@craft-native/ios 0.0.91 → 0.0.94

package/templates/CraftApp.swift

@@ -34,7 +34,42 @@ import ActivityKit
 extension Notification.Name {
     static let craftPushToken = Notification.Name("craftPushToken")
     static let craftPushRegistrationError = Notification.Name("craftPushRegistrationError")
-    static let craftNotificationResponse = Notification.Name("craftNotificationResponse")
+}
+
+/// Which failed page loads mean the remote origin is out of reach (#252).
+///
+/// That is the only failure the bundled copy stands in for. Anything else
+/// either is not a failure at all or is one the bundle would hide: a TLS error
+/// or a bad response means the server *was* reached, and swapping in a local
+/// copy would bury a real fault under a page that half-works.
+///
+/// Written against NSError's domain and code rather than WebKit's types, so it
+/// compiles with Foundation alone — which is how `compile-templates` runs it on
+/// its own, on the CI host, rather than only reading its text.
+enum CraftLoadFailure {
+    static func isUnreachable(_ error: Error) -> Bool {
+        let error = error as NSError
+        // Everything outside NSURLErrorDomain is excluded, WebKit's own
+        // frame-load-interrupted (WebKitErrorDomain 102) among them: a load
+        // replaced by a newer one is not a load that failed.
+        guard error.domain == NSURLErrorDomain else { return false }
+        switch error.code {
+        case NSURLErrorNotConnectedToInternet,
+             NSURLErrorCannotFindHost,
+             NSURLErrorCannotConnectToHost,
+             NSURLErrorTimedOut,
+             NSURLErrorNetworkConnectionLost,
+             NSURLErrorDNSLookupFailed,
+             NSURLErrorDataNotAllowed,
+             NSURLErrorInternationalRoamingOff:
+            return true
+        default:
+            // NSURLErrorCancelled (-999) lands here. WebKit reports it for two
+            // quick taps, a redirect, or a `location.assign` while a load is in
+            // flight — and it used to end the session on the bundled copy.
+            return false
+        }
+    }
 }
 
 final class CraftAppDelegate: NSObject, UIApplicationDelegate, UNUserNotificationCenterDelegate {
@@ -68,11 +103,23 @@ final class CraftAppDelegate: NSObject, UIApplicationDelegate, UNUserNotificatio
     }
 
     func userNotificationCenter(_ center: UNUserNotificationCenter, didReceive response: UNNotificationResponse, withCompletionHandler completionHandler: @escaping () -> Void) {
-        NotificationCenter.default.post(name: .craftNotificationResponse, object: response.notification.request.content.userInfo)
+        // Through the manager, not NotificationCenter. A tap that launches a
+        // killed app arrives here before SwiftUI has built the Coordinator, and
+        // NotificationCenter keeps nothing for an observer that does not exist
+        // yet — so the tap was dropped, and the page opened wherever it opens
+        // rather than where the notification pointed. The manager exists from
+        // process start and holds the tap until the page is ready, the way it
+        // already does for a home-screen shortcut.
+        CraftEventManager.shared.handleNotificationResponse(response.notification.request.content.userInfo)
         completionHandler()
     }
 
     func userNotificationCenter(_ center: UNUserNotificationCenter, willPresent notification: UNNotification, withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void) {
+        // Told to the page as well as shown. A page that is open when a push
+        // lands used to hear about it only if someone tapped the banner, so it
+        // could not refresh what the push was about while it was on screen.
+        // The banner still shows: the page is told, not asked.
+        CraftEventManager.shared.handleNotificationReceived(notification.request.content.userInfo)
         completionHandler([.banner, .badge, .sound])
     }
 }
@@ -108,6 +155,30 @@ class CraftEventManager {
         sendToWeb("craftShortcut", data: ["type": shortcut.type])
     }
 
+    /// A tap on a notification, carrying the payload it was sent with.
+    ///
+    /// Keys that are not strings are dropped rather than failing the whole
+    /// event: an APNs payload's keys always are, and the page could not index
+    /// by anything else anyway.
+    func handleNotificationResponse(_ userInfo: [AnyHashable: Any]) {
+        sendToWeb("craftNotificationResponse", data: Self.pageData(userInfo))
+    }
+
+    /// A notification that arrived while the app was in front, in the same
+    /// shape as a tap so one handler can read both.
+    func handleNotificationReceived(_ userInfo: [AnyHashable: Any]) {
+        sendToWeb("craftNotificationReceived", data: Self.pageData(userInfo))
+    }
+
+    private static func pageData(_ userInfo: [AnyHashable: Any]) -> [String: Any] {
+        var data: [String: Any] = [:]
+        for (key, value) in userInfo {
+            guard let key = key as? String else { continue }
+            data[key] = value
+        }
+        return data
+    }
+
     func handleSiriActivity(_ activity: NSUserActivity) -> Bool {
         let prefix = "\(Bundle.main.bundleIdentifier ?? "{{BUNDLE_ID}}")."
         guard activity.activityType.hasPrefix(prefix) else { return false }
@@ -172,9 +243,16 @@ class DeepLinkManager {
     static let shared = DeepLinkManager()
 
     private var initialURL: URL?
-    private var pendingURL: URL?
+    // Every link that arrived while no page could receive it, in order. This
+    // was a single slot, so a second link before the bridge was ready replaced
+    // the first; on a cold start, that could be the link that launched the app.
+    private var pendingURLs: [URL] = []
     private weak var webView: WKWebView?
     private var isReady = false
+    // Whether a page has ever become ready. A link that arrives before that is
+    // the one the app was opened with; a link that arrives later is not, and
+    // is no answer to getInitialURL.
+    private var hasBeenReady = false
 
     private init() {}
 
@@ -182,26 +260,33 @@ class DeepLinkManager {
         self.webView = webView
     }
 
+    // A navigation started, so the page that would have received a link is
+    // going away. Without this a link arriving during a reload was dispatched
+    // into the page being torn down and lost.
+    func setLoading() {
+        isReady = false
+    }
+
     func setReady() {
         isReady = true
-        // If there's a pending URL, dispatch it now
-        if let url = pendingURL {
-            dispatchDeepLink(url)
-            pendingURL = nil
+        let firstPage = !hasBeenReady
+        hasBeenReady = true
+        let urls = pendingURLs
+        pendingURLs.removeAll()
+        for url in urls {
+            dispatchDeepLink(url, initial: firstPage && url == initialURL)
         }
     }
 
     func handleURL(_ url: URL) {
-        // Store as initial URL if this is the first one
-        if initialURL == nil {
+        if initialURL == nil && !hasBeenReady {
             initialURL = url
         }
 
         if isReady && webView != nil {
-            dispatchDeepLink(url)
+            dispatchDeepLink(url, initial: false)
         } else {
-            // Store for later when web view is ready
-            pendingURL = url
+            pendingURLs.append(url)
         }
     }
 
