diff --git a/client/components/xero/emulator-inspector-overlay.tsx b/client/components/xero/emulator-inspector-overlay.tsx
new file mode 100644
index 00000000..119248b2
--- /dev/null
+++ b/client/components/xero/emulator-inspector-overlay.tsx
@@ -0,0 +1,266 @@
+"use client"
+
+import { useCallback, useRef } from "react"
+import { Crosshair, ExternalLink, Search, X } from "lucide-react"
+import { cn } from "@/lib/utils"
+import type { ElementInfo, UseInspector } from "@/src/features/emulator/use-inspector"
+
+interface InspectorOverlayProps {
+  /** Device dimensions (in device pixels). */
+  deviceWidth: number
+  deviceHeight: number
+  /** The inspector state from useInspector(). */
+  inspector: UseInspector
+  /** Called when the user clicks an element to open source (RN only). */
+  onOpenSource?: (file: string, line: number, column: number) => void
+  /** Called to search the project for a given AX identifier or label. */
+  onSearchProject?: (query: string) => void
+}
+
+/**
+ * Transparent overlay rendered on top of the emulator frame when inspect
+ * mode is active. Captures ALL pointer events (suppresses touch input to
+ * the device). Queries element-at-point via Metro or AXUIElement, renders
+ * highlight rectangle and info tooltip.
+ */
+export function InspectorOverlay({
+  deviceWidth,
+  deviceHeight,
+  inspector,
+  onOpenSource,
+  onSearchProject,
+}: InspectorOverlayProps) {
+  const overlayRef = useRef<HTMLDivElement>(null)
+
+  // Convert pointer position to device pixels.
+  const toDeviceCoords = useCallback(
+    (e: React.PointerEvent<HTMLDivElement>) => {
+      const rect = e.currentTarget.getBoundingClientRect()
+      if (rect.width === 0 || rect.height === 0) return null
+      const nx = (e.clientX - rect.left) / rect.width
+      const ny = (e.clientY - rect.top) / rect.height
+      return {
+        x: Math.round(nx * deviceWidth),
+        y: Math.round(ny * deviceHeight),
+      }
+    },
+    [deviceWidth, deviceHeight],
+  )
+
+  const handlePointerMove = useCallback(
+    (e: React.PointerEvent<HTMLDivElement>) => {
+      // Suppress event propagation so the device doesn't receive touch input.
+      e.stopPropagation()
+      e.preventDefault()
+      const coords = toDeviceCoords(e)
+      if (!coords) return
+      inspector.elementAt(coords.x, coords.y)
+    },
+    [toDeviceCoords, inspector],
+  )
+
+  const handlePointerDown = useCallback(
+    (e: React.PointerEvent<HTMLDivElement>) => {
+      // Suppress all pointer events — inspect mode owns the viewport.
+      e.stopPropagation()
+      e.preventDefault()
+    },
+    [],
+  )
+
+  const handleClick = useCallback(
+    (e: React.MouseEvent<HTMLDivElement>) => {
+      e.stopPropagation()
+      e.preventDefault()
+      const el = inspector.hoveredElement
+      if (!el) return
+
+      // RN apps: open source file.
+      if (el.source && onOpenSource) {
+        onOpenSource(el.source.file, el.source.line, el.source.column)
+        return
+      }
+
+      // Native apps: search project for AX identifier or label.
+      const searchTerm = el.componentName || el.nativeType
+      if (searchTerm && onSearchProject) {
+        onSearchProject(searchTerm)
+      }
+    },
+    [inspector.hoveredElement, onOpenSource, onSearchProject],
+  )
+
+  const el = inspector.hoveredElement
+  const isNativeMode = el != null && el.source == null
+
+  return (
+    <div
+      ref={overlayRef}
+      className="absolute inset-0 z-20 cursor-crosshair"
+      onPointerDown={handlePointerDown}
+      onPointerMove={handlePointerMove}
+      onPointerUp={handlePointerDown}
+      onClick={handleClick}
+    >
+      {/* Highlight rectangle */}
+      {el && deviceWidth > 0 && (
+        <HighlightBox
+          bounds={el.bounds}
+          deviceWidth={deviceWidth}
+          deviceHeight={deviceHeight}
+        />
+      )}
+
+      {/* Tooltip */}
+      {el && (
+        <ElementTooltip
+          element={el}
+          hasSource={!!onOpenSource}
+          hasSearch={!!onSearchProject}
+          isNativeMode={isNativeMode}
+        />
+      )}
+
+      {/* Inspect mode badge */}
+      <div className="absolute left-2 top-2 flex items-center gap-1.5">
+        <div className="flex items-center gap-1 rounded-md bg-primary/90 px-1.5 py-0.5 text-[10px] font-medium text-primary-foreground shadow-sm">
+          <Crosshair className="h-3 w-3" />
+          Inspect
+        </div>
+        {isNativeMode && (
+          <div className="rounded-md bg-muted/90 px-1.5 py-0.5 text-[9px] text-muted-foreground shadow-sm">
+            Accessibility view — source correlation is best-effort
+          </div>
+        )}
+      </div>
+    </div>
+  )
+}
+
+// MARK: - Subcomponents
+
+function HighlightBox({
+  bounds,
+  deviceWidth,
+  deviceHeight,
+}: {
+  bounds: { x: number; y: number; w: number; h: number }
+  deviceWidth: number
+  deviceHeight: number
+}) {
+  // Convert device coords to percentage-based positioning.
