diff --git a/.github/workflows/_e2e-ios.yml b/.github/workflows/_e2e-ios.yml
index 9a96882187..d6f5d97f1b 100644
--- a/.github/workflows/_e2e-ios.yml
+++ b/.github/workflows/_e2e-ios.yml
@@ -178,12 +178,15 @@ jobs:
       # flows' way. Never fails the leg.
       - name: Warm up (approve the deep-link confirmation once)
         env:
+          # Which simulator the fixture server opens deep links on (open-link-ios.js).
+          SIM_UDID: ${{ steps.sim.outputs.udid }}
           MAESTRO_DRIVER_STARTUP_TIMEOUT: '300000'
         run: |
-          maestro test -e APP_ID=${{ env.APP_ID }} e2e/warmup/ios-approve-open-link.yaml || echo "warm-up flow did not pass (non-fatal)"
+          maestro test -e APP_ID=${{ env.APP_ID }} -e SIM_UDID="$SIM_UDID" e2e/warmup/ios-approve-open-link.yaml || echo "warm-up flow did not pass (non-fatal)"
 
       - name: Run flows
         env:
+          SIM_UDID: ${{ steps.sim.outputs.udid }}
           # Passed through the environment so a tags value cannot break out of the
           # command line via `${{ }}` text substitution.
           TAGS: ${{ inputs.tags }}
@@ -196,7 +199,7 @@ jobs:
         run: |
           set -euo pipefail
           # shellcheck disable=SC2086 # $TAGS is a list of flags and must word-split
-          maestro test -e APP_ID=${{ env.APP_ID }} $TAGS \
+          maestro test -e APP_ID=${{ env.APP_ID }} -e SIM_UDID="$SIM_UDID" $TAGS \
             --format junit --output e2e-report.xml \
             --debug-output "$PWD/maestro-debug" --flatten-debug-output \
             e2e/flows/
@@ -226,6 +229,19 @@ jobs:
           node scripts/e2e/junit-summary.mjs e2e-report.xml \
             "ios · RN ${{ inputs.rn-version }} · iOS ${{ inputs.ios-runtime }}"
 
+      # The warm-up's logs land in ~/.maestro/tests. Copied into the workspace because
+      # upload-artifact roots the archive at the common ancestor of all paths: a $HOME path
+      # buried e2e-report.xml under work/<repo>/<repo>/, and the report job, which expects
+      # it at the artifact root, scored every iOS leg `missing-report`.
+      - name: Collect Maestro home logs
+        if: always()
+        run: |
+          if [ -d "$HOME/.maestro/tests" ]; then
+            rm -rf maestro-tests
+            cp -R "$HOME/.maestro/tests" maestro-tests
+          fi
+
+      # Every path here must stay inside the workspace (see the step above).
       - name: Upload artifacts
         if: always()
         uses: actions/upload-artifact@v7
@@ -234,7 +250,7 @@ jobs:
           path: |
             e2e-report.xml
             maestro-debug/**
+            maestro-tests/**
             post-mortem/**
             device.log
-            ~/.maestro/tests/**
           if-no-files-found: ignore
diff --git a/e2e/CONTEXT.md b/e2e/CONTEXT.md
index c859d053ad..5a04f0dd61 100644
--- a/e2e/CONTEXT.md
+++ b/e2e/CONTEXT.md
@@ -41,13 +41,27 @@ How to run the suite and how to add a flow: [`README.md`](README.md). The CI mat
 - **Zero retries.** A flow is never re-run to turn it green — a retry hides exactly the
   race conditions this suite exists to catch. A flow that proves unstable gets quarantined
   (`tags: [flaky]`) with an issue, and drops out of the gate until it is fixed. The single
-  exception is transport, not behaviour: `e2e/shared/open-scenario.yaml` retries the
-  `openLink` command itself, because `simctl openurl` on hosted macOS runners has timed
-  out before the app received anything. What the app then shows is never retried.
+  exception is transport, not behaviour: on iOS the deep link is opened by the fixture
+  server (`POST /__open-link`, `e2e/fixtures/open-link.mjs`), which retries `simctl
+  openurl`, because on hosted macOS runners that command has timed out
+  (NSPOSIXErrorDomain 60) while the link still arrived seconds later. It cannot be done in
+  the flow: Maestro's `retry` and `optional` only catch `MaestroException`, and this
+  failure is an `IllegalStateException`, so a `retry` around `openLink` never ran a second
+  attempt. A link delivered twice is harmless (the screen is keyed on the scenario). What
+  the app then shows is never retried.
