@craft-native/ios 0.0.487 → 0.0.491

package/dist/cli.js

@@ -546,6 +546,21 @@ function hybridConfigProblems(config) {
     if (!matchNativePath(config.nativeScreens, start, config.nativeScreenConstraints))
       problems.push(`The start path "${start}" (from devServerURL) is not a nativeScreens path; with renderer: "native" the app must start on a native screen.`);
   }
+  const gate = config.nativeGate;
+  if (gate !== undefined) {
+    if (typeof gate.redirect !== "string" || normalizeNativePath(gate.redirect) !== gate.redirect)
+      problems.push(`nativeGate.redirect "${String(gate.redirect)}" must be an absolute path with no query, hash or trailing slash.`);
+    else if (hasNativeRoutes(config) && !matchNativePath(config.nativeScreens, gate.redirect, config.nativeScreenConstraints))
+      problems.push(`nativeGate.redirect "${gate.redirect}" is not a nativeScreens path; a signed-out launch would have nothing to show.`);
+    for (const path of gate.publicPaths ?? []) {
+      if (typeof path !== "string" || normalizeNativePath(path) !== path)
+        problems.push(`nativeGate.publicPaths "${String(path)}" must be an absolute path with no query, hash or trailing slash.`);
+    }
+    if (typeof gate.redirect === "string" && !(gate.publicPaths ?? []).some((path) => gate.redirect === path || gate.redirect.startsWith(`${path}/`)))
+      problems.push(`nativeGate.redirect "${gate.redirect}" must also be listed in nativeGate.publicPaths.`);
+    if (gate.token !== undefined && (typeof gate.token !== "string" || !gate.token))
+      problems.push("nativeGate.token must be the secure-storage key the sign-in lives under.");
+  }
   if (config.nativeApp !== undefined) {
     if (typeof config.nativeApp !== "string" || !/^[A-Za-z_$][\w$-]*$/.test(config.nativeApp))
       problems.push(`nativeApp "${String(config.nativeApp)}" must be a route name from the native bundle.`);

package/dist/index.js

@@ -740,6 +740,21 @@ function hybridConfigProblems(config) {
     if (!matchNativePath(config.nativeScreens, start, config.nativeScreenConstraints))
       problems.push(`The start path "${start}" (from devServerURL) is not a nativeScreens path; with renderer: "native" the app must start on a native screen.`);
   }
+  const gate = config.nativeGate;
+  if (gate !== undefined) {
+    if (typeof gate.redirect !== "string" || normalizeNativePath(gate.redirect) !== gate.redirect)
+      problems.push(`nativeGate.redirect "${String(gate.redirect)}" must be an absolute path with no query, hash or trailing slash.`);
+    else if (hasNativeRoutes(config) && !matchNativePath(config.nativeScreens, gate.redirect, config.nativeScreenConstraints))
+      problems.push(`nativeGate.redirect "${gate.redirect}" is not a nativeScreens path; a signed-out launch would have nothing to show.`);
+    for (const path of gate.publicPaths ?? []) {
+      if (typeof path !== "string" || normalizeNativePath(path) !== path)
+        problems.push(`nativeGate.publicPaths "${String(path)}" must be an absolute path with no query, hash or trailing slash.`);
+    }
+    if (typeof gate.redirect === "string" && !(gate.publicPaths ?? []).some((path) => gate.redirect === path || gate.redirect.startsWith(`${path}/`)))
+      problems.push(`nativeGate.redirect "${gate.redirect}" must also be listed in nativeGate.publicPaths.`);
+    if (gate.token !== undefined && (typeof gate.token !== "string" || !gate.token))
+      problems.push("nativeGate.token must be the secure-storage key the sign-in lives under.");
+  }
   if (config.nativeApp !== undefined) {
     if (typeof config.nativeApp !== "string" || !/^[A-Za-z_$][\w$-]*$/.test(config.nativeApp))
       problems.push(`nativeApp "${String(config.nativeApp)}" must be a route name from the native bundle.`);

package/dist/internal/ios/src/index.d.ts

@@ -317,6 +317,28 @@ export interface CraftConfig {
      * `craftsession` event on the page.
      */
     sessionTokenKey?: string;
+    /**
+     * Which screens a signed-out launch may start on.
+     *
+     * The shell resolves this while it is deciding the start path, before any
+     * screen is built. An app script cannot do the same job: it is started from
+     * the first frame's completion block, so by the time it can read a token the
+     * signed-in screen it would have prevented has already been painted — with
+     * the previous session's kept snapshot in it when the launch follows an
+     * expired token rather than a sign-out.
+     *
+     * ```ts
+     * nativeGate: {
+     *   publicPaths: ['/m/login', '/m/signup', '/m/store'],
+     *   redirect: '/m/login',
+     * }
+     * ```
+     *
+     * `publicPaths` admits a listed path and anything under it, so `/m/store`
+     * covers `/m/store/42` and not `/m/storefront`. `token` defaults to
+     * `sessionTokenKey`, the item `craft.session` already follows.
+     */
+    nativeGate?: NativeGate;
     /**
      * Crash and error reporting to bughq (CraftCrashReporter.swift): crashes
      * and hangs (signal handlers, NSException, MetricKit), uncaught JavaScript
@@ -325,6 +347,25 @@ export interface CraftConfig {
      */
     crashReporting?: CraftCrashReporting;
 }
+/**
+ * An auth gate the shell applies while resolving the start path.
+ *
+ * See `CraftConfig.nativeGate`. The allowlist is static data in the apps that
+ * need this, so emitting it into the config costs nothing at runtime.
+ */
+export interface NativeGate {
+    /**
+     * Paths a signed-out launch may start on, each admitting what sits under it.
+     *
+     * Not `public`: that is a Swift keyword, and remapping it would make the
+     * stored key differ from the property the host decodes it into.
+     */
+    publicPaths?: string[];
+    /** Where a signed-out launch starts instead. Must itself be public. */
+    redirect: string;
+    /** The secure-storage key holding the sign-in. Defaults to `sessionTokenKey`. */
+    token?: string;
+}
 export interface CraftCrashReporting {
     /** The bughq project's public ingest key. Ships in the app; it is not a secret. */
     key: string;
@@ -362,7 +403,7 @@ export declare function usesNativeBundle(config: Pick<CraftConfig, 'renderer' |
  */
 export declare function nativeStartPath(config: Pick<CraftConfig, 'devServerURL'>): string;
 /** What is wrong with a config's hybrid and tab settings, one sentence each. */
-export declare function hybridConfigProblems(config: Pick<CraftConfig, 'renderer' | 'nativeScreens' | 'nativeScreenConstraints' | 'tabs' | 'shareStorage' | 'devServerURL' | 'nativeApp' | 'nativeScriptThread' | 'notificationCategories'>): string[];
+export declare function hybridConfigProblems(config: Pick<CraftConfig, 'renderer' | 'nativeScreens' | 'nativeScreenConstraints' | 'tabs' | 'shareStorage' | 'devServerURL' | 'nativeApp' | 'nativeScriptThread' | 'notificationCategories' | 'nativeGate'>): string[];
 /**
  * The builder installs a directory of route bundles (stx's `routesDir`) as
  * well as the one-file bundle, and the app runs each screen from its own

