진재명의 블로그

Skewers at Sutnom Kkochigui in Yeonsan-dong: tasty and good value

Wed, 30 Sep 2026 10:50:00 GMT

After makchang at Yeonmakchang Yeonsan, I came here for a second round at about 9 on a Wednesday night. I was already full, so I picked it to eat lightly on skewers. It is an izakaya that serves skewers, and I am told you see it straight ahead at the end of the alley on the Wellness Hospital side.

We ordered just the assorted skewers, 10 kinds.

The ingredients vary. One skewer has tomato in it, and one is wrapped in chives. The seasoned skewer comes separately on a small dish with mayonnaise.

It tasted good, and it felt worth the price. Around the time I first wrote this visit up on my Naver blog, the menu posted on the map listed the medium assorted skewers at 35,000 won and the large, with 15 kinds, at 45,000 won.

Next time I plan to start the evening here. I want to order other dishes then, such as okonomiyaki or fish cake soup.

Jjaekjjaek Coffee in Gohyeon, Geoje: a warehouse-like room to rest in

Tue, 29 Sep 2026 12:00:00 GMT

After lunch in Geoje we thought about where to go next and decided on a cafe. My friend, who was traveling from another city, found the place. It was about 12:30 on a Saturday. There is also a Jisimdo Hoetjip note from the same day.

Jjaekjjaek Coffee is in Gohyeon. I am told it is about 5 minutes by car from Gohyeon Bus Terminal, or 15 to 20 minutes on foot.

The outer wall has the word Nonghyup on it. It looked like a Nonghyup warehouse turned into a cafe. I liked how the inside was decorated. I would recommend it to anyone who wants to spend time at ease.

I ordered an americano. It is 4,500 won. The taste was fine.

While drinking I spilled a little coffee. Cleaning it up took some effort.

The special set at Jisimdo Hoetjip in Geoje: many dishes, but lacking

Tue, 29 Sep 2026 09:20:00 GMT

A friend from another city and I were talking about where to go and went to Geoje on a whim. It was about 11 on a Saturday morning. We were hungry and searched for a raw fish restaurant, but not many were open. I think it was because of the early hour. We found one that opens at 11 and went in. I wrote about the cafe we visited the same day in the Jjaekjjaek Coffee note.

It is next to the Jangseungpo community center, across from the Jisimdo ticket office, on the second floor.

We ordered the Jisimdo special set. It comes with raw fish, sushi, grilled fish, and fried food.

There are many dishes. But for me the selection and the amount fell short. That is how it looks next to a neighborhood raw fish place in Busan.

Travelers may find it fine. The friend I went with seemed fairly satisfied.

Triploid oysters at Haerujil Gwangalli: big and tasty

Tue, 29 Sep 2026 07:40:00 GMT

I had wanted to try this place since around the time it opened. A friend and I went at about 7:40 on a Friday evening. I am told you head toward Gwangalli Beach from Geumnyeonsan Station. At about 9 that night we were at Joseph.

There were many guests, and I worried whether we could get in. Luckily two seats were left in a corner, and we took them. The menu says you must order at least 25,000 won, not counting alcohol.

I had never had triploid oysters, so we ordered the two-piece plate. It was 15,000 won. Around the time I first wrote this visit up on my Naver blog, the menu posted on the map listed it at 16,000 won.

The oysters were big and tasty. Each comes with one slice of lemon on top. All the seafood was fresh and tasty. I plan to drop by now and then when I am in Gwangalli and there is no line.

We also ordered the sweet shrimp and ankimo set. It is 25,000 won.

Sweet shrimp, seaweed, and wasabi come on one plate. I think my friend felt like having ankimo that day.

Crab-marinade sashimi at Sarangppang in Namcheon-dong: worth one visit

Tue, 29 Sep 2026 07:00:00 GMT

I found this place on social media. A friend came to Busan from another city, so I booked ahead and we went together at about 6 on a Friday evening. It serves seafood dishes in Namcheon-dong. It is on the second floor above Gimbap Maeul, on the way from Namcheon Station toward Haebyeon Market. Haerujil Gwangalli is another place I wrote up from this day.

The place was crowded, and many people were waiting. Without a reservation it would have been hard to get in. The reservations seemed to be full as well.

We had the special female crab marinade sashimi. You wrap the raw fish together with the marinated crab and eat it.

The taste was fine. I liked how the room was decorated. I also liked that the menu is built on seafood I do not often see elsewhere, such as crab, shrimp, and razor clams.

It is worth one visit. Next time I want to try the razor clams.

Animal Forest, an animal cafe in Gwangalli: even a pig and a chicken

Tue, 29 Sep 2026 05:10:00 GMT

At about 4:30 on a Friday afternoon, I went to Animal Forest with a friend from another city. It was during the Children's Day holiday. It is an animal cafe on the 6th floor of the corner building on the sea side of Millak Subyeon-ro in Gwangalli. The place we went to that evening is Sarangppang.

It is less a place to order food than a place you enter with a ticket. Around the time I first wrote this visit up on my Naver blog, the map listed it at 14,000 won for 90 minutes. I am told children under 18 months get in free after their documents are checked. A snack for the animals is 2,000 won per kind, and they also sell snack sets by course.

The cats and dogs were resting at ease.

We could see a pig up close too. You can also try holding a white chicken on your arm. There are not only unfamiliar animals but familiar pets as well, and there are several animals you can touch.

I recommend it to anyone who wants to try something different. You can park in the basement, and cars enter from behind the building.

There were many children that day. I think it was because of the holiday. I wonder whether there are fewer people on other days.

Yeonhwa-ri Haenyeochon in Gijang: a great 30,000 won seafood platter

Tue, 29 Sep 2026 03:40:00 GMT

A family member had a day off, so we went to Gijang to eat together. It was about 3 on a Monday afternoon. My family member and I both like seafood and have similar tastes.

Seafood stalls are gathered along Yeonhwa 1-gil in Gijang-eup. The area is called Yeonhwa-ri Haenyeochon. I am told there are several stalls run by women divers and that they change places with the season. We went to Manseong Ajumma, the one my family knows well.

As I see it, the prices and what you get are about the same at each stall. So you can simply pick one with a free window seat that looks out on the sea. We sat at a window with a sea view too.

We ordered the small assorted seafood for 30,000 won. Sea squirt, abalone, shrimp, and other seafood come on one tray. The menu lists the largest size at 70,000 won.

I was very happy to get this much for this price. Compared with other haenyeo villages in Busan, I think it is cheaper and the selection is better. That is my personal comparison.

The abalone porridge is served in a pot. It is 12,000 won per person, and the minimum order is two servings. We ordered two. It arrives in the pot and each person ladles out a portion.

The menu says cards cannot be used. As far as I know, all the stalls close in summer and reopen in autumn. It is a long way to go, but I recommend it to anyone who wants to eat seafood while looking at the sea.

After the meal we moved to Cafe 824 and had mango shaved ice.

Yeonmakchang in Yeonsan-dong: pre-grilled makchang, clean taste

Tue, 29 Sep 2026 01:40:00 GMT

I wanted makchang. At about 7 on a Wednesday evening I met a friend after work and we went to Yeonmakchang Yeonsan. I do not come to Yeonsan-dong often.

The place was nearly full. A little later and we would have had to wait.

We ordered makchang first. It comes pre-grilled, so you grill it on the plate right away and eat it.

The taste was clean. There was hardly any smell, so it was easy to eat. The staff were kind too.

While eating the makchang we added one order of flame-grilled spicy chicken feet.

After eating here we moved on to Sutnom Kkochigui.

Lee Jae-mo Pizza in Seomyeon: I am not sure it is worth the line

Mon, 28 Sep 2026 23:30:00 GMT

At about 5 on a Tuesday afternoon I was in Seomyeon on another errand and saw the Lee Jae-mo Pizza sign. About 20 years ago I went to the main store often. I had heard that the taste changed after they switched cheese and that people think less of it now, so I went in to see how different it is.

I like pizza right out of the oven, so I chose to eat in. I ordered the Lee Jae-mo Crust.

I ate about two slices and took the rest home. The taste did not leave much of an impression. I could not really tell what had changed from before either.

It is not bad. But I doubt it is worth standing in a long line for. I also wondered whether visitors expect too much. I am someone who does not find Sungsimdang special either, so it may just be my taste. I do not think people who live in Busan would wait in line for it.

I would come here only if a friend asked to go. Domino's cheese pizza suits me better.

A glass of Yoichi at Acorn in Suyeong: a smooth end to the night

Mon, 28 Sep 2026 22:10:00 GMT

At about 8 on a Saturday night, after the second stop at Tansuho, I went to Acorn as the third. I wanted to end the day's drinking with one glass of whisky. There is also a note from my visit on April 16.

That day I had Yoichi single malt. It is a Japanese whisky.

It was smooth. The owner is kind, so it is a good place to end a night of drinking over a conversation. I talked with the owner for a while and then went home.

I also like Yamazaki and Kavalan. Next time I plan to try those two. The menu posted on the map lists highballs at 11,000 won and cocktails at 15,000 won. I came once more in August as well.

Mango shaved ice at Cafe 824 in Gijang, on a terrace by the sea

Mon, 28 Sep 2026 13:10:00 GMT

After seafood at Gijang Haenyeochon, my family and I moved to a cafe. It was about 4 on a Monday afternoon. Cafe 824 is on Gijang Haean-ro, and we sat at an outdoor terrace table with a view of the sea.

The surroundings were quiet. There were not many guests, so it felt relaxed and still. I think that was because it was a weekday during the day.

We ordered the signature mango shaved ice. It is for two. Large pieces of mango, scored with a knife, sit on top, and the red beans come separately in a small dish.

The shaved ice was good. Still, the main reason I recommend this cafe is the view from the seats that face the sea.

I was the driver that day. The weather was so nice that I felt like going fishing and having a drink. About a month later I came once more with a friend.

Corning in Gwangan-dong: gelato with a glass of white wine

Mon, 28 Sep 2026 12:00:00 GMT

A friend came to Busan from another city. At about 3 on a Friday afternoon, with good weather, we stopped by Corning together. It is a cafe that sells gelato and wine by the glass. We also dropped by Animal Forest that day.

It sits inside the alleys on the way down from Gwangan Station to the beach. I am told you turn into an alley twice from the station exit.

I picked a glass of white wine. Wine by the glass costs 9,000 won, red or white. We added a cold coffee and gelato. Gelato costs 7,000 won if you pick two flavors and 9,000 won if you pick three.

The gelato was fine. I liked the feel of the place more. The room is stylish. On a day with good weather you can sit at the outdoor tables too. I got the impression that many of the guests were couples.

I recommend this cafe to people who like this kind of room. At our seat was a sheet for a collaboration menu offered for five days only (May 1 to 5). It had a lemon à la mode and a few pound cakes on it.

Aged kimchi gimbap at Tansuho in Mangmi: good food, nice room

Mon, 28 Sep 2026 10:30:00 GMT

After the first stop at Ijo Sutbul Galbi, my younger companion and I moved to Tansuho at about 7 on a Saturday evening. It is a Korean restaurant close to the KT Suyeong branch.

It looks like a place that usually has a long line, but that day we walked right in without waiting. I think we were lucky. They take reservations too.

I liked the decoration and the feel of the room. A baseball player's autograph hangs on the wall. I guessed that players may come here often.

What I ate that day was the aged kimchi gimbap.

I liked the food. The menu here seems to change often with the season. The aged kimchi gimbap also seemed to be off the menu around the time I wrote this up.

The menu had an octopus and aged kimchi carpaccio. The oyster bossam seems to be sold when oysters are in season. Next time I want to try those two.

From here we went to Acorn and finished with a glass of whisky.

Ijo Sutbul Galbi in Mangmi Market: cheap pork belly grilled outdoors

Mon, 28 Sep 2026 09:30:00 GMT

At about 5:30 on a Saturday evening, the younger companion I was with suggested it, and we went to Ijo Sutbul Galbi as the first stop of the day. It is inside Mangmi Jungang Market.

We ate at an outdoor table. Even at that hour there were quite a few guests, many of them young. I wondered whether it is because outdoor tables are in fashion these days. I also got the impression that people who live nearby come often.

We ordered fresh pork belly. The menu lists it at 9,000 won for 130 g. Several side dishes come with it.

The price felt low. Grilling outdoors also meant the smoke bothered me less. The staff who served us were kind. The menu also lists pork ribs at 9,000 won for 130 g and a soybean paste stew, ordered after the meat, at 2,000 won.

There was a cat shelter among the stacked boxes, and I saw a cat too. It is a good place to grill meat outdoors on a clear day, so I plan to go again when the weather is good.

After eating here we went to Tansuho.

All-you-can-eat skewers and hot pot at Yangyang near PNU: fair value

Mon, 28 Sep 2026 07:20:00 GMT

My friend wanted malatang and lamb skewers, and my friend also found the place. At about 6 on a Thursday evening we went to Yangyang Yangkkochi near Pusan National University. It is on the second floor, and there is no parking. It has no regular closing day.

It is an all-you-can-eat place for skewers and hot pot. They also sell skewers only or hot pot only. We chose the combined skewers and hot pot, at 24,000 won per person.

You bring the skewers and hot pot ingredients yourself from the self-service bar. The skewers turn on their own over the charcoal as they cook.

Because it is cheap, I did not expect much from the taste. It turned out to be fine. For this price the offer makes sense. Since you fetch things yourself, I ate at ease without feeling watched.

It is worth a visit when you want hot pot or lamb skewers near PNU without spending much. I remember that we ate quite a lot. The cup for used skewers filled up.

Joseph, a bar in Gwangalli: Macallan 12 at a candlelit bar seat

Mon, 28 Sep 2026 06:00:00 GMT

Joseph is a bar in Gwangalli that I like. When I am in Gwangalli I end up coming here. That day, at about 9 on a Tuesday night, my friend and I stopped by as the third place, after the second round at Izakaya Yasumu Gwangan.

I am told it is behind Pascucci, across from the Haman parking lot. The room is dim, with candles lit here and there. We sat at the bar.

I chose Macallan 12.

The friend I was with does not drink, so my friend ordered a non-alcoholic cocktail. I went back on May 1, and once more in July of the same year.

Half-and-half platter at Izakaya Yasumu Gwangan: tasty, good value

Mon, 28 Sep 2026 05:00:00 GMT

We had pork for the first meal at Durumi Gwangan and then walked along Gwangalli Beach to help it settle. After that my friend and I went into Izakaya Yasumu Gwangan for a second round. It was about 8 on a Tuesday night.

I am told it is across the street from Lucky Sanghoe Gwangan, in the building next to Millak Silbi. A staff member led us to the one table that was left. The other tables were said to be reserved.

The interior is nicely decorated. I thought it suits couples on a date more than a group of friends.

We ordered the half-and-half platter. It comes with raw beef sashimi and salmon sashimi, and the menu posted on the map lists it at 37,000 won.

White mist rose from under the plate. I think they used dry ice. It tasted good, and the price felt low. I was full, though, and could not eat much. I think it was because I had eaten just before.

I hear the signature dish here is handmade yakitori. After the meal we moved on to Joseph.

Pork belly and fried rice at Durumi Gwangan: worth standing in line

Mon, 28 Sep 2026 03:30:00 GMT

At about 5 on a Tuesday afternoon, a friend and I went to Durumi Gwangan as the first stop of the day. I am told it is in an alley about a 5-minute walk toward the sea from exit 3 of Geumnyeonsan Station.

The Durumi main store in Jeonpo has a long line and is hard to get into. At the Gwangan branch, I think getting in is easier than at the main store if you come at opening time.

The table was a little greasy. It is a barbecue place, so I let it pass.

We first ordered the Jeju premium pork belly. A staff member explains and grills it for you. I liked the way they explained things.

Next we had the Hwangje rib meat.

Among the pork barbecue places I have been to in Busan, I think this is one of the tastier ones. I could see why it is so popular. If there is no line, or you have time to wait, I would recommend it.

The last dish was fried rice. I suggest you order it.

After the meal we walked along Gwangalli Beach and then went to Izakaya Yasumu Gwangan.

Acorn, a whisky bar in Suyeong: easy even for a first-timer

Mon, 28 Sep 2026 01:10:00 GMT

After the first stop at Baeksu Nongwon, a friend and I came here for a second round. It is a whisky bar recommended by a close acquaintance, and we went at about 8:30 on a Thursday night.

From the McDonald's at Suyeong Station, go into the alley on the right and head straight toward Daiso. I am told it is easy to find. Whisky bottles line the inside, and the room is small. Seats may run out, so it is better to ask before you go.

I ordered an Old Fashioned. I enjoyed it.

My friend had Bunnahabhain 12.

The owner is kind and cheerful. They recommend whisky to people who do not know it well, and they sell beer too. So I felt it is a place even a first-timer can visit comfortably.

On the menu posted on the map, cocktails are listed at 15,000 won and highballs at 11,000 won, and whisky is listed with variable pricing. I wrote about going back on the 25th of the same month in my April 25 visit note, and I went once more in August.

Pork belly at Baeksu Nongwon in Suyeong: a fair place for a quick stop

Sun, 27 Sep 2026 23:50:00 GMT

A close younger friend suggested it, so at about 7 on a Thursday evening we went to Baeksu Nongwon. It is a barbecue restaurant I have been to before, mostly with this same friend. It is a suitable place to drop by without much thought.

The hall is large. In my experience I have rarely had to wait. It is on the exit 11 side of Suyeong Station, and the entrance is lit up.

We ordered the Korean pork belly. It is 11,500 won for 130 g. Several side dishes come with it.

The quality of the meat was fair. So was the service. That day we had only pork belly and kept the first stop short. I have a separate note from another visit in August.

The A set at Michin Makchang in Dongnae: not much smell, easy to eat

Sun, 27 Sep 2026 22:20:00 GMT

At about 7 on a Tuesday evening I met a friend I have known since university, after my friend got off work. While choosing where to eat, we saw a makchang place that looked newly opened and went in. I do not know when it actually opened.

Come out of exit 4 of Dongnae Station, cross at the crosswalk, and go into the alley.

The menu was neatly organized. We ordered the A set, which comes with both salted and seasoned makchang.

The makchang did not have much of an unpleasant smell and was easy to eat. I would recommend it as a place for makchang.

We finished with pork skin. Lately I have seen the place full several times.

Kalmat Hoetjip: grunt sold out, a pricier fish at no extra charge

Sun, 27 Sep 2026 13:20:00 GMT

This is the first place I think of when I want sashimi. It is my favorite raw fish restaurant in Busan, and I have been going for almost 20 years. I went with a friend at about 4 on a Saturday afternoon. The restaurant opens at 4, and sometimes they let you in earlier.

Ordering here is by fish, one kind at a time. They sometimes accept a request to mix, so that day I asked for striped jack (shima-aji) and grunt together. I was told the grunt was sold out. They swapped in dot-benjari and did not charge extra. The menu says dot-benjari costs 10,000 won more than grunt. I felt lucky to eat a fish I had not expected.

The two fish together came to 70,000 won.

Corn cheese is a side dish that comes as standard. Special cuts also came on a small plate.

The regular assorted sashimi is fine too. I especially like what goes into the premium sashimi, though, so I suggest the premium to anyone who goes. If you can match the hours, it is worth a visit.

I wrote about going back in July in my July visit note.

Charcoal chicken with chives at Ondaljip in Dongnae: good with soju

Sun, 27 Sep 2026 12:20:00 GMT

At about 7 on a Friday evening, timed to when my friend got off work, we met at Ondaljip Dongnae. I have come here with this friend before. The restaurant grills chicken over charcoal and is on the exit 4 side of Dongnae Station.

We ordered what we always do: the charcoal-grilled chicken with chives. The cut is chicken thigh, and it is 14,000 won.

The two of us drank two bottles of Chamisul. We had the chicken alongside the soju. I have a separate note from another visit in August.

Daebak Donkkaseu in Mandeok: big portions, prices not what they were

Sun, 27 Sep 2026 09:40:00 GMT

I had not eaten pork cutlet for a while and started craving it, so I went at about 3 on a Thursday afternoon. I lived in Mandeok for a long time. I have known this place since it was in an alley inside Mandeok Market.

After a short appearance on the pork cutlet episode of a TV food show, it got more guests, and then it moved out of the market to its current building. People still line up after the move.

I had the pork cutlet with rice. A small serving of hand-pulled dough soup comes with the cutlet.

What stands out here is the generous portion. It is closer to a neighborhood restaurant than a place you travel to for outstanding taste.

Here is one way to handle the large portion. Ask for the sauce on the side, eat about half, then ask for a container and take the rest home. Of course, if you can finish it alone, eating it all there is better.

I remember the dough soup being refilled without limit when the place was in the market. Now it seems to be served once, but that is my guess from what I saw.

When I want Korean-style pork cutlet there are few other places nearby, so I do expect to go again. But it used to be a place that was easy on the wallet. As I remember it, the cutlet costs more than twice what it did before the move. I used to order the cutlet with spicy chewy noodles, and now that combination comes to more than 20,000 won. So I have gone less often since the move.

The set at Ninano in Jeonpo: my friend picks the kimchi tuna gimbap

Sun, 27 Sep 2026 08:40:00 GMT

After the first stop at Paldak Paldak Hoetjip, my friends and I moved to Ninano Jeonpo at about 6 on a Saturday evening. A friend who had been there before suggested it. I gather that friend liked it. It is a bar on the second floor of a building on the exit 6 side of Jeonpo Station.

A basic side dish comes before the food you order. They draw the bar's name and a cat face on the plate with sauce.

We ordered the Pilseung Johap set. It bundles aged kimchi tuna gimbap, suyuk katsu, and corn cheese fire chicken, and costs 47,000 won.

The aged kimchi tuna gimbap is the dish my friend named as the best one here.

The dishes other than the gimbap looked good as well. I went back at the end of July and tried dishes that are not in this set.

Sashimi course at Jagalchi Hoetjip, Suyeong: go when the line is short

Sun, 27 Sep 2026 07:20:00 GMT

I went back to Jagalchi Hoetjip, which I had not visited for a while. I was with a close acquaintance who lives in Haeundae, and it was about 6 on a Tuesday evening. It is a raw fish restaurant on the exit 5 side of Suyeong Station. It is fairly well known to locals and to travelers alike.

That day we had the assorted sashimi course. It is 35,000 won per person.

The sashimi and side dishes came out well, as you would expect from a known place. The basic course is fine. For my own taste, though, I like Marine Boy nearby better.

One step up, the premium sashimi course is 45,000 won per person. I am told the braised dish comes from that course up. If your budget allows, the premium course is the better pick. I remember the premium course being 35,000 won in the past, so the price seems to have gone up. I am not sure my memory is right.

I suggest coming here when the line is short or there is none. If the line is long, it is better to go to another raw fish place nearby.

After the meal I moved on to Rentan Suyeong.

Assorted clams at Suminine in Cheongsapo: the staff grilled everything

Sun, 27 Sep 2026 06:10:00 GMT

On a Saturday my family and I went out to Gwangalli and decided to have dinner in Cheongsapo. It was about 6 in the evening. Cheongsapo is a place I often go to for clams, and now and then for fishing.

Suminine is a grilled clam restaurant in Cheongsapo. By the map directions, you go down the main road toward the Blue Line Park Cheongsapo stop and turn right, then turn right again into the side alley before you reach the big pine tree.

One funny thing happened. Perhaps because my hair is long and bleached, the staff seemed to take me for a foreigner. They first spoke to me in a foreign language and were surprised to learn I am Korean.

I ordered the assorted clams. Scallops and several kinds of clams come on one plate. A female staff member did all the grilling. She did the same the last time I came.

I enjoyed the meal. I think my family ate well too. I had to drive, so I could not drink.

Momos Coffee at Domoheon: crowded, but the garden is worth it

Sun, 27 Sep 2026 05:10:00 GMT

My family and I had gone on an outing to Hwangnyeongsan and stopped here for a rest on the way down. It was about 4:30 on a Saturday afternoon. The Momos Coffee main store always has a lot of people waiting, which puts me off. So I chose the branch in Domoheon.

The cafe is on the first floor of the Domoheon main building. I parked in the Domoheon lot. This branch was crowded too, but by luck we got a seat in the corner.

We ordered two iced coffees, one madeleine, and one cookie.

My family enjoyed what we had.

As far as I know, Domoheon used to be the mayor's official residence. It is now open to the public. The building is well kept and the interior is nicely decorated. I thought it would be a good place for couples to stop by as well. We walked around the building and the garden, and from the garden you can see Gwangan Bridge in the distance.

Sashimi at Makseoreo Hoetjip in Oncheonjang: better than expected

Sun, 27 Sep 2026 02:40:00 GMT

It was about 7 on a Saturday evening, after chicken galbi at Dakdukkeobi. I have no regular raw fish place in Oncheonjang, so I looked around and found Makseoreo Hoetjip in an alley in Oncheonjang.

I did not expect much. I ordered the assorted sashimi.

The fish was in better condition than I expected. The side dishes, such as steamed egg, pancake, and greens for wraps, were fine too. The price range felt average.

It is a fair choice when you want a light sashimi meal. I would not go as far as telling someone who already has a favorite raw fish place to come here on purpose.

I ate in the restaurant. I have a feeling that it stopped dine-in service after that, but I am not sure. When I wrote this up, the delivery menu on Naver Map listed small flounder at 40,000 won and medium flounder at 55,000 won. Those are not the price of the sashimi I had that day.

Chicken galbi at Dakdukkeobi in Oncheonjang: both kinds were good

Sun, 27 Sep 2026 01:10:00 GMT

I met friends I have known since high school at about 5:30 on a Saturday evening. Dakdukkeobi was the first stop of the gathering. It is a chicken galbi restaurant introduced by a friend who works nearby and knows the places in Oncheonjang well.

It is next to Sarang Nursing Hospital, in front of the Bando parking lot, and across from Bando Apartments, 636 m from exit 1 of Oncheonjang Station.

The menu says the chicken takes 10 minutes of pre-grilling and that orders start at three servings. We ordered two servings each of the salt chicken galbi and the gochujang chicken galbi. Both are 9,900 won. Greens for wraps, garlic, and several sauces are set out as standard.

The price was not a burden, and both kinds tasted good. I would suggest it to anyone who wants chicken galbi.

After eating here we went to Makseoreo Hoetjip.

Raw beef at Minjeong Hanu Suyuk Gukbap in Yeonsan-dong: fresh and fair

Sat, 26 Sep 2026 23:30:00 GMT

This was the second stop after eating at Beolttejip. I was with a close younger friend who lives in Haeundae, and it was about 7:30 on a Wednesday evening. Minjeong Hanu Suyuk Gukbap is a Korean beef soup restaurant in Yeonsan-dong. It seemed that people line up there from time to time.

It is a soup place, but I also like its mungtigi, raw beef. The mungtigi is 20,000 won for 300 g and the soup is 9,000 won, so both are quite easy on the wallet.

If you like mungtigi, I would recommend it. The meat was fresh.

The Korean beef soup comes in an earthenware pot. The soup was good too.

As for why the mungtigi is so fresh, my guess is that many guests mean the meat turns over quickly.

Aged kimchi chicken stew at Chiaksan Matjip, Wonju: great kimchi

Sat, 26 Sep 2026 22:00:00 GMT

On the way home to Busan from the Yongpyong ski resort in Daegwallyeong, I stopped in Wonju. At about 6 on a Sunday evening I had dinner with a friend who used to live in Wonju.

Chiaksan Matjip Main Branch is a chicken stew restaurant in Dangye-dong, Wonju. The map description puts it across from the Dangye-dong Nonghyup. A large menu board hangs on the inside wall, with braised dishes, stews, hot pots, and stir-fries, plus meals such as hand-pulled dough soup, fried rice, and noodle soup. There was a lot to choose from.

I ordered the aged kimchi chicken stew, listed as the signature dish on the map, in the small size.

It was good. The aged kimchi was especially good. I had to drive, so I did not drink, but it was the kind of dish I would have wanted a drink with.

Seafood stew at Beolttejip in Yeonsan-dong: generous and fairly priced

Sat, 26 Sep 2026 14:50:00 GMT

I met a close younger friend who lives in Haeundae in Yeonsan-dong at about 6 on a Wednesday evening. Beolttejip is a seafood stew restaurant in an alley on the exit 4 side of Yeonsan Station.

The seafood stew comes in small, medium, and large, and the small is 25,000 won. The pot sits on a portable burner on the table and you eat while it boils.

The pot held a generous amount of seafood, and the mix was good.

We also ordered raw hanchi squid. It is a seasonal item, so my guess is that it may not be available out of season. The menu here changes often with what is in season.

For what we paid, I was very satisfied. Most of the seafood dishes and sashimi here are easy on the wallet and fairly fresh. I would suggest it to anyone looking for sashimi or seafood stew in Yeonsan-dong.

After the meal we moved on to Minjeong Hanu Suyuk Gukbap.

Joseph in Gwangalli: a happy night with Dongdong the dog

Sat, 26 Sep 2026 14:20:00 GMT

At about 9 on a Friday night, a friend and I went to Joseph as the last stop of the day. It is the cocktail and whisky bar in Gwangalli that I also visited on April 21. It is behind Pascucci, in front of the Haman parking lot.

This time the reason was a dog. A dog named Dongdong sometimes comes to this bar. My friend is not used to drinking but likes animals, so I wanted my friend to meet Dongdong.

When we arrived, Dongdong was not there. I said that was a pity, and the owner called Dongdong over.

My friend liked Dongdong too. The owner sat the dog on the seat beside us, and the sight of it sitting there made me laugh. The dog was heavier than I expected and hard to set down on the floor.

We drank while playing with Dongdong and ended the day in a good mood. I went again in July and met Dongdong once more.

Sashimi at Paldak Paldak Hoetjip in Jeonpo: fresh, thick slices

Sat, 26 Sep 2026 14:00:00 GMT

When I want sashimi in Jeonpo-dong, I often go to Paldak Paldak Hoetjip. At about 5 on a Saturday afternoon I went with friends, as the first stop of the gathering.

If you come late, the line can be long and the fish can run out. So it is better to come early.

We ordered the assorted sashimi. The menu says it is made up of flounder, rockfish, and mullet. The small size (for 2) starts at 43,000 won, and the largest is the extra large (for 5).

The fish was fresh. This place tends to cut its sashimi fairly thick. The price and the portion felt fair.

One grilled flounder comes along with it.

There was also rice for sushi at the back of the table. I vaguely remember that they sold yellowtail in winter.

I would recommend it as a place for sashimi in Jeonpo-dong. After eating here we went to Ninano Jeonpo.

Pork cartilage ribs and udon at Rentan in Suyeong: a fair second stop

Sat, 26 Sep 2026 13:30:00 GMT

After eating at Jagalchi Hoetjip, I moved to Rentan Suyeong for a second round. It was about 8:20 on a Tuesday night. It is a bar that mainly serves food grilled over coal briquettes, and I have come here several times for a second round.

I am told it is about a 3-minute walk from Suyeong Station.

Here I usually order the signature cuttlefish. That day I chose the seasoned Korean pork cartilage ribs.

The taste was fair. Because it is grilled over briquettes, it has a smoky flavor. The grilled dishes here are mostly satisfying.

I also ordered the street-stall style udon. I finished the second round with those two dishes that day.

Udon at the Mandeok oden truck: cheap oden, an old street-stall feel

Sat, 26 Sep 2026 13:10:00 GMT

It was about 9 on a Monday night, and I was heading home after Shanghai Tan and Haesam Meongge Malmijal in Suyeong. I wanted something to settle my stomach after drinking, so I stopped at the oden truck in Mandeok. I have used it many times.

The truck has no name of its own and is not registered on the map. It parks in front of the 24-hour Jeonju Myeongga bean sprout soup restaurant on Mandeok 2-ro, so I marked that restaurant on the map. That restaurant is 225 m from exit 1 of Mandeok Station. "Mandeok Oden Truck" is simply what I call it.

I ordered udon and asked for oden and rice cake in the same bowl.

The oden and rice cake are cheap, so there is no burden. I also like that it still feels like an old street stall. My impression, though, is that it is not a place to expect much in the way of hygiene. There are tables where you can sit.

I stop by when it comes to mind on my way home. I have a separate note from a visit in August as well.

Seasonal seafood platter at Haesam Meongge Malmijal in Suyeong: fresh

Sat, 26 Sep 2026 12:40:00 GMT

After the meal at Shanghai Tan, I wanted seafood and looked for a place nearby. That is how we came to Haesam Meongge Malmijal for a second round. I was with a friend I have known since high school, and it was about 6:30 on a Monday evening.

It is a bar in Suyeong that serves seasonal seafood, set inside an alley. The room was tidy, and I thought it would suit couples as well.

We ordered the seasonal platter first.

The seafood was fresh and tasted good. Then we added the purple sea urchin, sweet shrimp, and avocado.

The sea urchin had no fishy taste, and I enjoyed it. Both dishes are worth recommending, though the seasonal platter suited me better.

On the way home that night I made one more stop, at the Mandeok oden truck.

Lamb skewers at Shanghai Tan in Suyeong: cheap and good, tricky fire

Sat, 26 Sep 2026 12:10:00 GMT

Shanghai Tan is a lamb skewer restaurant I have been to several times since its early days. At about 5 on a Monday afternoon, a friend and I went there as the first stop of the day. It is on the first floor of the building right to the left as you come out of exit 7 of Suyeong Station.

If you come late, there is often a line. If you want a quiet meal, it is better to arrive early.

Skewers and ribs

We ordered lamb skewers and mala lamb skewers. The mala ones have seasoning on the outside, so you can tell them apart.

The lamb skewers were very good. The lamb ribs are grilled on a wire grill.

The fire is hard to manage. Fat drips from the skewers and flames can flare up.

Egg fried rice

The egg fried rice was good too.

I did not note the price of each dish, but the meal felt easy on the wallet. From here we moved on to Haesam Meongge Malmijal.

Fresh pork makchang at Taeyoung in Dongnae: no off smell, nice chew

Sat, 26 Sep 2026 11:40:00 GMT

A friend I have known since university had a day off, so we decided to eat together. At about 4:40 on a Tuesday afternoon we went to Taeyoung Saengmakchang in Dongnae. I think I found the place on social media, but I do not remember for sure.

I like makchang, grilled pork intestine. My friend is not very fond of makchang or beef tripe. Looking back, I think I mostly went to beef tripe places in Dongnae.

The restaurant is on the exit 4 side of Dongnae Station. I was told to face the main gate of Myeongnyun Xi and take the alley on the left. There were no other guests when we went.

