diff --git a/.agents/skills/change-maple-ci/references/changing-ci.md b/.agents/skills/change-maple-ci/references/changing-ci.md
index d1c7c8cb1..7fcefe334 100644
--- a/.agents/skills/change-maple-ci/references/changing-ci.md
+++ b/.agents/skills/change-maple-ci/references/changing-ci.md
@@ -23,6 +23,7 @@ Paths are relative to the repository root. `scripts/ci/lanes.py` and
 | `submodules` | Recursive submodules with full blobless history (Nix needs `revCount`) |
 | `hook` | Pre-commit component that runs the same checks locally |
 | `restore` | Read-only restore of a cache another workflow writes |
+| `requires` | Lanes whose jobs this lane's special job needs. The planner adds them to every plan that selects the lane, dispatches included; a required lane has no paths, labels or gate of its own, so nothing else selects it (lint). `metal-toolchain` is the example: GitHub's xcode-27 image exports Xcode's Metal Toolchain for `agent-package-macos` |
 
 Event sets:
 
@@ -99,6 +100,8 @@ Its id is the lane's `job`. Checked by `plan.py lint` and the policy tests:
 - `runs-on` exactly `${{ vars.<VARIABLE> || '<label>' }}` when the runner has
   an override variable, otherwise the plain label; `timeout-minutes` equals
   the lane's `timeout` (lint).
+- A lane with `requires` has its own job, whose `needs:` lists each required
+  lane's job (lint).
 - `ci-ok` needs it (test 8); a new runner label is declared in
   `.github/actionlint.yaml` (test 9 and lint); checkouts use
   `persist-credentials: false` (test 3).
@@ -132,7 +135,7 @@ The `Runner` constants at the top of `lanes.py` are authoritative.
 | `MACOS` (Blacksmith macOS) | `CI_MACOS_RUNNER` |
 | `WINDOWS` (Blacksmith Windows) | `CI_WINDOWS_RUNNER` |
 | `GITHUB_WINDOWS` (`maple-windows-2025-16core`) | `CI_WINDOWS_GITHUB_RUNNER`, read only by special jobs |
-| `GITHUB`, `GITHUB_WINDOWS_FREE`, `EIF_BUILDER`, inline `ubuntu-24.04-arm` | none |
+| `GITHUB`, `GITHUB_WINDOWS_FREE`, `GITHUB_XCODE` (`xcode-27`), `EIF_BUILDER`, inline `ubuntu-24.04-arm` | none |
 
 - Matrix lanes resolve their runner when `plan` runs. A new matrix variable
   must be passed in the `plan` step's `env`; `lint` checks this.
@@ -159,7 +162,10 @@ The `Runner` constants at the top of `lanes.py` are authoritative.
 - The Agent release key's hash is a step output from
   `scripts/ci/cargo_graph_key.py`, not `hashFiles`. C4 runs that step, with
   the script working and failing, so an empty or misnamed output cannot turn
-  the exact key into a family prefix.
+  the exact key into a family prefix. The macOS build also passes
+  `scripts/ci/apple-toolchain.json`, as the macOS lanes list it in
+  `cache_files`: an Xcode upgrade must not restore objects built against the
+  previous SDK.
 - Turn off implicit saves on PR paths: setup-bun `no-cache: true` and no
   Magic Nix Cache (both checked), and Trivy `cache: "false"` (convention).
 - After a lockfile change, master's first save deletes the lane's target
@@ -252,6 +258,9 @@ selected or nightly; run it yourself after doc edits.
 `just lane <id>` runs exactly what CI runs. Limits:
 
 - macOS lanes need macOS and the pinned Xcode (`scripts/ci/select-xcode.py`).
+  The Agent's Clippy and native suite build gpui with `runtime_shaders`, so
+  they need no Metal Toolchain; the packaging rehearsal compiles the shaders
+  and needs it (`xcodebuild -downloadComponent MetalToolchain`).
 - Windows lanes need Windows with the toolchain from
   `.github/actions/setup-agent-windows`.
 - `os-sdk-e2e` needs PostgreSQL on `127.0.0.1:5432` with the credentials in
diff --git a/.agents/skills/change-maple-ci/references/debugging.md b/.agents/skills/change-maple-ci/references/debugging.md
index 915e46d47..19ee47d4b 100644
--- a/.agents/skills/change-maple-ci/references/debugging.md
+++ b/.agents/skills/change-maple-ci/references/debugging.md
@@ -70,7 +70,7 @@ the cancellation to finish, so rapid re-pushes each add some delay.
   variable `CI_LINUX_HEAVY_RUNNER=blacksmith-16vcpu-ubuntu-2404` (same
   vendor, so caches still work) and unset it afterwards. For the 8-vCPU
   lanes, `CI_LINUX_RUNNER=blacksmith-16vcpu-ubuntu-2404` keeps Blacksmith's
-  store. In a Blacksmith-wide outage use `ubuntu-latest` (or `macos-26`,
+  store. In a Blacksmith-wide outage use `ubuntu-latest` (or `xcode-27`,
   `windows-2025`): cold, saves nothing, slower.
   - Matrix lanes take their runner from `plan`, so re-plan: cancel a PR run,
     then **Re-run all jobs**. Never cancel a master run; the variable applies
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 571459b27..8b5c0d6e8 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -3,8 +3,10 @@ self-hosted-runner:
   labels:
     - blacksmith-16vcpu-ubuntu-2404-arm
     - blacksmith-8vcpu-windows-2025
-    - blacksmith-6vcpu-macos-26
+    - blacksmith-6vcpu-macos-27
     - blacksmith-8vcpu-ubuntu-2404
     - blacksmith-32vcpu-ubuntu-2404
     # GitHub-hosted larger runner (org runner group "Maple"); actionlint only knows standard labels.
     - maple-windows-2025-16core
+    # GitHub-hosted Xcode 27 image; newer than the pinned actionlint label list.
+    - xcode-27
diff --git a/.github/actions/export-metal-toolchain/action.yml b/.github/actions/export-metal-toolchain/action.yml
new file mode 100644
index 000000000..0bd6651b9
--- /dev/null
+++ b/.github/actions/export-metal-toolchain/action.yml
@@ -0,0 +1,28 @@
+name: Export the Metal Toolchain
+description: >-
+  Download the selected Xcode's Metal Toolchain and upload it as this run's
+  one-day `metal-toolchain` artifact. Blacksmith's macOS image has no Metal
+  Toolchain and cannot download it (its MobileAsset catalog fetch fails), so a
+  GitHub xcode-27 job exports it and the Blacksmith jobs import it. Run it after
+  selecting the pinned Xcode.
+runs:
+  using: composite
+  steps:
+    - name: Download and export the Metal Toolchain
+      shell: bash
+      run: |
+        set -euo pipefail
+        export_dir="$RUNNER_TEMP/metal-toolchain"
+        mkdir -p "$export_dir"
+        xcodebuild -downloadComponent metalToolchain -exportPath "$export_dir"
+        # Keep symlinks and modes intact; artifacts flatten them.
+        tar -C "$export_dir" -cf "$RUNNER_TEMP/metal-toolchain.tar" .
+    - name: Upload the Metal Toolchain
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      with:
+        name: metal-toolchain
+        path: ${{ runner.temp }}/metal-toolchain.tar
+        if-no-files-found: error
+        # Apple's toolchain, re-hosted only for this run's jobs.
+        retention-days: 1
+        compression-level: 0
diff --git a/.github/actions/import-metal-toolchain/action.yml b/.github/actions/import-metal-toolchain/action.yml
new file mode 100644
index 000000000..4454e1b10
--- /dev/null
+++ b/.github/actions/import-metal-toolchain/action.yml
@@ -0,0 +1,30 @@
+name: Import the Metal Toolchain
+description: >-
+  Install the Metal Toolchain that this run's metal-toolchain job exported, so
+  gpui can compile its Metal shaders on Blacksmith's macOS image. A runner whose
+  Xcode already has it (GitHub's xcode-27 image, during a failover) skips the
+  import. Run it after selecting the pinned Xcode.
+runs:
+  using: composite
+  steps:
+    - name: Download the exported Metal Toolchain
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      with:
+        name: metal-toolchain
+        path: ${{ runner.temp }}/metal-toolchain-artifact
+    - name: Import the Metal Toolchain
+      shell: bash
+      run: |
+        set -euo pipefail
+        if xcodebuild -showComponent metalToolchain | grep -q '^Status: installed'; then
+          echo "The selected Xcode already has its Metal Toolchain."
+        else
+          import_dir="$RUNNER_TEMP/metal-toolchain"
+          mkdir -p "$import_dir"
+          tar -C "$import_dir" -xf "$RUNNER_TEMP/metal-toolchain-artifact/metal-toolchain.tar"
+          bundle="$(find "$import_dir" -maxdepth 1 \( -name '*.exportedBundle' -o -name '*.dmg' \) -print -quit)"
+          test -n "$bundle"
+          xcodebuild -importComponent metalToolchain -importPath "$bundle" \
+            || sudo xcodebuild -importComponent metalToolchain -importPath "$bundle"
+        fi
+        xcrun -sdk macosx metal --version
diff --git a/.github/workflows/agent-desktop-build.yml b/.github/workflows/agent-desktop-build.yml
index c0c529a58..cb994738e 100644
--- a/.github/workflows/agent-desktop-build.yml
+++ b/.github/workflows/agent-desktop-build.yml
@@ -51,11 +51,31 @@ jobs:
         # Dispatch, the nightly run, an unusable push base and selector errors all build.
         run: python3 scripts/ci/plan.py only agent-desktop >> "$GITHUB_OUTPUT"
 
+  # Blacksmith's macOS image cannot download Xcode's Metal Toolchain, so GitHub's
+  # xcode-27 image exports it for the macOS build, which compiles gpui's shaders.
+  metal-toolchain:
+    name: Export the Metal Toolchain
+    needs: changes
+    if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false') && github.repository == 'MaplePrivacyLabs/Maple' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }}
+    runs-on: xcode-27
+    permissions:
+      contents: read
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Select pinned Xcode
+        working-directory: .
+        run: python3 scripts/ci/select-xcode.py
+      - uses: ./.github/actions/export-metal-toolchain
+
   macos-build:
     name: Build macOS binary (${{ matrix.variant }})
-    needs: changes
+    needs: [changes, metal-toolchain]
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.agent != 'false') && github.repository == 'MaplePrivacyLabs/Maple' && github.ref == 'refs/heads/master' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }}
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     permissions:
       contents: read
     timeout-minutes: 120
@@ -82,9 +102,10 @@ jobs:
       - name: Select pinned Xcode
         working-directory: .
         run: python3 scripts/ci/select-xcode.py
+      - uses: ./.github/actions/import-metal-toolchain
       - name: Hash the Agent's third-party dependency graph and toolchain
         id: graph
-        run: python3 ../../scripts/ci/cargo_graph_key.py Cargo.lock flake.lock >> "$GITHUB_OUTPUT"
+        run: python3 ../../scripts/ci/cargo_graph_key.py Cargo.lock flake.lock ../../scripts/ci/apple-toolchain.json >> "$GITHUB_OUTPUT"
       - name: Restore the exact-key Agent release cache
         id: cache
         uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
@@ -138,7 +159,7 @@ jobs:
       contents: read
       id-token: write
       attestations: write
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 120
     strategy:
       fail-fast: false
@@ -513,7 +534,7 @@ jobs:
     permissions:
       contents: read
       attestations: read
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 30
     strategy:
       fail-fast: false
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 271f33873..a11591c1c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -229,11 +229,27 @@ jobs:
           if-no-files-found: error
           retention-days: 7
 