@@ -209,7 +294,7 @@ class DeepLinkManager {
         return initialURL
     }
 
-    private func dispatchDeepLink(_ url: URL) {
+    private func dispatchDeepLink(_ url: URL, initial: Bool) {
         guard let webView = webView else { return }
 
         // Parse URL components
@@ -218,7 +303,10 @@ class DeepLinkManager {
             "scheme": url.scheme ?? "",
             "host": url.host ?? "",
             "path": url.path,
-            "query": url.query ?? ""
+            "query": url.query ?? "",
+            // Lets the page tell the launch link apart from later ones, so a
+            // page that reads getInitialURL is not also handed it again.
+            "initial": initial
         ]
 
         // Parse query parameters
@@ -478,6 +566,21 @@ struct CraftWebView: UIViewRepresentable {
         private var pendingPushCallbackId: String?
         private var loadedBundledFallback = false
 
+        /// The highest `cb_<n>` this process has seen the page hand out.
+        ///
+        /// The page's own counter restarts at 0 on every injection, which is
+        /// every reload, navigation and web-content crash recovery, and
+        /// nothing native records which load a call came from. So an answer
+        /// to a call made before a reload was delivered to whichever call on
+        /// the new page drew the same number: `getDeviceInfo` settled with a
+        /// Siri result, or rejected with the earlier call's TIMEOUT (#226).
+        ///
+        /// Seeding each injection above everything already handed out makes
+        /// an id unique for the life of the process. A late answer then names
+        /// a callback no page has, and is dropped where it lands — on either
+        /// runtime, and without native having to track page loads at all.
+        private var highestCallbackId = 0
+
         // Location
         private var locationManager: CLLocationManager?
         private var singleLocationCallbackId: String?
@@ -567,7 +670,7 @@ struct CraftWebView: UIViewRepresentable {
             }
             NotificationCenter.default.addObserver(self, selector: #selector(receivePushToken(_:)), name: .craftPushToken, object: nil)
             NotificationCenter.default.addObserver(self, selector: #selector(receivePushRegistrationError(_:)), name: .craftPushRegistrationError, object: nil)
-            NotificationCenter.default.addObserver(self, selector: #selector(receiveNotificationResponse(_:)), name: .craftNotificationResponse, object: nil)
+            NotificationCenter.default.addObserver(self, selector: #selector(appWillEnterForeground(_:)), name: UIApplication.willEnterForegroundNotification, object: nil)
             setupNetworkMonitoring()
         }
 
@@ -590,6 +693,9 @@ struct CraftWebView: UIViewRepresentable {
         private func setupNetworkMonitoring() {
             networkMonitor = NWPathMonitor()
             networkMonitor?.pathUpdateHandler = { [weak self] path in
+                // Read before it is overwritten: the retry below wants the
+                // transition, not the state.
+                let wasConnected = self?.isConnected ?? true
                 self?.isConnected = path.status == .satisfied
                 if path.usesInterfaceType(.wifi) {
                     self?.connectionType = "wifi"
@@ -604,6 +710,16 @@ struct CraftWebView: UIViewRepresentable {
                     "isConnected": self?.isConnected ?? false,
                     "type": self?.connectionType ?? "unknown"
                 ])
+                // Only on false → true. Retrying whenever the path is merely
+                // satisfied would loop: a server that is down on a network
+                // that is up leaves the path satisfied throughout, so every
+                // update would retry, fail, fall back and retry again. That
+                // case recovers on the next foreground instead.
+                if !wasConnected, self?.isConnected == true {
+                    DispatchQueue.main.async {
+                        self?.returnFromBundledFallback(because: "the network came back")
+                    }
+                }
             }
             networkMonitor?.start(queue: DispatchQueue.global())
         }
@@ -618,6 +734,9 @@ struct CraftWebView: UIViewRepresentable {
                   let action = body["action"] as? String else { return }
 
             let callbackId = body["callbackId"] as? String
+            // Before Zig is offered the call, because the seed has to cover
+            // every id the page drew, not only the ones Swift went on to serve.
+            noteCallbackId(callbackId)
 
             // The Zig runtime first, when there is one.
             //
@@ -650,16 +769,23 @@ struct CraftWebView: UIViewRepresentable {
             switch action {
             case "startListening":
                 if config.enableSpeechRecognition {
+                    // Answers that the request was taken. Authorization and the
+                    // recognizer answer later, as craftSpeech* events; waiting
+                    // for them here would leave the promise open on every path
+                    // that ends without one.
                     startSpeechRecognition()
+                    resolveCallback(callbackId, result: true)
                 } else {
                     rejectCallback(callbackId, error: "Speech recognition is disabled", code: "CAPABILITY_DISABLED")
                 }
             case "stopListening":
                 stopSpeechRecognition()
+                resolveCallback(callbackId, result: true)
             case "haptic":
                 if config.enableHaptics {
                     let style = body["style"] as? String ?? "medium"
                     triggerHaptic(style: style)
+                    resolveCallback(callbackId, result: true)
                 } else {
                     rejectCallback(callbackId, error: "Haptics is disabled", code: "CAPABILITY_DISABLED")
                 }
@@ -821,6 +947,8 @@ struct CraftWebView: UIViewRepresentable {
             case "setBadge":
                 if let count = body["count"] as? Int {
                     setBadgeCount(count, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "setBadge needs a whole number of badges", code: "INVALID_ARGUMENT")
                 }
             case "clearBadge":
                 setBadgeCount(0, callbackId: callbackId)
@@ -835,6 +963,8 @@ struct CraftWebView: UIViewRepresentable {
             case "setFlashlight":
                 if let enabled = body["enabled"] as? Bool {
                     setFlashlight(enabled: enabled, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "setFlashlight needs true or false", code: "INVALID_ARGUMENT")
                 }
             // Vibrate pattern
             case "vibrate":
@@ -849,6 +979,8 @@ struct CraftWebView: UIViewRepresentable {
                 if let urlString = body["url"] as? String, let url = URL(string: urlString) {
                     UIApplication.shared.open(url)
                     resolveCallback(callbackId, result: true)
+                } else {
+                    rejectCallback(callbackId, error: "openURL needs a URL it can parse", code: "INVALID_ARGUMENT")
                 }
             // App state
             case "getAppState":
@@ -1256,6 +1388,8 @@ struct CraftWebView: UIViewRepresentable {
             case "setShortcuts":
                 if let shortcuts = body["shortcuts"] as? [[String: Any]] {
                     setAppShortcuts(shortcuts: shortcuts, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "setShortcuts needs a list of shortcuts", code: "INVALID_ARGUMENT")
                 }
             case "clearShortcuts":
                 clearAppShortcuts(callbackId: callbackId)
@@ -1266,16 +1400,22 @@ struct CraftWebView: UIViewRepresentable {
                    let value = body["value"] as? String {
                     let group = body["group"] as? String
                     setSharedKeychainItem(key: key, value: value, group: group, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "setSharedItem needs both a key and a value", code: "INVALID_ARGUMENT")
                 }
             case "getSharedItem":
                 if let key = body["key"] as? String {
                     let group = body["group"] as? String
                     getSharedKeychainItem(key: key, group: group, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "getSharedItem needs a key", code: "INVALID_ARGUMENT")
                 }
             case "removeSharedItem":
                 if let key = body["key"] as? String {
                     let group = body["group"] as? String
                     removeSharedKeychainItem(key: key, group: group, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "removeSharedItem needs a key", code: "INVALID_ARGUMENT")
                 }
 
