fix(ci): bound stalled Apple probes and record verified native APK

Mac Node bootstrap and checkout now pass, but Apple-tool preflight stalled after Xcode version output for twenty minutes. Add per-command deadlines and diagnostics without changing licenses/host settings; fourteen preflight/probe regressions pass. Record successful Android build/upload, downloaded APK signature/version and emulator install/launch, and unchanged missing-KVM matrix failures. No Apple app success is claimed.

docs/ci-runners.md

@@ -46,7 +46,17 @@ Before the first JavaScript action, an inline shell bootstrap installs verified
 native Node 22.22.1 into a versioned runner tool cache and exports its bin directory
 through `GITHUB_PATH`. It needs no Homebrew/root access and remains available to
 action post-cleanup. This addresses run #4's `Cannot find: node in PATH` failure;
-the modified workflow itself still needs a real Mac run.
+native bootstrap and checkout were verified in Mac job 1062 (run 661/#6).
+That job subsequently stalled in Apple-tool preflight after printing Xcode 27.1.
+The preflight now prints each tool probe and bounds it to 60 seconds using Python
+(`scripts/check-apple-tools.py`), so the next run identifies the unresponsive
+command rather than hanging silently. This does not validate the iOS app.
+
+If an Apple probe stalls, run the named command in the runner user's interactive
+login session, check the selected full Xcode, finish its first-launch components
+and confirm CoreSimulator/runtimes work for that user. CI does not accept licenses,
+change `xcode-select`, install runtimes or kill host simulator services. The runner
+administrator must repair those prerequisites before native Apple validation.
 
 XcodeGen's pinned, checksum-verified binary includes native arm64 and x86_64
 slices; Rosetta/Homebrew installation is not required by the workflow. Build,

docs/continuation.md

@@ -42,7 +42,14 @@ collection before uninstall; the PNG was opened and confirmed nonblank. Five new
 output-regression tests guard missing, invalid, ambiguous and stale screenshots.
 See `validation.md` for logs and limitations. No Apple SDK result is implied.
 
-The next Mac/Ubuntu workflow execution still needs inspection after pushing.
+Android build job 1059 in global run 660 (#5) succeeded; the actual native debug
+artifact was downloaded, checked and installed/launched on `emulator-5554`.
+Jobs 1060/1061 still fail KVM preflight. Mac job 1062 in run 661 (#6) passed native
+Node bootstrap and checkout, printed Xcode 27.1, then stalled in Apple-tool
+preflight for at least 20 minutes. The new `check-apple-tools.py` prints each
+command and imposes a 60-second deadline; fourteen runner/probe regressions pass.
+Inspect its next Mac run for the exact stalled command and fix the runner user
+session/Xcode/CoreSimulator prerequisites without weakening the check.
 Rebuild/collect from a clean checkout; do not present cached wrapper artifacts as
 the native preview. Keep the signing stash parked.
 

docs/native-delivery-report.md

@@ -49,7 +49,7 @@ Human security review and additional device/role/error-path coverage remain open
 
 10 JVM tests, 6 native API-35 UI tests, the 7-test real-server suite (including
 those same 6), both Android lint variants and package builds pass. Swift has 16
-portable passes plus strict formatting/parsing. 23 script regressions, repository
+portable passes plus strict formatting/parsing. 27 script regressions, repository
 checks, workflow lint and the 266-coordinate OSV scan pass. See
 [validation](validation.md) for evidence, failures corrected and exact limitations.
 
@@ -62,10 +62,13 @@ state. Only the development-signed debug APK is installable as provided.
 
 ## 10. Gitea CI
 
-The Android workflow offers `android-native-debug-apk`; the Mac workflow bootstraps
-verified ARM64 Node before checkout. Actual artifact publication and Apple build
-results require remote-run inspection. Remote Ubuntu emulator jobs need KVM access;
-local emulator success is not a substitute for a passing remote matrix.
+Android build job 1059 succeeded and uploaded `android-native-debug-apk`. The actual
+artifact was downloaded, signature/version checked, installed and launched on the
+authorized local emulator. [Download the verified artifact](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/660/artifacts/android-native-debug-apk).
+Mac Node bootstrap and checkout now succeed, but its Apple-tool preflight stalled;
+named/bounded probes have been added for diagnosis. The remote emulator matrix
+still fails missing-KVM preflight, not native tests. No green whole-pipeline or
+Apple application validation is claimed. See [validation](validation.md).
 
 ## 11. Signing and publication
 

docs/validation.md

@@ -21,7 +21,7 @@ not included in the native suites or counted toward native completion.
 | Android packages | Debug APK and unsigned release APK/AAB built successfully |
 | Swift portable suite | 16 passed; actual Foundation transport/contracts and URL/metadata policy, not Apple UI/Keychain execution |
 | Swift formatting/parsing | Strict format lint and parsing passed, including Apple-only sources |
-| Script regressions | 10 runner-preflight, 8 JUnit-evidence and 5 screenshot-output tests passed |
+| Script regressions | 14 runner-preflight/Apple-probe, 8 JUnit-evidence and 5 screenshot-output tests passed |
 | Repository/workflows | Source invariants, Python compilation, diff whitespace and actionlint for all 3 Gitea workflows passed |
 | OSV | No listed advisories for 266 locked/direct Maven coordinates and plugins; not a security audit |
 
@@ -51,10 +51,31 @@ Evidence paths in the local external build directory:
   `/home/neste/yuvomi-native-integration-final.log`,
   `/home/neste/yuvomi-native-swift.log`.
 
+## Observed Gitea results for source `40a7962`
+
+- Android run #5 (global run 660), build job 1059: **success**, including packages,
+  JVM/lint, formatting/repository/script checks, OSV and both artifact uploads.
+- The actual `android-native-debug-apk` ZIP was downloaded. It contains exactly
+  `app-debug.apk`, version `0.2.0-native-preview`/code 2; APK v2 signature verified,
+  no fixture certificate/private-key files, installed and launched on the local
+  authorized API-35 emulator. SHA-256 of the downloaded APK:
+  `48d58ba5663b2e4fe563064efc567732e8ea35588cb610660f60406e82ccf610`.
+  Its ephemeral CI debug certificate differs from the local development key, so
+  its checksum intentionally differs from the locally collected APK.
+- [Download the verified native debug artifact](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/660/artifacts/android-native-debug-apk)
+  (repository access required; normal 14-day artifact retention applies).
+- Remote jobs 1060/1061 (API 35/37.0): **failed preflight** because `/dev/kvm` was
+  not exposed/writable. They executed no emulator tests. The matrix is not green.
+- iOS run #6 (global 661), job 1062: verified native Node bootstrap and checkout
+  **succeeded**. Xcode 27.1/build 27A9275 printed, but the subsequent Apple-tool
+  preflight did not return during a 20-minute observation. No SwiftUI compile or
+  simulator/XCTest/Keychain/device success is claimed. Bounded, named tool probes
+  now fail with actionable diagnostics instead of silently hanging for the job's
+  full hour; their actual next Mac result still needs inspection.
+
 No Apple SDK application build, simulator UI test or physical-device result is
-claimed from these Linux runs. The modified Mac bootstrap and remote APK upload
-still require inspection of the next actual Gitea run. Prior remote emulator jobs
-failed KVM preflight; the prerequisite was not weakened or counted as passing.
+claimed from the Linux runs or the stalled Mac job. Runner prerequisites were
+not weakened or counted as passing, and no host license/settings were changed.
 
 ## Commands