+  # Blacksmith's macOS image cannot download Xcode's Metal Toolchain, so GitHub's
+  # xcode-27 image exports it for the lanes that compile gpui's shaders.
+  metal-toolchain:
+    name: metal-toolchain
+    needs: plan
+    if: fromJSON(needs.plan.outputs.lanes)['metal-toolchain']
+    runs-on: xcode-27
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+      - name: Select pinned Xcode
+        run: python3 scripts/ci/select-xcode.py
+      - uses: ./.github/actions/export-metal-toolchain
+
   agent-package-macos:
     name: agent-package-macos
-    needs: plan
+    needs: [plan, metal-toolchain]
     if: fromJSON(needs.plan.outputs.lanes)['agent-package-macos']
-    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-26' }}
+    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 60
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -242,13 +258,15 @@ jobs:
       - uses: ./.github/actions/setup-nix
       - name: Select pinned Xcode
         run: python3 scripts/ci/select-xcode.py
+      - uses: ./.github/actions/import-metal-toolchain
       - name: Restore the packaging rehearsal cache
         id: package-cache
         uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           # Thin-LTO release artifacts; master's fat-LTO cache cannot serve them.
-          key: ci-v1-agent-package-${{ runner.os }}-${{ hashFiles('apps/maple-agent/flake.lock', 'apps/maple-agent/Cargo.lock') }}
-          restore-keys: ci-v1-agent-package-${{ runner.os }}-
+          # The Xcode pin leads, so a prefix restore never brings back another SDK's objects.
+          key: ci-v1-agent-package-${{ runner.os }}-${{ hashFiles('scripts/ci/apple-toolchain.json') }}-${{ hashFiles('apps/maple-agent/flake.lock', 'apps/maple-agent/Cargo.lock') }}
+          restore-keys: ci-v1-agent-package-${{ runner.os }}-${{ hashFiles('scripts/ci/apple-toolchain.json') }}-
           path: |
             ~/.cargo/registry/index
             ~/.cargo/registry/cache
@@ -355,7 +373,7 @@ jobs:
     name: research-ios
     needs: plan
     if: fromJSON(needs.plan.outputs.lanes)['research-ios']
-    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-26' }}
+    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 120 # a missed ONNX Runtime cache builds it from source
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -388,7 +406,7 @@ jobs:
     name: research-desktop-macos
     needs: plan
     if: fromJSON(needs.plan.outputs.lanes)['research-desktop-macos']
-    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-26' }}
+    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -498,7 +516,7 @@ jobs:
     name: research-dev-macos
     needs: plan
     if: fromJSON(needs.plan.outputs.lanes)['research-dev-macos']
-    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-26' }}
+    runs-on: ${{ vars.CI_MACOS_RUNNER || 'blacksmith-6vcpu-macos-27' }}
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -655,7 +673,7 @@ jobs:
   ci-ok:
     name: ci-ok
     if: always()
-    needs: [plan, nix, windows, agent-package-linux, agent-package-macos, agent-package-windows, research-rust,
+    needs: [plan, nix, windows, agent-package-linux, metal-toolchain, agent-package-macos, agent-package-windows, research-rust,
             research-ios, research-desktop-macos, research-desktop-linux, research-desktop-windows,
             research-dev-macos, os-sdk-e2e, os-helpers, os-eif]
     runs-on: ubuntu-latest
diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index bfff307bb..7891bd453 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -15,7 +15,7 @@ jobs:
     environment: desktop-signing
     needs: changes
     if: ${{ always() && !cancelled() && (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.macos != 'false') }}
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     timeout-minutes: 120
     permissions:
       contents: read
@@ -214,7 +214,7 @@ jobs:
   verify-macos-desktop-artifacts:
     needs:
       - build-macos
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 30
     permissions:
       contents: read
diff --git a/.github/workflows/ios-dev-testflight.yml b/.github/workflows/ios-dev-testflight.yml
index 5b7cf75e4..dc511336a 100644
--- a/.github/workflows/ios-dev-testflight.yml
+++ b/.github/workflows/ios-dev-testflight.yml
@@ -36,7 +36,7 @@ jobs:
       (github.event_name == 'workflow_dispatch' || (github.event_name == 'push' &&
         (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.ios != 'false')))
     environment: apple-signing
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     timeout-minutes: 240
     permissions:
       contents: read
@@ -144,7 +144,7 @@ jobs:
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: build-ios-dev
     environment: apple-signing
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 45
     permissions:
       contents: read
diff --git a/.github/workflows/mobile-build.yml b/.github/workflows/mobile-build.yml
index 4a04c6a33..5bae3046e 100644
--- a/.github/workflows/mobile-build.yml
+++ b/.github/workflows/mobile-build.yml
@@ -34,7 +34,7 @@ jobs:
       github.ref == 'refs/heads/master' &&
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch') &&
       (needs.changes.result != 'success' || needs.changes.outputs.frontend != 'false' || needs.changes.outputs.ios != 'false')
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     # The ONNX source build and the app build each allow 90 minutes.
     timeout-minutes: 240
     permissions:
@@ -120,7 +120,7 @@ jobs:
 
   verify-ios-artifacts:
     needs: build-ios
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 30
     permissions:
       contents: read
@@ -156,7 +156,7 @@ jobs:
       github.ref == 'refs/heads/master' &&
       (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: verify-ios-artifacts
-    runs-on: macos-26
+    runs-on: xcode-27
     timeout-minutes: 45
     permissions:
       contents: read
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index b8d603b44..c42421626 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -46,7 +46,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-26, windows-latest]
+        os: [ubuntu-latest, xcode-27, windows-latest]
     defaults:
       run:
         shell: bash
diff --git a/.github/workflows/proxy-rust.yml b/.github/workflows/proxy-rust.yml
index 32f8d38e3..8b76bf186 100644
--- a/.github/workflows/proxy-rust.yml
+++ b/.github/workflows/proxy-rust.yml
@@ -45,7 +45,7 @@ jobs:
             archive: maple-proxy-linux-x86_64.tar.gz
           - runner: ubuntu-24.04-arm
             archive: maple-proxy-linux-aarch64.tar.gz
-          - runner: blacksmith-6vcpu-macos-26
+          - runner: blacksmith-6vcpu-macos-27
             archive: maple-proxy-macos-aarch64.tar.gz
           - runner: windows-2025
             archive: maple-proxy-windows-x86_64.zip
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2e002420e..40d471ee4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -137,7 +137,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - platform: blacksmith-6vcpu-macos-26
+          - platform: blacksmith-6vcpu-macos-27
             nix_shell: ci
             artifact_prefix: macos
           - platform: blacksmith-8vcpu-ubuntu-2404
@@ -452,7 +452,7 @@ jobs:
   build-ios:
     environment: apple-signing
     needs: classify-app-release
-    runs-on: blacksmith-6vcpu-macos-26
+    runs-on: blacksmith-6vcpu-macos-27
     permissions:
       contents: write
       id-token: write
@@ -619,7 +619,7 @@ jobs:
             archive: maple-proxy-linux-x86_64.tar.gz
           - runner: ubuntu-24.04-arm
             archive: maple-proxy-linux-aarch64.tar.gz
-          - runner: blacksmith-6vcpu-macos-26
+          - runner: blacksmith-6vcpu-macos-27
             archive: maple-proxy-macos-aarch64.tar.gz
           - runner: windows-2025
             archive: maple-proxy-windows-x86_64.zip
@@ -816,7 +816,7 @@ jobs:
     needs:
       - classify-app-release
       - build-tauri
-    runs-on: macos-26
+    runs-on: xcode-27
     permissions:
       contents: read
     steps:
@@ -964,7 +964,7 @@ jobs:
       - update-latest-json
       - verify-android-release-artifacts
       - verify-proxy-release-artifacts
-    runs-on: macos-26
+    runs-on: xcode-27
     permissions:
       contents: read
     steps:
diff --git a/apps/maple-agent/Cargo.toml b/apps/maple-agent/Cargo.toml
index 6da94889d..8432cc8bc 100644
--- a/apps/maple-agent/Cargo.toml
+++ b/apps/maple-agent/Cargo.toml
@@ -35,6 +35,18 @@ lto = "fat"
 codegen-units = 1
 strip = true
 
+# Cargo strips build scripts and proc-macros whenever their profile has no debug info
+# (release, and dev under CI's CARGO_PROFILE_DEV_DEBUG=0), using rustc's rust-objcopy,
+# which can leave a dylib's LINKEDIT string table 4-byte aligned. macOS 27 refuses to
+# load such dylibs when they are linked against its SDK, and every build loads its
+# proc-macros as dylibs. They never ship, so leave them unstripped. Remove once the
+# pinned Rust's rust-objcopy includes llvm/llvm-project#203680.
+[profile.dev.build-override]
+strip = false
+
+[profile.release.build-override]
+strip = false
+
 # The embedded proxy requires `maple-sdk` from the registry; resolve it to the same
 # in-tree source as the workspace dependency above (docs/sdk-publishing.md).
 [patch.crates-io]
diff --git a/apps/maple-agent/flake.nix b/apps/maple-agent/flake.nix
index ac7a6df80..e0ac4c226 100644
--- a/apps/maple-agent/flake.nix
+++ b/apps/maple-agent/flake.nix
@@ -310,6 +310,11 @@
               # nixpkgs' generic clang wrapper cannot infer that SDK boundary.
               export CC="$(/usr/bin/xcrun --find clang)"
               export CXX="$(/usr/bin/xcrun --find clang++)"
+              # Rust links through `cc`, which is nixpkgs' clang wrapper and its
+              # older ld64. That ld64 cannot read the macOS 27 SDK's .tbd stubs
+              # (they list the arm64e.x1 architecture), so link with Xcode too.
+              export CARGO_TARGET_AARCH64_APPLE_DARWIN_LINKER="$CC"
+              export CARGO_TARGET_X86_64_APPLE_DARWIN_LINKER="$CC"
               export PATH="${xcrun}/bin:$PATH"
 
