craft-native 0.0.487 → 0.0.491

package/dist/ios/templates/CraftNativeScreen.swift

@@ -12,6 +12,7 @@ import OSLog
 import Security
 import SwiftUI
 import UIKit
+import UIKit.UIGestureRecognizerSubclass
 
 /// A menu belongs to its native view, not to coordinates in a web page.
 final class CraftNativeContextMenu: NSObject, UIContextMenuInteractionDelegate {
@@ -5195,6 +5196,23 @@ private final class CraftNativeScrollView: UIScrollView, UIGestureRecognizerDele
 /// Native inspection of an SVG plot. Coordinates are fractions of the plot's
 /// bounds; labels and values are already localized by the application. No JS
 /// callback or bridge round trip is needed while a finger moves.
+/// Reports where each touch starts and then fails, so it observes a window
+/// without ever taking a touch from the view underneath.
+final class CraftTouchBeganRecognizer: UIGestureRecognizer {
+    private let began: (CGPoint) -> Void
+    init(began: @escaping (CGPoint) -> Void) {
+        self.began = began
+        super.init(target: nil, action: nil)
+        cancelsTouchesInView = false
+        delaysTouchesBegan = false
+        delaysTouchesEnded = false
+    }
+    override func touchesBegan(_ touches: Set<UITouch>, with event: UIEvent) {
+        state = .failed
+        if let touch = touches.first { began(touch.location(in: view)) }
+    }
+}
+
 final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
     struct Reading {
         let key: String
@@ -5214,6 +5232,7 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
     private lazy var tap = UITapGestureRecognizer(target: self, action: #selector(tapped(_:)))
     private lazy var pan = UIPanGestureRecognizer(target: self, action: #selector(panned(_:)))
     private lazy var hold = UILongPressGestureRecognizer(target: self, action: #selector(held(_:)))
+    private var outside: CraftTouchBeganRecognizer?
 
     init(view: UIView) {
         self.view = view
@@ -5241,6 +5260,7 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
                            color: (point["color"] as? String).flatMap { UIColor(css: $0) } ?? .systemBlue, label: label, rows: rows)
         }
         selectedIndex = -1
+        unwatchOutside()
         view?.isUserInteractionEnabled = !readings.isEmpty
         if readings.isEmpty { view?.accessibilityTraits.remove(.adjustable); view?.accessibilityValue = nil }
         [tap, pan, hold].forEach { $0.isEnabled = !readings.isEmpty }
@@ -5270,6 +5290,7 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
     }
 
     @discardableResult func dismiss() -> Bool {
+        unwatchOutside()
         guard selectedIndex >= 0 else { return false }
         selectedIndex = -1
         configureAccessibility()
@@ -5277,20 +5298,47 @@ final class CraftChartInspection: NSObject, UIGestureRecognizerDelegate {
         return true
     }
 