When I want makchang in Dongnae, this is the place I plan to choose. That day we ordered the fresh pork makchang, the signature dish. The staff did all of the grilling.

The makchang had no unpleasant smell and a nice, springy chew. We had soju with it.

I do not know what it is like when the place is busy.

Sambari in Dongnae: good grilled octopus and shrimp, not cheap

Wed, 23 Sep 2026 18:18:00 GMT

The Sambari main branch is a place I had already visited several times. This time a friend and I went on a Thursday evening, a little before eight. It is 99 m from exit 4 of Dongnae Station, a seafood bar that also serves grilled clams.

What I like here is the charcoal-grilled octopus and the shrimp. We had both that day.

They grill and clean it for you

The staff put the seafood on the charcoal one item at a time, grill it, and clean it for you.

The raw shrimp comes to the table already peeled.

The shrimp heads are served separately.

Price and crowd

The price range is not low. I was still happy with the taste this time, and I plan to go again. I remember standing in a long line here in the past, but these days there seemed to be somewhat fewer guests. That is only my impression.

We finished with ramyeon.

Grilled chicken platter at Isegye in Seomyeon after an hour in line

Wed, 23 Sep 2026 15:59:00 GMT

On a Thursday evening I met a friend in Seomyeon for a drink, timed to when my friend got off work. We went to Isegye, a restaurant that specializes in chicken. It is about 120 m from exit 8 of Seomyeon Station.

Many people wait for a table here. As I remember it, we waited about an hour that day.

At the charcoal grill in front of the table, the staff explain every dish and grill it for you, so guests can simply eat.

The platter and the rice ball

We ordered the medium assorted platter.

We added the grilled sticky rice ball later.

The chicken was good overall and tasted clean. I have been to a number of yakitori places in Seomyeon and Dongnae, and compared with those, this one felt easier on the wallet and tasted good too.

I was happy with the taste and the price. The only thing that makes me hesitate is the long wait. On a day when I can accept that, I would like to go often.

Squid and cuttlefish were the best part at Eobuui Sulsang, Songjeong

Wed, 23 Sep 2026 15:41:00 GMT

I wanted bigfin reef squid, so a friend and I went to Songjeong. It was a Sunday evening, shortly after the place opened, and there were no other guests yet. The staff still seemed to be setting up. The sea is visible in front of the restaurant, and the view was good.

We ordered plenty for two men. The set of Hokkaido scallops and steamed red snow crab was 89,000 won, and the bigfin reef squid with steamed cuttlefish was 80,000 won.

Scallops and red snow crab

You grill the scallops yourself on the table grill. They were fresh and tasted good.

The steamed red snow crab was fresh and tasty as well. For its size, though, there was not much meat to eat, and that was a letdown.

Bigfin reef squid and steamed cuttlefish

The bigfin reef squid was the reason for the trip. It was as good as I had hoped.

The steamed cuttlefish had an especially good chew. I was happy with both squid dishes.

We did not order sea squirt, but it came on the house.

Price and setting

The prices are on the high side. Still, the seasonal seafood is fresh and the sea is right in front of the restaurant, so I thought it would suit people looking for fresh seafood, or a couple who want to eat with a view. The menu changes with the season.

There are outdoor tables, so I guessed that eating outside is possible when the weather is right. I plan to go once more for the bigfin reef squid.

RnT in Daegwallyeong, my burger stop: a single should be enough

Wed, 23 Sep 2026 06:52:00 GMT

When I am in Daegwallyeong and want a burger, RnT is the place that comes to mind. Getting to a McDonald's means going all the way to Gangneung. I tend to stop by in ski season and whenever I come to Daegwallyeong, and this time I went on a Monday at about 12:40. The shop is right next to the Alpensia promotion hall. As far as I know it is already fairly well known. I think it is a good place and suggest it to people visiting Daegwallyeong.

I ordered the bacon burger set, which is what I usually pick.

The double burger is a generous portion. I think a single would be enough for me.

Boiled turban shell at Ara Saengseongui, a good second stop

Wed, 23 Sep 2026 06:21:00 GMT

A friend who lives in Haeundae and I wanted one more drink, so we went to Ara Saengseongui in Jwadong Market. It was about 8:50 on a Thursday night. I had been to this place a few times before. It is good for a light drink in Jwadong Market, and I plan to go again.

Jwadong Market sits further in than Haeundae Market. In my view it has a number of places worth eating at. The restaurant is 368 m from exit 4 of Jangsan Station. There seemed to be quite a few local guests, though that is only my impression.

The name says grilled fish, but there are also soups and boiled meat, so there is a lot to choose from. That night we ordered the boiled turban shell.

It tasted good and the price felt reasonable.

Rough-cut raw fish at a fair price at the Gwangalli Eobang Festival

Wed, 23 Sep 2026 05:57:00 GMT

I knew the Gwangalli Eobang Festival is held every year, but this was my first visit. I went with friends on a Sunday, at about half past two in the afternoon.

Gwangalli Beach is 793 m from exit 3 of Gwangan Station. We passed exit 4 and walked toward the beach.

The festival grounds had a number of hands-on booths, and there seemed to be plenty of space for children to play.

Raw fish from the beach stalls

We kept the meal simple and ate at the food stalls set up on the beach. We ordered only raw fish.

The price was in the middle, neither cheap nor expensive. The fish was cut roughly. I thought it had been prepared ahead and kept cold, but that is a guess based on it being a festival stall and not a raw fish restaurant.

We went during the day. I imagined that eating at the outdoor tables after sunset would have some charm.

Will I go next year

Going back for next year's festival feels like a hassle, so I do not plan to return.

After the festival we moved to a grilled clam restaurant nearby. That story is in my visit to Jogaeview Gwangan.

Eochon Hoetjip in Suyeong: good sashimi, awkward upstairs seats

Wed, 23 Sep 2026 05:39:00 GMT

A friend I often eat out with and I went to Eochon Hoetjip, inside Suyeong Paldo Market, for the first time. It was about 6:40 on a Tuesday evening. I am not sure where I first heard of the place. I think I saw it on Instagram. It is 187 m from exit 3 of Suyeong Station.

We were seated on the second floor. The room looks like a converted attic, and the ceiling is low, so it was hard to walk around standing straight. The seats were not comfortable either. There is no call button, which made ordering more from upstairs a hassle. A staff member from the first floor carried the food up.

We ordered the small assorted sashimi for 40,000 won. Sushi, soft tofu, and salad come with it.

The fish was in good condition, and at this price it felt easy on the wallet. The two of us drank three bottles of soju. Near the end of the meal a grilled fish head came out.

This place suits people who care more about the fish and the price than about a comfortable seat. I was happy with the meal and wanted to return, and about two months later I did go once more.

Moving Time Capsule backups to SMB on macOS 27

Sun, 13 Sep 2026 15:00:00 GMT

The Macs on my network used a 4th-generation AirPort Time Capsule as the destination for automatic Time Machine backups. After the upgrade to macOS 27.0, those backups stopped working. Apple's support article states that AFP-based Time Capsule backups are not supported on macOS 27 or later. As rechecked on October 4, 2026, the article is dated September 14, 2026.

To keep using the device, I chose TimeCapsuleSMB. It is an unofficial tool that runs Samba 4 inside the device so that backups go over SMB3. On September 14, 2026, I confirmed that a first Time Machine backup finished from a Mac mini on macOS 27. Below, what I ran myself and what I only read in documentation are kept apart.

What went away is the AFP client

The stock server on a Time Capsule offers AFP and SMB1. The TimeCapsuleSMB README and an article from The Eclectic Light Company describe it this way. In macOS 27.0 the AFP client is gone, and mount_smbfs remains.

There was advance notice. The enterprise release notes for macOS Sequoia 15.5 announced that the AFP client would be removed in the future. The support article says backups to an AFP NAS are not recommended and are not supported on macOS 27 or later, and it applies the same condition to AirPort Extreme and Time Capsule. Earlier, the macOS Sequoia 15 release notes recorded a fix for a failure to create a new encrypted backup on a Time Capsule or AFP server.

A MacRumors article explains the cause with TLS 1.2, but that is a different matter. The minimum TLS requirement in the macOS 27 Golden Gate release notes covers some processes related to device management, automated device enrollment, installing configuration profiles and apps, and software update. Time Machine is not among them. The same release notes have no item about removing AFP either. So the conclusion that AFP is gone rests on the support article and on the fact that the files are missing in macOS 27.0.

This is the result of trying an AFP mount on macOS 27.0. I used an address that does not exist, and only the directory path is replaced with <dir>.

$ mount -t afp //example.invalid/share <dir>
mount: exec /Library/Filesystems/afp.fs/Contents/Resources/mount_afp for <dir>: No such file or directory
mount: <dir> failed with 72

The command ends before it even resolves the name, because the helper file is missing. /sbin/mount_afp does not exist, there is no AFP bundle in /System/Library/Filesystems, and the network file system plug-ins have no AFP entry. On the other hand, the setdestination section of man tmutil still mentions AFP and SMB shares. Wording in a manual page is not evidence that AFP works.

AirPort Utility changed as well. A fresh install of macOS 27 does not include it. After an upgrade the existing app can remain, but it is not guaranteed to work from 27 on. My Mac was updated from macOS 26.6.2, and AirPort Utility 6.3.9 was still there.

The available paths

The replacements Apple lists are an external storage device, a NAS that supports Time Machine, and a shared folder on another Mac.

A directly attached external drive: the configuration Apple commonly gives. A network outage does not matter, but a laptop backs up only while the drive is plugged in.
A NAS with SMB: several Macs can back up to one place. The device costs money.
A shared folder on another Mac: it uses a Mac that is already there. Apple recommends that both Macs run macOS 11 or later.
Staying on macOS 26: AFP keeps working for a while. It is hard to keep going once security updates end.
TimeCapsuleSMB: it keeps the device in use and leaves room to carry over old backups. The cost is accepting an unofficial tool running as root on the device.

I took the last path. I installed with the default settings first, then examined the binaries and the issues, and changed the settings and deployed again based on what I found. The security section below is what I learned after installing, but it belongs before installation, so I put it first.

What Time Machine needs from an SMB server

For Time Machine to use an SMB share as a backup destination, the server has to support Apple-specific features. In Samba, the vfs_fruit module does this.

This share definition comes from Samba's public test configuration. Nothing in it is edited during installation. The excerpt only shows which options are needed.

[vfs_fruit_timemachine]
	vfs objects = fruit streams_xattr acl_xattr xattr_tdb
	fruit:time machine = yes

A share with fruit:time machine = yes is advertised over Bonjour as _adisk._tcp. The registration is in Samba's Avahi registration code. vfs_fruit negotiates the AAPL extension of SMB2 and handles Finder metadata. The extension needs SMB2 or later, so the SMB1 of the stock server cannot meet the condition.

What TimeCapsuleSMB does on the device

The v2.2.9 I installed runs Samba 4.24.3 and accepts connections over SMB3. A separate mDNS helper advertises _smb._tcp and _adisk._tcp. By default only SMB2 and SMB3 are allowed, and turning on Allow Any SMB Protocol lifts that limit.

The installed files are split across two storage areas. /mnt/Flash is small but survives a reboot, so the boot script, the configuration, and the small mDNS helper go there. The large Samba binaries live in .samba4 on the hard disk. Every time the device starts, they are copied to the /mnt/Memory RAM disk and run from there. The Apple firmware spins down an idle hard disk, so they cannot run directly from the disk.

During installation, the app first turns on SSH on the device and sends the files through it. Data that was already on the disk is not touched. The uninstall feature removes the files on the hard disk and the loader in /mnt/Flash. Deleting the installed files and restoring the boot hook are two different jobs, which is worth knowing. The command that returns the firmware to stock is flash --restore.

The binaries differ by generation. The 5th generation is NetBSD 6, and generations 1 to 4 are NetBSD 4. My 4th-generation device got the build for NetBSD 4.0 little-endian.

Security conditions to know before installing

The first thing to know about is the heartbeat. The nbns-advertiser in v2.2.9 contains a heartbeat feature. It downloads heartbeat4le and a signature file over HTTP, verifies them, and runs the result. The address found in the strings of the binary is http://timecapsulesmb.jamesyc.com/downloads/bin/heartbeat4le. The source of this feature is not in the v2.2.9 tag.

Issue 299 reports that this feature runs every 12 hours with root privileges and sends device information. The maintainer answered that it is telemetry, that it can be turned off with a setting, and that the structure was changed in v3.0.0. On September 14, 2026, when I installed it, v3.0.0 had not been released. Looking at the release list again on October 4, 2026, v3.0.0 was published on September 15 (UTC), and the latest release is v3.2.0. I have not installed the v3 line, so the installation and telemetry details in this post are based on v2.2.9. Signature verification keeps an arbitrary file from being run, but what gets run depends on the maintainer's server and signing key.

I also checked how far the telemetry setting reaches. The app and the CLI write TELEMETRY=false to .bootstrap on the Mac, and that stops the usage events sent from the Mac. But in the deployed code and binary strings of v2.2.9, this value is not passed into the device's configuration. Which setting issue 299 refers to is not clear.

The way to stop the heartbeat on the device is to turn NBNS off. nbns-advertiser is always placed in .samba4 on the hard disk, but it is copied to the RAM disk and run only when NBNS_ENABLED=1. In the app, turning off Enable NBNS and running Install/Update again deploys NBNS_ENABLED=0. In the CLI it is deploy --no-nbns. The basis for this conclusion is the boot code and the strings in the binary. I did not verify with packets that the network requests actually stopped.

With NBNS off, NetBIOS name responses stop, so the device can drop out of discovery on Windows. Macs find it through Bonjour and do not strictly need NBNS, and my device worked normally after the redeploy.

The remaining conditions are these.

Bind SMB to LAN Only is off by default. When it is off, the server can bind to every interface including WAN, and when it is on, it is limited to the LAN. If the device also acts as the router, turning it on is the safe choice.
SMB authentication accepts any user name and uses the device password of the Time Capsule. Guests are blocked, and an authenticated user is mapped to root.
The README says to use it only on the LAN and not to open ports to the internet. The FAQ says it can be used on a home network and should be avoided in security-sensitive environments.
The first launch of the app needs the Gatekeeper warning to be allowed by hand. Issue 284 includes a case where the maintainer provided an unpublished build through an external share link. Getting the app from an official release is the better choice.

The steps I followed with the app

I installed with the app, not the CLI. The steps were as follows.

Download the app from the GitHub releases. After unpacking and opening it, Gatekeeper blocks it, and it runs only after it is allowed by hand.
Give the app the local network permission. It is under "Privacy & Security" in System Settings, and the app has to be quit and reopened after the permission is given.
In Add Device, pick the device, enter the device password, and save it with Save Device. The app then turns on SSH, and I waited for that to finish.
Change three settings: Mac telemetry off, Enable NBNS off, and Bind SMB to LAN Only on.
Press Install/Update. The NBNS and LAN settings go to the device at this step.
For generations 1 to 4, write the boot hook.
Run Checkup after 5 to 10 minutes.

On the 4th-generation device, the deploy took about 6 minutes. The checks that the device rebooted and that the runtime was activated succeeded, and Checkup showed 0 failures and 0 warnings.

The README also describes what to do on failure. If the SSH step is stuck, restart the app and register the device again, or reboot the device itself. If the deploy step is stuck, delete the device entry saved in the app, register it again, and run the deploy once more. In some cases one deploy does not transfer every file, and it has to be repeated several times.

The boot hook on generations 1 to 4

The NetBSD 4 firmware on generations 1 to 4 cannot keep a boot hook. Without a patch, tcapsule activate has to be run after every reboot. In the app, the Persistent NetBSD4 Boot Hook menu runs Back Up and Inspect, Plan Patch, and Write Patch in that order.

The firmware on my device is 7.8.1. Both banks were backed up to the Mac, and an image built from 7.8.1 in Apple's catalog was written only to the primary bank. The secondary bank is still the original. The check that reads the bank back after writing and compares it also passed. The reboot command is not available in patch mode, so I unplugged the power cord and plugged it back in, and after that Samba started without activate.

Writing to flash carries risk. The v2.2.9 FAQ warns that losing power during the write can leave the device unusable. The v2.2.9 README says tcapsule flash --restore returns the chosen bank to stock, but I did not test a restore. According to the README and the FAQ, the 5th generation needs no boot hook, starts Samba automatically after a reboot, and reboots once during the deploy. I did not test the 5th generation either.

Installing with the CLI

I did not run the CLI. The order in the README, with the option that turns NBNS off added, looks like this.

./tcapsule bootstrap
.venv/bin/tcapsule configure
.venv/bin/tcapsule deploy --no-nbns
.venv/bin/tcapsule doctor

bootstrap creates a Python virtual environment inside the repository, and configure writes the address and password to a configuration file. deploy --no-nbns deploys with NBNS off, and doctor checks the state. On generations 1 to 4, after deploy, flash makes a backup and flash --patch writes the boot hook.

The documented requirements are macOS 14 or later, Python 3.9 or later, Homebrew, and smbclient. If the target is a NetBSD 4 device, sshpass is needed as well.

Reusing existing backups

This section summarizes the FAQ on main. The baseline is commit 34c075f on September 14, 2026, and I did not move a backup myself. Installation does not delete the disk or an existing .sparsebundle.

First check that the SMB connection works.
Put the .sparsebundle at the root of the SMB share. With standard internal-disk settings, this is the ShareRoot folder. A bundle inside a per-user folder is moved to the same place.
Set the Time Machine destination to the SMB share again.
When Time Machine offers to continue with the earlier backup, accept it.

If the earlier bundle is not found or cannot be reused, Time Machine may create a new bundle. When macOS still cannot find the existing backup after the move, the remedy the FAQ gives is a reboot. With the backup not mounted, reboot the Time Capsule first and then the Mac.

What I verified

This is the environment I verified. The Mac used for installation runs macOS 27.0, and the Mac that backed up is a Mac mini on macOS 27. The device is a 4th-generation AirPort Time Capsule with firmware 7.8.1 and NetBSD 4.0. The app is 2.2.9, Samba is 4.24.3, and the date is September 14, 2026. On the Mac mini I set the SMB share as the backup destination, and the first Time Machine backup finished.

A few commands help when checking the state. This one finds devices that advertise an SMB service over Bonjour.

dns-sd -B _smb._tcp local.

This one finds devices that advertise a Time Machine backup service. The two commands are run separately, and since the output keeps going, each is stopped with Control-C.

dns-sd -B _adisk._tcp local.

This one lists the backup destinations registered on the Mac.

tmutil destinationinfo

The first command shows the SMB device name, and the second shows the device name of the backup disk. Seeing the advertisement does not mean that authentication and writing work. According to the documentation, doctor checks the Samba processes, port 445, the Bonjour advertisement, the authenticated share list, and file operations inside the share.

What to watch while it stays in use

Keeping the app or the CLI folder after installation is the better choice. Running Checkup, deploying again, activate, and uninstalling all need that tool. The FAQ explains that the CLI folder can be deleted, but that it has to be kept or downloaded again to run maintenance commands. To move to a new version, do not uninstall first. Deploy once more on top of the existing installation. After that, check that the NBNS setting, the LAN setting, and the telemetry structure are unchanged, and finish with Checkup. Generations 1 to 4 without the boot hook need activate after a reboot.

Changes on the OS side matter too. The FAQ records a regression of Time Machine network backups in macOS 26.4.x and 15.7.5 through 15.7.7. After an OS update, it is worth confirming that the first backup finishes.

There are also cases in the issues. Issue 294 is about SMB stalling during a backup. It reports that wired connections or a newer external access point were more stable than the built-in Wi-Fi, but the cause is not settled. In issue 271, the maintainer judged the cause to be instability in Samba and the network. Issue 177 is a case where the device was factory reset during the first deploy. The data on the disk remains, but the network has to be set up again with AirPort Utility, and on macOS 27 that app is not guaranteed to work. For that reason, write down the device's settings before installing.

I also read the main branch, which was still unreleased when I installed. In commit 34c075f from September 14, 2026 and the native helper README, the heartbeat is split out into a telemetry helper, which downloads and runs a signed debug executable when the server tells it to. This is code before release, and I did not confirm how it behaves, so the release notes and the FAQ should be read again before updating.

This setup puts an unofficial project on a device that Apple no longer supports. Important backups are better kept in one more place, on an external drive or an SMB NAS.

What I did not verify myself is the CLI installation, the restore to stock firmware, and the move of existing backups. I did not test a 5th-generation device, an AirPort Extreme, or an external disk attached to the device either. I did not test accessing files over the stock SMB1 on macOS 27 either. This post is about the Time Machine problem. I did not confirm with a packet capture that the heartbeat stopped either.

A Guinness on the terrace at Issi in Haeundae, facing the sea

Tue, 08 Sep 2026 05:00:00 GMT

After the barbecue at Butasinise Haeundae, a friend and I went to Issi for a second round. It was about 8:30 on a Sunday night.

Issi is a Western-style restaurant on the first floor of Palais de Seas, right across from Haeundae Beach. From the subway it is a fair walk. There are terrace seats outside, and that day I saw that pets were allowed on the terrace.

I mostly drink Guinness stout. I had one that day as well.

From the terrace you can see the sea. It is a good place to talk without hurry over a drink, and it suits a light beer, whisky, or wine. It also fits well into a walk along the beach.

Striped jack sashimi at Dongnae Gimssi: good fish, slow to arrive

Mon, 07 Sep 2026 05:00:00 GMT

It was a Saturday and I wanted striped jack. I called a friend who was getting off work, and at about 6:45 in the evening we went to Dongnae Gimssi together. It is an izakaya near Dongnae Station.

For striped jack I usually go to Kalmat Hoetjip near Pusan National University. But getting in there takes a long wait and it closes early, which can be a burden. On a day when that place is hard to get into, I think of this one as an alternative for striped jack, and I plan to go again.

We ordered the seasonal striped jack sashimi as a single dish, not a set, for 70,000 won.

I was fairly happy with the quality of the fish. We did wait a long time between ordering and getting the plate, though. The only side dish was some peanuts, so there was almost nothing to eat with it. I tried to allow for it being an izakaya and not a raw fish restaurant, but so few side dishes was a letdown.

The two of us drank two bottles of soju.

All-you-can-eat clams at Jogaeview Gwangalli: great view, weak meal

Sun, 06 Sep 2026 16:48:00 GMT

After looking around the Gwangalli Eobang Festival, my friends and I went for grilled clams. There were three of us, and it was around three on a Sunday afternoon, early for a meal.

Because we were early, we got a seat that looks down on Gwangalli. The view was really good.

The clam table and the scallops

We ordered the all-you-can-eat Sanhaejinmi table and added seasonal scallops.

The clams were fresh. Taken as a whole, though, the meal fell short of what I expected, for three reasons.

Scallops: I expected large scallops, but the ones that came were small. They looked like red scallops to me, which is my own guess.
Refills: When we asked for more, some clams came uncleaned and the portion got smaller. That is what happened to us that day.
Heat: The grill gave off so much heat that it was very hot while we ate.

I have no plan to go back to this restaurant. I have rarely been satisfied at raw fish or grilled clam places near Gwangalli, so I tend to avoid seafood in this area. In my experience, neighborhood raw fish restaurants were better in both price and taste. That is only a personal comparison.

Thin-cut squid delivered from Uosin in Mandeok: plenty, but pricey

Sun, 06 Sep 2026 06:32:00 GMT

At about 5 on a Friday afternoon I wanted squid at home, so I ordered delivery. Uosin is a live squid restaurant close to my home, and I have eaten there with my family before. The restaurant is 240 m from exit 1 of Mandeok Station.

I like squid, but prices have gone up a lot lately and I feel it. This meal also cost more than 50,000 won.

The house style is to cut the squid as thin as thread. The menu says you can ask for a different thickness.

I had no real complaint about the knife work or the freshness. I do prefer wide, thin slices to thin threads, though. The portion was plenty for one person. I do not know whether it was one squid or two.

I hear the squid sells out early every day, so my guess is that it comes in daily. If you live near Mandeok, it is worth considering, at the restaurant or by delivery. Next time I plan to go and eat there with my family.

Dokdo Kkotsaeu in Dongnae: expensive, but very satisfying to eat

Sun, 06 Sep 2026 05:00:00 GMT

After the first round at Singsing Domae Hoetjip, I looked for the next place and chose Dokdo Kkotsaeu. I like spot prawn. It was about 10 on a Saturday night. The restaurant specializes in spot prawn and is 59 m to the left of exit 4 of Dongnae Station.

Spot prawn comes in small, medium, and large, and the small starts at 70,000 won. They clean the prawns in front of you.

Eaten raw, the prawn tasted good and had a good bite. The heads come back deep-fried, and they were crisp. A salt-grilled dish was served too.

The price is a heavy burden, and the portion felt small for it. Still, eating it was so satisfying that I felt the price was worth bearing. I would eat this more often if I could afford to.

Raw horned turban was available that day, so I added it.

Butasinise in Haeundae: good pork, but I could do without the music

Sat, 05 Sep 2026 05:00:00 GMT

Someone younger than me who lives in Haeundae suggested a drink, so at about 7 on a Sunday evening we went to Butasinise Haeundae. It is a pork barbecue restaurant 499 m from exit 7 of Haeundae Station.

The room was tidy. I wondered whether it had opened recently, but I am not sure. A group having a company dinner was there when we went.

We ordered the Si set, which comes with bone-in pork belly, pork neck, and pork skin. The person who took the order and grilled the meat was a staff member from abroad. The grilling looked a little unpracticed, but they were kind, so I did not mind.

The meat had no off smell and tasted good.

What I did not like was the music. Korean pop songs were playing, and I felt this place would be better quiet, without music. The noise from the company dinner did not bother me much. The music did.

If you live nearby, it is worth one visit. I would go again too, but Haeundae is far from my home, so I do not know how often. There is also a note on Issi, which I visited on the same day.

Marinated galbi at Silla Nongwon in Deokcheon: the kids liked it more

Fri, 04 Sep 2026 05:00:00 GMT

We went for dinner after visiting a family member at Gupo Seongsim Hospital. It was about 7:20 on a Wednesday evening, and the family included two of my nieces and nephews.

We usually go to a galbi place near home that the kids like. That day we chose a different restaurant we had not been to for a while. Trying a new place was part of the fun. Silla Nongwon is 116 m from exit 10 of Deokcheon Station, and I heard it has been around for 20 years. The restaurant is large, and there seemed to be many families.

We ordered marinated galbi. The meat comes in a bowl, sitting in its marinade.

Both kids enjoyed it and said it tasted better than their usual place. I also felt the price and the taste were good enough to recommend.

I do not expect to be in this area often. If I do come back, though, I would eat here.

Miso, an oden bar in Dongnae: an easy second stop when you are full

Thu, 03 Sep 2026 05:00:00 GMT

We had already filled up at the first place, so for the second round we picked a place where a little food is enough. That was Miso, an oden bar, at about 9:30 on a Thursday night. There is also a note on Dyeonbyeorak Makchang, which I visited on the same day.

It is 105 m from exit 4 of Dongnae Station, across from the Dongnae public parking lot. There are two kinds of seats: ordinary tables, and tables built around the oden bar. We usually sit at the oden bar. The staff are very kind, and takeout is possible.

The oden bar is shared. You pick the oden you want yourself, and the rice cake skewer is ordered separately. Each person must order at least four oden.

I mostly eat the basic square oden, and I have one rice cake skewer every time I go. Sometimes I add grilled toothfish, but not that night. It goes well with a bottle or two of soju.

Small rock bream at Singsing Domae Hoetjip in Dongnae: fresh and fair

Wed, 02 Sep 2026 06:29:00 GMT

When I want sashimi at a price that does not hurt, I go to Singsing Domae Hoetjip. It is right in front of exit 4 of Dongnae Station, 22 m away. This time I went at about 8 on a Saturday evening. It suits a light first round of sashimi, so I plan to keep going.

It is a busy place. It is usually close to full, and sometimes there is a wait. They take reservations and do takeout and delivery.

I eat many kinds of sashimi, and rock bream is one of the fish I like most. That day I ordered the small rock bream for 65,000 won, and had one bottle of soju.

The fish was fresh and the price was not a burden. My guess is that the low price brings many guests, the fish turns over quickly, and that keeps it fresh.

There is also a note on Dokdo Kkotsaeu, which I visited on the same day.

Dyeonbyeorak Makchang in Dongnae: clean-tasting and chewy

Wed, 02 Sep 2026 04:33:00 GMT

I like makchang, grilled pork intestine, and have been to quite a few places that serve it. This was a Thursday. A friend got off work, we met at about 7:30 in the evening, and we had drinks at Dyeonbyeorak Makchang.

The restaurant is 124 m from exit 4 of Dongnae Station. Cross the road and go a short way to the left. The spot used to be Orihyang, which served duck and monkfish. That place closed and the makchang restaurant moved in. Perhaps because it opened not long ago, the room was tidy.

We ordered the set for two to three people with both plain and seasoned makchang, for 39,000 won.

Plain and seasoned makchang

The makchang comes already grilled once. I did not notice any off smell, and it was mild and chewy, which I liked.

The seasoned makchang is part of the same set.

Fried rice and soju

We added fried rice. It tasted the way I expected.

As I remember it, three bottles of soju went quickly. They also do takeout and delivery and take groups. It is a place I will think of on a day I want makchang.

There is also a note on Miso, an oden bar, which I visited on the same day.

Fresh assorted seafood at Yongwon Gadeok Hoetjip in Gupo Market

Wed, 02 Sep 2026 03:54:00 GMT

At about noon on a Tuesday, after visiting my father at Gupo Seongsim Hospital, my mother and I went to Gupo Market. We first meant to go to Sijang Kalguksu, but it was closed that day, so we looked for another place nearby.

My mother and I both like seafood and sometimes go out for it together. The last place we went was Gijang Haenyeochon, and we ate well there. But it closes early and stops opening in the summer heat. So that day I really wanted seafood.

Gupo Market is fairly close to home, yet I rarely go. My mother goes often and knows the restaurants well. Yongwon Gadeok Hoetjip is inside the market, 250 m from exit 1 of Deokcheon Station.

We ordered the small assorted seafood for 40,000 won.

The seafood was fresh, and at this price it felt easy on the wallet. The side dishes that come with it were neat and tasty too.

The spoon worm stood out for its nutty taste. As I remember it, Gijang Haenyeochon only served spoon worm from the large size up, which disappointed me. Here it was included even in the small size.

I had to drive, so I could not have soju, and that was a pity. If I come to Gupo Market with a friend later, I think I will suggest this place.

The bottled cola at Starbucks Reserve: trying it once was enough

Sun, 23 Aug 2026 05:47:00 GMT

I like cola. I had been curious about the drinks sold at Starbucks Reserve stores, and a note saying the cola comes with a bottle opener made me more curious. So on a Wednesday during the day I bought a bottle.

The store is a Reserve store on the first floor of Samjeong Tower in Seomyeon. The drink is called The Real Premium Cola and costs 4,700 won. It is made by Baladin, an Italian brand, and a small bottle opener is attached to the bottle. To say it up front: with the price in mind I cannot call it a good pick, and I do not plan to buy it again.

The fizz was on the weak side. The taste was not bad, but it was different from the cola I know, enough that I wondered whether to call it cola. My only guess is that natural ingredients are the reason.

Bigfin reef squid at Amaika in Seomyeon: I ordered a second dish

Sun, 23 Aug 2026 05:21:00 GMT

After my dental treatment was finished, I wanted bigfin reef squid. Amaika is a place I had seen on YouTube and meant to visit for a while. I like the chef in the video and wanted to taste the food it showed. I walked in at about 5 on a Wednesday afternoon, right at opening.

The izakaya is on the second floor of the building diagonally across from Gaemijip Seomyeon, on the exit 1 side of Seomyeon Station. There is a sign board in front of the building, which seemed to list the day's suggested dishes and the reservations.

I first ordered one dish, the Amaika bigfin reef squid, for 42,000 won.

The taste and the bite were both very good. Among the squid I have eaten, I rate this especially high. So I ordered one more squid dish, the konowata ika somen for 48,000 won. It is the same squid cut into thin strips, served with salted sea cucumber innards.

I drank one bottle of Chamisul. I wanted to eat more, but the spending was a burden, so I stopped there.

Uri Pocha in Gwangalli: a plate of only what we wanted to eat

Sun, 23 Aug 2026 04:39:00 GMT

After eating at Golmok Pocha, a friend and I went to the Uri Pocha main branch for a second round. It was about 7:30 on a Thursday evening. The raw fish restaurant is behind Hanseo Hospital, up past the Gwangan Homeplus. It is 527 m from exit 14 of Suyeong Station.

I like small squid and shrimp, and my friend likes fresh tuna. We each told the owner what we wanted and asked for it on one plate. The plate we got had fresh tuna, mackerel sashimi, raw shrimp, abalone, and small squid.

Overall it was fresh and tasted good. The staff were kind as well.

The place is known for yellowtail in winter. I have heard that people line up in yellowtail season. There were not many guests when we went, and I suspect that is because it was not the season.

Next time I would like to come in winter for the yellowtail.

LA galbi at Golmok Pocha in Gwangalli: still good after a long gap

Sun, 23 Aug 2026 04:04:00 GMT

Golmok Pocha is a pub I went to several times in the past. I had not been for a while, and I came back at about 6 on a Thursday evening. This is the second branch, in Gwangan-dong, on the exit 1 side of Gwangan Station. There used to be a first branch, but it seems to be gone now.

I remembered liking the LA galbi before, so I ordered it again. The basic side dishes come first and the galbi follows. A staff member brings the galbi to the table and cuts all of it up for you.

The LA galbi was good this time too. I also ordered one bottle of soju. The staff were kind.

There was a fish tank, and I saw seafood on the menu. I do not think I saw seafood dishes here before, so I wondered whether the menu had changed in the meantime.

There is also a note on Uri Pocha, which I visited on the same day.

Tanti in Jeonggwan: a fine view, but weak coffee and strict rules

Mon, 17 Aug 2026 17:16:00 GMT

After visiting the columbarium where my father rests, my family and I stopped at a cafe. It was about 5:30 on a Wednesday afternoon, and the children in my brother's family were with us. Tanti is a large cafe up on a mountain in Jeonggwan, Gijang. It is hard to reach without a car, but there was plenty of parking.

The room is large and the view is good. My first impression was positive. For the price, though, the service and the food did not satisfy me, so I have no plan to go back. I prefer the cafes on the Gijang coast.

I hear it stays open late at night, and my guess is that this is for the night view. It may suit couples on a date more than families.