               unset maple_nix_developer_dir maple_nix_selected_developer_dir
diff --git a/apps/maple-research/frontend/src-tauri/Cargo.toml b/apps/maple-research/frontend/src-tauri/Cargo.toml
index 4770e167c..4ced1b877 100644
--- a/apps/maple-research/frontend/src-tauri/Cargo.toml
+++ b/apps/maple-research/frontend/src-tauri/Cargo.toml
@@ -118,3 +118,15 @@ tao = { path = "patches/tao-0.37.1" }
 # to link (Tauri 2.12.3 made its own public: tauri-apps/tauri#16130); the
 # vendored copy only adds that keyword. Remove once upstream publishes the fix.
 tauri-plugin-sign-in-with-apple = { path = "patches/tauri-plugin-sign-in-with-apple-1.0.2" }
+
+# Cargo strips build scripts and proc-macros whenever their profile has no debug info
+# (release, and dev under CI's CARGO_PROFILE_DEV_DEBUG=0), using rustc's rust-objcopy,
+# which can leave a dylib's LINKEDIT string table 4-byte aligned. macOS 27 refuses to
+# load such dylibs when they are linked against its SDK, and every build loads its
+# proc-macros as dylibs. They never ship, so leave them unstripped. Remove once the
+# pinned Rust's rust-objcopy includes llvm/llvm-project#203680.
+[profile.dev.build-override]
+strip = false
+
+[profile.release.build-override]
+strip = false
diff --git a/apps/maple-research/frontend/src-tauri/gen/apple/maple.xcodeproj/project.pbxproj.backup b/apps/maple-research/frontend/src-tauri/gen/apple/maple.xcodeproj/project.pbxproj.backup
deleted file mode 100644
index 41a99a896..000000000
--- a/apps/maple-research/frontend/src-tauri/gen/apple/maple.xcodeproj/project.pbxproj.backup
+++ /dev/null
@@ -1,626 +0,0 @@
-// !$*UTF8*$!
-{
-	archiveVersion = 1;
-	classes = {
-	};
-	objectVersion = 56;
-	objects = {
-
-/* Begin PBXBuildFile section */
-		0F4AA8C5111094B8D7B033A4 /* WebKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = E996CAD20B045EF299247BEF /* WebKit.framework */; };
-		23D760C25DBAAA96DF52F98C /* MetalKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = AAFD3E024B29F57EA0D88AB5 /* MetalKit.framework */; };
-		27222ACBBD95CA356BDB87AB /* QuartzCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BAF092EB33F2B4FDF867E2ED /* QuartzCore.framework */; };
-		46728F6CD07C626A781543FF /* Security.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 938F41BA03AF7FAB80585A60 /* Security.framework */; };
-		4E14944735CA89389849E430 /* libapp.a in Frameworks */ = {isa = PBXBuildFile; fileRef = F27A6FC4AB3E06D481B1E137 /* libapp.a */; };
-		621A96F6B965E600E714FB6C /* LaunchScreen.storyboard in Resources */ = {isa = PBXBuildFile; fileRef = B0EAFEFF59AA7CFEF57FA63C /* LaunchScreen.storyboard */; };
-		8F9EDB5679AB5E12D6F1E071 /* UIKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = DACD0B6B9FB86AFF47366EB2 /* UIKit.framework */; };
-		90DEA2E2EC5F95784C9D8B00 /* CoreGraphics.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 898D6E7ABC92C3B9A7970DAE /* CoreGraphics.framework */; };
-		9F3ED7EA97AFC22E0B4A6EAF /* main.mm in Sources */ = {isa = PBXBuildFile; fileRef = CE20E8A9C4CF149CA9CA485A /* main.mm */; };
-		A120CF155DE2B343CEFFB77C /* Assets.xcassets in Resources */ = {isa = PBXBuildFile; fileRef = 6BF4C7EB12DBD2E253B2741E /* Assets.xcassets */; };
-		B79EC8A2A1A869B9F38906ED /* assets in Resources */ = {isa = PBXBuildFile; fileRef = AF5DA3546C7B12BA141E9508 /* assets */; };
-		FB98D58EAB479A32F7CA66CA /* Metal.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = C072EB8E1CCC1094712EA7F7 /* Metal.framework */; };
-/* End PBXBuildFile section */
-
-/* Begin PBXFileReference section */
-		1094B8CB671809878F533CEC /* lib.rs */ = {isa = PBXFileReference; lastKnownFileType = text; path = lib.rs; sourceTree = "<group>"; };
-		19C98BDFCAE8C0B2FE05F13B /* maple_iOS.entitlements */ = {isa = PBXFileReference; lastKnownFileType = text.plist.entitlements; path = maple_iOS.entitlements; sourceTree = "<group>"; };
-		1DB07799A17353B2E32B65D3 /* Maple.app */ = {isa = PBXFileReference; explicitFileType = wrapper.application; includeInIndex = 0; path = Maple.app; sourceTree = BUILT_PRODUCTS_DIR; };
-		6BF4C7EB12DBD2E253B2741E /* Assets.xcassets */ = {isa = PBXFileReference; lastKnownFileType = folder.assetcatalog; path = Assets.xcassets; sourceTree = "<group>"; };
-		7BBAB8D5C4E3D05A4F48B6EA /* bindings.h */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; path = bindings.h; sourceTree = "<group>"; };
-		898D6E7ABC92C3B9A7970DAE /* CoreGraphics.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CoreGraphics.framework; path = System/Library/Frameworks/CoreGraphics.framework; sourceTree = SDKROOT; };
-		938F41BA03AF7FAB80585A60 /* Security.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Security.framework; path = System/Library/Frameworks/Security.framework; sourceTree = SDKROOT; };
-		AAFD3E024B29F57EA0D88AB5 /* MetalKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = MetalKit.framework; path = System/Library/Frameworks/MetalKit.framework; sourceTree = SDKROOT; };
-		AF5DA3546C7B12BA141E9508 /* assets */ = {isa = PBXFileReference; lastKnownFileType = folder; path = assets; sourceTree = SOURCE_ROOT; };
-		B0EAFEFF59AA7CFEF57FA63C /* LaunchScreen.storyboard */ = {isa = PBXFileReference; lastKnownFileType = file.storyboard; path = LaunchScreen.storyboard; sourceTree = "<group>"; };
-		BAF092EB33F2B4FDF867E2ED /* QuartzCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = QuartzCore.framework; path = System/Library/Frameworks/QuartzCore.framework; sourceTree = SDKROOT; };
-		C072EB8E1CCC1094712EA7F7 /* Metal.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Metal.framework; path = System/Library/Frameworks/Metal.framework; sourceTree = SDKROOT; };
-		C0A332F21EB65CD4B83229DF /* main.rs */ = {isa = PBXFileReference; lastKnownFileType = text; path = main.rs; sourceTree = "<group>"; };
-		CE20E8A9C4CF149CA9CA485A /* main.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = main.mm; sourceTree = "<group>"; };
-		D6F6085362AF0C062EDB5810 /* Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist; path = Info.plist; sourceTree = "<group>"; };
-		DACD0B6B9FB86AFF47366EB2 /* UIKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = UIKit.framework; path = System/Library/Frameworks/UIKit.framework; sourceTree = SDKROOT; };
-		E996CAD20B045EF299247BEF /* WebKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = WebKit.framework; path = System/Library/Frameworks/WebKit.framework; sourceTree = SDKROOT; };
-		F27A6FC4AB3E06D481B1E137 /* libapp.a */ = {isa = PBXFileReference; lastKnownFileType = archive.ar; path = libapp.a; sourceTree = "<group>"; };
-/* End PBXFileReference section */
-
-/* Begin PBXFrameworksBuildPhase section */
-		04F3BEBB04BD927FDC86B255 /* Frameworks */ = {
-			isa = PBXFrameworksBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				4E14944735CA89389849E430 /* libapp.a in Frameworks */,
-				90DEA2E2EC5F95784C9D8B00 /* CoreGraphics.framework in Frameworks */,
-				FB98D58EAB479A32F7CA66CA /* Metal.framework in Frameworks */,
-				23D760C25DBAAA96DF52F98C /* MetalKit.framework in Frameworks */,
-				27222ACBBD95CA356BDB87AB /* QuartzCore.framework in Frameworks */,
-				46728F6CD07C626A781543FF /* Security.framework in Frameworks */,
-				8F9EDB5679AB5E12D6F1E071 /* UIKit.framework in Frameworks */,
-				0F4AA8C5111094B8D7B033A4 /* WebKit.framework in Frameworks */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXFrameworksBuildPhase section */
-
-/* Begin PBXGroup section */
-		31943D18956B6AFD5A82AB02 /* maple_iOS */ = {
-			isa = PBXGroup;
-			children = (
-				D6F6085362AF0C062EDB5810 /* Info.plist */,
-				19C98BDFCAE8C0B2FE05F13B /* maple_iOS.entitlements */,
-			);
-			path = maple_iOS;
-			sourceTree = "<group>";
-		};
-		6AE8986BFC081ADF4EF98889 /* Externals */ = {
-			isa = PBXGroup;
-			children = (
-			);
-			path = Externals;
-			sourceTree = "<group>";
-		};
-		A278899D6905367F60E00F01 /* Sources */ = {
-			isa = PBXGroup;
-			children = (
-				E5992A2C52DE443515252068 /* maple */,
-			);
-			path = Sources;
-			sourceTree = "<group>";
-		};
-		B58B2AB62FA5D8F41C3A031C /* Frameworks */ = {
-			isa = PBXGroup;
-			children = (
-				898D6E7ABC92C3B9A7970DAE /* CoreGraphics.framework */,
-				F27A6FC4AB3E06D481B1E137 /* libapp.a */,
-				C072EB8E1CCC1094712EA7F7 /* Metal.framework */,
-				AAFD3E024B29F57EA0D88AB5 /* MetalKit.framework */,
-				BAF092EB33F2B4FDF867E2ED /* QuartzCore.framework */,
-				938F41BA03AF7FAB80585A60 /* Security.framework */,
-				DACD0B6B9FB86AFF47366EB2 /* UIKit.framework */,
-				E996CAD20B045EF299247BEF /* WebKit.framework */,
-			);
-			name = Frameworks;
-			sourceTree = "<group>";
-		};
-		C312B5C9A1506139452E194B /* Products */ = {
-			isa = PBXGroup;
-			children = (
-				1DB07799A17353B2E32B65D3 /* Maple.app */,
-			);
-			name = Products;
-			sourceTree = "<group>";
-		};
-		D3140E092D76240F6A157CCE = {
-			isa = PBXGroup;
-			children = (
-				AF5DA3546C7B12BA141E9508 /* assets */,
-				6BF4C7EB12DBD2E253B2741E /* Assets.xcassets */,
-				B0EAFEFF59AA7CFEF57FA63C /* LaunchScreen.storyboard */,
-				6AE8986BFC081ADF4EF98889 /* Externals */,
-				31943D18956B6AFD5A82AB02 /* maple_iOS */,
-				A278899D6905367F60E00F01 /* Sources */,
-				FF31B258F4FE6CC5B57B4FB8 /* src */,
-				B58B2AB62FA5D8F41C3A031C /* Frameworks */,
-				C312B5C9A1506139452E194B /* Products */,
-			);
-			sourceTree = "<group>";
-		};
-		E5992A2C52DE443515252068 /* maple */ = {
-			isa = PBXGroup;
-			children = (
-				CE20E8A9C4CF149CA9CA485A /* main.mm */,
-				F9E1B0C7AF484C8F6312F2C8 /* bindings */,
-			);
-			path = maple;
-			sourceTree = "<group>";
-		};
-		F9E1B0C7AF484C8F6312F2C8 /* bindings */ = {
-			isa = PBXGroup;
-			children = (
-				7BBAB8D5C4E3D05A4F48B6EA /* bindings.h */,
-			);
-			path = bindings;
-			sourceTree = "<group>";
-		};
-		FF31B258F4FE6CC5B57B4FB8 /* src */ = {
-			isa = PBXGroup;
-			children = (
-				1094B8CB671809878F533CEC /* lib.rs */,
-				C0A332F21EB65CD4B83229DF /* main.rs */,
-			);
-			name = src;
-			path = ../../src;
-			sourceTree = "<group>";
-		};
-/* End PBXGroup section */
-
-/* Begin PBXNativeTarget section */
-		745812EBA5246F9E4CEE1574 /* maple_iOS */ = {
-			isa = PBXNativeTarget;
-			buildConfigurationList = 27939507295816FC37580B40 /* Build configuration list for PBXNativeTarget "maple_iOS" */;
-			buildPhases = (
-				88FF8D973FB9516A2A98CD39 /* Build Rust Code */,
-				6D9F08407F22BE108C77276C /* Sources */,
-				25104604B2C2A81B04543E68 /* Resources */,
-				04F3BEBB04BD927FDC86B255 /* Frameworks */,
-			);
-			buildRules = (
-			);
-			dependencies = (
-			);
-			name = maple_iOS;
-			productName = maple_iOS;
-			productReference = 1DB07799A17353B2E32B65D3 /* Maple.app */;
-			productType = "com.apple.product-type.application";
-		};
-/* End PBXNativeTarget section */
-
-/* Begin PBXProject section */
-		EAA0B11A781B9CD753D1399F /* Project object */ = {
-			isa = PBXProject;
-			attributes = {
-				BuildIndependentTargetsInParallel = YES;
-				LastUpgradeCheck = 1430;
-			};
-			buildConfigurationList = 2FA6FD4DEFE659C96AAB5E5D /* Build configuration list for PBXProject "maple" */;
-			compatibilityVersion = "Xcode 14.0";
-			developmentRegion = en;
-			hasScannedForEncodings = 0;
-			knownRegions = (
-				Base,
-				en,
-			);
-			mainGroup = D3140E092D76240F6A157CCE;