-    private func select(at point: CGPoint) {
-        guard let view, view.bounds.width > 0 else { return }
+    private func nearest(at point: CGPoint) -> Int? {
+        guard let view, view.bounds.width > 0 else { return nil }
         let fraction = max(0, min(1, point.x / view.bounds.width))
-        if let nearest = readings.indices.min(by: { abs(readings[$0].x - fraction) < abs(readings[$1].x - fraction) }) { select(nearest) }
+        return readings.indices.min(by: { abs(readings[$0].x - fraction) < abs(readings[$1].x - fraction) })
+    }
+    private func select(at point: CGPoint) {
+        if let index = nearest(at: point) { select(index); watchOutside() }
+    }
+    /// A tap pins the reading under it. Tapping the pinned reading again puts
+    /// it away, so a reading can always be closed where it was opened.
+    func tap(at point: CGPoint) {
+        guard let index = nearest(at: point) else { return }
+        if index == selectedIndex { dismiss() } else { select(at: point) }
+    }
+    /// A drag or a hold reads the chart only while the finger is down.
+    func scrub(_ state: UIGestureRecognizer.State, at point: CGPoint) {
+        switch state {
+        case .began, .changed: select(at: point)
+        case .ended, .cancelled, .failed: dismiss()
+        default: break
+        }
     }
-    @objc private func tapped(_ gesture: UITapGestureRecognizer) { select(at: gesture.location(in: view)) }
-    @objc private func panned(_ gesture: UIPanGestureRecognizer) {
-        if gesture.state == .began || gesture.state == .changed { select(at: gesture.location(in: view)) }
-        if gesture.state == .cancelled { dismiss() }
+    /// A touch that starts anywhere off the chart closes a pinned reading. The
+    /// watcher never recognises, so the touch still reaches what it landed on.
+    func touchBegan(inWindow point: CGPoint) {
+        guard let view, let window = view.window else { return }
+        if !view.bounds.contains(view.convert(point, from: window)) { dismiss() }
     }
-    @objc private func held(_ gesture: UILongPressGestureRecognizer) {
-        if gesture.state == .began || gesture.state == .changed { select(at: gesture.location(in: view)) }
-        if gesture.state == .cancelled { dismiss() }
+    private func watchOutside() {
+        guard outside == nil, let window = view?.window else { return }
+        let watcher = CraftTouchBeganRecognizer { [weak self] point in self?.touchBegan(inWindow: point) }
+        window.addGestureRecognizer(watcher)
+        outside = watcher
     }
+    private func unwatchOutside() {
+        if let outside { outside.view?.removeGestureRecognizer(outside) }
+        outside = nil
+    }
+    @objc private func tapped(_ gesture: UITapGestureRecognizer) { tap(at: gesture.location(in: view)) }
+    @objc private func panned(_ gesture: UIPanGestureRecognizer) { scrub(gesture.state, at: gesture.location(in: view)) }
+    @objc private func held(_ gesture: UILongPressGestureRecognizer) { scrub(gesture.state, at: gesture.location(in: view)) }
     func gestureRecognizerShouldBegin(_ gesture: UIGestureRecognizer) -> Bool {
         guard gesture === pan else { return true }
         let velocity = pan.velocity(in: view)
@@ -6002,9 +6050,23 @@ final class CraftNativeSolidSwitch: UIControl {
         return CGRect(x: min(max(x, track.minX), track.maxX - rect.width - stretch),
                       y: rect.minY, width: rect.width + stretch, height: rect.height)
     }
+    /// How much wider than tall the thumb is drawn.
+    ///
+    /// iOS 26 draws a wide pill where every system before it drew a circle,
+    /// so a square thumb reads as a control from an older OS sitting among
+    /// native ones. Measured on iOS 26.5 (iPhone 17 Pro simulator) by walking
+    /// a real `UISwitch`: the control is 63x28 and its thumb 37x24, inset 2 on
+    /// every side, travelling from x=2 to x=24.
+    ///
+    /// Expressed against the thumb's own height rather than as a fixed size,
+    /// so it keeps following whatever the real `UISwitch` reports — which is
+    /// where `naturalSize` already comes from. At the system's own 24-point
+    /// thumb height this is exactly 37.
+    private static let thumbAspect: CGFloat = 37.0 / 24.0
     private func thumbRect(at position: CGFloat) -> CGRect {
         let track = trackRect.insetBy(dx: 2, dy: 2)
-        return CGRect(x: track.minX + (track.width - track.height) * position, y: track.minY, width: track.height, height: track.height)
+        let width = min(track.width, track.height * Self.thumbAspect)
+        return CGRect(x: track.minX + (track.width - width) * position, y: track.minY, width: width, height: track.height)
     }
     override func draw(_ rect: CGRect) {
         let track = trackRect
@@ -6341,12 +6403,37 @@ private final class CraftNativeTextView: UITextView {
         if !isScrollEnabled, contentOffset != .zero { contentOffset = .zero }
         let inset = textContainerInset
         let padding = textContainer.lineFragmentPadding
-        placeholderLabel.frame = CGRect(
-            x: inset.left + padding,
-            y: inset.top,
-            width: max(0, bounds.width - inset.left - inset.right - padding * 2),
-            height: max(0, bounds.height - inset.top - inset.bottom)
-        )
+        let measured = placeholderLabel
+            .sizeThatFits(CGSize(width: Self.placeholderWidth(bounds: bounds, inset: inset, padding: padding),
+                                 height: .greatestFiniteMagnitude))
+        placeholderLabel.frame = Self.placeholderFrame(bounds: bounds, inset: inset, padding: padding,
+                                                       fittedHeight: measured.height)
+    }
+
+    static func placeholderWidth(bounds: CGRect, inset: UIEdgeInsets, padding: CGFloat) -> CGFloat {
+        max(0, bounds.width - inset.left - inset.right - padding * 2)
+    }
+
+    /// Where the placeholder sits inside the box.
+    ///
+    /// Anchored at the top, and no taller than the text it holds. `UILabel`
+    /// centres its text block vertically within its frame, while
+    /// `UITextView` lays its glyphs out from the top, so a label handed the
+    /// box's whole remaining height drew the placeholder of a four-row notes
+    /// field halfway down it — nowhere near the caret that replaced it the
+    /// moment the field was tapped (#501). The two rules only agreed when
+    /// the box was exactly one line tall, which is why single-line fields
+    /// looked right and every `textarea` did not. Given only the height its
+    /// text needs, the label has no spare height to centre within.
+    ///
+    /// Clamped to what is left of the box so that a placeholder longer than
+    /// the field stays inside it rather than drawing past the bottom.
+    static func placeholderFrame(bounds: CGRect, inset: UIEdgeInsets, padding: CGFloat, fittedHeight: CGFloat) -> CGRect {
+        let available = max(0, bounds.height - inset.top - inset.bottom)
+        return CGRect(x: inset.left + padding,
+                      y: inset.top,
+                      width: placeholderWidth(bounds: bounds, inset: inset, padding: padding),
+                      height: min(max(0, fittedHeight), available))
     }
 