 - **iOS: the first deep link on a fresh simulator can raise "Open in app?", and the link
   after that confirmation never reaches JS.** The iOS leg runs
   `e2e/warmup/ios-approve-open-link.yaml` once before the suite to take that confirmation
   out of the real flows' way; the shared subflow still handles it defensively.
+- **iOS: an unanswered "Open in app?" prompt outlives the app and hides it.** The prompt
+  belongs to SpringBoard: it survives `stopApp`, `clearState` and `launchApp`, and while it
+  is up the app is missing from the hierarchy, so `e2e-host-ready` never becomes visible.
+  On a slow `macos-15` runner the prompt came up only after the warm-up had stopped
+  waiting for it (no prompt 20 s after `openLink`), and that leg lost all 10 flows.
+  `launch-app.yaml` therefore taps Open on a prompt that is already up after launch and
+  relaunches. Open rather than Cancel, so the approval sticks. With no prompt the check
+  takes ~7 s per launch (Maestro's fixed lookup time for a `when: visible` that is false;
+  7.5 s measured in CI), which did not show up in leg durations against runner variance.
 - v7 API only in the test app: `useVideoPlayer` + `VideoView` + `useEvent`,
   `player.seekTo()`. No `<Video>` component, no v6 `drm` prop.
 - No check becomes *required* in branch protection before 10–15 consecutive clean runs
@@ -93,6 +107,14 @@ How to run the suite and how to add a flow: [`README.md`](README.md). The CI mat
   padding equal to `StatusBar.currentHeight`, the first marker renders under the status
   bar and Maestro drops it from the hierarchy as invisible ("Skipping invisible child").
   Local runs on API 34 never showed this; API 35/36 do.
+- **API 34 kills an app launched within ~1 s of `pm clear`.** Clearing state removes the
+  previous task; when that removal's 1 s destroy timeout fires, Android 14 kills the
+  package's current process ("Destroy timeout of remove-task" then "Killing <pid> (adj
+  -10000): remove task" in logcat), which by then is the one Maestro just started. The
+  activity survives without a React root: a white screen and no `e2e-host-ready`.
+  `launchApp: {clearState: true}` starts the app ~0.9 s after the clear on a hosted runner,
+  which cost 5 of 30 flows across the API 34 nightly legs and none on API 35/36. Hence
+  `launch-app.yaml` runs `clearState`, waits 2.5 s on Android, then `launchApp`.
 - **Taps are immediate on Android, deferred on iOS.** The iOS driver only delivers a tap
   once the player goes idle (below); the Android driver delivers it at once. Flows that
   must work on both use absolute actions (`btn-play`, `btn-seek-1`, `btn-loop-on`), never
diff --git a/e2e/README.md b/e2e/README.md
index 88ed4811d4..5ad4436b3e 100644
--- a/e2e/README.md
+++ b/e2e/README.md
@@ -10,7 +10,9 @@ CI matrix: [`CI_MATRIX_DESIGN.md`](CI_MATRIX_DESIGN.md).
 ./e2e/fixtures/generate.sh
 
 # 2. Serve fixtures (dependency-free — the same server CI starts via
-#    .github/actions/e2e-setup/action.yml; run it from the repo root and leave it running)
+#    .github/actions/e2e-setup/action.yml; run it from the repo root and leave it running).
+#    iOS flows also open their deep links through it, on the booted simulator; with more
+#    than one simulator booted, start it with E2E_SIM_UDID=<udid>.
 node e2e/fixtures/serve.mjs e2e/fixtures/media 8090
 
 # 3. Pick the React Native version and install.
@@ -87,8 +89,9 @@ However a flow was drafted, the committed artifact is plain YAML, reviewed by ha
 - No external network in flows — local fixtures only.
 - Zero retries on anything the flows assert. A flaky flow gets quarantined
   (`tags: [flaky]`) with an issue, never retried into a false green — a retry hides the
-  race the flow just caught. The one retry in the suite wraps the `openLink` transport in
-  `e2e/shared/open-scenario.yaml` (hosted simulators have timed out inside `simctl openurl`
-  before the app saw anything); a scenario screen or marker that does not appear still
+  race the flow just caught. The one retry in the suite is on the iOS deep-link transport:
+  `e2e/shared/open-scenario.yaml` asks the fixture server to open the link, and the server
+  retries `simctl openurl` when it times out on a hosted simulator (Maestro's own `retry`
+  does not catch that failure); a scenario screen or marker that does not appear still
   fails the flow.
 - Bugfix in an E2E-coverable area ⇒ the PR includes a reproducing flow.
diff --git a/e2e/fixtures/open-link.mjs b/e2e/fixtures/open-link.mjs
new file mode 100644
index 0000000000..34a8c8a356
--- /dev/null
+++ b/e2e/fixtures/open-link.mjs
@@ -0,0 +1,53 @@
+// Opens a scenario deep link on the iOS simulator for a Maestro flow (POST /__open-link,
+// called from e2e/shared/open-link-ios.js), retrying `simctl openurl` when it times out.