-			projectDirPath = "";
-			projectRoot = "";
-			targets = (
-				745812EBA5246F9E4CEE1574 /* maple_iOS */,
-			);
-		};
-/* End PBXProject section */
-
-/* Begin PBXResourcesBuildPhase section */
-		25104604B2C2A81B04543E68 /* Resources */ = {
-			isa = PBXResourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				A120CF155DE2B343CEFFB77C /* Assets.xcassets in Resources */,
-				621A96F6B965E600E714FB6C /* LaunchScreen.storyboard in Resources */,
-				B79EC8A2A1A869B9F38906ED /* assets in Resources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXResourcesBuildPhase section */
-
-/* Begin PBXShellScriptBuildPhase section */
-		88FF8D973FB9516A2A98CD39 /* Build Rust Code */ = {
-			isa = PBXShellScriptBuildPhase;
-			alwaysOutOfDate = 1;
-			buildActionMask = 2147483647;
-			files = (
-			);
-			inputFileListPaths = (
-			);
-			inputPaths = (
-			);
-			name = "Build Rust Code";
-			outputFileListPaths = (
-			);
-			outputPaths = (
-				"$(SRCROOT)/Externals/x86_64/${CONFIGURATION}/libapp.a",
-				"$(SRCROOT)/Externals/arm64/${CONFIGURATION}/libapp.a",
-				"$(SRCROOT)/Externals/arm64-sim/${CONFIGURATION}/libapp.a",
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-			shellPath = /bin/sh;
-			shellScript = "bun tauri ios xcode-script -v --platform ${PLATFORM_DISPLAY_NAME:?} --sdk-root ${SDKROOT:?} --framework-search-paths \"${FRAMEWORK_SEARCH_PATHS:?}\" --header-search-paths \"${HEADER_SEARCH_PATHS:?}\" --gcc-preprocessor-definitions \"${GCC_PREPROCESSOR_DEFINITIONS:-}\" --configuration ${CONFIGURATION:?} ${FORCE_COLOR} ${ARCHS:?}";
-		};
-/* End PBXShellScriptBuildPhase section */
-
-/* Begin PBXSourcesBuildPhase section */
-		6D9F08407F22BE108C77276C /* Sources */ = {
-			isa = PBXSourcesBuildPhase;
-			buildActionMask = 2147483647;
-			files = (
-				9F3ED7EA97AFC22E0B4A6EAF /* main.mm in Sources */,
-			);
-			runOnlyForDeploymentPostprocessing = 0;
-		};
-/* End PBXSourcesBuildPhase section */
-
-/* Begin XCBuildConfiguration section */
-		1DE1BEC252AAEF735A07CA8B /* debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
-				ARCHS = (
-					arm64,
-					"arm64-sim",
-				);
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_ENTITLEMENTS = maple_iOS/maple_iOS.entitlements;
-				CODE_SIGN_IDENTITY = "Apple Development";
-				CODE_SIGN_STYLE = Automatic;
-				DEVELOPMENT_TEAM = "X773Y823TN";
-				ENABLE_BITCODE = NO;
-				"EXCLUDED_ARCHS[sdk=iphoneos*]" = "arm64-sim x86_64";
-				"EXCLUDED_ARCHS[sdk=iphonesimulator*]" = arm64;
-				FRAMEWORK_SEARCH_PATHS = (
-					"$(inherited)",
-					"\".\"",
-				);
-				INFOPLIST_FILE = maple_iOS/Info.plist;
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/Frameworks",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64-sim]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64-sim/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=x86_64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/x86_64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				PRODUCT_BUNDLE_IDENTIFIER = cloud.opensecret.maple;
-				PRODUCT_NAME = Maple;
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SDKROOT = iphoneos;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				VALID_ARCHS = "arm64  arm64-sim";
-			};
-			name = debug;
-		};
-		1E8FE8E2E3063C3FDCD3B5D1 /* debug */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_TESTABILITY = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_DYNAMIC_NO_PIC = NO;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"$(inherited)",
-					"DEBUG=1",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 13.0;
-				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
-				MTL_FAST_MATH = YES;
-				ONLY_ACTIVE_ARCH = YES;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SDKROOT = iphoneos;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
-				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-				SWIFT_VERSION = 5.0;
-			};
-			name = debug;
-		};
-		94ECC2E044AA76E166E0866E /* release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = "dwarf-with-dsym";
-				ENABLE_NS_ASSERTIONS = NO;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 13.0;
-				MTL_ENABLE_DEBUG_INFO = NO;
-				MTL_FAST_MATH = YES;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SDKROOT = iphoneos;
-				SWIFT_COMPILATION_MODE = wholemodule;
-				SWIFT_OPTIMIZATION_LEVEL = "-O";
-				SWIFT_VERSION = 5.0;
-			};
-			name = release;
-		};
-		B90C9BEF4885680BFA986CD2 /* release */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
-				ARCHS = (
-					arm64,
-					"arm64-sim",
-				);
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_ENTITLEMENTS = maple_iOS/maple_iOS.entitlements;
-				CODE_SIGN_IDENTITY = "Apple Development";
-				CODE_SIGN_STYLE = Automatic;
-				DEVELOPMENT_TEAM = "X773Y823TN";
-				ENABLE_BITCODE = NO;
-				"EXCLUDED_ARCHS[sdk=iphoneos*]" = "arm64-sim x86_64";
-				"EXCLUDED_ARCHS[sdk=iphonesimulator*]" = arm64;
-				FRAMEWORK_SEARCH_PATHS = (
-					"$(inherited)",
-					"\".\"",
-				);
-				INFOPLIST_FILE = maple_iOS/Info.plist;
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/Frameworks",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64-sim]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64-sim/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=x86_64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/x86_64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				PRODUCT_BUNDLE_IDENTIFIER = cloud.opensecret.maple;
-				PRODUCT_NAME = Maple;
-				PROVISIONING_PROFILE_SPECIFIER = "";
-				SDKROOT = iphoneos;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				VALID_ARCHS = "arm64  arm64-sim";
-			};
-			name = release;
-		};
-		EA2669D02DADAA11005A7F4B /* local */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_SEARCH_USER_PATHS = NO;
-				CLANG_ANALYZER_NONNULL = YES;
-				CLANG_ANALYZER_NUMBER_OBJECT_CONVERSION = YES_AGGRESSIVE;
-				CLANG_CXX_LANGUAGE_STANDARD = "gnu++14";
-				CLANG_CXX_LIBRARY = "libc++";
-				CLANG_ENABLE_MODULES = YES;
-				CLANG_ENABLE_OBJC_ARC = YES;
-				CLANG_ENABLE_OBJC_WEAK = YES;
-				CLANG_WARN_BLOCK_CAPTURE_AUTORELEASING = YES;
-				CLANG_WARN_BOOL_CONVERSION = YES;
-				CLANG_WARN_COMMA = YES;
-				CLANG_WARN_CONSTANT_CONVERSION = YES;
-				CLANG_WARN_DEPRECATED_OBJC_IMPLEMENTATIONS = YES;
-				CLANG_WARN_DIRECT_OBJC_ISA_USAGE = YES_ERROR;
-				CLANG_WARN_DOCUMENTATION_COMMENTS = YES;
-				CLANG_WARN_EMPTY_BODY = YES;
-				CLANG_WARN_ENUM_CONVERSION = YES;
-				CLANG_WARN_INFINITE_RECURSION = YES;
-				CLANG_WARN_INT_CONVERSION = YES;
-				CLANG_WARN_NON_LITERAL_NULL_CONVERSION = YES;
-				CLANG_WARN_OBJC_IMPLICIT_RETAIN_SELF = YES;
-				CLANG_WARN_OBJC_LITERAL_CONVERSION = YES;
-				CLANG_WARN_OBJC_ROOT_CLASS = YES_ERROR;
-				CLANG_WARN_QUOTED_INCLUDE_IN_FRAMEWORK_HEADER = YES;
-				CLANG_WARN_RANGE_LOOP_ANALYSIS = YES;
-				CLANG_WARN_STRICT_PROTOTYPES = YES;
-				CLANG_WARN_SUSPICIOUS_MOVE = YES;
-				CLANG_WARN_UNGUARDED_AVAILABILITY = YES_AGGRESSIVE;
-				CLANG_WARN_UNREACHABLE_CODE = YES;
-				CLANG_WARN__DUPLICATE_METHOD_MATCH = YES;
-				COPY_PHASE_STRIP = NO;
-				DEBUG_INFORMATION_FORMAT = dwarf;
-				ENABLE_STRICT_OBJC_MSGSEND = YES;
-				ENABLE_TESTABILITY = YES;
-				GCC_C_LANGUAGE_STANDARD = gnu11;
-				GCC_DYNAMIC_NO_PIC = NO;
-				GCC_NO_COMMON_BLOCKS = YES;
-				GCC_OPTIMIZATION_LEVEL = 0;
-				GCC_PREPROCESSOR_DEFINITIONS = (
-					"$(inherited)",
-					"DEBUG=1",
-				);
-				GCC_WARN_64_TO_32_BIT_CONVERSION = YES;
-				GCC_WARN_ABOUT_RETURN_TYPE = YES_ERROR;
-				GCC_WARN_UNDECLARED_SELECTOR = YES;
-				GCC_WARN_UNINITIALIZED_AUTOS = YES_AGGRESSIVE;
-				GCC_WARN_UNUSED_FUNCTION = YES;
-				GCC_WARN_UNUSED_VARIABLE = YES;
-				IPHONEOS_DEPLOYMENT_TARGET = 13.0;
-				MTL_ENABLE_DEBUG_INFO = INCLUDE_SOURCE;
-				MTL_FAST_MATH = YES;
-				ONLY_ACTIVE_ARCH = YES;
-				PRODUCT_NAME = "$(TARGET_NAME)";
-				SDKROOT = iphoneos;
-				SWIFT_ACTIVE_COMPILATION_CONDITIONS = DEBUG;
-				SWIFT_OPTIMIZATION_LEVEL = "-Onone";
-				SWIFT_VERSION = 5.0;
-			};
-			name = local;
-		};
-		EA2669D12DADAA11005A7F4B /* local */ = {
-			isa = XCBuildConfiguration;
-			buildSettings = {
-				ALWAYS_EMBED_SWIFT_STANDARD_LIBRARIES = YES;
-				ARCHS = (
-					arm64,
-					"arm64-sim",
-				);
-				ASSETCATALOG_COMPILER_APPICON_NAME = AppIcon;
-				CODE_SIGN_ENTITLEMENTS = maple_iOS/maple_iOS.entitlements;
-				CODE_SIGN_IDENTITY = "Apple Development";
-				"CODE_SIGN_IDENTITY[sdk=iphoneos*]" = "iPhone Developer";
-				CODE_SIGN_STYLE = Manual;
-				DEVELOPMENT_TEAM = "X773Y823TN";
-				"DEVELOPMENT_TEAM[sdk=iphoneos*]" = X773Y823TN;
-				ENABLE_BITCODE = NO;
-				"EXCLUDED_ARCHS[sdk=iphoneos*]" = "arm64-sim x86_64";
-				"EXCLUDED_ARCHS[sdk=iphonesimulator*]" = arm64;
-				FRAMEWORK_SEARCH_PATHS = (
-					"$(inherited)",
-					"\".\"",
-				);
-				INFOPLIST_FILE = maple_iOS/Info.plist;
-				LD_RUNPATH_SEARCH_PATHS = (
-					"$(inherited)",
-					"@executable_path/Frameworks",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64-sim]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64-sim/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=arm64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/arm64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				"LIBRARY_SEARCH_PATHS[arch=x86_64]" = (
-					"$(inherited)",
-					"$(PROJECT_DIR)/Externals/x86_64/$(CONFIGURATION)",
-					"$(SDKROOT)/usr/lib/swift",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift/$(PLATFORM_NAME)",
-					"$(TOOLCHAIN_DIR)/usr/lib/swift-5.0/$(PLATFORM_NAME)",
-				);
-				PRODUCT_BUNDLE_IDENTIFIER = cloud.opensecret.maple;
-				PRODUCT_NAME = Maple;
-				PROVISIONING_PROFILE_SPECIFIER = "86059ea7-ae8e-44af-8a58-b2ab7c78d299";
-				"PROVISIONING_PROFILE_SPECIFIER[sdk=iphoneos*]" = "86059ea7-ae8e-44af-8a58-b2ab7c78d299";
-				SDKROOT = iphoneos;
-				TARGETED_DEVICE_FAMILY = "1,2";
-				VALID_ARCHS = "arm64  arm64-sim";
-			};
-			name = local;
-		};
-/* End XCBuildConfiguration section */
-
-/* Begin XCConfigurationList section */
-		27939507295816FC37580B40 /* Build configuration list for PBXNativeTarget "maple_iOS" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				1DE1BEC252AAEF735A07CA8B /* debug */,
-				EA2669D12DADAA11005A7F4B /* local */,
-				B90C9BEF4885680BFA986CD2 /* release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = debug;
-		};
-		2FA6FD4DEFE659C96AAB5E5D /* Build configuration list for PBXProject "maple" */ = {
-			isa = XCConfigurationList;
-			buildConfigurations = (
-				1E8FE8E2E3063C3FDCD3B5D1 /* debug */,
-				EA2669D02DADAA11005A7F4B /* local */,
-				94ECC2E044AA76E166E0866E /* release */,
-			);
-			defaultConfigurationIsVisible = 0;
-			defaultConfigurationName = debug;
-		};
-/* End XCConfigurationList section */
-	};
-	rootObject = EAA0B11A781B9CD753D1399F /* Project object */;
-}
diff --git a/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh b/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh
index 21b6e43c8..0baf7fc9d 100755
--- a/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh
+++ b/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime-all.sh
@@ -23,7 +23,7 @@ BUILD_DIR="${TAURI_DIR}/onnxruntime-build"
 OUTPUT_DIR="${TAURI_DIR}/onnxruntime-ios"
 XCFRAMEWORK_DIR="${OUTPUT_DIR}/onnxruntime.xcframework"
 