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@craft-native/ios",
-  "version": "0.0.487",
+  "version": "0.0.491",
   "homepage": "https://github.com/craft-native/craft/tree/main/packages/ios#readme",
   "repository": {
     "type": "git",

package/templates/CraftApp.swift

@@ -2046,6 +2046,9 @@ struct CraftConfig: Codable {
     /// (`auth.token` unless set): `craft.session` follows it, and a change of
     /// it is `SESSION_CHANGED` on every screen (CraftSession).
     var sessionTokenKey: String? = nil
+    /// Which screens a signed-out launch may start on, resolved before the
+    /// first frame is built (CraftHybrid.configure).
+    var nativeGate: NativeGate? = nil
     /// The bundle route of the app script: a screen-less script that runs for
     /// the app's whole life and hears the app's events (CraftHybrid.swift).
     var nativeApp: String? = nil
@@ -2057,6 +2060,33 @@ struct CraftConfig: Codable {
     /// unless the config names a project key.
     var crashReporting: CrashReporting? = nil
 
+    /// An auth gate the shell applies while resolving the start path.
+    ///
+    /// An app script cannot do this. It is started from the first frame's
+    /// `CATransaction` completion block, so by the time it can read a token
+    /// the signed-in screen it would have prevented is already on screen —
+    /// with the previous session's kept snapshot in it when the launch
+    /// follows an expired token rather than a sign-out (#499). The check has
+    /// to belong to whoever decides the start path, and that is the shell.
+    struct NativeGate: Codable {
+        /// Paths that may be shown without a sign-in. A path is public when
+        /// it is listed, or when it sits under a listed one: `/m/store`
+        /// admits `/m/store/42` and not `/m/storefront`.
+        ///
+        /// Spelled `publicPaths` rather than `public` in the stored config
+        /// too. `public` is a Swift keyword, and remapping it through
+        /// `CodingKeys` would make the property name and the stored key
+        /// differ — which is exactly what the Zig conformance mirror checks,
+        /// and a divergence worth not having for the sake of one word.
+        var publicPaths: [String]? = nil
+        /// Where a signed-out launch starts instead.
+        var redirect: String? = nil
+        /// The secure-storage key holding the sign-in. Defaults to
+        /// `sessionTokenKey`, which is the same item `craft.session` follows,
+        /// so an app that already declares one need not repeat it.
+        var token: String? = nil
+    }
+
     struct Tab: Codable {
         var id: String
         var title: String

package/templates/CraftHybrid.swift

@@ -425,6 +425,7 @@ final class CraftHybrid: NSObject {
                 : "[craft hybrid] nativeScreens are set but dist/native-screen.js is missing; the app has no screens to show")
         }
         isEnabled = wanted && Self.hasBundle
+        applyGate(config)
         if isEnabled, !hasWeb, routes.match(startPath) == nil {
             // No web view to show it in: the first tab a screen draws.
             let fallback = (config.tabs ?? []).map(\.id).first { routes.match($0) != nil }
@@ -458,6 +459,54 @@ final class CraftHybrid: NSObject {
         DispatchQueue.main.asyncAfter(deadline: .now() + 1.5) { self.startAppScript() }
     }
 
+    /// Whether `path` may be shown to someone who is not signed in.
+    ///
+    /// Listed, or under something listed: `/m/store` admits `/m/store/42` and
+    /// not `/m/storefront`. Prefixes are compared with the separator attached
+    /// so a listed path cannot admit a sibling that merely starts with its
+    /// letters.
+    static func gateAdmits(_ path: String, public allowed: [String]) -> Bool {
+        allowed.contains { entry in
+            var listed = entry
+            while listed.count > 1, listed.hasSuffix("/") { listed.removeLast() }
+            guard !listed.isEmpty else { return false }
+            if path == listed { return true }
+            // "/" is the root path, not a prefix of everything. Reading it as
+            // one would admit every path, which is a gate that is not a gate.
+            guard listed != "/" else { return false }
+            return path.hasPrefix(listed + "/")
+        }
+    }
+
+    /// Send a signed-out launch to the gate's redirect before anything is built.
+    ///
+    /// This runs while `startPath` is still being resolved, which is the
+    /// whole point: the app script that would otherwise do it does not start
+    /// until the first frame has been committed, so it can only push sign-in
+    /// on top of a screen that has already been drawn with the previous
+    /// session's data in it (#499).
+    ///
+    /// The Keychain read is synchronous and can cost 100-900ms cold. It is
+    /// not an extra read: every signed-in screen reads this same item when it
+    /// opens, and `CraftKeychain` caches it, so the gate moves the app's first
+    /// read earlier rather than adding one. Only apps that declare a gate pay
+    /// it at all.
+    private func applyGate(_ config: CraftConfig) {
+        guard let gate = config.nativeGate, let redirect = gate.redirect, !redirect.isEmpty else { return }
+        guard !Self.gateAdmits(startPath, public: gate.publicPaths ?? []) else { return }
+        let key = gate.token ?? config.sessionTokenKey ?? "auth.token"
+        guard (CraftNativeActions.webSecureValue(forKey: key) ?? "").isEmpty else { return }
+        // A redirect nothing can draw would trade a private screen for a
+        // blank one. Say so and leave the start path alone; the fallback
+        // below then treats it as any other unroutable start.
+        if isEnabled, !hasWeb, routes.match(redirect) == nil {
+            NSLog("[craft hybrid] nativeGate redirect %@ has no native screen; the gate did not run", redirect)
+            return
+        }
+        NSLog("[craft hybrid] no sign-in under %@: starting on %@ instead of %@", key, redirect, startPath)
+        startPath = redirect
+    }
+
     /// A silent push or a background refresh is waiting for the app script,
     /// with iOS's clock running: it starts now rather than after a frame,
     /// which a launch in the background never draws.