     func refreshPlaceholder() {
@@ -7037,6 +7124,17 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
 
     override func viewWillDisappear(_ animated: Bool) {
         super.viewWillDisappear(animated)
+        // A screen does not take the keyboard with it. Its field is still
+        // first responder at this point, and once the view leaves the window
+        // the next screen's `window?.endEditing` no longer reaches it — the
+        // keyboard then stays up with nothing able to dismiss it until the
+        // app is backgrounded (#497). This is the one moment both facts hold:
+        // the screen is going, and its view still owns the responder.
+        //
+        // `lastFocusedInput` is deliberately left alone. A screen merely
+        // covered by a push comes back, and restoreFocus putting the person
+        // back where they were is the behaviour that was already there.
+        view.endEditing(true)
         screenVisibilityChanged(false)
         stopCelebrations(in: view)
         // Release only this screen's accessory. A retained or prepared screen
@@ -7045,7 +7143,7 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         CraftChrome.shared.releaseTabAccessory(ownedBy: self)
         // Popped (or its stack dismissed) while the bar was away: it comes
         // back for whatever shows next, a web page included.
-        if tabBarHidden, isMovingFromParent || isBeingDismissed || navigationController?.isBeingDismissed == true {
+        if tabBarHiddenApplied, isMovingFromParent || isBeingDismissed || navigationController?.isBeingDismissed == true {
             CraftChrome.shared.setHiddenByScreen(false)
         }
     }
@@ -7087,7 +7185,7 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
 