-IOS_DEPLOYMENT_TARGET="13.0"
+IOS_DEPLOYMENT_TARGET="16.0"
 
 echo "========================================"
 echo "Building ONNX Runtime ${ORT_VERSION} for iOS"
diff --git a/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime.sh b/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime.sh
index de3e38d0e..649e1df11 100755
--- a/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime.sh
+++ b/apps/maple-research/frontend/src-tauri/scripts/build-ios-onnxruntime.sh
@@ -24,7 +24,7 @@ OUTPUT_DIR="${TAURI_DIR}/onnxruntime-ios"
 XCFRAMEWORK_DIR="${OUTPUT_DIR}/onnxruntime.xcframework"
 
 # Minimum iOS version to support
-IOS_DEPLOYMENT_TARGET="13.0"
+IOS_DEPLOYMENT_TARGET="16.0"
 
 echo "========================================"
 echo "Building ONNX Runtime ${ORT_VERSION} for iOS"
diff --git a/apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh b/apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh
index 51cb644df..ce6b55e44 100644
--- a/apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh
+++ b/apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh
@@ -165,11 +165,11 @@ onnxruntime_ios_commit_for_version() {
 }
 
 onnxruntime_ios_device_lib_sha256_for_version() {
-  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-17F42}}"
+  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-27A9275}}"
 
   case "$1:${xcode_build}" in
-    1.23.2:17F42)
-      printf '%s\n' "917cf5f30aa65f435371e323e347e094c99804fd6a268d3ae946cd8e5e58945f"
+    1.23.2:27A9275)
+      printf '%s\n' "e4d288188f0b520d6676e87ad4a694326a8844618f471b5c8cfcdb69daf66657"
       ;;
     *)
       echo "No pinned ONNX Runtime iOS device library SHA-256 for version '$1' and Xcode build '${xcode_build}'." >&2
@@ -179,11 +179,11 @@ onnxruntime_ios_device_lib_sha256_for_version() {
 }
 
 onnxruntime_ios_simulator_lib_sha256_for_version() {
-  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-17F42}}"
+  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-27A9275}}"
 
   case "$1:${xcode_build}" in
-    1.23.2:17F42)
-      printf '%s\n' "87c87225026db5ee2b5a1293468b9cc3410ad22eac182899056a05f2f2862071"
+    1.23.2:27A9275)
+      printf '%s\n' "0b670a0fce021844551d7bd9fc0c3c4275208375155e0c17254866215ae28736"
       ;;
     *)
       echo "No pinned ONNX Runtime iOS simulator library SHA-256 for version '$1' and Xcode build '${xcode_build}'." >&2
@@ -193,11 +193,11 @@ onnxruntime_ios_simulator_lib_sha256_for_version() {
 }
 
 onnxruntime_ios_xcframework_sha256_for_version() {
-  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-17F42}}"
+  local xcode_build="${2:-${MAPLE_XCODE_BUILD_VERSION:-27A9275}}"
 
   case "$1:${xcode_build}" in
-    1.23.2:17F42)
-      printf '%s\n' "86871fe82fb5b043540d5bbc67de5ba73f2a52105ec05c66e835b7add8972af5"
+    1.23.2:27A9275)
+      printf '%s\n' "93cbb699abebba06963ccf1b5c283ea0bbf7b8e9e4664f9b2df726d2808bf18a"
       ;;
     *)
       echo "No pinned ONNX Runtime iOS xcframework SHA-256 for version '$1' and Xcode build '${xcode_build}'." >&2
diff --git a/apps/maple-research/frontend/src-tauri/tests/storekit/README.md b/apps/maple-research/frontend/src-tauri/tests/storekit/README.md
index 96943c890..e570b3064 100644
--- a/apps/maple-research/frontend/src-tauri/tests/storekit/README.md
+++ b/apps/maple-research/frontend/src-tauri/tests/storekit/README.md
@@ -26,8 +26,9 @@ re-signs/verifies them, and generates the local experiment scheme. Source plist
 and entitlements are restored. Preserve the existing frozen artifact when
 comparing toolchains; rebuilding Maple is a separate action.
 
-These test commands explicitly select installed Xcode 26.6 **after entering** the
-pinned Apple shell, without changing repository pins or global Xcode selection.
+These test commands use the Xcode selected by the pinned Apple shell
+(`scripts/ci/apple-toolchain.json`). The dated notes below record earlier runs on
+Xcode 26.5 and 26.6.
 Use `run.sh`, which prepares native linker variables; do not invoke `run.py`
 directly from an unprepared Nix shell. Substitute the exact frozen app path and
 intended simulator UDID when different from these examples.
@@ -35,9 +36,7 @@ intended simulator UDID when different from these examples.
 First build the small runner and run the catalog canary, which needs no fixture:
 
 ```sh
-nix develop --no-update-lock-file .#apple -c env \
-  MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-  DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+nix develop --no-update-lock-file .#apple -c \
   bash scripts/testing/storekit/run.sh \
   --app apps/maple-research/frontend/src-tauri/gen/apple/build/arm64-sim/Maple.app \
   --udid "<YOUR_BOOTED_SIMULATOR_UDID>" \
@@ -47,9 +46,7 @@ nix develop --no-update-lock-file .#apple -c env \
 Then run the certificate canary with a fresh runner-owned bootstrap fixture:
 
 ```sh
-nix develop --no-update-lock-file .#apple -c env \
-  MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-  DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+nix develop --no-update-lock-file .#apple -c \
   bash scripts/testing/storekit/run.sh --skip-build --fixture-bootstrap \
   --app apps/maple-research/frontend/src-tauri/gen/apple/build/arm64-sim/Maple.app \
   --udid "<YOUR_BOOTED_SIMULATOR_UDID>" \
@@ -69,9 +66,7 @@ Pass that certificate to the remaining cases. They reuse the runner build but
 each gets a separate XCTest invocation, fixture process and journal:
 
 ```sh
-nix develop --no-update-lock-file .#apple -c env \
-  MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-  DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+nix develop --no-update-lock-file .#apple -c \
   bash scripts/testing/storekit/run.sh --skip-build \
   --fixture-certificate /absolute/path/to/MapleStoreKitSigningCertificate.cer \
   --app apps/maple-research/frontend/src-tauri/gen/apple/build/arm64-sim/Maple.app \
@@ -175,9 +170,7 @@ To export metadata from an already running purchased diagnostic screen without
 reinstalling or restarting Maple, pass the exact GUI-built DerivedData app:
 
 ```sh
-nix develop --no-update-lock-file .#apple -c env \
-  MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-  DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+nix develop --no-update-lock-file .#apple -c \
   bash scripts/testing/storekit/run.sh --app /absolute/path/to/Maple.app \
   --udid "<YOUR_BOOTED_SIMULATOR_UDID>" \
   --only MapleStoreKitCaptureUITests/testExportPublicSigningCertificate
@@ -202,7 +195,7 @@ The exact Foundation-only parser can also be checked on the host, without
 building an app or operating a simulator:
 
 ```sh
-DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+DEVELOPER_DIR=/Applications/Xcode_27.1.app/Contents/Developer \
   python3 scripts/testing/storekit/check-snapshot-parser.py
 ```
 
diff --git a/docs/ci.md b/docs/ci.md
index 1eba71e17..ed1c2d8d2 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -94,7 +94,8 @@ later push runs the labelled lanes again until the label is removed.
 `just lane <id>` (the same as `python3 scripts/ci/plan.py run <id>`) runs the
 lane's command in its pinned Nix shell, exactly as `ci.yml` does. macOS lanes
 need macOS and use its selected Xcode (CI pins it with
-`scripts/ci/select-xcode.py`), Windows lanes need Windows with the toolchain
+`scripts/ci/select-xcode.py`; only the packaging rehearsal also needs its Metal
+Toolchain), Windows lanes need Windows with the toolchain
 from `.github/actions/setup-agent-windows`, `os-sdk-e2e` needs PostgreSQL on
 `127.0.0.1:5432` with the credentials in `scripts/ci/opensecret-sdk-e2e.sh`,
 `os-helpers` needs Docker that builds `linux/arm64`, and `os-eif` needs Linux
@@ -169,8 +170,9 @@ org's 16-core GitHub runner are billed by the minute.
 
 | Runner | Lanes | Why |
 | --- | --- | --- |
-| `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-6vcpu-macos-26`, `blacksmith-8vcpu-windows-2025` | Most compiling lanes, for example Research Rust, OpenSecret Rust, every macOS lane and the Agent's Windows Clippy | Fast, with warm caches in Blacksmith's store |
+| `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-6vcpu-macos-27`, `blacksmith-8vcpu-windows-2025` | Most compiling lanes, for example Research Rust, OpenSecret Rust, every macOS lane and the Agent's Windows Clippy | Fast, with warm caches in Blacksmith's store |
 | `blacksmith-32vcpu-ubuntu-2404` | `agent-lint`, `agent-test` | The heaviest cold builds |
+| `xcode-27` | `metal-toolchain` | GitHub's Xcode 27 image ships Xcode's Metal Toolchain, which Blacksmith's macOS image lacks and cannot download; it exports it for the macOS packaging rehearsal, the only lane that compiles gpui's shaders. The Agent's other macOS lanes build with runtime shaders |
 | `ubuntu-latest`, `ubuntu-24.04-arm` | Lighter lanes, for example `repo`, SDK, proxy, Research web, services, `deps-*` and `os-pcr` | Free, and fast enough without Blacksmith |
 | `windows-2025` | `agent-windows-updater`, `agent-full-windows` | Blacksmith's Windows workspace inherits a foreign write ACE that the updater's storage validation rejects, and the reparse tests need the symlink privilege GitHub's runner grants |
 | `maple-windows-2025-16core` | `agent-package-windows` (its install smoke needs GitHub's image), `research-desktop-windows` (for speed) | Same image and cache store as `windows-2025`, with more cores |
diff --git a/docs/repository-workflows.md b/docs/repository-workflows.md
index 8eec5ddde..750582ccb 100644
--- a/docs/repository-workflows.md
+++ b/docs/repository-workflows.md
@@ -247,7 +247,7 @@ release workflows use:
 
 | Work | Runner |
 | --- | --- |
-| Research macOS, Linux, Android and iOS builds, which compile and sign (master and release); `rust-tests.yml`; the Agent's unsigned master builds | Blacksmith (`blacksmith-6vcpu-macos-26`, `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-8vcpu-windows-2025`) |
+| Research macOS, Linux, Android and iOS builds, which compile and sign (master and release); `rust-tests.yml`; the Agent's unsigned master builds | Blacksmith (`blacksmith-6vcpu-macos-27`, `blacksmith-8vcpu-ubuntu-2404`, `blacksmith-8vcpu-windows-2025`) |
 | Release `build-windows` | `maple-windows-2025-16core` |
 | Signed Research Windows master build; Agent Windows signing and verification | `windows-2025` |
 | Artifact verifiers, TestFlight submission, the Agent's signing and attestation, CodeQL, web and frontend evidence | Other GitHub-hosted runners |
@@ -268,13 +268,17 @@ PowerShell Gallery and its CDN and accepts only the pinned SHA-256. Rust,
 MSVC, Perl and the linker are pinned by `.github/actions/setup-agent-windows`
 for the Agent.
 