package/templates/CraftNativeActions.swift

@@ -2001,7 +2001,15 @@ enum CraftSnapshots {
             }
             lock.unlock()
             DispatchQueue.main.async {
-                if ok { NotificationCenter.default.post(name: changed, object: nil, userInfo: ["name": name]) }
+                // Posted whether or not the write landed. A screen displays its
+                // checkpoint optimistically, and this notification carries only
+                // the name, so a reader answers it by calling `read` — which
+                // after a failure finds the previous value, because `pending`
+                // was cleared above and the cache was only refilled on success.
+                // Posting only on success left a failed checkpoint on screen as
+                // though it had been kept; Android already restores it
+                // (`changed("snapshots", name, if (ok) json else previous, null)`).
+                NotificationCenter.default.post(name: changed, object: nil, userInfo: ["name": name])
                 completion?(ok)
             }
         }

package/templates/CraftNativeScreen.swift

@@ -12,6 +12,7 @@ import OSLog
 import Security
 import SwiftUI
 import UIKit
+import UIKit.UIGestureRecognizerSubclass
 
 /// A menu belongs to its native view, not to coordinates in a web page.
 final class CraftNativeContextMenu: NSObject, UIContextMenuInteractionDelegate {
@@ -5195,6 +5196,23 @@ private final class CraftNativeScrollView: UIScrollView, UIGestureRecognizerDele
 /// Native inspection of an SVG plot. Coordinates are fractions of the plot's
 /// bounds; labels and values are already localized by the application. No JS
 /// callback or bridge round trip is needed while a finger moves.
+/// Reports where each touch starts and then fails, so it observes a window
+/// without ever taking a touch from the view underneath.
+final class CraftTouchBeganRecognizer: UIGestureRecognizer {
+    private let began: (CGPoint) -> Void
+    init(began: @escaping (CGPoint) -> Void) {
+        self.began = began
+        super.init(target: nil, action: nil)
+        cancelsTouchesInView = false
+        delaysTouchesBegan = false
+        delaysTouchesEnded = false
+    }
+    override func touchesBegan(_ touches: Set<UITouch>, with event: UIEvent) {
+        state = .failed
+        if let touch = touches.first { began(touch.location(in: view)) }
+    }
+}
+
 final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
     struct Reading {
         let key: String
@@ -5214,6 +5232,7 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
     private lazy var tap = UITapGestureRecognizer(target: self, action: #selector(tapped(_:)))
     private lazy var pan = UIPanGestureRecognizer(target: self, action: #selector(panned(_:)))
     private lazy var hold = UILongPressGestureRecognizer(target: self, action: #selector(held(_:)))
+    private var outside: CraftTouchBeganRecognizer?
 
     init(view: UIView) {
         self.view = view
@@ -5241,6 +5260,7 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
                            color: (point["color"] as? String).flatMap { UIColor(css: $0) } ?? .systemBlue, label: label, rows: rows)
         }
         selectedIndex = -1
+        unwatchOutside()
         view?.isUserInteractionEnabled = !readings.isEmpty
         if readings.isEmpty { view?.accessibilityTraits.remove(.adjustable); view?.accessibilityValue = nil }
         [tap, pan, hold].forEach { $0.isEnabled = !readings.isEmpty }
@@ -5270,6 +5290,7 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
     }
 
     @discardableResult func dismiss() -> Bool {
+        unwatchOutside()
         guard selectedIndex >= 0 else { return false }
         selectedIndex = -1
         configureAccessibility()
@@ -5277,20 +5298,47 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
         return true
     }
 