The ordering rules

That good first impression faded as we ordered. Each person has to order one drink, and the rule was applied to the children too. We were told that the children's drinks can only be ordered for kids of kindergarten age or younger. The second floor was closed to children and seniors. There are bungalows outside, and it seemed you need permission from the staff to use them.

A notice at the counter said, in effect, that they would give more value than what you pay. From what I experienced, I could not agree.

Coffee and bread

I had stayed up the whole night before and needed caffeine, so I ordered a cold brew. It was very disappointing. It was the worst cold brew I have had. The coffee tasted thin overall, and I thought Compose Coffee would have been better.

The drinks the children ordered were so sweet that most of them were left. The bread was far too sweet as well. I do not expect much from the taste at very large bakery cafes to begin with.

Assorted sashimi at Seonpung in Gangneung: one I was happy with

Mon, 17 Aug 2026 16:49:00 GMT

I was visiting a couple, friends of mine, who live in Daegwallyeong. It feels hard to find a raw fish restaurant in Daegwallyeong, so the three of us went out to Gangneung for sashimi. It was about 8 on a Monday evening.

Whenever I travel in Gangwon, I have been unhappy with seafood prices. So this time I searched Naver Map and picked a place where the price looked fair. That was Seonpung, in Gyo-dong, Gangneung.

We ordered the assorted sashimi.

As I remember it, the plate had marumi, flounder, puffer, and pike conger. I am not certain. Compared with what I had eaten at raw fish places in Gangwon before, I was happy with the mix, and the side dishes were good too.

My friend, who is pregnant, drove that day while the rest of us drank. I felt sorry about leaving the driving to her.

Kalmat Hoetjip near PNU: twenty years of going back for the knife work

Mon, 17 Aug 2026 16:26:00 GMT

I have been going to Kalmat Hoetjip since I was a university student. By my count that is about 20 years. It is in Jangjeon-dong, close to Pusan National University Station. This time I went at about 3 on a Friday afternoon. I wrote about an earlier visit that April in my April visit note.

The restaurant opens at 4 in the afternoon. If you go in the evening, there is a good chance the fish has run out and you cannot eat. So it is best to arrive at opening time. Since the restaurant expanded, it can take more guests.

I ordered the Kalmat premium sashimi for three (100,000 won) and for two (70,000 won).

As I remember it, the fish that day were black-spotted jack mackerel, grunt, and red sea bream, but I am not certain. These days I like the jack mackerel so much that I could eat it daily. It is about as fatty as yellowtail, a fish I do not care for much.

I think the knife work here is especially good, even next to other raw fish places in Busan. That is my personal view. The fish is in good condition for a price that does not hurt, and the side dishes are generous.

As someone who lives in Busan, I do not think a raw fish restaurant has to be by the sea. The hours are hard to match, which is the drawback, but if you have the time I would recommend it strongly.

I used saved coupons and got a spicy rockfish stew.

Rules that make an App Store review submission safe to rerun

Mon, 17 Aug 2026 15:00:00 GMT

DailySudoku is an app that gives one Sudoku puzzle per day. I build it alone and ship it on the App Store, Google Play, and the web. Pushing a tag runs everything from build upload to the iOS review request. When one channel fails, the design is to rerun only that channel.

That design had a gap. If the server processes a request but the client ends without receiving the response, the rerun is rejected as a duplicate. The Android side fixed the same problem earlier, and this time I added an idempotency check to iOS. What follows is based on the iOS automation on the develop branch as of August 16, 2026.

The state names were different to begin with

To make a decision, the code has to read the current state of the version. I opened the spaceship implementation in the fastlane version pinned by Gemfile.lock and found two accessors for the state.

This is the accessor declaration in the spaceship app version model.

attr_accessor :app_store_state      # Deprecated in App Store Connect API specification 3.3
attr_accessor :app_version_state    # ← 현행

The comment on the second line, 현행, means "current."

The two accessors differ in more than the name. They return different values. READY_FOR_SALE on the old one is READY_FOR_DISTRIBUTION on the current one, and PROCESSING_FOR_APP_STORE is PROCESSING_FOR_DISTRIBUTION. The filter that spaceship uses to look up versions also uses the current field. To decide based on the app version resource in the App Store Connect API, the code has to read the current accessor.

The name has a trap too. In JSON the field is appVersionState, but the accessor name after Ruby mapping is different. Accessing it with the camel-case name gives nil, and code that compares against nil passes the syntax check. The flow then falls into the "unknown state" branch without any error.

When the version state alone gives the wrong answer

At first I classified READY_FOR_REVIEW as "submission accepted." That was wrong. The same state remains when the run stops after preparing the version and creating the submission object, right before the last API call. If this state counts as success, the rerun ends without making the actual review request.

The build needed its own check. Even with the same marketing version, the build number selected on the version can differ because of a manual submission or an earlier run. Whether the uploaded build exists and whether that build is attached to the version are two different conditions. Without separating them, the review state of a different binary is read as success for this build.

A second axis: the submission object for the whole app

A second investigation showed that the submission tool does not reject based on the version state. It checks whether the app as a whole has a review submission in progress.

This is part of the branch that fastlane deliver checks before submitting for review.

if app.get_in_progress_review_submission(platform:)
  UI.user_error!("Cannot submit for review - A review submission is already in progress")
  # …

The READY_FOR_REVIEW state and an unfinished submission object can exist at the same time. So the version state alone cannot decide the outcome. The state of the submission object has to be read as well.

I got this wrong once more. Reducing the lookup result to "object exists or not" erases the difference between waiting, in review, and unresolved issues. A rejected version could still be judged a success because the build and the notes match. I changed the code to keep the submission object's state as it is and to apply blocking conditions first.

An enum value was also missing. Of the 15 states, I had classified only 14, and the missing one was the approved state. A rerun while waiting for manual release after approval could fail. Now a self-test walks through every enum value in the pinned gem and asserts that zero values are unclassified. If a gem update adds a new value, the verification step fails before any real submission.

A third defect in the submission note comparison

In the test that compares submission notes per locale, I had typed the keys by hand. As a result the test exercised only the comparison function. It did not check whether my locale keys match the keys the API returns. If the spelling differs, every locale is judged missing and the whole rerun is blocked.

The error message was a problem too. The old message pointed to stale notes as the cause, which did not help when the real cause was a key mismatch. So I handle one case separately: every locale is missing, but the set of notes on the server is not empty. In that case the code prints the key list from the input and the key list from the server response.

Four decision rules

After three rounds of fixes, I reduced the rules to four.

Keep the version state and the app-wide submission state as independent axes.
On an unknown value, fail closed and ask a person to decide.
If either axis shows a blocking signal, blocking wins over submitting.
A dry run only reports the state and does not stop because of that state.

The priority in rule 3 is fixed in the structure, not left to the order of conditional statements. Rule 4 exists because the state can change between the rehearsal and the real tag run.

How I verified it without calling App Store Connect

The decision logic is split into pure functions that run without credentials. That makes it possible to verify with a self-test and no call to the App Store Connect API. The checks cover a table per version state, a table per submission object state, and the classification of every enum value in the gem.

There is also a guard against an implementation that ignores the second axis. Two contrast cases keep the version state the same and change only the submission object state. If they produce the same decision, the test fails. For the note comparison I used mutation. I replaced the comparison function with one that always returns false and one that always returns true, and confirmed that both the too-permissive defect and the too-strict defect are caught. I covered the idea of checking the checker with a control in a separate post about negative controls in verification scripts.

Looking back, one round of fixes was avoidable. A document that investigated the second axis was already in the repository, and I started without reading it. I need the habit of rereading the notes I wrote months ago.

Some things remain unverified. I have no record of reproducing the failure where the server finishes and only the response is lost. It was hard to build a way to reproduce it. What I verified is the decision logic that reads combinations of states, not the whole failure. The exhaustive enum check also covers only the values that the pinned gem knows. Whether the gem reflects the full, latest set of states on the server cannot be known until the gem is updated.

Fixing the order of the UMP explainer and the ATT request on iOS

Mon, 17 Aug 2026 15:00:00 GMT

DailySudoku is a personal project that gives one Sudoku puzzle every day. It ships on the App Store, Google Play, and the web. To keep it free, I added banner ads and consent handling.

Here are the abbreviations used in this post. IDFA (Identifier for Advertisers) is Apple's advertising identifier. ATT (App Tracking Transparency) is the Apple framework that asks for tracking permission, and UMP (User Messaging Platform) is the consent screen SDK from Google. GDPR (General Data Protection Regulation) is the EU privacy regulation, EEA stands for European Economic Area, and NPA (Non-Personalized Ads) means ads that are not personalized.

The ATT system alert leaves little room to change its wording. So I wanted a separate screen that explains the reason before the request, and I drafted an IDFA explainer message in the AdMob console in 8 locales. The console said that this explainer screen triggers the ATT alert. If the SDK requests ATT by itself, then with the current structure, where the app already requests ATT, the explainer might never be shown. I stopped publishing and started investigating. This was about three and a half weeks after the earlier work.

The design from a month before

I had connected ATT and audited it about a month earlier. The reasoning at the time was this. The UMP screen is skipped in some regions, and if ATT sits inside the UMP completion callback, ATT is skipped there too. At the time, I expected the UMP screen in regions under GDPR, the United Kingdom, and some US states. Korea is the main market, so the app needed to obtain the IDFA outside the EEA as well.

So the calling rule did not depend on the UMP screen. In the startup task of AppCoordinator, the call sat after refreshConsent() and before maybeStartAdMob(), and it applied to every user who was not adFree. The actual ATT request ran in its own Task, so it ran at the same time as UMP.

Ad requests used the more restrictive of the two answers. If either ATT was denied or UMP consent was missing, the request carried npa=1. Back then I checked the four combinations of ATT and UMP states with unit tests, and confirmed in the simulator that the ATT alert appears on first launch, including in a non-EEA locale.

Whichever shows first wins

The ATT request screen appears only when the status is .notDetermined. A call after the user has answered just returns the existing status. So if the app's request shows first, the SDK's explainer has no place to appear. If the SDK moves first, the explainer appears and ATT follows. Which one came first depended on how long the network took. The reversed order, where ATT appears first and the explainer comes after it, could happen as well.

The existing tests did not reveal this problem. I found it while preparing to publish the AdMob message.

The documents had no answer, so I opened the binary

The Google guide to UMP privacy integration on iOS showed how to create the explainer message. At the time I could not find a basis for who calls ATT, how a sample uses it, or what the execution order is. The Apple AppTrackingTransparency documentation had no answer about UMP either. One line of guidance in the console was not enough to justify changing the code.

So I looked at the UserMessagingPlatform binary directly.

UserMessagingPlatform 바이너리:
  _objc_msgSend$requestTrackingAuthorizationWithCompletionHandler:
  _objc_msgSend$trackingAuthorizationStatus
  "ATTrackingManager"   ← 문자열(동적 조회)

otool -L: AppTrackingTransparency 하드 링크 없음

The Korean labels in the block read "binary" (바이너리), "string, dynamic lookup" (문자열, 동적 조회), and "no hard link" (하드 링크 없음).

The binary contains the request selector and the status selector, and ATTrackingManager appears as a string. The otool -L output showed no direct link to AppTrackingTransparency. I read this as the SDK looking up the class dynamically. From that I inferred that the app has to link the framework, but I did not reproduce what happens when the link is removed.

Four decisions that changed the order

First, the app's ATT request moved to after UMP finishes. If the permission is already decided, the guard returns right away, so there is no duplicate request.

Second, I kept the app's ATT call. I assumed that the SDK does not request ATT when the explainer message is not published, and in that case the app requests it instead. This reduces the dependence on whether the message is published before or after the code is merged. My judgment was that removing the app's call would leave no way to obtain the IDFA until publishing, and AdMob ads would be served as non-personalized.

Third, UMP runs once even on the path where no consent screen is needed. I took needsForm to mean only whether a consent screen is required. The point is to give the SDK a chance to handle the explainer outside the EEA too, and I expected it to return immediately when no message is published.

This is the branch for the case where no consent screen is needed.

case .none, .formOnly:
    guard AdsConfig.adMobEnabled else { break }
    // 폼이 «필요 없어도» UMP 흐름을 한 번 돌립니다.
    // 메시지가 게시돼 있지 않으면 즉시 반환합니다(no-op).
    umpFlowRan = await consentProvider.presentConsentForm()

The two comments say that the UMP flow runs once even when no form is needed, and that it returns immediately as a no-op when no message is published.

Fourth, maybeStartAdMob() does not wait for the ATT answer. In the main market the ad chain uses AdFit, so there is nothing to gain from waiting for the first AdMob impression. I also considered that the banner can be covered while the ATT alert is up.

This part schedules ATT only when the UMP flow actually ran.

if AdsConfig.adMobEnabled, umpFlowRan {
    Task { await ATTAuthorization.request() }
}
maybeStartAdMob()

Three fixes from code review

The first was the refresh failure. .refreshFailed, which comes from a network error, fell into the .none handling in an if/else if structure. If the cache still held "no screen needed," UMP returned success and the app could request ATT without knowing whether the explainer was published. I switched to a switch and handled the failure separately. A side benefit is that the compiler points out a missing branch when the enum gains a value later. In the excerpt below, the .none and .formOnly branch is the same as the code shown earlier, so it is shortened.

switch prompt {
case .refreshFailed:
    // 게시 여부를 모르는 상태입니다. 아무것도 하지 않습니다.
    // 동의 상태는 UMP가 마지막으로 아는 값이 유지되고, 다음 런치에 재시도됩니다.
    break
case .introThenForm:
    umpFlowRan = await presentConsentIntro()
case .none, .formOnly:
    // …
}

The comments under .refreshFailed say that the publishing state is unknown so nothing is done, that the consent state keeps the last value UMP knows, and that it is retried on the next launch.

The second was the app's own intro sheet. When the intro sheet shown before the SDK screen is dismissed with the scrim or the grabber, presentConsentForm() is not called. umpFlowRan checks whether UMP actually ran, and on this path ATT is skipped. The intro sheet is shown again each time the app starts.

The third was the ad provider condition. A guard that looks at third-party ads as a whole passes when only another provider is enabled. ATT could run even in a configuration with AdMob turned off. The WKWebView-based provider does not use the IDFA. I narrowed the ATT and UMP conditions to AdsConfig.adMobEnabled.

What ATTAuthorization.request() does

The code that imports AppTrackingTransparency is gathered in one file.

static func request() async {
    guard ATTrackingManager.trackingAuthorizationStatus == .notDetermined else { return }
    if UIApplication.shared.applicationState != .active {
        await withCheckedContinuation { continuation in
            var observer: NSObjectProtocol?
            observer = NotificationCenter.default.addObserver(
                forName: UIApplication.didBecomeActiveNotification, object: nil, queue: .main
            ) { _ in
                if let observer { NotificationCenter.default.removeObserver(observer) }
                continuation.resume()
            }
        }
    }
    await withCheckedContinuation { continuation in
        ATTrackingManager.requestTrackingAuthorization { _ in continuation.resume() }
    }
}

The guard at the top ends right away unless the status is .notDetermined. Even though the function is called on every launch, it does not call the request API for users who have already answered.

Next comes the check that the app is .active. Requesting directly from a startup callback such as didFinishLaunching or willConnectTo can return .notDetermined without showing a screen. Usually sceneDidBecomeActive has passed while UMP waits on the network, but the function waits for didBecomeActiveNotification itself so that it does not rely on that timing.

What I confirmed and what I could not

Based on the develop branch as of 2026-08-16 (commits 2ae29c42 through 657d87c7), iOS passed 301 tests in 60 suites with xcodebuild test, and Android succeeded at compileDebugKotlin. On first launch in the simulator, the ATT alert appeared as before, and running UMP with no published message did not add another modal. The log on the following launch showed [ATTrackingManager] Returning from trackingAuthorizationStatus - 0. The value 0 means not determined, so that path requests again.

To imitate a regulated US state, I added the -AdMobDebugUSState argument on iOS and --ez admobDebugUsState true on Android. I confirmed in the SDK header that UMPDebugGeographyRegulatedUSState has the value 3 and wired it in.

Two things are unconfirmed. simctl privacy grant tracking failed with Operation not permitted, so there was no way to inject an ATT answer automatically. Whether the app stops asking after the user has answered is left for QA on a real device. I also could not see whether the explainer shows again on the second launch after the message is published, because the publishing conditions were not met at the time.

There are remaining limits too. Until the explainer message is published, the app's ATT alert can appear without the explainer. That is the intended fallback behavior. What I saw in the binary is an observation limited to the UMP release in use at the time, and it is not behavior that the official Google documentation guarantees. It has to be investigated again when the SDK changes.

One piece of documentation debt is left. The comments in ATTAuthorization.swift still describe the old calling rule. The statement that it runs regardless of the screen, the statement that it runs right after refreshConsent(), and the statement that ATT and UMP are independent no longer match the implementation. I corrected two comments in other files but missed this file, so I filed an issue for it. When a premise changes, an earlier decision has to be reviewed again. So a decision record should include the premises that make the conclusion hold, not only the conclusion.

Keeping the export compliance answer in sync across two files and ASC

Mon, 17 Aug 2026 15:00:00 GMT

I ship DailySudoku, a personal app that gives one Sudoku game a day, on iOS, Android, and the web together. The release channels are the App Store, Google Play, and the web. Pushing a git tag runs everything automatically up to the review request in App Store Connect (ASC).

While making the review submission safe to rerun, I added a check for the encryption declaration. In the process I fixed defects of my own making four more times. The code described here is the store metadata check and the iOS release automation on the develop branch as of August 16, 2026.

Where the answer lives

Uploading an app requires declaring whether it uses encryption. In the repository, that value is in two places. One is the ITSAppUsesNonExemptEncryption key in Info.plist. The other is the submission declaration file that the automation takes as input.

If the two values disagree, ASC asks an extra question and the pipeline stops. The declaration file had the value false and a comment saying that both files must be changed together. No code actually checked what that comment said.

Having an answer is not the same as having the right one

At first I decided not to compare the values. If the version is waiting for a compliance answer, the flow moves to manual handling anyway, so I judged that a separate comparison was not needed.

That judgment had a gap. Whether an answer exists and whether that answer equals the approved value are two different conditions. After a person enters a value in ASC, or after an earlier automated run enters a different value, the state still becomes resolved. If the build, the release notes, and the release method also match, a rerun can be judged a success. Then the review goes ahead with a declaration outside what was approved. A wrong declaration can become a reason for a review rejection or a policy violation.

As the first fix, the actual value in ASC is compared with the approved value, and a missing answer blocks the run.

A regression found 30 minutes later

That fix caused another problem right away. The function that supplies the approved value uses Ruby symbols as keys, but the code that reads the value looked it up with a string key.

This is the result of looking up the same value with the two kinds of key.

문자열로 조회: nil     ← 옛 코드
심볼로 조회  : false   ← 고친 코드 (= 선언 파일의 승인값)

The first line is the lookup with a string, which was the old code. The second is the lookup with a symbol, which is the fixed code and equals the approved value in the declaration file.

Because the lookup returned nil and not false, the value was always judged different from the one in ASC. As a result, every retry was blocked.

This was the third defect that blocked everything all the time. The earlier two were in the promotion comparison and the locale identifiers, and this one was the lookup of the declared value. The existing self-test checked only the number of keys and the types of the values. So I added an assertion that looks the value up with exactly the key the consuming code uses.

Looking once more for the same kind of defect

Before review, I searched for more blocking paths of the same kind, and a fourth candidate came up. The previous commit treated a nil value in ASC as a missing answer.

But when compliance is settled by the declaration in the app binary's Info.plist, the declaration field of the Build can be empty. This is an inference from how the submission tool is implemented. The submission tool, fastlane deliver, writes the value only when it is nil. Shipped as it was, the code would have blocked valid retries too. This time it was found before release.

After the change, the approved value is compared only when the ASC field has a value. A case that is really unresolved is stopped by the check on whether the version is waiting for an answer. The roles are separated so that a nil value and an unresolved state are not treated as the same thing.

An offline check that compares the two files

Apart from the runtime decision, I turned the contract inside the repository into a check. It compares Info.plist with the submission declaration. A conflict is known as soon as only one file is edited, so it can be caught on every PR.

This is the part that asserts the two values read from the files are equal.

plist_value = plist[key]                    # Info.plist
declared = decl[field]                      # 제출 선언 파일
assert plist_value == declared, (
    "수출 규정 선언이 두 곳에서 어긋난다 — ASC가 되묻거나 잘못된 신고로 심사가 진행된다. "
    "**한쪽만 고치지 말 것**(선언 파일 주석)."
)

The second comment means "submission declaration file." The message says that the export compliance declaration disagrees in two places, that ASC will ask again or the review will go ahead with a wrong declaration, and that one side must not be fixed alone.

The type is checked as well. When a value is extracted with plutil, a false inside an XML string node also comes out as a string. Converting only the result of comparing that string with "true" into a Boolean hides the fact that the original type was wrong. So the file is parsed with Python's plistlib, and then the value is checked to be a bool.

This assertion confirms that the value read from Info.plist is a Boolean.

assert isinstance(plist_value, bool), (
    f"Info.plist 의 {key} 가 Boolean 이 아니다: {plist_value!r}. "
    "ASC 는 이 키를 Boolean 으로 요구한다 — <true/> 또는 <false/> 여야 한다"
)

The message says that the key in Info.plist is not a Boolean, and that ASC requires this key as a Boolean, written as <true/> or <false/>.

A missing key is a failure too, because without the key ASC asks again and the pipeline stops.

The check also ran in the wrong place

I first put this check in the self-test of the iOS release workflow. On a PR, that workflow runs only when a path under apps/ios/** changes. The submission declaration file is outside that path, so a PR that changed only the declaration did not run the check.

I moved it into the store metadata check, which owns both files. That check runs on every PR and push.

I confirmed the result in three ways. A mutation that flips the Boolean in Info.plist makes the assertion fail. The self-test looks the value up with the key that the consuming code really uses. And I matched every gem accessor and constant used in the code against the pinned source, one by one, because referring to names without checking them was the repeated cause. Feeding a check an input that should fail is covered in the post on applying a negative control to a verification script.

A promise written as a comment is easy to mistake for a managed contract, so it should become an assertion. Searching for more failure paths of the same kind while fixing one defect paid off. And the change a check watches has to be included in the conditions that trigger that check. Adding a safeguard can itself create new errors, which is what happened here.

I have never made a real submission with mismatched declarations. Testing the review queue with a wrong declaration was not an option. The statement that ASC asks again when the two values conflict or the key is missing rests on the experience recorded in the declaration file's comment and on the API's requirements. The basis for the nil handling is also the tool's implementation, and I could not confirm in the documentation the exact condition under which ASC fills the Build's declaration field.

When parallel tests disturbed each other through global notifications

Mon, 17 Aug 2026 15:00:00 GMT

DailySudoku, a Sudoku app I build as a side project, gives one free game a day and shows a banner ad. It is available on the App Store, Google Play, and the web. A failure showed up in the iOS tests for that banner ad.

A test named holdsImpressionUntilTheSlotIsLiveAgain passed locally in about 0.02 seconds, while the CI job ran into its 45-minute limit. After the first fix the endless wait was gone, but the test kept failing. The code baseline is the iOS implementation at commits d44808bb and b7646ee2 on the develop branch as of August 14, 2026.

The notifications the banner listened to

AdBannerView has to react to a remove-ads purchase, a consent change, and a return to the foreground. So it observed three notifications on NotificationCenter.default.

This is the code where the banner registered its observers.

for name in [SudokuStore.didChange, AdsNotifications.didChange, UIApplication.didBecomeActiveNotification] {
    NotificationCenter.default.addObserver(self, selector: #selector(refresh), name: name, object: nil)
}

The last one, the did-become-active notification, is there for a reason. Something has to restart the load and the impression handling that were held back while the slot was inactive. When the user returns to a screen that is already showing, viewWillAppear cannot be expected to be called. Without this trigger, both the ad slot and the impression record can stay empty.

At first I suspected load on the runner

Several jobs share the CI runner, so load was my first suspect. Then I found a different problem in the test code. Execution continued after #expect failed, and it then entered a while with no upper bound that waited for shownKind.

Reduced to its shape, the flow looked like this. The arguments and the loop body are omitted.

#expect(await waitForChain(               // 실패해도 실행이 멈추지 않는다
    // …
))
while banner.shownKind == nil {           // 그래서 여기서 영원히 대기한다
    // …
}

The Korean comment on the first line says that execution does not stop even on failure, and the one on the while line says that it therefore waits here forever.

I measured the time too. Run alone, this test took 0.024 seconds locally. Under contention, there was a case where the asynchronous MainActor work that builds the chain was delayed beyond the 4-second observation window.

I also ruled out other changes as the cause. releaseForcedProvider in the PR that changed ad routing is always nil in DEBUG. The PR under review has no change in the ad directory. Both were confirmed from the ancestry and the diff of the two PRs.

Defensive changes went in first. The wait was raised from 4 seconds to 8 to match the provider's network time limit, and waitForShown was built on the existing polling approach. #require stops progress after a failure, and the unbounded loop became a wait with a time limit. The result was that a 45-minute wait turned into an 8-second failure. The interference between tests was still there.

A notification from another test reset the banner

The hypothesis is the combination of parallel execution in Swift Testing and a notification center shared by the whole process. A static search found 7 test files that post SudokuStore.didChange. A notification posted by an unrelated test synchronously calls refresh() on the banners that are observing. When ads are disabled, the !enabled branch clears chain, shownKind, and pendingImpression and bumps the generation.

Two conditions made only this test vulnerable.

The watcher uses shownKind as input to decide the remove-ads state. A reset can happen once the value exists. A notification before the value exists only calls setNeedsLayout().
Unlike the other tests, this one does not call layoutIfNeeded() before its first wait. So after a reset there is no layout pass to restart the load.

I judged that this is the only test where both conditions hold together.

The same hypothesis explained the difference between local runs and CI. When the test passed locally, the suites running alongside it presumably did not post a notification during the risky window. The observation that contention delays timing was valid in itself, but it did not fit as the cause of this failure.

I confirmed the hypothesis with an experiment. Adding a Task that posts the notification made the failure reproducible locally. The existing test, run in parallel, failed at the same place in the code.

Injecting the notification center

I added notificationCenter: NotificationCenter = .default to the initializer of AdBannerView and changed the observers to register on the injected center.

This is part of the changed initializer. The setup code before the observer registration is omitted.

init(
    colors: SudokuColors,
    adsProvider: AdsProvider,
    consentProvider: ConsentProvider,
    notificationCenter: NotificationCenter = .default   // 추가
) {
    // …
    for name in [SudokuStore.didChange, AdsNotifications.didChange, UIApplication.didBecomeActiveNotification] {
        notificationCenter.addObserver(self, selector: #selector(refresh), name: name, object: nil)
    }
}

The Korean comment next to the new parameter means "added."

Three test files each pass their own instance. Because of the default value, the app keeps using the same NotificationCenter as before. adsProvider, consentProvider, makeAd, and logger were already injected, so this follows the same pattern. The reset behavior in refresh() and didMoveToWindow() means that the creative is removed, so I left it as it was.

Other options were considered. @Suite(.serialized) only limits concurrency inside that suite, so it has no effect on notifications posted by other suites. And when layout does not run again, raising 8 seconds to 80, or waiting forever, does not recover the test.

How the fix was confirmed

xcodebuild test reported 299 tests in 60 suites passing. One regression test was added, which took the count from 298 to 299. The problem test alone ran in 0.023 seconds, and the whole run took 8.58 seconds.

I also checked that the new test catches the defect. With a mutation that puts the center back to .default, both the new test and the existing test failed. Deliberately putting a failing condition into verification code is covered in the post on applying a negative control to a verification script.

Four rules came out of this. A failure that happens only in CI is not assumed to be a performance problem. A hypothesis built from reading code is confirmed by reproduction. A regression test is checked by putting the defect back and seeing it fail. A time limit and a stop after failure have value apart from the isolation fix, so they stay.

What I observed directly is the failure under an artificially created notification. I did not find which suite actually posted the notification in the CI run that failed. The search result of 7 files cannot settle who the sender was at that time. Whether the centers in the three test files are also independent per test case is not covered in this post.

How a canceled Task still ran to the end in a review prompt

Mon, 17 Aug 2026 15:00:00 GMT

I added a feature to DailySudoku, a personal project that gives one Sudoku game a day, that asks for a store rating after a win. The store and web addresses are the App Store, Google Play, and the web.

AppStore.requestReview(in:) on iOS does not report whether the prompt actually appeared, and there is no completion callback. The system limits how often it shows, and the app also limits requests to one per version. If an attempt is recorded at a moment when the screen is not suitable for a request, the chance for that release is used up. Two code reviews each found one such path.

An earlier version of this post gave the wrong name for Swift's cancellation error and described the behavior of Task.sleep incorrectly. On October 4, 2026, I ran the cancellation behavior again in a standalone program on Swift 6.4 and corrected it. The app's tests and the real race were not rerun this time.

The flow that schedules a request

When a game ends in a win, markPending() checks eligibility and only marks it pending. StoreKit is not called at that point. When the completion screen is shown, screenDidShowCompletion() schedules a run 2 seconds later only if it is pending, and when the screen is left, screenWillDisappear() cancels the schedule. Using a delay follows the sample in Apple's guide to requesting reviews.

fire, which does the work, does not keep the scene from the time of scheduling. It reads presenter.view.window?.windowScene right before running.

private func fire(presenter: UIViewController?, repository: ReviewPromptRepository) {
    scheduledTask = nil
    guard let presenter, let scene = presenter.view.window?.windowScene else { return }
    let version = ReviewPromptConfig.currentAppVersion
    let epochDay = EpochDays.today(millis: Int64(Date().timeIntervalSince1970 * 1000))
    // 시도 기록은 여기에서만 합니다.
    repository.recordAttempt(epochDay: epochDay, version: version)
    AppStore.requestReview(in: scene)
}

The Korean comment says the attempt is recorded only here.

Pending is not saved as an attempt so that a canceled schedule does not start the cooldown. The code assumed that the window is nil once the screen is left, but that assumption may not hold during a transition or in the background.

First finding: the window stays in the background

The first review found the case where the app goes to the background during the 2-second wait. UIKit can keep the window attached in the background, so the presence of a window alone does not tell whether a request is appropriate.

I added a condition that the scene is .foregroundActive.

guard let presenter, let scene = presenter.view.window?.windowScene,
      scene.activationState == .foregroundActive else { return }

During a screen transition, this condition does not guarantee a suitable state for a request either.

Second finding: a path that reached fire after cancel

A review two days later found a path where fire can run even though the schedule was canceled when the screen was left. The schedule looked like this.

scheduledTask = Task { [weak presenter] in
    do { try await Task.sleep(for: .seconds(2)) }
    catch { return }   // 취소됨 — 여기서 끝난다고 생각했습니다
    fire(presenter: presenter, repository: repository)
}

The comment says "canceled, and I thought it ended here."

I thought that on cancel, Task.sleep throws and the catch ends the task. That is only half right. The earlier version called this error CancellationException, which is the Kotlin name. In Swift it is CancellationError.

This is the behavior I confirmed by running code (Swift 6.4, a standalone program).

Calling try await Task.sleep inside a task that is already canceled gives CancellationError.
Canceling in the middle of a 30-second wait also gives CancellationError.
Canceling after Task.sleep has returned normally lets the next statement run. Task.isCancelled is true at that point.
Wrapping the call in try? only turns the error into nil, and the next statement runs. The canceled state remains.
Calling Task.checkCancellation() in the canceled state gives CancellationError.

This is the output of running the three cases. before is calling sleep after cancel, during is canceling in the middle of the wait, and after is canceling after sleep returned.

before: isCancelled=true
before: error=CancellationError, CancellationError=true
try?: nil=true, continued=true, isCancelled=true
check: CancellationError=true
during: CancellationError=true
after: sleep returned
after: continued=true, isCancelled=true
after: check CancellationError=true

The after result is the path in question. Once sleep has returned, a late cancel does not turn that call into a failure. The catch is skipped, so execution reaches fire. The earlier version stated this broadly as "an expired sleep does not throw," but what was confirmed goes only as far as "a cancel after a normal return." The exact race between the moment the timer ends and the moment the task resumes could not be settled by this experiment.

The fix is one line. After handling the error from sleep, the code checks once more whether it is canceled now.

do { try await Task.sleep(for: .seconds(2)) }
catch { return }
guard !Task.isCancelled else { return }   // 이 줄이 있어야 합니다
fire(presenter: presenter, repository: repository)

The comment says "this line is needed."

The catch covers a cancel during the wait, and the guard covers a cancel after the return. Handling the error from Task.checkCancellation() is another way to do it. What this guard sees is the state at that instant. It does not remove the chance of a cancel arriving from another execution context after the check. Whether the screen events and this code run one after another in the same context cannot be confirmed from the excerpt alone.

The comparison with Android

My judgment back then was that the same problem does not exist on the Android side, for two reasons. According to the Kotlin cancellation documentation, suspending functions such as delay check for cancellation when they suspend. The API documentation of delay says that if it was cancelled while suspended, CancellationException is thrown even when it is ready to return. And recordPrompt is placed after suspendCancellableCoroutine. That guarantee covers a cancellation that arrives while the coroutine is suspended, though. If the cancellation arrives after suspendCancellableCoroutine has returned normally and before recordPrompt is called, the next statement can still run, as in the after case of the measurement above. Whether the Android code checks in between, for example with ensureActive(), and a result of reproducing the cancellation are not in this post, so the Android side cannot be called safe. recordAttempt on iOS is a synchronous call and has no point at all where cancellation is checked. The flow of Google Play in-app reviews is not part of this comparison.

The earlier version added here that "Swift's sleep checks for cancellation only while waiting." As before in the output above shows, a task that is already canceled also gets the error, so that explanation does not hold. The Kotlin side was not confirmed by running code. What an API guarantees and whether the whole feature is safe are different questions, and each platform has to be checked separately.