-Research desktop and iOS builds select Xcode 26.5 (`17F42`) from
+Research desktop and iOS builds select Xcode 27.1 (`27A9275`) from
 [`scripts/ci/apple-toolchain.json`](../scripts/ci/apple-toolchain.json) through
 `scripts/ci/select-xcode.py`; the root Nix shell exports the same version for
 its Apple recipes. Do not rely on a runner's default Xcode. The
 [iOS ONNX pins](../apps/maple-research/frontend/src-tauri/scripts/onnxruntime-pins.sh)
 verify artifacts against that exact build, so an Xcode upgrade means rebuilding
-and reviewing those hashes and validating desktop and iOS packaging. A newer
+and reviewing those hashes and validating desktop and iOS packaging. The
+Agent's signed macOS build compiles gpui's Metal shaders: Blacksmith's macOS
+image has no Metal Toolchain and cannot download one, so a GitHub `xcode-27`
+job exports it as a one-day artifact that the build imports, and the build's
+release cache key hashes the Xcode pin. A newer
 CI image does not raise the shipped deployment targets: Research supports
 macOS 13.4 and iOS 16.0.
 
diff --git a/scripts/ci/_common.sh b/scripts/ci/_common.sh
index 046293ea3..6736b1e31 100755
--- a/scripts/ci/_common.sh
+++ b/scripts/ci/_common.sh
@@ -2814,7 +2814,7 @@ verify_ios_onnxruntime_pinned_hashes() {
   local version xcode_build xcframework manifest file expected actual status
 
   version="$(ios_onnxruntime_version)"
-  xcode_build="${MAPLE_XCODE_BUILD_VERSION:-17F42}"
+  xcode_build="${MAPLE_XCODE_BUILD_VERSION:-27A9275}"
   xcframework="$(ios_onnxruntime_xcframework_dir)"
   manifest="$(ios_onnxruntime_manifest_file)"
   status=0
diff --git a/scripts/ci/apple-toolchain.json b/scripts/ci/apple-toolchain.json
index 8f2cd86e1..9aa97b351 100644
--- a/scripts/ci/apple-toolchain.json
+++ b/scripts/ci/apple-toolchain.json
@@ -1,4 +1,4 @@
 {
-  "version": "26.5",
-  "build": "17F42"
+  "version": "27.1",
+  "build": "27A9275"
 }
diff --git a/scripts/ci/cargo_graph_key.py b/scripts/ci/cargo_graph_key.py
index 541541bd7..21e0906ef 100644
--- a/scripts/ci/cargo_graph_key.py
+++ b/scripts/ci/cargo_graph_key.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Hash a Cargo.lock's dependency graph and a flake.lock for an exact cache key.
+"""Hash a Cargo.lock's dependency graph, a flake.lock and toolchain pins for an exact cache key.
 
 agent-desktop-build.yml keys its release cache on this hash. Every third-party
 package's name, version, source and checksum, every dependency edge, and the
@@ -7,7 +7,9 @@
 packages, the ones without a `source` (workspace members and path
 dependencies), are dropped, wherever they appear: a release version bump keeps
 the key, while any other change gives a new one. Cargo rebuilds local packages
-anyway.
+anyway. Further arguments are toolchain pin files hashed as text: the macOS build
+passes scripts/ci/apple-toolchain.json, so an Xcode upgrade never restores
+objects built against the previous SDK. Without them the key is unchanged.
 
 Prints `hash=<sha256>` for $GITHUB_OUTPUT. Input it cannot resolve
 unambiguously fails with no output.
@@ -20,6 +22,7 @@
 from pathlib import Path
 import re
 import sys
+from typing import Sequence
 
 try:
     import tomllib
@@ -147,10 +150,12 @@ def parse_flake_lock(text: str) -> dict:
     return flake
 
 
-def key(cargo_lock: str, flake_lock: str) -> str:
-    """SHA-256 of the normalized Cargo.lock graph and the parsed flake.lock."""
+def key(cargo_lock: str, flake_lock: str, pins: Sequence[str] = ()) -> str:
+    """SHA-256 of the normalized Cargo.lock graph, the parsed flake.lock and any pin texts."""
     payload = {"schema": SCHEMA, "cargo": graph(parse_cargo_lock(cargo_lock)),
                "flake": parse_flake_lock(flake_lock)}
+    if pins:
+        payload["pins"] = [text.replace("\r\n", "\n") for text in pins]
     try:
         canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"), ensure_ascii=True)
     except TypeError as error:  # a TOML date or time, which Cargo never writes
@@ -159,12 +164,12 @@ def key(cargo_lock: str, flake_lock: str) -> str:
 
 
 def main(argv: list) -> int:
-    if len(argv) != 2:
-        print("usage: cargo_graph_key.py CARGO_LOCK FLAKE_LOCK", file=sys.stderr)
+    if len(argv) < 2:
+        print("usage: cargo_graph_key.py CARGO_LOCK FLAKE_LOCK [PIN ...]", file=sys.stderr)
         return 2
     try:
         texts = [Path(name).read_text(encoding="utf-8") for name in argv]
-        digest = key(*texts)
+        digest = key(texts[0], texts[1], texts[2:])
     except (OSError, UnicodeError, GraphError) as error:
         print(f"::error::cargo_graph_key.py: {error}", file=sys.stderr)
         return 1
diff --git a/scripts/ci/lanes.py b/scripts/ci/lanes.py
index d71ca362c..1b7762442 100644
--- a/scripts/ci/lanes.py
+++ b/scripts/ci/lanes.py
@@ -36,9 +36,12 @@ def cache_store(label: str) -> str:
 # The override variables are unset; set one to fail over during an outage.
 LINUX = Runner("blacksmith-8vcpu-ubuntu-2404", "CI_LINUX_RUNNER")
 LINUX_HEAVY = Runner("blacksmith-32vcpu-ubuntu-2404", "CI_LINUX_HEAVY_RUNNER")
-MACOS = Runner("blacksmith-6vcpu-macos-26", "CI_MACOS_RUNNER")
+MACOS = Runner("blacksmith-6vcpu-macos-27", "CI_MACOS_RUNNER")
 WINDOWS = Runner("blacksmith-8vcpu-windows-2025", "CI_WINDOWS_RUNNER")
 GITHUB = Runner("ubuntu-latest")  # free GitHub runner for lanes that compile nothing heavy
+# GitHub's Xcode 27 image ships Xcode's Metal Toolchain, which Blacksmith's macOS image
+# lacks and cannot download (its MobileAsset catalog fetch fails).
+GITHUB_XCODE = Runner("xcode-27")
 # The Agent updater's native Windows tests and the installer smoke test need GitHub's
 # runner: Blacksmith's workspace inherits a foreign write ACE the updater rejects, and
 # master's Windows install smoke (agent-desktop-build.yml verify-windows) runs there too.
@@ -144,6 +147,7 @@ class Lane:
     submodules: bool = False                    # check out submodules, with the full (blobless) history Nix needs
     hook: Optional[str] = None                  # the pre-commit component that runs these checks
     restore: str = ""                           # read-only restore of a cache another workflow writes
+    requires: Tuple[str, ...] = ()              # lanes whose jobs this lane's job needs; selected with it
 
 
 AGENT_DIR = dict(
@@ -152,6 +156,14 @@ class Lane:
     env=(("RUSTFLAGS", "-D warnings"),),
 )
 AGENT_FLAKE = dict(flake="./apps/maple-agent", **AGENT_DIR)
+# The macOS lanes also key their caches on the Xcode pin, so an Xcode upgrade never
+# restores objects built against the previous SDK.
+AGENT_MACOS = dict(AGENT_FLAKE, runner=MACOS,
+                   cache_files=AGENT_DIR["cache_files"] + ("scripts/ci/apple-toolchain.json",))
+# gpui compiles its Metal shaders at run time instead of build time, so these lanes need
+# no Metal Toolchain (Blacksmith's macOS image has none). Compiled shaders are proven by
+# master's signed Prod build on every Agent push, the nightly Dev build and ci:package.
+RUNTIME_SHADERS = "-F gpui-platform/runtime_shaders"
 # Lanes that only resolve the Agent's graph share its Cargo home, without a target
 # directory, so they stop cloning the zed and cua git dependencies on every run.
 AGENT_CARGO_HOME = dict(AGENT_FLAKE, cache="agent-cargo-home", cache_targets=False)
@@ -220,8 +232,8 @@ def deny(manifest: str, component: str) -> str:
     Lane("agent-test", AGENT, also=RUST_SDK + PROXY_RUNTIME, runner=LINUX_HEAVY,
          run="just ci-test", cache="agent-test", timeout=40, hook="agent", **AGENT_FLAKE),
     Lane("agent-macos", AGENT, also=RUST_SDK + PROXY_RUNTIME + APPLE_TOOLCHAIN,
-         runner=MACOS, run="cargo clippy --workspace --all-targets --locked -- -D warnings",
-         cache="agent-macos", timeout=25, **AGENT_FLAKE),
+         run=f"cargo clippy --workspace --all-targets --locked {RUNTIME_SHADERS} -- -D warnings",
+         cache="agent-macos", timeout=25, **AGENT_MACOS),
     # Windows Clippy and the native PE-metadata and host-spawn fixtures, on every Agent change.
     Lane("agent-windows", AGENT, also=RUST_SDK + PROXY_RUNTIME + ("scripts/ci/agent_windows.py",),
          labels=("ci:windows", "ci:full"),
@@ -235,13 +247,15 @@ def deny(manifest: str, component: str) -> str:
     Lane("agent-windows-updater", AGENT_WINDOWS_UPDATER, labels=("ci:windows", "ci:full"),
          run="cargo test -p maple-agent-updater --locked --no-fail-fast -- --test-threads=1",
          cache="agent-windows-updater", timeout=30, **dict(AGENT_WIN, runner=GITHUB_WINDOWS_FREE)),
-    # The rest of `just ci` and the native macOS suite: master, nightly and ci:full.
+    # The rest of `just ci` and the native macOS suite (with runtime shaders, see
+    # RUNTIME_SHADERS): master, nightly and ci:full.
     Lane("agent-full-linux", AGENT, also=RUST_SDK + PROXY_RUNTIME, pr_paths=(), run="just ci-extra",
          cache="agent-full-linux", timeout=30, gate=False, **AGENT_FLAKE),
-    Lane("agent-full-macos", AGENT, also=RUST_SDK + PROXY_RUNTIME, pr_paths=(), runner=MACOS,
-         run="python3 scripts/test_git_metadata.py && cargo build --workspace --all-targets --locked"
-             " && ./scripts/macos-debug-app.sh && cargo test --workspace --locked",
-         cache="agent-full-macos", timeout=45, gate=False, **AGENT_FLAKE),
+    Lane("agent-full-macos", AGENT, also=RUST_SDK + PROXY_RUNTIME + APPLE_TOOLCHAIN, pr_paths=(),
+         run="python3 scripts/test_git_metadata.py"
+             f" && cargo build --workspace --all-targets --locked {RUNTIME_SHADERS}"
+             f" && ./scripts/macos-debug-app.sh && cargo test --workspace --locked {RUNTIME_SHADERS}",
+         cache="agent-full-macos", timeout=45, gate=False, **AGENT_MACOS),
     # The native Windows suite: nightly (which saves its cache) and by label, on the free runner.
     Lane("agent-full-windows", AGENT, also=RUST_SDK + PROXY_RUNTIME, pr_paths=(), labels=("ci:windows", "ci:full"),
          events=PR_AND_NIGHTLY,
@@ -267,7 +281,12 @@ def deny(manifest: str, component: str) -> str:
          events=PR_AND_NIGHTLY, job="agent-package-linux", run="just package-rehearsal", timeout=60, gate=False, **AGENT_PACKAGE_FLAKE),
     Lane("agent-package-macos", AGENT_PACKAGING + APPLE_TOOLCHAIN, pr_paths=(), labels=("ci:package", "ci:full"),
          events=PR_AND_NIGHTLY, job="agent-package-macos", runner=MACOS, run="just package-rehearsal", timeout=60,
-         gate=False, **AGENT_PACKAGE_FLAKE),
+         gate=False, requires=("metal-toolchain",), **AGENT_PACKAGE_FLAKE),
+    # Exports Xcode's Metal Toolchain as a one-day artifact for the macOS packaging rehearsal,
+    # which compiles gpui's shaders like the signed builds. Nothing selects it by path or
+    # label: the planner adds it to every plan with a lane that requires it.
+    Lane("metal-toolchain", (), pr_paths=(), labels=(), gate=False, job="metal-toolchain",
+         runner=GITHUB_XCODE, timeout=15),
     Lane("agent-package-windows", AGENT_WINDOWS_PACKAGING, pr_paths=(), labels=("ci:package", "ci:full"),
          events=PR_AND_NIGHTLY, job="agent-package-windows", runner=GITHUB_WINDOWS, workdir="apps/maple-agent", run=WINDOWS_PACKAGE,
          env=(("RUSTFLAGS", "-D warnings -C target-feature=+crt-static"),) + FAST_RELEASE, timeout=90, gate=False),
@@ -324,6 +343,10 @@ def deny(manifest: str, component: str) -> str:
     # desktop-build.yml, mobile-build.yml and android-build.yml build master.
     Lane("research-ios", (TAURI + "gen/apple/**", TAURI + "icons/ios/**", TAURI + "capabilities/mobile-ios.json",
                           TAURI + "tauri.ios-dev.conf.json", TAURI + "Info.plist", TAURI + "Entitlements.plist",
+                          # iOS-only sources: the scene manifest tauri-cli merges into the app's
+                          # plist, plugin Swift code, and the vendored tao's iOS platform layer.
+                          TAURI + "Info.ios.plist", TAURI + "plugins/*/ios/**", TAURI + "patches/*/ios/**",
+                          TAURI + "patches/tao-*/src/platform_impl/ios/**",
                           TAURI + "scripts/*ios*", TAURI + "scripts/canonicalize-static-archive.py",
                           TAURI + "scripts/onnxruntime-pins.sh", "scripts/ci/ios-*.sh", "scripts/ci/ios-build-profile.py",
                           "scripts/ci/canonical-ios-app-hash.py", "scripts/ci/_common.sh",
diff --git a/scripts/ci/plan.py b/scripts/ci/plan.py
index fdc7b6499..bb4bf86be 100644
--- a/scripts/ci/plan.py
+++ b/scripts/ci/plan.py
@@ -87,6 +87,19 @@ def everything(event: str, why: str) -> Selection:
     return {lane.id: [why] for lane in active(event)}
 