+//
+// Why not Maestro's own `openLink`: on a hosted macOS runner `simctl openurl` has timed
+// out (NSPOSIXErrorDomain 60) while the link still arrived seconds later, and Maestro's
+// `retry`/`optional` do not catch that failure (it is not a MaestroException). Only the
+// transport is retried; what the app then shows is asserted by the flow, never retried
+// (the zero-retries rule in e2e/CONTEXT.md).
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+// Deliberately narrower than the app's parser: this value becomes a process argument.
+const SCENARIO_LINK = /^rnvtest:\/\/scenario\/[a-z0-9]+(?:-[a-z0-9]+)*$/;
+
+const SIMULATOR_UDID = /^[0-9A-F]{8}(?:-[0-9A-F]{4}){3}-[0-9A-F]{12}$/i;
+
+// The link from `?url=<link>`, or null unless it is exactly one scenario link.
+export function scenarioLink(requestUrl) {
+  const values = new URL(requestUrl, 'http://x').searchParams.getAll('url');
+  return values.length === 1 && SCENARIO_LINK.test(values[0]) ? values[0] : null;
+}
+
+// The simulator from `&device=<udid>`: undefined when absent, null when not a UDID.
+export function simulatorDevice(requestUrl) {
+  const values = new URL(requestUrl, 'http://x').searchParams.getAll('device');
+  if (values.length === 0 || (values.length === 1 && values[0] === '')) return undefined;
+  return values.length === 1 && SIMULATOR_UDID.test(values[0]) ? values[0] : null;
+}
+
+export async function openLink({
+  link,
+  device = 'booted',
+  xcrun = 'xcrun',
+  attempts = 3,
+  pauseMs = 2000,
+  // simctl's own timeout is ~13 s; this only bounds a hung process.
+  run = (file, args) => execFileAsync(file, args, { timeout: 60_000 }),
+  sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+}) {
+  let error = '';
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    try {
+      await run(xcrun, ['simctl', 'openurl', device, link]);
+      return { ok: true, attempts: attempt };
+    } catch (err) {
+      error = err.message;
+      if (attempt < attempts) await sleep(pauseMs);
+    }
+  }
+  return { ok: false, attempts, error };
+}
diff --git a/e2e/fixtures/open-link.test.mjs b/e2e/fixtures/open-link.test.mjs
new file mode 100644
index 0000000000..efb842bd8e
--- /dev/null
+++ b/e2e/fixtures/open-link.test.mjs
@@ -0,0 +1,109 @@
+import { describe, test, expect } from 'bun:test';
+import { scenarioLink, simulatorDevice, openLink } from './open-link.mjs';
+
+const request = (link) => `/__open-link?url=${encodeURIComponent(link)}`;
+
+describe('scenarioLink', () => {
+  test('accepts a scenario deep link', () => {
+    expect(scenarioLink(request('rnvtest://scenario/mp4'))).toBe('rnvtest://scenario/mp4');
+    expect(scenarioLink(request('rnvtest://scenario/broken-manifest'))).toBe('rnvtest://scenario/broken-manifest');
+    expect(scenarioLink(request('rnvtest://scenario/error-404'))).toBe('rnvtest://scenario/error-404');
+  });
+
+  test('rejects anything that is not exactly a scenario deep link', () => {
+    for (const link of [
+      'https://example.com',
+      'rnvtest://other/mp4',
+      'rnvtest://scenario/',
+      'rnvtest://scenario/mp4/extra',
+      'rnvtest://scenario/mp4?x=1',
+      'rnvtest://scenario/MP4',
+      'rnvtest://scenario/mp4 --help',
+      'rnvtest://scenario/mp4;rm',
+      ' rnvtest://scenario/mp4',
+    ]) {
+      expect(scenarioLink(request(link))).toBeNull();
+    }
+  });
+
+  test('rejects a missing or repeated url parameter', () => {
+    expect(scenarioLink('/__open-link')).toBeNull();
+    expect(scenarioLink('/__open-link?url=')).toBeNull();
+    expect(
+      scenarioLink('/__open-link?url=rnvtest%3A%2F%2Fscenario%2Fmp4&url=rnvtest%3A%2F%2Fscenario%2Fhls')
+    ).toBeNull();
+  });
+});
+
+describe('simulatorDevice', () => {
+  const udid = '7D16E67F-1E34-43CB-BD36-B95CCE24981A';
+
+  test('is undefined when the request names no device', () => {
+    expect(simulatorDevice('/__open-link?url=x')).toBeUndefined();
+    expect(simulatorDevice('/__open-link?url=x&device=')).toBeUndefined();
+  });
+
+  test('accepts a simulator UDID', () => {
+    expect(simulatorDevice(`/__open-link?url=x&device=${udid}`)).toBe(udid);
+    expect(simulatorDevice(`/__open-link?url=x&device=${udid.toLowerCase()}`)).toBe(udid.toLowerCase());
+  });
+
+  test('is null for anything else, including simctl keywords and repeats', () => {
+    for (const device of ['booted', 'all', '--help', `${udid} x`, 'iPhone%2017']) {
+      expect(simulatorDevice(`/__open-link?url=x&device=${device}`)).toBeNull();
+    }
+    expect(simulatorDevice(`/__open-link?url=x&device=${udid}&device=${udid}`)).toBeNull();
+  });
+});
+
+describe('openLink', () => {
+  const link = 'rnvtest://scenario/mp4';
+  const timedOut = Object.assign(new Error('Simulator device failed to open'), { code: 60 });
+
+  // `run` fails `failures` times, then succeeds.