Eligibility is a pure function

The part that computes whether a request is allowed is separated into a function that does not depend on StoreKit.

static func shouldRequestReview(
    wonCompletionCount: Int,
    lastAttemptEpochDay: Int64,
    todayEpochDay: Int64,
    lastPromptedVersion: String?,
    currentVersion: String,
    forceOverride: Bool
) -> Bool {
    if forceOverride { return true }
    guard wonCompletionCount >= ReviewPromptConfig.wonCompletionThreshold else { return false }
    guard todayEpochDay - lastAttemptEpochDay >= ReviewPromptConfig.cooldownDays else { return false }
    if let lastPromptedVersion, lastPromptedVersion == currentVersion { return false }
    return true
}

If forceOverride is on, the request is allowed first. After that, the number of wins is compared with the threshold, the days since the last attempt are compared with the cooldown, and the request is refused when the current version equals the last prompted version. Since it does not call StoreKit's AppStore, it can be tested with a truth table.

iOS and Android each read the same 12 inputs from one JSON file and test against them. The Android check on the number of cases was changed from >= 10 to exactly 12, because >= 10 did not catch the shared fixture changing or the two sides drifting apart. How the date boundary is handled connects to the post on leaderboard date boundaries.

I chose the win threshold and the cooldown myself. By my own assessment, the values allow a request earlier than the intent of Apple's guidelines on ratings and reviews, which is not to ask before the user has formed an opinion. I treat the system limit as extra protection and wrote the reason for the choice in a comment next to the constants. Nothing guarantees that the system limit stands in for the recommendation in the guidelines.

What was verified

The original verification was based on commits eeb4d90d, 9884d36f, and fa69105c on the develop branch as of August 15, 2026. xcodebuild test on iOS passed with 287 tests in 60 suites, and testDebugUnitTest on Android passed with 297 tests in 42 classes. Eligibility has 12 cases on both platforms. These numbers are the record from that time and were not rerun this time.

Much is not covered by automated tests. The API does not report whether the prompt was shown, so automated tests cannot confirm that the system prompt actually appeared. Neither platform has a test that automatically checks execution after cancel. iOS has no such test file, and only the part that marks pending is within unit tests. Even with a test file, the kill switch in the xctestplan would have blocked the real call. The cancellation path was reviewed by tracing the code and with a static call graph, and both defects came out of code review.

On a device, the check uses a debug build from Xcode with a launch argument that skips the eligibility decision. According to the requestReview(in:) documentation, this method has no effect in apps distributed through TestFlight.

What I confirmed by running code this time goes only as far as cancellation behavior in a standalone Swift program. The real race involving UIKit, StoreKit, and the MainActor queue, and whether that path is closed in the app after the fix, could not be reproduced.

Turning Apple Pencil handwriting into Sudoku digits

Thu, 06 Aug 2026 15:00:00 GMT

The goal for Apple Pencil input in DailySudoku was simple. Writing a 7 on a cell places a 7, and a quick dot with the pencil selects that cell. When a palm touches the screen or the recognition result is uncertain, no digit should be placed.

Keeping that goal meant solving four things: receiving input without clashing with the existing board gestures, grouping several strokes into one character, converting the input into the same shape used in training, and deciding when to apply a result. Below is the implementation based on the develop branch as of 2026-08-07 (commit 6db30672), along with the parts that automated tests alone could not confirm.

Sending the pencil and the finger down different paths

I placed a child view, PencilDrawOverlay, on top of BoardView. PencilDrawOverlay is a transparent PKCanvasView with the .pencilOnly policy, so only the pencil can draw on it. The board's recognizer, in turn, does not accept the pencil.

These are the touch types the board recognizer accepts.

허용: direct, indirect, indirectPointer
제외: pencil

In the block, 허용 means "allowed" and 제외 means "excluded."

With this split, the pencil goes to the overlay, and the finger, mouse, and trackpad go to the original cell selection handling. While a stroke is being written, the board's pan is turned off and tap stays on. The overlay is not exposed as an accessibility element. VoiceOver users keep using the 81 virtual cells described in the post about board accessibility. The cell geometry is shared, and only the path a touch takes is different.

Tap or ink, and which group

If the diagonal of the first stroke's bounding box is 6pt or less and the stroke lasts 0.12 seconds or less, it is a tap. Both conditions must hold. For a tap, the ink is cleared and the cell at the center of the bounding box is selected. A stroke near a group that is already being written counts as ink even when it is small and short, because it can be part of a digit.

A group is finalized 0.45 seconds after the last stroke. Each added stroke resets the end of the wait. The value accounts for digits such as 4, 5, and 7 that can take more than one stroke.

If a stroke that is not a tap is more than 60pt away from the center of the current group in the x or y direction, the previous group is finalized and a new group starts. For a short, small stroke far away, the tap decision comes first. The previous group is processed and then the new cell is selected. The target cell comes from passing the center of the whole group's box to BoardView.cellIndex. The rounded-corner check also uses the same function as the board. Classifying a stroke, assigning it to a group, and choosing the target cell are separate steps.

The weak point is that 60pt is a fixed distance. Cell spacing changes with screen size, and the boundary for writing in adjacent cells one after another is not settled by tests. I am considering a value proportional to the cell size, or measuring distances on supported devices and calibrating.

Building the 28×28 the model sees

Point lists are taken from the paths of PKDrawing and drawn again into a grayscale buffer the size of the board. Then the image is cropped and scaled to match the MNIST format.

This is the preprocessing flow in order.

PKDrawing
  -> [[CGPoint]]
  -> round-cap grayscale raster
  -> ink bounding-box crop
  -> longest side 20px, aspect ratio 유지
  -> bilinear resample
  -> center of mass를 28×28 중앙으로 이동
  -> [1, 1, 28, 28] Float tensor

The Korean in the block says to keep the aspect ratio (유지) and to move the center of mass to the center of the 28×28 image.

The stroke width shown on screen is 6pt for normal input and 3pt for notes. For inference, both are redrawn at 6pt. This keeps the display mode from changing the distribution of the input the model receives.

The preprocessing tests check that empty input returns nil, that the same input gives the same result, that the longest side is 20px, and that the center of mass is in place. They also compare the Core ML label and probability from the Python reference with the Swift result. If any of the crop, scale, pixel direction, or intensity range differs from the training conditions, the model can run without an error and still misrecognize the digit. A successful run does not show that the preprocessing is correct.

Results to accept and results to drop

The model keeps all 10 classes, 0 through 9. Sudoku has no 0, but I kept it so that an ambiguous circle is not forced into 6 or 9. Input classified as 0 is dropped at the apply step.

The default confidence threshold is 0.8. For notes, where a correction costs less, it is lowered by 0.1 to 0.7. Only when the result is between 1 and 9 and meets the threshold does the app select the cell and place the digit. A 0, a value out of range, low confidence, a model loading failure, a preprocessing failure, and an inference error are all rejects. A reject does not increase the mistake count. It simply does nothing. The ink is cleared regardless of the result.

In the current structure, failures with different causes all merge into a single .reject. There is no way to tell whether the model failed to load, the probability was low, or the label was wrong. Counts per cause are needed. I am considering watching the failure rate with on-device statistics only, without sending the original strokes, but that is not implemented yet.

Results that arrive late

Rendering and prediction run in Task.detached, and an accepted result calls selectCell and placeDigit on the main actor. There are two problems here.

The first is sharing the model. CoreMLDigitRecognizer is declared @unchecked Sendable, so several tasks can use the same MLModel at once. The MLModel documentation sets a condition that calls on one instance be serialized. @unchecked Sendable only skips the compiler check and does not change the runtime condition of MLModel. So the current declaration may conflict with that condition.

This is a proposal to let an actor own the recognizer. It is not applied yet.

actor DigitInference {
    private let recognizer: CoreMLDigitRecognizer

    init() throws {
        recognizer = try CoreMLDigitRecognizer()
    }

    func recognize(_ pixels: [Float]) throws -> DigitRecognition? {
        try recognizer.recognize(pixels: pixels)
    }
}

With this, predictions run one at a time, and callers have to use await. Cloning the model per queue is another option, but it is something to review only after measurements show that a single actor falls short on latency or throughput.

The second problem is that an old result can be applied after the state has changed. The completion checks only whether the game is in the playing state. After a pause and resume, or after switching note mode, a result requested earlier can still be applied. The two modes can also disagree: the threshold is chosen from the mode at capture time, while placeDigit acts on the mode at completion time. I am considering storing the three values below with each request and checking that they still match right before applying.

input revision + target cell + entry mode

If the values differ, the result is discarded. A monotonically increasing number works as the revision.

What automated tests covered and what they did not

The automated tests focus on the pure reducer and renderer. They cover hit testing on the rounded board, the tap and ink conditions, debounce, restart on a distant stroke, normalization, the reject branches, loading the bundled model, the Python and Swift comparison, the allowed touch list, and the delegate wiring.

There are only two handwriting fixtures, 1 and 7. That means only two kinds of input are checked from rendering through to the expected digit. The threshold search in the training script is also a proxy evaluation that uses MNIST with rotation and stroke-width changes, plus 0 and noise. So the recognition rate for real pencil handwriting, and whether 0.8 is the best value, are not proven.

For the delegate, there is a record in a source comment. It diagnosed that on iOS 26.5, PencilKit falls into recursion when the canvas sets itself as its own delegate, so a separate bridge is used. The test only checks whether the canvas and the delegate are the same object. I did not recheck the device logs from that time. Another limit is that the .pencilOnly path cannot be exercised with a mouse in the simulator.

Six things need to be checked on devices.

Precision and reject rate for 1 through 9 across handwriting styles
Latency of the first response and the order of consecutive results
The 60pt boundary on each screen size
Behavior when pencil, finger, pointer, and VoiceOver are mixed
Discarding earlier results during pause and resume or a mode change
Whether users can understand a model loading failure or repeated rejects

For metrics, I plan to look at the share of wrong inputs among accepted results, the reject rate, and p95 latency. My judgment was to protect the precision of applied actions first and accept that more inputs go unrecognized.

What it takes to switch to PKStrokeRecognizer in iOS 27

The iOS 27 beta has PKStrokeRecognizer. It is an actor, and it is an API that recognizes strokes as text asynchronously on the device. It takes a PKDrawing as input. Recognition results can differ by OS, so storing a result means keeping recognitionVersion with it. A guide to recognizing handwriting and converting it to text is published as well. An app with an iOS 26.5 deployment target needs the Xcode 27 beta SDK, #available(iOS 27.0, *), and a fallback path that uses Core ML.

Swapping only the implementation is hard. The current DigitRecognizing takes [Float] and returns a digit and a confidence. PKStrokeRecognizer takes input through updateDrawing(_:), returns String? from recognizedText(strokeIDs:), and has no confidence. So a higher asynchronous boundary that takes the drawing and its context is needed.

recognize(drawing, context) async -> candidate 또는 reject

Here 또는 means "or": the call returns either a candidate or a reject.

The Core ML side can keep the current rendering and probability policy, and the new adapter can limit the text to 1 through 9. The rule for applying a result that has no probability automatically needs separate product validation. During the beta period I plan to keep the existing model.

The values 0.8, 0.7, and 60pt in this post are constants set by policy, not optimal values found by measurement. Two handwriting fixtures and a proxy evaluation on MNIST cannot speak for real accuracy, and the six items above stay open until they are checked on devices.

Exposing 81 Sudoku cells to VoiceOver and TalkBack

Wed, 05 Aug 2026 15:00:00 GMT

The DailySudoku board is a 9×9 square that shows digits and notes. For someone who looks at the screen and taps with a finger, turning a touch position into a cell number is enough. Someone who uses VoiceOver or TalkBack needs more: which cell has focus, what the cell contains, whether it is selected, and how to activate it.

This post compares the iOS and Android implementations based on the source code as of 2026-08-06. It is not a report that accessibility is done. It records the design rules I used and the parts that are still unverified.

What each cell has to say

On screen, the board is a single UIView on iOS and a single gesture container on Android. Assistive technology still receives 81 separate cells. Each cell needs this information:

Position: row and column numbers, starting from 1
Content: empty, a given digit, a value the user entered, an error, or notes
State: selected or not
Action and area: selecting the cell, and a rectangle that matches the cell on screen

An identifier or test tag such as game.cell.r0c0 is only for automated tests to find a cell. The description the user hears has to be separate from that identifier: a localized sentence that carries the position and the content. An example is a sentence saying that row 2, column 7 holds the digit 4.

One model for state, one function for input

The core game state is projected into models in the CellUi family. The model holds five things.

CellUi = value + given + error + notes + highlight

The colors and digits on screen, the calculation from coordinates to an index, and the description, state, and action for assistive technology all come from this model. The two platforms do not need the same view hierarchy. They need the same information from the same model.

Input also goes to one place. A tap, a drag, a VoiceOver activation, and a TalkBack double-tap all end in selectCell(index). I avoided separate accessibility-only logic because it could drift away from the state on screen.

iOS: one view, 81 accessibility elements

On iOS, a single BoardView draws the background, the grid, the digits, and the notes. Instead of one UIView per cell, it creates 81 UIAccessibilityElement objects. Apple's documentation describes this as the way to expose items that are not views.

Each element gets these values:

Array order: row-major (left to right, then top to bottom)
accessibilityLabel: the coordinates plus whichever of empty, given, error, value, or notes applies
accessibilityTraits: button, with selected added for the selected cell
accessibilityFrameInContainerSpace: the rectangle of the cell
accessibilityActivate(): calls onSelect(index)

When the size changes after rotation or Split View, the frames are calculated again. The values are set directly in container coordinates.

Two things are unverified. I still need to check whether the order in which indexes 0 through 80 are created matches the real VoiceOver swipe order and read-all order. I also have not verified that VoiceOver speaks the new value right away when the focused cell changes.

Android: pointerInput has no button meaning

On Android, container coordinates are converted to a 9×9 index, and tap and drag use the same hit test. Pointer changes that the board handles are consumed so they do not interfere with outer scrolling.

The problem is that pointerInput alone does not make TalkBack treat a cell as a button. The Compose guide to gesture handling levels explains that default semantics and focus support shrink as you go down from Button to clickable to pointerInput. So each BoardCell gets its description, role, and click action by hand.

These are the semantics attached to each BoardCell.

Modifier.semantics {
    contentDescription = cellDescription
    role = Role.Button
    onClick {
        onSelect(index)
        true
    }
}

The board handles continuous drags from ordinary touch, and semantics handles activation of the cell that TalkBack has focused. Putting clickable on each cell would make it compete with the board's pointerInput for the same events. This setup avoids that.

Where the two platforms still differ

Here is the source comparison as a table.

Item	iOS	Android
Each cell exposed separately	Yes	Yes
Position and content description	Yes	Yes
Button activation	Yes	Yes
Separate automation identifier	Yes	Yes
User-entered value	Read as a digit only	Distinguished as input
Selected state	`.selected`	None
Collection structure	None	None

Android has no selected or stateDescription. The background color of the selected cell changes, but the selected state does not reach TalkBack. Android also does not use collectionInfo or collectionItemInfo. The collection information described in the Compose semantics documentation tells the user the overall size and the current position. For now, both platforms convey the 9-row, 9-column structure only through the description text of each cell.

I set the next steps in this order. First, add the selected state on Android and listen to the speech output on both platforms. The 9×9 collection information comes after checking that it is not read twice together with the current row and column description. A custom rotor is worth considering only when there is evidence that moving through 81 cells in a line is a real problem.

The cells are small

The board size has an upper limit: 560pt on iOS and 520dp on Android. On Android, when the width is 840dp or more, the board and the controls sit side by side. In a foldable tabletop posture, the hinge splits the screen into top and bottom areas.

At any size, the drawing, the hit test, and the accessibility cells must point to the same index. They are recalculated on rotation, window size change, and foldable posture change. While the pause or completion modal is up, the board behind it is removed from navigation. iOS makes the overlay a modal accessibility area, and Android clears the background semantics.

The concern is cell size. The accessibility section of the Human Interface Guidelines gives a default control size of 44×44pt and a minimum of 28×28pt for iOS and iPadOS. The Compose documentation on default accessibility behavior recommends at least 48dp for interactive elements. With nine cells per row, a cell on iOS is narrower than 44pt when the board is narrower than 396pt. On Android, the cell computed from the code under a compact 360dp condition is about 34dp. That number is calculated, not measured on a device.

Because the Android cells carry hand-written semantics, they do not rely on the automatic target expansion that clickable provides. Still, growing all 81 areas to 44pt or 48dp at once would make them overlap, and it could become unclear which cell was chosen. I can only judge this after measuring focus areas, touch exploration, and finger mis-taps on real devices. The alternatives are enlarging the board, navigating by row or box, or a separate input method. I do not yet have grounds to pick one.

Text size is also open. Digits and notes on iOS are drawn at a fixed ratio of the cell, so they do not follow Dynamic Type. Where and how to show larger text is left for later verification.

What to lock down with tests

The existing checks cover cell state projection, coordinate hit testing, drag boundaries, part of the color contrast, and foldable areas. No test locks down the virtual accessibility elements or the cell semantics themselves. These are the items I plan to automate:

81 cells in the playing state
First and last coordinates (1,1) and (9,9)
A description for each of given, error, notes, empty, and an ordinary value
Selected state exposed only on the selected cell
One selectCell(index) call per activation
Areas that match after a resize
The board excluded after a modal appears
The 9×9 information and the current row and column in Compose

The UI tests described in the Compose accessibility testing documentation can check semantics properties and actions. In UIKit, unit tests can check the label, traits, frame, and activation. Being able to find an element with a selector does not prove accessibility.

I also listed what to check on devices. On an iPhone and an Android phone: the point where a swipe moves to the next row, whether the spoken cell matches the finger position, whether focus stays after a double-tap, and whether changes to digits, notes, and errors are noticed. The last check is to select, enter, correct, and finish without looking at the screen.

Apple's guide to supporting VoiceOver and the VoiceOver section of the Human Interface Guidelines recommend turning VoiceOver on and auditing element access, traversal, and tasks that depend on sight. The automated checks introduced in the Compose accessibility overview help find small targets and traversal order problems, but hands-on checking is still needed.

What the current source supports is this much: both platforms expose the cells separately and route selection to the same function. The selected state on Android, grid information on both platforms, whether the target size is adequate, speech output on state changes, and a full traversal on real devices are not verified. So I do not claim that the two platforms have reached the same level of accessibility.

A contract for counting ad impressions the same way on three platforms

Wed, 05 Aug 2026 15:00:00 GMT

In ad analytics, the event named ad_impression often gets recorded at a different moment on each platform. One app sends it when the ad finishes loading on iOS, when the SDK reports an impression on Android, and when the ad element is attached to the DOM on the web. The numbers end up in one table, but each platform counts by a different rule. Depending on the platform, the result is an overcount or an undercount.

Five things get mixed under that one name. They are downloading the ad, attaching it to the view hierarchy, overlapping the viewport, being counted as an impression by the SDK, and receiving a revenue callback. On top of that, adding a manual event to one that is already logged automatically counts the same impression twice.

This post is a contract I wrote after comparing what each callback means in the Google, Firebase, and web documentation. I reopened and checked the documents on October 4, 2026. It does not give SDK versions, measured logs, or run results. Choosing an ad provider is out of scope.

A finished load and a DOM mount are not impressions

Receiving an ad does not mean the user saw it. After loading, the ad may never be attached to the screen, and in the meantime the screen can close or the slot can switch to another ad. Being ready is not enough to count an impression.

Attaching to the DOM on the web is not enough evidence either. IntersectionObserver observes whether the ratio of overlap between the target and the root crosses a threshold. The default threshold is 0, so a notification can arrive as soon as the edges touch. Right after observe() starts, the first notification can arrive even for a target that is not visible. That notification cannot be treated as the basis an ad network uses for billing. What the documentation describes stops at observing the overlap.

Six stages an ad goes through

I split the mixed signals into stages, and for each stage I wrote down what is still undecided.

requested: the request has started. The response, the display, and the impression are all undecided.
loaded: a response or creative has arrived. The display and the impression are undecided.
rendered: the ad is attached to a view or the DOM. Whether it is really visible and whether the SDK counted it are undecided.
app_visible: the viewport condition defined by the app is met. Whether the network bills for it is undecided.
sdk_impression: the SDK counted an impression. Whether revenue data comes and how precise it is are undecided.
paid_value: revenue for the impression was observed. The settled amount and its accuracy are undecided.

Platform signals map to these stages as follows.

bannerViewDidReceiveAd(_:) on iOS and onAdLoaded() on Android are loaded. They are not counted as impressions.
bannerViewDidRecordImpression(_:) on iOS and onAdImpression() on Android are sdk_impression. The app records them only when there is no automatic collection.
Mounting the ad element on the web is rendered. It is not counted as an impression.
Meeting the observer rule is app_visible. It is used only for in-house ads.
paidEventHandler on iOS and OnPaidEventListener on Android are paid_value. They do not add to the count.

What counts as one impression

The SDK callback comes first as evidence of an impression. For in-house ads with no SDK, the visibility condition is written down, and when it is met the event is recorded with evidence=app_visible. That group is analyzed separately from the group observed by an SDK. Sharing an event name does not make the two groups directly comparable.

In this contract, a paid callback is treated as revenue data attached to an impression that was already counted. It does not add one more. Currency and precision are kept as they are. Precision can be unknown or estimated, so the value must not be read as a final settlement. When no revenue is provided, the value is not filled with 0 and is not calculated backward from the count. If a value is put into the Firebase ad_impression event, the currency has to go with it, and precision is kept in a separate revenue path.

The failure side is narrowed as well. ad_load_failed is recorded only when a provider that was actually requested failed to respond. A provider that was skipped because it is not registered or is turned off is not a failure. For the same reason, choosing a provider is not enough to send ad_impression. If a request was canceled when the screen closed or unmounted and its callback arrives late, it is not treated as a result of the current slot.

When events are logged automatically, the app does not send them

With AdMob linked to Firebase and automatic logging turned on, the app must not send the same event by hand. Sending the same GA4 event again inside onAdImpression() turns one impression into two. An SDK with no automatic collection records one event per callback, and an in-house ad records one event each time the visibility condition is met. External web content where only the DOM can be observed needs its own evidence rule.

Automatic events can lack fields such as slot or selection_source. Instead of sending another impression to fill them in, the gap is accepted and the analysis is done per evidence. Before paid data that goes to a separate server is converted into a GA4 event, the first check is whether automatic logging is on. The contract also states how the filled fields differ between automatic and manual events.

Slot, attempt, and ad instance

To remove duplicates, the app first has to define what one unit is. A slot is the unit for as long as the UI lives. An attempt is one request to one provider. An ad instance is the unit for as long as one creative lives.

This diagram shows one slot where a request fails, a second request succeeds, and a refresh produces a second impression.

slot instance
  ├─ attempt 1 → load failed
  └─ attempt 2 → loaded → impression 1
                            └─ refresh → impression 2

A single Boolean per session misses the impression that comes from a refresh. Sending every callback, on the other hand, can produce duplicates on retries and remounts. So a failure is kept once per attempt and an impression once per instance. When a refresh brings a new creative, it is a new instance, and only a repeated callback from the same instance is dropped. In-memory identifiers are enough for this. There is no need to send unique IDs to GA4 and create a dimension with too many distinct values.

The shape of the event inside the app

Inside the app, the event has few fields and only fixed values. The example below is not a standard GA4 schema. It is an internal example.

{
  "name": "ad_impression",
  "provider": "global_network",
  "format": "banner",
  "slot": "bottom",
  "evidence": "sdk_impression",
  "selection_source": "normal"
}

For provider, format, and slot, the mapping to each platform's enum is written in code. If a provider is added and a mapping is missing, the build or a test fails. The values given for evidence in the text are sdk_auto, sdk_callback, and app_visible. How sdk_impression in the example maps to those three values is not defined in this post.

selection_source is calculated for the object the event points to. If a forced provider fails and another provider's ad is shown, the source of the failure and the source of the impression can differ. Copying one source along the chain of requests distorts the meaning.

Checking without depending on ad inventory

Waiting for a real ad makes the check depend on inventory. Injecting callbacks directly in a test removes that dependency. The list below gives the expected values for such a check. It is not a record of a run that passed.

A successful load alone gives 0 impressions.
One SDK callback gives 1.
A repeated callback from the same instance still gives 1.
After a refresh with a new ad, the total is 2.
For a provider with automatic collection, manual events are 0.
A provider skipped before any request gives 0 failures.
When another provider is shown after a failure, there is 1 failure and 1 impression, and the source is calculated for each.
A late callback after unmount gives 0.
The first observer notification while not visible gives 0.
Two independent slots that are each shown give 2.

Putting the SDK callback first, the units of identity, and the design of the internal enums and source are my reading of the documents. They do not guarantee what a network bills or settles. An in-house visibility rule on the web has to be verified down to the threshold, the dwell time, and the reset when the ad leaves the area, and a single entry at one moment cannot tell how long the ad was visible. trackVisibility is limited and experimental, so it is left out of the required dependencies. How to link a revenue callback to the earlier impression, and how to handle the order in which callbacks arrive, are not covered in this post.

Daily puzzle scores: which day they belong to and how they get lost

Wed, 05 Aug 2026 15:00:00 GMT

When the result of a once-a-day puzzle is sent to both Game Center and Google Play Games, the date becomes a problem for a game that crosses midnight. In a game started at 23:50 and finished at 00:05, the day the puzzle belongs to, the day the SDK received the submission, and the range the leaderboard screen shows can all disagree.

Delivery is a problem too. The completion record and the statistics can remain on the device while the external score is lost. The opposite problem also exists: asking for sign-in in the middle of completion ties game progress to authentication.

The basis is the official Apple and Google documentation, which I reopened and checked on October 4, 2026. What those documents state is the behavior of the SDKs and the servers. The submission condition, where the sign-in screen goes, the in-memory slot, and the outbox are app-side design on top of that, not requirements of the documentation. The midnight case is a made-up example. This post does not give measured values, run logs, or SDK versions.

Three values that all look like a date

Three values look like the same "date" but have different owners. puzzle_day is the puzzle's date, decided by the app. submitted_at is the submission time, decided by the app and the device. leaderboard_window is the range used for queries, decided by the SDK.

The puzzle date is set when the game is created and does not change within the session. The submission time can change on every retry. Nothing guarantees that the SDK's window matches midnight on the device. So the date is not calculated again at completion. The value stored in the session is used.

This example shows how the three values differ in a game that crosses midnight.

퍼즐 생성: 2026-08-05 23:50 → puzzle_day = 2026-08-05
게임 완료: 2026-08-06 00:05 → submitted_at = 2026-08-06 00:05
제출 메타데이터                    → 2026-08-05

The three Korean labels mean "puzzle created," "game completed," and "submission metadata."

Extra values do not change the window

On Android, the puzzle date in yyyy-MM-dd form can be carried in scoreTag. scoreTag is an optional argument of submitScore in LeaderboardsClient. It allows only URI-safe characters and up to 64 characters. The documentation defines this value only as optional metadata. Using it to say which puzzle date a score came from is the app's own choice. It does not prevent duplicates per date and does not filter the screen. Putting 2026-08-05 in the tag does not split the rows of TIME_SPAN_DAILY by date.

context on Apple is the same. The context of submitScore is an extra value whose meaning the app defines, so how to express a date in it is the app's responsibility. It is not a way to control timeScope. If only context: 0 was sent, the puzzle date cannot be worked out from the score data. The fact that this value means different things on the two platforms should be written into the product requirements.

The day that the default screens show

Play Games leaderboards offer daily, weekly, and all-time, and the daily boundary is midnight UTC-7 all year. Apple's today scope is the last 24 hours. When an occurrence of an Apple recurring leaderboard changes depends on the recurrence settings in App Store Connect. Neither default daily screen guarantees a match with puzzle_day.

Take an app whose puzzle changes at midnight in Seoul. Scores for the new puzzle and for the previous day's puzzle can fall into one Google daily window. Apple's today scope can also hold scores from both days. This comes from a different contract for the displayed range, and editing the tag does not solve it.

There are three paths, depending on the requirement.

If the SDK's daily screen is enough, use the extra value and the default UI.
If occurrences need to be told apart on Apple, consider a recurring leaderboard.
If both platforms must use the same calendar rule and the same query rule, a separate store and a custom UI are needed.

The last path brings costs for operations, anti-cheating, and privacy management. For a simple daily competition, I judged that it does not need to be introduced in advance. That judgment is my reading, not something the documentation says.

When to submit and when not to

The SDKs do not define when to submit. The policy below is an example of what the app decides: a score is submitted only when three conditions are all met.

submit = won && daily && authenticated

In free mode, after a loss, or without authentication, nothing is sent. When the authentication state is uncertain, only a check that shows no screen is allowed. The sign-in screen belongs on the path where the user presses the leaderboard button. A disabled service, a signed-out user, or a canceled sign-in must not make completion, statistics, or the screen transition fail.

The device has its own duties at completion. It prevents the terminal transition from being handled twice, deletes the resume data, and updates the statistics and the daily completion record. The external submission is a separate attempt, and its failure does not roll completion back.

The phrase "local first" needs care here. The phrase alone does not say that the write to disk finishes before the submission. On Android, if the submission starts right after an asynchronous write is scheduled, the order in which the two finish is not defined. If the disk record has to be settled first, the design needs to wait for the save to complete.

Holding one score for a short while

On Android, a score can arrive in the short moment when no UI host is connected. One design for that case holds at most one score in memory. This is a design on the app side, not a feature of the SDK. If A is held and B arrives, B replaces A. When an Activity connects, the score is taken out, authentication is checked, and it is submitted once.

Activity 없음
  score A 보류
  score B 도착 → A를 B로 교체
Activity 연결
  B를 꺼내 인증 확인 → 제출 시도

In the block, the lines read: no Activity, score A is held, score B arrives and replaces A, an Activity connects, and B is taken out, authentication is checked, and a submission is attempted.

The in-memory slot exists to reduce short lifecycle races, and its limits are clear. If the process dies, the held score is gone. If authentication is false or the check fails after the score is taken out, it is not put back. If iOS has no equivalent in-memory slot, the chance that a score is delivered also differs between the two platforms.

Keeping the latest item is a rule inside the device only. Google applies a score only when it is better than the value on the server, and Apple picks the best score or the most recent score depending on the setting. The app choosing the latest item does not mean the server adopts that record.

The call itself differs too. submitScore does not report a result, and submitScoreImmediate returns a Task. With the call that reports nothing, the app cannot tell whether the submission succeeded. For the one that returns a Task, too, the documentation says nothing about sending again after the app restarts.

How far to guarantee delivery

Splitting the delivery level into three is also my own classification. The documentation does not make this distinction.

One direct attempt: send once within the session. It costs the least and fits a feature that can afford to miss a score.
One slot in memory: keep the latest item while there is no host. The cost is low, and it fits short lifecycle races.
Durable outbox: the score can be sent again after a restart. The cost is high, and it fits cases where a lost submission affects rewards or contest results.

With a durable outbox, the payload is written to disk first. A stable submission ID, puzzle_day, the score, and the target leaderboard are stored. Only items with a success response are deleted, and the remaining items are restored on restart. Backoff and success confirmation are part of it. The server keeping an existing better record and the app deciding to stop resending are judged separately. Storing a submission ID does not mean the SDK removes duplicates or processes a score exactly once.

If loss is accepted, the queue is not extended into a general-purpose one. The conditions under which a score is dropped are written into the documentation and the tests.

Expected values to pin with tests

The expected values below are a plan: keep the condition and the holding policy as pure functions and pin them with tests. This post does not include results from a run.

A win in free mode or a loss in daily mode gives 0 submissions.
A daily win without authentication gives 0 submissions and no sign-in screen.
Playing from 23:50 to 00:05 keeps the session's puzzle date.
With no Activity, A followed by B keeps only B.
If the process dies while a score is held, nothing is submitted after restart.
If authentication fails after the score is taken out, it is not held again.
If the remote request fails, the completion record and statistics remain.
For a latest score lower than the previous one, the device's latest choice and the server's best choice are checked separately.
If the terminal event arrives again, completion is recorded once and submission is attempted once.
The default daily and today queries use the SDK's time range, not the extra value.

Unit tests prove only the app's branches and the payload. They are not evidence that a score actually reached the server. Canceled sign-in, offline use, and display errors of the leaderboard intent and the access point have to be checked separately in an integrated environment. The different meaning of a day on the default screens, the loss of the in-memory score, the call whose result is unknown, and the order in which the disk write completes all remain as limits of this design.

Why a daily puzzle ID needs a generator version

Wed, 05 Aug 2026 15:00:00 GMT

The board of a daily puzzle is made from the date. That is how the Sudoku app DailySudoku works. With the same day integer and the same core build, entering through the normal daily screen gives the same board on iOS, Android, and the web. But if the way boards are generated changes, the board can differ even when the seed stays the same. When the keys for storage, analytics, and leaderboards hold only the date, that difference is hard to express.

The baseline is commit 9c99930582be23d2c72d37fb46d77a488b9fe04c on the develop branch, dated August 6, 2026. I describe the current structure and the proposal on top of it separately. The DailyPuzzleIdentity type, the device-local-v1 day policy, the g1 and g2 IDs, schema v2, and the resolver are all proposals and are not implemented yet.

How a daily puzzle is created today

Entering the daily puzzle screen decides the board in this order.

현재 시각
  -> 기기 로컬 시간대의 epochDay
  -> dailySeed(epochDay)
  -> generate(MEDIUM, seed)
  -> puzzleId = "DAILY-<epochDay>"

The first two lines read "current time" and "epochDay in the device's local time zone."

dailySeed uses the SplitMix64 finalizer and is computed with 64-bit wrapping addition, wrapping multiplication, and logical shifts. The generator builds a complete board with its own RNG and then removes only the clues that keep the solution unique. This core is written in Rust. iOS and Android call it through UniFFI, and the web calls it through WebAssembly.

From the normal daily entry point, with the same day integer and the same core build, the fresh board and the solution match on all three platforms. That determinism and the golden fixtures are explained in the post on testing and CI for the shared core.

The date is the device's local date

The day integer comes from the device's local date, not the UTC date.

localEpochDay = floor((utcMillis + offsetAtInstant) / 86_400_000)

The offset is "local minus UTC" at that instant. The one that returns milliseconds is TimeZone.getOffset on Android. secondsFromGMT(for:) on iOS returns seconds, so it is converted to milliseconds. getTimezoneOffset on the web returns "UTC minus local" in minutes, so the sign is flipped and the value is multiplied by 60_000. Because of daylight saving time, the offset must not be a constant.

Under this policy, the day integer can differ between Seoul and Los Angeles at the same UTC instant. A time zone change after travel affects the ID on the next launch. A game that has already started keeps its date, and the date is decided again the next time the daily puzzle is entered. There is no guarantee that the whole world gets one board at the same moment. Conversely, devices that pick the same day integer, such as ones in Seoul and Tokyo, get the same board when the core and the difficulty are the same. So the time zone ID can be left out of the identity fields.

What a date-only ID misses

DAILY-<epochDay> has neither the difficulty nor the generator version. The version: 1 in the JSON that Rust stores is the number of the serialization format. The reader rejects any other schema that has no migration. That number is not the version of the generation algorithm.