+  const left = `${(bounds.x / deviceWidth) * 100}%`
+  const top = `${(bounds.y / deviceHeight) * 100}%`
+  const width = `${(bounds.w / deviceWidth) * 100}%`
+  const height = `${(bounds.h / deviceHeight) * 100}%`
+
+  return (
+    <div
+      className="pointer-events-none absolute border-2 border-primary/80 bg-primary/10"
+      style={{ left, top, width, height }}
+    />
+  )
+}
+
+function ElementTooltip({
+  element,
+  hasSource,
+  hasSearch,
+  isNativeMode,
+}: {
+  element: ElementInfo
+  hasSource: boolean
+  hasSearch: boolean
+  isNativeMode: boolean
+}) {
+  return (
+    <div className="absolute bottom-2 left-2 right-2 flex flex-col gap-0.5 rounded-md border border-border/60 bg-popover/95 px-2 py-1.5 text-[10px] shadow-md backdrop-blur-sm">
+      {/* Element name + native type */}
+      <div className="flex items-center gap-1.5">
+        <span className="font-semibold text-foreground">
+          {isNativeMode ? (
+            // Native: show AX role/type
+            <>{element.nativeType || "Unknown"}</>
+          ) : (
+            // RN: show component name
+            <>{"<"}{element.componentName || "Unknown"}{" />"}</>
+          )}
+        </span>
+        {!isNativeMode && element.nativeType && (
+          <span className="text-muted-foreground">({element.nativeType})</span>
+        )}
+      </div>
+
+      {/* Label (for native AX elements) */}
+      {isNativeMode && element.componentName && element.componentName !== element.nativeType && (
+        <div className="text-foreground/80">
+          Label: &ldquo;{element.componentName}&rdquo;
+        </div>
+      )}
+
+      {/* Bounds */}
+      <div className="text-muted-foreground">
+        {element.bounds.w}×{element.bounds.h} at ({element.bounds.x}, {element.bounds.y})
+      </div>
+
+      {/* Source location (RN only) */}
+      {element.source && (
+        <div className="flex items-center gap-1 text-primary">
+          <ExternalLink className="h-2.5 w-2.5" />
+          <span className="truncate">
+            {element.source.file.split("/").pop()}:{element.source.line}
+          </span>
+          {hasSource && (
+            <span className="text-muted-foreground/60">(click to open)</span>
+          )}
+        </div>
+      )}
+
+      {/* Search project (native AX — best-effort source correlation) */}
+      {isNativeMode && hasSearch && (element.componentName || element.nativeType) && (
+        <div className="flex items-center gap-1 text-primary">
+          <Search className="h-2.5 w-2.5" />
+          <span className="truncate">
+            Search project for &ldquo;{element.componentName || element.nativeType}&rdquo;
+          </span>
+          <span className="text-muted-foreground/60">(click)</span>
+        </div>
+      )}
+    </div>
+  )
+}
+
+// MARK: - Inspect mode toggle button (for use in toolbar)
+
+export function InspectModeButton({
+  active,
+  connected,
+  disabled,
+  onClick,
+}: {
+  active: boolean
+  connected: boolean
+  disabled?: boolean
+  onClick: () => void
+}) {
+  return (
+    <button
+      aria-label={active ? "Exit inspect mode" : "Enter inspect mode"}
+      aria-pressed={active}
+      className={cn(
+        "inline-flex items-center gap-1 rounded-md border px-2 py-0.5 text-[11px] transition-colors",
+        active
+          ? "border-primary bg-primary/20 text-primary"
+          : "border-border/70 bg-background/60 text-foreground hover:border-primary/50 hover:text-primary",
+        disabled && "opacity-50 cursor-not-allowed",
+      )}
+      disabled={disabled}
+      onClick={onClick}
+      title={connected ? "Inspect React Native elements" : "Inspect UI elements (Accessibility)"}
+      type="button"
+    >
+      <Crosshair className="h-3 w-3" />
+      {active ? "Inspecting" : "Inspect"}
+    </button>
+  )
+}
diff --git a/client/components/xero/emulator-missing-sdk.tsx b/client/components/xero/emulator-missing-sdk.tsx
index 99f459af..82c7b04c 100644
--- a/client/components/xero/emulator-missing-sdk.tsx
+++ b/client/components/xero/emulator-missing-sdk.tsx
@@ -22,6 +22,8 @@ interface SdkStatus {
     idbCompanionPresent: boolean
     supported: boolean
     axPermissionGranted: boolean
+    screenRecordingPermissionGranted: boolean
+    helperPresent: boolean
   }
 }
 
@@ -194,6 +196,15 @@ export function EmulatorMissingSdk({ active = true, platform, onDismiss }: Props
     )
   }
 
+  // Screen Recording permission is needed for the Swift helper's
+  // ScreenCaptureKit frame capture. Show this card when the helper
+  // binary is present but permission hasn't been granted yet.
+  if (status.ios.present && status.ios.helperPresent && !status.ios.screenRecordingPermissionGranted) {
+    return (
+      <IosScreenRecordingPermissionCard isProbing={isProbing} onDismiss={onDismiss} onProbe={probe} />
+    )
+  }
+
   // AX-permission case takes precedence when Xcode is fine but macOS
   // hasn't granted us the Accessibility right. We render a dedicated
   // card because it needs invoke-backed action buttons, not just hrefs.
@@ -323,6 +334,105 @@ function IosAxPermissionCard({
   )
 }
 
+function IosScreenRecordingPermissionCard({
+  isProbing,
+  onDismiss,
+  onProbe,
+}: {
+  isProbing: boolean
+  onDismiss?: () => void
+  onProbe: () => void
+}) {
+  const [busy, setBusy] = useState(false)
+
+  // Poll while this banner is mounted so it disappears within a second
+  // or two of the user granting the permission.
+  useEffect(() => {
+    if (!isTauri()) return
+    const handle = window.setInterval(() => {
+      onProbe()
+    }, 1500)
+    return () => window.clearInterval(handle)
+  }, [onProbe])
+
+  const handlePrompt = useCallback(async () => {
+    if (!isTauri()) return
+    setBusy(true)
+    try {
+      await invoke("emulator_ios_request_screen_recording_permission")
+    } finally {
+      setBusy(false)
+      onProbe()
+    }
+  }, [onProbe])
+
+  const handleOpenSettings = useCallback(async () => {
+    if (!isTauri()) return
+    await invoke("emulator_ios_open_screen_recording_settings")
+  }, [])
+
+  return (
+    <div
+      aria-live="polite"
+      className="flex shrink-0 flex-col gap-2 border-b border-border/60 bg-warning/10 px-3 py-2 text-[11px] leading-relaxed"
+      role="region"
+    >
+      <div className="font-medium text-warning">Screen Recording permission needed</div>
+      <div className="text-muted-foreground">
+        Xero captures the iOS Simulator window for a smooth preview using
+        ScreenCaptureKit — macOS requires Screen Recording permission for this.
+        Without it, Xero falls back to slower screenshot polling. Enable Xero in
+        System Settings → Privacy & Security → Screen Recording.
+      </div>
+      <div className="flex flex-wrap items-center gap-2">
+        <button
+          className={cn(
+            "inline-flex items-center gap-1 rounded-md border border-warning/60 bg-warning/20 px-2 py-0.5",
+            "font-medium text-[11px] text-warning transition-colors hover:border-warning hover:bg-warning/30 disabled:opacity-60",
+          )}
+          disabled={busy}
+          onClick={handleOpenSettings}
+          type="button"
+        >
+          <ExternalLink className="h-3 w-3" />
+          Open Screen Recording settings
+        </button>
+        <button
+          className={cn(
+            "inline-flex items-center gap-1 rounded-md border border-border/70 bg-background/60 px-2 py-0.5",
+            "text-[11px] text-foreground transition-colors hover:border-primary/50 hover:text-primary disabled:opacity-60",
+          )}
+          disabled={busy}
+          onClick={handlePrompt}
+          type="button"
+        >
+          {busy ? <Loader2 className="h-3 w-3 animate-spin" /> : <RefreshCw className="h-3 w-3" />}
+          Prompt macOS
+        </button>
+        <button
+          aria-label="Re-detect permission"
+          className="inline-flex items-center gap-1 rounded-md border border-border/70 bg-background/60 px-2 py-0.5 text-[11px] text-foreground transition-colors hover:border-primary/50 hover:text-primary disabled:opacity-60"
+          disabled={isProbing}
+          onClick={onProbe}
+          type="button"
+        >
+          <RefreshCw className={cn("h-3 w-3", isProbing && "animate-spin")} />
+          Re-check
+        </button>
+        {onDismiss ? (
+          <button
+            className="ml-auto text-[11px] text-muted-foreground/80 underline-offset-2 hover:text-foreground hover:underline"
+            onClick={onDismiss}
+            type="button"
+          >
+            Dismiss
+          </button>
+        ) : null}
+      </div>
+    </div>
+  )
+}
+
 function errorMessage(err: unknown): string {
   if (err && typeof err === "object" && "message" in err) {
     const message = (err as { message?: unknown }).message
diff --git a/client/components/xero/emulator-sidebar.tsx b/client/components/xero/emulator-sidebar.tsx
index 8cdc97a2..77c0f0dc 100644
--- a/client/components/xero/emulator-sidebar.tsx
+++ b/client/components/xero/emulator-sidebar.tsx
@@ -30,7 +30,9 @@ import {
   type EmulatorPlatform,
 } from "@/src/features/emulator/use-emulator-session"
 import { EmulatorHardwareStrip } from "./emulator-hardware-strip"
+import { InspectorOverlay, InspectModeButton } from "./emulator-inspector-overlay"
 import { EmulatorMissingSdk } from "./emulator-missing-sdk"
+import { useInspector } from "@/src/features/emulator/use-inspector"
 
 interface EmulatorSidebarProps {
   open: boolean
@@ -233,6 +235,20 @@ export function EmulatorSidebar({ open, platform }: EmulatorSidebarProps) {
   const [selectedDeviceId, setSelectedDeviceId] = useState<string | null>(null)
 
   const session = useEmulatorSession({ platform, active: sessionActive })
+  const inspector = useInspector()
+
+  // Auto-connect Metro inspector when streaming an iOS session.
