name: Restore the exact-key Agent release cache
         id: cache
         uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           # No restore-keys: a master build never starts from another dependency
-          # graph's artifacts. The hash covers flake.lock and every third-party
-          # package and edge in Cargo.lock, not workspace or path crate versions
-          # (Cargo rebuilds those anyway). Prod pushes save it; Dev builds only
+          # graph's artifacts. The hash covers flake.lock, every third-party
+          # package and edge in Cargo.lock and, on macOS, the Xcode pin, not workspace
+          # or path crate versions (Cargo rebuilds those anyway). Prod pushes save it; Dev builds only
           # restore it (Cargo rebuilds what the profile changes).
           key: ci-v1-agent-release-${{ runner.os }}-${{ steps.graph.outputs.hash }}
           path: |
@@ -138,7 +159,7 @@ jobs:
       contents: read
       id-token: write
       attestations: write
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 120
     strategy:
       fail-fast: false
@@ -513,6 +534,9 @@ jobs:
     permissions:
       contents: read
       attestations: read
+    # Launch the signed app on macOS 26, where most users run it, rather than on
+    # the macOS 27 it was built on. The job builds nothing, so it uses the image's
+    # default Xcode: the pinned 27.1 exists only on xcode-27.
     runs-on: macos-26
     timeout-minutes: 30
     strategy:
@@ -535,9 +559,6 @@ jobs:
       - name: Verify pinned Nix runtime
         working-directory: .
         run: bash scripts/ci/verify-nix-runtime.sh
-      - name: Select pinned Xcode
-        working-directory: .
-        run: python3 scripts/ci/select-xcode.py
       - name: Download exact Agent packages
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 271f33873..a11591c1c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -229,11 +229,27 @@ jobs:
           if-no-files-found: error
           retention-days: 7
 
+  # Blacksmith's macOS image cannot download Xcode's Metal Toolchain, so GitHub's
+  # xcode-27 image exports it for the lanes that compile gpui's shaders.
+  metal-toolchain:
+    name: metal-toolchain
+    needs: plan
+    if: fromJSON(needs.plan.outputs.lanes)['metal-toolchain']
+    runs-on: xcode-27
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - name: Select pinned Xcode
+        run: python3 scripts/ci/select-xcode.py
+      - uses: ./.github/actions/export-metal-toolchain
+
   agent-package-macos:
     name: agent-package-macos
-    needs: plan
+    needs: [plan, metal-toolchain]
     if: fromJSON(needs.plan.outputs.lanes)['agent-package-macos']
-    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-26' }}
+    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -242,13 +258,15 @@ jobs:
       - uses: ./.github/actions/setup-nix
       - name: Select pinned Xcode
         run: python3 scripts/ci/select-xcode.py
+      - uses: ./.github/actions/import-metal-toolchain
       - name: Restore the packaging rehearsal cache
         id: package-cache
         uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           # Thin-LTO release artifacts; master's fat-LTO cache cannot serve them.
-          key: ci-v1-agent-package-${{ runner.os }}-${{ hashFiles('apps/maple-agent/flake.lock', 'apps/maple-agent/Cargo.lock') }}
-          restore-keys: ci-v1-agent-package-${{ runner.os }}-
+          # The Xcode pin leads, so a prefix restore never brings back another SDK's objects.
+          key: ci-v1-agent-package-${{ runner.os }}-${{ hashFiles('scripts/ci/apple-toolchain.json') }}-${{ hashFiles('apps/maple-agent/flake.lock', 'apps/maple-agent/Cargo.lock') }}
+          restore-keys: ci-v1-agent-package-${{ runner.os }}-${{ hashFiles('scripts/ci/apple-toolchain.json') }}-
           path: |
             ~/.cargo/registry/index
             ~/.cargo/registry/cache
@@ -355,7 +373,7 @@ jobs:
     name: research-ios
     needs: plan
     if: fromJSON(needs.plan.outputs.lanes)['research-ios']
-    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-26' }}
+    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 120 # a missed ONNX Runtime cache builds it from source
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -388,7 +406,7 @@ jobs:
     name: research-desktop-macos
     needs: plan
     if: fromJSON(needs.plan.outputs.lanes)['research-desktop-macos']
-    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-26' }}
+    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -498,7 +516,7 @@ jobs:
     name: research-dev-macos
     needs: plan
     if: fromJSON(needs.plan.outputs.lanes)['research-dev-macos']
-    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-26' }}
+    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -655,7 +673,7 @@ jobs:
   ci-ok:
     name: ci-ok
     if: always()
-    needs: [plan, nix, windows, agent-package-linux, agent-package-macos, agent-package-windows, research-rust,
+    needs: [plan, nix, windows, agent-package-linux, metal-toolchain, agent-package-macos, agent-package-windows, research-rust,
             research-ios, research-desktop-macos, research-desktop-linux, research-desktop-windows,
             research-dev-macos, os-sdk-e2e, os-helpers, os-eif]
     runs-on: ubuntu-latest
diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index bfff307bb..4bb617c62 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -15,7 +15,7 @@ jobs:
     environment: desktop-signing
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.macos != 'false') }}
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     timeout-minutes: 120
     permissions:
       contents: read
diff --git a/.github/workflows/ios-dev-testflight.yml b/.github/workflows/ios-dev-testflight.yml
index 5b7cf75e4..dc511336a 100644
--- a/.github/workflows/ios-dev-testflight.yml
+++ b/.github/workflows/ios-dev-testflight.yml
@@ -36,7 +36,7 @@ jobs:
       (github.event_name == 'workflow_dispatch' || (github.event_name == 'push' &&
         (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.ios != 'false')))
     environment: apple-signing
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     timeout-minutes: 240
     permissions:
       contents: read
@@ -144,7 +144,7 @@ jobs:
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: build-ios-dev
     environment: apple-signing
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 45
     permissions:
       contents: read
diff --git a/.github/workflows/mobile-build.yml b/.github/workflows/mobile-build.yml
index 4a04c6a33..5f502962c 100644
--- a/.github/workflows/mobile-build.yml
+++ b/.github/workflows/mobile-build.yml
@@ -34,7 +34,7 @@ jobs:
       github.ref == 'refs/heads/master' &&
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
       (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.ios != 'false')
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     # The ONNX source build and the app build each allow 90 minutes.
     timeout-minutes: 240
     permissions:
@@ -156,7 +156,7 @@ jobs:
       github.ref == 'refs/heads/master' &&
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: verify-ios-artifacts
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 45
     permissions:
       contents: read
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index b8d603b44..c42421626 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -46,7 +46,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-26, windows-latest]
+        os: [ubuntu-latest, xcode-27, windows-latest]
     defaults:
       run:
         shell: bash
diff --git a/.github/workflows/proxy-rust.yml b/.github/workflows/proxy-rust.yml
index 32f8d38e3..8b76bf186 100644
--- a/.github/workflows/proxy-rust.yml
+++ b/.github/workflows/proxy-rust.yml
@@ -45,7 +45,7 @@ jobs:
             archive: maple-proxy-linux-x86_64.tar.gz
           - runner: ubuntu-24.04-arm
             archive: maple-proxy-linux-aarch64.tar.gz
-          - runner: blacksmith-6vcpu-macos-26
+          - runner: blacksmith-6vcpu-macos-27
             archive: maple-proxy-macos-aarch64.tar.gz
           - runner: windows-2025
             archive: maple-proxy-windows-x86_64.zip
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2e002420e..40d471ee4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -137,7 +137,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - platform: blacksmith-6vcpu-macos-26
+          - platform: blacksmith-6vcpu-macos-27
             nix_shell: ci
             artifact_prefix: macos
           - platform: blacksmith-8vcpu-ubuntu-2404
@@ -452,7 +452,7 @@ jobs:
   build-ios:
     environment: apple-signing
     needs: classify-app-release
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     permissions:
       contents: write
       id-token: write
@@ -619,7 +619,7 @@ jobs:
             archive: maple-proxy-linux-x86_64.tar.gz
           - runner: ubuntu-24.04-arm
             archive: maple-proxy-linux-aarch64.tar.gz
-          - runner: blacksmith-6vcpu-macos-26
+          - runner: blacksmith-6vcpu-macos-27
             archive: maple-proxy-macos-aarch64.tar.gz
           - runner: windows-2025
             archive: maple-proxy-windows-x86_64.zip
@@ -816,7 +816,7 @@ jobs:
     needs:
       - classify-app-release
       - build-tauri
-    runs-on: macos-26
+    runs-on: xcode-27
     permissions:
       contents: read
     steps:
@@ -964,7 +964,7 @@ jobs:
       - update-latest-json
       - verify-android-release-artifacts
       - verify-proxy-release-artifacts
-    runs-on: macos-26
+    runs-on: xcode-27
     permissions:
       contents: read
     steps:
diff --git a/apps/maple-agent/docs/desktop-builds.md b/apps/maple-agent/docs/desktop-builds.md
index 9046c5b61..ce57723fb 100644
--- a/apps/maple-agent/docs/desktop-builds.md
+++ b/apps/maple-agent/docs/desktop-builds.md
@@ -42,7 +42,10 @@ Research state. The development launcher retains its existing workspace
 configuration and uses a separate debug app identity.
 
 macOS compiles each profile in a job without signing credentials and uploads
-its prebuilt binary. Packaging runs on a fresh runner that downloads that
+its prebuilt binary. That job runs on Blacksmith's macOS 27 image, which has no
+Metal Toolchain: a GitHub `xcode-27` job exports Xcode's toolchain as a one-day
+artifact that the build imports before compiling gpui's shaders, so a retry more
+than a day later must re-run that export job too. Packaging runs on a fresh runner that downloads that
 binary and checks its embedded profile and source commit against the run's
 checkout before the signing step receives Apple credentials. It reads a dedicated
 Mach-O JSON section without executing artifact code, including before signing.
diff --git a/apps/maple-agent/flake.nix b/apps/maple-agent/flake.nix
index ac7a6df80..e0ac4c226 100644
--- a/apps/maple-agent/flake.nix
+++ b/apps/maple-agent/flake.nix
@@ -310,6 +310,11 @@
               # nixpkgs' generic clang wrapper cannot infer that SDK boundary.
               export CC="$(/usr/bin/xcrun --find clang)"
               export CXX="$(/usr/bin/xcrun --find clang++)"
+              # Rust links through `cc`, which is nixpkgs' clang wrapper and its
+              # older ld64. That ld64 cannot read the macOS 27 SDK's .tbd stubs
+              # (they list the arm64e.x1 architecture), so link with Xcode too.
+              export CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER="$CC"
+              export CARGO_TARGET_X86_64_APPLE_DARWIN_LINKER="$CC"
               export PATH="${xcrun}/bin:$PATH"
 