+  function harness(failures) {
+    const calls = [];
+    const pauses = [];
+    return {
+      calls,
+      pauses,
+      run: async (file, args) => {
+        calls.push([file, ...args]);
+        if (calls.length <= failures) throw timedOut;
+      },
+      sleep: async (ms) => void pauses.push(ms),
+    };
+  }
+
+  test('runs `simctl openurl` once when it succeeds', async () => {
+    const h = harness(0);
+    expect(await openLink({ link, run: h.run, sleep: h.sleep })).toEqual({ ok: true, attempts: 1 });
+    expect(h.calls).toEqual([['xcrun', 'simctl', 'openurl', 'booted', link]]);
+    expect(h.pauses).toEqual([]);
+  });
+
+  test('targets the given simulator and xcrun binary', async () => {
+    const h = harness(0);
+    await openLink({ link, run: h.run, sleep: h.sleep, device: 'ABCD-1234', xcrun: '/tmp/fake-xcrun' });
+    expect(h.calls).toEqual([['/tmp/fake-xcrun', 'simctl', 'openurl', 'ABCD-1234', link]]);
+  });
+
+  test('tries again after a failure, pausing in between', async () => {
+    const h = harness(2);
+    expect(await openLink({ link, run: h.run, sleep: h.sleep, pauseMs: 250 })).toEqual({ ok: true, attempts: 3 });
+    expect(h.calls).toHaveLength(3);
+    expect(h.pauses).toEqual([250, 250]);
+  });
+
+  test('gives up after `attempts` failures and reports the last error', async () => {
+    const h = harness(Infinity);
+    expect(await openLink({ link, run: h.run, sleep: h.sleep, attempts: 3 })).toEqual({
+      ok: false,
+      attempts: 3,
+      error: 'Simulator device failed to open',
+    });
+    expect(h.calls).toHaveLength(3);
+    // No pause after the last attempt: nothing follows it.
+    expect(h.pauses).toHaveLength(2);
+  });
+});
diff --git a/e2e/fixtures/serve.mjs b/e2e/fixtures/serve.mjs
index 6491f0a7dc..c4c7d036fe 100644
--- a/e2e/fixtures/serve.mjs
+++ b/e2e/fixtures/serve.mjs
@@ -4,6 +4,7 @@
 import { createServer } from 'node:http';
 import { createReadStream, statSync } from 'node:fs';
 import { join, normalize, extname, resolve } from 'node:path';
+import { openLink, scenarioLink, simulatorDevice } from './open-link.mjs';
 
 const [, , rootArg = 'e2e/fixtures/media', portArg = '8090'] = process.argv;
 const root = resolve(rootArg);
@@ -15,9 +16,43 @@ const TYPES = {
   '.m3u8': 'application/vnd.apple.mpegurl',
 };
 
+const LOOPBACK = new Set(['127.0.0.1', '::1', '::ffff:127.0.0.1']);
+
+// The one route that is not a file: iOS flows open their deep link through here (see
+// open-link.mjs). It runs a process, so it answers loopback only, and only for a scenario
+// link. The simulator comes from `&device=<udid>`, else E2E_SIM_UDID, else the booted one.