 
+def with_requirements(selected: Selection) -> Selection:
+    """Add every lane a selected lane requires, transitively: the requiring lane's job needs theirs."""
+    by_id = {lane.id: lane for lane in LANES}
+    pending = list(selected)
+    while pending:
+        lane = by_id.get(pending.pop())
+        for name in lane.requires if lane else ():
+            if name not in selected:
+                pending.append(name)
+            selected.setdefault(name, []).append(f"required by {lane.id}")
+    return selected
+
+
 def select(event: str, paths: Iterable[str], labels: Sequence[str] = ()) -> Selection:
     """Active lanes that the changed paths and PR labels select for `event`."""
     lanes = active(event)
@@ -115,7 +128,7 @@ def select(event: str, paths: Iterable[str], labels: Sequence[str] = ()) -> Sele
                 chosen.setdefault(lane.id, []).append(f"label {label}")
     if approvals:  # opensecret-eif.yml compares the edited approvals instead
         chosen.pop("os-eif", None)
-    return chosen
+    return with_requirements(chosen)
 
 
 def hook_components(paths: Iterable[str]) -> List[str]:
@@ -170,7 +183,7 @@ def plan_event(event: str, payload: dict) -> Selection:
         unknown = sorted(set(names) - {lane.id for lane in active(event)})
         if unknown:
             raise ValueError(f"not an active lane: {', '.join(unknown)}")
-        return {name: ["dispatch"] for name in names}
+        return with_requirements({name: ["dispatch"] for name in names})
     if event == NIGHTLY:
         return everything(event, "nightly")
     labels: List[str] = []
@@ -496,6 +509,33 @@ def lint_problems(files: Sequence[str]) -> List[str]:
             problems.append(f"ci.yml plan: {variable} is not passed to plan.py")
     if f"toolchain: {AGENT_WINDOWS_RUST}\n" not in WINDOWS_SETUP.read_text():
         problems.append(f"setup-agent-windows does not pin Rust {AGENT_WINDOWS_RUST}")
+    # A lane's requirements run only for it: they exist, form no cycle, select nothing on their
+    # own, and the requiring lane's special job waits for theirs.
+    by_id = {lane.id: lane for lane in LANES}
+    for lane in LANES:
+        for name in lane.requires:
+            required = by_id.get(name)
+            if required is None:
+                problems.append(f"{lane.id}: requires unknown lane {name}")
+                continue
+            if required.paths or required.pr_paths or required.labels or required.gate:
+                problems.append(f"{name}: a required lane must have no paths, labels or gate")
+            if lane.job in MATRIX_JOBS or lane.job not in blocks:
+                problems.append(f"{lane.id}: a lane with requirements needs its own ci.yml job")
+                continue
+            needs = re.search(r"^    needs: \[?([^\]\n]*)\]?$", blocks[lane.job], re.M)
+            if not needs or required.job not in {n.strip() for n in needs[1].split(",")}:
+                problems.append(f"ci.yml {lane.job}: needs does not include {required.job}")
+    for lane in LANES:
+        seen, stack = set(), list(lane.requires)
+        while stack:
+            name = stack.pop()
+            if name == lane.id:
+                problems.append(f"{lane.id}: requirement cycle")
+                break
+            if name not in seen and name in by_id:
+                seen.add(name)
+                stack.extend(by_id[name].requires)
     declared = set(re.findall(r"^\s+- (\S+)$", (ROOT / ".github/actionlint.yaml").read_text(), re.M))
     problems += [f"{lane.id}: {lane.opensecret} is no opensecret_change_detection.py output" for lane in LANES
                  if lane.opensecret and lane.opensecret not in OPENSECRET_OUTPUTS + ("pcr",)]
diff --git a/scripts/ci/select-xcode.py b/scripts/ci/select-xcode.py
index 2e29aadb5..8a85f59cb 100644
--- a/scripts/ci/select-xcode.py
+++ b/scripts/ci/select-xcode.py
@@ -29,7 +29,10 @@ def load_pin(path=PIN):
 
 def select_xcode(pin, applications=Path("/Applications")):
     version = pin["version"]
-    for name in (f"Xcode_{version}.app", f"Xcode_{version}.0.app", "Xcode.app"):
+    # Hosted images may keep a release under a suffixed name (for example
+    # Xcode_27.1_Release_Candidate.app); the exact build check below decides.
+    suffixed = sorted(path.name for path in applications.glob(f"Xcode_{version}_*.app"))
+    for name in (f"Xcode_{version}.app", f"Xcode_{version}.0.app", *suffixed, "Xcode.app"):
         developer = applications / name / "Contents/Developer"
         if not (developer / "usr/bin/xcodebuild").is_file():
             continue
diff --git a/scripts/ci/test-canonical-macho.py b/scripts/ci/test-canonical-macho.py
index 99e344fe0..94790a3af 100644
--- a/scripts/ci/test-canonical-macho.py
+++ b/scripts/ci/test-canonical-macho.py
@@ -71,6 +71,35 @@ def local_absolute_symbols(path):
     return symbols
 
 
+def swap_local_absolute_symbols(path):
+    """Swap the first two local absolute nlist entries in place."""
+    data = bytearray(Path(path).read_bytes())
+    _, _, _, _, ncmds, _, _, _ = struct.unpack_from("<IiiIIIII", data)
+    command_offset = 32
+    for _ in range(ncmds):
+        command, command_size = struct.unpack_from("<II", data, command_offset)
+        if command == LC_SYMTAB:
+            symbol_offset, symbol_count, _, _ = struct.unpack_from(
+                "<IIII", data, command_offset + 8
+            )
+            break
+        command_offset += command_size
+    else:
+        raise AssertionError(f"Mach-O has no symbol table: {path}")
+    entries = []
+    for index in range(symbol_count):
+        entry_offset = symbol_offset + index * 16
+        symbol_type = data[entry_offset + 4]
+        if not symbol_type & N_STAB and (symbol_type & N_TYPE) == N_ABS and not symbol_type & N_EXT:
+            entries.append(entry_offset)
+    first, second = entries[:2]
+    data[first:first + 16], data[second:second + 16] = (
+        data[second:second + 16],
+        data[first:first + 16],
+    )
+    Path(path).write_bytes(bytes(data))
+
+
 class CanonicalMachoTests(unittest.TestCase):
     def build_executable(self, output, local_symbols, return_value, global_symbol):
         object_path = output.with_suffix(".o")
@@ -145,6 +174,10 @@ def test_local_absolute_symbol_order_is_not_runtime_content(self):
             )
 
             self.assertEqual(local_absolute_symbols(executable_ab), symbols_ab)
+            if local_absolute_symbols(executable_ba) == symbols_ab:
+                # Xcode 27's ld sorts local absolute symbols, so reproduce the
+                # input-order variant older linkers emitted by swapping the entries.
+                swap_local_absolute_symbols(executable_ba)
             self.assertEqual(local_absolute_symbols(executable_ba), symbols_ba)
 
             canonical_ab = CANONICALIZER.canonical_macho(executable_ab)
diff --git a/scripts/ci/test_cargo_graph_key.py b/scripts/ci/test_cargo_graph_key.py
index 66a78464e..deb406152 100644
--- a/scripts/ci/test_cargo_graph_key.py
+++ b/scripts/ci/test_cargo_graph_key.py
@@ -199,6 +199,16 @@ def test_a_flake_lock_change_changes_the_key(self):
         flake["nodes"]["nixpkgs"]["locked"]["rev"] = "b" * 40
         self.assertNotEqual(key(flake=flake), key())
 
+    def test_toolchain_pins_join_the_key_only_when_given(self):
+        pin = '{\n  "version": "27.1",\n  "build": "27A9275"\n}\n'
+        lockfiles = (lock_text(PACKAGES), json.dumps(FLAKE, indent=2))
+        self.assertEqual(cargo_graph_key.key(*lockfiles, ()), key())
+        self.assertNotEqual(cargo_graph_key.key(*lockfiles, (pin,)), key())
+        self.assertNotEqual(cargo_graph_key.key(*lockfiles, (pin.replace("27A9275", "27A9276"),)),
+                            cargo_graph_key.key(*lockfiles, (pin,)))
+        self.assertEqual(cargo_graph_key.key(*lockfiles, (pin.replace("\n", "\r\n"),)),
+                         cargo_graph_key.key(*lockfiles, (pin,)))
+
     def test_formatting_order_and_line_endings_do_not_change_the_key(self):
         reordered = copy.deepcopy(PACKAGES[::-1])
         for package in reordered:
@@ -265,6 +275,15 @@ def test_prints_one_github_output_line_for_the_agent_lockfiles(self):
         self.assertEqual(code, 0)
         self.assertRegex(stdout, r"\Ahash=[0-9a-f]{64}\n\Z")
 
