[beruro]

Problem

The current ORG2 Remote iOS experience is only present in an uncommitted development worktree. Its session recovery, speech input, image handling and tool/diff inspection rely on shared UI and desktop bridge changes that must travel with the client. The existing iOS release job also lacks an explicitly selected Xcode 26 toolchain and a verified manual distribution-signing path.

Solution

Capture the current mobile Remote feature and its required desktop/shared dependencies in a reproducible branch. Include native speech, account/device/session recovery, read-state coordination, permissions, images, tool details and change review. Exclude unrelated desktop diff, sidebar grouping and dev-server fixes.

Align the iOS Tauri crate with the frontend API, bundle the audited privacy manifest and encryption declaration, and prepare explicit manual archive/export settings in an isolated signing keychain. Keep the existing environment reviewers, allowed branches and reviewed-SHA upload gate. Validate the exported IPA before retaining or uploading it.

Potential risks

This is a large mobile feature snapshot, including desktop RPC, permission and read-state dependencies. The client needs a compatible desktop build; cross-version and production relay compatibility are not fully verified. Real-device login, voice, pairing, account deletion, offline recovery and background lifecycle acceptance remain outstanding.

Actual Apple Distribution archive/export has not run: protected credentials are only available on the approved branches and require environment approval. Signing scripts have local structural tests, not live credential verification. Privacy labels and service retention practices still require account-owner review. App Store screenshots and final privacy-policy copy are not completed by this PR.

The desktop rustls lock entry is updated from 0.23.40 to 0.23.45 to address CI advisory RUSTSEC-2026-0285 without changing its dependency graph. Reverting that entry restores a known vulnerable version. The Tauri dependency update changes the iOS lockfile. Rollback requires reverting the mobile crate and frontend API alignment together; reverting only the crate would restore the CLI version mismatch. No database migration or destructive data cleanup is included. Disable the manual release workflow to stop subsequent candidates; do not reuse an uploaded build number.

Verification

• pnpm test src/modules/MobileRemote: 92 files, 701 tests passed after rebasing onto the latest develop plus fix(search-input): accept nullable shared refs #1824
• NODE_OPTIONS=--max-old-space-size=6144 pnpm exec tsc --noEmit --pretty false: passed again after rebase with the nullable-ref prerequisite from fix(search-input): accept nullable shared refs #1824
• pnpm test src/components/SearchInput/SearchInput.test.ts: 2 tests passed for that prerequisite
• NODE_OPTIONS=--max-old-space-size=6144 pnpm build:mobile-native: passed
• cargo check --locked --manifest-path apps/remote-ios/src-tauri/Cargo.toml --target aarch64-apple-ios: passed
• node --test scripts/ios-release/*.test.mjs: 25 tests passed
• Workflow YAML parsing, all shell blocks syntax checks and git diff --check: passed
• The original source snapshot built and launched on an iPhone 17 Pro Max simulator to the login page; the app-root privacy manifest matched the source. This does not verify a distribution IPA or post-login behavior
• Focused UI control audit: 0 fix, 5 keep-with-reason, 0 abstract. Full-device visual and accessibility evidence remains outstanding

Prerequisite #1824 has merged; this PR now targets develop. The final feature commit resolves the mobile stop-confirmation translation conflicts without duplicate keys. Mobile tests, frontend build, native cargo check and all 25 signing tests were rerun successfully after rebase. Normal commit hooks passed lint-staged and TypeScript checks; the scoped Rust hook accepted the changed files but reported unrelated Rust warnings, so this is not a clean full-workspace Clippy result. CI follow-up splits the overlong provider into context/state, authenticated handshake, notification and session-action owners; reuses socket wait helpers and removes three dead connection helpers. RPC availability is published in React state, background promise rejections are handled, and unnecessary Rust borrows/clones are removed. No quality baseline was increased.

• pnpm test src/hooks/voice src/modules/MobileRemote src/store/session/__tests__/desktopReadStateBridge.test.ts: 99 files / 716 tests passed, including native speech cleanup rejection after unmount
• pnpm exec tsgo --noEmit --pretty false: passed after provider extraction
• git diff --cached --name-only --diff-filter=ACMR -z | node scripts/ci/check-changed-file-length.cjs: all 16 changed TypeScript files within 700 lines
• Mobile native production frontend build passed after extraction
• NODE_OPTIONS=--max-old-space-size=6144 pnpm check:typed-lint: final rerun passed with 0 new or increased findings
• node scripts/tauri/prepare-sidecars.cjs --profile debug followed by cargo clippy --manifest-path src-tauri/Cargo.toml --workspace --all-targets -- -D warnings: passed; no warnings after preparing the real desktop sidecar
• Local cargo audit could not run because the tool is not installed; GitHub Rust (cargo audit) passed on commit 0b1de71 with the updated lockfile

The frontend CI subsequently exposed 24 obsolete mobile translation keys and missing chat.draftTooLong translations in 11 locales. Removed unused keys in both mobile locales, added the translations, and updated locale tests to assert the current product labels. pnpm check:i18n-keys passed with zero new findings or locale gaps; pnpm test src/modules/MobileRemote/mobileI18n.test.ts passed all 7 tests. Final CI rerun pending on 69d1e84.

No TestFlight upload or App Review submission has occurred.