There is a case where generation really changed. For the Expert difficulty, the maximum number of attempts was raised from 8 to 4,096, and for seed 159 a 24-clue board came out in place of the earlier 25-clue fallback. This is the change history of Expert, and it is not evidence that MEDIUM, which the daily puzzle uses, changed. It should be read only as a case showing that generation rules can change.

If the generator changes while old and new apps run together, this happens. A new game in the old app is a board made by g1. A new game in the new app is a board made by g2. A restored game is the stored g1 board. All three can use the same DAILY-day. When the storage format is compatible, the old game can continue by restoring the board and the solution, but the collision of the external ID in analytics remains. Standard Game Center and Play Games have no feature that splits scores by a dynamic puzzle ID. Which version's scores to accept has to be decided before submission. The limits of context and the score tag are covered in the post on leaderboard date boundaries.

The proposed identity

I propose a type that groups the day policy, the day integer, the difficulty, and the generator version.

type DailyPuzzleIdentity = {
  dayPolicy: "device-local-v1";
  epochDay: number;
  difficulty: "MEDIUM";
  generatorVersion: number;
};

Each field has its own responsibility. dayPolicy covers the boundary of a day, epochDay the chosen date, difficulty the generation target, and generatorVersion the seed derivation, the RNG, and the generation rules. With dayPolicy in place, changing the date rule later does not apply the new rule to old identities. Metadata that records the observed time zone and dayPolicy have different roles.

Written as a string ID, the identity looks like this.

DAILY-device-local-v1-20671-MEDIUM-g1

The seed can be computed again from epochDay, so it does not need to be in the ID. It can still be used in stored data or telemetry as a helper value for diagnosis and fixtures.

generatorVersion is kept separate from the Cargo package version. A change to the UI or an ad SDK alone does not need a bump. A change to the RNG, the shuffle, the difficulty target, clue removal, or retries bumps it depending on whether results are affected. The meaning of a version that has been issued is never changed. If Rust returns the identity and the board together as one result, a g2 board cannot end up with a g1 label.

A unique solution and a stable identity are different questions

Each time the generator removes a clue, the solver looks for up to two solutions, and only a removal that leaves exactly one solution is accepted. This is a check on a freshly generated board. Whether an ID such as DAILY-20671 points to exactly one board is a separate matter.

solver invariant
  -> 이 board에는 해답이 정확히 하나인가

identity invariant
  -> 이 PuzzleIdentity는 배포·복원·분석 전체에서 같은 board를 뜻하는가

The first question asks whether this board has exactly one solution. The second asks whether this PuzzleIdentity means the same board across release, restore, and analytics.

The solver cannot catch two different uniquely solvable boards sharing an ID, and it cannot catch one board having several IDs.

Fixtures have limits too. A fixture only tells whether the result changed for the chosen inputs. The mistake of changing generation rules without bumping the version cannot be blocked automatically by the return API alone. If whole-board equality has to be guaranteed, a canonical digest or an archive fills the gap. A hash only says that something changed. It does not say why, or which generator to use to build the board again. So the version contract of the identity comes first, and whether to add a checksum is decided after that.

Moving stored data

For schema v2, I propose storing the snapshot together with the versioned identity. Existing v1 saves are labeled g1 only when the release history confirms that all of v1 was g1.

A save whose origin is unknown is isolated as legacy-<digest>. The digest is a canonical digest of the givens, the solution, and the difficulty. The entries, the history, and the elapsed time are left out. Such a save is excluded from version comparison. A past record that lacks a board or a version stays as legacy-unknown.

A new game uses the active version, and regenerating a past date uses the recorded version.

PuzzleIdentity.generatorVersion == 1 -> g1 또는 저장된 g1 board
PuzzleIdentity.generatorVersion == 2 -> g2 또는 저장된 g2 board

On each line, the right side reads "that generator, or the stored board of that version."

A past version that is not supported is reported as an error and is not quietly built with another version. A product with no replay of past games only needs the board and solution of the save in progress and a path that carries the identity. When there is replay or server-side verification, the old generator or an immutable archive is needed.

What to keep when rolling back

If g2 has a problem and is rolled back, the version-aware binary stays, and only new issuance moves from g2 to g1. A board already assigned as g2 stays g2.

The order is fixed as well. First comes a compatible build that reads both v1 and v2 and uses versioned IDs but issues only g1. After that, g2 is turned on by a build or a remote policy. During the rollback period, both g1 generation and reading of g2 snapshots are kept. Going back to an old binary that does not know versions is not allowed.

This switch cannot be forced at once in the current structure. The generator is inside the client binary, and nothing central picks the version. Even if the server or the web is rolled back, a g2 mobile app that is already installed keeps running g2. Versioning cannot force one board per day in a mixed rollout. If that is required, a single authority has to manage an immutable mapping from the date to the generator version and also operate the handling of old clients. That means the server issues the identity or the board, or the minimum app version is controlled.

In a structure that ships both generators and picks one through the server or Remote Config, new issuance can be switched to g1. A stored g2 game finishes with its original identity and board. Excluding g2 scores has to happen before submission, and querying by version needs a custom backend or leaderboards that were split in advance.

Checks that exist now and checks to add

Today the parity fixture pins the seed, the givens, and the solution for the combination of 4 epoch days and 5 difficulties. Overwriting the existing fixture with new results erases the contract of the old version. The fixed 64-bit seed arithmetic is checked with golden values, drift in fresh boards with the Rust tests and parity, and uniqueness with clue removal and tests on selected seeds. Checking 4 by 5 combinations does not prove every input.

For the switch, I propose leaving the g1 fixture as it is and creating the g2 fixture as a new file.

g1 fixture: 변경 금지
  (device-local-v1, day-before-cutover, MEDIUM, g1) -> board A

g2 fixture: 새 파일
  (device-local-v1, cutover-day, MEDIUM, g2) -> board B

resolver test
  저장된 g1 identity -> g1 또는 저장 snapshot
  새 g2 identity     -> g2

The Korean notes say that the g1 fixture must not be changed and that the g2 fixture is a new file. In the resolver test, a stored g1 identity resolves to g1 or the stored snapshot, and a new g2 identity resolves to g2.

There are four things to confirm. The g1 board and solution match on supported builds. Different versions give different external IDs. After a rollback, g2 is not treated as g1. The versions of the identity and the board are never mixed. On the Swift, Kotlin, and TypeScript side, the algorithm is not copied for testing. The tests cover storing and restoring the ID and passing it to the analytics and score policies.

The order of implementation is combining the Rust return value, keeping the identity in schema v2, replacing the analytics key, checking the version at score submission, and fixed fixtures per version. Until a second generator exists, a small switch is enough for dispatch, and there is no need to build a separate factory or a general migration system first.

Identifying the generator version, the contract for old and new versions living together, and migration and rollback per version are all still unimplemented. The determinism guaranteed today holds only while the input and the code are fixed, and that is different from an identity contract that lasts. The constraint on splitting scores in Game Center and Play Games has to be checked again if the platforms or the configuration change.

Ordering ad providers by GeoIP region without the location permission

Wed, 05 Aug 2026 15:00:00 GMT

When the ad providers an app can use differ by region, the app has to know which region the user is in. The information it needs is not coordinates. A country, or an area broader than that, is enough. Asking for precise location access just to pick an ad is a heavy cost for both the user and the app.

Below is a design that does not use the OS location permission. It decides the order of providers from a region that the server estimates from the IP address. It explains what each signal means and where it can be wrong. This post has no record of observing or measuring a real failure, and it does not give the versions of the SDKs and services. Only the example function that decides the order was run, and the result is in the section "What running the example function showed."

What the official documentation explains directly is how the location permission, the CDN location headers, and the UMP gate each behave. Looking up the region after consent, the per-process cache, the split between the resolver and the loader, the provider chain, and the expected values in tests are not requirements of the documentation. They are my own design choices made on top of it.

Four signals that hint at a region

Signals that look like a region mean different things.

The app language is a preference for a language that is comfortable to read.
The country in the Locale is a setting the user chose.
OS location services give a value measured by the device, and they come with permissions and the handling of sensitive data.
GeoIP is a region estimated from an IP address observed from outside.

Using Korean is not enough to choose a domestic provider. While traveling, or when the setting was never changed, the Locale and the current place can differ. GeoIP can also be wrong or empty because of a VPN, a relay service, or a carrier gateway. And the server that does the lookup sees the IP address.

So the signals are considered from the least precise up. The Locale is used only as a default for language and policy, not as the basis for whether a provider is available in a region. GeoIP is requested separately, only when a regional branch is needed, and when there is not enough to decide, the result stays unknown. For a feature that really needs location, the context and the minimum permission level are weighed against Apple's guide to location authorization and Android's guide to minimizing permission requests.

Consent first, region second

The order at app start is as follows.

Refresh the stored consent state.
Handle the consent UI if it is needed.
Check the gate that says ads may be requested.
Resolve the region once per process and keep it in memory.
Build the provider array for the region bucket.
Request in the order of the array.
If everything fails, end with in-house content.

An example of the gate is canRequestAds in Google UMP. Being allowed to request ads and being able to trust the region estimate are separate matters.

When consent has not been confirmed, or external ads are blocked, the region lookup is not made at all. What to show in that case is decided by the product and its policy, but external ads must not be called through a side path.

Initialization being called twice has to be prevented as well. Initialization can be entered both right after the consent refresh and from the completion callback of the consent UI. Reusing the region task in progress, or the plan already built, reduces duplicate requests and races.

The server returns only a bucket

The location headers that a CDN adds are based on the IP address the server observed. CloudFront request headers are one example. The city value can be missing, and names that are not ASCII can arrive encoded. If every app parses raw city values and keeps its own policy, the work is duplicated, so the server builds the region bucket and sends that down.

There are three buckets. regionalMarket is a candidate for trying the regional provider first, otherMarket is the target of the global provider, and unknown means the region could not be classified. The response does not include coordinates, the IP address, or the city name. If branching by city is truly required, only an identifier used by the business rule is sent. A missing header, a decoding failure, or a validation failure gives unknown.

The CDN cache needs attention too. If the response varies by region but the header is not in the cache key, the result for one region can be reused for another. Conversely, splitting the key too finely lowers the cache hit rate. The policy states either that the response is not cached, or that it is cached by the coarse bucket the server built.

Separate region resolution from ad loading

The region resolver has no dependency on an ad SDK, and the ad loader has no dependency on the IP address or the Locale. The two are connected only through enums.

This example checks the consent state first and returns an array of provider candidates for the region bucket. The function does not load ads. It only builds the array.

enum ConsentState {
    case pending
    case adsAllowed
    case externalAdsBlocked
}

enum AdRegion {
    case regionalMarket
    case otherMarket
    case unknown
}

enum AdProvider {
    case regional
    case global
    case inHouse
}

func makeAdPlan(
    consent: ConsentState,
    resolveRegion: () async -> AdRegion
) async -> [AdProvider] {
    switch consent {
    case .pending, .externalAdsBlocked:
        return [.inHouse]
    case .adsAllowed:
        break
    }

    switch await resolveRegion() {
    case .regionalMarket:
        return [.regional, .global, .inHouse]
    case .otherMarket, .unknown:
        return [.global, .inHouse]
    }
}

The example turns one policy into code. Returning [.inHouse] when consent is not finished or is blocked, and trying the global provider for unknown, are not general rules. Whether to try the global provider for unknown depends on the regions the service supports and on the consent conditions. That choice is not hidden inside the resolver. It is made visible in the chain policy.

The function itself has no guard against running twice, no network timeout, and no loader. Running once and caching the result is implemented by the caller, or by the resolver reusing its task. The loader tries the array in order and stops at the first success. It does not call a failed provider again right away, and it does not restart the whole chain. inHouse is the last option that keeps the slot from being empty when every external request fails. When a provider is added, only the chain changes and the resolver is left alone.

iOS, Android, and the web can share the contract of buckets and priority. The implementation modules do not have to be merged. Each platform uses its own SDK and keeps only the contract ConsentState → AdRegion → [AdProvider].

What running the example function showed

I compiled makeAdPlan above as it is and ran every combination of the three consent states and the three region buckets. It ran on macOS 27.0.1 with Swift 6.4, on October 4, 2026. The run also prints how many times the closure that returns the region was called.

pending + regionalMarket -> [geodemo.AdProvider.inHouse] resolveRegion calls=0
pending + otherMarket -> [geodemo.AdProvider.inHouse] resolveRegion calls=0
pending + unknown -> [geodemo.AdProvider.inHouse] resolveRegion calls=0
adsAllowed + regionalMarket -> [geodemo.AdProvider.regional, geodemo.AdProvider.global, geodemo.AdProvider.inHouse] resolveRegion calls=1
adsAllowed + otherMarket -> [geodemo.AdProvider.global, geodemo.AdProvider.inHouse] resolveRegion calls=1
adsAllowed + unknown -> [geodemo.AdProvider.global, geodemo.AdProvider.inHouse] resolveRegion calls=1
externalAdsBlocked + regionalMarket -> [geodemo.AdProvider.inHouse] resolveRegion calls=0
externalAdsBlocked + otherMarket -> [geodemo.AdProvider.inHouse] resolveRegion calls=0
externalAdsBlocked + unknown -> [geodemo.AdProvider.inHouse] resolveRegion calls=0

geodemo is the module name of the executable. With consent pending, or with external ads blocked, the region lookup never happened and only the in-house provider came out. The lookup happened once only when ads were allowed, and the regional provider came first only for the regional bucket.

What this run confirmed stops at the function that decides the order. A real GeoIP lookup, an ad SDK, the loader that tries providers in order, the timeout, and the cache were not run.

Keep going when the lookup fails

The network request for the region lookup is restricted.

Only the specified HTTPS target is allowed, and unexpected redirects are blocked.
The timeout is a few seconds at most, and the request is not repeated while the screen is rendering.
The response size is limited, and only bucket values on an allow list are accepted.
A response that does not fit is treated as unknown.
The result and the request in progress are reused within the process.
The raw IP address and city are not stored on disk and not written to analytics logs.

An HTTP error, a timeout, being offline, and a parsing error are all handled as ordinary failure values. Concrete numbers for the timeout and the response size are not set here.

The in-memory cache has a limit. After the network changes, the previous bucket can still be used. I judged this acceptable for a coarse priority hint, and the region is evaluated again when the process next starts. No measurement that backs this judgment is included here. Until measurement shows that a long-lived cache is needed, permanent storage and expiry handling are not added.

No permission does not mean anonymous

Without the OS location API, the location permission prompt does not appear. But the GeoIP server and the CDN still process the IP address. Describing "no permission needed" as "anonymous" or "no location data is handled" is not accurate.

The purpose, the retention, the transfer to third parties, and the relation to consent have to be reviewed against the real data flow. The app receives only the bucket, the server does not keep the IP address and location headers longer than needed, and the value used for routing is not used for a long-term profile. Collecting less and complying with the law or store policy are separate things. Apple's privacy guidelines are a reference from this point of view.

What to pin with tests

Calling the real GeoIP service and ad SDK can give a different result on each run because of VPNs, network state, and ad inventory. Unit tests inject the region function and the loader and pin the expected values below.

If consent is pending, there are 0 region lookups and in-house is chosen.
If ads are allowed and the bucket is regional, the regional provider comes first.
If the regional provider fails, the chain moves to global once.
On a timeout or a response error, global is chosen through the unknown path.
If every external request fails, the chain ends with in-house.
If the consent completion callback arrives twice, the lookup and the plan are each made once.

In an integrated environment, the conditions to check are offline, a slow response, a missing header, an encoded city value, a VPN, and Private Relay. The pass criteria are that only allowed provider combinations appear, that the flow ends within the time limit, and that raw sensitive values do not show up in logs. How often the real location is guessed correctly is not a pass condition.

The goal of this design is that the app does not stop even when GeoIP is wrong. The expected values and the integration conditions above are the criteria for checking that goal. Of these, what a run confirmed is that the function that builds the plan produces only allowed combinations. Results that confirm a real lookup ends within the time limit, and how the loader behaves, are not in this post.

Keeping and revoking a one-time remove-ads purchase on iOS and Android

Wed, 05 Aug 2026 15:00:00 GMT

I added a product that removes ads permanently to the iOS and Android versions of DailySudoku, a Sudoku app. At first it looked as if storing whether the purchase succeeded would be enough. But the result right after the purchase turned out to be a poor basis for judging the state later. The app can be reinstalled, a payment can stay pending, and a purchase can be refunded.

The source baseline is commit 9c999305 on the develop branch as of August 6, 2026. That is separate from anything confirmed in a release on the stores. Below, the behavior of that source, what the Apple and Google documentation says, and what the automated tests cover are kept apart. That is as far as this post goes. Records of paying and refunding on real devices, and run logs, are not in it.

What is missed when only the purchase result is stored

A purchase notification is only one of the inputs. Ownership is refreshed by reading the current list of entitlements. Storing only the purchase result misses the following.

The user canceled the payment.
A pending payment completed after the app was closed.
The purchase was made on another device.
The data was reset or the app was newly installed.
A refund, a cancellation, or a revoke happened.
The connection dropped before the result arrived.

So three inputs are merged into one entitlement state.

구매 이벤트 ───────┐
앱 시작·복귀 조회 ─┼─> 검증된 현재 권한 ─> 로컬 캐시 ─> 광고 게이트
스토어 외부 변경 ──┘

From top to bottom, the three inputs on the left are the purchase event, the query at app start and return, and a change made outside the app in the store. They lead to the verified current entitlement, then the local cache, then the ad gate.

Each input has its own job. The purchase notification is used to tell the user right away. The query at app start and on return to the foreground recovers missed changes and changes from other devices. Updates carry changes while the app is running. All three end up sharing the same adFree value.

The local value is a cache

The Boolean stored on the device is a cache for drawing the screen, not the source of truth for ownership. Both the snapshot and the updates write true and false as they are. After a refund, false goes in and ads are allowed again.

There is one ambiguity here. adFree == false can mean "not owned," and it can also mean "not queried yet." If the two cases are not told apart, a user who bought the product can see an ad right after launch. So whether the query has finished is marked separately with entitlementsSynced.

The condition that allows ads is computed from three values.

adsEnabled = entitlementsSynced && !adFree && consentAllowsAds

While entitlementsSynced == false, no ad is requested. A user who has not bought enters the ad path after the first restore finishes, and a user who has bought stays blocked because adFree == true. The settings, home, difficulty selection, game, and statistics screens share this decision.

How the ad objects are handled differs by platform. When blocked, the Android side does not create the Compose subtree at all and releases the native view that was attached. On iOS, the banner is collapsed and further loads are suppressed. Whether an already loaded provider is torn down on iOS is not verified by automated tests. The ad disappearing from the screen is not enough to say that the SDK has stopped its background work.

iOS: what is read from StoreKit 2

A purchase is handled according to the result of Product.purchase().

For .success(.verified(transaction)), the entitlement is granted and the transaction is finished.
For .success(.unverified(...)), the entitlement is not granted.
For .pending and .userCancelled, it is not granted either.

Changes while running are observed through Transaction.updates. Ask to Buy, a purchase on another device, and a revoke arrive there. At app start and on return to the foreground, Transaction.currentEntitlements is checked for the product ID of the remove-ads product and for a verified result. According to the documentation, this list holds the latest entitlement for a non-consumable, and items that were refunded or revoked are left out. If the query finishes with no matching product, false is stored.

On a reinstall or a new device, the latest transaction is provided automatically, so in normal use the currentEntitlements query is enough. A manual restore runs only when the user chooses restore in settings. At that point AppStore.sync() is called and the entitlements are queried again. That call can show an authentication prompt, so it is not run automatically at app start.

The price is refreshed separately. The ownership flow and the consent flow do not need to wait for the price response.

Android: what is read from Play Billing

The product type on Android is INAPP. One-time products have no separate API for non-consumables, so the purchase is acknowledged and not consumed.

The flow follows the Play Billing integration guide. queryProductDetailsAsync returns the products that can be sold to that user and the localized price, and launchBillingFlow is called with the returned ProductDetails and the offer token. The purchase arrives through PurchasesUpdatedListener or is found by a later queryPurchasesAsync.

The entitlement is granted only when the product ID and the purchase state are checked and the state is PURCHASED, and since the purchase is not consumed, it is acknowledged. PENDING is not a confirmed failure. It is a state waiting for completion, such as a cash payment or an additional approval. Google's guidance is not to grant the benefit while the state is PENDING and to handle it after it turns PURCHASED. The state can change while the app is closed, so queryPurchasesAsync() in onResume() recovers missed changes.

Verification and acknowledgement are different jobs. Verification checks that the purchase is legitimate and has not been handled already. Acknowledgement tells Play that the benefit was delivered. According to the documentation, a normal purchase can be refunded automatically if it is not acknowledged within 3 days after turning PURCHASED, and for a purchase by a license tester that window is 3 minutes.

What the current implementation trusts is narrow. It checks PURCHASED and the product ID as reported by BillingClient, and acknowledges on the client. It does not verify the purchase token on a server. Google's billing security guide recommends verifying with the Google Play Developer API on a secure backend before granting the benefit, and acknowledging on the server as well. For now the setup accepts trusting the client, and it cannot be described as having completed server verification.

Restore, refunds, and failed queries

The purpose of a restore is not to find out whether something was bought in the past. It is to make the cache match the current snapshot. At start and on return, the Android side queries with queryPurchasesAsync(INAPP), and changes while running arrive through the listener or are recovered by the query on the next resume. A manual restore also queries the current inventory again.

The moment a refund takes effect differs by platform. On iOS it is reflected in an update or a later snapshot. On Android the value becomes false when the next inventory query succeeds.

An empty result and an error have to be told apart. The product not being there and the store being unreachable are different events. Right now, when the connection or the inventory query fails on Android, adFree is left as it is and entitlementsSynced = true is set. This policy has a cost in both directions. A buyer who reinstalled has a cache of false and can see ads until the state is recovered. A user who got a refund can stay blocked from ads until a query succeeds.

The iOS model has a gap too. With no verified matching item the value becomes false, but an unverified case and a temporarily empty false negative are not classified separately. The failure policies of the two platforms differ, and neither is a guarantee of safety.

The improvement I have in mind is to split the state into unknown, owned, and notOwned, or to tell an error apart from a successful empty result. On top of that, each product decides between fail-open and fail-closed. This is still a proposal, not a fix that has been made.

Restores that run at the same time need checking as well. Five asynchronous paths write to the cache: purchase, update, start, resume, and manual restore. The issue is the order in which the start query and the foreground query finish, and locking the connection alone does not serialize the whole reconcile. A past snapshot that arrives late can overwrite a newer value.

When the price cannot be fetched

The price shown is the localized value from the store, and no fixed price is written on the screen. On both platforms, the settings screen hides the remove-ads row when the price is nil. But the manual restore control is on the screen opened from that row.

As a result, when the price query fails, the entry point for retrying by hand disappears. Automatic recovery at start and resume keeps running. The screen also cannot tell a product that is not registered from a temporary network failure.

The improvement is to disable only the buy button and show restore separately, and to tell an empty product response from an exception in retries and in monitoring. This too is a proposal.

Ways to test and expected results

On the Apple side, StoreKit configuration in Xcode allows local tests of transactions, interrupted purchases, refunds, and revokes. Flows that involve an account are checked in Sandbox or TestFlight.

With a license tester, the real purchase flow and test payment methods can be exercised on Android. If the package name and the tester account conditions are met, a debug-signed sideloaded build can be tested too, and the test tracks are for checking before release. It is not correct to say flatly that a direct ADB install always fails or that only an install from Play works.

Below are the results I intend to confirm. They are not a record of runs that passed.

New purchase: ad requests stop, the state holds after a relaunch, and the product cannot be bought again.
User cancellation: no entitlement and no success message, and the purchase can be tried again.
Approval after pending: no benefit while pending, and one grant after PURCHASED.
Cancellation after pending: no benefit is granted.
Already owned: ownership is recovered on a new device, after a reinstall, and by manual restore.
Completed outside the app: recovered by an update or the next resume.
Lost connection: a successful empty response and a query error are told apart.
Failed acknowledgement: retried and completed within the allowed window.
Refund and revoke: the cache becomes false and ads are allowed again.
Fast app switching: repeated background and foreground does not let a past query overwrite the value.

The automated tests cover little. On iOS they cover storing false on a restore with nothing owned, and the price refresh. A hosted unit test cannot cover the UI path of a real successful purchase. The purchase and restore in PlayBillingProvider, the pending notice, a failed acknowledgement, the Settings row, and the full truth table of the ad gate are missing from the automated tests on the Android side. Passing local tests is not enough to say that real store payments were confirmed.

What remains is server verification on Android, the screen for the pending state, the error model, concurrent reconcile, the restore entry point, and checking the store scenarios on real devices. The 3-day and 3-minute acknowledgement windows, the offer token condition, and the eligibility of a debug-signed sideload are what the documentation said on the baseline date, so they have to be checked again in the official documentation when a policy or a library changes.

Verifying a verification script with deliberately broken input

Wed, 05 Aug 2026 15:00:00 GMT

Automated checks before a release can all pass while the output is still missing a required file, or holds the same content for locales that should differ. This happens with scripts that check the resources and metadata of a cross-platform app. The checks ran to the end, yet the rule they were meant to protect was never examined.

Whether a check script really catches a defect only shows when it is given input that has one. This post goes through putting a single defect into a copy of a good sample and confirming that the check fails with the expected category. Combinations of platform builds and tests are out of scope. I ran the example with a small validator on Python 3.14.5, and the result is written below the example.

What exit status 0 does not tell you

There are several ways for a check to skip the rule and still end in success.

A glob does not match, so there are 0 targets.
A missing tool or environment variable is treated as success.
The generating side and the checking side share the same wrong default.

In each case the exit status can be 0, so the value 0 alone cannot tell whether the rule was checked. The pytest exit codes separate these two as well. The code is 0 when all collected tests pass, and 5 when no tests were collected.

I suggest making the same distinction in a check script you write yourself. Failing to find a required output is a problem with the input contract, and a missing tool or input in a required CI job is a problem with the setup. Skipping an optional check is a separate state with the reason recorded. The candidate states are pass, validation-failure, invalid-setup, and skip. These four are my own design, not something the pytest documentation defines.

Judging a failure needs more information than the exit status.

category or rule_id
The number of inputs processed and the number of required checks
Exit statuses that separate environment errors from contract violations
A distinction between an empty target set and an allowed skip

If the only requirement is "it exited abnormally," a syntax error or a permission problem can be miscounted as catching the defect. For a sample that breaks the image size rule, the expected category is wrong_size. An internal_error caused by failing to read the file is not evidence that the rule worked. CI compares against a stable category value, and the descriptive message is for investigating the cause.

A sample with exactly one defect

In this post, a negative control means a defective sample that has what it takes to be rejected. The term is not carried over as defined in statistics or experimental fields. Put the disallowed value dark into a copy of the good data and require invalid_value, and everything from reading the input to reporting the error is checked in one go.

A sample is made by copying a reviewed fixture to a temporary location, changing it, and discarding it afterwards. The files that actually ship are not touched. If good data is rejected, or defective data is accepted, the check has not met the conditions for being trusted.

Putting a contract violation into a good sample is what this post calls a mutation. Each run changes one rule only. Examples are inserting the disallowed value dark, deleting a required file, making the content of two locales identical, and changing the size information of an image. With several defects at once it is hard to tell which one was caught, and a tool that stops at the first failure never reaches the later rules. So one mutation is paired with one expected category.

Tools such as Stryker and PIT also use the word mutation. They change the program code and watch whether the tests react. In Stryker's description of states, a mutant is killed when at least one test fails and survived when all tests pass. PIT's basic concepts describe equivalent mutations, changes that do not alter behavior. Tests cannot detect those. The same holds when input is changed by hand, so the cases chosen have to really break the contract. Up to here the content is from the documentation, and carrying the idea over to checks on input files is my own reading. The idea of trusting a test because it was seen to fail is also in a Google Testing Blog post.

An example that confirms the baseline first

Before any defective sample goes in, the good sample has to pass. The exit status must be 0 with 0 failures. Without this condition, an abnormal exit caused by a defect that was already there can be counted as catching the new one.

The example assumes that the JSON result of the validator contains the category of each entry in failures, and checked. Exit status 0 is a pass, 1 is a contract violation, and anything else is a setup or internal problem. There are 4 input contracts. The first part is the function that runs the validator and reads the result, followed by the check of the good sample.

import json
import shutil
import subprocess
import tempfile
from pathlib import Path

FIXTURE = Path("validator-fixture")
PASS = 0
VALIDATION_FAILED = 1
REQUIRED_CHECKS = 4


def validate(root: Path) -> tuple[int, set[str], int]:
    result = subprocess.run(
        ["python", "validate.py", str(root), "--json"],
        check=False,
        capture_output=True,
        text=True,
    )
    report = json.loads(result.stdout)
    failures = {item["category"] for item in report["failures"]}
    return result.returncode, failures, report["checked"]


baseline_code, baseline_failures, baseline_checked = validate(FIXTURE)
if baseline_code != PASS or baseline_failures or baseline_checked != REQUIRED_CHECKS:
    raise SystemExit(
        f"invalid baseline: checked={baseline_checked}, "
        f"failures={sorted(baseline_failures)}"
    )

The next part applies each of the four mutations to a copy in a fresh temporary directory. It uses the names from the block above.

cases = [
    ("invalid-value", "invalid_value"),
    ("missing-file", "missing_file"),
    ("duplicate-content", "duplicate_content"),
    ("wrong-size", "wrong_size"),
]
if not cases:
    raise SystemExit("no mutation cases")

for mutation, expected_category in cases:
    with tempfile.TemporaryDirectory() as temp:
        root = Path(temp) / "fixture"
        shutil.copytree(FIXTURE, root)
        subprocess.run(["python", "mutate.py", mutation, str(root)], check=True)

        code, failures, checked = validate(root)
        introduced_failures = failures - baseline_failures

        if code != VALIDATION_FAILED or checked == 0 or expected_category not in introduced_failures:
            raise SystemExit(
                f"survived mutation: {mutation}, checked={checked}, "
                f"failures={sorted(failures)}"
            )

When the list of mutation cases is empty, the script fails before it enters the loop. The failures after the mutation, minus the failures of the baseline, are the newly introduced failures. A case passes when the exit status is 1, the number of checks is not 0, and the introduced failures contain the expected category. In this example the baseline failures have to be empty to get this far, so the set difference equals the set of failures after the mutation. A case still passes when other categories appear alongside the expected one.

When a condition is not met, the script raises SystemExit. It does not use assert, because Python's -O option removes assert statements. The CI decision is made with explicit condition branches.

validate.py, mutate.py, and the fixture itself are not in this post. For the run I wrote a small separate validator with four rules. With the normal validator, all four mutations were detected. When I changed the validator to report the expected category while performing 0 checks on a mutated copy, the version without the checked == 0 condition ended as a pass, and the version with it ended with survived mutation. That condition and the check for an empty list were added to the original example. Handling of JSON that cannot be parsed, and separate handling of environment errors, are not in the example either.

Keeping the judgment apart from the generator

If the generating code and the checking code use the same decision function, or the fixture is built only from the latest generated output, the same error can be hidden on both sides. Sharing a neutral schema is fine. The criteria for allowed values, sizes, and uniqueness come from the written contract and from material a person has reviewed.

In CI, I suggest keeping one defective sample per core rule and running them when the validator or the discovery code changes. The order is this.

Confirm that the tool and the fixture exist.
Confirm the state of the good sample and the minimum number of checks.
Apply one mutation to each copy.
Confirm that the expected category was detected.

A required CI job fails when a tool or input is missing, when the number of tests is 0, when the number of checks is 0, or when there are 0 mutation cases. Only skipping an optional item is allowed, with a reason. When a defect goes undetected, look at how files are discovered, how errors are reported, and how the expected category is set. Keeping the baseline result and the expected and observed categories as CI artifacts makes that investigation easier.

A few reviewed samples are enough to start. The example compares only the set of category values, though, so it cannot tell apart several failures of the same category in different places. When the location of a failure matters, use the combination of rule_id and a normalized relative path. The CI procedure looks at whether the number of checks is at least a minimum, while the example checks that the number for the good sample equals 4. The number of checks on a mutated copy is only tested for being 0 and is not compared with a minimum. A change that does not alter behavior cannot be detected by this method either.

Who watches the watcher: finding a scheduled job that vanished

Wed, 05 Aug 2026 15:00:00 GMT

While checking the automation of an app, I once found the records and reality out of step. The job ledger said a retry job had been registered, but querying the scheduler returned only one gate poller. The gate kept doing its work, so the missing retry did not show. There was not enough evidence to pin down when or why it had been deleted.

A scheduled job that has been deleted cannot report its own failure. This post goes through a state comparison for finding that kind of gap, and a setup in which the monitoring does not stop together with what it monitors. Cron here is not only the Unix crontab. It also covers the GitHub Actions schedule and the Kubernetes CronJob. The original query output and logs, and measurements after a repair, are not included. The versions of the scheduler and tools used at the time, and the environment they ran in, were not recorded either.

Zero errors is not zero runs

Different kinds of failure leave different traces.

An error during a run leaves a start record, the error, and a failure count, and the job can retry from the inside.
A run that stalls partway shows up as a start record with a stale heartbeat. Whether it can recover from the inside depends on conditions.
An object that was made inactive is still in the scheduler but cannot recover from the inside.
A deleted object, or a stopped scheduler, sends no report from the inside at all, and cannot recover from the inside either.

So zero errors alone cannot be read as healthy. The possibility of zero runs has to be ruled out first.

Roles in the ledger, real objects in the query result

An ID written in the ledger is only a reference for looking things up. It is not evidence that the object is registered now. The desired state holds the role, the schedule, and the command, and the actual state holds the objects that were returned and whether they are active. Recreating an object can change its ID, so the comparison uses role keys such as retry and gate. Putting a version on the schedule and on the run template also helps detect outdated settings. The pseudocode for comparing the sets of roles is this.

expected = desired_jobs_by_role
actual = scheduler.list()

missing    = expected.roles - actual.roles
duplicates = actual.group_by(role).where(count > 1)
mismatched = actual.where(spec_version != expected.spec_version)

It states what the comparison means, and a result of running it is not in this post. The pseudocode alone misses two cases. First, comparing only the version does not catch someone editing the schedule or the command without bumping the version. The actual schedule and command, or a hash of the whole desired specification, have to be compared for each role. Second, an object whose role is not in the expected list is neither missing nor a duplicate, so it would stay. actual.roles - expected.roles needs its own category, with an alert to investigate ownership and no automatic deletion.