               unset maple_nix_developer_dir maple_nix_selected_developer_dir
diff --git a/apps/maple-agent/scripts/test_macos_build_info.py b/apps/maple-agent/scripts/test_macos_build_info.py
index 9ab5eca31..9400fd806 100644
--- a/apps/maple-agent/scripts/test_macos_build_info.py
+++ b/apps/maple-agent/scripts/test_macos_build_info.py
@@ -163,7 +163,13 @@ def test_native_rust_section_survives_release_lto_and_symbol_stripping(self):
 static MAPLE_AGENT_BUILD_INFO: [u8; include_bytes!("build-info.json").len()] = *include_bytes!("build-info.json");
 fn main() { panic!("the signing preflight must never execute an artifact"); }
 ''')
+        # Link with the linker Cargo would use. The Nix shell sets it to Xcode's clang,
+        # because its own `cc` cannot read the macOS 27 SDK.
+        host = subprocess.run(["rustc", "--print", "host-tuple"], check=True, capture_output=True,
+                              text=True).stdout.strip()
+        linker = os.environ.get(f"CARGO_TARGET_{host.upper().replace('-', '_')}_LINKER")
         subprocess.run(["rustc", "--edition=2024", "-C", "opt-level=3", "-C", "lto=fat", "-C", "strip=symbols",
+                        *(["-C", f"linker={linker}"] if linker else []),
                         "-C", "link-arg=-Wl,-u,_MAPLE_AGENT_BUILD_INFO", str(source), "-o", str(self.binary)],
                        check=True, capture_output=True, text=True)
         self.assertEqual(metadata.validated_build_info("dev", self.binary, SOURCE_SHA), info)
diff --git a/apps/maple-research/frontend/src-tauri/Cargo.toml b/apps/maple-research/frontend/src-tauri/Cargo.toml
index 7c5dc9d04..b02036d92 100644
--- a/apps/maple-research/frontend/src-tauri/Cargo.toml
+++ b/apps/maple-research/frontend/src-tauri/Cargo.toml
@@ -121,3 +121,16 @@ tao = { path = "patches/tao-0.37.1" }
 # to link (Tauri 2.12.3 made its own public: tauri-apps/tauri#16130); the
 # vendored copy only adds that keyword. Remove once upstream publishes the fix.
 tauri-plugin-sign-in-with-apple = { path = "patches/tauri-plugin-sign-in-with-apple-1.0.2" }
+
+# Cargo strips build scripts and proc-macros whenever their profile has no debug info
+# (release, and dev under CI's CARGO_PROFILE_DEV_DEBUG=0), using rustc's rust-objcopy,
+# which can leave a dylib's LINKEDIT string table 4-byte aligned. macOS 27 refuses to
+# load such dylibs when they are linked against its SDK, and every build loads its
+# proc-macros as dylibs. They never ship, so leave them unstripped. Remove once the
+# root flake pins Rust 1.98 or newer: its stripped proc-macros stay 8-byte aligned,
+# which is why the Agent needs no override (llvm/llvm-project#203680).
+[profile.dev.build-override]
+strip = false
+
+[profile.release.build-override]
+strip = false
diff --git a/apps/maple-research/frontend/src-tauri/gen/apple/maple.xcodeproj/project.pbxproj.backup b/apps/maple-research/frontend/src-tauri/gen/apple/maple.xcodeproj/project.pbxproj.backup
deleted file mode 100644
index 41a99a896..000000000
--- a/apps/maple-research/frontend/src-tauri/gen/apple/maple.xcodeproj/project.pbxproj.backup
+++ /dev/null
@@ -1,626 +0,0 @@
-// !$*UTF8*$!
-{
-	archiveVersion = 1;
-	classes = {
-	};
-	objectVersion = 56;
-	objects = {
-
-/* Begin PBXBuildFile section */
-		0F4AA8C5111094B8D7B033A4 /* WebKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = E996CAD20B045EF299247BEF /* WebKit.framework */; };
-		23D760C25DBAAA96DF52F98C /* MetalKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = AAFD3E024B29F57EA0D88AB5 /* MetalKit.framework */; };
-		27222ACBBD95CA356BDB87AB /* QuartzCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BAF092EB33F2B4FDF867E2ED /* QuartzCore.framework */; };
-		46728F6CD07C626A781543FF /* Security.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 938F41BA03AF7FAB80585A60 /* Security.framework */; };
-		4E14944735CA89389849E430 /* libapp.a in Frameworks */ = {isa = PBXBuildFile; fileRef = F27A6FC4AB3E06D481B1E137 /* libapp.a */; };
-		621A96F6B965E600E714FB6C /* LaunchScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = B0EAFEFF59AA7CFEF57FA63C /* LaunchScreen.storyboard */; };
-		8F9EDB5679AB5E12D6F1E071 /* UIKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = DACD0B6B9FB86AFF47366EB2 /* UIKit.framework */; };
-		90DEA2E2EC5F95784C9D8B00 /* CoreGraphics.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 898D6E7ABC92C3B9A7970DAE /* CoreGraphics.framework */; };
-		9F3ED7EA97AFC22E0B4A6EAF /* main.mm in Sources */ = {isa = PBXBuildFile; fileRef = CE20E8A9C4CF149CA9CA485A /* main.mm */; };
-		A120CF155DE2B343CEFFB77C /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 6BF4C7EB12DBD2E253B2741E /* Assets.xcassets */; };
-		B79EC8A2A1A869B9F38906ED /* assets in Resources */ = {isa = PBXBuildFile; fileRef = AF5DA3546C7B12BA141E9508 /* assets */; };
-		FB98D58EAB479A32F7CA66CA /* Metal.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = C072EB8E1CCC1094712EA7F7 /* Metal.framework */; };
-/* End PBXBuildFile section */
-
-/* Begin PBXFileReference section */
-		1094B8CB671809878F533CEC /* lib.rs */ = {isa = PBXFileReference; lastKnownFileType = text; path = lib.rs; sourceTree = "<group>"; };
-		19C98BDFCAE8C0B2FE05F13B /* maple_iOS.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = maple_iOS.entitlements; sourceTree = "<group>"; };
-		1DB07799A17353B2E32B65D3 /* Maple.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = Maple.app; sourceTree = BUILT_PRODUCTS_DIR; };
-		6BF4C7EB12DBD2E253B2741E /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
-		7BBAB8D5C4E3D05A4F48B6EA /* bindings.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = bindings.h; sourceTree = "<group>"; };
-		898D6E7ABC92C3B9A7970DAE /* CoreGraphics.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CoreGraphics.framework; path = System/Library/Frameworks/CoreGraphics.framework; sourceTree = SDKROOT; };
-		938F41BA03AF7FAB80585A60 /* Security.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Security.framework; path = System/Library/Frameworks/Security.framework; sourceTree = SDKROOT; };
-		AAFD3E024B29F57EA0D88AB5 /* MetalKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = MetalKit.framework; path = System/Library/Frameworks/MetalKit.framework; sourceTree = SDKROOT; };
-		AF5DA3546C7B12BA141E9508 /* assets */ = {isa = PBXFileReference; lastKnownFileType = folder; path = assets; sourceTree = SOURCE_ROOT; };
-		B0EAFEFF59AA7CFEF57FA63C /* LaunchScreen.storyboard */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; path = LaunchScreen.storyboard; sourceTree = "<group>"; };
-		BAF092EB33F2B4FDF867E2ED /* QuartzCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = QuartzCore.framework; path = System/Library/Frameworks/QuartzCore.framework; sourceTree = SDKROOT; };
-		C072EB8E1CCC1094712EA7F7 /* Metal.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Metal.framework; path = System/Library/Frameworks/Metal.framework; sourceTree = SDKROOT; };
-		C0A332F21EB65CD4B83229DF /* main.rs */ = {isa = PBXFileReference; lastKnownFileType = text; path = main.rs; sourceTree = "<group>"; };
-		CE20E8A9C4CF149CA9CA485A /* main.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = main.mm; sourceTree = "<group>"; };
-		D6F6085362AF0C062EDB5810 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist; path = Info.plist; sourceTree = "<group>"; };
-		DACD0B6B9FB86AFF47366EB2 /* UIKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = UIKit.framework; path = System/Library/Frameworks/UIKit.framework; sourceTree = SDKROOT; };
-		E996CAD20B045EF299247BEF /* WebKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = WebKit.framework; path = System/Library/Frameworks/WebKit.framework; sourceTree = SDKROOT; };
-		F27A6FC4AB3E06D481B1E137 /* libapp.a */ = {isa = PBXFileReference; lastKnownFileType = archive.ar; path = libapp.a; sourceTree = "<group>"; };
-/* End PBXFileReference section */
-
-/* Begin PBXFrameworksBuildPhase section */
-		04F3BEBB04BD927FDC86B255 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				4E14944735CA89389849E430 /* libapp.a in Frameworks */,
-				90DEA2E2EC5F95784C9D8B00 /* CoreGraphics.framework in Frameworks */,
-				FB98D58EAB479A32F7CA66CA /* Metal.framework in Frameworks */,
-				23D760C25DBAAA96DF52F98C /* MetalKit.framework in Frameworks */,
-				27222ACBBD95CA356BDB87AB /* QuartzCore.framework in Frameworks */,
-				46728F6CD07C626A781543FF /* Security.framework in Frameworks */,
-				8F9EDB5679AB5E12D6F1E071 /* UIKit.framework in Frameworks */,
-				0F4AA8C5111094B8D7B033A4 /* WebKit.framework in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXFrameworksBuildPhase section */
-
-/* Begin PBXGroup section */
-		31943D18956B6AFD5A82AB02 /* maple_iOS */ = {
-			isa = PBXGroup;
-			children = (
-				D6F6085362AF0C062EDB5810 /* Info.plist */,
-				19C98BDFCAE8C0B2FE05F13B /* maple_iOS.entitlements */,
-			);
-			path = maple_iOS;
-			sourceTree = "<group>";
-		};
-		6AE8986BFC081ADF4EF98889 /* Externals */ = {
-			isa = PBXGroup;
-			children = (
-			);
-			path = Externals;
-			sourceTree = "<group>";
-		};
-		A278899D6905367F60E00F01 /* Sources */ = {
-			isa = PBXGroup;
-			children = (
-				E5992A2C52DE443515252068 /* maple */,
-			);
-			path = Sources;
-			sourceTree = "<group>";
-		};
-		B58B2AB62FA5D8F41C3A031C /* Frameworks */ = {
-			isa = PBXGroup;
-			children = (
-				898D6E7ABC92C3B9A7970DAE /* CoreGraphics.framework */,
-				F27A6FC4AB3E06D481B1E137 /* libapp.a */,
-				C072EB8E1CCC1094712EA7F7 /* Metal.framework */,
-				AAFD3E024B29F57EA0D88AB5 /* MetalKit.framework */,
-				BAF092EB33F2B4FDF867E2ED /* QuartzCore.framework */,
-				938F41BA03AF7FAB80585A60 /* Security.framework */,
-				DACD0B6B9FB86AFF47366EB2 /* UIKit.framework */,
-				E996CAD20B045EF299247BEF /* WebKit.framework */,
-			);
-			name = Frameworks;
-			sourceTree = "<group>";
-		};
-		C312B5C9A1506139452E194B /* Products */ = {
-			isa = PBXGroup;
-			children = (
-				1DB07799A17353B2E32B65D3 /* Maple.app */,
-			);
-			name = Products;
-			sourceTree = "<group>";
-		};
-		D3140E092D76240F6A157CCE = {
-			isa = PBXGroup;
-			children = (
-				AF5DA3546C7B12BA141E9508 /* assets */,
-				6BF4C7EB12DBD2E253B2741E /* Assets.xcassets */,
-				B0EAFEFF59AA7CFEF57FA63C /* LaunchScreen.storyboard */,
-				6AE8986BFC081ADF4EF98889 /* Externals */,
-				31943D18956B6AFD5A82AB02 /* maple_iOS */,
-				A278899D6905367F60E00F01 /* Sources */,
-				FF31B258F4FE6CC5B57B4FB8 /* src */,
-				B58B2AB62FA5D8F41C3A031C /* Frameworks */,
-				C312B5C9A1506139452E194B /* Products */,
-			);
-			sourceTree = "<group>";
-		};
-		E5992A2C52DE443515252068 /* maple */ = {
-			isa = PBXGroup;
-			children = (
-				CE20E8A9C4CF149CA9CA485A /* main.mm */,