     private func restoreShellChrome() {
         guard !isAppScript else { return }
-        CraftChrome.shared.setHiddenByScreen(tabBarHidden)
+        applyTabBarHidden()
         // A screen not yet asked about the accessory (one shown for the first
         // time, before its script has run) leaves the bar as it is; one that
         // has drawn without asking for it takes off what nobody claims.
@@ -7183,6 +7281,18 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     private func disposeRuntime() {
         guard !runtimeDisposed else { return }
         runtimeDisposed = true
+        // Again here, and forgetting the input this time: a screen can be torn
+        // down without ever appearing (one prepared and then replaced), so
+        // viewWillDisappear is not guaranteed to have run. Nothing comes back
+        // from here, so there is no focus worth restoring.
+        //
+        // `viewIfLoaded`, never `view`: this also runs from `deinit`, where
+        // `view` is a `UIView!` that UIKit has already cleared — reading it
+        // traps on the implicit unwrap, and a screen that never appeared
+        // would instead have `loadView` resurrect `self` while it is being
+        // deallocated. A screen with no loaded view has nothing focused.
+        forgetFocusedInput()
+        viewIfLoaded?.endEditing(true)
         frameDelivery.close()
         storageLifetime.close()
         pendingCapabilityDeadlines.values.forEach { $0.cancel() }
@@ -7658,7 +7768,8 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     /// - `craft.secureStorage.getSync(key)`: the Keychain item the web page's
     ///   `craft.secureStorage.set` wrote.
     /// - `craft.navigation.setOptions({ title, titleColor, largeTitle, hidden,
-    ///   backTitle, tabBarHidden, tabItem, swipeBack, contentSwipeBack,
+    ///   backTitle, tabBarHidden, tabBarHiddenWhenPushed, tabItem, swipeBack,
+    ///   contentSwipeBack,
     ///   tabSwipeEnabled, backgroundColor, navigationBarSolid, leftButtons,
     ///   rightButtons, tabAccessory })`; a button's tap is the event
     ///   `navButton`. `craft.d.ts` types no navigation surface, so this list
@@ -8125,6 +8236,32 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
     private var statusBarHiddenOverride: Bool?
     /// The app's tab bar away while this screen shows (`tabBarHidden`).
     private var tabBarHidden = false
+    /// The bar away only once this screen is pushed onto something
+    /// (`tabBarHiddenWhenPushed`): UIKit's `hidesBottomBarWhenPushed` idiom,
+    /// for a screen that keeps the bar as its stack's root and drops it when
+    /// it is a detail. Craft's tab bar is drawn by CraftChrome rather than a
+    /// UITabBarController, so the depth is read here and the bar is asked
+    /// directly; the Android shell has honoured the same key all along.
+    private var tabBarHiddenWhenPushed = false
+    /// What this screen last told the chrome. Teardown has to put back a bar
+    /// this screen took away, and recomputing the answer there is no good:
+    /// UIKit has already taken a popped screen out of `viewControllers` by
+    /// `viewWillDisappear`, so a bar hidden for depth would read as never
+    /// hidden at all and stay off for whatever shows next.
+    private var tabBarHiddenApplied = false
+
+    /// Whether the bar should be away for this screen as it stands now.
+    private var wantsTabBarHidden: Bool {
+        if tabBarHidden { return true }
+        guard tabBarHiddenWhenPushed, let stack = navigationController?.viewControllers else { return false }
+        guard let depth = stack.firstIndex(where: { $0 === self }) else { return false }
+        return depth > 0
+    }
+
+    private func applyTabBarHidden() {
+        tabBarHiddenApplied = wantsTabBarHidden
+        CraftChrome.shared.setHiddenByScreen(tabBarHiddenApplied)
+    }
     private var tabAccessory: [String: Any]?
     /// Whether the screen has said anything about the accessory yet
     /// (`tabAccessory`, null included): until it has, the bar keeps showing
@@ -8210,8 +8347,16 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         }
         if let hidden = options["tabBarHidden"] as? Bool {
             tabBarHidden = hidden
+        }
+        if let hiddenWhenPushed = options["tabBarHiddenWhenPushed"] as? Bool {
+            tabBarHiddenWhenPushed = hiddenWhenPushed
+        }
+        if options.keys.contains("tabBarHidden") || options.keys.contains("tabBarHiddenWhenPushed") {
+            // Prepared tabs and screens under a push keep the answer and apply
+            // it when they are shown (restoreShellChrome); only the screen on
+            // display may move the shared bar.
             if navigationController?.topViewController === self, isShownOnScreen {
-                CraftChrome.shared.setHiddenByScreen(hidden)
+                applyTabBarHidden()
             }
         }
         if let swipeBack = options["swipeBack"] as? Bool {
@@ -8324,6 +8469,22 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
 