One desired state is matched against four observed stages.

desired: the expected roles in a versioned specification
registered: whether the real object exists, and its enabled or suspend state
executed: the last start time and the run history
succeeded: a last success within the time limit
progressed: a checkpoint, the queue depth, the completion time

Each stage tells you something different. According to the Kubernetes CronJob documentation, when .spec.suspend is true, later runs stop even though the object exists. A run can also stall or fail after it starts. Even when the success time is recent, only a checkpoint tells whether the input was empty or a condition was wrong. I suggest obtaining the list of real objects and the last success time first, and widening to business metrics when the need comes up.

What monitoring inside the same scheduler cannot see

The structure in the case I first saw had a flaw. The relation ran one way, with retry repairing the other poller, while that poller only did its own work. If retry is deleted, nothing is left to do the repair. Making the two check each other does not help against a failure that hits both in the same scheduler.

Comparing when a session restarts or when settings change provides a basic safeguard. It leaves a gap between one check and the next, though. When detection has to be continuous, an outside dead-man monitor checks the time of the last success. The outside monitor and the delivery of its alerts are things to check as well. The aim is to run the monitoring and what it monitors on separate foundations, so that one stopped scheduler does not stop both.

The monitoring chapter of the Google SRE book calls monitoring based on metrics exposed by the internals of a system white-box, and testing externally visible behavior as a user would see it black-box. Seen this way, the internal list, the run history, and the heartbeat are white-box. My reading is that it is black-box only when a separate system directly checks the end result from the user's point of view, and that installing the monitor outside does not by itself make it black-box.

The order for comparing and repairing

The repair is split into five steps.

observe → classify → re-read → repair → verify

Query the list and the active state, then classify the result as missing, duplicate, inactive, drift, or unexpected, which is a role that is not in the expected list. Query once more to filter out races and temporary delays. After that, create only what is missing from a version-controlled literal template, check the role, the schedule, the command, and the spec version again, and update the ID in the ledger. The goal is one object per expected role. Several objects with the same role raise a duplicate alert, and a role that is not in the expected list raises an unexpected alert. Either way, an object whose ownership is unknown is not deleted.

Automatic repair is limited to missing objects whose ownership and specification are certain. The other states are handled like this.

inactive: check the change history, then activate it explicitly.
duplicate: alert on the risk of concurrent runs, and have a person look into the ownership.
drift: check the expected version and who made the change.
unexpected: have a person find out who created it and why. It is not deleted automatically.

An inactive state or a drift that someone made on purpose must not be overwritten. This comparison runs when a process starts or resumes, and right after settings change. When detection has to be faster, add a periodic check from outside.

Alerting on the time of the last success

The Prometheus instrumentation guide says the key metric of a batch job is the last time it succeeded. The same document says that to track the time since something happened, you export the Unix timestamp at which it happened, not the time since. The elapsed time is calculated at query time. The condition for whether the time since the last success of retry has passed the threshold is this.

time() - job_last_success_timestamp_seconds{job="retry"} > stale_after_seconds

As a starting threshold I suggest twice the run interval plus the longest expected run time. The Prometheus alerting guide also says to page when a batch job has not succeeded recently enough, and that this should generally be at least enough time for 2 full runs. The value is not a number settled by measurement. It is adjusted by how much the run time varies and how much detection delay is acceptable. A normal success that comes one interval late has its alert held back within a grace window, and a run that passes its timeout after starting is classified as a stale execution or a hang.

The case where the series does not exist at all is looked at separately. The PromQL functions reference has absent() and absent_over_time(). According to the Pushgateway guide, the Pushgateway does not remove the series it received on its own. It keeps exposing them until they are deleted by hand, so a stale success value can remain. That is why a missing series and a stale success time are told apart.

When the object is missing, look at registration, the comparison process, and the real list.
When the success metric is missing, look at instrumentation, collection, the first run, and scrape or push.
When the success time is stale, look for delay, failure, or a stall in the history and logs.

Where to look also depends on the observed stage.

With no recent start, look at the trigger and the scheduler.
With a start and no success, look at the logs and the timeout.
With a recent success and a checkpoint that has stopped moving, look at the input and the business conditions.
With no heartbeat from the watcher, look at the outside probe and the alerts.

What a scheduler guarantees also differs by product. According to the Kubernetes documentation, a CronJob creates a Job about once per scheduled time. In some circumstances two Jobs are created, or none, so Jobs should be idempotent. startingDeadlineSeconds and concurrencyPolicy are settings that control delay and concurrent runs, and they do not guarantee exactly-once execution. According to the GitHub Actions schedule documentation, the schedule event can be delayed during periods of high load and queued jobs may be dropped, and it runs only when the workflow file is on the default branch, and only on that branch. Whatever the product, the things to look at in common are the object, the run history, and the success time.

The part that compares and classifies sets can be checked with unit tests. Real delays, duplicates, and gaps are things to check in staging or in an isolated production check. Results of running them are not in this post. Why the first gap happened was not settled either. Comparing intermittently leaves a gap in detection, and the outside monitor and its alerts can fail too. There can be a delay before a newly created object shows up in a query. Querying again right after creation can still show it as missing, and a second object would then be created. To avoid a duplicate, wait with a bounded retry until the object is visible, or make creation idempotent by using the role key as a unique name.

Rust shared core, part 7: splitting tests and CI by layer

Sat, 25 Jul 2026 15:00:00 GMT

The goal of checking the common rules in Rust and having three clients consume the result is not only less code. The results have to match. Yet each platform has places that can still break after the Rust tests pass.

iOS: the Rust tests pass, and linking fails.
Android: the debug build works, and an ABI is missing from the release AAB.
Web: the dev server works, and wasm loading fails in the production build.

These three are cases that can happen, not a record of incidents I went through. This part sorts out which layer's checks should catch such failures.

Domain checks belong in Rust

I recommend concentrating the checks on the rules in the Rust engine. For Sudoku, that covers puzzle generation, the correctness of the solver, invalid number input, the reducer for toggling notes, the reproducibility of the daily seed, difficulty classification, the serialization round trip, boundary values, and error conversion. I recommend setting them up to run with cargo test, with no mobile simulator or emulator.

It is good to pin the result for the same seed and the same sequence of actions. What can make results differ is the time, the locale, the source of randomness, and the time zone slipping in implicitly. So I suggest taking them as input: a timestamp parameter in place of reading the current time, a specified seed for randomness, and a locale code received from outside.

Shared fixtures and the responsibility of each layer

I suggest using JSON fixtures that hold input and expected values as the contract. These are examples of files that could be there.

fixtures/
  start-game-easy-seed-001.json
  apply-action-set-value-valid.json
  apply-action-set-value-conflict.json
  daily-puzzle-2026-06-24.json
  completed-game-score.json

The list above gives example file names. Two of them were actually written in an example, and their content is in the section "Fixtures read from both sides in an example." In this design the Rust tests and the tests on each platform read the same fixture files directly. In the example, the two sides that actually read them are Rust and Node. A passing fixture means that range of input was checked.

Each layer checks something different.

Rust test
  -> 도메인 규칙이 맞는가

iOS test
  -> Swift adapter가 Rust 결과를 맞게 해석하는가

Android test
  -> Kotlin adapter와 native library 연결이 맞는가

Web test
  -> wasm package와 TypeScript wrapper가 맞는가

In order, the Korean questions read: are the domain rules right, does the Swift adapter interpret the Rust result correctly, is the connection between the Kotlin adapter and the native library right, and do the wasm package and the TypeScript wrapper match.

iOS checks how Swift interprets the DTOs. Android checks the Kotlin conversion, the serialization settings, and the native linking. The web checks how TypeScript converts the values returned by wasm, and the package linking. I do not think each client needs to test the whole algorithm of the engine again. This division is not set by the UniFFI documentation or that of any other tool. It is my own design choice.

Fixtures read from both sides in an example

In a small example I wrote two fixtures and had a Rust test and a web-side test read the same files. It is not a real app, only a minimal workspace for checking the structure. The tools were cargo 1.96.0, wasm-pack 0.15.0, and Node 24.14.1, and the date was October 4, 2026. The fixture for an input that conflicts looks like this.

{
  "request": { "seed": 0 },
  "action": { "type": "set_value", "row": 0, "col": 2, "value": 5 },
  "expected": { "ok": false, "cell_index": 2, "cell": "0", "error_code": "conflict" }
}

The Rust test reads every file in the directory and compares the result with the expected values. It also checks the number of files, so a missing fixture fails the test. This is fixtures.rs without its imports and its other tests.

const ENV: &str = r#"{"locale":"ko-KR"}"#;

// 저장소의 fixtures/ 를 그대로 읽는다. Web 쪽 테스트도 같은 파일을 읽는다.
#[test]
fn fixtures_match_expected() {
    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../fixtures");
    let mut checked = 0;
    for entry in fs::read_dir(dir).unwrap() {
        let path = entry.unwrap().path();
        let fixture: Value = serde_json::from_str(&fs::read_to_string(&path).unwrap()).unwrap();
        let snapshot = sudoku_core::start_game_json(&fixture["request"].to_string());
        let result: Value =
            serde_json::from_str(&sudoku_core::apply_action_json(&snapshot, &fixture["action"].to_string(), ENV)).unwrap();
        let expected = &fixture["expected"];
        assert_eq!(result["ok"], expected["ok"], "{path:?}");
        assert_eq!(result["error"]["code"], expected["error_code"], "{path:?}");
        if result["ok"] == true {
            let next: Value = serde_json::from_str(result["snapshot"].as_str().unwrap()).unwrap();
            let index = expected["cell_index"].as_u64().unwrap() as usize;
            assert_eq!(&next["cells"].as_str().unwrap()[index..index + 1], expected["cell"].as_str().unwrap(), "{path:?}");
        }
        checked += 1;
    }
    assert_eq!(checked, 2, "fixture 수가 달라졌다");
}

The Korean comment says that the test reads the repository's fixtures/ as is and that the web-side test reads the same files. The message in the last assertion says the number of fixtures has changed.

The web side loads the package built by wasm-pack in Node and reads the same directory.

// Rust 테스트와 같은 fixtures/ 를 읽어 wasm 패키지의 결과를 대조한다.
import { readdirSync, readFileSync } from 'node:fs';
import { createRequire } from 'node:module';
import assert from 'node:assert/strict';
import test from 'node:test';

const wasm = createRequire(import.meta.url)('./wasm-node/sudoku_wasm.js');
const dir = new URL('../fixtures/', import.meta.url);

for (const name of readdirSync(dir)) {
  test(name, () => {
    const fixture = JSON.parse(readFileSync(new URL(name, dir), 'utf8'));
    const snapshot = wasm.start_game(JSON.stringify(fixture.request));
    const result = JSON.parse(wasm.apply_action(snapshot, JSON.stringify(fixture.action), '{"locale":"ko-KR"}'));
    assert.equal(result.ok, fixture.expected.ok);
    assert.equal(result.error?.code ?? null, fixture.expected.error_code);
    if (result.ok) assert.equal(JSON.parse(result.snapshot).cells[fixture.expected.cell_index], fixture.expected.cell);
  });
}

The comment on the first line says it reads the same fixtures/ as the Rust test and compares the result of the wasm package.

These are the results from both sides, taking only the test result part of each run's output. cargo test -p sudoku-core is above, and node --test is below.

running 5 tests
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

✔ apply-action-set-value-conflict.json (2.652125ms)
✔ apply-action-set-value-valid.json (0.324083ms)
ℹ tests 2
ℹ pass 2
ℹ fail 0

One of the five Rust tests is the fixture test. Adapter tests for iOS and Android were not written. Reading the same fixtures from Swift and Kotlin is a part that was not confirmed.

CI builds the artifacts from a fresh checkout

The goal of CI is to reproduce building the artifacts from a fresh checkout. The steps can be split into five groups.

Rust
  cargo fmt
  cargo clippy
  cargo test

UniFFI
  generate Swift binding
  generate Kotlin binding
  generated output validation

Apple
  build Rust static library
  create XCFramework
  xcodebuild build/test

Android
  build Rust .so per ABI
  generate Kotlin binding
  Gradle unit test
  assemble release or debug
  native library packaging check

Web
  wasm-pack build
  typecheck
  test
  production build

The block above lists the names of steps and is not a CI configuration file. No CI configuration file was written. In the example, the tests, binding generation, the XCFramework, the .so files for Android, and the Wasm build are tied together in one script. I copied only the sources to a fresh directory, ran it from the start, and it ended with exit code 0. That was a single run, and not on a CI server.

Stale output has to be caught too. Be wary of relying on generated code and binaries left on a local machine, and I suggest checking that there is no diff before and after regenerating in CI.

Splitting jobs makes it easier to decide where to look first when something fails. Examples of job names are rust-core, uniffi-bindings, apple-xcframework, android-native, web-wasm, and contract-fixtures. If a shared fixture fails, look at the domain contract first, and if only iOS fails, look at the Apple package setup first. The candidates to look at on each platform are these.

iOS: the slices of the XCFramework, a mismatch in the Swift bindings, differences in Xcode, and the target difference between a device and the simulator
Android: the ABI, the name of the .so, the NDK, 16 KB pages, and the Gradle packaging settings
Web: how wasm is started, the bundler, the point where it meets SSR, and a mismatch in the TypeScript declarations

What to check before release, and how much to run

Six items are checked before a release.

Whether the app reflects the version of the Rust core
Whether the Rust API and the UniFFI output match
Whether the XCFramework contains the device and simulator variants
Whether the Android release has the required ABIs and supports 16 KB
Whether wasm starts in the web production build
Whether the expected values of the fixtures match on every platform

I recommend moving what a machine can check into CI and leaving only what a person has to look at on the release list.

What to run and when is for the team to decide. The team decides whether a PR that changes the core also requires the platform app builds, and whether the full combination runs on a nightly or on the release branch. Running everything on every PR can raise the cost. The compromise I suggest is this.

A PR that changes the core: Rust tests, binding generation, and fixture checks
A platform integration PR: the build and tests of that platform
A release candidate: all of iOS, Android, and the web

This setup is a recommendation. How many times it succeeded after being applied in CI, how long a run takes, and a CI configuration file are not here. The only passing record is the local run of the example. The cost of running the full combination remains, and items that are hard to automate and need a person stay on the release list. A passing cargo test alone cannot guarantee the state of the adapters, the native packages, or the web release.

Rust shared core, part 6: using it on the web as a Wasm package

Thu, 23 Jul 2026 15:00:00 GMT

Applying the rules of the Rust core used on iOS and Android to the web as well needs a way to run the same code in a browser. WebAssembly is that way. It is a low-level binary format for browsers, Rust can compile to it with the web as the target, and it is used together with JavaScript.

That does not mean writing the whole web app in Rust. Part 6 uses Sudoku to explain what Rust and the web each take on, and when and where a Next.js app initializes Wasm.

What Rust takes and what the web takes

The candidates on the Rust side are the things whose results and rules have to be the same across platforms: puzzle generation, the solver, validation, the action reducer, score calculation, and the seed of the daily puzzle.

What I recommend leaving on the web side is the React components, routing, localStorage and IndexedDB, keyboard shortcuts, pointer interaction, analytics, and the service worker. The DOM, fetch, hydration, accessibility, and browser storage are also better handled by TypeScript and the web framework. The web builds its UI state from the results of calling Rust.

Two tools and a directory layout

Two tools share the work. wasm-bindgen exposes Rust functions to JavaScript and generates the wrapper and TypeScript declarations. wasm-pack builds the crate and bundles the WebAssembly binary, the JavaScript glue code, and the package metadata into a form that can be consumed from npm. Up to here the content comes from the documentation of the two tools. The directory layout and the initialization approach below are my own design choices.

core/sudoku-rs/crates/
  sudoku-core/      # 순수 Rust 로직
  sudoku-wasm/      # wasm-bindgen 공개 API

packages/
  sudoku-wasm/      # wasm-pack output 또는 wrapper package

apps/web/
  app/              # Next.js / React 앱

The Korean comments in the block mean, in order: "pure Rust logic" on the sudoku-core/ line, "the public wasm-bindgen API" on the sudoku-wasm/ line under crates/, "wasm-pack output or a wrapper package" on the sudoku-wasm/ line under packages/, and "the Next.js / React app" on the app/ line.

sudoku-wasm calls sudoku-core. The web app imports @app/sudoku-wasm and does not see Rust's internal model directly. Managing it as a package makes the dependencies and the location of the artifacts visible. The versions and the target option I used in an example are in the section "A Wasm package built from an example." The current wasm-pack documentation says it may describe features that are not in a released version, so check that it matches the version in use.

Where to initialize in Next.js

In Next.js, code runs on the server and in the browser. Running a browser-only module in a server component or during a static build can cause an error. So I suggest fixing the place and the time of initialization.

Client Component
  -> dynamic import("@app/sudoku-wasm")
  -> init wasm
  -> create SudokuEngineClient

A Client Component does a dynamic import, initializes Wasm, and then creates the SudokuEngineClient. Another option is lazy initialization in the state layer, on first use.

The UI has to be able to tell whether the engine is ready. I suggest managing five states.

wasm loading
wasm ready
wasm failed
engine action pending
engine action failed

Without showing these states, the user can get a blank screen or a button that does nothing. Apart from whether the core is stable, the initialization process affects how stable the app feels. Real error messages and steps to reproduce are not included in this post.

One call per UI event

I recommend avoiding calls to Rust per cell inside React render, or on every pointer move. It is better to pass the snapshot and the action once per UI event and receive the next snapshot and the effects.

The contract the app sees has two methods.

export interface SudokuEngineClient {
  startGame(request: StartGameRequest): Promise<GameSnapshot>;
  applyAction(snapshot: GameSnapshot, action: GameAction): Promise<Transition>;
}

In this structure React uses only this client, and the generated raw functions are called only inside the client implementation. The SudokuEngineClient on iOS, Android, and the web can differ in implementation, but the meaning in the domain and the contract the app sees stay the same. Conceptually it sits in the same place as the adapter on mobile.

The types may need one more step. The generated TypeScript declarations alone may not cover all the domain types of the app. So a separate wrapper is a good idea. That wrapper converts what Wasm returns into the app's types and does JSON decoding, schema validation, and error code mapping.

A Wasm package built from an example

I built this structure as a small example and loaded it from Node. No real web app is involved. It is a minimal workspace that checks the structure. The tools were wasm-pack 0.15.0, wasm-bindgen 0.2.129, and Node 24.14.1, and the date was October 4, 2026. The binding crate only wraps the functions of the core. Keeping the JSON-facing functions in the core as well is where the example departs from the design in part 2, to stay small.

use wasm_bindgen::prelude::*;

#[wasm_bindgen]
pub fn start_game(request_json: &str) -> String {
    sudoku_core::start_game_json(request_json)
}

#[wasm_bindgen]
pub fn apply_action(snapshot_json: &str, action_json: &str, environment_json: &str) -> String {
    sudoku_core::apply_action_json(snapshot_json, action_json, environment_json)
}
// … validate_snapshot and generate_daily_puzzle have the same shape.

There is one build command. The target is nodejs, because the run was in Node and not in a browser. The grep and sed after it keep only the completion lines of the output and shorten the absolute path. Run on its own, this line can end as a success even when the build fails, because of the last command in the pipe. The script that was run has set -euo pipefail at its top so that such a failure is not missed.

wasm-pack build crates/sudoku-wasm --target nodejs --out-dir ../../out/wasm-node 2>&1 | grep -E "Done|ready" | sed 's#at .*/out/#at out/#'

The output directory got sudoku_wasm_bg.wasm, sudoku_wasm.js, sudoku_wasm.d.ts, sudoku_wasm_bg.wasm.d.ts, and package.json. The .wasm file was 142,894 bytes. These are the TypeScript declarations generated in sudoku_wasm.d.ts. The two lint comment lines at the top of the file are left out.

export function apply_action(snapshot_json: string, action_json: string, environment_json: string): string;

export function generate_daily_puzzle(request_json: string): string;

export function start_game(request_json: string): string;

export function validate_snapshot(snapshot_json: string): string;

Every argument and return value is a string. As described earlier, turning that string into the app's types and validating it is work a wrapper has to do separately. I loaded this package in Node with require and called the functions, and two tests that read the shared fixtures passed. Those tests are in part 7.

What was not done is worth writing down too. No build was made for the web or bundler target. Initialization in a browser, the dynamic import in Next.js, and a client and wrapper that return a Promise were not built.

Both sides read the same fixtures

I suggest that the Rust tests and the web tests use the same fixtures. The Rust side checks the output of the engine, and the web side checks that the wrapper interprets the same result correctly. The aim is to find the case where the engine is right and the type conversion is wrong.

fixtures/
  daily-seed-2026-06-24.json
  apply-action-note-toggle.json
  invalid-move-conflict.json

The date in the file name is an identifier in the example. How to set up tests and CI is covered in the next part.

What this setup emphasizes is not speed. It is that the three platforms use the same domain rules. Performance numbers and an implementation that handles initialization failure are not here. Testing went as far as running two fixtures in Node. The interface that returns a Promise is an example of the contract the app sees, and this post has no definition of the fields of Transition.

Rust shared core, part 5: what to check when shipping a .so on Android

Sat, 04 Jul 2026 15:00:00 GMT

When a Rust module shared by several platforms goes into Android, generating the Kotlin bindings does not finish the integration. If an ABI is missing or in the wrong place, or if a platform or store condition is not met, the build, the install, or the run can fail somewhere.

Part 5 covers the build wiring and the compatibility checks for putting a Rust binary into an Android release. The versions and policies in it are the values in the Android documentation as I rechecked it on October 4, 2026. The environment in which I built an example is recorded separately in the section "The alignment of a .so built from an example."

Each ABI needs its own .so

The ABIs the NDK supports are four: armeabi-v7a, arm64-v8a, x86, and x86_64. Which of them to ship is decided by the app's policy. For each chosen ABI, a .so has to be built with the matching Rust target.

The output goes under jniLibs in the app module, in a directory per ABI. Below is an example with three ABIs chosen.

apps/android/
  app/
    src/main/
      jniLibs/
        arm64-v8a/libdomain_core.so
        armeabi-v7a/libdomain_core.so
        x86_64/libdomain_core.so

This layout makes the file for each ABI easy to find. Copying the files by hand carries a risk. After the Rust code changes, the app can still contain the old binary.

Wiring the Rust build into Gradle

The ABIs, the page size, and the compatible versions come from the documentation. The Gradle task setup in this section and the checklists further down are my own design choices built on that, not requirements of the documentation.

To avoid copying by hand, connect it to the build. This setup makes preBuild depend on a task that builds Rust.

preBuild
  dependsOn buildRustCoreForAndroid

buildRustCoreForAndroid
  -> ABI별 cargo build
  -> UniFFI Kotlin binding 생성
  -> jniLibs / generated source 경로에 output 배치

The three arrows read: build with cargo for each ABI, generate the UniFFI Kotlin binding, and place the output in the jniLibs and generated source paths.

The block above draws the relation between tasks and is not a Gradle configuration to use as written. The order is to compile with cargo, generate Kotlin code with UniFFI, and put the results in the jniLibs and generated source paths.

Without inputs and outputs declared on the Gradle task, unnecessary rebuilds can happen, or a change can go undetected. The boundary of the task has to be set with both local speed and reproducibility in CI in mind.

Hide generated types behind a Kotlin interface

Exposing generated types across ViewModels, Composables, and repositories increases coupling. A Kotlin adapter and the SudokuEngineClient contract separate the internal model. This is the shape of the interface I propose.

interface SudokuEngineClient {
    fun startGame(request: StartGameRequest): GameSnapshot
    fun applyAction(snapshot: GameSnapshot, action: GameAction): Transition
}

The implementation calls UniFFI, and the ViewModel uses only this contract. Tests can put in a fake. Using the same Rust module on the web as a WebAssembly package is left to part 6.

Heavy Rust computation is handled off the main thread. I recommend separating the choice of dispatcher in the ViewModel scope from the update of UI state, and not exposing the Rust dependency to Compose UI. Measured cost and the specific dispatcher are not given in this post.

The 16 KB page rule

According to the Android guide to 16 KB page sizes, apps on Google Play that target Android 15 (API level 35) or later have to support 16 KB pages on 64-bit devices. From February 1, 2027, updates that do not support 16 KB cannot be released. The earlier version of this post gave November 1, 2025 as the start date, and that date is not in the document as rechecked on October 4, 2026. Native code brought in by SDKs is in scope, so a Rust .so is included.

Per the documentation, NDK r28 and later use 16 KB alignment by default. Even so, every library in the release has to be checked without relying on the default. An old binary brought in by an ad or analytics SDK can affect the compatibility of the whole app.

Four items need checking.

The ELF alignment of every .so
Behavior on a 16 KB emulator or device
Whether third-party SDKs contain native code
Whether the inspection used the release APK or AAB, not a debug build

The alignment of an APK is checked with zipalign, and the page size of a connected device is read with adb.

zipalign -c -P 16 -v 4 app-release.apk
adb shell getconf PAGE_SIZE

These two commands look at the alignment of the APK packaging and at the condition of the device. They do not by themselves confirm the ELF alignment of every .so or that the app works. A project that ships mainly as an AAB adds the Play Console pre-launch report, or an APK built from the bundle, to what is checked. I could not run these two commands. No APK could be built, for the reason given in the next section.

The alignment of a .so built from an example

I built a small Rust example for three ABIs and checked the ELF alignment myself. The workspace is not a real app. It is a minimal one made to check the structure. I ran it on October 4, 2026, on macOS 27.0.1 with cargo 1.96.0 and the NDK installed on this Mac, 30.0.15729638-beta2. That is a different version from the NDK 28.2 in the section "Pin the tool versions" below, and it is a beta. The three Android targets of Rust were already installed.

For each target, cargo is told to use the NDK's clang as the linker. The alignment is read from the LOAD lines of llvm-objdump -p, which is the method the Android guide gives. These lines are taken from the build script. Two things are simplified because it is an example. The first line picks the highest version among the installed NDKs, so installing another NDK can change the result. To reproduce it, give the NDK path or version explicitly. The 24 in the linker names stands for minSdkVersion. If the app's minSdk is lower than 24, it has to match that value.

NDK=$(ls -d "$HOME"/Library/Android/sdk/ndk/* | sort -V | tail -1)
TC="$NDK/toolchains/llvm/prebuilt/darwin-x86_64/bin"
# …
export CARGO_TARGET_AARCH64_LINUX_ANDROID_LINKER="$TC/aarch64-linux-android24-clang"
export CARGO_TARGET_ARMV7_LINUX_ANDROIDEABI_LINKER="$TC/armv7a-linux-androideabi24-clang"
export CARGO_TARGET_X86_64_LINUX_ANDROID_LINKER="$TC/x86_64-linux-android24-clang"
for target in aarch64-linux-android armv7-linux-androideabi x86_64-linux-android; do
  cargo build -q -p sudoku-uniffi --release --target "$target"
  so="target/$target/release/libsudoku_uniffi.so"
  echo "$target: $(stat -f %z "$so") bytes"
  # …
done

The alignment was read with one more script. sort -u collapses lines with the same value into one.

OBJDUMP="$NDK/toolchains/llvm/prebuilt/darwin-x86_64/bin/llvm-objdump"
for target in aarch64-linux-android armv7-linux-androideabi x86_64-linux-android; do
  echo "$target"
  "$OBJDUMP" -p "target/$target/release/libsudoku_uniffi.so" | awk '/LOAD/ {print "  LOAD " $(NF-1) " " $NF}' | sort -u
done

The two scripts printed the following. The file size per ABI is above, and the alignment on the LOAD lines is below.

aarch64-linux-android: 716632 bytes
armv7-linux-androideabi: 505140 bytes
x86_64-linux-android: 686000 bytes

aarch64-linux-android
  LOAD align 2**14
armv7-linux-androideabi
  LOAD align 2**12
x86_64-linux-android
  LOAD align 2**14

For the 64-bit ABIs, arm64-v8a and x86_64, every LOAD segment was 214, which is 16 KB. The guide says the load segments must not have values less than 214. For the 32-bit armeabi-v7a, the value was 2**12. The 16 KB rule is about 64-bit devices. No linker option was passed separately.

More was left unchecked than checked. Gradle is not on this Mac, so no APK or AAB could be built. That means the zipalign check, the jniLibs placement, a release build, and loading on a device or an emulator were not tried. The Kotlin bindings were generated and not compiled.

Pin the tool versions

In the compatibility table of the AGP 9.1 release notes as rechecked on October 4, 2026, the values for AGP 9.1.1 are Gradle 9.3.1, JDK 17, and NDK 28.2.13676358. From AGP 9.0 on, the default NDK is in the r28 line, and 9.1.1 uses the same default. Different NDK versions among developers can be a cause of different alignment and linker behavior.

So the following six are pinned in one place and managed consistently.

AGP version
Gradle version
JDK version
NDK version
Rust toolchain
Android Rust targets

A new configuration file is not needed. The version catalog, the Gradle wrapper, the CI image, and the README that are already maintained can serve as the reference. It is also worth confirming that ./gradlew assembleRelease from a fresh clone, or the release job in CI, succeeds including the generation of the Rust output. For using the NDK with a build system other than Gradle, see the NDK guide to other build systems.

A working debug build does not cover release

Because of R8, minify, packagingOptions, ABI splits, and App Bundle processing, the result of a debug build is not enough to judge a release. Five things are checked on the release output.

Whether every required ABI is included
Whether the name the binding looks for matches the name of the binary
Whether System.loadLibrary succeeds
Whether the 16 KB rule is met
Whether a Rust call succeeds right after a fresh install

I recommend checking automatically in CI. When that is hard, a manual checklist for each release candidate is the minimum alternative. The basic concepts of native calls are in the Android JNI tips.

At the release stage, a Rust module is one more native binary dependency. Which ABIs to support, how to design incremental builds for the Gradle task, which thread to run on, whether third-party code meets the rule, and whether the final release really works all have to be confirmed separately in each project. The policy date and the version values are those in the documentation as rechecked on October 4, 2026.

Rust shared core, part 4: delivering it to iOS as an XCFramework

Tue, 30 Jun 2026 15:00:00 GMT

Using a shared Rust core in an iOS app takes more than passing tests on the Rust side. That is not a guarantee that the app links. Results can differ between the simulator and a device, or between a development machine and CI, and the binary checksum of a Swift package can fail to match.

Part 4 goes through delivering the Rust binary and the Swift calling layer to an Apple app, based on the Apple Developer, Rust Reference, rustc, and UniFFI documentation. I reopened and checked these documents on October 4, 2026.

Bundle the static libraries into an XCFramework

The crate types for Rust output that another language links against include staticlib and cdylib (linkage in the Rust Reference). On iOS, the approach is to package a static library as an XCFramework.

The device build and the simulator build are made separately, the headers and the module map are prepared, and xcodebuild -create-xcframework combines them. Written out conceptually, the flow is this.

cargo build --target aarch64-apple-ios
cargo build --target aarch64-apple-ios-sim

libdomain_core.a
headers/
module.modulemap

-> DomainCore.xcframework

The supported targets are listed in rustc's Apple iOS platform notes. The block above is not commands that were run with their output. It is a picture of how the inputs relate to the artifact.

An XCFramework can hold a variant per platform and architecture in one bundle. iOS devices, the simulator, macOS, and visionOS are examples. When it is used as a binary dependency of an Xcode project or a Swift package, Xcode can choose the slice that matches the build destination.

Reproducing the build needs matching conditions. I recommend making the installed targets, the toolchain version, the profile, the output location, and the place where headers are generated the same on development machines and in CI. I also recommend putting target installation and packaging into a script. The values of the environment in which I built the example are in the section "An XCFramework bundled from an example."

The headers, the module map, and the generated Swift bindings have to match each other. If the code UniFFI produced and the Rust library are from different versions, linking can fail or symbol problems can appear at run time. So I suggest managing the two generation steps as one release unit.

An XCFramework bundled from an example

I ran the flow above for real with a small example. The example is deliberately small. Its job is to check the structure, and it is not a real app. The run was on October 4, 2026, on macOS 27.0.1 with Xcode 27.0, cargo 1.96.0, and uniffi 0.29.5. The Rust targets aarch64-apple-ios and aarch64-apple-ios-sim were already installed. The crate-type of the binding crate includes staticlib.

For the header and the module map, I used what UniFFI generated together with the Swift bindings. The generated sudoku_uniffiFFI.modulemap was copied under the name module.modulemap. Below are the lines of the script that was run which belong to this step. The sed at the end shortens the absolute path printed in the output, and out/host is the directory used for the Swift call in part 3.

mkdir -p out/headers out/host
cp out/swift/sudoku_uniffiFFI.h out/headers/
cp out/swift/sudoku_uniffiFFI.modulemap out/headers/module.modulemap
# …
cargo build -q -p sudoku-uniffi --release --target aarch64-apple-ios
cargo build -q -p sudoku-uniffi --release --target aarch64-apple-ios-sim
xcodebuild -create-xcframework \
  -library target/aarch64-apple-ios/release/libsudoku_uniffi.a -headers out/headers \
  -library target/aarch64-apple-ios-sim/release/libsudoku_uniffi.a -headers out/headers \
  -output out/SudokuCore.xcframework | sed 's#: .*/out/#: out/#'

This is the output and the directory that was produced.

xcframework successfully written out to: out/SudokuCore.xcframework
SudokuCore.xcframework
SudokuCore.xcframework/Info.plist
SudokuCore.xcframework/ios-arm64
SudokuCore.xcframework/ios-arm64-simulator
SudokuCore.xcframework/ios-arm64-simulator/Headers
SudokuCore.xcframework/ios-arm64-simulator/libsudoku_uniffi.a
SudokuCore.xcframework/ios-arm64/Headers
SudokuCore.xcframework/ios-arm64/libsudoku_uniffi.a

Info.plist held two entries, ios-arm64 and ios-arm64-simulator. Each static library was about 31 MB. That is the size of a release build that was not stripped.

That is as far as the check went. I went one step further to see whether this XCFramework can really be consumed. I made a Swift package that points at the XCFramework with a binaryTarget and puts the generated Swift bindings in a target, and built it with xcodebuild build for the iOS simulator and for a device. Both succeeded. The module map generated by UniFFI was used unchanged. That is the result on Xcode 27.0, and other Xcode versions need their own check. Running an app in the simulator and xcodebuild test were not tried. Calling Rust through the generated Swift bindings was confirmed on macOS only, and that record is in part 3.