+    def test_a_pin_file_argument_changes_the_agent_key(self):
+        agent = ROOT / "apps/maple-agent"
+        lockfiles = (str(agent / "Cargo.lock"), str(agent / "flake.lock"))
+        _, plain, _ = self.run_main(*lockfiles)
+        code, pinned, _ = self.run_main(*lockfiles, str(ROOT / "scripts/ci/apple-toolchain.json"))
+        self.assertEqual(code, 0)
+        self.assertRegex(pinned, r"\Ahash=[0-9a-f]{64}\n\Z")
+        self.assertNotEqual(pinned, plain)
+
     def test_the_agent_lock_keeps_its_key_when_every_local_version_is_bumped(self):
         agent = ROOT / "apps/maple-agent"
         text, flake = (agent / "Cargo.lock").read_text(), (agent / "flake.lock").read_text()
diff --git a/scripts/ci/test_contracts.py b/scripts/ci/test_contracts.py
index 4251232b4..05819c8c8 100644
--- a/scripts/ci/test_contracts.py
+++ b/scripts/ci/test_contracts.py
@@ -417,8 +417,12 @@ def test_c4_ci_restores_only_what_a_master_workflow_saves(self):
                     if step["uses"].startswith("actions/cache/save@"):
                         self.assertIn("refs/heads/master' && github.event_name == 'schedule'", step["if"])
                     else:
-                        self.assertTrue(step["with"]["key"].startswith("ci-v1-agent-package-${{ runner.os }}-"))
-                        self.assertEqual(step["with"]["restore-keys"], "ci-v1-agent-package-${{ runner.os }}-")
+                        # macOS also leads with the Xcode pin, so a prefix restore never
+                        # brings back objects built against another SDK.
+                        prefix = "ci-v1-agent-package-${{ runner.os }}-" + (
+                            "${{ hashFiles('scripts/ci/apple-toolchain.json') }}-" if job_id == "agent-package-macos" else "")
+                        self.assertTrue(step["with"]["key"].startswith(prefix))
+                        self.assertEqual(step["with"]["restore-keys"], prefix)
             elif name == "ci.yml":
                 with self.subTest(job=job_id):
                     self.assertTrue(step["uses"].startswith("actions/cache/restore@"))
@@ -459,7 +463,12 @@ def test_c4_agent_release_key_hashes_the_dependency_graph_and_toolchain(self):
         # empty or misnamed output would turn the exact key into a prefix that restores any
         # entry of the family.
         agent = ROOT / "apps/maple-agent"
-        expected = cargo_graph_key.key((agent / "Cargo.lock").read_text(), (agent / "flake.lock").read_text())
+        lockfiles = ((agent / "Cargo.lock").read_text(), (agent / "flake.lock").read_text())
+        # The macOS builder also hashes the Xcode pin, so an Xcode upgrade never restores
+        # objects built against the previous SDK.
+        apple = ((ROOT / "scripts/ci/apple-toolchain.json").read_text(),)
+        expected = {job: cargo_graph_key.key(*lockfiles, apple if job == "macos-build" else ())
+                    for _, job in AGENT_RELEASE_WRITERS}
         pattern = r"ci-v1-agent-release-\$\{\{ runner\.os \}\}-\$\{\{ steps\.([\w-]+)\.outputs\.([\w-]+) \}\}"
         with tempfile.TemporaryDirectory() as temporary:
             working = Path(temporary) / "bin/python3"
@@ -497,7 +506,7 @@ def run(step, directory, python, output):
                     output = Path(temporary) / f"{job_id}.output"
                     result = run(step, directory, working, output)
                     self.assertEqual(result.returncode, 0, result.stderr)
-                    self.assertEqual(output.read_text().splitlines(), [f"{reference[2]}={expected}"])
+                    self.assertEqual(output.read_text().splitlines(), [f"{reference[2]}={expected[job_id]}"])
                     failed = Path(temporary) / f"{job_id}.failed"
                     self.assertNotEqual(run(step, directory, failing, failed).returncode, 0)
                     self.assertEqual(failed.read_text() if failed.exists() else "", "")
diff --git a/scripts/ci/test_plan.py b/scripts/ci/test_plan.py
index c78ab8a40..0d9748ca1 100644
--- a/scripts/ci/test_plan.py
+++ b/scripts/ci/test_plan.py
@@ -1,6 +1,7 @@
 """Lane selection: the table, the planner's events and the pre-commit hook."""
 
 import contextlib
+import dataclasses
 import io
 import json
 import os
@@ -233,6 +234,25 @@ def test_every_tracked_file_is_classified_and_ci_yml_matches(self):
                               plan.lint_problems(plan.tracked_files()))
 
 
+    def test_a_lane_with_requirements_waits_for_their_jobs(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            workflow = Path(tmp) / "ci.yml"
+            workflow.write_text(plan.CI_WORKFLOW.read_text().replace(
+                "    needs: [plan, metal-toolchain]\n    if: fromJSON(needs.plan.outputs.lanes)['agent-package-macos']",
+                "    needs: plan\n    if: fromJSON(needs.plan.outputs.lanes)['agent-package-macos']"))
+            with mock.patch.object(plan, "CI_WORKFLOW", workflow):
+                self.assertIn("ci.yml agent-package-macos: needs does not include metal-toolchain",
+                              plan.lint_problems(plan.tracked_files()))
+        def edited(lane_id, **changes):
+            return tuple(dataclasses.replace(lane, **changes) if lane.id == lane_id else lane for lane in lanes.LANES)
+        for broken, problem in ((edited("agent-package-macos", requires=("no-such-lane",)),
+                                 "agent-package-macos: requires unknown lane no-such-lane"),
+                                (edited("metal-toolchain", labels=("ci:full",)),
+                                 "metal-toolchain: a required lane must have no paths, labels or gate")):
+            with self.subTest(problem=problem), mock.patch.object(plan, "LANES", broken):
+                self.assertIn(problem, plan.lint_problems(plan.tracked_files()))
+
+
 class HookTests(unittest.TestCase):
     """The pre-commit hook's components: a path selects those of the lanes that own it."""
 
@@ -379,6 +399,21 @@ def test_packaging_rehearsals_run_only_by_label_and_nightly(self):
             self.assertEqual(agent_lanes(selected(["docs/x.md"], labels=[label])) & packages, packages)
         self.assertLessEqual(packages, active(NIGHTLY))
 
+    def test_a_required_lane_runs_only_with_the_lane_that_requires_it(self):
+        # The macOS packaging rehearsal compiles gpui's shaders on Blacksmith, whose image
+        # cannot download the Metal Toolchain; metal-toolchain exports it, and only that
+        # requirement ever selects it.
+        consumer, required = "agent-package-macos", "metal-toolchain"
+        for event in (PR, PUSH):
+            with self.subTest(event=event):
+                self.assertFalse({consumer, required} & selected(["apps/maple-agent/app/src/main.rs"], event))
+        for label in ("ci:package", "ci:full"):
+            with self.subTest(label=label):
+                chosen = plan.select(PR, ["docs/x.md"], [label])
+                self.assertIn(consumer, chosen)
+                self.assertEqual(chosen[required], [f"required by {consumer}"])
+        self.assertLessEqual({consumer, required}, active(NIGHTLY))
+
     def test_full_suites_run_on_master_nightly_and_by_label(self):
         full = {"agent-full-linux", "agent-full-macos", "agent-full-windows"}
         self.assertFalse(full & selected(["apps/maple-agent/app/src/main.rs"]))
@@ -462,6 +497,11 @@ def test_research_platform_builds_run_on_native_inputs_or_labels(self):
         # Mobile builds still follow their native inputs; desktop bundles never block
         # a PR (desktop-build.yml builds master; ci:package rehearses them).
         for path, lanes_ in ((tauri + "gen/apple/project.yml", {"research-ios"}),
+                             (tauri + "Info.ios.plist", {"research-ios", "research-rust"}),
+                             (tauri + "plugins/tauri-plugin-iap/ios/Sources/IapPlugin.swift",
+                              {"research-ios", "research-rust"}),
+                             (tauri + "patches/tao-0.37.1/src/platform_impl/ios/app_state.rs",
+                              {"research-ios", "research-rust"}),
                              (tauri + "gen/android/app/build.gradle.kts", {"research-android"}),
                              (tauri + "dmg/background.tiff", {"research-rust"}),
                              (tauri + "tauri.conf.json", {"research-rust", "repo"}),
@@ -564,6 +604,11 @@ def test_schedule_and_dispatch(self):
         self.assertEqual({lane for lane, on in outputs["lanes"].items() if on}, {"agent-test"})
         self.assertEqual([entry["id"] for entry in outputs["nix"]], ["agent-test"])
 
+    def test_dispatching_a_lane_also_runs_the_lanes_it_requires(self):
+        _, outputs = self.github(DISPATCH, {}, LANES_INPUT="agent-package-macos")
+        self.assertEqual({lane for lane, on in outputs["lanes"].items() if on},
+                         {"agent-package-macos", "metal-toolchain"})
+
     def test_quarantined_lanes_still_run_and_an_unknown_id_fails_the_plan(self):
         code, outputs = self.github(NIGHTLY, {}, CI_QUARANTINE=" research-ios,agent-test, ")
         self.assertEqual((code, outputs["quarantine"]), (0, ["agent-test", "research-ios"]))
@@ -622,6 +667,8 @@ def test_a_cache_key_pins_the_toolchain_and_leaves_lockfiles_to_rust_cache(self)
                 workspace = lane.workspaces.split("->")[0].strip()
                 pins = {f"{workspace}/{name}" for name in ("flake.lock", "rust-toolchain.toml")
                         if (plan.ROOT / workspace / name).is_file()}
+                if lane.runner == lanes.MACOS:  # and the Xcode that builds against the SDK
+                    pins.add("scripts/ci/apple-toolchain.json")
                 with self.subTest(lane=lane.id):
                     self.assertIn(f"{workspace}/flake.lock", pins)
                     self.assertEqual(set(lane.cache_files), pins)
diff --git a/scripts/ci/test_select_xcode.py b/scripts/ci/test_select_xcode.py
index e2115b194..2785cc128 100644
--- a/scripts/ci/test_select_xcode.py
+++ b/scripts/ci/test_select_xcode.py
@@ -97,6 +97,19 @@ def test_beta_install_and_disguised_beta_symlink_are_never_probed(self):
                 selector.select_xcode(self.pin, self.directory)
             run.assert_not_called()
 
+    def test_suffixed_release_install_is_selected_by_exact_build(self):
+        self.install("Xcode_26.5_beta_2.app")
+        developer = self.install("Xcode_26.5_Release_Candidate.app")
+        with patch.object(selector.subprocess, "run", return_value=self.result()) as run:
+            self.assertEqual(selector.select_xcode(self.pin, self.directory), developer)
+        self.assertEqual(run.call_count, 1)
+
+    def test_suffixed_install_with_another_build_is_rejected(self):
+        self.install("Xcode_26.5_Release_Candidate.app")
+        with patch.object(selector.subprocess, "run", return_value=self.result(build="17F40")):
+            with self.assertRaisesRegex(selector.ToolchainError, "26.5 build 17F42"):
+                selector.select_xcode(self.pin, self.directory)
+
     def test_rolling_default_is_skipped_when_pinned_release_is_available(self):
         self.install("Xcode_26.5.app")
         developer = self.install("Xcode_26.5.0.app")
diff --git a/scripts/ci/test_workflow_policy.py b/scripts/ci/test_workflow_policy.py
index a123a5edb..d38f33a2a 100644
--- a/scripts/ci/test_workflow_policy.py
+++ b/scripts/ci/test_workflow_policy.py
@@ -30,7 +30,9 @@
 PINNED = re.compile(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+(?:/[A-Za-z0-9_./-]+)?@[0-9a-f]{40}")
 # Standard images, and the org's one GitHub-hosted larger runner, by its exact label:
 # a pattern would also admit a self-hosted runner that borrowed the name.
-GITHUB_HOSTED = re.compile(r"(?:ubuntu|macos|windows)-[A-Za-z0-9.-]+|maple-windows-2025-16core")
+# GitHub-hosted labels: the standard images, the per-Xcode macOS images (xcode-27) and the
+# org's larger Windows runner.
+GITHUB_HOSTED = re.compile(r"(?:ubuntu|macos|windows)-[A-Za-z0-9.-]+|xcode-[0-9]+|maple-windows-2025-16core")
 # The workflows that run on pull requests or the merge queue. Every other check is a
 # ci.yml lane (scripts/ci/lanes.py), so ci-ok judges it; adding one here is an owner call.
 PULL_REQUEST_WORKFLOWS = frozenset({
diff --git a/scripts/testing/storekit/run.sh b/scripts/testing/storekit/run.sh
index 812b01f14..e0ac66d1a 100644
--- a/scripts/testing/storekit/run.sh
+++ b/scripts/testing/storekit/run.sh
@@ -2,10 +2,11 @@
 set -euo pipefail
 
 # Invoke through .#apple so native linker variables are prepared here.
-# A deliberate local comparison can select Xcode 26.6 without changing pins:
+# A deliberate local comparison can select another installed Xcode without
+# changing pins:
 # nix develop --no-update-lock-file .#apple -c env \
-#   MAPLE_NIX_XCODE_VERSION=26.6 MAPLE_NIX_XCODE_BUILD_VERSION=17F113 \
-#   DEVELOPER_DIR=/Applications/Xcode_26.6.app/Contents/Developer \
+#   MAPLE_NIX_XCODE_VERSION=<version> MAPLE_NIX_XCODE_BUILD_VERSION=<build> \
+#   DEVELOPER_DIR=/Applications/Xcode_<version>.app/Contents/Developer \
 #   bash scripts/testing/storekit/run.sh ...
 source "$(cd "$(dirname "${BASH_SOURCE[0]}")/../../ci" && pwd)/_common.sh"
 use_xcode_toolchain