-    private func select(at point: CGPoint) {
-        guard let view, view.bounds.width > 0 else { return }
+    private func nearest(at point: CGPoint) -> Int? {
+        guard let view, view.bounds.width > 0 else { return nil }
         let fraction = max(0, min(1, point.x / view.bounds.width))
-        if let nearest = readings.indices.min(by: { abs(readings[$0].x - fraction) < abs(readings[$1].x - fraction) }) { select(nearest) }
+        return readings.indices.min(by: { abs(readings[$0].x - fraction) < abs(readings[$1].x - fraction) })
+    }
+    private func select(at point: CGPoint) {
+        if let index = nearest(at: point) { select(index); watchOutside() }
+    }
+    /// A tap pins the reading under it. Tapping the pinned reading again puts
+    /// it away, so a reading can always be closed where it was opened.
+    func tap(at point: CGPoint) {
+        guard let index = nearest(at: point) else { return }
+        if index == selectedIndex { dismiss() } else { select(at: point) }
+    }
+    /// A drag or a hold reads the chart only while the finger is down.
+    func scrub(_ state: UIGestureRecognizer.State, at point: CGPoint) {
+        switch state {
+        case .began, .changed: select(at: point)
+        case .ended, .cancelled, .failed: dismiss()
+        default: break
+        }
     }
-    @objc private func tapped(_ gesture: UITapGestureRecognizer) { select(at: gesture.location(in: view)) }
-    @objc private func panned(_ gesture: UIPanGestureRecognizer) {
-        if gesture.state == .began || gesture.state == .changed { select(at: gesture.location(in: view)) }
-        if gesture.state == .cancelled { dismiss() }
+    /// A touch that starts anywhere off the chart closes a pinned reading. The
+    /// watcher never recognises, so the touch still reaches what it landed on.
+    func touchBegan(inWindow point: CGPoint) {
+        guard let view, let window = view.window else { return }
+        if !view.bounds.contains(view.convert(point, from: window)) { dismiss() }
     }
-    @objc private func held(_ gesture: UILongPressGestureRecognizer) {
-        if gesture.state == .began || gesture.state == .changed { select(at: gesture.location(in: view)) }
-        if gesture.state == .cancelled { dismiss() }
+    private func watchOutside() {
+        guard outside == nil, let window = view?.window else { return }
+        let watcher = CraftTouchBeganRecognizer { [weak self] point in self?.touchBegan(inWindow: point) }
+        window.addGestureRecognizer(watcher)
+        outside = watcher
     }
+    private func unwatchOutside() {
+        if let outside { outside.view?.removeGestureRecognizer(outside) }
+        outside = nil
+    }
+    @objc private func tapped(_ gesture: UITapGestureRecognizer) { tap(at: gesture.location(in: view)) }
+    @objc private func panned(_ gesture: UIPanGestureRecognizer) { scrub(gesture.state, at: gesture.location(in: view)) }
+    @objc private func held(_ gesture: UILongPressGestureRecognizer) { scrub(gesture.state, at: gesture.location(in: view)) }
     func gestureRecognizerShouldBegin(_ gesture: UIGestureRecognizer) -> Bool {
         guard gesture === pan else { return true }
         let velocity = pan.velocity(in: view)
@@ -6002,9 +6050,23 @@ final class CraftNativeSolidSwitch: UIControl {
         return CGRect(x: min(max(x, track.minX), track.maxX - rect.width - stretch),
                       y: rect.minY, width: rect.width + stretch, height: rect.height)
     }
+    /// How much wider than tall the thumb is drawn.
+    ///
+    /// iOS 26 draws a wide pill where every system before it drew a circle,
+    /// so a square thumb reads as a control from an older OS sitting among
+    /// native ones. Measured on iOS 26.5 (iPhone 17 Pro simulator) by walking
+    /// a real `UISwitch`: the control is 63x28 and its thumb 37x24, inset 2 on
+    /// every side, travelling from x=2 to x=24.
+    ///
+    /// Expressed against the thumb's own height rather than as a fixed size,
+    /// so it keeps following whatever the real `UISwitch` reports — which is
+    /// where `naturalSize` already comes from. At the system's own 24-point
+    /// thumb height this is exactly 37.
+    private static let thumbAspect: CGFloat = 37.0 / 24.0
     private func thumbRect(at position: CGFloat) -> CGRect {
         let track = trackRect.insetBy(dx: 2, dy: 2)
-        return CGRect(x: track.minX + (track.width - track.height) * position, y: track.minY, width: track.height, height: track.height)
+        let width = min(track.width, track.height * Self.thumbAspect)
+        return CGRect(x: track.minX + (track.width - width) * position, y: track.minY, width: width, height: track.height)
     }
     override func draw(_ rect: CGRect) {
         let track = trackRect
@@ -6341,12 +6403,37 @@ private final class CraftNativeTextView: UITextView {
         if !isScrollEnabled, contentOffset != .zero { contentOffset = .zero }
         let inset = textContainerInset
         let padding = textContainer.lineFragmentPadding
-        placeholderLabel.frame = CGRect(
-            x: inset.left + padding,
-            y: inset.top,
-            width: max(0, bounds.width - inset.left - inset.right - padding * 2),
-            height: max(0, bounds.height - inset.top - inset.bottom)
-        )
+        let measured = placeholderLabel
+            .sizeThatFits(CGSize(width: Self.placeholderWidth(bounds: bounds, inset: inset, padding: padding),
+                                 height: .greatestFiniteMagnitude))
+        placeholderLabel.frame = Self.placeholderFrame(bounds: bounds, inset: inset, padding: padding,
+                                                       fittedHeight: measured.height)
+    }
+
+    static func placeholderWidth(bounds: CGRect, inset: UIEdgeInsets, padding: CGFloat) -> CGFloat {
+        max(0, bounds.width - inset.left - inset.right - padding * 2)
+    }
+
+    /// Where the placeholder sits inside the box.
+    ///
+    /// Anchored at the top, and no taller than the text it holds. `UILabel`
+    /// centres its text block vertically within its frame, while
+    /// `UITextView` lays its glyphs out from the top, so a label handed the
+    /// box's whole remaining height drew the placeholder of a four-row notes
+    /// field halfway down it — nowhere near the caret that replaced it the
+    /// moment the field was tapped (#501). The two rules only agreed when
+    /// the box was exactly one line tall, which is why single-line fields
+    /// looked right and every `textarea` did not. Given only the height its
+    /// text needs, the label has no spare height to centre within.
+    ///
+    /// Clamped to what is left of the box so that a placeholder longer than
+    /// the field stays inside it rather than drawing past the bottom.
+    static func placeholderFrame(bounds: CGRect, inset: UIEdgeInsets, padding: CGFloat, fittedHeight: CGFloat) -> CGRect {
+        let available = max(0, bounds.height - inset.top - inset.bottom)
+        return CGRect(x: inset.left + padding,
+                      y: inset.top,
+                      width: placeholderWidth(bounds: bounds, inset: inset, padding: padding),
+                      height: min(max(0, fittedHeight), available))
     }
 
     func refreshPlaceholder() {
@@ -7037,6 +7124,17 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
 
     override func viewWillDisappear(_ animated: Bool) {
         super.viewWillDisappear(animated)
+        // A screen does not take the keyboard with it. Its field is still
+        // first responder at this point, and once the view leaves the window
+        // the next screen's `window?.endEditing` no longer reaches it — the
+        // keyboard then stays up with nothing able to dismiss it until the
+        // app is backgrounded (#497). This is the one moment both facts hold:
+        // the screen is going, and its view still owns the responder.
+        //
+        // `lastFocusedInput` is deliberately left alone. A screen merely
+        // covered by a push comes back, and restoreFocus putting the person
+        // back where they were is the behaviour that was already there.
+        view.endEditing(true)
         screenVisibilityChanged(false)
         stopCelebrations(in: view)
         // Release only this screen's accessory. A retained or prepared screen
@@ -7045,7 +7143,7 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         CraftChrome.shared.releaseTabAccessory(ownedBy: self)
         // Popped (or its stack dismissed) while the bar was away: it comes
         // back for whatever shows next, a web page included.
-        if tabBarHidden, isMovingFromParent || isBeingDismissed || navigationController?.isBeingDismissed == true {
+        if tabBarHiddenApplied, isMovingFromParent || isBeingDismissed || navigationController?.isBeingDismissed == true {
             CraftChrome.shared.setHiddenByScreen(false)
         }
     }
@@ -7087,7 +7185,7 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
 