+  useEffect(() => {
+    if (session.status.phase === "streaming" && platform === "ios" && !inspector.metroConnected) {
+      inspector.connect().catch(() => {
+        // Metro not running — silent, inspect button stays available.
+      })
+    }
+    if (session.status.phase !== "streaming" && inspector.metroConnected) {
+      inspector.disconnect()
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [session.status.phase, platform])
 
   useEffect(() => {
     if (typeof window === "undefined") return
@@ -317,8 +333,14 @@ export function EmulatorSidebar({ open, platform }: EmulatorSidebarProps) {
   const Icon = platform === "ios" ? Apple : Smartphone
 
   const handleStart = useCallback(() => {
-    if (!selectedDeviceId) return
-    void session.start(selectedDeviceId)
+    // Use selected device, or auto-pick first available device.
+    const deviceId = selectedDeviceId ?? session.devices[0]?.id
+    if (!deviceId) {
+      // Force refresh devices then retry.
+      void session.refreshDevices()
+      return
+    }
+    void session.start(deviceId)
   }, [selectedDeviceId, session])
 
   const handleStop = useCallback(() => {
@@ -441,7 +463,7 @@ export function EmulatorSidebar({ open, platform }: EmulatorSidebarProps) {
         <span className="text-[11px] font-semibold uppercase tracking-[0.1em] text-muted-foreground">
           {meta.label}
         </span>
-        <div className="ml-auto flex items-center gap-1">
+        <div className="ml-auto flex shrink-0 items-center gap-1">
           {session.devices.length > 0 ? (
             <Select
               disabled={isActive}
@@ -476,6 +498,12 @@ export function EmulatorSidebar({ open, platform }: EmulatorSidebarProps) {
               >
                 <RotateCcw className="h-3 w-3" />
               </button>
+              <InspectModeButton
+                active={inspector.inspectMode}
+                connected={inspector.metroConnected}
+                disabled={!isStreaming}
+                onClick={inspector.toggleInspect}
+              />
               <button
                 aria-label="Stop device"
                 className="flex h-6 items-center gap-1 rounded-md border border-border/70 bg-background/60 px-2 text-[11px] text-foreground transition-colors hover:border-destructive/40 hover:text-destructive disabled:opacity-60"
@@ -495,7 +523,7 @@ export function EmulatorSidebar({ open, platform }: EmulatorSidebarProps) {
             <button
               aria-label="Start device"
               className="flex h-6 items-center gap-1 rounded-md border border-border/70 bg-background/60 px-2 text-[11px] text-foreground transition-colors hover:border-primary/40 hover:text-primary disabled:opacity-60"
-              disabled={!selectedDeviceId || session.isStarting}
+              disabled={session.isStarting}
               onClick={handleStart}
               type="button"
             >
@@ -504,7 +532,7 @@ export function EmulatorSidebar({ open, platform }: EmulatorSidebarProps) {
               ) : (
                 <Play className="h-3 w-3" />
               )}
-              Start
+              {session.devices.length === 0 ? "Loading..." : "Start"}
             </button>
           )}
         </div>
@@ -517,6 +545,7 @@ export function EmulatorSidebar({ open, platform }: EmulatorSidebarProps) {
         error={session.error}
         frameSeq={session.frame?.seq ?? null}
         inputError={session.inputError}
+        inspector={inspector}
         isStreaming={isStreaming}
         onDismissInputError={session.dismissInputError}
         onInput={(payload) => void session.sendInput(payload)}
@@ -542,6 +571,7 @@ interface ViewportProps {
   error: string | null
   frameSeq: number | null
   inputError: string | null
+  inspector: ReturnType<typeof useInspector>
   isStreaming: boolean
   onDismissInputError: () => void
   onInput: (input: { kind: EmulatorInputKind; x?: number; y?: number }) => void
@@ -557,6 +587,7 @@ function EmulatorViewport({
   error,
   frameSeq,
   inputError,
+  inspector,
   isStreaming,
   onDismissInputError,
   onInput,
@@ -706,6 +737,18 @@ function EmulatorViewport({
             onLoad={settleFrameRequest}
             src={frameSrc}
           />
+          {inspector.inspectMode && currentDevice && (
+            <InspectorOverlay
+              deviceWidth={currentDevice.width}
+              deviceHeight={currentDevice.height}
+              inspector={inspector}
+              onSearchProject={(query) => {
+                // TODO: Wire to editor search command when available.
+                // For now, copy to clipboard as a bridging affordance.
+                navigator.clipboard?.writeText(query).catch(() => {})
+              }}
+            />
+          )}
           {isIos && !isTablet ? <DynamicIsland /> : null}
           {isIos && !isTablet ? <HomeIndicator /> : null}
         </div>
diff --git a/client/src-tauri/.cargo/config.toml b/client/src-tauri/.cargo/config.toml
index 8d1712a8..50a051be 100644
--- a/client/src-tauri/.cargo/config.toml
+++ b/client/src-tauri/.cargo/config.toml
@@ -14,3 +14,9 @@
 # SFSpeechRecognizer path (which works on all deployment targets).
 [env]
 MACOSX_DEPLOYMENT_TARGET = "26.0"
+
+[target.aarch64-apple-darwin]
+rustflags = [
+    "-L", "/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/lib",
+    "-L", "/usr/lib",
+]
diff --git a/client/src-tauri/Cargo.lock b/client/src-tauri/Cargo.lock
index dc3d8ca0..e8614bf9 100644
--- a/client/src-tauri/Cargo.lock
+++ b/client/src-tauri/Cargo.lock
@@ -1461,6 +1461,12 @@ dependencies = [
  "parking_lot_core",
 ]
 
+[[package]]
+name = "data-encoding"
+version = "2.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
+
 [[package]]
 name = "datafusion"
 version = "52.5.0"
@@ -7471,6 +7477,17 @@ dependencies = [
  "stable_deref_trait",
 ]
 
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.2.17",
+ "digest",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -8915,6 +8932,24 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.8.5",
+ "sha1",
+ "thiserror 1.0.69",
+ "utf-8",
+]
+
 [[package]]
 name = "twox-hash"
 version = "2.1.2"
@@ -10326,6 +10361,7 @@ dependencies = [
  "tokio-stream",
  "tonic",
  "tonic-build",
+ "tungstenite",
  "url",
  "xcap",
  "zip",
diff --git a/client/src-tauri/Cargo.toml b/client/src-tauri/Cargo.toml
index f56afa36..8042ab55 100644
--- a/client/src-tauri/Cargo.toml
+++ b/client/src-tauri/Cargo.toml
@@ -33,11 +33,12 @@ reqwest = { version = "0.12", default-features = false, features = ["blocking",
 tar = "0.4"
 
 [features]
-# Keep dev startup lean. `ios-grpc` remains available for full iOS
-# Simulator HID/streaming work, but the default build uses the
-# simctl-screenshot + AppleScript fallback to avoid pulling tonic/prost
-# into every `tauri dev` boot.