Delivering through a Swift package

What an XCFramework holds, how xcodebuild -create-xcframework is used, and Rust's crate types and targets are documented. Preparing a module map, Xcode choosing a slice, and the symptoms of a version mismatch were not found in the documents checked this time. The scripting and the single release unit recommended in the previous section, and the package layout and CI practice from this section on, are not decided by the documentation. They are my own design choices.

With a single app, the XCFramework can be added to the project directly. With several apps, or with samples and test targets, I suggest using a Swift package. The binary target and the target for the Swift adapter can be separated.

DomainEnginePackage/
  Package.swift
  Sources/
    DomainEngine/
      DomainEngineClient.swift
      UniFFIAdapter.swift
      GeneratedBindings.swift
  Artifacts/
    DomainCore.xcframework

The point of contact exposed to the app is DomainEngineClient. The generated code and the binary are treated as internal implementation. That reduces what the app has to know about the Rust connection, and the dependencies are clearer than piling up scripts in the project's build phases.

Distribution has decisions of its own: where to keep the artifact, how to manage the checksum of a remote ZIP, and how to match the version of the source package to the version of the binary. For internal use only, one way is to start with the artifact inside the repository and move it to release files once things are stable.

Making local builds and CI follow the same order

For integration on the Apple side, I think managing the Swift layer, the package, the build phases, and CI takes more of the work than calling Rust functions does.

A local machine can still have targets that were installed earlier and artifacts that were built before. CI is assumed to start from a fresh clone. Different paths cause problems as well. So I recommend managing the inputs and the order in one place.

install/check rust targets
cargo build for ios device
cargo build for ios simulator
generate UniFFI Swift bindings
generate headers/module map
create XCFramework
run xcodebuild test

This list names the steps to put into automation, not a shell script that runs as written.

Compiling Rust in a build phase every time can lengthen the edit-and-run cycle during development. I recommend setting inputs, outputs, and a cache locally, and running CI mainly as clean builds. A measured time for how much longer it gets is not in this post.

A setup that does not commit generated files adds one more condition. The required artifacts have to be generated automatically in the process of cloning fresh, opening the Xcode project, and building. Otherwise the first build of a newcomer fails.

Put the UniFFI implementation behind a Swift protocol

Using the API generated by UniFFI directly in the app is an easy start. Over time, the range the app depends on can widen. So the UniFFI implementation goes behind a Swift protocol. This is the shape of the protocol I propose.

protocol SudokuEngineClient {
    func startGame(request: StartGameRequest) throws -> GameSnapshot
    func apply(_ action: GameAction, to snapshot: GameSnapshot) throws -> Transition
}

The ViewModel depends on this protocol, and the generated API is used only inside the adapter. Heavy Rust work can be wrapped in an async API in the adapter, with UI updates handled on the MainActor. With a fake client, the ViewModel can be tested by itself. Delivering the same structure to Android as a .so (ABI, Gradle, the NDK, and the 16 KB page size) is in part 5.

Three things are worth confirming. Build for both a device and the simulator. See that local builds and CI use the same commands. See that an Xcode build works from a fresh clone. Of these, the example covered building for a device and for the simulator. I also copied only the sources to a fresh directory and ran the same script from the start, and it passed to the end. Running in CI and building an Xcode project were not checked.

Xcode UI tests and what automationmodetool does and does not cover

Tue, 30 Jun 2026 15:00:00 GMT

Running Xcode UI tests in CI can stall on an authentication dialog before the run starts. On a Mac with a person in front of it, typing the password is enough. A self-hosted runner or a Mac in a test lab has nobody to type it, so the tests do not proceed.

automationmodetool is the tool that configures this authentication requirement. It does not solve every permission problem of UI tests, though. This post separates what the tool covers from what has to be handled on its own, such as TCC permissions, and goes through the order for preparing a machine. I ran the status query myself on October 4, 2026, on macOS 27.0.1 with Xcode 27.0. The commands that change the setting, and UI tests, were not run.

With no argument it reports the status

According to the man page, the tool configures a device so that Automation Mode for UI testing can be enabled without user authentication. It says this is for preparing CI machines and lab machines whose users do not have administrator privileges. With no argument, it prints whether Automation Mode is enabled and whether authentication is required, and exits. The man page installed on my Mac says the same.

automationmodetool

This is the output from running it on my Mac.

Automation Mode is disabled.
This device DOES NOT REQUIRE user authentication to enable Automation Mode.

The two lines say different things. The disabled on the first line is the current state: Automation Mode is off right now. The second line is the setting for whether authentication is needed when the mode is turned on. When it says DOES NOT REQUIRE, XCTest and testmanagerd can switch the mode during a run without a password being entered.

This command allows enabling it without authentication.

sudo automationmodetool enable-automationmode-without-authentication

This one goes back to requiring authentication.

sudo automationmodetool disable-automationmode-without-authentication

Changing the setting itself needs administrator authentication. So I recommend doing it when a machine is first prepared, not on every PR.

The authentication setting and TCC permissions are separate problems

Xcode Helper or the runner asking for Accessibility, AppleEvents, or Post Event is a TCC matter. In Apple's PPPC settings guide, these three correspond to controlling the Mac via Accessibility APIs, sending a restricted AppleEvent to another process, and sending events with CoreGraphics APIs. automationmodetool cannot stand in for a TCC grant, an installed PPPC profile, or an Accessibility grant.

The wording in the log tells the two apart. A denial such as Xcode Helper does not have permission to use Accessibility. points to the Privacy & Security settings or the PPPC settings in MDM. Timed out while enabling automation mode. may be a problem at the authentication step, so query the status first. A timeout alone does not settle that it is an authentication problem, and the two failures can happen together. The prompt on screen is also a hint. A prompt asking for a password is a candidate for the mode authentication side, and a prompt asking for consent to control an app, or for Accessibility, is a candidate for the TCC and PPPC side.

Which process is asking for the permission can be seen in the TCC log. The command is given in the same PPPC guide.

log stream --debug --predicate 'subsystem == "com.apple.TCC" AND eventMessage BEGINSWITH "AttributionChain"'

I recommend confirming the responsible process in this log before allowing it, and not adding Xcode.app or the app under test to the allow list on a guess.

Configure when preparing the machine, and only query in the job

Here is an example order for preparing a Mac for unattended UI tests. Select the Xcode developer directory, accept the license, run the first-launch tasks, change the authentication setting, and query the status.

sudo xcode-select -s /Applications/Xcode.app/Contents/Developer
sudo xcodebuild -license accept
sudo xcodebuild -runFirstLaunch
sudo automationmodetool enable-automationmode-without-authentication
automationmodetool

On a self-hosted runner, be careful about putting this change into a workflow. A step like the one below is an example.

- name: Enable automation mode
  run: sudo automationmodetool enable-automationmode-without-authentication

Allowing sudo in a workflow where arbitrary code runs creates a risk of privilege escalation. I recommend a split in which the owner of the machine does the preparation and the job only builds and tests. At the start of the job, record the status without changing the setting.

- name: Show UI automation state
  run: |
    automationmodetool || true
    xcodebuild -version
    xcode-select -p

|| true keeps the job going when the query fails, so that the record is still left. This way of operating is my own reading, not something the man page prescribes.

There is an exception. Hosted CI where the service manages sudo is a different situation. The Bitrise guide says to run the change command in a Script Step when this timeout appears.

The problem has been reported several times. Issue 5410 reports UI tests failing with the timeout on the macOS 12 Monterey runner of GitHub Actions, and issue 7778 covers the same error on macOS 13 with Xcode 14.3.1. Flutter issue 166011 says that integration tests through XCUITest need this setting, and that the trouble is the setting command asking for a password. That issue quotes an approach that types the password with expect. That is fragile, so I recommend preparing the runner account and the machine in advance. Recording and replaying UI automation is the subject of WWDC25 session 344.

The per-device mode setting is separate from TCC and keychain permissions, which depend on the user, the process, and the signing. The signing keychain, Developer Tools Access, and DevToolsSecurity are also areas to look into on their own. With several Xcode versions or several runner accounts, work out which setting applies to which scope. The earlier version of this post was written against macOS 26.5.1 and Xcode 26.6, and this time only the status query was checked again. Whether the setting survives a reboot, an update, or an image replacement, and whether UI tests really pass after it is set, were not checked.

Rust shared core, part 3: keep UniFFI generated code behind an adapter

Mon, 29 Jun 2026 15:00:00 GMT

Calling common functionality written in Rust from iOS and Android needs a connecting layer on the Swift side and on the Kotlin side. One way is to build a C ABI and a wrapper per platform by hand. That is a reasonable choice for a small experiment, but I expect the maintenance burden to grow as the app gets larger and the API grows.

UniFFI is a tool that generates this layer. The tool does the generating, but it does not decide where the generated code sits inside the app. Part 3 is about choosing that place.

What UniFFI does and does not do

What UniFFI generates, as described in this section, comes from its documentation. The judgment that the risk of drift goes down, the account of what the tool leaves undecided, and the adapter structure and handling of generated files in the later sections are my own reading and design choices.

UniFFI produces Swift and Kotlin calling code from the Rust functions and types chosen for exposure. The generated code reaches the Rust library through a C-compatible FFI. After the API is changed, the code can be generated again, so a wrapper per language does not have to be maintained by hand. Both platforms end up using the same domain functions, so I expect the risk of rules drifting apart to go down. The Swift output and the Kotlin output are separate artifacts that come from the same Rust API.

The tool does not decide everything. Which functions to expose, what shape the DTOs take, how errors are represented, and how far the generated types are visible in the app are decided by the people building the app. Exposing Rust's internal model as it is can make it awkward to use on mobile.

Generated code goes behind an adapter

If a ViewModel or a ViewController calls the generated API directly and the generated types spread through the whole app, every change to the Rust API may require changes to the UI on both platforms. So each platform gets a thin adapter.

iOS
  SudokuEngineClient protocol
    -> UniFFISudokuEngineClient
      -> generated Swift binding

Android
  SudokuEngineClient interface
    -> UniFFISudokuEngineClient
      -> generated Kotlin binding

The app uses only the protocol on iOS and the interface on Android. Only UniFFISudokuEngineClient touches the generated code. Generated types are not passed to the ViewModel. Swift passes its own DTOs or domain types, and Kotlin passes data classes.

With this structure, a fake SudokuEngineClient can be put into the unit tests of a ViewModel. Integration tests that really call Rust are set up separately.

Call size and types

I recommend handling one call per user action over calling many times on every render. The current state and the action go in, and the changed state comes back in one piece.

The API below is an example written with JSON strings going in and out.

start_game(request_json: String) -> String
apply_action(snapshot_json: String, action_json: String) -> String
validate_snapshot(snapshot_json: String) -> String

JSON is not mandatory. UniFFI records, enums, and sequences are an option too. As the exposed types get more complex, though, keeping the meaning identical in the two languages can become hard.

I prefer to start with simple DTOs and fixtures. The types are split more finely after measurement shows a performance problem. Making the FFI design complex first does not help if the real bottleneck is somewhere else. Numbers comparing the performance of the two approaches are not in this post.

What to look after on each platform

Using UniFFI does not make the two apps structurally the same. How things run inside the adapter is chosen to fit the runtime of that platform.

On iOS, Swift concurrency, MainActor, and state updates in UIKit and SwiftUI are taken into account. Calls that use a lot of CPU are better handled off the main thread. The adapter manages a background queue or an async boundary, and screen updates happen back on the main actor. Packaging the Rust output as an XCFramework comes in part 4.

ViewModel scope, the coroutine dispatcher, state updates in Compose, and the order of loading native libraries are the things to check on Android. If the Rust .so fails to load, an error can occur at app start or on the first call. Whether it is packaged correctly for each ABI has to be confirmed too. For the concepts of connecting Kotlin and native code, see the Android JNI tips.

What I generated and called in an example

I built this structure as a small example, and on October 4, 2026 I generated the bindings and called them. The workspace is small and only checks the structure. No real app is behind it. The environment is macOS 27.0.1, cargo 1.96.0, uniffi 0.29.5, and Swift 6.4. The binding crate only wraps and exports the functions of the core. Keeping the functions that parse and serialize JSON in the core crate as well is where the example departs from the design in part 2, to stay small.

uniffi::setup_scaffolding!();

#[uniffi::export]
pub fn start_game(request_json: String) -> String {
    sudoku_core::start_game_json(&request_json)
}

#[uniffi::export]
pub fn apply_action(snapshot_json: String, action_json: String, environment_json: String) -> String {
    sudoku_core::apply_action_json(&snapshot_json, &action_json, &environment_json)
}
// … validate_snapshot and generate_daily_puzzle have the same shape.

Unlike the API example above, apply_action takes three arguments. environment_json was added, following the contract in part 2. The bindings are generated from the built library. uniffi-bindgen is not installed separately. It is a binary in the same crate.

cargo build -q -p sudoku-uniffi
# …
cargo run -q -p sudoku-uniffi --bin uniffi-bindgen -- generate \
  --library target/debug/libsudoku_uniffi.dylib --language swift --out-dir out/swift
cargo run -q -p sudoku-uniffi --bin uniffi-bindgen -- generate \
  --library target/debug/libsudoku_uniffi.dylib --language kotlin --no-format --out-dir out/kotlin

--no-format is on the Kotlin side because ktlint is not on this Mac. Generating without the option printed a warning that ktlint could not be found. -q is the cargo option that reduces output. Four files were generated.

kotlin/uniffi/sudoku_uniffi/sudoku_uniffi.kt
swift/sudoku_uniffi.swift
swift/sudoku_uniffiFFI.h
swift/sudoku_uniffiFFI.modulemap

The Swift file was 514 lines and the Kotlin file 1107 lines. In Swift the function names become startGame(requestJson:), applyAction(snapshotJson:actionJson:environmentJson:), and so on. I compiled the generated Swift file together with the calling code using swiftc, linked the Rust library, and ran it on macOS. This is part of the calling code.

let env = #"{"locale":"ko-KR"}"#
let snapshot = startGame(requestJson: #"{"seed":0}"#)
// …
print("validate:", validateSnapshot(snapshotJson: snapshot))
// …
let conflict = applyAction(snapshotJson: snapshot, actionJson: #"{"type":"set_value","row":0,"col":2,"value":5}"#, environmentJson: env)
print("conflict:", conflict)

This is the output of that part.

validate: {"valid":true,"errors":[]}
conflict: {"ok":false,"snapshot":null,"effects":[],"error":{"code":"conflict","message":"the value conflicts with a row, column, or box"}}

That confirms a function called from Swift returning the result from Rust as a string. The run was on the macOS host, not on iOS, and no adapter or protocol was built.

Whether to commit the generated files

There are two options.

Commit the generated Swift and Kotlin files. They are easy to browse in the IDE, and a PR shows how the API changed. The large diff of generated code can be a burden in review.
Generate at build time. Rust stays the single source. The generation steps have to be reproduced on a fresh clone and in CI, and the build can become unstable when the UniFFI CLI or Rust toolchain versions differ across development environments.

Early in an app project, especially while the connection between iOS and Xcode has not settled, committing is worth considering. In that case it is good to record the generation command and have CI check that regenerating produces no diff. For a project centered on a library, or when the amount of change is a burden, generating at build time is worth considering. Neither is a policy that fits every project. Whichever is chosen, I recommend reproducing binding generation in CI.

How to manage generated files, along with the API boundary, the types, and the error representation, has to be decided per project. The options in this post are recommendations. What the example confirmed is generation and a Swift call on macOS. Compiling the Kotlin bindings and calling them on Android, and running on an iOS device, were not checked.

DevToolsSecurity on macOS and debugger authorization on unattended CI

Thu, 25 Jun 2026 15:00:00 GMT

When a debugger attaches to a program built in Xcode or the terminal on a Mac, or when Instruments starts, a "Developer Tools Access" prompt can appear and ask whether one process may control another. On my own Mac, typing the password ends it. On an unattended test or a headless CI/CD runner, the job stalls while that prompt waits for input.

The command that removes the prompt ahead of time is sudo DevToolsSecurity -enable. This post covers what the command changes and where to look when the prompt remains after enabling. What I confirmed with read-only commands on macOS 27.0.1 on October 4, 2026 is marked as such. I did not run -enable or the group command again this time.

Why a debugger asks for authorization

macOS isolates the memory of each process. Stopping another process, reading or writing its memory, and injecting code into it are restricted.

lldb and Instruments need access to the target process to analyze it. They get the target's Mach task port through task_for_pid in XNU, and use that port to step line by line or dump memory. Without enough privilege, the request is denied or goes through an administrator password prompt. Authorization Services handles that authorization, and the rules are stored in /var/db/auth.db.

The rule that DevToolsSecurity changes

/usr/sbin/DevToolsSecurity changes the rule of a right named system.privilege.taskport. The earlier version of this post explained that before enabling, the rule asks for the login password or root credentials, and that after enabling, it is tied to the _developer group. Of these, I could not check the behavior before enabling this time.

I read the rule in the enabled state with security authorizationdb read system.privilege.taskport. These are the values I read (macOS 27.0.1).

class is user.
group is _developer.
authenticate-user is true, and allow-root is false.
timeout is 36000.

An earlier version of this post said the class after enabling is rule, but the value I read this time was user. The comment on the rule says this right is used by task_for_pid and applies only when the requesting program and the target program are run by the same user. It does not authorize access to another user's program. I could not check the values before enabling, because the Mac I checked already had it enabled.

Use -status to check the state

Running /usr/sbin/DevToolsSecurity with no argument does not show the state. According to the usage text, the default action is -enable.

This is the usage text, printed by passing an option that does not exist.

$ /usr/sbin/DevToolsSecurity -help
DevToolsSecurity: unrecognized option `-help'
Changes the security authorization policies for developer systems
Usage: /usr/sbin/DevToolsSecurity [-verbose] [-enable | -disable | -status]
    -enable  :: (default) enable developer mode policies
    -disable :: return policies to system default
    -status  :: prints out whether or not developer mode policies are in effect
    -verbose :: makes output more verbose

To see only the state, use -status.

$ /usr/sbin/DevToolsSecurity -status
Developer mode is currently enabled.

The earlier version said to run the command with no argument and look for enabled. That explanation was wrong, and it is corrected as shown above.

When the prompt remains after enabling

After -enable, lldb in the terminal or C++ debugging in VS Code can still show the prompt or fail with attach failed. The place to look is whether the account is in the _developer group.

This command adds the currently logged-in account to the group.

# 현재 로그인된 계정을 _developer 그룹에 강제 멤버십 추가
sudo dscl . append /Groups/_developer GroupMembership $(whoami)

The Korean comment says the command adds the currently logged-in account to the _developer group.

After adding, reopening the terminal or logging out and back in is recommended. The members of the group can be listed with dscl . read /Groups/_developer GroupMembership.

I did not compare causes myself for this part. On the Mac I checked, the _developer group had no GroupMembership key at all.

$ dscl . read /Groups/_developer GroupMembership
No such key: GroupMembership

I did not check how attaching a debugger behaves on this Mac, where the GroupMembership key was absent, or under exactly which condition group membership is needed. There is also no basis for saying that joining the group resolves every attach failed.

What happens on an unattended runner

Mobile release automation uses a Mac mini or a macOS virtual machine in the cloud as a runner. The problem case is when this setup step is omitted after a fresh Xcode install or an OS upgrade.

When Appium or an Xcode UI test installs the test app and tries to attach for debugging, the authorization request appears in the GUI in the background. Nobody is at the runner to answer. The job ends only after the configured time limit passes, and a runner with no time limit keeps waiting. A result from reproducing this flow and timing it is not included here.

So the script that prepares a runner runs two things together.

# 개발자 도구 액세스 허용 활성화
sudo /usr/sbin/DevToolsSecurity -enable

# 빌드 실행 에이전트 계정을 개발자 그룹에 병합
sudo dscl . append /Groups/_developer GroupMembership build_agent_user

The first comment says "enable developer tools access," and the second says "add the build agent account to the developer group."

Replace build_agent_user with the account name the runner uses. Putting the enable command into the runner setup guide as well keeps it from being missed on a new machine. There is no basis for saying that every server needs both commands. I also did not measure how installing a test app on a device or simulator connects to task port authorization on the Mac.

What is given up in security

This setting removes one authorization step. To that extent, developer tools can handle the memory of other processes run by the same user more widely. Access to the machine should be controlled, and binaries or code of unknown origin should not run on it.

Developer Mode on an iPhone or iPad targets something else. Developer Mode on a device allows locally installed apps, such as an app built and run from Xcode, to run on that device. It does not affect apps installed from the App Store or TestFlight. The setting in this post is the permission for tools such as lldb to control other processes on a Mac.

The values read this time come from one Mac running macOS 27.0.1, and because it was already enabled, the values before enabling could not be checked. A comparison across macOS versions is not included here either. I also could not confirm in the documentation exactly which signature the condition "only signed developer tools are allowed" refers to.

Why Hangul file names fall apart into jamo, and how NFC fixes it

Thu, 25 Jun 2026 15:00:00 GMT

When a file with a Hangul name made on macOS is sent to Windows or Linux, the jamo in the name (the letters that make up each Hangul syllable) can appear separated. It is not only a display problem. Git can detect a file whose content did not change as renamed, and in CI the resource path the code looks for may not match the actual file name. The same can happen when a file travels as a mail attachment, through a messenger, in a ZIP, or through cloud storage.

The cause is that the same character has two Unicode representations. This post confirms the difference between the two with code points, and covers how to bring file names and strings to one of them.

Errors in the code points and the examples were present in the earlier version of this post. I corrected them by running string normalization myself on October 4, 2026, on macOS 27.0.1, with Python 3.14.5, Swift 6.4, and Node.js 24.14.1. What I checked is string normalization, plus the convmv dry run and rename on one file in a temporary folder. The convmv result is in the section below. I did not run Automator or Git, and I did not compare file systems. The definition of the normalization forms comes from UAX #15, and the advice on where to normalize is my own reading.

Two representations of the same character

NFD is the canonically decomposed form of a character, and NFC is the canonically composed form. For the syllable 한 it looks like this.

NFC: the single code point U+D55C (HANGUL SYLLABLE HAN).
NFD: the three code points U+1112, U+1161, and U+11AB. In order, they are HANGUL CHOSEONG HIEUH, HANGUL JUNGSEONG A, and HANGUL JONGSEONG NIEUN.

This is the Python code I used to check, with its output.

import unicodedata as u

print([f"U+{ord(c):04X}" for c in u.normalize("NFD", "한")])
print(u.normalize("NFC", "\u1112\u1161\u11ab"))
print(u.normalize("NFC", "\u1106\u1161\u11ab"))
print(u.normalize("NFC", "ㅎㅏㄴ"), u.normalize("NFD", "ㅎㅏㄴ"))
print([f"U+{ord(c):04X}" for c in "ㅎㅏㄴ"])

Running the Python code prints the following.

['U+1112', 'U+1161', 'U+11AB']
한
만
ㅎㅏㄴ ㅎㅏㄴ
['U+314E', 'U+314F', 'U+3134']

The Hangul strings in the code are the syllable 한 and the three separately typed letters that are explained in the next section.

The earlier version gave the initial consonant as U+1106. U+1106 is HANGUL CHOSEONG MIEUM. As the third line of the output shows, composing U+1106, U+1161, and U+11AB gives 만 (U+B9CC), not 한.

The visible separated letters are not the decomposed form

To explain the decomposed form, it is tempting to type the letters separately and show them that way. The earlier version did so. But the letters typed on a keyboard are U+314E, U+314F, and U+3134, which are compatibility jamo, a different set of characters. They are not the same characters as U+1112, U+1161, and U+11AB used in the decomposed form.

The fourth line of the output above shows the difference. Applying NFC to the three compatibility letters does not give 한, and applying NFD leaves them as they are. The file name that the earlier version used as a decomposed example, ㄱㅓㅁㅅㅐㄱㅎㅘㅁㅕㄴ.png, is also written in compatibility jamo, so normalization does not turn it into 검색화면.png. The real decomposed form of 검색화면.png contains final-consonant jamo such as U+11B7, U+11A8, and U+11AB.

For that reason, this post writes the decomposed form as code points and escapes, not as visible letters.

Where the problem shows up

The earlier version explained that macOS stores file names in the decomposed form and that Windows and Linux use the composed form. That explanation can vary with the file system, the program that draws the screen, and the transfer tool, and I did not check it this time. The two cases below are not reproduced from real logs either. They describe paths by which the problem can happen.

With Git, the case to think about is this. A file named 검색화면.png is added and pushed on macOS and pulled on Windows. If the normalization form changes along the way, a file with the same content can be detected as renamed. Then diffs appear with no change in content, unnecessary commits pile up, and conflicts can become more likely. The outcome can differ with the Git configuration and with whether a conversion happens in transfer.

In builds, image and Markdown paths on the web or in iOS are affected. In a Linux container such as GitHub Actions, a path string written in the composed form in code and a file name stored in the decomposed form have different bytes. So the file may not be found.

Renaming files to NFC with convmv

Existing file names can be changed in bulk with convmv. I ran the dry-run command and the apply command below on October 4, 2026 with convmv 2.06, in a temporary folder that held one .txt file with a decomposed name. convmv was already installed, so I did not run the install command again.

Install it with Homebrew.

brew install convmv

First preview what would change. This command keeps the encoding as UTF-8, converts to NFC, and searches subdirectories.

convmv -f utf8 -t utf8 --nfc -r [변경을_원하는_디렉토리_경로]

The bracketed Korean placeholder stands for the path of the directory to change.

Nothing is renamed at this step. The tool shows each planned rename in the form mv "old name" "new name" and prints No changes to your files done. Would have converted 1 files in 0 seconds. and Use --notest to finally rename the files. That differs from the wording in the earlier version of this post. Checking the file name after the run showed it was still decomposed. After checking the list, add --notest to apply it.

convmv -f utf8 -t utf8 --nfc -r --notest [변경을_원하는_디렉토리_경로]

Running it with --notest printed Ready! I converted 1 files in 0 seconds., and I confirmed that the file name had changed to the composed form (NFC). The name went from 10 code points to 6.

Adding it to the Finder context menu

For frequent use, a Quick Action can be made in Automator.

Create a new Quick Action in Automator.
Set the input to files and folders, and the application to Finder.
Add a Run Shell Script action and set Pass input to as arguments.
Put in the script below.
Save it under a name such as "Compose Hangul jamo," and it appears in the Finder context menu.

for i in "$@"; do
    /opt/homebrew/bin/convmv -f utf-8 -t utf-8 --nfc --notest "$i"
done

/opt/homebrew is the Homebrew path on Apple Silicon Macs from the M1 on. If the install location differs, the path has to be changed. This script has no -r, so unlike the command above it does not process the items inside a selected folder.

Normalizing in code

If the form is unified at the boundary where file names or user input go into a database or storage, later comparisons become simple.

Swift has precomposedStringWithCanonicalMapping for the composed form and decomposedStringWithCanonicalMapping for the decomposed form. This is an example I ran, with the decomposed form written as escapes.

import Foundation

let decomposed = "\u{1112}\u{1161}\u{11AB}"   // NFD: U+1112 U+1161 U+11AB
let composed = decomposed.precomposedStringWithCanonicalMapping
let back = composed.decomposedStringWithCanonicalMapping

func scalars(_ s: String) -> String {
    s.unicodeScalars.map { String(format: "U+%04X", $0.value) }.joined(separator: " ")
}

print(scalars(decomposed))
print(scalars(composed))
print(scalars(back))
print(decomposed == composed)
print(Array(decomposed.utf8) == Array(composed.utf8))

The Swift code prints these code points.

U+1112 U+1161 U+11AB
U+D55C
U+1112 U+1161 U+11AB
true
false

The fourth and fifth lines deserve attention. A Swift String compared with == treats the decomposed and composed forms as equal. Their UTF-8 bytes, however, differ. The difference stays hidden while comparing inside Swift, and appears at the moment the string is written out as bytes and used as a file name or a key.

In JavaScript, use normalize("NFC").

const decomposed = "\u1112\u1161\u11AB"; // NFD: U+1112 U+1161 U+11AB
const composed = decomposed.normalize("NFC");

const codePoints = (s) => [...s].map((c) => "U+" + c.codePointAt(0).toString(16).toUpperCase().padStart(4, "0")).join(" ");

console.log(codePoints(decomposed));
console.log(codePoints(composed));
console.log(decomposed === composed);
console.log(decomposed.normalize("NFC") === composed);

The Node.js code prints this.

U+1112 U+1161 U+11AB
U+D55C
false
true

The === operator in JavaScript treats the decomposed and composed forms as different. They become equal only after normalization.

In Python it is unicodedata.normalize. This function only returns a changed string. It does not rename a file on disk.

import os
import sys
import unicodedata

def sanitize_nfc(path):
    return unicodedata.normalize('NFC', path)

Places to check

Using only English file names avoids the problem, but for a project that uses Hangul names, it is better to check the following.

Whether decomposed names have entered a repository that several people use.
Whether a build on Windows or Linux finds resources at Hangul paths.
How Git detects renames. core.ignorecase is a setting about letter case, and there is no basis for saying it solves normalization.
Whether the boundary that receives uploads normalizes and validates names.

Whether convmv converts every file, and whether names stay intact in transfer after the conversion, was not checked this time. The same goes for what happens when a converted name collides with an existing file, for permission problems, and for differences between file systems. What I confirmed by running is string normalization in Python, Swift, and JavaScript, plus the convmv dry run and rename on one file in a temporary folder.

Rust shared core, part 2: keep the API across the boundary coarse

Thu, 25 Jun 2026 15:00:00 GMT

When a calculation engine shared by several platforms is written in Rust, the data types that suit the inside of the engine differ from the types that are easy to handle in an app. Following the convenience of each platform can also pull the design of the core toward outside concerns.

Part 2 asks two questions: how large the externally called functions should be, and which data types the values crossing the boundary should use. Sudoku is the running example.

The inside model and the outside model

Inside Rust, the rules are expressed with types such as Grid, Cell, CandidateSet, PuzzleSeed, Difficulty, Move, GameState, and ValidationError. Enums, pattern matching, ownership, and traits can be used as they are.

Crossing the boundary changes the picture. Generics, lifetimes, nested enums, complex collections, and borrowed references are represented differently when passed to another language. Even when the generator supports something, whether the API is easy to understand and convenient to test and debug has to be judged separately. How bindings are made is in the UniFFI and wasm-bindgen documentation. Sizing the calls and the contract as shown below is my own design choice, not a requirement of that documentation. An example that implements this contract and was actually run, with its environment, is in the section "The contract, checked with an example."

So the roles are split in two.

sudoku-core
  - Rust 내부 도메인 모델
  - Rust 테스트
  - 순수 계산 로직

sudoku-uniffi / sudoku-wasm
  - 외부 공개 DTO
  - serialization
  - error 변환
  - coarse-grained 함수

The Korean lines under sudoku-core read "internal Rust domain model," "Rust tests," and "pure calculation logic." Under the binding crates, they read "externally exposed DTOs" and "error conversion."

The core is designed so that it does not depend on a binding tool, and the domain logic is kept as independent as possible. I recommend putting DTOs, serialization, error conversion, and coarse functions in the binding crates.

A few large functions over many small ones

Exposing functions that each handle one cell gives this shape.

get_cell(row, col)
set_value(row, col, value)
toggle_note(row, col, digit)
is_conflict(row, col)
get_candidates(row, col)

That increases the number of trips across the boundary. The state the app holds and the state the engine holds can drift apart, and calling per cell for rendering makes the flow hard to trace.

The alternative is to expose units of work.

start_game(request) -> GameSnapshot
apply_action(snapshot, action) -> TransitionResult
validate_snapshot(snapshot) -> ValidationReport
generate_daily_puzzle(request) -> PuzzleEnvelope

The engine computes how the state changes for an action, and the app converts the returned value into state for the screen. I expect fewer calls and a clearer scope for tests. An experiment comparing the two approaches is not part of this post.

This structure is the same as a reducer.

현재 상태 + 사용자 액션 + 설정
  -> 다음 상태 + 효과 + 에러 또는 경고

The block reads: current state plus user action plus settings gives the next state plus effects plus an error or a warning.

This model fits the ViewModel on iOS and Android and the state layer on the web. Each platform can convert the result into UI state.

Data types that cross the boundary

The candidates for DTOs are simple ones: string, integer, boolean, a flat array, an enum with clear cases, an optional value, and a JSON string when needed.

JSON has a benefit and a cost. It is convenient for passing state or actions in large units. In return it has a serialization cost, and type safety at compile time can get weaker. Calls made per frame for rendering and calls made when the user acts are judged separately. For a unit that applies one user action, the gain from a simpler boundary can outweigh the serialization cost. Numbers that measure how large each cost is are not in this post.

A contract built on JSON has this shape.

apply_action(
  snapshot_json: String,
  action_json: String,
  environment_json: String
) -> transition_json: String

On the app side, the shape of that JSON can be expressed with Codable, kotlinx.serialization, Zod, or TypeScript types, and the Rust side handles it with serde. I suggest that the team keep a JSON schema and fixtures together. In my view, fixtures can be a more accurate reference than documents.

Errors come back as values

When Rust's Result<T, E> is connected to the outside, its representation has to be decided early. Putting error handling off makes it more expensive later. The options are a thrown error, a result object, a nullable, and an error in a callback. For a domain engine, I prefer returning an explicit error object.

TransitionResult
  - ok: Boolean
  - snapshot: String?
  - effects: [Effect]
  - error: EngineError?

The roles are divided like this. Expressing why something failed is the job of the core. Whether to ignore the action, show an alert, give haptic feedback, or send an analytics event is chosen by the app.

Messages are divided as well. Codes such as INVALID_MOVE, PUZZLE_ALREADY_COMPLETED, and SEED_OUT_OF_RANGE are stable machine-readable codes, and they are separated from the text people read. Korean and English translation, and localization, belong to the app.