     private func restoreShellChrome() {
         guard !isAppScript else { return }
-        CraftChrome.shared.setHiddenByScreen(tabBarHidden)
+        applyTabBarHidden()
         // A screen not yet asked about the accessory (one shown for the first
         // time, before its script has run) leaves the bar as it is; one that
         // has drawn without asking for it takes off what nobody claims.
@@ -7183,6 +7281,18 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     private func disposeRuntime() {
         guard !runtimeDisposed else { return }
         runtimeDisposed = true
+        // Again here, and forgetting the input this time: a screen can be torn
+        // down without ever appearing (one prepared and then replaced), so
+        // viewWillDisappear is not guaranteed to have run. Nothing comes back
+        // from here, so there is no focus worth restoring.
+        //
+        // `viewIfLoaded`, never `view`: this also runs from `deinit`, where
+        // `view` is a `UIView!` that UIKit has already cleared — reading it
+        // traps on the implicit unwrap, and a screen that never appeared
+        // would instead have `loadView` resurrect `self` while it is being
+        // deallocated. A screen with no loaded view has nothing focused.
+        forgetFocusedInput()
+        viewIfLoaded?.endEditing(true)
         frameDelivery.close()
         storageLifetime.close()
         pendingCapabilityDeadlines.values.forEach { $0.cancel() }
@@ -7658,7 +7768,8 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     /// - `craft.secureStorage.getSync(key)`: the Keychain item the web page's
     ///   `craft.secureStorage.set` wrote.
     /// - `craft.navigation.setOptions({ title, titleColor, largeTitle, hidden,
-    ///   backTitle, tabBarHidden, tabItem, swipeBack, contentSwipeBack,
+    ///   backTitle, tabBarHidden, tabBarHiddenWhenPushed, tabItem, swipeBack,
+    ///   contentSwipeBack,
     ///   tabSwipeEnabled, backgroundColor, navigationBarSolid, leftButtons,
     ///   rightButtons, tabAccessory })`; a button's tap is the event
     ///   `navButton`. `craft.d.ts` types no navigation surface, so this list
@@ -8125,6 +8236,32 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     private var statusBarHiddenOverride: Bool?
     /// The app's tab bar away while this screen shows (`tabBarHidden`).
     private var tabBarHidden = false
+    /// The bar away only once this screen is pushed onto something
+    /// (`tabBarHiddenWhenPushed`): UIKit's `hidesBottomBarWhenPushed` idiom,
+    /// for a screen that keeps the bar as its stack's root and drops it when
+    /// it is a detail. Craft's tab bar is drawn by CraftChrome rather than a
+    /// UITabBarController, so the depth is read here and the bar is asked
+    /// directly; the Android shell has honoured the same key all along.
+    private var tabBarHiddenWhenPushed = false
+    /// What this screen last told the chrome. Teardown has to put back a bar
+    /// this screen took away, and recomputing the answer there is no good:
+    /// UIKit has already taken a popped screen out of `viewControllers` by
+    /// `viewWillDisappear`, so a bar hidden for depth would read as never
+    /// hidden at all and stay off for whatever shows next.
+    private var tabBarHiddenApplied = false
+
+    /// Whether the bar should be away for this screen as it stands now.
+    private var wantsTabBarHidden: Bool {
+        if tabBarHidden { return true }
+        guard tabBarHiddenWhenPushed, let stack = navigationController?.viewControllers else { return false }
+        guard let depth = stack.firstIndex(where: { $0 === self }) else { return false }
+        return depth > 0
+    }
+
+    private func applyTabBarHidden() {
+        tabBarHiddenApplied = wantsTabBarHidden
+        CraftChrome.shared.setHiddenByScreen(tabBarHiddenApplied)
+    }
     private var tabAccessory: [String: Any]?
     /// Whether the screen has said anything about the accessory yet
     /// (`tabAccessory`, null included): until it has, the bar keeps showing
@@ -8210,8 +8347,16 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         }
         if let hidden = options["tabBarHidden"] as? Bool {
             tabBarHidden = hidden
+        }
+        if let hiddenWhenPushed = options["tabBarHiddenWhenPushed"] as? Bool {
+            tabBarHiddenWhenPushed = hiddenWhenPushed
+        }
+        if options.keys.contains("tabBarHidden") || options.keys.contains("tabBarHiddenWhenPushed") {
+            // Prepared tabs and screens under a push keep the answer and apply
+            // it when they are shown (restoreShellChrome); only the screen on
+            // display may move the shared bar.
             if navigationController?.topViewController === self, isShownOnScreen {
-                CraftChrome.shared.setHiddenByScreen(hidden)
+                applyTabBarHidden()
             }
         }
         if let swipeBack = options["swipeBack"] as? Bool {
@@ -8324,6 +8469,22 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
 