+async function handleOpenLink(req, res) {
+  const json = (status, body) =>
+    res.writeHead(status, { 'Content-Type': 'application/json' }).end(JSON.stringify(body));
+
+  if (!LOOPBACK.has(req.socket.remoteAddress)) return json(403, { ok: false, error: 'loopback only' });
+  if (req.method !== 'POST') return json(405, { ok: false, error: 'POST only' });
+  const link = scenarioLink(req.url);
+  if (!link) return json(400, { ok: false, error: 'expected ?url=rnvtest://scenario/<name>' });
+  const device = simulatorDevice(req.url);
+  if (device === null) return json(400, { ok: false, error: 'device must be a simulator UDID' });
+
+  const result = await openLink({
+    link,
+    device: device || process.env.E2E_SIM_UDID || 'booted',
+    xcrun: process.env.E2E_XCRUN || 'xcrun',
+    pauseMs: Number(process.env.E2E_OPEN_LINK_PAUSE_MS || 2000),
+  });
+  console.log(`[fixtures] open-link ${link}: ${JSON.stringify(result)}`);
+  return json(result.ok ? 200 : 502, result);
+}
+
 const server = createServer((req, res) => {
   try {
     const path = decodeURIComponent(new URL(req.url, 'http://x').pathname);
+
+    if (path === '/__open-link') {
+      handleOpenLink(req, res).catch((err) => {
+        console.error(`[fixtures] open-link failed: ${err.message}`);
+        res.destroy();
+      });
+      return;
+    }
     const file = join(root, normalize(path));
 
     if (!file.startsWith(root)) {
diff --git a/e2e/fixtures/serve.test.mjs b/e2e/fixtures/serve.test.mjs
index d5da6fb863..cba5235d22 100644
--- a/e2e/fixtures/serve.test.mjs
+++ b/e2e/fixtures/serve.test.mjs
@@ -1,13 +1,28 @@
 import { test, expect, beforeAll, afterAll } from 'bun:test';
 import { spawn } from 'node:child_process';
+import { chmodSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
 
 const PORT = 8199;
 const BASE = `http://127.0.0.1:${PORT}`;
 let proc;
 
+// Stands in for `xcrun` on the /__open-link route: records its arguments and fails the
+// first call, the way `simctl openurl` times out on a slow runner.
+const fakeDir = mkdtempSync(join(tmpdir(), 'rnv-open-link-'));
+const fakeXcrun = join(fakeDir, 'xcrun');
+const fakeCalls = join(fakeDir, 'calls');
+writeFileSync(
+  fakeXcrun,
+  `#!/bin/sh\necho "$@" >> "${fakeCalls}"\n[ "$(wc -l < "${fakeCalls}")" -gt 1 ] || exit 60\n`
+);
+chmodSync(fakeXcrun, 0o755);
+
 beforeAll(async () => {
   proc = spawn('node', ['e2e/fixtures/serve.mjs', 'e2e/fixtures/media', String(PORT)], {
     stdio: 'ignore',
+    env: { ...process.env, E2E_XCRUN: fakeXcrun, E2E_OPEN_LINK_PAUSE_MS: '10', E2E_SIM_UDID: 'SIM-1' },
   });
   for (let i = 0; i < 50; i++) {
     try {
@@ -20,7 +35,10 @@ beforeAll(async () => {
   throw new Error('server did not start');
 });
 
-afterAll(() => proc?.kill());
+afterAll(() => {
+  proc?.kill();
+  rmSync(fakeDir, { recursive: true, force: true });
+});
 
 test('serves a fixture with the right content type', async () => {
   const res = await fetch(`${BASE}/short.mp4`);
@@ -86,3 +104,37 @@ test('handles open-ended ranges correctly (bytes=N-)', async () => {
   const contentLength = parseInt(res.headers.get('content-length'), 10);
   expect(data.byteLength).toBe(contentLength);
 });
+
+const openLinkUrl = (link) => `${BASE}/__open-link?url=${encodeURIComponent(link)}`;
+
+test('/__open-link opens a scenario link on the simulator, retrying a failed attempt', async () => {
+  const res = await fetch(openLinkUrl('rnvtest://scenario/mp4'), { method: 'POST' });
+  expect(res.status).toBe(200);
+  expect(await res.json()).toEqual({ ok: true, attempts: 2 });
+  expect(readFileSync(fakeCalls, 'utf8')).toBe(
+    'simctl openurl SIM-1 rnvtest://scenario/mp4\nsimctl openurl SIM-1 rnvtest://scenario/mp4\n'
+  );
+});
+
+test('/__open-link refuses anything but a scenario link', async () => {
+  const before = readFileSync(fakeCalls, 'utf8');
+  for (const link of ['https://example.com', 'rnvtest://scenario/mp4 --help', '']) {
+    expect((await fetch(openLinkUrl(link), { method: 'POST' })).status).toBe(400);
+  }
+  expect(readFileSync(fakeCalls, 'utf8')).toBe(before);
+});
+
+test('/__open-link targets the simulator the flow names, and refuses a non-UDID', async () => {
+  const udid = '7D16E67F-1E34-43CB-BD36-B95CCE24981A';
+  const res = await fetch(`${openLinkUrl('rnvtest://scenario/hls')}&device=${udid}`, { method: 'POST' });
+  expect(res.status).toBe(200);
+  expect(readFileSync(fakeCalls, 'utf8').trimEnd().split('\n').at(-1)).toBe(
+    `simctl openurl ${udid} rnvtest://scenario/hls`
+  );
+  const bad = await fetch(`${openLinkUrl('rnvtest://scenario/hls')}&device=booted`, { method: 'POST' });
+  expect(bad.status).toBe(400);
+});
+
+test('/__open-link is POST only', async () => {
+  expect((await fetch(openLinkUrl('rnvtest://scenario/mp4'))).status).toBe(405);
+});