             // MARK: - Local Auth Persistence
@@ -1283,6 +1423,8 @@ struct CraftWebView: UIViewRepresentable {
                 if let enabled = body["enabled"] as? Bool {
                     let duration = body["duration"] as? Double ?? 300 // 5 min default
                     setBiometricPersistence(enabled: enabled, duration: duration, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "setBiometricPersistence needs true or false", code: "INVALID_ARGUMENT")
                 }
             case "checkBiometricPersistence":
                 checkBiometricPersistence(callbackId: callbackId)
@@ -1366,6 +1508,8 @@ struct CraftWebView: UIViewRepresentable {
             case "updateWidget":
                 if let data = body["data"] as? [String: Any] {
                     updateWidget(data: data, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "updateWidget needs a data object", code: "INVALID_ARGUMENT")
                 }
             case "reloadWidgets":
                 reloadAllWidgets(callbackId: callbackId)
@@ -1375,20 +1519,28 @@ struct CraftWebView: UIViewRepresentable {
                 if let phrase = body["phrase"] as? String,
                    let action = body["shortcutAction"] as? String {
                     registerSiriShortcut(phrase: phrase, action: action, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "registerSiriShortcut needs both a phrase and a shortcutAction", code: "INVALID_ARGUMENT")
                 }
             case "removeSiriShortcut":
                 if let action = body["shortcutAction"] as? String {
                     removeSiriShortcut(action: action, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "removeSiriShortcut needs a shortcutAction", code: "INVALID_ARGUMENT")
                 }
 
             // MARK: - Watch Connectivity
             case "sendToWatch":
                 if let message = body["message"] as? [String: Any] {
                     sendMessageToWatch(message: message, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "sendToWatch needs a message object", code: "INVALID_ARGUMENT")
                 }
             case "updateWatchContext":
                 if let context = body["context"] as? [String: Any] {
                     updateWatchContext(context: context, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "updateWatchContext needs a context object", code: "INVALID_ARGUMENT")
                 }
             case "isWatchReachable":
                 isWatchReachable(callbackId: callbackId)
@@ -1400,6 +1552,7 @@ struct CraftWebView: UIViewRepresentable {
 
         func webView(_ webView: WKWebView, didStartProvisionalNavigation navigation: WKNavigation!) {
             CraftEventManager.shared.setLoading()
+            DeepLinkManager.shared.setLoading()
         }
 
         func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
@@ -1428,10 +1581,17 @@ struct CraftWebView: UIViewRepresentable {
         }
 
         func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) {
-            loadBundledFallback(in: webView)
+            fallBackIfUnreachable(webView, after: error)
         }
 
         func webView(_ webView: WKWebView, didFail navigation: WKNavigation!, withError error: Error) {
+            fallBackIfUnreachable(webView, after: error)
+        }
+
+        /// Both used to fall back on *any* error, -999 included, so a second
+        /// tap before the first page committed ended the session on the bundle.
+        private func fallBackIfUnreachable(_ webView: WKWebView, after error: Error) {
+            guard CraftLoadFailure.isUnreachable(error) else { return }
             loadBundledFallback(in: webView)
         }
 
@@ -1440,16 +1600,60 @@ struct CraftWebView: UIViewRepresentable {
                   config.devServerURL != nil,
                   let bundledURL = URL(string: "craft://app/index.html") else { return }
             loadedBundledFallback = true
+            // Kept for the way back: `returnFromBundledFallback` has no view of
+            // its own to reload.
+            self.webView = webView
             webView.load(URLRequest(url: bundledURL))
         }
 
+        /// Leave the bundled copy for the remote origin again (#252).
+        ///
+        /// It used to be one-way for the life of the process, and the bundle
+        /// cannot reach a frontend's API by relative path — so one dropped
+        /// connection meant no API until the app was killed.
+        ///
+        /// Called when connectivity comes back and when the app returns to the
+        /// foreground, never on every path update. If the remote is still out
+        /// of reach, the load fails with a connectivity error and falls back
+        /// again: one round trip per trigger, not a loop.
+        private func returnFromBundledFallback(because reason: String) {
+            guard loadedBundledFallback,
+                  let webView,
+                  let remote = config.devServerURL.flatMap(URL.init(string:)) else { return }
+            loadedBundledFallback = false
+            print("Craft: \(reason); loading \(remote) again instead of the bundled copy")
+            webView.load(URLRequest(url: remote))
+        }
+
+        @objc private func appWillEnterForeground(_ notification: Notification) {
+            returnFromBundledFallback(because: "the app returned to the foreground")
+        }
+
         private func isTrustedURL(_ url: URL?) -> Bool {
             guard let url = url else { return false }
-            if url.scheme == "craft" && url.host == "app" { return true }
             return isTrustedOrigin(scheme: url.scheme ?? "", host: url.host ?? "", port: url.port ?? 0)
         }
 
+        /// The single answer to "may this origin reach native?".
+        ///
+        /// The bundled app is served from craft://app by
+        /// `BundledAssetSchemeHandler`, and it is the only content a generated
+        /// app loads when no dev server is configured. That origin used to be
+        /// trusted for *navigation* only: `isTrustedURL` carried the clause,
+        /// while the `userContentController` guard called this function
+        /// directly and fell through to the https/localhost check. So every
+        /// bridge call from the app's own page was answered with
+        ///
+        ///     Blocked Craft bridge message from untrusted origin: craft://app
+        ///
+        /// and its promise never settled — the whole native surface was dead
+        /// in the default configuration, which is the one every generated app
+        /// ships with. Two guards that had to agree, and did not. There is one
+        /// now, and `scripts/mobile-e2e.ts` runs a real round trip on a booted
+        /// simulator so a future hardening pass cannot quietly take the bridge
+        /// away again.
         private func isTrustedOrigin(scheme: String, host: String, port: Int) -> Bool {
+            if scheme == "craft" && host == "app" { return true }
             if scheme == "file" { return true }
             guard scheme == "https" || (scheme == "http" && ["localhost", "127.0.0.1", "::1"].contains(host)) else { return false }
             let defaultPort = scheme == "https" ? 443 : 80
@@ -1466,6 +1670,16 @@ struct CraftWebView: UIViewRepresentable {
             return allowed.contains(origin)
         }
 