     /// A bar button from `{ id, symbol | title }`. Its tap is the event
     /// `navButton` with `{ id }`.
+    /// A bar button's choices, or nil when it has none worth a menu.
+    static func navigationMenu(_ raw: Any?, chosen: @escaping (String) -> Void) -> UIMenu? {
+        let actions: [UIAction] = ((raw as? [[String: Any]]) ?? []).prefix(12).compactMap { choice in
+            guard let id = choice["id"] as? String, !id.isEmpty,
+                  let title = choice["title"] as? String, !title.isEmpty else { return nil }
+            var attributes: UIMenuElement.Attributes = []
+            if choice["disabled"] as? Bool == true { attributes.insert(.disabled) }
+            if choice["destructive"] as? Bool == true { attributes.insert(.destructive) }
+            let action = UIAction(title: title, image: (choice["symbol"] as? String).flatMap { UIImage(systemName: $0) },
+                                  attributes: attributes) { _ in chosen(id) }
+            action.accessibilityIdentifier = "nav-menu-\(id)"
+            return action
+        }
+        return actions.isEmpty ? nil : UIMenu(children: actions)
+    }
+
     private func navigationButton(_ spec: [String: Any]) -> UIBarButtonItem? {
         guard let id = spec["id"] as? String, !id.isEmpty else { return nil }
         let action = UIAction { [weak self] _ in
@@ -8332,11 +8493,16 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         if spec["variant"] as? String == "accent" || spec["variant"] as? String == "account" {
             return accountNavigationButton(spec, action: action)
         }
+        // `menu`: the button opens a native menu instead of sending its own
+        // id, and each choice is reported as a press of that choice's id.
+        let menu = Self.navigationMenu(spec["menu"]) { [weak self] choice in
+            self?.send(type: "EVENT", payload: ["handlerName": "navButton", "nativeEvent": ["id": choice]])
+        }
         let item: UIBarButtonItem
         if let symbol = spec["symbol"] as? String, let image = UIImage(systemName: symbol) {
-            item = UIBarButtonItem(image: image, primaryAction: action)
+            item = menu.map { UIBarButtonItem(image: image, menu: $0) } ?? UIBarButtonItem(image: image, primaryAction: action)
         } else if let title = spec["title"] as? String {
-            item = UIBarButtonItem(title: title, primaryAction: action)
+            item = menu.map { UIBarButtonItem(title: title, menu: $0) } ?? UIBarButtonItem(title: title, primaryAction: action)
         } else {
             return nil
         }
@@ -8927,14 +9093,22 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
                 ])
             }
         case "NAVIGATE", "NAVIGATE_REPLACE":
-            // A screen's own stack; the app script has none (it opens paths).
-            guard !isAppScript, navigationController?.topViewController === self,
-                  let screen = payload["screen"] as? String, !screen.isEmpty,
-                  let navigation = navigationController else { return }
+            guard let screen = payload["screen"] as? String, !screen.isEmpty else { return }
+            // Replacing a path needs no stack of its own: it asks the shell to
+            // show that path, which is why it delegates rather than pushing.
+            // The app script has no stack, so this was refused to it along
+            // with everything else, and its only way to redirect was to push
+            // sign-in on top of the screen it meant to prevent (#499). The
+            // gate in CraftHybrid.configure is the fix for launch; this is
+            // what lets a session that ends mid-run replace rather than stack.
             if type == "NAVIGATE_REPLACE", screen.hasPrefix("/") {
+                guard isAppScript || navigationController?.topViewController === self else { return }
                 hybridEvents?.nativeScreen(self, replace: screen)
                 return
             }
+            // A screen's own stack; the app script has none (it opens paths).
+            guard !isAppScript, navigationController?.topViewController === self,
+                  let navigation = navigationController else { return }
             let params = payload["params"] as? [String: Any] ?? [:]
             let next = CraftNativeScreenController(config: config, routeName: screen, routeParams: params)
             next.hybridEvents = hybridEvents
@@ -9376,7 +9550,18 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         previousNodesByProtocolID.removeAll(keepingCapacity: true)
         adoptedPreviousProtocolIDs.removeAll(keepingCapacity: true)
         indexPreviousNodes(previous)
-        let next = reconcile(document, identity: "root", path: "root", previous: previous)
+        // The app's configured body face seeds the inheritance chain, so a
+        // screen's text is branded for the same reason its chrome is. Without
+        // this the chain starts empty and `fontFamily` reached the navigation
+        // bar, the tab labels and the bar buttons — all UIAppearance proxies —
+        // while every label, button and field inside a screen stayed in the
+        // system face (#500).
+        //
+        // A node that sets its own family still wins: the fill below only
+        // applies where a node set none or `inherit`. Nil unless the app
+        // configured one, which the same guard makes free.
+        let next = reconcile(document, identity: "root", path: "root", previous: previous,
+                             inheritedFontFamily: CraftChromeFonts.body)
         previousNodesByProtocolID.removeAll(keepingCapacity: true)
         adoptedPreviousProtocolIDs.removeAll(keepingCapacity: true)
         if previous?.view !== next.view {

package/templates/CraftNativeServices.swift

@@ -324,11 +324,19 @@ final class CraftNativeSounds {
         object: nil,
         queue: .main,
     ) { note in CraftNativeSounds.handleInterruption(note) }
+    /// There is no interruption for the media server restarting, and it is
+    /// not recoverable the way an interruption is: see `handleMediaReset`.
+    private static let mediaResetObserver = NotificationCenter.default.addObserver(
+        forName: AVAudioSession.mediaServicesWereResetNotification,
+        object: nil,
+        queue: .main,
+    ) { _ in CraftNativeSounds.handleMediaReset() }
     /// `{ id, event: "ended" | "error", message? }` to the screen's script.
     var emit: (([String: Any]) -> Void)?
 
     init() {
         _ = Self.interruptionObserver
+        _ = Self.mediaResetObserver
         Self.services.add(self)
     }
 
@@ -362,6 +370,33 @@ final class CraftNativeSounds {
         }
     }
 
+    /// The media server restarted, which orphans every audio object the
+    /// process holds. Apple's requirement is to discard them and make new
+    /// ones; an orphaned `AVQueuePlayer` never plays again, never reaches the
+    /// end of its item and so never reports anything. Without this, a sound
+    /// playing across a reset left the script a handle that was silent
+    /// forever, `pause`/`resume` answering `true` about nothing, and the
+    /// session claim never released — while Android reports the equivalent
+    /// permanent loss of audio focus as an `error` event and drops the sound.
+    ///
+    /// A file player's playhead does not survive the reset, so the handle is
+    /// released and the loss reported rather than guessed at. Web Audio is
+    /// recovered instead (CraftWebAudio.swift): its graph is pure synthesis
+    /// the script is still driving, so a new engine continues it.
+    static let mediaResetMessage = "Audio stopped because the media services were reset"
+
+    /// Sound services and their playback controls are used on main.
+    private static func handleMediaReset() {
+        // The pre-reset interruption, if any, is gone with the server.
+        sessionInterrupted = false
+        for service in services.allObjects {
+            for id in Array(service.sounds.keys) {
+                service.remove(id, result: .failure(CraftNativeActionError(code: "AUDIO_ERROR", message: mediaResetMessage)))
+                service.emit?(["id": id, "event": "error", "message": mediaResetMessage])
+            }
+        }
+    }
+
     /// Starts `url`. `answer` hears once it plays (or could not be loaded).
     func play(id: String, url: URL, options: [String: Any], answer: @escaping (Result<Any, CraftNativeActionError>) -> Void) {
         stop(id: id, fadeOut: 0)