     /// A bar button from `{ id, symbol | title }`. Its tap is the event
     /// `navButton` with `{ id }`.
+    /// A bar button's choices, or nil when it has none worth a menu.
+    static func navigationMenu(_ raw: Any?, chosen: @escaping (String) -> Void) -> UIMenu? {
+        let actions: [UIAction] = ((raw as? [[String: Any]]) ?? []).prefix(12).compactMap { choice in
+            guard let id = choice["id"] as? String, !id.isEmpty,
+                  let title = choice["title"] as? String, !title.isEmpty else { return nil }
+            var attributes: UIMenuElement.Attributes = []
+            if choice["disabled"] as? Bool == true { attributes.insert(.disabled) }
+            if choice["destructive"] as? Bool == true { attributes.insert(.destructive) }
+            let action = UIAction(title: title, image: (choice["symbol"] as? String).flatMap { UIImage(systemName: $0) },
+                                  attributes: attributes) { _ in chosen(id) }
+            action.accessibilityIdentifier = "nav-menu-\(id)"
+            return action
+        }
+        return actions.isEmpty ? nil : UIMenu(children: actions)
+    }
+
     private func navigationButton(_ spec: [String: Any]) -> UIBarButtonItem? {
         guard let id = spec["id"] as? String, !id.isEmpty else { return nil }
         let action = UIAction { [weak self] _ in
@@ -8332,11 +8493,16 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         if spec["variant"] as? String == "accent" || spec["variant"] as? String == "account" {
             return accountNavigationButton(spec, action: action)
         }
+        // `menu`: the button opens a native menu instead of sending its own
+        // id, and each choice is reported as a press of that choice's id.
+        let menu = Self.navigationMenu(spec["menu"]) { [weak self] choice in
+            self?.send(type: "EVENT", payload: ["handlerName": "navButton", "nativeEvent": ["id": choice]])
+        }
         let item: UIBarButtonItem
         if let symbol = spec["symbol"] as? String, let image = UIImage(systemName: symbol) {
-            item = UIBarButtonItem(image: image, primaryAction: action)
+            item = menu.map { UIBarButtonItem(image: image, menu: $0) } ?? UIBarButtonItem(image: image, primaryAction: action)
         } else if let title = spec["title"] as? String {
-            item = UIBarButtonItem(title: title, primaryAction: action)
+            item = menu.map { UIBarButtonItem(title: title, menu: $0) } ?? UIBarButtonItem(title: title, primaryAction: action)
         } else {
             return nil
         }
@@ -8927,14 +9093,22 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
                 ])
             }
         case "NAVIGATE", "NAVIGATE_REPLACE":
-            // A screen's own stack; the app script has none (it opens paths).
-            guard !isAppScript, navigationController?.topViewController === self,
-                  let screen = payload["screen"] as? String, !screen.isEmpty,
-                  let navigation = navigationController else { return }
+            guard let screen = payload["screen"] as? String, !screen.isEmpty else { return }
+            // Replacing a path needs no stack of its own: it asks the shell to
+            // show that path, which is why it delegates rather than pushing.
+            // The app script has no stack, so this was refused to it along
+            // with everything else, and its only way to redirect was to push
+            // sign-in on top of the screen it meant to prevent (#499). The
+            // gate in CraftHybrid.configure is the fix for launch; this is
+            // what lets a session that ends mid-run replace rather than stack.
             if type == "NAVIGATE_REPLACE", screen.hasPrefix("/") {
+                guard isAppScript || navigationController?.topViewController === self else { return }
                 hybridEvents?.nativeScreen(self, replace: screen)
                 return
             }
+            // A screen's own stack; the app script has none (it opens paths).
+            guard !isAppScript, navigationController?.topViewController === self,
+                  let navigation = navigationController else { return }
             let params = payload["params"] as? [String: Any] ?? [:]
             let next = CraftNativeScreenController(config: config, routeName: screen, routeParams: params)
             next.hybridEvents = hybridEvents
@@ -9376,7 +9550,18 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         previousNodesByProtocolID.removeAll(keepingCapacity: true)
         adoptedPreviousProtocolIDs.removeAll(keepingCapacity: true)
         indexPreviousNodes(previous)
-        let next = reconcile(document, identity: "root", path: "root", previous: previous)
+        // The app's configured body face seeds the inheritance chain, so a
+        // screen's text is branded for the same reason its chrome is. Without
+        // this the chain starts empty and `fontFamily` reached the navigation
+        // bar, the tab labels and the bar buttons — all UIAppearance proxies —
+        // while every label, button and field inside a screen stayed in the
+        // system face (#500).
+        //
+        // A node that sets its own family still wins: the fill below only
+        // applies where a node set none or `inherit`. Nil unless the app
+        // configured one, which the same guard makes free.
+        let next = reconcile(document, identity: "root", path: "root", previous: previous,
+                             inheritedFontFamily: CraftChromeFonts.body)
         previousNodesByProtocolID.removeAll(keepingCapacity: true)
         adoptedPreviousProtocolIDs.removeAll(keepingCapacity: true)
         if previous?.view !== next.view {