The contract, checked with an example

On October 4, 2026, I implemented this contract in a small example and ran it. This small workspace exists to check the structure and is not the code of a real app. The environment is cargo 1.96.0, serde 1.0.229, and serde_json 1.0.151. The function at the boundary takes three strings and returns one. In the example this function sits inside the sudoku-core crate. Under the structure laid out earlier, serialization and error conversion belong to the binding side, so this is a place where the example departs from the design to stay small. A proper split would move the JSON-facing functions into the binding crates, or into a separate crate shared by the two bindings.

pub fn apply_action_json(snapshot_json: &str, action_json: &str, environment_json: &str) -> String {
    // 이 예제의 규칙은 environment 를 쓰지 않는다. 형식만 확인한다.
    if let Err(e) = serde_json::from_str::<Environment>(environment_json) {
        return to_json(&fail("invalid_environment", &e.to_string()));
    }
    let result = match (serde_json::from_str(snapshot_json), serde_json::from_str(action_json)) {
        (Ok(snapshot), Ok(action)) => apply_action(&snapshot, &action),
        (Err(e), _) => fail("invalid_snapshot", &e.to_string()),
        (_, Err(e)) => fail("invalid_action", &e.to_string()),
    };
    to_json(&result)
}

The Korean comment says that the rules of this example do not use the environment and only its format is checked. When the input cannot be parsed, the function does not throw. It returns a result of the same shape. fail builds a result with ok set to false and a code and message in error, and to_json serializes with serde_json. Below is the output of five calls through the Wasm package from Node. In order they are an action that succeeds, an action that conflicts, an action on a given cell, an action that cannot be parsed, and the validation of a broken snapshot. Long lines are cut at 150 characters and marked with ….

valid   : {"ok":true,"snapshot":"{\"version\":1,\"seed\":0,\"givens\":\"530070000600195000098000060800060003400803001700020006060000280000419005000080079\",\"ce …
conflict: {"ok":false,"snapshot":null,"effects":[],"error":{"code":"conflict","message":"the value conflicts with a row, column, or box"}}
given   : {"ok":false,"snapshot":null,"effects":[],"error":{"code":"given_cell","message":"a given cell cannot be changed"}}
bad json: {"ok":false,"snapshot":null,"effects":[],"error":{"code":"invalid_action","message":"unknown variant `fly`, expected `set_value` or `clear` at line 1  …
validate: {"valid":false,"errors":[{"code":"invalid_snapshot","message":"missing field `version` at line 1 column 2"}]}

In this example, when ok is true, snapshot holds the JSON string of the next state and error is null. When ok is false, snapshot is null and error is present. The error codes are lowercase, such as conflict, given_cell, and out_of_range, and the message exists in English only. No translation was added.

Keeping the contract with versions and fixtures

After an app ships on the App Store and the Play Store, different releases stay on different devices. The web and mobile also update at different speeds. So I recommend putting a version in the request and the response, and keeping fixtures per version.

When there is a breaking change, the Rust core, the Swift adapter, the Kotlin adapter, and the web package are checked in the same PR. The diff of generated bindings can be large and hard to read. I recommend confirming the contract from the wrapper or the schema in review, not from that diff alone. Two items can go into the PR template: a rule that a fixture is added when the public API changes, and a question on whether the tests of the Swift, Kotlin, and TypeScript adapters changed. The request and response fixtures serve directly as contract tests.

I think a simple outside contract also helps the work of connecting UniFFI, wasm-bindgen, XCFramework, and the Android .so. Calling this API from iOS and Android through UniFFI is the subject of part 3.

That is the shape of the design, and some things remain undecided. The fixture tests were run in the example from both Rust and Node. Five Rust tests and two Node tests passed. Adapter tests in Swift and Kotlin were not written. The combinations of ok, snapshot, and error are what I observed in the example, and they are not written down as a contract document.

Rust shared core, part 1: what to share and where to draw the line

Tue, 23 Jun 2026 15:00:00 GMT

Building for three platforms (iOS, Android, and the web) produces three copies of the logic. It is natural for the UI, the storage method, and the lifecycle to differ by platform. The trouble starts when puzzle rules, state changes, offline decisions, price calculation, cryptography, and sync conflict handling are also implemented three times. Then defects have to be managed per platform as well.

I consider sharing logic through Rust a practical choice as of 2026. The focus is not on merging the whole app. It is on extracting an engine that owns the common rules. As the first part of a series, this post covers what to share and where to draw the boundary.

What is written here is a design proposal. Sudoku is an example for explanation, and this post does not include measured results or benchmarks from a specific app. Whether this structure really builds is something I did check with a small example on October 4, 2026, and the result and the tool versions are in the section "The structure, built for real." The Rust linkage, UniFFI, and WebAssembly documentation explains what each tool does. How to split the layers and the criterion for sharing are my own design choices.

Why it gets complicated when Rust owns everything

Each platform has constraints to follow.

iOS: the UIKit and SwiftUI lifecycle, MainActor, App Extensions, and App Store review
Android: Activity, ViewModel, Compose state, Gradle packaging, and Play policy
Web: routing, hydration, browser storage, the bundler, and the deployment target

If the Rust side takes on UI state, analytics events, storage I/O, networking, and permissions, it takes on these constraints along with them. So what to share is decided by how the maintenance responsibility is divided.

What goes into the engine and what stays in the app

With Sudoku as the example, the candidates for the engine are these.

Puzzle generation and the solver
Judging user input
Changes to notes and values
Computing the seed of the daily puzzle
Rating the difficulty
Computing score and streak
A reducer that can replay actions

What stays in the app is rendering, accessibility, ads, payments, push notifications, the analytics SDK, the choice of storage, network retries, and the setup for review and release.

The criterion is not whether the code looks similar. It is whether the result has to be the same. The valid and invalid judgment for the same board and the same input has to match across platforms, and the daily puzzle that comes from the same seed has to match.

The presentation can differ. On iOS a UIKit collection view may feel natural, and on Android Compose state may fit well. Keyboard shortcuts and pointer interaction on the web have to be designed separately. Sharing too much can cost the interaction that fits each platform.

Candidates for the core are filtered by four conditions.

The result is determined by the input alone.
It is not tied directly to the current time, the locale, storage, or the network.
It knows nothing about a UI framework or a platform SDK.
It can be tested with Rust alone.

A candidate that does not meet the conditions is reconsidered. How to pass a time value for time-related candidates such as the daily seed or the streak is not covered in this post.

A structure in three layers

I propose three layers: domain, binding, and app.

core/
  sudoku-rs/
    crates/
      sudoku-core/      # 순수 Rust 도메인 로직
      sudoku-uniffi/    # iOS/Android 바인딩 표면
      sudoku-wasm/      # WebAssembly 바인딩 표면

apps/
  ios/                  # Swift/UIKit 또는 SwiftUI 앱
  android/              # Kotlin/Compose 앱
  web/                  # TypeScript/React 앱

sudoku-core is centered on Rust's own internal model. It keeps out the representation constraints of Swift, Kotlin, TypeScript, and FFI as far as possible, and the tests are concentrated here.

sudoku-uniffi is the conversion boundary for mobile. It manages the DTOs shaped for Swift and Kotlin, error mapping, serialization, and the names of public functions.

sudoku-wasm is the calling boundary on the web side, using wasm-bindgen or wasm-pack. Its goal is to provide a TypeScript API and a package that the app imports.

With this split, the core is less tied to the binding tools. Even when the way UniFFI generates code or the web bundler setup changes, I expect the domain rules to stay relatively stable.

The app does not call generated code directly

If a ViewController, a ViewModel, a Composable, or a React component is tied directly to generated code, a change in a function name or a DTO affects the whole UI. So the app has a layer in between.

iOS ViewModel
  -> SudokuEngineClient protocol
    -> UniFFI generated binding
      -> Rust core

Android ViewModel
  -> SudokuEngineClient interface
    -> UniFFI generated binding
      -> Rust core

Web state layer
  -> SudokuEngineClient
    -> wasm package
      -> Rust core

SudokuEngineClient is a protocol on iOS and an interface on Android, and on the web it is a client that sits between the state layer and the wasm package. The values exposed to the UI are types of the language that app uses. In tests, the adapter can be swapped for a fake. Which layers are allowed to use the generated binding needs to be written down as a team rule.

The structure, built for real

I built the three layers above as a Cargo workspace. It is a minimal example made to check the structure, not the code of a real app. sudoku-core holds four rules (start, apply an action, validate, generate the daily puzzle), and sudoku-uniffi and sudoku-wasm only wrap those functions. The environment is macOS 27.0.1, Xcode 27.0, and cargo 1.96.0.

Listing the direct dependencies of each crate with cargo tree --depth 1 gives this.

sudoku-core v0.1.0
├── serde v1.0.229
└── serde_json v1.0.151

sudoku-uniffi v0.1.0
├── sudoku-core v0.1.0
└── uniffi v0.29.5

sudoku-wasm v0.1.0
├── sudoku-core v0.1.0
└── wasm-bindgen v0.2.129

The core depends only on serde and serde_json, and the two binding crates call the core. This output confirms that no dependency runs from the core toward the bindings. The core of the example does take on JSON serialization (serde_json) as well, though. What was assigned to the binding layer above is kept in the core in the example, to keep it short.

The tests of the core run with cargo test -p sudoku-core. They finish with no simulator and no browser. Only the part of the output where the five tests ran is shown, and the lines before and after it that report 0 tests are left out.

running 5 tests
test same_seed_gives_same_snapshot ... ok
test given_cell_is_rejected ... ok
test snapshot_validation_reports_errors_as_values ... ok
test daily_puzzle_depends_only_on_the_date ... ok
test fixtures_match_expected ... ok
test result: ok. 5 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s

The five tests check that the same seed gives the same result, that an action on a given cell is rejected, and that the daily puzzle depends only on the date string. How this workspace was turned into artifacts for iOS, Android, and the web is spread over parts 3 to 7 of this series.

The order of moving code

List the domain logic that is duplicated across platforms.
From that list, pick the candidates whose results have to match.
Keep the core from depending on UI, storage, network, analytics, or payments.
Separate the internal model from the binding model.
Put an adapter on each platform and set the rule for access to generated code.
Move small, deterministic logic first.

Good first candidates are the daily seed calculation, puzzle validation, and the reducer. Before setting up a Cargo workspace, decide whether sharing is really needed. Moving every candidate at once makes the scope large.

As a way to check, I suggest tests that run with Rust alone and a fake for the app adapter. The Rust tests were run in the example above. A fake for the app adapter was not built, and performance numbers are not part of this post.

Even with this structure, the responsibility for platform development, review, and release stays where it was. If the team does not keep the rules, dependencies can come back between the separated layers. Measurements that back the expectation of easier and more stable adoption are not included in this post. Once the boundary is set, the next step is to look at how to use UniFFI, XCFramework, the Android .so, and WebAssembly, and the next part covers the design of the FFI API that is called from outside.

What to decide when registering fonts at runtime on iOS

Wed, 17 Jun 2026 15:00:00 GMT

A font that always ships inside the app never needs runtime registration. Add the file in Xcode and declare it under UIAppFonts in Info.plist, and the system loads it at launch. The guide to adding a custom font to your app explains this method.

Runtime registration is worth considering in other cases: a font downloaded from a server, a font chosen by theme, language, or content, a font inside a Swift Package, a framework, or a separate bundle, a font list that changes after the build, and a font swapped in for tests and previews. The two methods are used together, depending on what is required.

What follows covers how the API behaves and what has to be decided in operation, with example code. How the API behaves comes from the Apple documentation. Managing registration in one place, the ownership of the file and the order of deletion, and the advice to organize everything around the file URL are not requirements of the documentation. They are my own design choices. I compiled and ran the example code on macOS on October 4, 2026, and the result is in the section "What running it on macOS showed." Results from running it in an iOS app and applying the font on screen are not in this post.

Registration lasts only within the process

Passing a file URL to CTFontManagerRegisterFontsForURL puts the fonts in that file into descriptor matching. After that they can be used with UIFont(name:size:) or Font.custom(_:size:). For a font used only inside the app, the scope is CTFontManagerScope.process. This registration disappears when the process ends, so it has to be done again on the next launch.

This is the simplest registration code.

import CoreText

func registerFont(at url: URL) throws {
    var error: Unmanaged<CFError>?

    let success = CTFontManagerRegisterFontsForURL(
        url as CFURL,
        .process,
        &error
    )

    if !success {
        if let error = error?.takeRetainedValue() {
            throw error
        }
    }
}

Three things are missing from this code. It does not check that the file exists, it does not find out the name of the font, and it has no handling for registering the same file twice.

A file name is not a font name

Registering a file named Pretendard-Regular.otf does not guarantee that the font can be called by the name Pretendard-Regular. What UIFont(name:size:) takes is a fully specified name.

The name is read from the file itself. CTFontManagerCreateFontDescriptorsFromURL returns the descriptors, and kCTFontNameAttribute gives the PostScript name. One file can hold several faces, as in a .ttc file, so the result is an array.

This function collects the PostScript names from the descriptors in a file.

import CoreText

func postScriptNames(in url: URL) -> [String] {
    guard let descriptors = CTFontManagerCreateFontDescriptorsFromURL(url as CFURL) as? [CTFontDescriptor] else {
        return []
    }

    return descriptors.compactMap {
        CTFontDescriptorCopyAttribute($0, kCTFontNameAttribute) as? String
    }
}

During development, logging the names that were read makes it easy to confirm which name to call.

let names = postScriptNames(in: fontURL)
print("Font PostScript names:", names)

The output of an actual run is in the section "What running it on macOS showed." The names that were read are gathered in one place, such as a design system or a registry. Writing the string directly in each view makes it hard to replace a font or trace an error.

An example that manages registration state in one place

Calling registration every time a cell is created, every time a SwiftUI body is evaluated, or every time a screen appears can cause duplicate registration errors and unnecessary cost. So one object is put in charge of registration. RuntimeFontRegistry.shared handles the file check, the name collection, and the record of registrations per URL.

First comes the part that holds the state. It stores the URL as the key and the array of names read from that file as the value. The three blocks that follow are the rest of this class. To combine them, remove the // … line and the closing brace below it from this block, then append the three blocks in order. The last block closes the class and declares the error type outside it.

import Foundation
import CoreText

final class RuntimeFontRegistry {
    static let shared = RuntimeFontRegistry()

    private var registeredURLs: [URL: [String]] = [:]
    private let lock = NSLock()

    private init() {}

    // …
}

The register method normalizes the key with standardizedFileURL, checks that the file exists, and checks that the descriptors and names are valid. It then looks up the cache under an NSLock. If the URL is already registered, it returns the stored names. If not, it registers with .process and puts the array of names into the cache.

    @discardableResult
    func registerFont(at url: URL) throws -> [String] {
        let url = url.standardizedFileURL

        guard FileManager.default.fileExists(atPath: url.path) else {
            throw FontRegistrationError.fileNotFound(url)
        }

        let names = try Self.readPostScriptNames(from: url)

        lock.lock()
        if let cached = registeredURLs[url] {
            lock.unlock()
            return cached
        }
        lock.unlock()

        var error: Unmanaged<CFError>?
        let success = CTFontManagerRegisterFontsForURL(
            url as CFURL,
            .process,
            &error
        )

        if !success {
            if let error = error?.takeRetainedValue() as Error? {
                throw error
            }
        }

        lock.lock()
        registeredURLs[url] = names
        lock.unlock()

        return names
    }

The unregister method calls CoreText with the same scope used for registration and removes the entry from the cache.

    func unregisterFont(at url: URL) throws {
        let url = url.standardizedFileURL

        var error: Unmanaged<CFError>?
        let success = CTFontManagerUnregisterFontsForURL(
            url as CFURL,
            .process,
            &error
        )

        if !success {
            if let error = error?.takeRetainedValue() as Error? {
                throw error
            }
        }

        lock.lock()
        registeredURLs.removeValue(forKey: url)
        lock.unlock()
    }

This is the part that reads the names, and the error type. It tells apart a missing file, a file that is not a font, and a file with no PostScript name.

    private static func readPostScriptNames(from url: URL) throws -> [String] {
        guard let descriptors = CTFontManagerCreateFontDescriptorsFromURL(url as CFURL) as? [CTFontDescriptor],
              !descriptors.isEmpty else {
            throw FontRegistrationError.invalidFontFile(url)
        }

        let names = descriptors.compactMap {
            CTFontDescriptorCopyAttribute($0, kCTFontNameAttribute) as? String
        }

        guard !names.isEmpty else {
            throw FontRegistrationError.missingPostScriptName(url)
        }

        return names
    }
}

enum FontRegistrationError: Error {
    case fileNotFound(URL)
    case invalidFontFile(URL)
    case missingPostScriptName(URL)
}

Some things are not handled in this example. Interpreting the error codes that CoreText returns is extra work. I recommend treating a repeated request for the same URL as success, and treating a different file with the same PostScript name as a conflict. A wrong or damaged file has to be handled separately from a duplicate or a name conflict.

Reading the code also shows some limits. NSLock is held only while the cache is looked up and while it is stored, and the CoreText call is outside the lock. So two simultaneous requests for the same URL can both enter registration. Also, when success is false but error is nil, the code does not throw and moves on to the next line. I read these two points from the code. I did not reproduce them by running it.

A downloaded font needs a decision about the file's lifetime

If a file in a temporary location is registered, there is a risk that the system keeps a reference after the file is deleted. So the file is moved to a location the app manages, and registered after that.

This function creates a RuntimeFonts directory under Application Support.

func fontStorageDirectory() throws -> URL {
    let baseURL = try FileManager.default.url(
        for: .applicationSupportDirectory,
        in: .userDomainMask,
        appropriateFor: nil,
        create: true
    )

    let directory = baseURL.appendingPathComponent("RuntimeFonts", isDirectory: true)

    if !FileManager.default.fileExists(atPath: directory.path) {
        try FileManager.default.createDirectory(
            at: directory,
            withIntermediateDirectories: true
        )
    }

    return directory
}

This function copies the downloaded file into that directory and registers it with the registry. The file name is the last path component of temporaryURL as it is, and if a file with the same name exists, it is deleted before the copy.

func installDownloadedFont(from temporaryURL: URL) throws -> [String] {
    let directory = try fontStorageDirectory()
    let destinationURL = directory.appendingPathComponent(temporaryURL.lastPathComponent)

    if FileManager.default.fileExists(atPath: destinationURL.path) {
        try FileManager.default.removeItem(at: destinationURL)
    }

    try FileManager.default.copyItem(at: temporaryURL, to: destinationURL)

    return try RuntimeFontRegistry.shared.registerFont(at: destinationURL)
}

This install example does not unregister before deleting the existing file. That does not match the advice below to unregister before deleting. If the file at an already registered URL is replaced, the registry can also return the names it cached earlier. This is another limit read from the code. The descriptor check happens inside the registry after the copy, and there is no code that checks the integrity of the download, the license, or a name conflict.

What has to be decided in operation lies outside this example: when to delete the file, how to register on the next launch, the fallback and what the user sees when a download fails, the server response and distribution, cache invalidation, the relation to the app version, and the license review.

What running it on macOS showed

I joined the Swift code of this post as it is, compiled it, and ran it. The run used Swift 6.4 on macOS 27.0.1. CoreText exists on macOS too, so registering and unregistering could be checked with no iOS device. There is no UIKit there, though, so the name was checked with CTFontCreateWithName in place of UIFont(name:size:). The font was PretendardStd-Bold.otf, which was already on this Mac and was copied to a temporary folder. It was not installed in the system.

The code compiled with no warnings. Below is the output of a run with calling code added that checks whether the font can be found by name before and after registration.

Font PostScript names: ["PretendardStd-Bold"]
before register: discoverable=false
registry.registerFont: ["PretendardStd-Bold"]
after register : discoverable=true
CTFontCreateWithName -> PretendardStd-Bold
registry.registerFont again (cached): ["PretendardStd-Bold"]
plain registerFont again: error com.apple.CoreText.CTFontManagerErrorDomain code=105
after unregister: discoverable=false
unregister again: error com.apple.CoreText.CTFontManagerErrorDomain code=201
missing file: fileNotFound(<url>)

Four things can be read from it.

The font could not be found by name before registration, could be found after it, and could not be found again after unregistration.
On the second registration, the registry returned the names it had cached. Registering the same URL again without going through the registry gave an error with code 105, the value of CoreText's kCTFontManagerErrorAlreadyRegistered.
Unregistering twice gave an error with code 201 (kCTFontManagerErrorNotRegistered).
A missing file was caught as fileNotFound before CoreText was called.

With a font file that is already installed in the system, the same run found the font by name before registration and after unregistration as well. The same font remains at another path. Code that judges registration by name cannot tell that case apart. installDownloadedFont was not called.

Unregistering only removes the font from matching

Calling CTFontManagerUnregisterFontsForURL takes the font out of descriptor matching. It should not be read as cleaning up UIFont, CTFont, NSAttributedString, and SwiftUI views that already exist.

The lifetime is decided by how the font is used. A font needed for the whole run stays registered. For a temporarily downloaded resource, an owner is decided and that owner unregisters it. Unregistering is attempted before the file is deleted, and if it fails, the deletion is postponed. The scope for registering and unregistering has to be the same, so a font registered with .process is unregistered with .process.

CTFontManagerRegisterGraphicsFont is the API that registers a CGFont object. For a font in a file, the Apple documentation points to URL registration. In the documentation as rechecked on October 4, 2026, this API is marked deprecated as of iOS 18.0 and macOS 15.0, with a note to use CTFontManagerCreateFontDescriptorsFromData or CTFontManagerRegisterFontsForURL. That designing storage, registration, unregistration, and the cache as one unit around the file URL is easier to handle is my own judgment.

The lifetime of .process, the choice between URL registration and CGFont registration, and the effect of unregistering on objects that already exist need to be checked against the SDK and OS version. Branching per error code, conflict handling, safe file replacement and cache invalidation, registration after a restart, and the fallback policy are only described in this post and not implemented in the examples. What the examples do contain is the per-URL cache and a simple file replacement.

What to look at before adopting a Swift package registry

Wed, 17 Jun 2026 15:00:00 GMT

Swift dependencies are usually declared with a Git URL. The same dependency can also be declared with a registry identifier.

This is a declaration with a Git URL.

.package(url: "https://github.com/apple/swift-log.git", from: "1.5.0")

This is a declaration with a registry ID.

.package(id: "apple.swift-log", from: "1.5.0")

The difference is one line, but the path the package travels changes, and CI, reproducibility, internal distribution, security, and Xcode configuration are affected along with it. This post lists what an iOS team should look at when deciding whether to choose this approach. The post does not record applying it to a specific project, and it has no measured resolve times.

The cost of fetching through Git

With a Git URL, the first build clones the repository and picks a version from the tags. Even when only one release is needed, the Git history comes along. With a large repository or a complex dependency graph, resolving can get slow.

Reproducibility is at risk too. What a tag points to can change. If the repository is deleted or moved, having Package.resolved does not guarantee a build.

Some environments have a restricted network. When github.com is blocked, clones and CI can fail. In such places the security team usually requires going through an approved Artifactory, a Git mirror, or an artifact store. With a registry, a setup that supplies packages without reaching GitHub becomes possible.

The order in which a registry serves a package

A registry identifier has the form scope.package-name. For mona.LinkedList, the scope is mona and the name is LinkedList.

.package(id: "mona.LinkedList", .upToNextMajor(from: "1.0.0"))

According to the service specification, the main requests come in three steps. The list of releases comes from /{scope}/{name}, then the Package.swift of that version, then the archive from /{scope}/{name}/{version}.zip. Checking the checksum and the signature also fetches the metadata of the release (usage documentation). Because the archive is served over HTTP, releases can be operated as immutable, and a CDN or an internal store can be used. Source control and distribution are separated. The background is in SE-0292.

The development repository does not have to move. Development can continue on GitHub, GitLab, GitHub Enterprise Server, or an internal Git server, and the registry only delivers releases.

Where the configuration lives

The default registry is set with the CLI.

swift package-registry set https://packages.example.com

The setting is stored at project scope and at user scope. This is the file location at project scope.

.swiftpm/configuration/registries.json

This is the file location at user scope.

~/.swiftpm/configuration/registries.json

The file holds the default URL and the format version.

{
  "registries": {
    "[default]": {
      "url": "https://packages.example.com"
    }
  },
  "version": 1
}

In the help text of Swift 6.4, set takes one URL and has the --global and --scope options. I confirmed this only with --help on October 4, 2026. I did not connect to a registry server or change any configuration.

For a package project, declaring by ID in Package.swift is enough. An iOS app is different. An Xcode app project usually has no Package.swift, and dependencies are managed through project.pbxproj, the workspace, and Package.resolved. Do not assume that a setting made with the CLI applies to Xcode as it is. Check where the setting is actually stored.

Within a team, the registry URL setting is shared, and access tokens are not committed. Another option is a CLI or GUI tool that finds the configuration location in the workspace or .xcodeproj and writes mirrors.json. That is my suggestion, and this post has no example of having built one.

When Git and a registry are mixed

The case that needs the most care is one package arriving by two paths. The direct dependency is declared by registry ID, and another package pulls in the same thing by Git URL.

This is the direct dependency.

.package(id: "apple.swift-log", from: "1.5.0")

This is the declaration that comes in as a transitive dependency.

.package(url: "https://github.com/apple/swift-log.git", from: "1.5.0")

With different origins, the two can get separate identities. Then modules or products can be duplicated, and symbols can clash.

What connects the two is /identifiers?url=. It looks up the registry ID that corresponds to a Git URL. The mapping between URL and ID has to be exact. It is better to keep one origin per package, and I suggest carrying out the move to ID declarations and the upkeep of Git or mirrors together, step by step.

A mirror is something else

A mirror has a different purpose from a registry. The mirror in SE-0219 keeps the .package(url:) declaration and only changes the address fetched from to another Git server.

This is an example that maps the original address to an internal Git address. git.example.com stands for the address of the internal Git server.

{
  "object": [
    {
      "original": "https://github.com/apple/swift-log.git",
      "mirror": "https://git.example.com/mirrors/apple/swift-log.git"
    }
  ],
  "version": 1
}

A registry is the path of IDs and archives, and a mirror is the path that swaps one Git for another. In a restricted network, I suggest applying an internal mirror first and moving to a registry after that.

Authentication and signing

A private registry needs authentication, and the login command can store the credentials (SE-0378).

swift package-registry login https://packages.example.com --token "$TOKEN"

Authentication is about access rights. Whether a release is genuine is handled by signing. A signature is evidence that the publisher holds the key and that the release has not been altered. The two signature headers in the archive response (X-Swift-Package-Signature-Format and X-Swift-Package-Signature) are checked, and the signature and the certificate chain are validated. A verified signature does not mean that the publisher can be trusted. Which CAs to trust, and which certificate may publish which scope, are decided separately by the organization.

Signing needs an X.509 certificate for code signing and a private key. On macOS an identity in the Keychain can be used, and in CI passing a key file and certificate chain files is also possible (SE-0391). The publish endpoint that the command below uploads the archive to is defined in SE-0321.

swift package-registry publish mycompany.design-system 1.2.0 \
  --url https://packages.example.com \
  --private-key-path ./private-key.pkcs8.der \
  --cert-chain-paths ./leaf-cert.der ./intermediate.der ./root.der

I confirmed only that --token of login and --url, --private-key-path, and --cert-chain-paths of publish are in the help text of Swift 6.4. The commands were not run against a real server. The environment variable SWIFTPM_REGISTRY_TOKEN, which the earlier version mentioned for CI, did not appear in the help text. The usage documentation on the main branch lists this variable as a way to authenticate (checked on October 4, 2026). I could not confirm whether Swift 6.4 supports it, so check with the toolchain in use before relying on it.

At the organization level, the scopes and packages each certificate may publish are managed, and when an internal CA is operated, the SwiftPM trust root configuration has to be distributed to the team.

Deciding whether to adopt it

With few dependencies and free access to GitHub, the gain may be small. The following are reasons to consider it. Resolving is slow. There are many internal packages. Outside access is restricted. A store such as JFrog, Nexus, or Artifactory is already in operation. A private SDK is delivered to customers. There are requirements for checksums, signing, or audit logs.

I suggest checking in the following order.

List the dependencies.
Look at the Git URLs in Package.resolved and in Xcode.
Measure how long resolving takes in CI.
Check whether GitHub, GitHubusercontent, and external binary URLs are allowed.
Separate what to receive through a registry from what to receive through a mirror.
Check that no dependency graph brings the same package in by both a Git URL and a registry ID.
Confirm where the configuration lives in the workspace and .xcodeproj.
Decide how tokens and CI variables are handled.
Decide whether signing is needed and which CA to trust.
See how it connects to the internal store.

Package approval, the choice between a registry and a mirror, sharing the Xcode configuration, and the external hosts allowed in CI are matters for the team or a platform group to set as policy.

The request order, the configuration files, authentication, and signing come from the Swift Evolution proposals and the SwiftPM documentation. The adoption order and the checklist are my own design choices built on that, not results confirmed by applying them. Where the configuration lives in each Xcode version, and how compatible it is, was not checked. Results confirming how a mixed graph actually behaves, or the speed before and after moving to a registry, are not in this post either. The documentation links point to the main branch, so their content can change.

Five changes from WWDC26 for iOS developers

Wed, 17 Jun 2026 15:00:00 GMT

On June 8, 2026, at WWDC26, Apple announced iOS 27, iPadOS 27, macOS 27, watchOS 27, visionOS 27, and tvOS 27 (Apple Newsroom). According to the same press release, the developer beta was available from the day of the announcement, and the release comes this fall as a free software update.

This post sorts what reaches people who build iOS apps into five areas. The announced facts are what I rechecked on October 4, 2026 on six official Apple pages, and what comes later in each section is my own view. Results of implementing or measuring anything on the beta are not in this post.

Exposing app content and actions to the system

According to the WWDC26 iOS guide, Siri reaches the content and actions of an app in natural language through the App Intents framework. Entity schemas contribute the content of the app to the Spotlight semantic index. With intent schemas, people can ask for actions on that content in natural language, with no specific phrases to define. The new View Annotations API maps views to entities, so that what is on screen can be referred to and acted on in conversation. The App Intents Testing framework validates the integration through real system pathways, without UI automation.

From here on it is my view. The ways into a feature from Siri and Spotlight, outside the app, are getting wider, so I see App Intents support as something to put into the first design, not an extra convenience. I expect it to be harder to add later. I recommend deciding first which entities and actions to expose. For a sports app the candidates are games, teams, leagues, and schedules, and for a commerce app they are products, orders, the cart, and delivery status. These examples are mine and are not in Apple's guide.

Where the model runs

The same iOS guide introduces the Foundation Models framework as a Swift API for the on-device model that Apple Intelligence uses. It says the framework now works with Apple Foundation Models, with cloud models like Claude and Gemini, and with any other provider that conforms to the Language Model protocol. Multimodal prompts pass images alongside text, and Dynamic Profiles swap models, tools, and instructions within a continuous session. The Evaluations framework is a tool for verifying that AI features behave correctly across conditions.

Core AI is a new framework for running your own models on-device. It is built into the OS and made for Apple Silicon, and models are loaded and run through a Swift API. The guide names ahead-of-time compilation, zero-copy data paths, and stateful execution as its performance elements. For Private Cloud Compute, there is a condition. The guide says that if you are enrolled in the App Store Small Business Program and your app has fewer than 2 million total first-time downloads, you can access the next generation of Apple Foundation Models running on Private Cloud Compute at no cloud API cost.

As I read it, the two have different roles. Foundation Models connects language and multimodal models to an app, and Core AI runs a model you already have on Apple Silicon. I recommend looking first at handling summarizing, classifying, recommending, and input correction on the device, and at Private Cloud Compute or an outside provider for large inference and generation. For sensitive information, check whether it can be handled on the device before it is sent out. The things to compare are cost, latency, and privacy. Also look at whether testing and evaluation can be automated.

Xcode 27 and agents

According to the summary of the Platforms State of the Union, Xcode 27 is Apple silicon only. Projects load faster, settings sync via iCloud, and the toolbar is customizable. The new Device Hub replaces Simulator and brings virtual and physical devices together in one place. The same article says agents in Xcode can run tests, try things in Playground, run apps in the Simulator, fix issues, and localize apps. Plugins add skills and MCP tools, and other agents connect through the Agent Client Protocol. The WWDC26 Xcode guide covers Device Hub, improvements to Instruments, and localization with agents.

The sentence that Device Hub replaces Simulator and the sentence that agents run apps in the Simulator are in the same article. From that article alone I could not tell whether only the management screen changed or the runtime changed as well.

If you develop on an Intel Mac or run CI builds on one, I think a plan to move is needed. I expect agents to be useful for validating small changes, analyzing test failures, and tidying string catalogs. Even so, I recommend treating generated code as a draft and always reviewing the diff. A team does well to agree first on how far agents are used and on the review rules. Changes that touch architecture, authentication, payments, storage, or sync deserve a stricter look. I think decisions about structure and quality have to stay with the developer.

The material and the size of the screen

According to the iOS 27 page, Liquid Glass has more uniform refraction and improved contrast, and app icons are sharper. A slider lets users adjust Liquid Glass from ultraclear to fully tinted. The page also gives performance figures. App launches are up to 30% faster, new photos load in Photos up to 70% faster, and AirDrop transfers are up to 80% faster. These numbers are upper bounds that Apple measured on specific devices under specific conditions, and the footnotes give the test conditions. They do not mean every app gets that much faster.

The State of the Union summary says iOS apps are now resizable. People can use larger displays on iPad, and in iPhone Mirroring on Mac.

I see custom navigation bars, tab bars, toolbars, blur backgrounds, translucent overlays, and floating buttons that an app implements itself as things to check again. Confirm that they stay readable with Dynamic Type, dark mode, Reduce Transparency, and increased contrast. A layout that assumes the size of an iPhone can break when the size changes, so I recommend checking touch areas, scrolling, and transitions on a real device.

Subscription products and review submission

According to the WWDC26 App Store guide, multiple In-App Purchases, including subscriptions, can be grouped into a single submission in App Store Connect. They can also go together with other review items such as In-App Events, custom product pages, and product page optimization tests.

Retention Messaging shows subscribers a message about the value of the subscription. Apple describes it as not adding friction to the cancellation flow, and says a special offer can be shown with it. It is listed as coming this fall. Subscription Bundles let people buy several auto-renewable subscriptions as a single subscription, and Suites offer a set of subscriptions that are not sold standalone. The guide says more on how to request these two will come later in the summer. Group Purchases let one subscriber buy multiple seats in a single purchase and invite others. Volume Purchasing makes a subscription available to enterprise and education buyers through Apple School Manager and Apple Business.

If you run subscriptions, I do not think the StoreKit code is the only thing to look at. The product model, operations in App Store Connect, review, entitlements after purchase, and the cancellation process need to be reviewed together. Pricing and bundling, the response to churn, and sales to organizations are questions to settle together with policy.

What this post relies on is Apple's press release and guide pages as they were on October 4, 2026. API names and availability conditions can change in the release version. Availability by region and device, and beta numbers, are not covered here. This post includes no implementation results for the parts written as my view.