package/templates/CraftVoiceRecording.swift

@@ -15,7 +15,12 @@ extension AVAudioRecorder: CraftVoiceRecorder {}
 /// is starting, so a late permission/encoder answer cannot resurrect it.
 final class CraftVoiceRecording {
     static let shared = CraftVoiceRecording()
-    private static let fileQueue = DispatchQueue(label: "craft.voice-recording-files", qos: .utility)
+    /// Deleting a recording somebody just cancelled is work they are waiting
+    /// on: until it is gone, what they decided not to send still exists. At
+    /// `.utility` a busy device could leave the removal queued for seconds
+    /// behind everything else (it missed a two-second bound on a loaded CI
+    /// simulator while every other step of the cancellation was on time).
+    private static let fileQueue = DispatchQueue(label: "craft.voice-recording-files", qos: .userInitiated)
     private static let launchCleanup: Void = discardAbandonedRecordings(includeLegacy: false)
     private static let legacyCleanup: Void = discardAbandonedRecordings()
     private static let folderName = "voice-recordings"
@@ -106,7 +111,16 @@ final class CraftVoiceRecording {
     private let startupTimeout: TimeInterval
     private let stopTimeout: TimeInterval
     struct FileRemovalReceipt: Encodable {
+        /// From deciding to delete to the block actually running: the trace,
+        /// the submission, and the wait for a thread.
         let queueMilliseconds: Double
+        /// The first of those three alone. A run where `queueMilliseconds` is
+        /// seconds and this is near zero spent them waiting for GCD to admit
+        /// the block; one where this carries most of them spent them in
+        /// `trace`, which takes a process-wide lock and then logs
+        /// synchronously. Without it the two are indistinguishable, which is
+        /// where #490 ran out of evidence at 7638ms of queue for 3ms of work.
+        let submitMilliseconds: Double
         let removalMilliseconds: Double
         let ownedBefore: Bool
         let removed: Bool
@@ -178,12 +192,14 @@ final class CraftVoiceRecording {
             let queued = ProcessInfo.processInfo.systemUptime
             let observed = fileRemovalObserved
             Self.trace("cancel \(session.key.prefix(8)): file removal queued")
+            let submitted = ProcessInfo.processInfo.systemUptime
             Self.fileQueue.async {
                 let began = ProcessInfo.processInfo.systemUptime
                 let owned = CraftNativeFiles.owned(file.path) != nil
                 let removed = CraftNativeFiles.remove(file.path)
                 let receipt = FileRemovalReceipt(
                     queueMilliseconds: (began - queued) * 1000,
+                    submitMilliseconds: (submitted - queued) * 1000,
                     removalMilliseconds: (ProcessInfo.processInfo.systemUptime - began) * 1000,
                     ownedBefore: owned, removed: removed,
                     existsAfter: FileManager.default.fileExists(atPath: file.path))

package/templates/CraftWebAudio.swift

@@ -1361,7 +1361,12 @@ final class CraftWebAudio {
     private var engine: AVAudioEngine?
     private var claimedSession = false
     private var pump: Timer?
+    /// Notifications about the audio session and the app, registered once and
+    /// outliving any one engine.
     private var observers: [NSObjectProtocol] = []
+    /// And the one about this engine's configuration, which does not: a
+    /// rebuilt engine is a different object (`rebuildEngine`).
+    private var engineObserver: NSObjectProtocol?
     private weak var script: JSContext?
 
     init(live: Bool = true) {
@@ -1434,15 +1439,7 @@ final class CraftWebAudio {
                 contexts[id] = nil
                 return nil
             }
-            let engine = self.engine ?? makeEngine()
-            let source = AVAudioSourceNode(format: format) { silence, _, frameCount, bufferList in
-                let buffers = UnsafeMutableAudioBufferListPointer(bufferList)
-                silence.pointee = ObjCBool(graph.render(Int(frameCount), into: buffers))
-                return noErr
-            }
-            engine.attach(source)
-            engine.connect(source, to: engine.mainMixerNode, format: format)
-            context.source = source
+            attachSource(context, format: format, to: self.engine ?? makeEngine())
             refreshEngine()
         }
         startPump()
@@ -1482,25 +1479,84 @@ final class CraftWebAudio {
 
     // MARK: Engine and session
 
+    /// A context's graph reaches the engine through a source node. Attached
+    /// when the context opens, and again on a fresh engine for every live
+    /// context after the media server restarts.
+    private func attachSource(_ context: Context, format: AVAudioFormat, to engine: AVAudioEngine) {
+        let graph = context.graph
+        let source = AVAudioSourceNode(format: format) { silence, _, frameCount, bufferList in
+            let buffers = UnsafeMutableAudioBufferListPointer(bufferList)
+            silence.pointee = ObjCBool(graph.render(Int(frameCount), into: buffers))
+            return noErr
+        }
+        engine.attach(source)
+        engine.connect(source, to: engine.mainMixerNode, format: format)
+        context.source = source
+    }
+
     private func makeEngine() -> AVAudioEngine {
         let engine = AVAudioEngine()
         self.engine = engine
         let center = NotificationCenter.default
         // A route change (headphones) or an interruption (a call) stops the
-        // engine; it starts again when the context still plays.
-        observers.append(center.addObserver(forName: .AVAudioEngineConfigurationChange, object: engine, queue: .main) { [weak self] _ in
+        // engine; it starts again when the context still plays. This one is
+        // scoped to the engine, so a rebuilt engine replaces it.
+        if let engineObserver { center.removeObserver(engineObserver) }
+        engineObserver = center.addObserver(forName: .AVAudioEngineConfigurationChange, object: engine, queue: .main) { [weak self] _ in
             self?.refreshEngine()
-        })
+        }
+        // The rest are about the session and the app, not this engine.
+        guard observers.isEmpty else { return engine }
         observers.append(center.addObserver(forName: AVAudioSession.interruptionNotification, object: nil, queue: .main) { [weak self] note in
             let type = (note.userInfo?[AVAudioSessionInterruptionTypeKey] as? NSNumber)?.uintValue
             if type == AVAudioSession.InterruptionType.ended.rawValue { self?.refreshEngine() }
         })
+        observers.append(center.addObserver(forName: AVAudioSession.mediaServicesWereResetNotification, object: nil, queue: .main) { [weak self] _ in
+            self?.rebuildEngine()
+        })
         observers.append(center.addObserver(forName: UIApplication.willEnterForegroundNotification, object: nil, queue: .main) { [weak self] _ in
             self?.refreshEngine()
         })
         return engine
     }
 