package/dist/ios/templates/CraftNativeServices.swift

@@ -324,11 +324,19 @@ final class CraftNativeSounds {
         object: nil,
         queue: .main,
     ) { note in CraftNativeSounds.handleInterruption(note) }
+    /// There is no interruption for the media server restarting, and it is
+    /// not recoverable the way an interruption is: see `handleMediaReset`.
+    private static let mediaResetObserver = NotificationCenter.default.addObserver(
+        forName: AVAudioSession.mediaServicesWereResetNotification,
+        object: nil,
+        queue: .main,
+    ) { _ in CraftNativeSounds.handleMediaReset() }
     /// `{ id, event: "ended" | "error", message? }` to the screen's script.
     var emit: (([String: Any]) -> Void)?
 
     init() {
         _ = Self.interruptionObserver
+        _ = Self.mediaResetObserver
         Self.services.add(self)
     }
 
@@ -362,6 +370,33 @@ final class CraftNativeSounds {
         }
     }
 
+    /// The media server restarted, which orphans every audio object the
+    /// process holds. Apple's requirement is to discard them and make new
+    /// ones; an orphaned `AVQueuePlayer` never plays again, never reaches the
+    /// end of its item and so never reports anything. Without this, a sound
+    /// playing across a reset left the script a handle that was silent
+    /// forever, `pause`/`resume` answering `true` about nothing, and the
+    /// session claim never released — while Android reports the equivalent
+    /// permanent loss of audio focus as an `error` event and drops the sound.
+    ///
+    /// A file player's playhead does not survive the reset, so the handle is
+    /// released and the loss reported rather than guessed at. Web Audio is
+    /// recovered instead (CraftWebAudio.swift): its graph is pure synthesis
+    /// the script is still driving, so a new engine continues it.
+    static let mediaResetMessage = "Audio stopped because the media services were reset"
+
+    /// Sound services and their playback controls are used on main.
+    private static func handleMediaReset() {
+        // The pre-reset interruption, if any, is gone with the server.
+        sessionInterrupted = false
+        for service in services.allObjects {
+            for id in Array(service.sounds.keys) {
+                service.remove(id, result: .failure(CraftNativeActionError(code: "AUDIO_ERROR", message: mediaResetMessage)))
+                service.emit?(["id": id, "event": "error", "message": mediaResetMessage])
+            }
+        }
+    }
+
     /// Starts `url`. `answer` hears once it plays (or could not be loaded).
     func play(id: String, url: URL, options: [String: Any], answer: @escaping (Result<Any, CraftNativeActionError>) -> Void) {
         stop(id: id, fadeOut: 0)