-				F9E1B0C7AF484C8F6312F2C8 /* bindings */,
-			);
-			path = maple;
-			sourceTree = "<group>";
-		};
-		F9E1B0C7AF484C8F6312F2C8 /* bindings */ = {
-			isa = PBXGroup;
-			children = (
-				7BBAB8D5C4E3D05A4F48B6EA /* bindings.h */,
-			);
-			path = bindings;
-			sourceTree = "<group>";
-		};
-		FF31B258F4FE6CC5B57B4FB8 /* src */ = {
-			isa = PBXGroup;
-			children = (
-				1094B8CB671809878F533CEC /* lib.rs */,
-				C0A332F21EB65CD4B83229DF /* main.rs */,
-			);
-			name = src;
-			path = ../../src;
-			sourceTree = "<group>";
-		};
-/* End PBXGroup section */
-
-/* Begin PBXNativeTarget section */
-		745812EBA5246F9E4CEE1574 /* maple_iOS */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 27939507295816FC37580B40 /* Build configuration list for PBXNativeTarget "maple_iOS" */;
-			buildPhases = (
-				88FF8D973FB9516A2A98CD39 /* Build Rust Code */,
-				6D9F08407F22BE108C77276C /* Sources */,
-				25104604B2C2A81B04543E68 /* Resources */,
-				04F3BEBB04BD927FDC86B255 /* Frameworks */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = maple_iOS;
-			productName = maple_iOS;
-			productReference = 1DB07799A17353B2E32B65D3 /* Maple.app */;
-			productType = "com.apple.product-type.application";
-		};
-/* End PBXNativeTarget section */
-
-/* Begin PBXProject section */
-		EAA0B11A781B9CD753D1399F /* Project object */ = {
-			isa = PBXProject;
-			attributes = {
-				BuildIndependentTargetsInParallel = YES;
-				LastUpgradeCheck = 1430;
-			};
-			buildConfigurationList = 2FA6FD4DEFE659C96AAB5E5D /* Build configuration list for PBXProject "maple" */;
-			compatibilityVersion = "Xcode 14.0";
-			developmentRegion = en;
-			hasScannedForEncodings = 0;
-			knownRegions = (
-				Base,
-				en,
-			);
-			mainGroup = D3140E092D76240F6A157CCE;
-			projectDirPath = "";
-			projectRoot = "";
-			targets = (
-				745812EBA5246F9E4CEE1574 /* maple_iOS */,
-			);
-		};
-/* End PBXProject section */
-
-/* Begin PBXResourcesBuildPhase section */
-		25104604B2C2A81B04543E68 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				A120CF155DE2B343CEFFB77C /* Assets.xcassets in Resources */,
-				621A96F6B965E600E714FB6C /* LaunchScreen.storyboard in Resources */,
-				B79EC8A2A1A869B9F38906ED /* assets in Resources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXResourcesBuildPhase section */
-
-/* Begin PBXShellScriptBuildPhase section */
-		88FF8D973FB9516A2A98CD39 /* Build Rust Code */ = {
-			isa = PBXShellScriptBuildPhase;
-			alwaysOutOfDate = 1;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputFileListPaths = (
-			);
-			inputPaths = (
-			);
-			name = "Build Rust Code";
-			outputFileListPaths = (
-			);
-			outputPaths = (
-				"$(SRCROOT)/Externals/x86_64/${CONFIGURATION}/libapp.a",
-				"$(SRCROOT)/Externals/arm64/${CONFIGURATION}/libapp.a",
-				"$(SRCROOT)/Externals/arm64-sim/${CONFIGURATION}/libapp.a",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "bun tauri ios xcode-script -v --platform ${PLATFORM_DISPLAY_NAME:?} --sdk-root ${SDKROOT:?} --framework-search-paths \"${FRAMEWORK_SEARCH_PATHS:?}\" --header-search-paths \"${HEADER_SEARCH_PATHS:?}\" --gcc-preprocessor-definitions \"${GCC_PREPROCESSOR_DEFINITIONS:-}\" --configuration ${CONFIGURATION:?} ${FORCE_COLOR} ${ARCHS:?}";
-		};
-/* End PBXShellScriptBuildPhase section */
-
-/* Begin PBXSourcesBuildPhase section */
-		6D9F08407F22BE108C77276C /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				9F3ED7EA97AFC22E0B4A6EAF /* main.mm in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXSourcesBuildPhase section */
-
-/* Begin XCBuildConfiguration section */
-		1DE1BEC252AAEF735A07CA8B /* debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
-				ARCHS = (
-					arm64,
-					"arm64-sim",
-				);
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_ENTITLEMENTS = maple_iOS/maple_iOS.entitlements;
-				CODE_SIGN_IDENTITY = "Apple Development";
-				CODE_SIGN_STYLE = Automatic;
-				DEVELOPMENT_TEAM = "X773Y823TN";
-				ENABLE_BITCODE = NO;
-				"EXCLUDED_ARCHS[sdk=iphoneos*]" = "arm64-sim x86_64";
-				"EXCLUDED_ARCHS[sdk=iphonesimulator*]" = arm64;
-				FRAMEWORK_SEARCH_PATHS = (
-					"$(inherited)",
-					"\".\"",
-				);
-				INFOPLIST_FILE = maple_iOS/Info.plist;
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/Frameworks",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64-sim]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64-sim/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=x86_64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/x86_64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				PRODUCT_BUNDLE_IDENTIFIER = cloud.opensecret.maple;
-				PRODUCT_NAME = Maple;
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SDKROOT = iphoneos;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				VALID_ARCHS = "arm64  arm64-sim";
-			};
-			name = debug;
-		};
-		1E8FE8E2E3063C3FDCD3B5D1 /* debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_TESTABILITY = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_DYNAMIC_NO_PIC = NO;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"$(inherited)",
-					"DEBUG=1",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 13.0;
-				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
-				MTL_FAST_MATH = YES;
-				ONLY_ACTIVE_ARCH = YES;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SDKROOT = iphoneos;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
-				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-				SWIFT_VERSION = 5.0;
-			};
-			name = debug;
-		};
-		94ECC2E044AA76E166E0866E /* release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				ENABLE_NS_ASSERTIONS = NO;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 13.0;
-				MTL_ENABLE_DEBUG_INFO = NO;
-				MTL_FAST_MATH = YES;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SDKROOT = iphoneos;
-				SWIFT_COMPILATION_MODE = wholemodule;
-				SWIFT_OPTIMIZATION_LEVEL = "-O";
-				SWIFT_VERSION = 5.0;
-			};
-			name = release;
-		};
-		B90C9BEF4885680BFA986CD2 /* release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
-				ARCHS = (
-					arm64,
-					"arm64-sim",
-				);
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_ENTITLEMENTS = maple_iOS/maple_iOS.entitlements;
-				CODE_SIGN_IDENTITY = "Apple Development";
-				CODE_SIGN_STYLE = Automatic;
-				DEVELOPMENT_TEAM = "X773Y823TN";
-				ENABLE_BITCODE = NO;
-				"EXCLUDED_ARCHS[sdk=iphoneos*]" = "arm64-sim x86_64";
-				"EXCLUDED_ARCHS[sdk=iphonesimulator*]" = arm64;
-				FRAMEWORK_SEARCH_PATHS = (
-					"$(inherited)",
-					"\".\"",
-				);
-				INFOPLIST_FILE = maple_iOS/Info.plist;
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/Frameworks",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64-sim]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64-sim/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=x86_64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/x86_64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				PRODUCT_BUNDLE_IDENTIFIER = cloud.opensecret.maple;
-				PRODUCT_NAME = Maple;
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SDKROOT = iphoneos;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				VALID_ARCHS = "arm64  arm64-sim";
-			};
-			name = release;
-		};
-		EA2669D02DADAA11005A7F4B /* local */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_TESTABILITY = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_DYNAMIC_NO_PIC = NO;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"$(inherited)",
-					"DEBUG=1",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 13.0;
-				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
-				MTL_FAST_MATH = YES;
-				ONLY_ACTIVE_ARCH = YES;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SDKROOT = iphoneos;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
-				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-				SWIFT_VERSION = 5.0;
-			};
-			name = local;
-		};
-		EA2669D12DADAA11005A7F4B /* local */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
-				ARCHS = (
-					arm64,
-					"arm64-sim",
-				);
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_ENTITLEMENTS = maple_iOS/maple_iOS.entitlements;
-				CODE_SIGN_IDENTITY = "Apple Development";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
-				CODE_SIGN_STYLE = Manual;
-				DEVELOPMENT_TEAM = "X773Y823TN";
-				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = X773Y823TN;
-				ENABLE_BITCODE = NO;
-				"EXCLUDED_ARCHS[sdk=iphoneos*]" = "arm64-sim x86_64";
-				"EXCLUDED_ARCHS[sdk=iphonesimulator*]" = arm64;
-				FRAMEWORK_SEARCH_PATHS = (
-					"$(inherited)",
-					"\".\"",
-				);
-				INFOPLIST_FILE = maple_iOS/Info.plist;
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/Frameworks",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64-sim]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64-sim/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=x86_64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/x86_64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				PRODUCT_BUNDLE_IDENTIFIER = cloud.opensecret.maple;
-				PRODUCT_NAME = Maple;
-				PROVISIONING_PROFILE_SPECIFIER = "86059ea7-ae8e-44af-8a58-b2ab7c78d299";
-				"PROVISIONING_PROFILE_SPECIFIER[sdk=iphoneos*]" = "86059ea7-ae8e-44af-8a58-b2ab7c78d299";
-				SDKROOT = iphoneos;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				VALID_ARCHS = "arm64  arm64-sim";
-			};
-			name = local;
-		};
-/* End XCBuildConfiguration section */
-
-/* Begin XCConfigurationList section */
-		27939507295816FC37580B40 /* Build configuration list for PBXNativeTarget "maple_iOS" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				1DE1BEC252AAEF735A07CA8B /* debug */,
-				EA2669D12DADAA11005A7F4B /* local */,
-				B90C9BEF4885680BFA986CD2 /* release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = debug;
-		};
-		2FA6FD4DEFE659C96AAB5E5D /* Build configuration list for PBXProject "maple" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				1E8FE8E2E3063C3FDCD3B5D1 /* debug */,
-				EA2669D02DADAA11005A7F4B /* local */,
-				94ECC2E044AA76E166E0866E /* release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = debug;
-		};
-/* End XCConfigurationList section */
-	};
-	rootObject = EAA0B11A781B9CD753D1399F /* Project object */;
-}
diff --git a/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh b/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh
index 21b6e43c8..0baf7fc9d 100755
--- a/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh
+++ b/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh
@@ -23,7 +23,7 @@ BUILD_DIR="${TAURI_DIR}/onnxruntime-build"
 OUTPUT_DIR="${TAURI_DIR}/onnxruntime-ios"
 XCFRAMEWORK_DIR="${OUTPUT_DIR}/onnxruntime.xcframework"
 