+    /// The media server restarted, which orphans every audio object the
+    /// process holds — this engine and the source nodes attached to it. An
+    /// orphaned engine can be told to start and still produce no sound, and
+    /// no configuration-change notification is posted for it, so
+    /// `refreshEngine` cannot recover from this. Apple's requirement is to
+    /// discard the orphans and make new ones.
+    ///
+    /// A context does survive, because `CraftAudioGraph` is pure synthesis
+    /// holding no AVFoundation object: it is given a fresh source node on a
+    /// fresh engine and keeps playing from where its own clock is. That is
+    /// why this recovers where a file-backed sound reports the loss instead
+    /// (`CraftNativeSounds.handleMediaReset`) — a player's playhead does not
+    /// survive the reset, a synthesised graph does. Starting the new engine
+    /// reactivates the session, so the claim this screen already holds does
+    /// not need to be taken again.
+    private func rebuildEngine() {
+        guard live, let orphaned = engine else { return }
+        for context in contexts.values {
+            if let source = context.source {
+                orphaned.disconnectNodeOutput(source)
+                orphaned.detach(source)
+            }
+            context.source = nil
+        }
+        orphaned.stop()
+        if let engineObserver { NotificationCenter.default.removeObserver(engineObserver) }
+        engineObserver = nil
+        engine = nil
+        guard !contexts.isEmpty else { return }
+        let engine = makeEngine()
+        for context in contexts.values {
+            guard let format = AVAudioFormat(standardFormatWithSampleRate: context.graph.sampleRate, channels: 2) else { continue }
+            attachSource(context, format: format, to: engine)
+        }
+        refreshEngine()
+    }
+
     private func refreshEngine() {
         guard live, let engine else { return }
         let playing = contexts.values.contains { $0.running }
@@ -1522,6 +1578,8 @@ final class CraftWebAudio {
     }
 
     private func stopEngine() {
+        if let engineObserver { NotificationCenter.default.removeObserver(engineObserver) }
+        engineObserver = nil
         observers.forEach(NotificationCenter.default.removeObserver)
         observers.removeAll()
         engine?.stop()
@@ -1714,6 +1772,13 @@ final class CraftWebAudio {
     }
 
     var contextIdsForTesting: [Int] { Array(contexts.keys).sorted() }
+    /// The engine and a context's source node, so a test can see that a
+    /// media-services reset replaced them rather than restarting orphans
+    /// (`rebuildEngine`). Posting the notification cannot really orphan them,
+    /// so identity is the only observable; the clock moving afterwards is
+    /// what shows the replacements actually render.
+    var engineForTesting: AVAudioEngine? { engine }
+    func sourceForTesting(_ contextId: Int) -> AVAudioSourceNode? { contexts[contextId]?.source }
 
     // MARK: Helpers
 

package/templates/testing/DriverTests.swift.template

@@ -354,6 +354,30 @@ final class DriverTests: XCTestCase {
         lastTappedInput = input
     }
 
+    /// `target`'s frame once it has stopped moving, or its last reading at
+    /// the deadline. This only ever waits — it never taps.
+    ///
+    /// A journey that flicks the page before touching a control leaves the
+    /// scroll view decelerating, and a touch that lands on a decelerating
+    /// scroll view stops the scroll instead of reaching the control. HQ's
+    /// agreement journey does exactly that: `swipe up`, then `tapid` the
+    /// first switch, which stayed off while the second one — tapped seconds
+    /// later — turned on (#449). `scrollto` and `drag` both end with a hold
+    /// that leaves the content at rest; `swipe` is a flick and does not.
+    ///
+    /// Waiting before the one gesture is not a second gesture.
+    func settledFrame(_ target: XCUIElement, within seconds: TimeInterval = 1.0) -> CGRect {
+        var frame = target.frame
+        let deadline = Date().addingTimeInterval(seconds)
+        while Date() < deadline {
+            Thread.sleep(forTimeInterval: 0.1)
+            let next = target.frame
+            if next.equalTo(frame) { return frame }
+            frame = next
+        }
+        return frame
+    }
+
     func answerOpenPrompt() {
         // A direct app link has already arrived. Querying an invisible
         // SpringBoard here can stall its accessibility snapshot on iOS 27.
@@ -517,7 +541,7 @@ final class DriverTests: XCTestCase {
                 // renderer or hit-testing failure (HQ agreement job 7570).
                 let before = target.value as? String
                 let enabledBefore = target.isEnabled
-                let frameBefore = target.frame
+                let frameBefore = settledFrame(target)
                 press(target)
                 let settle = Date().addingTimeInterval(1.5)
                 var flipped = false
@@ -525,11 +549,17 @@ final class DriverTests: XCTestCase {
                     flipped = switchFlipped(from: before, to: target.value as? String)
                     if !flipped { Thread.sleep(forTimeInterval: 0.25) }
                 } while !flipped && Date() < settle
+                let frameAfter = target.frame
                 let observation: [String: Any] = [
                     "id": arg, "gestures": 1, "flipped": flipped,
                     "enabledBefore": enabledBefore, "enabledAfter": target.isEnabled,
                     "valueBefore": before ?? "unknown", "valueAfter": target.value as? String ?? "unknown",
                     "frameBefore": [frameBefore.origin.x, frameBefore.origin.y, frameBefore.width, frameBefore.height],
+                    // Without this a control that was still moving when it
+                    // was tapped looks exactly like one that sat still and
+                    // ignored the tap, which is where #449 ran out of
+                    // evidence.
+                    "frameAfter": [frameAfter.origin.x, frameAfter.origin.y, frameAfter.width, frameAfter.height],
                 ]
                 lastBooleanTap = observation
                 if let data = try? JSONSerialization.data(withJSONObject: observation, options: [.sortedKeys]),