-default = []
+# ios-grpc is default so touch/swipe/HID input works out of the box
+# via idb_companion. The Swift helper (ScreenCaptureKit + IndigoHID) is
+# the primary input path; ios-grpc is the fallback when the helper is
+# unavailable. Without ios-grpc, touch and swipe fall back to
+# AppleScript click-only which can't handle drag gestures.
+default = ["ios-grpc"]
 # When enabled, `emulator_start` spins up a color-cycling frame generator
 # instead of launching a real device. Used for end-to-end testing of the
 # frame pipeline without an Android SDK / Xcode.
@@ -54,6 +55,11 @@ emulator-live = ["dep:openh264", "ios-grpc"]
 # and accessibility-tree/log RPCs; builds without this feature fall back to
 # a simctl-screenshot poll + AppleScript HID where possible.
 ios-grpc = ["dep:tonic", "dep:tonic-build", "dep:protoc-bin-vendored", "dep:prost", "dep:tokio-stream"]
+# Enables compilation of the Swift ios-helper binary (xero-ios-helper) in
+# build.rs. The helper uses ScreenCaptureKit for 30 FPS frame capture and
+# IndigoHID for reliable input injection. Runtime detection works regardless
+# of this feature — if the binary exists on disk, the session will use it.
+ios-helper = []
 
 [dependencies]
 arc-swap = "1"
@@ -94,6 +100,7 @@ time = { version = "0.3", features = ["formatting"] }
 tokio = { version = "1", features = ["rt-multi-thread", "sync", "macros"] }
 tokio-stream = { version = "0.1", optional = true }
 tonic = { version = "0.12", optional = true }
+tungstenite = "0.24"
 url = "2"
 tar = "0.4"
 zip = { version = "2", default-features = false, features = ["deflate"] }
diff --git a/client/src-tauri/build.rs b/client/src-tauri/build.rs
index 50dc7369..6247f64d 100644
--- a/client/src-tauri/build.rs
+++ b/client/src-tauri/build.rs
@@ -22,6 +22,7 @@ fn main() {
     configure_custom_cfgs();
     tauri_build::build();
     compile_dictation_shim();
+    compile_ios_helper();
     build_cookie_importer();
     fetch_scrcpy_server();
     fetch_idb_companion();
@@ -151,6 +152,142 @@ fn compile_dictation_shim() {
     println!("cargo:rustc-cfg=xero_dictation_native_shim");
 }
 
+/// Compile the Swift helper binary (`xero-ios-helper`) that uses
+/// ScreenCaptureKit for frame capture and IndigoHID for input injection.
+/// The binary is a standalone executable (not a static library) that
+/// communicates with the Tauri Rust backend over a Unix domain socket.
+///
+/// Unlike `compile_dictation_shim()` which produces a `.a` linked into the
+/// main binary, this produces an independent executable copied next to the
+/// Tauri output binary.
+#[cfg(target_os = "macos")]
+fn compile_ios_helper() {
+    let manifest_dir = PathBuf::from(std::env::var("CARGO_MANIFEST_DIR").unwrap());
+    let helper_dir = manifest_dir.join("native/ios-helper");
+
+    println!("cargo:rerun-if-changed=native/ios-helper/Main.swift");
+    println!("cargo:rerun-if-changed=native/ios-helper/Connection.swift");
+    println!("cargo:rerun-if-changed=native/ios-helper/FrameCapture.swift");
+    println!("cargo:rerun-if-changed=native/ios-helper/HidBridge.swift");
+    println!("cargo:rerun-if-changed=native/ios-helper/JpegEncoder.swift");
+    println!("cargo:rerun-if-changed=native/ios-helper/AccessibilityBridge.swift");
+    println!("cargo:rerun-if-env-changed=XERO_SKIP_IOS_HELPER");
+
+    if std::env::var_os("XERO_SKIP_IOS_HELPER").is_some() {
+        println!(
+            "cargo:warning=XERO_SKIP_IOS_HELPER is set; iOS helper binary will not be compiled."
+        );
+        return;
+    }
+
+    let Some(swiftc) = xcrun_find("swiftc") else {
+        println!(
+            "cargo:warning=swiftc not found via xcrun; iOS helper binary will not be compiled."
+        );
+        return;
+    };
+    let Some(sdk_path) = xcrun_output(&["--sdk", "macosx", "--show-sdk-path"]) else {
+        println!(
+            "cargo:warning=macOS SDK path not found; iOS helper binary will not be compiled."
+        );
+        return;
+    };
+
+    // Check that ScreenCaptureKit is available (macOS 12.3+ SDK).
+    let sdk_version = xcrun_output(&["--sdk", "macosx", "--show-sdk-version"]).unwrap_or_default();
+    let major: u32 = sdk_version
+        .split('.')
+        .next()
+        .and_then(|s| s.parse().ok())
+        .unwrap_or(0);
+    if major < 12 {
+        println!(
+            "cargo:warning=macOS SDK {sdk_version} < 12.3; ScreenCaptureKit unavailable. \
+             iOS helper binary will not be compiled."
+        );
+        return;
+    }
+
+    let out_dir = PathBuf::from(std::env::var("OUT_DIR").unwrap());
+    let output = out_dir.join("xero-ios-helper");
+
+    let sources = [
+        helper_dir.join("Main.swift"),
+        helper_dir.join("Connection.swift"),
+        helper_dir.join("FrameCapture.swift"),
+        helper_dir.join("HidBridge.swift"),
+        helper_dir.join("JpegEncoder.swift"),
+        helper_dir.join("AccessibilityBridge.swift"),
+    ];
+
+    let status = Command::new(&swiftc)
+        .arg("-parse-as-library")
+        .arg("-module-name")
+        .arg("XeroIosHelper")
+        .arg("-sdk")
+        .arg(&sdk_path)
+        .arg("-O")
+        .arg("-framework")
+        .arg("ScreenCaptureKit")
+        .arg("-framework")
+        .arg("CoreGraphics")
+        .arg("-framework")
+        .arg("ImageIO")
+        .arg("-framework")
+        .arg("Foundation")
+        .arg("-framework")
+        .arg("CoreMedia")
+        .arg("-framework")
+        .arg("ApplicationServices")
+        .arg("-framework")
+        .arg("AppKit")
+        .arg("-o")
+        .arg(&output)
+        .args(sources.iter())
+        .status()
+        .expect("failed to spawn swiftc for iOS helper");
+
+    if !status.success() {
+        // Non-fatal: the helper is optional. The session falls back to
+        // idb_companion / screenshot polling when the binary is absent.
+        println!(
+            "cargo:warning=failed to compile xero-ios-helper (exit {status:?}); \
+             iOS Simulator will use fallback paths."