-IOS_DEPLOYMENT_TARGET="13.0"
+IOS_DEPLOYMENT_TARGET="16.0"
 
 echo "========================================"
 echo "Building ONNX Runtime ${ORT_VERSION} for iOS"
diff --git a/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime.sh b/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime.sh
index de3e38d0e..649e1df11 100755
--- a/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime.sh
+++ b/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime.sh
@@ -24,7 +24,7 @@ OUTPUT_DIR="${TAURI_DIR}/onnxruntime-ios"
 XCFRAMEWORK_DIR="${OUTPUT_DIR}/onnxruntime.xcframework"
 
 # Minimum iOS version to support
-IOS_DEPLOYMENT_TARGET="13.0"
+IOS_DEPLOYMENT_TARGET="16.0"
 
 echo "========================================"
 echo "Building ONNX Runtime ${ORT_VERSION} for iOS"
diff --git a/apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh b/apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh
index 51cb644df..ce6b55e44 100644
--- a/apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh
+++ b/apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh
@@ -165,11 +165,11 @@ onnxruntime_ios_commit_for_version() {
 }
 
 onnxruntime_ios_device_lib_sha256_for_version() {
-  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-17F42}}"
+  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-27A9275}}"
 
   case "$1:${xcode_build}" in
-    1.23.2:17F42)
-      printf '%s\n' "917cf5f30aa65f435371e323e347e094c99804fd6a268d3ae946cd8e5e58945f"
+    1.23.2:27A9275)
+      printf '%s\n' "e4d288188f0b520d6676e87ad4a694326a8844618f471b5c8cfcdb69daf66657"
       ;;
     *)
       echo "No pinned ONNX Runtime iOS device library SHA-256 for version '$1' and Xcode build '${xcode_build}'." >&2
@@ -179,11 +179,11 @@ onnxruntime_ios_device_lib_sha256_for_version() {
 }
 
 onnxruntime_ios_simulator_lib_sha256_for_version() {
-  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-17F42}}"
+  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-27A9275}}"
 
   case "$1:${xcode_build}" in
-    1.23.2:17F42)
-      printf '%s\n' "87c87225026db5ee2b5a1293468b9cc3410ad22eac182899056a05f2f2862071"
+    1.23.2:27A9275)
+      printf '%s\n' "0b670a0fce021844551d7bd9fc0c3c4275208375155e0c17254866215ae28736"
       ;;
     *)
       echo "No pinned ONNX Runtime iOS simulator library SHA-256 for version '$1' and Xcode build '${xcode_build}'." >&2
@@ -193,11 +193,11 @@ onnxruntime_ios_simulator_lib_sha256_for_version() {
 }
 
 onnxruntime_ios_xcframework_sha256_for_version() {
-  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-17F42}}"
+  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-27A9275}}"
 
   case "$1:${xcode_build}" in
-    1.23.2:17F42)
-      printf '%s\n' "86871fe82fb5b043540d5bbc67de5ba73f2a52105ec05c66e835b7add8972af5"
+    1.23.2:27A9275)
+      printf '%s\n' "93cbb699abebba06963ccf1b5c283ea0bbf7b8e9e4664f9b2df726d2808bf18a"
       ;;
     *)
       echo "No pinned ONNX Runtime iOS xcframework SHA-256 for version '$1' and Xcode build '${xcode_build}'." >&2
diff --git a/apps/maple-research/frontend/src-tauri/tests/storekit/README.md b/apps/maple-research/frontend/src-tauri/tests/storekit/README.md
index 96943c890..e570b3064 100644
--- a/apps/maple-research/frontend/src-tauri/tests/storekit/README.md
+++ b/apps/maple-research/frontend/src-tauri/tests/storekit/README.md
@@ -26,8 +26,9 @@ re-signs/verifies them, and generates the local experiment scheme. Source plist
 and entitlements are restored. Preserve the existing frozen artifact when
 comparing toolchains; rebuilding Maple is a separate action.
 
-These test commands explicitly select installed Xcode 26.6 **after entering** the
-pinned Apple shell, without changing repository pins or global Xcode selection.
+These test commands use the Xcode selected by the pinned Apple shell
+(`scripts/ci/apple-toolchain.json`). The dated notes below record earlier runs on
+Xcode 26.5 and 26.6.
 Use `run.sh`, which prepares native linker variables; do not invoke `run.py`
 directly from an unprepared Nix shell. Substitute the exact frozen app path and
 intended simulator UDID when different from these examples.
@@ -35,9 +36,7 @@ intended simulator UDID when different from these examples.
 First build the small runner and run the catalog canary, which needs no fixture:
 
 ```sh
-nix develop --no-update-lock-file .#apple -c env \
-  MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-  DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+nix develop --no-update-lock-file .#apple -c \
   bash scripts/testing/storekit/run.sh \
   --app apps/maple-research/frontend/src-tauri/gen/apple/build/arm64-sim/Maple.app \
   --udid "<YOUR_BOOTED_SIMULATOR_UDID>" \
@@ -47,9 +46,7 @@ nix develop --no-update-lock-file .#apple -c env \
 Then run the certificate canary with a fresh runner-owned bootstrap fixture:
 
 ```sh
-nix develop --no-update-lock-file .#apple -c env \
-  MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-  DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+nix develop --no-update-lock-file .#apple -c \
   bash scripts/testing/storekit/run.sh --skip-build --fixture-bootstrap \
   --app apps/maple-research/frontend/src-tauri/gen/apple/build/arm64-sim/Maple.app \
   --udid "<YOUR_BOOTED_SIMULATOR_UDID>" \
@@ -69,9 +66,7 @@ Pass that certificate to the remaining cases. They reuse the runner build but
 each gets a separate XCTest invocation, fixture process and journal:
 
 ```sh
-nix develop --no-update-lock-file .#apple -c env \
-  MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-  DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+nix develop --no-update-lock-file .#apple -c \
   bash scripts/testing/storekit/run.sh --skip-build \
   --fixture-certificate /absolute/path/to/MapleStoreKitSigningCertificate.cer \
   --app apps/maple-research/frontend/src-tauri/gen/apple/build/arm64-sim/Maple.app \
@@ -175,9 +170,7 @@ To export metadata from an already running purchased diagnostic screen without
 reinstalling or restarting Maple, pass the exact GUI-built DerivedData app:
 
 ```sh
-nix develop --no-update-lock-file .#apple -c env \
-  MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-  DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+nix develop --no-update-lock-file .#apple -c \
   bash scripts/testing/storekit/run.sh --app /absolute/path/to/Maple.app \
   --udid "<YOUR_BOOTED_SIMULATOR_UDID>" \
   --only MapleStoreKitCaptureUITests/testExportPublicSigningCertificate
@@ -202,7 +195,7 @@ The exact Foundation-only parser can also be checked on the host, without
 building an app or operating a simulator:
 
 ```sh
-DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+DEVELOPER_DIR=/Applications/Xcode_27.1.app/Contents/Developer \
   python3 scripts/testing/storekit/check-snapshot-parser.py
 ```
 
diff --git a/docs/ci.md b/docs/ci.md
index 1eba71e17..2d6c6193a 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -94,7 +94,8 @@ later push runs the labelled lanes again until the label is removed.
 `just lane <id>` (the same as `python3 scripts/ci/plan.py run <id>`) runs the
 lane's command in its pinned Nix shell, exactly as `ci.yml` does. macOS lanes
 need macOS and use its selected Xcode (CI pins it with
-`scripts/ci/select-xcode.py`), Windows lanes need Windows with the toolchain
+`scripts/ci/select-xcode.py`; only the packaging rehearsal also needs its Metal
+Toolchain), Windows lanes need Windows with the toolchain
 from `.github/actions/setup-agent-windows`, `os-sdk-e2e` needs PostgreSQL on
 `127.0.0.1:5432` with the credentials in `scripts/ci/opensecret-sdk-e2e.sh`,
 `os-helpers` needs Docker that builds `linux/arm64`, and `os-eif` needs Linux
@@ -169,8 +170,9 @@ org's 16-core GitHub runner are billed by the minute.
 
 | Runner | Lanes | Why |
 | --- | --- | --- |
-| `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-6vcpu-macos-26`, `blacksmith-8vcpu-windows-2025` | Most compiling lanes, for example Research Rust, OpenSecret Rust, every macOS lane and the Agent's Windows Clippy | Fast, with warm caches in Blacksmith's store |
+| `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-6vcpu-macos-27`, `blacksmith-8vcpu-windows-2025` | Most compiling lanes, for example Research Rust, OpenSecret Rust, every macOS lane and the Agent's Windows Clippy | Fast, with warm caches in Blacksmith's store |
 | `blacksmith-32vcpu-ubuntu-2404` | `agent-lint`, `agent-test` | The heaviest cold builds |
+| `xcode-27` | `metal-toolchain` | GitHub's Xcode 27 image ships Xcode's Metal Toolchain, which Blacksmith's macOS image lacks and cannot download; it exports it for the macOS packaging rehearsal, the only lane that compiles gpui's shaders. The Agent's other macOS lanes build with runtime shaders. It is a public-preview label without an SLA; if GitHub retires it, use the label that carries Xcode 27.1 |
 | `ubuntu-latest`, `ubuntu-24.04-arm` | Lighter lanes, for example `repo`, SDK, proxy, Research web, services, `deps-*` and `os-pcr` | Free, and fast enough without Blacksmith |
 | `windows-2025` | `agent-windows-updater`, `agent-full-windows` | Blacksmith's Windows workspace inherits a foreign write ACE that the updater's storage validation rejects, and the reparse tests need the symlink privilege GitHub's runner grants |
 | `maple-windows-2025-16core` | `agent-package-windows` (its install smoke needs GitHub's image), `research-desktop-windows` (for speed) | Same image and cache store as `windows-2025`, with more cores |
diff --git a/docs/repository-workflows.md b/docs/repository-workflows.md
index 8eec5ddde..03a74eef1 100644
--- a/docs/repository-workflows.md
+++ b/docs/repository-workflows.md
@@ -77,8 +77,8 @@ branches in step with the lane table.
   keys. `scripts/ci/cargo_graph_key.py` hashes the Agent's `flake.lock` and
   its `Cargo.lock` without the versions of workspace and path crates, which
   Cargo rebuilds anyway: a release version bump keeps the key, and a change
-  to any third-party package or dependency edge, or to the toolchain, makes
-  the next build cold. Pushes build only Prod; the nightly Dev and dispatched
+  to any third-party package or dependency edge, or to the toolchain (for
+  macOS also `scripts/ci/apple-toolchain.json`), makes the next build cold. Pushes build only Prod; the nightly Dev and dispatched
   builds restore the same key without saving (the profile changes only Agent
   workspace crates, which Cargo rebuilds). No `ci.yml` lane reads it. The
   Agent packaging lanes build thin LTO into their own
@@ -123,7 +123,8 @@ the other side of each contract. A failure means the workflow change is wrong:
    ancestor succeeded (a scan still running does not block). These run on every
    relevant master push and are never cancelled.
 4. The signed master builds write the release cache keys above (the Agent's
-   is `cargo_graph_key.py`'s hash of its lockfiles, with no fallback), and
+   is `cargo_graph_key.py`'s hash of its lockfiles, plus the Xcode pin on
+   macOS, with no fallback), and
    `ios-dev-testflight.yml`'s run number is the Maple Dev build number: never
    rename that file.
 5. Every OpenSecret EIF builder that uses FlakeHub (`ci.yml`'s `os-eif`,
@@ -247,13 +248,21 @@ release workflows use:
 
 | Work | Runner |
 | --- | --- |
-| Research macOS, Linux, Android and iOS builds, which compile and sign (master and release); `rust-tests.yml`; the Agent's unsigned master builds | Blacksmith (`blacksmith-6vcpu-macos-26`, `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-8vcpu-windows-2025`) |
+| Research macOS, Linux, Android and iOS builds, which compile and sign (master and release); `rust-tests.yml`; the Agent's unsigned master builds | Blacksmith (`blacksmith-6vcpu-macos-27`, `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-8vcpu-windows-2025`) |
 | Release `build-windows` | `maple-windows-2025-16core` |
 | Signed Research Windows master build; Agent Windows signing and verification | `windows-2025` |
 | Artifact verifiers, TestFlight submission, the Agent's signing and attestation, CodeQL, web and frontend evidence | Other GitHub-hosted runners |
 | Proxy release builds and their PR rehearsal (`proxy-rust.yml`) | GitHub-hosted Linux and Windows, Blacksmith macOS |
 | EIF builders that use FlakeHub | `blacksmith-16vcpu-ubuntu-2404-arm` |
 
+The Agent's signing and attestation, both TestFlight submissions, the macOS
+release verifiers and the Metal Toolchain export need the pinned Xcode, so they
+run on GitHub's `xcode-27` label, a public-preview image without an SLA. If
+GitHub renames or retires it, move them to the label that carries Xcode 27.1,
+such as `macos-27` once that image ships it. Jobs that launch or inspect
+artifacts without selecting Xcode stay on `macos-26`, an older macOS than the
+builds link against.
+
 The Agent's signing and attestation, `windows-signing` jobs and every artifact
 verifier stay GitHub-hosted: the Agent publisher rejects self-hosted signers,
 Blacksmith counts as self-hosted, and verifiers run fresh. The Agent's
@@ -268,13 +277,17 @@ PowerShell Gallery and its CDN and accepts only the pinned SHA-256. Rust,
 MSVC, Perl and the linker are pinned by `.github/actions/setup-agent-windows`
 for the Agent.
 