+        /// Raise the seed to cover an id the page has just used.
+        ///
+        /// Every call the page makes arrives here first, including the ones
+        /// Zig serves, so this sees the whole range a load hands out.
+        private func noteCallbackId(_ callbackId: String?) {
+            guard let callbackId, callbackId.hasPrefix("cb_"),
+                  let drawn = Int(callbackId.dropFirst(3)) else { return }
+            if drawn > highestCallbackId { highestCallbackId = drawn }
+        }
+
         private func injectNativeBridge() {
             let laContext = LAContext()
             var biometricAvailable = false
@@ -1505,7 +1719,9 @@ struct CraftWebView: UIViewRepresentable {
                 },
 
                 _callbacks: {},
-                _callbackId: 0,
+                // Not 0: an id must not repeat one an earlier load of this
+                // page is still waiting on an answer for (#226).
+                _callbackId: \(highestCallbackId),
 
                 _createCallback: function() {
                     var id = 'cb_' + (++this._callbackId);
@@ -1909,10 +2125,10 @@ struct CraftWebView: UIViewRepresentable {
                     return this.geolocation.getCurrentPosition({});
                 },
                 watchPosition: function(callback) {
-                    return this.geolocation.watchPosition(callback);
+                    return this.location.watchPosition(callback);
                 },
                 clearWatch: function(watchId) {
-                    return this.geolocation.clearWatch(watchId);
+                    return this.location.clearWatch(watchId);
                 },
                 getContacts: function() {
                     return this._invoke('getContacts');
@@ -1977,20 +2193,62 @@ struct CraftWebView: UIViewRepresentable {
                     return Promise.reject(new Error('Android fitness APIs are unavailable on iOS'));
                 },
 
+                // Resolves true once UIKit has taken the haptic, and rejects
+                // CAPABILITY_DISABLED when enableHaptics is off.
                 haptic: function(style) {
-                    window.webkit.messageHandlers.craft.postMessage({action: 'haptic', style: style || 'medium'});
+                    var self = window.craft;
+                    var id = 'cb_' + (++self._callbackId);
+                    window.webkit.messageHandlers.craft.postMessage({action: 'haptic', style: style || 'medium', callbackId: id});
+                    return new Promise(function(resolve, reject) {
+                        self._callbacks[id] = {resolve: resolve, reject: reject};
+                    });
                 },
 
+                // Resolves true once native has taken the request, not once
+                // audio is flowing. What happens next (a prompt declined, no
+                // recognizer, a transcript) still arrives as craftSpeech*
+                // events, because none of it is known when this answers.
                 startListening: function() {
-                    window.webkit.messageHandlers.craft.postMessage({action: 'startListening'});
+                    var self = window.craft;
+                    var id = 'cb_' + (++self._callbackId);
+                    window.webkit.messageHandlers.craft.postMessage({action: 'startListening', callbackId: id});
+                    return new Promise(function(resolve, reject) {
+                        self._callbacks[id] = {resolve: resolve, reject: reject};
+                    });
                 },
 
                 stopListening: function() {
-                    window.webkit.messageHandlers.craft.postMessage({action: 'stopListening'});
+                    var self = window.craft;
+                    var id = 'cb_' + (++self._callbackId);
+                    window.webkit.messageHandlers.craft.postMessage({action: 'stopListening', callbackId: id});
+                    return new Promise(function(resolve, reject) {
+                        self._callbacks[id] = {resolve: resolve, reject: reject};
+                    });
                 },
 
                 share: function(text) {
-                    window.webkit.messageHandlers.craft.postMessage({action: 'share', text: text});
+                    return this._share({text: text});
+                },
+
+                // Both share entry points come through here, because the
+                // native side answers them the same way: `true` when the
+                // person finished an activity, `false` when they dismissed
+                // the sheet, a rejection when sharing is disabled or there is
+                // nothing to share. The flat `share` used to post with no
+                // callbackId, so every one of those answers stopped at the nil
+                // guard in resolveCallback and the page got `undefined`.
+                //
+                // No timeout, unlike `_invoke`'s thirty seconds. The sheet
+                // waits on a person, and someone slower than that to pick an
+                // app would be told the share failed while it was still on
+                // screen, with the real answer then dropped.
+                _share: function(payload) {
+                    var self = this;
+                    var id = 'cb_' + (++this._callbackId);
+                    window.webkit.messageHandlers.craft.postMessage(Object.assign({}, payload, {action: 'share', callbackId: id}));
+                    return new Promise(function(resolve, reject) {
+                        self._callbacks[id] = {resolve: resolve, reject: reject};
+                    });
                 },
 
                 openCamera: function() {
@@ -2112,12 +2370,25 @@ struct CraftWebView: UIViewRepresentable {
                             }
                         });
                     },
+                    // Resolves true once updates have started, before any
+                    // authorization answer. A later refusal arrives as a
+                    // craftLocationError event.
                     watchPosition: function(callback) {
+                        var self = window.craft;
+                        var id = 'cb_' + (++self._callbackId);
                         window.addEventListener('craftLocationUpdate', function(e) { callback(e.detail); });
-                        window.webkit.messageHandlers.craft.postMessage({action: 'watchPosition'});
+                        window.webkit.messageHandlers.craft.postMessage({action: 'watchPosition', callbackId: id});
+                        return new Promise(function(resolve, reject) {
+                            self._callbacks[id] = {resolve: resolve, reject: reject};
+                        });
                     },
                     clearWatch: function() {
-                        window.webkit.messageHandlers.craft.postMessage({action: 'clearWatch'});
+                        var self = window.craft;
+                        var id = 'cb_' + (++self._callbackId);
+                        window.webkit.messageHandlers.craft.postMessage({action: 'clearWatch', callbackId: id});
+                        return new Promise(function(resolve, reject) {
+                            self._callbacks[id] = {resolve: resolve, reject: reject};
+                        });
                     }
                 },
 