package/dist/ios/templates/CraftVoiceRecording.swift

@@ -15,7 +15,12 @@ extension AVAudioRecorder: CraftVoiceRecorder {}
 /// is starting, so a late permission/encoder answer cannot resurrect it.
 final class CraftVoiceRecording {
     static let shared = CraftVoiceRecording()
-    private static let fileQueue = DispatchQueue(label: "craft.voice-recording-files", qos: .utility)
+    /// Deleting a recording somebody just cancelled is work they are waiting
+    /// on: until it is gone, what they decided not to send still exists. At
+    /// `.utility` a busy device could leave the removal queued for seconds
+    /// behind everything else (it missed a two-second bound on a loaded CI
+    /// simulator while every other step of the cancellation was on time).
+    private static let fileQueue = DispatchQueue(label: "craft.voice-recording-files", qos: .userInitiated)
     private static let launchCleanup: Void = discardAbandonedRecordings(includeLegacy: false)
     private static let legacyCleanup: Void = discardAbandonedRecordings()
     private static let folderName = "voice-recordings"
@@ -106,7 +111,16 @@ final class CraftVoiceRecording {
     private let startupTimeout: TimeInterval
     private let stopTimeout: TimeInterval
     struct FileRemovalReceipt: Encodable {
+        /// From deciding to delete to the block actually running: the trace,
+        /// the submission, and the wait for a thread.
         let queueMilliseconds: Double
+        /// The first of those three alone. A run where `queueMilliseconds` is
+        /// seconds and this is near zero spent them waiting for GCD to admit
+        /// the block; one where this carries most of them spent them in
+        /// `trace`, which takes a process-wide lock and then logs
+        /// synchronously. Without it the two are indistinguishable, which is
+        /// where #490 ran out of evidence at 7638ms of queue for 3ms of work.
+        let submitMilliseconds: Double
         let removalMilliseconds: Double
         let ownedBefore: Bool
         let removed: Bool
@@ -178,12 +192,14 @@ final class CraftVoiceRecording {
             let queued = ProcessInfo.processInfo.systemUptime
             let observed = fileRemovalObserved
             Self.trace("cancel \(session.key.prefix(8)): file removal queued")
+            let submitted = ProcessInfo.processInfo.systemUptime
             Self.fileQueue.async {
                 let began = ProcessInfo.processInfo.systemUptime
                 let owned = CraftNativeFiles.owned(file.path) != nil
                 let removed = CraftNativeFiles.remove(file.path)
                 let receipt = FileRemovalReceipt(
                     queueMilliseconds: (began - queued) * 1000,
+                    submitMilliseconds: (submitted - queued) * 1000,
                     removalMilliseconds: (ProcessInfo.processInfo.systemUptime - began) * 1000,
                     ownedBefore: owned, removed: removed,
                     existsAfter: FileManager.default.fileExists(atPath: file.path))

package/dist/ios/templates/CraftWebAudio.swift

@@ -1361,7 +1361,12 @@ final class CraftWebAudio {
     private var engine: AVAudioEngine?
     private var claimedSession = false
     private var pump: Timer?
+    /// Notifications about the audio session and the app, registered once and
+    /// outliving any one engine.
     private var observers: [NSObjectProtocol] = []
+    /// And the one about this engine's configuration, which does not: a
+    /// rebuilt engine is a different object (`rebuildEngine`).
+    private var engineObserver: NSObjectProtocol?
     private weak var script: JSContext?
 
     init(live: Bool = true) {
@@ -1434,15 +1439,7 @@ final class CraftWebAudio {
                 contexts[id] = nil
                 return nil
             }
-            let engine = self.engine ?? makeEngine()
-            let source = AVAudioSourceNode(format: format) { silence, _, frameCount, bufferList in
-                let buffers = UnsafeMutableAudioBufferListPointer(bufferList)
-                silence.pointee = ObjCBool(graph.render(Int(frameCount), into: buffers))
-                return noErr
-            }
-            engine.attach(source)
-            engine.connect(source, to: engine.mainMixerNode, format: format)
-            context.source = source
+            attachSource(context, format: format, to: self.engine ?? makeEngine())
             refreshEngine()
         }
         startPump()
@@ -1482,25 +1479,84 @@ final class CraftWebAudio {
 