+        );
+        return;
+    }
+
+    // Copy the binary next to the Tauri output executable so it can be
+    // discovered by `helper::resolve_helper_binary()` during development.
+    // In bundled builds the binary is included via tauri.conf.json resources.
+    let profile_dir = out_dir
+        .ancestors()
+        .nth(3)
+        .expect("OUT_DIR should be inside target/<profile>/build/<pkg>/out")
+        .to_path_buf();
+    let destination = profile_dir.join("xero-ios-helper");
+    if let Err(e) = std::fs::copy(&output, &destination) {
+        println!(
+            "cargo:warning=failed to copy xero-ios-helper to {}: {e}",
+            destination.display()
+        );
+    }
+
+    // Also copy to resources/ for Tauri bundling.
+    let resources_dir = manifest_dir.join("resources");
+    let res_destination = resources_dir.join("xero-ios-helper");
+    if let Err(e) = std::fs::copy(&output, &res_destination) {
+        println!(
+            "cargo:warning=failed to copy xero-ios-helper to resources/: {e}"
+        );
+    }
+}
+
+#[cfg(not(target_os = "macos"))]
+fn compile_ios_helper() {
+    // No-op on non-macOS hosts.
+}
+
 fn xcrun_find(tool: &str) -> Option<PathBuf> {
     xcrun_output(&["--find", tool]).map(PathBuf::from)
 }
diff --git a/client/src-tauri/native/ios-helper/AccessibilityBridge.swift b/client/src-tauri/native/ios-helper/AccessibilityBridge.swift
new file mode 100644
index 00000000..8e46a75c
--- /dev/null
+++ b/client/src-tauri/native/ios-helper/AccessibilityBridge.swift
@@ -0,0 +1,212 @@
+// AccessibilityBridge.swift — AXUIElement inspection for native Swift apps.
+//
+// Uses the macOS Accessibility API (AXUIElement) to inspect the Simulator
+// process's UI element tree. This provides element-at-point inspection for
+// native iOS apps (SwiftUI, UIKit) that don't have a Metro inspector.
+//
+// The AXUIElement API sees the Simulator.app's AX tree from the host Mac
+// perspective. Elements contain: role, title, value, identifier, enabled,
+// focused, and frame (in screen coordinates).
+//
+// Requires Accessibility permission (same as cg_input.rs).
+
+import Foundation
+import ApplicationServices
+import AppKit
+
+class AccessibilityBridge {
+
+    /// Dump the full accessibility tree of the Simulator process.
+    /// Returns a JSON-serializable dictionary matching the UiNode shape
+    /// expected by the Rust `normalize_tree()` function in ios_ui.rs.
+    func dumpTree() -> Result<[String: Any], HelperError> {
+        guard let simPid = findSimulatorPid() else {
+            return .failure(.captureError("Simulator.app not running"))
+        }
+
+        let appElement = AXUIElementCreateApplication(simPid)
+
+        // Get the main window's content area.
+        var windowValue: CFTypeRef?
+        let windowResult = AXUIElementCopyAttributeValue(appElement, kAXFocusedWindowAttribute as CFString, &windowValue)
+
+        let rootElement: AXUIElement
+        if windowResult == .success, let window = windowValue {
+            rootElement = (window as! AXUIElement)
+        } else {
+            // Fallback: use the app element directly.
+            rootElement = appElement
+        }
+
+        guard let tree = elementToDict(rootElement, depth: 0) else {
+            return .failure(.captureError("failed to read AX tree from Simulator"))
+        }
+
+        return .success(tree)
+    }
+
+    /// Get the element at a specific screen coordinate.
+    /// Returns a dictionary matching the UiNode shape.
+    func elementAtPoint(x: Float, y: Float) -> Result<[String: Any], HelperError> {
+        guard let simPid = findSimulatorPid() else {
+            return .failure(.captureError("Simulator.app not running"))
+        }
+
+        let appElement = AXUIElementCreateApplication(simPid)
+        var elementRef: AXUIElement?
+        let point = CGPoint(x: CGFloat(x), y: CGFloat(y))
+
+        let result = AXUIElementCopyElementAtPosition(appElement, Float(point.x), Float(point.y), &elementRef)
+
+        guard result == .success, let element = elementRef else {
+            return .failure(.captureError("no AX element at (\(x), \(y))"))
+        }
+
+        guard let dict = elementToDict(element, depth: 0) else {
+            return .failure(.captureError("failed to read AX element properties"))
+        }
+
+        return .success(dict)
+    }
+
+    // MARK: - Private
+
+    private func findSimulatorPid() -> pid_t? {
+        let workspace = NSWorkspace.shared
+        for app in workspace.runningApplications {
+            if app.bundleIdentifier == "com.apple.iphonesimulator" {
+                return app.processIdentifier
+            }
+        }
+        return nil
+    }
+
+    /// Convert an AXUIElement to a dictionary matching the format that
+    /// `normalize_tree()` in ios_ui.rs expects:
+    /// {
+    ///   "type": "AXButton",          // maps to platform_role
+    ///   "identifier": "...",          // AX identifier
+    ///   "label": "...",               // AX title/description
+    ///   "value": "...",               // AX value
+    ///   "enabled": true,
+    ///   "focused": false,
+    ///   "frame": { "x": .., "y": .., "w": .., "h": .. },
+    ///   "children": [ ... ]
+    /// }
+    private func elementToDict(_ element: AXUIElement, depth: Int) -> [String: Any]? {
+        guard depth < 40 else { return nil } // Prevent infinite recursion.
+
+        var dict: [String: Any] = [:]
+
+        // Role
+        if let role = axString(element, kAXRoleAttribute as CFString) {
+            dict["type"] = role
+        } else {
+            dict["type"] = "AXUnknown"
+        }
+
+        // Identifier (AXIdentifier)
+        if let identifier = axString(element, kAXIdentifierAttribute as CFString) {
+            dict["identifier"] = identifier
+        } else {
+            dict["identifier"] = ""
+        }
+
+        // Label: prefer AXTitle, fall back to AXDescription
+        if let title = axString(element, kAXTitleAttribute as CFString), !title.isEmpty {
+            dict["label"] = title
+        } else if let desc = axString(element, kAXDescriptionAttribute as CFString), !desc.isEmpty {
+            dict["label"] = desc
+        } else {
+            dict["label"] = ""
+        }
+
+        // Value
+        if let value = axString(element, kAXValueAttribute as CFString) {
+            dict["value"] = value
+        } else {
+            dict["value"] = ""
+        }
+
+        // Enabled
+        dict["enabled"] = axBool(element, kAXEnabledAttribute as CFString) ?? true
+
+        // Focused
+        dict["focused"] = axBool(element, kAXFocusedAttribute as CFString) ?? false
+
+        // Frame (screen coordinates)
+        let frame = axFrame(element)
+        dict["frame"] = [
+            "x": frame.origin.x,
+            "y": frame.origin.y,
+            "w": frame.size.width,
+            "h": frame.size.height,
+        ]
+
+        // Children (recursive)
+        var children: [[String: Any]] = []
+        if let axChildren = axArray(element, kAXChildrenAttribute as CFString) {
+            for child in axChildren {
+                let childElement = child as! AXUIElement
+                if let childDict = elementToDict(childElement, depth: depth + 1) {
+                    children.append(childDict)
+                }
+            }
+        }
+        dict["children"] = children
+
+        return dict
+    }
+
+    // MARK: - AX attribute helpers
+
+    private func axString(_ element: AXUIElement, _ attribute: CFString) -> String? {
+        var value: CFTypeRef?