diff --git a/e2e/shared/launch-app.yaml b/e2e/shared/launch-app.yaml
index c11aa5c2f3..2d41aca704 100644
--- a/e2e/shared/launch-app.yaml
+++ b/e2e/shared/launch-app.yaml
@@ -7,8 +7,32 @@
 # nothing opens a scenario before it is visible.
 appId: ${APP_ID}
 ---
-- launchApp:
-    clearState: true
+# Not `launchApp: {clearState: true}`: that starts the app ~0.9 s after `pm clear`, and
+# API 34 kills the package's process when the removed task's 1 s destroy timeout fires,
+# leaving a white screen (details in CONTEXT.md). Maestro has no sleep command; waiting
+# for an id that never exists is the idiom, `optional` makes the timeout a warning.
+- clearState
+- runFlow:
+    when:
+      platform: Android
+    commands:
+      - extendedWaitUntil:
+          visible:
+            id: "e2e-never-rendered-sleep"
+          timeout: 2500
+          optional: true
+- launchApp
+# iOS: a stale "Open in “RNVideoE2E”?" prompt (SpringBoard's, so it survives clearState
+# and launchApp) hides the app from the hierarchy and would fail every flow from here on.
+# Tap Open so the approval sticks, then relaunch to drop the scenario that link opened.
+# Matched on the title, not the button, so a bare "Open" in the app never triggers it.
+- runFlow:
+    when:
+      platform: iOS
+      visible: "Open in .*RNVideoE2E.*"
+    commands:
+      - tapOn: "Open"
+      - launchApp
 # Generous on purpose: this waits for the app to start, not for library behaviour, and a
 # freshly cleared app on a busy emulator or hosted runner has taken 15-18 s to get here.
 - extendedWaitUntil:
diff --git a/e2e/shared/open-link-ios.js b/e2e/shared/open-link-ios.js
new file mode 100644
index 0000000000..d85f672942
--- /dev/null
+++ b/e2e/shared/open-link-ios.js
@@ -0,0 +1,23 @@
+// iOS replacement for Maestro's `openLink`: asks the fixture server (port 8090, see
+// e2e/fixtures/open-link.mjs) to open the link, so a `simctl openurl` timeout is retried.
+//
+// env: LINK; SIM_UDID (optional, which simulator, else the booted one); SOFT=true to log
+// a failure instead of throwing (the warm-up's later steps must still run).
+const device = typeof SIM_UDID === 'undefined' ? '' : SIM_UDID;
+const soft = typeof SOFT !== 'undefined' && SOFT === 'true';
+let failure = '';
+let attempts = 1;
+try {
+  const response = http.post(
+    'http://localhost:8090/__open-link?url=' + encodeURIComponent(LINK) + '&device=' + encodeURIComponent(device),
+    { body: '' }
+  );
+  if (response.ok) attempts = json(response.body).attempts;
+  else failure = 'open-link failed: HTTP ' + response.status + ' ' + response.body;
+} catch (error) {
+  failure = 'open-link failed: ' + error;
+}
+if (failure && !soft) throw new Error(failure);
+// console.log lands in maestro.log next to the flow.
+if (failure) console.log(failure);
+else if (attempts > 1) console.log('open-link needed ' + attempts + ' attempts for ' + LINK);
diff --git a/e2e/shared/open-scenario.yaml b/e2e/shared/open-scenario.yaml
index 7792095525..a1d6a21766 100644
--- a/e2e/shared/open-scenario.yaml
+++ b/e2e/shared/open-scenario.yaml
@@ -1,16 +1,25 @@
 # Shared by every flow (via runFlow): opens the scenario deep link and waits for its
 # screen. Lives outside e2e/flows/ so `maestro test e2e/flows/` never runs it on its own.
 #
-# The retry wraps ONLY the openLink transport: on a hosted macOS runner `simctl openurl`
-# itself has timed out (NSPOSIXErrorDomain 60, "Simulator device failed to open") before
-# the app saw anything. Nothing the flows assert on is retried — a marker that does not
-# appear still fails the flow, so the zero-retries rule for the library's behaviour holds.