-Research desktop and iOS builds select Xcode 26.5 (`17F42`) from
+Research desktop and iOS builds select Xcode 27.1 (`27A9275`) from
 [`scripts/ci/apple-toolchain.json`](../scripts/ci/apple-toolchain.json) through
 `scripts/ci/select-xcode.py`; the root Nix shell exports the same version for
 its Apple recipes. Do not rely on a runner's default Xcode. The
 [iOS ONNX pins](../apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh)
 verify artifacts against that exact build, so an Xcode upgrade means rebuilding
-and reviewing those hashes and validating desktop and iOS packaging. A newer
+and reviewing those hashes and validating desktop and iOS packaging. The
+Agent's signed macOS build compiles gpui's Metal shaders: Blacksmith's macOS
+image has no Metal Toolchain and cannot download one, so a GitHub `xcode-27`
+job exports it as a one-day artifact that the build imports, and the build's
+release cache key hashes the Xcode pin. A newer
 CI image does not raise the shipped deployment targets: Research supports
 macOS 13.4 and iOS 16.0.
 
diff --git a/scripts/ci/_common.sh b/scripts/ci/_common.sh
index 7286433cd..764e35430 100755
--- a/scripts/ci/_common.sh
+++ b/scripts/ci/_common.sh
@@ -2858,7 +2858,7 @@ verify_ios_onnxruntime_pinned_hashes() {
   local version xcode_build xcframework manifest file expected actual status
 
   version="$(ios_onnxruntime_version)"
-  xcode_build="${MAPLE_XCODE_BUILD_VERSION:-17F42}"
+  xcode_build="${MAPLE_XCODE_BUILD_VERSION:-27A9275}"
   xcframework="$(ios_onnxruntime_xcframework_dir)"
   manifest="$(ios_onnxruntime_manifest_file)"
   status=0
diff --git a/scripts/ci/apple-toolchain.json b/scripts/ci/apple-toolchain.json
index 8f2cd86e1..9aa97b351 100644
--- a/scripts/ci/apple-toolchain.json
+++ b/scripts/ci/apple-toolchain.json
@@ -1,4 +1,4 @@
 {
-  "version": "26.5",
-  "build": "17F42"
+  "version": "27.1",
+  "build": "27A9275"
 }
diff --git a/scripts/ci/cargo_graph_key.py b/scripts/ci/cargo_graph_key.py
index 541541bd7..21e0906ef 100644
--- a/scripts/ci/cargo_graph_key.py
+++ b/scripts/ci/cargo_graph_key.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Hash a Cargo.lock's dependency graph and a flake.lock for an exact cache key.
+"""Hash a Cargo.lock's dependency graph, a flake.lock and toolchain pins for an exact cache key.
 
 agent-desktop-build.yml keys its release cache on this hash. Every third-party
 package's name, version, source and checksum, every dependency edge, and the
@@ -7,7 +7,9 @@
 packages, the ones without a `source` (workspace members and path
 dependencies), are dropped, wherever they appear: a release version bump keeps
 the key, while any other change gives a new one. Cargo rebuilds local packages
-anyway.
+anyway. Further arguments are toolchain pin files hashed as text: the macOS build
+passes scripts/ci/apple-toolchain.json, so an Xcode upgrade never restores
+objects built against the previous SDK. Without them the key is unchanged.
 
 Prints `hash=<sha256>` for $GITHUB_OUTPUT. Input it cannot resolve
 unambiguously fails with no output.
@@ -20,6 +22,7 @@
 from pathlib import Path
 import re
 import sys
+from typing import Sequence
 
 try:
     import tomllib
@@ -147,10 +150,12 @@ def parse_flake_lock(text: str) -> dict:
     return flake
 
 
-def key(cargo_lock: str, flake_lock: str) -> str:
-    """SHA-256 of the normalized Cargo.lock graph and the parsed flake.lock."""
+def key(cargo_lock: str, flake_lock: str, pins: Sequence[str] = ()) -> str:
+    """SHA-256 of the normalized Cargo.lock graph, the parsed flake.lock and any pin texts."""
     payload = {"schema": SCHEMA, "cargo": graph(parse_cargo_lock(cargo_lock)),
                "flake": parse_flake_lock(flake_lock)}
+    if pins:
+        payload["pins"] = [text.replace("\r\n", "\n") for text in pins]
     try:
         canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"), ensure_ascii=True)
     except TypeError as error:  # a TOML date or time, which Cargo never writes
@@ -159,12 +164,12 @@ def key(cargo_lock: str, flake_lock: str) -> str:
 
 
 def main(argv: list) -> int:
-    if len(argv) != 2:
-        print("usage: cargo_graph_key.py CARGO_LOCK FLAKE_LOCK", file=sys.stderr)
+    if len(argv) < 2:
+        print("usage: cargo_graph_key.py CARGO_LOCK FLAKE_LOCK [PIN ...]", file=sys.stderr)
         return 2
     try:
         texts = [Path(name).read_text(encoding="utf-8") for name in argv]
-        digest = key(*texts)
+        digest = key(texts[0], texts[1], texts[2:])
     except (OSError, UnicodeError, GraphError) as error:
         print(f"::error::cargo_graph_key.py: {error}", file=sys.stderr)
         return 1
diff --git a/scripts/ci/lanes.py b/scripts/ci/lanes.py
index d71ca362c..b61bea0fc 100644
--- a/scripts/ci/lanes.py
+++ b/scripts/ci/lanes.py
@@ -36,9 +36,12 @@ def cache_store(label: str) -> str:
 # The override variables are unset; set one to fail over during an outage.
 LINUX = Runner("blacksmith-8vcpu-ubuntu-2404", "CI_LINUX_RUNNER")
 LINUX_HEAVY = Runner("blacksmith-32vcpu-ubuntu-2404", "CI_LINUX_HEAVY_RUNNER")
-MACOS = Runner("blacksmith-6vcpu-macos-26", "CI_MACOS_RUNNER")
+MACOS = Runner("blacksmith-6vcpu-macos-27", "CI_MACOS_RUNNER")
 WINDOWS = Runner("blacksmith-8vcpu-windows-2025", "CI_WINDOWS_RUNNER")
 GITHUB = Runner("ubuntu-latest")  # free GitHub runner for lanes that compile nothing heavy
+# GitHub's Xcode 27 image ships Xcode's Metal Toolchain, which Blacksmith's macOS image
+# lacks and cannot download (its MobileAsset catalog fetch fails).
+GITHUB_XCODE = Runner("xcode-27")
 # The Agent updater's native Windows tests and the installer smoke test need GitHub's
 # runner: Blacksmith's workspace inherits a foreign write ACE the updater rejects, and
 # master's Windows install smoke (agent-desktop-build.yml verify-windows) runs there too.
@@ -107,10 +110,13 @@ def cache_store(label: str) -> str:
     "release_profile.rs",
 )) + WINDOWS_TOOLCHAIN
 APPLE_TOOLCHAIN = ("scripts/ci/apple-toolchain.json", "scripts/ci/select-xcode.py")
+# The composite actions that carry Xcode's Metal Toolchain from GitHub's xcode-27 image
+# to Blacksmith macOS jobs (agent-desktop-build.yml macos-build, agent-package-macos).
+METAL_TOOLCHAIN = (".github/actions/export-metal-toolchain/**", ".github/actions/import-metal-toolchain/**")
 # What agent-desktop-build.yml builds and signs on master (`plan.py only agent-desktop`).
 AGENT_DESKTOP = AGENT + RUST_SDK + PROXY_RUNTIME + (
     ".github/workflows/agent-desktop-build.yml", ".github/actions/setup-agent-windows/**",
-    "scripts/ci/verify-agent-rust-deps.py", *APPLE_TOOLCHAIN, "scripts/ci/agent_windows.py",
+    "scripts/ci/verify-agent-rust-deps.py", *APPLE_TOOLCHAIN, *METAL_TOOLCHAIN, "scripts/ci/agent_windows.py",
     "scripts/ci/cargo_graph_key.py", "scripts/ci/install-windows-artifact-signing.ps1",
     "scripts/ci/windows-artifact-sign.ps1",
 )
@@ -144,6 +150,7 @@ class Lane:
     submodules: bool = False                    # check out submodules, with the full (blobless) history Nix needs
     hook: Optional[str] = None                  # the pre-commit component that runs these checks
     restore: str = ""                           # read-only restore of a cache another workflow writes
+    requires: Tuple[str, ...] = ()              # lanes whose jobs this lane's job needs; selected with it
 