+        guard AXUIElementCopyAttributeValue(element, attribute, &value) == .success else {
+            return nil
+        }
+        return value as? String
+    }
+
+    private func axBool(_ element: AXUIElement, _ attribute: CFString) -> Bool? {
+        var value: CFTypeRef?
+        guard AXUIElementCopyAttributeValue(element, attribute, &value) == .success else {
+            return nil
+        }
+        if let num = value as? NSNumber {
+            return num.boolValue
+        }
+        return nil
+    }
+
+    private func axArray(_ element: AXUIElement, _ attribute: CFString) -> [AnyObject]? {
+        var value: CFTypeRef?
+        guard AXUIElementCopyAttributeValue(element, attribute, &value) == .success else {
+            return nil
+        }
+        return value as? [AnyObject]
+    }
+
+    private func axFrame(_ element: AXUIElement) -> CGRect {
+        var position = CGPoint.zero
+        var size = CGSize.zero
+
+        var posValue: CFTypeRef?
+        if AXUIElementCopyAttributeValue(element, kAXPositionAttribute as CFString, &posValue) == .success,
+           let posValue = posValue {
+            var point = CGPoint.zero
+            AXValueGetValue(posValue as! AXValue, .cgPoint, &point)
+            position = point
+        }
+
+        var sizeValue: CFTypeRef?
+        if AXUIElementCopyAttributeValue(element, kAXSizeAttribute as CFString, &sizeValue) == .success,
+           let sizeValue = sizeValue {
+            var s = CGSize.zero
+            AXValueGetValue(sizeValue as! AXValue, .cgSize, &s)
+            size = s
+        }
+
+        return CGRect(origin: position, size: size)
+    }
+}
diff --git a/client/src-tauri/native/ios-helper/Connection.swift b/client/src-tauri/native/ios-helper/Connection.swift
new file mode 100644
index 00000000..1d3b659f
--- /dev/null
+++ b/client/src-tauri/native/ios-helper/Connection.swift
@@ -0,0 +1,291 @@
+// Connection.swift — UDS server + binary framing protocol.
+//
+// Framing:
+//   [1 byte type][4 bytes payload length BE][payload bytes]
+//
+// Types:
+//   0x01 — JSON control message (UTF-8)
+//   0x02 — Frame: payload = [4B width BE][4B height BE][JPEG bytes]
+
+import Foundation
+
+// MARK: - Error types
+
+enum HelperError: Error, CustomStringConvertible {
+    case invalidParams(String)
+    case unknownMethod(String)
+    case captureError(String)
+    case hidError(String)
+    case socketError(String)
+    case timeout
+
+    var description: String {
+        switch self {
+        case .invalidParams(let m): return "invalid_params: \(m)"
+        case .unknownMethod(let m): return "unknown_method: \(m)"
+        case .captureError(let m): return "capture_error: \(m)"
+        case .hidError(let m): return "hid_error: \(m)"
+        case .socketError(let m): return "socket_error: \(m)"
+        case .timeout: return "timeout"
+        }
+    }
+
+    var code: String {
+        switch self {
+        case .invalidParams: return "invalid_params"
+        case .unknownMethod: return "unknown_method"
+        case .captureError: return "capture_error"
+        case .hidError: return "hid_error"
+        case .socketError: return "socket_error"
+        case .timeout: return "timeout"
+        }
+    }
+}
+
+// MARK: - Request/Response types
+
+struct HelperRequest {
+    let id: Int
+    let method: String
+    let params: [String: Any]?
+}
+
+typealias ResponseCallback = (Result<[String: Any], HelperError>) -> Void
+
+// MARK: - Message types
+
+private let msgTypeJSON: UInt8 = 0x01
+private let msgTypeFrame: UInt8 = 0x02
+
+// MARK: - Connection
+
+class Connection {
+    let socketPath: String
+    var onRequest: ((HelperRequest, @escaping ResponseCallback) -> Void)?
+
+    private var serverFd: Int32 = -1
+    private var clientFd: Int32 = -1
+    private let writeLock = NSLock()
+    private var readThread: Thread?
+    private var alive = true
+
+    init(socketPath: String) {
+        self.socketPath = socketPath
+    }
+
+    // MARK: - Server lifecycle
+
+    /// Bind and listen on the UDS, then accept a client on a background
+    /// thread. This does NOT block the main thread — RunLoop.main must
+    /// be running for ScreenCaptureKit async callbacks to fire.
+    func acceptAndServe() {
+        // Remove stale socket file.
+        unlink(socketPath)
+
+        serverFd = socket(AF_UNIX, SOCK_STREAM, 0)
+        guard serverFd >= 0 else {
+            fputs("failed to create socket: \(errno)\n", stderr)
+            Foundation.exit(1)
+        }
+
+        var addr = sockaddr_un()
+        addr.sun_family = sa_family_t(AF_UNIX)
+        let pathBytes = socketPath.utf8CString
+        guard pathBytes.count <= MemoryLayout.size(ofValue: addr.sun_path) else {
+            fputs("socket path too long\n", stderr)
+            Foundation.exit(1)
+        }
+        _ = withUnsafeMutablePointer(to: &addr.sun_path) { sunPath in
+            pathBytes.withUnsafeBufferPointer { buf in
+                memcpy(sunPath, buf.baseAddress!, buf.count)
+            }
+        }
+
+        let bindResult = withUnsafePointer(to: &addr) { ptr in
+            ptr.withMemoryRebound(to: sockaddr.self, capacity: 1) { sockPtr in
+                bind(serverFd, sockPtr, socklen_t(MemoryLayout<sockaddr_un>.size))
+            }
+        }
+        guard bindResult == 0 else {
+            fputs("failed to bind \(socketPath): \(errno)\n", stderr)
+            Foundation.exit(1)
+        }
+
+        guard listen(serverFd, 1) == 0 else {
+            fputs("failed to listen: \(errno)\n", stderr)
+            Foundation.exit(1)
+        }
+
+        // Accept on a BACKGROUND thread so the main RunLoop stays free
+        // for ScreenCaptureKit / GCD callbacks.
+        let acceptThread = Thread {
+            let fd = accept(self.serverFd, nil, nil)
+            guard fd >= 0 else {
+                fputs("accept failed: \(errno)\n", stderr)
+                return
+            }
+            self.clientFd = fd
+
+            // Start reader thread for incoming messages.
+            self.readThread = Thread {
+                self.readLoop()
+            }
+            self.readThread?.name = "xero-ios-helper-reader"
+            self.readThread?.start()
+        }
+        acceptThread.name = "xero-ios-helper-accept"
+        acceptThread.start()
+    }
+
+    func close() {
+        alive = false
+        if clientFd >= 0 { Darwin.close(clientFd); clientFd = -1 }
+        if serverFd >= 0 { Darwin.close(serverFd); serverFd = -1 }
+        unlink(socketPath)
+    }
+
+    // MARK: - Read loop
+
+    private func readLoop() {
+        while alive && clientFd >= 0 {
+            guard let (msgType, payload) = readMessage() else {
+                // Connection closed or error.