@@ -2217,7 +2488,12 @@ struct CraftWebView: UIViewRepresentable {
 
                 // Vibrate
                 vibrate: function(pattern) {
-                    window.webkit.messageHandlers.craft.postMessage({action: 'vibrate', pattern: pattern});
+                    var self = window.craft;
+                    var id = 'cb_' + (++self._callbackId);
+                    window.webkit.messageHandlers.craft.postMessage({action: 'vibrate', pattern: pattern, callbackId: id});
+                    return new Promise(function(resolve, reject) {
+                        self._callbacks[id] = {resolve: resolve, reject: reject};
+                    });
                 },
 
                 // Open URL
@@ -2394,7 +2670,7 @@ struct CraftWebView: UIViewRepresentable {
 
                 // Deep Links
                 onDeepLink: function(callback) {
-                    window.addEventListener('craftDeepLink', function(e) { callback(e.detail); });
+                    return window.craft._subscribeDeepLinks(callback);
                 },
 
                 // Background Tasks
@@ -2722,6 +2998,7 @@ struct CraftWebView: UIViewRepresentable {
                 deepLinks: {
                     getInitialURL: function() {
                         var self = window.craft;
+                        self._claimInitialDeepLink();
                         var id = 'cb_' + (++self._callbackId);
                         window.webkit.messageHandlers.craft.postMessage({action: 'getInitialURL', callbackId: id});
                         return new Promise(function(resolve, reject) {
@@ -2729,7 +3006,7 @@ struct CraftWebView: UIViewRepresentable {
                         });
                     },
                     onLink: function(callback) {
-                        window.addEventListener('craftDeepLink', function(e) { callback(e.detail); });
+                        return window.craft._subscribeDeepLinks(callback);
                     }
                 },
 
@@ -2792,6 +3069,115 @@ struct CraftWebView: UIViewRepresentable {
             // Stable, versioned mobile contract consumed by craft-native/mobile.
             // Legacy flat methods remain available while every public SDK method
             // is routed through this nested contract.
+            // Links that arrive before anything is listening (#198).
+            //
+            // The native side dispatches a link the moment this script has
+            // run, and on a cold start that is the link the app was opened
+            // with. No page code can have called onLink by then: onLink is
+            // defined by this very script. So every such link was dispatched
+            // to nobody, and a page that subscribes, rather than asking
+            // getInitialURL, never learned how it was opened.
+            //
+            // Held here instead, and handed to the first subscriber on the
+            // next turn, so an unsubscribe returned in the same tick still
+            // applies. The launch link belongs to getInitialURL once the page
+            // has called it, whether native has dispatched it yet or not, so a
+            // page that does both in the same tick, in either order, gets it
+            // once. That includes a craftReady handler, which runs before
+            // native dispatches anything. A page that asks getInitialURL only
+            // later, after an await, should skip `initial` in onLink.
+            //
+            // The same block runs on Android (#215), where this script can run
+            // twice in one document, so its state lives on window.
+            (function installDeepLinkReplay(craft) {
+                var replay = window.__craftDeepLinkReplay;
+                if (!replay) {
+                    replay = window.__craftDeepLinkReplay = {undelivered: [], subscribed: false, initialClaimed: false};
+                    window.addEventListener('craftDeepLink', function(e) {
+                        if (!replay.subscribed && !claimed(e.detail)) replay.undelivered.push(e.detail);
+                    });
+                }
+                function claimed(detail) {
+                    return replay.initialClaimed && detail && detail.initial;
+                }
+                craft._subscribeDeepLinks = function(callback) {
+                    var active = true;
+                    var listener = function(e) { if (!claimed(e.detail)) callback(e.detail); };
+                    window.addEventListener('craftDeepLink', listener);
+                    if (!replay.subscribed) {
+                        replay.subscribed = true;
+                        setTimeout(function() {
+                            var pending = replay.undelivered;
+                            replay.undelivered = [];
+                            if (!active) return;
+                            pending.forEach(function(detail) { callback(detail); });
+                        }, 0);
+                    }
+                    return function() {
+                        active = false;
+                        window.removeEventListener('craftDeepLink', listener);
+                    };
+                };
+                craft._claimInitialDeepLink = function() {
+                    replay.initialClaimed = true;
+                    replay.undelivered = replay.undelivered.filter(function(detail) { return !(detail && detail.initial); });
+                };
+            })(window.craft);
+
+            // A notification tap that arrived before anything subscribed.
+            //
+            // On a cold launch the tap is flushed the moment the bridge is
+            // ready, and a page that wires its listener once its router has
+            // hydrated — which is most single-page apps — was not listening
+            // yet, so "open the thing this notification is about" opened the
+            // home screen instead. Deep links hit the same wall (#198) and
+            // are held the same way: state on window, so a second injection
+            // into the same page does not start a fresh buffer, and the first
+            // subscriber is handed whatever it missed.
+            (function installNotificationTapReplay(craft) {
+                var replay = window.__craftNotificationTapReplay;
+                if (!replay) {
+                    replay = window.__craftNotificationTapReplay = {undelivered: [], subscribed: false};
+                    window.addEventListener('craftNotificationResponse', function(e) {
+                        if (!replay.subscribed) replay.undelivered.push(e.detail);
+                    });
+                }
+                craft._subscribeNotificationTaps = function(callback) {
+                    var active = true;
+                    var listener = function(e) { callback(e.detail); };
+                    window.addEventListener('craftNotificationResponse', listener);
+                    if (!replay.subscribed) {
+                        replay.subscribed = true;
+                        setTimeout(function() {
+                            var pending = replay.undelivered;
+                            replay.undelivered = [];
+                            if (!active) return;
+                            pending.forEach(function(detail) { callback(detail); });
+                        }, 0);
+                    }
+                    return function() {
+                        active = false;
+                        window.removeEventListener('craftNotificationResponse', listener);
+                    };
+                };
+                if (craft.notifications) {
+                    craft.notifications.onTap = function(callback) {
+                        return craft._subscribeNotificationTaps(callback);
+                    };
+                    // A notification that arrived while the page was open.
+                    // Live only, with nothing held: it matters to a page that
+                    // is running, and one that subscribes later has no use for
+                    // an arrival it was not there to see.
+                    craft.notifications.onReceive = function(callback) {
+                        var listener = function(e) { callback(e.detail); };
+                        window.addEventListener('craftNotificationReceived', listener);
+                        return function() {
+                            window.removeEventListener('craftNotificationReceived', listener);
+                        };
+                    };
+                }
+            })(window.craft);
+
             (function installCraftMobileContract(craft) {
                 var legacyShare = craft.share.bind(craft);
                 var legacyOpenCamera = craft.openCamera.bind(craft);
@@ -2823,14 +3209,25 @@ struct CraftWebView: UIViewRepresentable {
                     getInfo: function() { return craft.getDeviceInfo(); },
                     getCapabilities: function() { return Promise.resolve(Object.assign({}, craft.capabilities)); }
                 };
+                // Feedback, as on Android and the web, where there is no
+                // motor to fire: an app that left enableHaptics off gets
+                // nothing played and a settled promise, so `await
+                // haptics.selection()` in the middle of a flow does not stop
+                // the flow. A native failure still rejects, and
+                // craft.haptic() itself reports the refusal.
+                function hapticFeedback(answer) {
+                    return answer.then(function() {}, function(error) {
+                        if (error && error.code === 'CAPABILITY_DISABLED') return;
+                        throw error;
+                    });
+                }
                 craft.haptics = {
-                    impact: function(style) { craft.haptic(style || 'medium'); return Promise.resolve(); },
+                    impact: function(style) { return hapticFeedback(craft.haptic(style || 'medium')); },
                     notification: function(type) {
-                        craft.haptic(type === 'error' ? 'heavy' : type === 'warning' ? 'medium' : 'light');
-                        return Promise.resolve();
+                        return hapticFeedback(craft.haptic(type === 'error' ? 'heavy' : type === 'warning' ? 'medium' : 'light'));
                     },
-                    selection: function() { craft.haptic('soft'); return Promise.resolve(); },
-                    vibrate: function(pattern) { craft.vibrate(pattern || []); return Promise.resolve(); }
+                    selection: function() { return hapticFeedback(craft.haptic('soft')); },
+                    vibrate: function(pattern) { return hapticFeedback(craft.vibrate(pattern || [])); }
                 };
                 craft.permissions = {
                     check: function(permission) { return craft._invoke('checkPermission', {permission: permission}); },
@@ -2856,23 +3253,80 @@ struct CraftWebView: UIViewRepresentable {
                 };
 