 
 AGENT_DIR = dict(
@@ -152,6 +159,14 @@ class Lane:
     env=(("RUSTFLAGS", "-D warnings"),),
 )
 AGENT_FLAKE = dict(flake="./apps/maple-agent", **AGENT_DIR)
+# The macOS lanes also key their caches on the Xcode pin, so an Xcode upgrade never
+# restores objects built against the previous SDK.
+AGENT_MACOS = dict(AGENT_FLAKE, runner=MACOS,
+                   cache_files=AGENT_DIR["cache_files"] + ("scripts/ci/apple-toolchain.json",))
+# gpui compiles its Metal shaders at run time instead of build time, so these lanes need
+# no Metal Toolchain (Blacksmith's macOS image has none). Compiled shaders are proven by
+# master's signed Prod build on every Agent push, the nightly Dev build and ci:package.
+RUNTIME_SHADERS = "-F gpui-platform/runtime_shaders"
 # Lanes that only resolve the Agent's graph share its Cargo home, without a target
 # directory, so they stop cloning the zed and cua git dependencies on every run.
 AGENT_CARGO_HOME = dict(AGENT_FLAKE, cache="agent-cargo-home", cache_targets=False)
@@ -220,8 +235,8 @@ def deny(manifest: str, component: str) -> str:
     Lane("agent-test", AGENT, also=RUST_SDK + PROXY_RUNTIME, runner=LINUX_HEAVY,
          run="just ci-test", cache="agent-test", timeout=40, hook="agent", **AGENT_FLAKE),
     Lane("agent-macos", AGENT, also=RUST_SDK + PROXY_RUNTIME + APPLE_TOOLCHAIN,
-         runner=MACOS, run="cargo clippy --workspace --all-targets --locked -- -D warnings",
-         cache="agent-macos", timeout=25, **AGENT_FLAKE),
+         run=f"cargo clippy --workspace --all-targets --locked {RUNTIME_SHADERS} -- -D warnings",
+         cache="agent-macos", timeout=25, **AGENT_MACOS),
     # Windows Clippy and the native PE-metadata and host-spawn fixtures, on every Agent change.
     Lane("agent-windows", AGENT, also=RUST_SDK + PROXY_RUNTIME + ("scripts/ci/agent_windows.py",),
          labels=("ci:windows", "ci:full"),
@@ -235,13 +250,15 @@ def deny(manifest: str, component: str) -> str:
     Lane("agent-windows-updater", AGENT_WINDOWS_UPDATER, labels=("ci:windows", "ci:full"),
          run="cargo test -p maple-agent-updater --locked --no-fail-fast -- --test-threads=1",
          cache="agent-windows-updater", timeout=30, **dict(AGENT_WIN, runner=GITHUB_WINDOWS_FREE)),
-    # The rest of `just ci` and the native macOS suite: master, nightly and ci:full.
+    # The rest of `just ci` and the native macOS suite (with runtime shaders, see
+    # RUNTIME_SHADERS): master, nightly and ci:full.
     Lane("agent-full-linux", AGENT, also=RUST_SDK + PROXY_RUNTIME, pr_paths=(), run="just ci-extra",
          cache="agent-full-linux", timeout=30, gate=False, **AGENT_FLAKE),
-    Lane("agent-full-macos", AGENT, also=RUST_SDK + PROXY_RUNTIME, pr_paths=(), runner=MACOS,
-         run="python3 scripts/test_git_metadata.py && cargo build --workspace --all-targets --locked"
-             " && ./scripts/macos-debug-app.sh && cargo test --workspace --locked",
-         cache="agent-full-macos", timeout=45, gate=False, **AGENT_FLAKE),
+    Lane("agent-full-macos", AGENT, also=RUST_SDK + PROXY_RUNTIME + APPLE_TOOLCHAIN, pr_paths=(),
+         run="python3 scripts/test_git_metadata.py"
+             f" && cargo build --workspace --all-targets --locked {RUNTIME_SHADERS}"
+             f" && ./scripts/macos-debug-app.sh && cargo test --workspace --locked {RUNTIME_SHADERS}",
+         cache="agent-full-macos", timeout=45, gate=False, **AGENT_MACOS),
     # The native Windows suite: nightly (which saves its cache) and by label, on the free runner.
     Lane("agent-full-windows", AGENT, also=RUST_SDK + PROXY_RUNTIME, pr_paths=(), labels=("ci:windows", "ci:full"),
          events=PR_AND_NIGHTLY,
@@ -265,9 +282,14 @@ def deny(manifest: str, component: str) -> str:
     # and master's real builds in agent-desktop-build.yml.
     Lane("agent-package-linux", AGENT_PACKAGING, pr_paths=(), labels=("ci:package", "ci:full"),
          events=PR_AND_NIGHTLY, job="agent-package-linux", run="just package-rehearsal", timeout=60, gate=False, **AGENT_PACKAGE_FLAKE),
-    Lane("agent-package-macos", AGENT_PACKAGING + APPLE_TOOLCHAIN, pr_paths=(), labels=("ci:package", "ci:full"),
+    Lane("agent-package-macos", AGENT_PACKAGING + APPLE_TOOLCHAIN + METAL_TOOLCHAIN, pr_paths=(), labels=("ci:package", "ci:full"),
          events=PR_AND_NIGHTLY, job="agent-package-macos", runner=MACOS, run="just package-rehearsal", timeout=60,
-         gate=False, **AGENT_PACKAGE_FLAKE),
+         gate=False, requires=("metal-toolchain",), **AGENT_PACKAGE_FLAKE),
+    # Exports Xcode's Metal Toolchain as a one-day artifact for the macOS packaging rehearsal,
+    # which compiles gpui's shaders like the signed builds. Nothing selects it by path or
+    # label: the planner adds it to every plan with a lane that requires it.
+    Lane("metal-toolchain", (), pr_paths=(), labels=(), gate=False, job="metal-toolchain",
+         events=PR_AND_NIGHTLY, runner=GITHUB_XCODE, timeout=15),
     Lane("agent-package-windows", AGENT_WINDOWS_PACKAGING, pr_paths=(), labels=("ci:package", "ci:full"),
          events=PR_AND_NIGHTLY, job="agent-package-windows", runner=GITHUB_WINDOWS, workdir="apps/maple-agent", run=WINDOWS_PACKAGE,
          env=(("RUSTFLAGS", "-D warnings -C target-feature=+crt-static"),) + FAST_RELEASE, timeout=90, gate=False),
@@ -322,8 +344,14 @@ def deny(manifest: str, component: str) -> str:
     # Unsigned platform builds: iOS and Android for PRs that touch their native inputs;
     # the desktop bundles (15-45 minutes) only by label, so no PR waits on them.
     # desktop-build.yml, mobile-build.yml and android-build.yml build master.
+    # research-ios downloads the iOS 27.1 Simulator runtime (7.85 GB, about a minute)
+    # on every run: Blacksmith's macOS 27 image ships only iOS 27.0's.
     Lane("research-ios", (TAURI + "gen/apple/**", TAURI + "icons/ios/**", TAURI + "capabilities/mobile-ios.json",
                           TAURI + "tauri.ios-dev.conf.json", TAURI + "Info.plist", TAURI + "Entitlements.plist",
+                          # iOS-only sources: the scene manifest tauri-cli merges into the app's
+                          # plist, plugin Swift code, and the vendored tao's iOS platform layer.
+                          TAURI + "Info.ios.plist", TAURI + "plugins/*/ios/**", TAURI + "patches/*/ios/**",
+                          TAURI + "patches/tao-*/src/platform_impl/ios/**", TAURI + "patches/tao-*/src/platform/ios.rs",
                           TAURI + "scripts/*ios*", TAURI + "scripts/canonicalize-static-archive.py",
                           TAURI + "scripts/onnxruntime-pins.sh", "scripts/ci/ios-*.sh", "scripts/ci/ios-build-profile.py",
                           "scripts/ci/canonical-ios-app-hash.py", "scripts/ci/_common.sh",
@@ -333,6 +361,10 @@ def deny(manifest: str, component: str) -> str:
          env=(("MAPLE_IOS_DOWNLOAD_SIMULATOR_RUNTIME", "1"),), timeout=120, **PLATFORM),
     Lane("research-android", (TAURI + "gen/android/**", TAURI + "icons/android/**",
                               TAURI + "capabilities/mobile-android.json", TAURI + "scripts/*android*",
+                              # Android-only sources: vendored plugins' Kotlin code and the vendored
+                              # tao's Android layer, which carries Maple's intent hardening.
+                              TAURI + "patches/*/android/**", TAURI + "patches/tao-*/src/platform_impl/android/**",
+                              TAURI + "patches/tao-*/src/platform/android.rs",
                               "scripts/ci/android-*.sh", "scripts/ci/_common.sh"),
          labels=("ci:android", "ci:full"), flake=".#android", run="./scripts/ci/android-pr.sh", timeout=45,
          restore="research-rust", **PLATFORM),
diff --git a/scripts/ci/plan.py b/scripts/ci/plan.py
index fdc7b6499..f708fc526 100644
--- a/scripts/ci/plan.py
+++ b/scripts/ci/plan.py
@@ -87,6 +87,19 @@ def everything(event: str, why: str) -> Selection:
     return {lane.id: [why] for lane in active(event)}
 
 
+def with_requirements(selected: Selection) -> Selection:
+    """Add every lane a selected lane requires, transitively: the requiring lane's job needs theirs."""
+    by_id = {lane.id: lane for lane in LANES}
+    pending = list(selected)
+    while pending:
+        lane = by_id.get(pending.pop())
+        for name in lane.requires if lane else ():
+            if name not in selected:
+                pending.append(name)
+            selected.setdefault(name, []).append(f"required by {lane.id}")
+    return selected
+
+
 def select(event: str, paths: Iterable[str], labels: Sequence[str] = ()) -> Selection:
     """Active lanes that the changed paths and PR labels select for `event`."""
     lanes = active(event)
@@ -115,7 +128,7 @@ def select(event: str, paths: Iterable[str], labels: Sequence[str] = ()) -> Sele
                 chosen.setdefault(lane.id, []).append(f"label {label}")
     if approvals:  # opensecret-eif.yml compares the edited approvals instead
         chosen.pop("os-eif", None)
-    return chosen
+    return with_requirements(chosen)
 
 
 def hook_components(paths: Iterable[str]) -> List[str]:
@@ -170,7 +183,7 @@ def plan_event(event: str, payload: dict) -> Selection:
         unknown = sorted(set(names) - {lane.id for lane in active(event)})
         if unknown:
             raise ValueError(f"not an active lane: {', '.join(unknown)}")
-        return {name: ["dispatch"] for name in names}
+        return with_requirements({name: ["dispatch"] for name in names})
     if event == NIGHTLY:
         return everything(event, "nightly")
     labels: List[str] = []
@@ -496,6 +509,38 @@ def lint_problems(files: Sequence[str]) -> List[str]:
             problems.append(f"ci.yml plan: {variable} is not passed to plan.py")
     if f"toolchain: {AGENT_WINDOWS_RUST}\n" not in WINDOWS_SETUP.read_text():
         problems.append(f"setup-agent-windows does not pin Rust {AGENT_WINDOWS_RUST}")
+    # A lane's requirements run only for it: they exist, form no cycle, select nothing on their
+    # own, and the requiring lane's special job waits for theirs.
+    by_id = {lane.id: lane for lane in LANES}
+    for lane in LANES:
+        for name in lane.requires:
+            required = by_id.get(name)
+            if required is None:
+                problems.append(f"{lane.id}: requires unknown lane {name}")
+                continue
+            if required.paths or required.pr_paths or required.labels or required.gate or required.opensecret:
+                problems.append(f"{name}: a required lane must have no paths, labels, gate or OpenSecret selector")
+            if lane.job in MATRIX_JOBS or lane.job not in blocks:
+                problems.append(f"{lane.id}: a lane with requirements needs its own ci.yml job")
+                continue
+            needs = re.search(r"^    needs: \[?([^\]\n]*)\]?$", blocks[lane.job], re.M)
+            if not needs or required.job not in {n.strip() for n in needs[1].split(",")}:
+                problems.append(f"ci.yml {lane.job}: needs does not include {required.job}")
+    # A fallback plan (everything()) must never run a required lane without a lane that needs it.
+    for name in sorted({name for lane in LANES for name in lane.requires} & set(by_id)):
+        requirers = set().union(*(lane.events for lane in LANES if name in lane.requires))
+        if not by_id[name].events <= requirers:
+            problems.append(f"{name}: a required lane's events must be a subset of its requirers' events")
+    for lane in LANES:
+        seen, stack = set(), list(lane.requires)
+        while stack:
+            name = stack.pop()
+            if name == lane.id:
+                problems.append(f"{lane.id}: requirement cycle")
+                break
+            if name not in seen and name in by_id:
+                seen.add(name)
+                stack.extend(by_id[name].requires)
     declared = set(re.findall(r"^\s+- (\S+)$", (ROOT / ".github/actionlint.yaml").read_text(), re.M))
     problems += [f"{lane.id}: {lane.opensecret} is no opensecret_change_detection.py output" for lane in LANES
                  if lane.opensecret and lane.opensecret not in OPENSECRET_OUTPUTS + ("pcr",)]
diff --git a/scripts/ci/select-xcode.py b/scripts/ci/select-xcode.py
index 2e29aadb5..8a85f59cb 100644
--- a/scripts/ci/select-xcode.py
+++ b/scripts/ci/select-xcode.py
@@ -29,7 +29,10 @@ def load_pin(path=PIN):
 
 def select_xcode(pin, applications=Path("/Applications")):
     version = pin["version"]
-    for name in (f"Xcode_{version}.app", f"Xcode_{version}.0.app", "Xcode.app"):
+    # Hosted images may keep a release under a suffixed name (for example
+    # Xcode_27.1_Release_Candidate.app); the exact build check below decides.
+    suffixed = sorted(path.name for path in applications.glob(f"Xcode_{version}_*.app"))
+    for name in (f"Xcode_{version}.app", f"Xcode_{version}.0.app", *suffixed, "Xcode.app"):
         developer = applications / name / "Contents/Developer"
         if not (developer / "usr/bin/xcodebuild").is_file():
             continue
diff --git a/scripts/ci/test-canonical-macho.py b/scripts/ci/test-canonical-macho.py
index 99e344fe0..94790a3af 100644
--- a/scripts/ci/test-canonical-macho.py
+++ b/scripts/ci/test-canonical-macho.py
@@ -71,6 +71,35 @@ def local_absolute_symbols(path):
     return symbols
 