+                alive = false
+                break
+            }
+
+            if msgType == msgTypeJSON {
+                handleJSONMessage(payload)
+            }
+            // Type 0x02 (frame) is outbound-only; ignore if received.
+        }
+    }
+
+    private func handleJSONMessage(_ data: Data) {
+        guard let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let id = json["id"] as? Int,
+              let method = json["method"] as? String else {
+            return
+        }
+
+        let params = json["params"] as? [String: Any]
+        let request = HelperRequest(id: id, method: method, params: params)
+
+        onRequest?(request) { [weak self] result in
+            var response: [String: Any] = ["id": id]
+            switch result {
+            case .success(let payload):
+                response.merge(payload) { _, new in new }
+            case .failure(let error):
+                response["error"] = ["code": error.code, "message": error.description]
+            }
+            self?.sendJSON(response)
+        }
+    }
+
+    // MARK: - Write methods
+
+    func sendFrame(jpeg: Data, width: Int, height: Int) {
+        // Frame payload: [4B width BE][4B height BE][JPEG bytes]
+        var payload = Data(capacity: 8 + jpeg.count)
+        payload.appendBE(UInt32(width))
+        payload.appendBE(UInt32(height))
+        payload.append(jpeg)
+        writeMessage(type: msgTypeFrame, payload: payload)
+    }
+
+    func sendJSON(_ object: [String: Any]) {
+        guard let data = try? JSONSerialization.data(withJSONObject: object) else { return }
+        writeMessage(type: msgTypeJSON, payload: data)
+    }
+
+    func sendEvent(code: String, message: String) {
+        sendJSON(["event": "error", "code": code, "message": message])
+    }
+
+    // MARK: - Framing primitives
+
+    private func writeMessage(type: UInt8, payload: Data) {
+        writeLock.lock()
+        defer { writeLock.unlock() }
+
+        guard clientFd >= 0 else { return }
+
+        // Header: [1B type][4B length BE]
+        var header = Data(capacity: 5)
+        header.append(type)
+        header.appendBE(UInt32(payload.count))
+
+        let headerOk = header.withUnsafeBytes { ptr in
+            writeAll(fd: clientFd, ptr.baseAddress!, ptr.count)
+        }
+        guard headerOk else { return }
+
+        payload.withUnsafeBytes { ptr in
+            _ = writeAll(fd: clientFd, ptr.baseAddress!, ptr.count)
+        }
+    }
+
+    private func readMessage() -> (UInt8, Data)? {
+        // Read header: 1 byte type + 4 bytes length.
+        guard let header = readExact(count: 5) else { return nil }
+        let msgType = header[0]
+        let length = header.readBE(at: 1) as UInt32
+
+        guard length <= 50_000_000 else {
+            // Sanity limit: 50MB max message.
+            fputs("message too large: \(length)\n", stderr)
+            return nil
+        }
+
+        guard let payload = readExact(count: Int(length)) else { return nil }
+        return (msgType, payload)
+    }
+
+    private func readExact(count: Int) -> Data? {
+        var buf = Data(count: count)
+        var offset = 0
+        while offset < count {
+            let n = buf.withUnsafeMutableBytes { ptr in
+                read(clientFd, ptr.baseAddress!.advanced(by: offset), count - offset)
+            }
+            if n <= 0 { return nil }
+            offset += n
+        }
+        return buf
+    }
+
+    @discardableResult
+    private func writeAll(fd: Int32, _ ptr: UnsafeRawPointer, _ count: Int) -> Bool {
+        var offset = 0
+        while offset < count {
+            let n = write(fd, ptr.advanced(by: offset), count - offset)
+            if n <= 0 {
+                if errno == EAGAIN || errno == EWOULDBLOCK { continue }
+                return false
+            }
+            offset += n
+        }
+        return true
+    }
+}
+
+// MARK: - Data extensions for big-endian encoding
+
+private extension Data {
+    mutating func appendBE(_ value: UInt32) {
+        var be = value.bigEndian
+        Swift.withUnsafeBytes(of: &be) { ptr in
+            self.append(contentsOf: ptr)
+        }
+    }
+
+    func readBE(at offset: Int) -> UInt32 {
+        guard self.count >= offset + 4 else { return 0 }
+        let b0 = self[self.startIndex + offset]
+        let b1 = self[self.startIndex + offset + 1]
+        let b2 = self[self.startIndex + offset + 2]
+        let b3 = self[self.startIndex + offset + 3]
+        return (UInt32(b0) << 24) | (UInt32(b1) << 16) | (UInt32(b2) << 8) | UInt32(b3)
+    }
+}
diff --git a/client/src-tauri/native/ios-helper/FrameCapture.swift b/client/src-tauri/native/ios-helper/FrameCapture.swift
new file mode 100644
index 00000000..f4273123
--- /dev/null
+++ b/client/src-tauri/native/ios-helper/FrameCapture.swift
@@ -0,0 +1,180 @@
+// FrameCapture.swift — ScreenCaptureKit frame capture.
+//
+// Captures the iOS Simulator window at the requested frame rate and
+// delivers JPEG-encoded frames via the `onFrame` callback.
+
+import Foundation
+import ScreenCaptureKit
+import CoreMedia
+import CoreGraphics
+
+@available(macOS 12.3, *)
+class FrameCapture: NSObject, SCStreamOutput {
+
+    let udid: String
+    var onFrame: ((Data, Int, Int) -> Void)?
+    var onError: ((String, String) -> Void)?
+
+    private var stream: SCStream?
+    private var isCapturing = false
+    private let encoder = JpegEncoder()
+
+    init(udid: String) {
+        self.udid = udid
+        super.init()
+    }
+
+    // MARK: - Start / Stop
+
+    struct Dimensions {
+        let width: Int
+        let height: Int
+    }
+
+    func start(fps: Int, completion: @escaping (Result<Dimensions, HelperError>) -> Void) {
+        guard !isCapturing else {
+            completion(.failure(.captureError("already capturing")))
+            return
+        }
+
+        findSimulatorWindow { [weak self] result in
+            guard let self = self else { return }
+            switch result {
+            case .failure(let err):
+                completion(.failure(err))
+            case .success(let window):
+                self.startStream(window: window, fps: fps, completion: completion)
+            }
+        }
+    }
+
+    func stop() {
+        guard isCapturing, let stream = stream else { return }
+        isCapturing = false
+        stream.stopCapture { error in
+            if let error = error {
+                fputs("stop capture error: \(error)\n", stderr)
+            }
+        }
+        self.stream = nil
+    }
+
+    // MARK: - Window discovery
+
+    private func findSimulatorWindow(
+        completion: @escaping (Result<SCWindow, HelperError>) -> Void
+    ) {
+        SCShareableContent.getExcludingDesktopWindows(true, onScreenWindowsOnly: false) { [weak self] content, error in
+            guard let self = self else { return }
+
+            if let error = error {
+                let nsError = error as NSError
+                // Code 1 typically means Screen Recording permission denied.
+                if nsError.domain == "com.apple.ScreenCaptureKit.SCStreamErrorDomain" {
+                    self.onError?("screen_recording_denied", "Screen Recording permission required")
+                    completion(.failure(.captureError("screen_recording_denied")))
+                    return
+                }
+                completion(.failure(.captureError(error.localizedDescription)))
+                return
+            }
+
+            guard let content = content else {
+                completion(.failure(.captureError("no shareable content")))
+                return
+            }
+
+            // Find the Simulator app.