     // MARK: Engine and session
 
+    /// A context's graph reaches the engine through a source node. Attached
+    /// when the context opens, and again on a fresh engine for every live
+    /// context after the media server restarts.
+    private func attachSource(_ context: Context, format: AVAudioFormat, to engine: AVAudioEngine) {
+        let graph = context.graph
+        let source = AVAudioSourceNode(format: format) { silence, _, frameCount, bufferList in
+            let buffers = UnsafeMutableAudioBufferListPointer(bufferList)
+            silence.pointee = ObjCBool(graph.render(Int(frameCount), into: buffers))
+            return noErr
+        }
+        engine.attach(source)
+        engine.connect(source, to: engine.mainMixerNode, format: format)
+        context.source = source
+    }
+
     private func makeEngine() -> AVAudioEngine {
         let engine = AVAudioEngine()
         self.engine = engine
         let center = NotificationCenter.default
         // A route change (headphones) or an interruption (a call) stops the
-        // engine; it starts again when the context still plays.
-        observers.append(center.addObserver(forName: .AVAudioEngineConfigurationChange, object: engine, queue: .main) { [weak self] _ in
+        // engine; it starts again when the context still plays. This one is
+        // scoped to the engine, so a rebuilt engine replaces it.
+        if let engineObserver { center.removeObserver(engineObserver) }
+        engineObserver = center.addObserver(forName: .AVAudioEngineConfigurationChange, object: engine, queue: .main) { [weak self] _ in
             self?.refreshEngine()
-        })
+        }
+        // The rest are about the session and the app, not this engine.
+        guard observers.isEmpty else { return engine }
         observers.append(center.addObserver(forName: AVAudioSession.interruptionNotification, object: nil, queue: .main) { [weak self] note in
             let type = (note.userInfo?[AVAudioSessionInterruptionTypeKey] as? NSNumber)?.uintValue
             if type == AVAudioSession.InterruptionType.ended.rawValue { self?.refreshEngine() }
         })
+        observers.append(center.addObserver(forName: AVAudioSession.mediaServicesWereResetNotification, object: nil, queue: .main) { [weak self] _ in
+            self?.rebuildEngine()
+        })
         observers.append(center.addObserver(forName: UIApplication.willEnterForegroundNotification, object: nil, queue: .main) { [weak self] _ in
             self?.refreshEngine()
         })
         return engine
     }
 
+    /// The media server restarted, which orphans every audio object the
+    /// process holds — this engine and the source nodes attached to it. An
+    /// orphaned engine can be told to start and still produce no sound, and
+    /// no configuration-change notification is posted for it, so
+    /// `refreshEngine` cannot recover from this. Apple's requirement is to
+    /// discard the orphans and make new ones.
+    ///
+    /// A context does survive, because `CraftAudioGraph` is pure synthesis
+    /// holding no AVFoundation object: it is given a fresh source node on a
+    /// fresh engine and keeps playing from where its own clock is. That is
+    /// why this recovers where a file-backed sound reports the loss instead
+    /// (`CraftNativeSounds.handleMediaReset`) — a player's playhead does not
+    /// survive the reset, a synthesised graph does. Starting the new engine
+    /// reactivates the session, so the claim this screen already holds does
+    /// not need to be taken again.
+    private func rebuildEngine() {
+        guard live, let orphaned = engine else { return }
+        for context in contexts.values {
+            if let source = context.source {
+                orphaned.disconnectNodeOutput(source)
+                orphaned.detach(source)
+            }
+            context.source = nil
+        }
+        orphaned.stop()
+        if let engineObserver { NotificationCenter.default.removeObserver(engineObserver) }
+        engineObserver = nil
+        engine = nil
+        guard !contexts.isEmpty else { return }
+        let engine = makeEngine()
+        for context in contexts.values {
+            guard let format = AVAudioFormat(standardFormatWithSampleRate: context.graph.sampleRate, channels: 2) else { continue }
+            attachSource(context, format: format, to: engine)
+        }
+        refreshEngine()
+    }
+
     private func refreshEngine() {
         guard live, let engine else { return }
         let playing = contexts.values.contains { $0.running }
@@ -1522,6 +1578,8 @@ final class CraftWebAudio {
     }
 
     private func stopEngine() {
+        if let engineObserver { NotificationCenter.default.removeObserver(engineObserver) }
+        engineObserver = nil
         observers.forEach(NotificationCenter.default.removeObserver)
         observers.removeAll()
         engine?.stop()
@@ -1714,6 +1772,13 @@ final class CraftWebAudio {
     }
 
     var contextIdsForTesting: [Int] { Array(contexts.keys).sorted() }
+    /// The engine and a context's source node, so a test can see that a
+    /// media-services reset replaced them rather than restarting orphans
+    /// (`rebuildEngine`). Posting the notification cannot really orphan them,
+    /// so identity is the only observable; the clock moving afterwards is
+    /// what shows the replacements actually render.
+    var engineForTesting: AVAudioEngine? { engine }
+    func sourceForTesting(_ contextId: Int) -> AVAudioSourceNode? { contexts[contextId]?.source }
 
     // MARK: Helpers