                 var locationWatchCallbacks = new Map();
+                var legacyLocationWatchCallbacks = [];
                 var nextLocationWatchId = 0;
+                var locationWatchStarted = false;
+                var locationWatchStart = null;
+                var locationWatchGeneration = 0;
+
+                function hasLocationWatchers() {
+                    return locationWatchCallbacks.size > 0 || legacyLocationWatchCallbacks.length > 0;
+                }
+
+                function startLocationWatch() {
+                    if (locationWatchStarted) return Promise.resolve(true);
+                    if (locationWatchStart) return locationWatchStart;
+
+                    var generation = locationWatchGeneration;
+                    var pending = craft._invoke('watchPosition');
+                    var managed = pending.then(function(result) {
+                        if (generation === locationWatchGeneration) {
+                            locationWatchStarted = hasLocationWatchers();
+                        }
+                        if (locationWatchStart === managed) locationWatchStart = null;
+                        return result;
+                    }, function(error) {
+                        if (generation === locationWatchGeneration) {
+                            locationWatchCallbacks.clear();
+                            legacyLocationWatchCallbacks.length = 0;
+                            locationWatchStarted = false;
+                        }
+                        if (locationWatchStart === managed) locationWatchStart = null;
+                        throw error;
+                    });
+                    locationWatchStart = managed;
+                    return managed;
+                }
+
+                function stopLocationWatchIfUnused() {
+                    if (hasLocationWatchers()) return Promise.resolve(true);
+                    if (!locationWatchStarted && !locationWatchStart) return Promise.resolve(true);
+
+                    locationWatchGeneration += 1;
+                    locationWatchStarted = false;
+                    locationWatchStart = null;
+                    return craft._invoke('clearWatch');
+                }
+
                 window.addEventListener('craftLocationUpdate', function(event) {
                     locationWatchCallbacks.forEach(function(callback) { callback(event.detail); });
+                    legacyLocationWatchCallbacks.slice().forEach(function(callback) { callback(event.detail); });
                 });
+                legacyGeolocation.watchPosition = function(callback) {
+                    legacyLocationWatchCallbacks.push(callback);
+                    return startLocationWatch();
+                };
+                legacyGeolocation.clearWatch = function() {
+                    legacyLocationWatchCallbacks.length = 0;
+                    return stopLocationWatchIfUnused();
+                };
                 craft.location = {
                     getCurrentPosition: function(options) { return legacyGeolocation.getCurrentPosition(options || {}); },
                     watchPosition: function(callback) {
                         var id = ++nextLocationWatchId;
                         locationWatchCallbacks.set(id, callback);
-                        if (locationWatchCallbacks.size === 1) void craft._invoke('watchPosition');
+                        void startLocationWatch().catch(function() {});
                         return id;
                     },
                     clearWatch: function(id) {
-                        locationWatchCallbacks.delete(id);
-                        if (locationWatchCallbacks.size === 0) {
-                            window.webkit.messageHandlers.craft.postMessage({action: 'clearWatch'});
+                        if (typeof id === 'undefined') {
+                            locationWatchCallbacks.clear();
+                            legacyLocationWatchCallbacks.length = 0;
+                            void stopLocationWatchIfUnused().catch(function() {});
+                            return;
                         }
+                        if (!locationWatchCallbacks.delete(id)) return;
+                        void stopLocationWatchIfUnused().catch(function() {});
                     },
                     startRecording: function() { return craft._invoke('startLocationRecording'); },
                     pauseRecording: function() { return craft._invoke('pauseLocationRecording'); },
@@ -2901,7 +3355,7 @@ struct CraftWebView: UIViewRepresentable {
                     }
                 };
                 var shareApi = function(text) { return legacyShare(text); };
-                shareApi.share = function(options) { return craft._invoke('share', {options: options || {}}); };
+                shareApi.share = function(options) { return craft._share({options: options || {}}); };
                 craft.share = shareApi;
                 craft.lifecycle = {
                     getState: function() { return document.visibilityState === 'visible' ? 'active' : 'background'; },
@@ -3219,36 +3673,68 @@ struct CraftWebView: UIViewRepresentable {
         }
 