 
+def swap_local_absolute_symbols(path):
+    """Swap the first two local absolute nlist entries in place."""
+    data = bytearray(Path(path).read_bytes())
+    _, _, _, _, ncmds, _, _, _ = struct.unpack_from("<IiiIIIII", data)
+    command_offset = 32
+    for _ in range(ncmds):
+        command, command_size = struct.unpack_from("<II", data, command_offset)
+        if command == LC_SYMTAB:
+            symbol_offset, symbol_count, _, _ = struct.unpack_from(
+                "<IIII", data, command_offset + 8
+            )
+            break
+        command_offset += command_size
+    else:
+        raise AssertionError(f"Mach-O has no symbol table: {path}")
+    entries = []
+    for index in range(symbol_count):
+        entry_offset = symbol_offset + index * 16
+        symbol_type = data[entry_offset + 4]
+        if not symbol_type & N_STAB and (symbol_type & N_TYPE) == N_ABS and not symbol_type & N_EXT:
+            entries.append(entry_offset)
+    first, second = entries[:2]
+    data[first:first + 16], data[second:second + 16] = (
+        data[second:second + 16],
+        data[first:first + 16],
+    )
+    Path(path).write_bytes(bytes(data))
+
+
 class CanonicalMachoTests(unittest.TestCase):
     def build_executable(self, output, local_symbols, return_value, global_symbol):
         object_path = output.with_suffix(".o")
@@ -145,6 +174,10 @@ def test_local_absolute_symbol_order_is_not_runtime_content(self):
             )
 
             self.assertEqual(local_absolute_symbols(executable_ab), symbols_ab)
+            if local_absolute_symbols(executable_ba) == symbols_ab:
+                # Xcode 27's ld sorts local absolute symbols, so reproduce the
+                # input-order variant older linkers emitted by swapping the entries.
+                swap_local_absolute_symbols(executable_ba)
             self.assertEqual(local_absolute_symbols(executable_ba), symbols_ba)
 
             canonical_ab = CANONICALIZER.canonical_macho(executable_ab)
diff --git a/scripts/ci/test_cargo_graph_key.py b/scripts/ci/test_cargo_graph_key.py
index 66a78464e..deb406152 100644
--- a/scripts/ci/test_cargo_graph_key.py
+++ b/scripts/ci/test_cargo_graph_key.py
@@ -199,6 +199,16 @@ def test_a_flake_lock_change_changes_the_key(self):
         flake["nodes"]["nixpkgs"]["locked"]["rev"] = "b" * 40
         self.assertNotEqual(key(flake=flake), key())
 
+    def test_toolchain_pins_join_the_key_only_when_given(self):
+        pin = '{\n  "version": "27.1",\n  "build": "27A9275"\n}\n'
+        lockfiles = (lock_text(PACKAGES), json.dumps(FLAKE, indent=2))
+        self.assertEqual(cargo_graph_key.key(*lockfiles, ()), key())
+        self.assertNotEqual(cargo_graph_key.key(*lockfiles, (pin,)), key())
+        self.assertNotEqual(cargo_graph_key.key(*lockfiles, (pin.replace("27A9275", "27A9276"),)),
+                            cargo_graph_key.key(*lockfiles, (pin,)))
+        self.assertEqual(cargo_graph_key.key(*lockfiles, (pin.replace("\n", "\r\n"),)),
+                         cargo_graph_key.key(*lockfiles, (pin,)))
+
     def test_formatting_order_and_line_endings_do_not_change_the_key(self):
         reordered = copy.deepcopy(PACKAGES[::-1])
         for package in reordered:
@@ -265,6 +275,15 @@ def test_prints_one_github_output_line_for_the_agent_lockfiles(self):
         self.assertEqual(code, 0)
         self.assertRegex(stdout, r"\Ahash=[0-9a-f]{64}\n\Z")
 
+    def test_a_pin_file_argument_changes_the_agent_key(self):
+        agent = ROOT / "apps/maple-agent"
+        lockfiles = (str(agent / "Cargo.lock"), str(agent / "flake.lock"))
+        _, plain, _ = self.run_main(*lockfiles)
+        code, pinned, _ = self.run_main(*lockfiles, str(ROOT / "scripts/ci/apple-toolchain.json"))
+        self.assertEqual(code, 0)
+        self.assertRegex(pinned, r"\Ahash=[0-9a-f]{64}\n\Z")
+        self.assertNotEqual(pinned, plain)
+
     def test_the_agent_lock_keeps_its_key_when_every_local_version_is_bumped(self):
         agent = ROOT / "apps/maple-agent"
         text, flake = (agent / "Cargo.lock").read_text(), (agent / "flake.lock").read_text()
diff --git a/scripts/ci/test_contracts.py b/scripts/ci/test_contracts.py
index 4251232b4..05819c8c8 100644
--- a/scripts/ci/test_contracts.py
+++ b/scripts/ci/test_contracts.py
@@ -417,8 +417,12 @@ def test_c4_ci_restores_only_what_a_master_workflow_saves(self):
                     if step["uses"].startswith("actions/cache/save@"):
                         self.assertIn("refs/heads/master' && github.event_name == 'schedule'", step["if"])
                     else:
-                        self.assertTrue(step["with"]["key"].startswith("ci-v1-agent-package-${{ runner.os }}-"))
-                        self.assertEqual(step["with"]["restore-keys"], "ci-v1-agent-package-${{ runner.os }}-")
+                        # macOS also leads with the Xcode pin, so a prefix restore never
+                        # brings back objects built against another SDK.
+                        prefix = "ci-v1-agent-package-${{ runner.os }}-" + (
+                            "${{ hashFiles('scripts/ci/apple-toolchain.json') }}-" if job_id == "agent-package-macos" else "")
+                        self.assertTrue(step["with"]["key"].startswith(prefix))
+                        self.assertEqual(step["with"]["restore-keys"], prefix)
             elif name == "ci.yml":
                 with self.subTest(job=job_id):
                     self.assertTrue(step["uses"].startswith("actions/cache/restore@"))
@@ -459,7 +463,12 @@ def test_c4_agent_release_key_hashes_the_dependency_graph_and_toolchain(self):
         # empty or misnamed output would turn the exact key into a prefix that restores any
         # entry of the family.
         agent = ROOT / "apps/maple-agent"
-        expected = cargo_graph_key.key((agent / "Cargo.lock").read_text(), (agent / "flake.lock").read_text())
+        lockfiles = ((agent / "Cargo.lock").read_text(), (agent / "flake.lock").read_text())
+        # The macOS builder also hashes the Xcode pin, so an Xcode upgrade never restores
+        # objects built against the previous SDK.
+        apple = ((ROOT / "scripts/ci/apple-toolchain.json").read_text(),)
+        expected = {job: cargo_graph_key.key(*lockfiles, apple if job == "macos-build" else ())
+                    for _, job in AGENT_RELEASE_WRITERS}
         pattern = r"ci-v1-agent-release-\$\{\{ runner\.os \}\}-\$\{\{ steps\.([\w-]+)\.outputs\.([\w-]+) \}\}"
         with tempfile.TemporaryDirectory() as temporary:
             working = Path(temporary) / "bin/python3"
@@ -497,7 +506,7 @@ def run(step, directory, python, output):
                     output = Path(temporary) / f"{job_id}.output"
                     result = run(step, directory, working, output)
                     self.assertEqual(result.returncode, 0, result.stderr)
-                    self.assertEqual(output.read_text().splitlines(), [f"{reference[2]}={expected}"])
+                    self.assertEqual(output.read_text().splitlines(), [f"{reference[2]}={expected[job_id]}"])
                     failed = Path(temporary) / f"{job_id}.failed"
                     self.assertNotEqual(run(step, directory, failing, failed).returncode, 0)
                     self.assertEqual(failed.read_text() if failed.exists() else "", "")
diff --git a/scripts/ci/test_plan.py b/scripts/ci/test_plan.py
index c78ab8a40..ab18a85b7 100644
--- a/scripts/ci/test_plan.py
+++ b/scripts/ci/test_plan.py
@@ -1,6 +1,7 @@
 """Lane selection: the table, the planner's events and the pre-commit hook."""
 
 import contextlib
+import dataclasses
 import io
 import json
 import os
@@ -233,6 +234,27 @@ def test_every_tracked_file_is_classified_and_ci_yml_matches(self):
                               plan.lint_problems(plan.tracked_files()))
 
 
+    def test_a_lane_with_requirements_waits_for_their_jobs(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            workflow = Path(tmp) / "ci.yml"
+            workflow.write_text(plan.CI_WORKFLOW.read_text().replace(
+                "    needs: [plan, metal-toolchain]\n    if: fromJSON(needs.plan.outputs.lanes)['agent-package-macos']",
+                "    needs: plan\n    if: fromJSON(needs.plan.outputs.lanes)['agent-package-macos']"))
+            with mock.patch.object(plan, "CI_WORKFLOW", workflow):
+                self.assertIn("ci.yml agent-package-macos: needs does not include metal-toolchain",
+                              plan.lint_problems(plan.tracked_files()))
+        def edited(lane_id, **changes):
+            return tuple(dataclasses.replace(lane, **changes) if lane.id == lane_id else lane for lane in lanes.LANES)
+        for broken, problem in ((edited("agent-package-macos", requires=("no-such-lane",)),
+                                 "agent-package-macos: requires unknown lane no-such-lane"),
+                                (edited("metal-toolchain", labels=("ci:full",)),
+                                 "metal-toolchain: a required lane must have no paths, labels, gate or OpenSecret selector"),
+                                (edited("metal-toolchain", events=lanes.GATE),
+                                 "metal-toolchain: a required lane's events must be a subset of its requirers' events")):
+            with self.subTest(problem=problem), mock.patch.object(plan, "LANES", broken):
+                self.assertIn(problem, plan.lint_problems(plan.tracked_files()))
+
+
 class HookTests(unittest.TestCase):
     """The pre-commit hook's components: a path selects those of the lanes that own it."""
 