+# Android uses Maestro's `openLink`. iOS goes through the fixture server (open-link-ios.js),
+# which retries `simctl openurl` when it times out on a hosted runner - Maestro's `retry`
+# does not catch that failure. Only the transport is retried: a marker that does not
+# appear still fails the flow (zero-retries rule, CONTEXT.md).
 appId: ${APP_ID}
 ---
-- retry:
-    maxRetries: 2
+- runFlow:
+    when:
+      platform: Android
     commands:
       - openLink: rnvtest://scenario/${SCENARIO}
+- runFlow:
+    when:
+      platform: iOS
+    commands:
+      - runScript:
+          file: open-link-ios.js
+          env:
+            LINK: rnvtest://scenario/${SCENARIO}
 # iOS can ask "Open in app?" for the first link; the iOS leg pre-approves it in a warm-up
 # flow, so this normally gives up after 1.5 s. Android never asks.
 - runFlow:
diff --git a/e2e/warmup/ios-approve-open-link.yaml b/e2e/warmup/ios-approve-open-link.yaml
index b28d525bb4..b76b69dffc 100644
--- a/e2e/warmup/ios-approve-open-link.yaml
+++ b/e2e/warmup/ios-approve-open-link.yaml
@@ -16,7 +16,12 @@ appId: ${APP_ID}
       id: "e2e-host-ready"
     timeout: 30000
     optional: true
-- openLink: rnvtest://scenario/mp4
+# Same transport as the real flows. SOFT: a failed open must not skip the tap below.
+- runScript:
+    file: ../shared/open-link-ios.js
+    env:
+      LINK: rnvtest://scenario/mp4
+      SOFT: 'true'
 - extendedWaitUntil:
     visible: "Open"
     timeout: 5000
diff --git a/scripts/e2e/junit-summary.mjs b/scripts/e2e/junit-summary.mjs
index c627c71951..1cfce040eb 100644
--- a/scripts/e2e/junit-summary.mjs
+++ b/scripts/e2e/junit-summary.mjs
@@ -26,14 +26,31 @@ function attribute(attrs, name) {
   return match ? decodeXmlEntities(match[1]) : '';
 }
 
+// Maestro 2.10 writes the reason as the element's text, not the JUnit `message`
+// attribute. The attribute wins when both are present (the text is then a stack trace).
+// Quoted attribute values may contain ">", so they are skipped as a unit.
+const FAILURE_RE = /<(?:failure|error)\b((?:[^>"]|"[^"]*")*?)(?:\/>|>([\s\S]*?)<\/(?:failure|error)>|>)/;
+
+const MAX_BODY_MESSAGE = 300;
+
+// First line only: a body is often a stack trace, and the summary is capped at 1 MiB.
+function elementText(inner) {
+  const text = inner
+    .split(/(<!\[CDATA\[[\s\S]*?\]\]>)/)
+    .map((part) => (part.startsWith('<![CDATA[') ? part.slice(9, -3) : decodeXmlEntities(part)))
+    .join('');
+  const firstLine = text.trim().split(/\r?\n/, 1)[0].trim();
+  return firstLine.length > MAX_BODY_MESSAGE ? `${firstLine.slice(0, MAX_BODY_MESSAGE - 1)}…` : firstLine;
+}
+
 export function parseJUnit(xml) {
   const cases = [];
   for (const [, attrs, , body = ''] of xml.matchAll(CASE_RE)) {
-    const failure = /<(?:failure|error)\b([^>]*)/.exec(body);
+    const failure = FAILURE_RE.exec(body);
     cases.push({
       name: attribute(attrs, 'name'),
       failed: failure !== null,
-      message: failure ? attribute(failure[1], 'message') : '',
+      message: failure ? attribute(failure[1], 'message') || elementText(failure[2] ?? '') : '',
     });
   }
   return {
diff --git a/scripts/e2e/junit-summary.test.mjs b/scripts/e2e/junit-summary.test.mjs
index a3a3bec4f6..b4303f41bf 100644
--- a/scripts/e2e/junit-summary.test.mjs
+++ b/scripts/e2e/junit-summary.test.mjs
@@ -49,6 +49,52 @@ describe('parseJUnit', () => {
     });
   });
 
+  // Maestro 2.10 writes the reason as the element's text, not as a `message` attribute:
+  // <failure>Assertion is false: id: evt-muted is visible</failure>
+  describe('failure text in the element body', () => {
+    const body = (inner) => parseJUnit(oneCase(inner)).cases[0].message;
+
+    test('is the message when there is no message attribute', () => {
+      expect(body('<failure>Assertion is false: id: evt-muted is visible</failure>')).toBe(
+        'Assertion is false: id: evt-muted is visible'
+      );