         // MARK: - Push Notifications
+
+        /// The deadline covering the APNs round trip, once authorization is in.
+        private var pendingPushDeadline: UUID?
+
         private func registerPushNotifications(callbackId: String?) {
+            // A second call used to overwrite the first's callbackId, and the
+            // first promise then never settled at all. Displacing a call is an
+            // answer the caller can act on, the way a replaced
+            // getCurrentPosition request is rejected rather than dropped.
+            if let displaced = pendingPushCallbackId {
+                if let token = pendingPushDeadline { _ = claimDeadline(token) }
+                pendingPushDeadline = nil
+                rejectCallback(displaced, error: "Replaced by another push registration", code: "CANCELLED")
+            }
             pendingPushCallbackId = callbackId
             UNUserNotificationCenter.current().requestAuthorization(options: [.alert, .badge, .sound]) { [weak self] granted, error in
                 if granted {
                     DispatchQueue.main.async {
+                        guard let self else { return }
+                        // Armed here rather than at dispatch: until the person
+                        // answers the prompt there is someone to wait for, and
+                        // only the APNs round trip afterwards is unattended.
+                        self.pendingPushDeadline = self.armDeadline(
+                            Coordinator.pushRegistrationDeadline,
+                            callbackId: callbackId,
+                            error: "APNs did not call back within \(Int(Coordinator.pushRegistrationDeadline))s"
+                        )
+                        self.pendingPushCallbackId = callbackId
                         UIApplication.shared.registerForRemoteNotifications()
                     }
                 } else {
-                    self?.rejectCallback(callbackId, error: error?.localizedDescription ?? "Permission denied")
-                    self?.pendingPushCallbackId = nil
+                    DispatchQueue.main.async { [weak self] in
+                        guard let self, self.pendingPushCallbackId == callbackId else { return }
+                        self.rejectCallback(callbackId, error: error?.localizedDescription ?? "Permission denied")
+                        self.pendingPushCallbackId = nil
+                    }
                 }
             }
         }
 
+        /// Whether this push callback is still the one waiting, claiming it if so.
+        private func claimPushRegistration() -> String?? {
+            guard let callbackId = pendingPushCallbackId else { return nil }
+            if let token = pendingPushDeadline, !claimDeadline(token) { return nil }
+            pendingPushDeadline = nil
+            pendingPushCallbackId = nil
+            return .some(callbackId)
+        }
+
         @objc private func receivePushToken(_ notification: Notification) {
             guard let token = notification.object as? String else { return }
-            resolveCallback(pendingPushCallbackId, result: token)
-            pendingPushCallbackId = nil
+            // The event goes out either way: a token that arrives after its
+            // deadline is still this app's token, and a page listening for
+            // craftPushToken is not the caller that timed out.
+            if let claimed = claimPushRegistration() { resolveCallback(claimed, result: token) }
             sendToWeb("craftPushToken", data: ["token": token])
         }
 
         @objc private func receivePushRegistrationError(_ notification: Notification) {
             let message = notification.object as? String ?? "Push registration failed"
-            rejectCallback(pendingPushCallbackId, error: message, code: "PUSH_REGISTRATION_ERROR")
-            pendingPushCallbackId = nil
-        }
-
-        @objc private func receiveNotificationResponse(_ notification: Notification) {
-            let data = notification.object as? [String: Any] ?? [:]
-            sendToWeb("craftNotificationResponse", data: data)
+            guard let claimed = claimPushRegistration() else { return }
+            rejectCallback(claimed, error: message, code: "PUSH_REGISTRATION_ERROR")
         }
 
         // MARK: - Secure Storage (Keychain)
@@ -3339,6 +3825,13 @@ struct CraftWebView: UIViewRepresentable {
                 let status = CBManager.authorization
                 resolveCallback(callbackId, result: permissionStatus(status == .allowedAlways, denied: status == .denied, restricted: status == .restricted))
             case "notifications":
+                // Zig answers UnknownAction for this permission, so Swift
+                // serves it on both runtimes and this is the only answer.
+                let token = armDeadline(
+                    Coordinator.notificationSettingsDeadline,
+                    callbackId: callbackId,
+                    error: "UNUserNotificationCenter.getNotificationSettings did not answer within \(Int(Coordinator.notificationSettingsDeadline))s"
+                )
                 UNUserNotificationCenter.current().getNotificationSettings { settings in
                     let status: String
                     switch settings.authorizationStatus {
@@ -3347,7 +3840,10 @@ struct CraftWebView: UIViewRepresentable {
                     case .notDetermined: status = "undetermined"
                     @unknown default: status = "undetermined"
                     }
-                    self.resolveCallback(callbackId, result: status)
+                    DispatchQueue.main.async { [weak self] in
+                        guard let self, self.claimDeadline(token) else { return }
+                        self.resolveCallback(callbackId, result: status)
+                    }
                 }
             default:
                 resolveCallback(callbackId, result: "undetermined")
@@ -3682,9 +4178,23 @@ struct CraftWebView: UIViewRepresentable {
         }
 
         func locationManager(_ manager: CLLocationManager, didFailWithError error: Error) {
+            let nativeError = error as NSError
+            // kCLErrorLocationUnknown is Core Location saying it has no fix
+            // *yet*, not that it failed. requestLocation gives up on it, so a
+            // one-shot asks again shortly instead of failing a caller whose
+            // fix was seconds off; its timeout still bounds the wait (#260).
+            // Nor is it an error event: a watch keeps running through it.
+            if nativeError.domain == kCLErrorDomain && nativeError.code == CLError.Code.locationUnknown.rawValue {
+                if let waiting = singleLocationCallbackId {
+                    DispatchQueue.main.asyncAfter(deadline: .now() + .seconds(1)) { [weak self] in
+                        guard let self, self.singleLocationCallbackId == waiting else { return }
+                        self.locationManager?.requestLocation()
+                    }
+                }
+                return
+            }
             let callbackId = singleLocationCallbackId
             finishSingleLocationRequest()
-            let nativeError = error as NSError
             let code = nativeError.domain == kCLErrorDomain && nativeError.code == CLError.Code.denied.rawValue
                 ? "PERMISSION_DENIED"
                 : "POSITION_UNAVAILABLE"
@@ -3996,6 +4506,10 @@ struct CraftWebView: UIViewRepresentable {
                 content.body = data["body"] as? String ?? ""
                 if let subtitle = data["subtitle"] as? String { content.subtitle = subtitle }
                 if let badge = data["badge"] as? Int { content.badge = NSNumber(value: badge) }
+                // The page's `data`, which is what a tap (#255) and an arrival
+                // (#256) hand back. It was dropped, so a tap on a scheduled
+                // notification reached the page as {} (#258).
+                if let info = data["data"] as? [String: Any] { content.userInfo = info }
                 content.sound = .default
 
                 let id = data["id"] as? String ?? UUID().uuidString
@@ -4046,6 +4560,13 @@ struct CraftWebView: UIViewRepresentable {
 