@@ -379,6 +401,23 @@ def test_packaging_rehearsals_run_only_by_label_and_nightly(self):
             self.assertEqual(agent_lanes(selected(["docs/x.md"], labels=[label])) & packages, packages)
         self.assertLessEqual(packages, active(NIGHTLY))
 
+    def test_a_required_lane_runs_only_with_the_lane_that_requires_it(self):
+        # The macOS packaging rehearsal compiles gpui's shaders on Blacksmith, whose image
+        # cannot download the Metal Toolchain; metal-toolchain exports it, and only that
+        # requirement ever selects it.
+        consumer, required = "agent-package-macos", "metal-toolchain"
+        for event in (PR, PUSH):
+            with self.subTest(event=event):
+                self.assertFalse({consumer, required} & selected(["apps/maple-agent/app/src/main.rs"], event))
+        for label in ("ci:package", "ci:full"):
+            with self.subTest(label=label):
+                chosen = plan.select(PR, ["docs/x.md"], [label])
+                self.assertIn(consumer, chosen)
+                self.assertEqual(chosen[required], [f"required by {consumer}"])
+        self.assertLessEqual({consumer, required}, active(NIGHTLY))
+        # A master push that falls back to every lane must not export it for nobody.
+        self.assertNotIn(required, plan.everything(PUSH, "fallback"))
+
     def test_full_suites_run_on_master_nightly_and_by_label(self):
         full = {"agent-full-linux", "agent-full-macos", "agent-full-windows"}
         self.assertFalse(full & selected(["apps/maple-agent/app/src/main.rs"]))
@@ -392,6 +431,18 @@ def test_full_suites_run_on_master_nightly_and_by_label(self):
         self.assertLessEqual(AGENT_PACKAGE | {"agent-package-windows"}, active(NIGHTLY))
         self.assertFalse(full & selected([".github/workflows/ci.yml"]))  # CI edits prove the gate lanes only
 
+    def test_agent_desktop_selector_covers_every_local_action_the_signed_builds_run(self):
+        # A change to one of them must start the signed build on master.
+        workflow = json.loads(subprocess.run(
+            ["yq", "-o=json", ".", str(plan.ROOT / ".github/workflows/agent-desktop-build.yml")],
+            check=True, capture_output=True, text=True).stdout)
+        actions = {step["uses"].removeprefix("./") for job in workflow["jobs"].values()
+                   for step in job.get("steps", []) if step.get("uses", "").startswith("./.github/actions/")}
+        self.assertTrue(actions)
+        for action in sorted(actions):
+            with self.subTest(action=action):
+                self.assertTrue(plan.matches(f"{action}/action.yml", lanes.AGENT_DESKTOP))
+
     def test_agent_desktop_selector_covers_the_signed_builds_inputs(self):
         for path in ("apps/maple-agent/app/src/main.rs", "sdk/rust/src/client.rs", "proxy/src/proxy.rs",
                      ".github/workflows/agent-desktop-build.yml", ".github/actions/setup-agent-windows/action.yml",
@@ -462,6 +513,17 @@ def test_research_platform_builds_run_on_native_inputs_or_labels(self):
         # Mobile builds still follow their native inputs; desktop bundles never block
         # a PR (desktop-build.yml builds master; ci:package rehearses them).
         for path, lanes_ in ((tauri + "gen/apple/project.yml", {"research-ios"}),
+                             (tauri + "Info.ios.plist", {"research-ios", "research-rust"}),
+                             (tauri + "plugins/tauri-plugin-iap/ios/Sources/IapPlugin.swift",
+                              {"research-ios", "research-rust"}),
+                             (tauri + "patches/tao-0.37.1/src/platform_impl/ios/app_state.rs",
+                              {"research-ios", "research-rust"}),
+                             (tauri + "patches/tao-0.37.1/src/platform/ios.rs", {"research-ios", "research-rust"}),
+                             (tauri + "patches/tao-0.37.1/src/platform_impl/android/ndk_glue.rs",
+                              {"research-android", "research-rust"}),
+                             (tauri + "patches/tao-0.37.1/src/platform/android.rs", {"research-android", "research-rust"}),
+                             (tauri + "patches/tauri-plugin-sign-in-with-apple-1.0.2/android/src/main/java/ExamplePlugin.kt",
+                              {"research-android", "research-rust"}),
                              (tauri + "gen/android/app/build.gradle.kts", {"research-android"}),
                              (tauri + "dmg/background.tiff", {"research-rust"}),
                              (tauri + "tauri.conf.json", {"research-rust", "repo"}),
@@ -564,6 +626,11 @@ def test_schedule_and_dispatch(self):
         self.assertEqual({lane for lane, on in outputs["lanes"].items() if on}, {"agent-test"})
         self.assertEqual([entry["id"] for entry in outputs["nix"]], ["agent-test"])
 
+    def test_dispatching_a_lane_also_runs_the_lanes_it_requires(self):
+        _, outputs = self.github(DISPATCH, {}, LANES_INPUT="agent-package-macos")
+        self.assertEqual({lane for lane, on in outputs["lanes"].items() if on},
+                         {"agent-package-macos", "metal-toolchain"})
+
     def test_quarantined_lanes_still_run_and_an_unknown_id_fails_the_plan(self):
         code, outputs = self.github(NIGHTLY, {}, CI_QUARANTINE=" research-ios,agent-test, ")
         self.assertEqual((code, outputs["quarantine"]), (0, ["agent-test", "research-ios"]))
@@ -622,6 +689,8 @@ def test_a_cache_key_pins_the_toolchain_and_leaves_lockfiles_to_rust_cache(self)
                 workspace = lane.workspaces.split("->")[0].strip()
                 pins = {f"{workspace}/{name}" for name in ("flake.lock", "rust-toolchain.toml")
                         if (plan.ROOT / workspace / name).is_file()}
+                if lane.runner == lanes.MACOS:  # and the Xcode that builds against the SDK
+                    pins.add("scripts/ci/apple-toolchain.json")
                 with self.subTest(lane=lane.id):
                     self.assertIn(f"{workspace}/flake.lock", pins)
                     self.assertEqual(set(lane.cache_files), pins)
diff --git a/scripts/ci/test_select_xcode.py b/scripts/ci/test_select_xcode.py
index e2115b194..2785cc128 100644
--- a/scripts/ci/test_select_xcode.py
+++ b/scripts/ci/test_select_xcode.py
@@ -97,6 +97,19 @@ def test_beta_install_and_disguised_beta_symlink_are_never_probed(self):
                 selector.select_xcode(self.pin, self.directory)
             run.assert_not_called()
 
+    def test_suffixed_release_install_is_selected_by_exact_build(self):
+        self.install("Xcode_26.5_beta_2.app")
+        developer = self.install("Xcode_26.5_Release_Candidate.app")
+        with patch.object(selector.subprocess, "run", return_value=self.result()) as run:
+            self.assertEqual(selector.select_xcode(self.pin, self.directory), developer)
+        self.assertEqual(run.call_count, 1)
+
+    def test_suffixed_install_with_another_build_is_rejected(self):
+        self.install("Xcode_26.5_Release_Candidate.app")
+        with patch.object(selector.subprocess, "run", return_value=self.result(build="17F40")):
+            with self.assertRaisesRegex(selector.ToolchainError, "26.5 build 17F42"):
+                selector.select_xcode(self.pin, self.directory)
+
     def test_rolling_default_is_skipped_when_pinned_release_is_available(self):
         self.install("Xcode_26.5.app")
         developer = self.install("Xcode_26.5.0.app")
diff --git a/scripts/ci/test_workflow_policy.py b/scripts/ci/test_workflow_policy.py
index a123a5edb..27dfc70e8 100644
--- a/scripts/ci/test_workflow_policy.py
+++ b/scripts/ci/test_workflow_policy.py
@@ -7,6 +7,7 @@
 from pathlib import Path
 import re
 import subprocess
+import tempfile
 import unittest
 
 import lanes
@@ -28,9 +29,10 @@
 VERIFY_NIX = "bash scripts/ci/verify-nix-runtime.sh"
 SETUP_NIX = "./.github/actions/setup-nix"
 PINNED = re.compile(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+(?:/[A-Za-z0-9_./-]+)?@[0-9a-f]{40}")
-# Standard images, and the org's one GitHub-hosted larger runner, by its exact label:
-# a pattern would also admit a self-hosted runner that borrowed the name.
-GITHUB_HOSTED = re.compile(r"(?:ubuntu|macos|windows)-[A-Za-z0-9.-]+|maple-windows-2025-16core")
+# GitHub-hosted labels: the standard image families (ubuntu-*, macos-*, windows-*) and the
+# per-Xcode macOS images (xcode-N), plus the org's larger Windows runner by its exact label,
+# since a pattern would also admit a self-hosted runner that borrowed the name.
+GITHUB_HOSTED = re.compile(r"(?:ubuntu|macos|windows)-[A-Za-z0-9.-]+|xcode-[0-9]+|maple-windows-2025-16core")
 # The workflows that run on pull requests or the merge queue. Every other check is a
 # ci.yml lane (scripts/ci/lanes.py), so ci-ok judges it; adding one here is an owner call.
 PULL_REQUEST_WORKFLOWS = frozenset({
@@ -95,6 +97,16 @@ def workflows() -> dict:
     return {path.name: load(path) for path in sorted(WORKFLOWS.glob("*.yml"))}
 
 
+def expanded_steps(steps, root: Path = ROOT, seen: frozenset = frozenset()):
+    """A job's steps, each local composite action followed by the steps it runs in that job."""
+    for step in steps:
+        yield step
+        uses = step.get("uses", "")
+        if uses.startswith("./.github/actions/") and uses not in seen:
+            action = load(root / uses.removeprefix("./") / "action.yml")
+            yield from expanded_steps(action.get("runs", {}).get("steps", []), root, seen | {uses})
+
+
 def jobs():
     for name, config in workflows().items():
         for job_id, job in config["jobs"].items():
@@ -267,8 +279,10 @@ def test_pull_requests_never_save_caches_or_read_other_runs_artifacts(self):
         for name, config in workflows().items():
             pr = bool({"pull_request", "merge_group"} & triggers(config))
             for job_id, job in config["jobs"].items():
-                for step in job.get("steps", []):
+                for step in expanded_steps(job.get("steps", [])):
                     self.assertNotIn("run-id", step.get("with", {}), (name, job_id))
+                    if step.get("uses", "").startswith("actions/download-artifact@"):
+                        self.assertNotIn("github-token", step.get("with", {}), (name, job_id))
                     guard = " ".join(str(value) for value in (
                         job.get("if", ""), step.get("if", ""), step.get("with", {}).get("save-if", "")))
                     if pr and cache_writer(step) and (name, job_id) in BRANCH_SCOPED_NIX:
@@ -283,11 +297,26 @@ def test_pull_requests_never_save_caches_or_read_other_runs_artifacts(self):
                             self.assertTrue(events and events <= {"push", "schedule"}, (job_id, guard))
         self.assertEqual(scoped, BRANCH_SCOPED_NIX)  # the exemption lapses with its job
 
+    def test_steps_inside_local_composite_actions_are_checked_too(self):
+        # A composite action's steps run in the job that uses it, so a cache save or another
+        # run's artifact inside one must reach the checks above.
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            action = root / ".github/actions/fixture/action.yml"
+            action.parent.mkdir(parents=True)
+            action.write_text(json.dumps({"runs": {"using": "composite", "steps": [
+                {"uses": "actions/download-artifact@" + "0" * 40, "with": {"name": "x", "run-id": "1"}},
+                {"uses": "actions/cache@" + "0" * 40, "with": {"path": "x", "key": "y"}},
+            ]}}))
+            steps = list(expanded_steps([{"uses": "./.github/actions/fixture"}], root))
+        self.assertTrue(any("run-id" in step.get("with", {}) for step in steps))
+        self.assertTrue(any(cache_writer(step) for step in steps))
+
     def test_only_listed_jobs_fill_githubs_cache_store_and_failovers_never_save(self):
         # Blacksmith runners cannot read GitHub's store, nor GitHub's runners Blacksmith's.
         writers = set()
         for name, job_id, job in jobs():
-            for step in job.get("steps", []):
+            for step in expanded_steps(job.get("steps", [])):
                 if name in SACRED or not cache_writer(step):
                     continue
                 guard = " ".join(str(value) for value in (step.get("if", ""), step["with"].get("save-if", "")))
diff --git a/scripts/testing/storekit/run.sh b/scripts/testing/storekit/run.sh
index 812b01f14..e0ac66d1a 100644
--- a/scripts/testing/storekit/run.sh
+++ b/scripts/testing/storekit/run.sh
@@ -2,10 +2,11 @@
 set -euo pipefail
 
 # Invoke through .#apple so native linker variables are prepared here.
-# A deliberate local comparison can select Xcode 26.6 without changing pins:
+# A deliberate local comparison can select another installed Xcode without
+# changing pins:
 # nix develop --no-update-lock-file .#apple -c env \
-#   MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-#   DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+#   MAPLE_NIX_XCODE_VERSION=<version> MAPLE_NIX_XCODE_BUILD_VERSION=<build> \
+#   DEVELOPER_DIR=/Applications/Xcode_<version>.app/Contents/Developer \
 #   bash scripts/testing/storekit/run.sh ...
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")/../../ci" && pwd)/_common.sh"
 use_xcode_toolchain