+      expect(body('<error>crashed</error>')).toBe('crashed');
+    });
+
+    test('is entity-decoded and trimmed', () => {
+      expect(body('<failure>\n  text &quot;Play&quot; &amp; &lt;b&gt;\n</failure>')).toBe('text "Play" & <b>');
+    });
+
+    test('is read verbatim from CDATA', () => {
+      expect(body('<failure><![CDATA[a < b &amp; c]]></failure>')).toBe('a < b &amp; c');
+    });
+
+    test('joins several CDATA sections and the text around them', () => {
+      expect(body('<failure>a &amp; <![CDATA[b < c]]> d <![CDATA[&amp;]]></failure>')).toBe('a & b < c d &amp;');
+    });
+
+    test('keeps only the first line, capped, of a long body such as a stack trace', () => {
+      expect(body('<error>java.lang.IllegalStateException: boom\n\tat a.b(C.kt:1)\n\tat d.e(F.kt:2)</error>')).toBe(
+        'java.lang.IllegalStateException: boom'
+      );
+      const long = body(`<failure>${'x'.repeat(1000)}</failure>`);
+      expect(long).toHaveLength(300);
+      expect(long.endsWith('…')).toBe(true);
+    });
+
+    test('loses to a message attribute', () => {
+      expect(body('<failure message="short">long stack trace</failure>')).toBe('short');
+    });
+
+    test('an empty element still counts as a failure with no message', () => {
+      expect(parseJUnit(oneCase('<failure></failure>')).cases[0]).toEqual({ name: 'f', failed: true, message: '' });
+    });
+  });
+
+  test('a ">" inside the message attribute does not cut the message short', () => {
+    expect(parseJUnit(oneCase('<failure message="a > b" type="x">trace</failure>')).cases[0].message).toBe('a > b');
+  });
+
   test('an empty document has no cases', () => {
     expect(parseJUnit('')).toEqual({ total: 0, failures: 0, cases: [] });
   });
diff --git a/test-app/ios/Podfile b/test-app/ios/Podfile
index db7a71c2cd..9167f75607 100644
--- a/test-app/ios/Podfile
+++ b/test-app/ios/Podfile
@@ -22,5 +22,40 @@ use_test_app!(
         config.build_settings['CLANG_CXX_LANGUAGE_STANDARD'] = 'c++17'
       end
     end
+
+    # RN 0.82: the NitroModules Swift compile builds the `fmt` clang module with C++20 and
+    # fails on consteval ("could not build module 'fmt'"). fmt 11.0.2 has no override for
+    # FMT_USE_CONSTEVAL, so turn it off in the installed header. No-op without the pod
+    # (RN 0.87 links the prebuilt core).
+    fmt_base = File.join(installer.sandbox.root, 'fmt', 'include', 'fmt', 'base.h')
+    if File.exist?(fmt_base)
+      source = File.read(fmt_base)
+      patched = source.gsub(/^(#\s*define FMT_USE_CONSTEVAL) 1$/, '\1 0')
+      if patched != source
+        File.chmod(0644, fmt_base)
+        File.write(fmt_base, patched)
+      end
+    end
+
+    # Same module build, next stop glog: logging.h includes log_severity.h and vlog_is_on.h
+    # inside `namespace google`, and with `module * { export * }` each is a submodule, which
+    # clang rejects ("import of module ... appears within namespace 'google'"). Textual
+    # headers are plain includes again.
+    glog_modulemap = File.join(installer.sandbox.target_support_files_root, 'glog', 'glog.modulemap')
+    if File.exist?(glog_modulemap)
+      source = File.read(glog_modulemap)
+      unless source.include?('textual header')
+        textual = %w[log_severity vlog_is_on].map { |h| %(  textual header "glog/#{h}.h"\n) }.join
+        File.write(glog_modulemap, source.sub(/^(\s*umbrella header .*\n)/) { "#{$1}#{textual}" })
+      end
+      # `pod install` rewrites this file each run; a fresh mtime makes clang rebuild the
+      # glog module and everything importing it, defeating the DerivedData cache. Pin the
+      # mtime to a file that comes out of the Pods cache unchanged.
+      stamp_source = File.join(installer.sandbox.root, 'glog', 'src', 'glog', 'logging.h.in')
+      if File.exist?(stamp_source)
+        stamp = File.mtime(stamp_source)
+        File.utime(stamp, stamp, glog_modulemap)
+      end
+    end
   end
 )