         // MARK: - In-App Purchase
         private func getProducts(_ productIds: [String], callbackId: String?) {
+            // Nobody is in front of a StoreKit fetch, and it reaches the
+            // network: a request that never returns leaves the page waiting.
+            let token = armDeadline(
+                Coordinator.storeKitDeadline,
+                callbackId: callbackId,
+                error: "StoreKit did not return products within \(Int(Coordinator.storeKitDeadline))s"
+            )
             Task {
                 do {
                     let products = try await Product.products(for: Set(productIds))
@@ -4058,9 +4579,15 @@ struct CraftWebView: UIViewRepresentable {
                             "displayPrice": product.displayPrice
                         ]
                     }
-                    resolveCallback(callbackId, result: productData)
+                    await MainActor.run { [weak self] in
+                        guard let self, self.claimDeadline(token) else { return }
+                        self.resolveCallback(callbackId, result: productData)
+                    }
                 } catch {
-                    rejectCallback(callbackId, error: error.localizedDescription)
+                    await MainActor.run { [weak self] in
+                        guard let self, self.claimDeadline(token) else { return }
+                        self.rejectCallback(callbackId, error: error.localizedDescription)
+                    }
                 }
             }
         }
@@ -4780,9 +5307,17 @@ struct CraftWebView: UIViewRepresentable {
                 durationSeconds: body["durationSeconds"] as? Double ?? current.durationSeconds,
                 progress: min(max(body["progress"] as? Double ?? current.progress, 0), 1)
             )
+            let token = armDeadline(
+                Coordinator.liveActivityDeadline,
+                callbackId: callbackId,
+                error: "Activity.update did not return within \(Int(Coordinator.liveActivityDeadline))s"
+            )
             Task {
                 await activity.update(ActivityContent(state: state, staleDate: nil))
-                resolveCallback(callbackId, result: ["updated": true])
+                await MainActor.run { [weak self] in
+                    guard let self, self.claimDeadline(token) else { return }
+                    self.resolveCallback(callbackId, result: ["updated": true])
+                }
             }
         }
 
@@ -4823,9 +5358,17 @@ struct CraftWebView: UIViewRepresentable {
             } else {
                 finalContent = nil
             }
+            let token = armDeadline(
+                Coordinator.liveActivityDeadline,
+                callbackId: callbackId,
+                error: "Activity.end did not return within \(Int(Coordinator.liveActivityDeadline))s"
+            )
             Task {
                 await activity.end(finalContent, dismissalPolicy: .default)
-                resolveCallback(callbackId, result: ["ended": true])
+                await MainActor.run { [weak self] in
+                    guard let self, self.claimDeadline(token) else { return }
+                    self.resolveCallback(callbackId, result: ["ended": true])
+                }
             }
         }
 
@@ -5452,9 +5995,90 @@ struct CraftWebView: UIViewRepresentable {
             resolveCallback(callbackId, result: ["registered": true, "action": action, "phrase": phrase])
         }
 
+        // Removals waiting on their completion, each under a token of its own:
+        // callbackId can be nil, and restarts when the page reloads.
+        /// One entry per call whose only answer is a framework callback.
+        ///
+        /// Each of these waits on something no person is in front of — a
+        /// notification-settings read, an APNs registration, a StoreKit fetch,
+        /// a Live Activity update — and nothing else settles the page's
+        /// promise if the callback never comes (#224). #211 found the same
+        /// shape in a Siri deletion, twice, on CI.
+        ///
+        /// Whoever claims the token first answers: the callback or the
+        /// deadline. Both run on the main queue, so the race is decided there
+        /// rather than by a lock, and the loser finds nothing and does
+        /// nothing. The deadline never claims the work happened — it may well
+        /// have — only that nothing reported back in time.
+        private var pendingDeadlines: [UUID: DispatchWorkItem] = [:]
+
+        /// How long each of them waits. Comfortably under the 30s the page's
+        /// own `_invoke` allows, so the caller hears the native answer rather
+        /// than its own timeout, and long enough that a slow device is not
+        /// cut off mid-answer.
+        private static let notificationSettingsDeadline: TimeInterval = 10
+        private static let pushRegistrationDeadline: TimeInterval = 20
+        private static let storeKitDeadline: TimeInterval = 20
+        private static let liveActivityDeadline: TimeInterval = 10
+
+        /// Arm a deadline for a call, and return the token that claims it.
+        private func armDeadline(_ seconds: TimeInterval, callbackId: String?, error: String) -> UUID {
+            let token = UUID()
+            let work = DispatchWorkItem { [weak self] in
+                guard let self, self.pendingDeadlines.removeValue(forKey: token) != nil else { return }
+                self.rejectCallback(callbackId, error: error, code: "TIMEOUT")
+            }
+            pendingDeadlines[token] = work
+            DispatchQueue.main.asyncAfter(deadline: .now() + seconds, execute: work)
+            return token
+        }
+
+        /// Claim the right to answer. False means the deadline already did.
+        ///
+        /// Call it on the main queue: the callbacks below hop there first,
+        /// because the queue a framework completion arrives on is its own
+        /// business and a `zig:` hand-off reply reaches `evaluateJavaScript`
+        /// with no hop of its own.
+        private func claimDeadline(_ token: UUID) -> Bool {
+            guard let work = pendingDeadlines.removeValue(forKey: token) else { return false }
+            work.cancel()
+            return true
+        }
+
+        private var pendingSiriRemovals: [UUID: DispatchWorkItem] = [:]
+        // The only thing that settles craft.siri.remove, which arms no timeout
+        // of its own; the same as Zig's.
+        private static let siriRemovalDeadline: TimeInterval = 15
+
         private func removeSiriShortcut(action: String, callbackId: String?) {
+            // The completion comes from a system daemon, and sometimes it never
+            // comes (#211). The deadline settles the call instead, and never
+            // with removed: true, because the deletion may still have happened.
+            // Both run on the main queue and remove the same entry, so only one
+            // of them answers.
+            let token = UUID()
+            let deadline = DispatchWorkItem { [weak self] in
+                guard let self, self.pendingSiriRemovals.removeValue(forKey: token) != nil else { return }
+                self.rejectCallback(
+                    callbackId,
+                    error: "NSUserActivity.deleteSavedUserActivities did not call its completion handler within \(Int(Coordinator.siriRemovalDeadline))s",
+                    code: "TIMEOUT"
+                )
+            }
+            pendingSiriRemovals[token] = deadline
+            DispatchQueue.main.asyncAfter(deadline: .now() + Coordinator.siriRemovalDeadline, execute: deadline)
+
             NSUserActivity.deleteSavedUserActivities(withPersistentIdentifiers: [action]) {
-                self.resolveCallback(callbackId, result: ["removed": true, "action": action])
+                // The queue this runs on is not documented, and a zig: hand-off
+                // reply goes to evaluateJavaScript without a hop of its own.
+                DispatchQueue.main.async { [weak self] in
+                    guard let self, let pending = self.pendingSiriRemovals.removeValue(forKey: token) else {
+                        print("removeSiriShortcut: the completion for \(action) arrived after its deadline; ignored")
+                        return
+                    }
+                    pending.cancel()
+                    self.resolveCallback(callbackId, result: ["removed": true, "action": action])
+                }
             }
         }