+            let simApp = content.applications.first { app in
+                app.bundleIdentifier == "com.apple.iphonesimulator"
+            }
+
+            guard let simApp = simApp else {
+                completion(.failure(.captureError("Simulator.app not running")))
+                return
+            }
+
+            // Find the window whose title contains the device name.
+            // Simulator window titles look like "iPhone 17 Pro — iOS 26.0".
+            // We match against the UDID device name resolved by the Rust side.
+            let simWindows = content.windows.filter { window in
+                window.owningApplication?.bundleIdentifier == simApp.bundleIdentifier
+                    && window.isOnScreen
+            }
+
+            // Prefer the largest on-screen window (the device viewport).
+            let window = simWindows.max(by: { a, b in
+                (a.frame.width * a.frame.height) < (b.frame.width * b.frame.height)
+            })
+
+            guard let window = window else {
+                completion(.failure(.captureError("no Simulator window found for \(self.udid)")))
+                return
+            }
+
+            completion(.success(window))
+        }
+    }
+
+    // MARK: - Stream setup
+
+    private func startStream(
+        window: SCWindow,
+        fps: Int,
+        completion: @escaping (Result<Dimensions, HelperError>) -> Void
+    ) {
+        let filter = SCContentFilter(desktopIndependentWindow: window)
+        let config = SCStreamConfiguration()
+        config.minimumFrameInterval = CMTime(value: 1, timescale: CMTimeScale(fps))
+        config.pixelFormat = kCVPixelFormatType_32BGRA
+        config.showsCursor = false
+        // Match the window's native resolution.
+        config.width = Int(window.frame.width * 2)  // Retina
+        config.height = Int(window.frame.height * 2)
+
+        let newStream = SCStream(filter: filter, configuration: config, delegate: nil)
+        do {
+            try newStream.addStreamOutput(self, type: .screen, sampleHandlerQueue: .global(qos: .userInteractive))
+        } catch {
+            completion(.failure(.captureError("addStreamOutput: \(error)")))
+            return
+        }
+
+        newStream.startCapture { [weak self] error in
+            if let error = error {
+                completion(.failure(.captureError("startCapture: \(error)")))
+                return
+            }
+            self?.stream = newStream
+            self?.isCapturing = true
+            completion(.success(Dimensions(
+                width: Int(window.frame.width * 2),
+                height: Int(window.frame.height * 2)
+            )))
+        }
+    }
+
+    // MARK: - SCStreamOutput
+
+    func stream(_ stream: SCStream, didOutputSampleBuffer sampleBuffer: CMSampleBuffer, of type: SCStreamOutputType) {
+        guard type == .screen, isCapturing else { return }
+        guard let pixelBuffer = CMSampleBufferGetImageBuffer(sampleBuffer) else { return }
+
+        let width = CVPixelBufferGetWidth(pixelBuffer)
+        let height = CVPixelBufferGetHeight(pixelBuffer)
+
+        guard let jpeg = encoder.encode(pixelBuffer: pixelBuffer) else { return }
+        onFrame?(jpeg, width, height)
+    }
+}
+
+// Fallback for macOS < 12.3 — this file won't be reached at runtime
+// because build.rs checks SDK version, but the compiler needs the type.
+@available(macOS, obsoleted: 12.3, message: "ScreenCaptureKit unavailable")
+class FrameCaptureFallback {
+    init(udid: String) {}
+    func start(fps: Int, completion: @escaping (Result<(width: Int, height: Int), HelperError>) -> Void) {
+        completion(.failure(.captureError("ScreenCaptureKit requires macOS 12.3+")))
+    }
+    func stop() {}
+}
diff --git a/client/src-tauri/native/ios-helper/HidBridge.swift b/client/src-tauri/native/ios-helper/HidBridge.swift
new file mode 100644
index 00000000..725f9151
--- /dev/null
+++ b/client/src-tauri/native/ios-helper/HidBridge.swift
@@ -0,0 +1,362 @@
+// HidBridge.swift — IndigoHID mach IPC for Simulator input injection.
+//
+// Communicates with the Simulator's Indigo HID mach service to inject
+// touch, swipe, text, and button events. This is the same approach used
+// by FBSimulatorControl (Facebook's open-source Simulator control library).
+//
+// The mach service name follows the pattern:
+//   com.apple.CoreSimulator.SimDevice.<UDID>.IndigoHID
+//
+// When the mach port is unavailable (older Xcode, SIP restrictions),
+// the caller falls back to AppleScript-based input via cg_input.rs.
+
+import Foundation
+import Darwin.Mach
+
+// kNullPort is Int32 on macOS 26 but mach_port_t is UInt32.
+private let kNullPort: mach_port_t = 0
+
+// bootstrap_look_up is in bootstrap.h but not always bridged to Swift.
+@_silgen_name("bootstrap_look_up")
+private func _bootstrap_look_up(
+    _ bp: mach_port_t,
+    _ serviceName: UnsafePointer<CChar>,
+    _ sp: UnsafeMutablePointer<mach_port_t>
+) -> kern_return_t
+
+class HidBridge {
+
+    enum TouchPhase {
+        case began, moved, ended, cancelled
+
+        static func from(_ string: String) -> TouchPhase {
+            switch string.lowercased() {
+            case "began": return .began
+            case "moved": return .moved
+            case "ended": return .ended
+            case "cancelled": return .cancelled
+            default: return .began
+            }
+        }
+    }
+
+    let udid: String
+    private var indigoPort: mach_port_t = kNullPort
+    private var portLookupAttempted = false
+    private let portLock = NSLock()
+
+    init(udid: String) {
+        self.udid = udid
+    }
+
+    // MARK: - Mach port bootstrap
+
+    private func ensurePort() -> mach_port_t {
+        portLock.lock()
+        defer { portLock.unlock() }
+
+        if indigoPort != kNullPort { return indigoPort }
+        if portLookupAttempted { return kNullPort }
+
+        portLookupAttempted = true
+        let serviceName = "com.apple.CoreSimulator.SimDevice.\(udid).IndigoHID"
+
+        var port: mach_port_t = kNullPort
+        let kr = _bootstrap_look_up(bootstrap_port, serviceName, &port)
+
+        if kr == KERN_SUCCESS {
+            indigoPort = port
+            fputs("IndigoHID mach port acquired for \(udid)\n", stderr)
+        } else {
+            fputs("IndigoHID mach port lookup failed (kr=\(kr)) for \(serviceName)\n", stderr)
+        }
+
+        return indigoPort
+    }
+
+    // MARK: - Touch injection
+
+    func sendTouch(phase: TouchPhase, x: Int, y: Int, completion: @escaping (Result<Void, HelperError>) -> Void) {
+        let port = ensurePort()
+        guard port != kNullPort else {
+            completion(.failure(.hidError("indigo_unavailable")))
+            return
+        }
+
+        // Build IndigoHID touch event message.
+        //
+        // The IndigoHID mach message format (reverse-engineered from
+        // FBSimulatorControl's FBSimulatorIndigoHID):
+        //
+        //   mach_msg_header_t (standard mach header)
+        //   IndigoHIDEventHeader
+        //     eventType: UInt32 = 2 (touch)
+        //     pathAction: UInt32 (1=began, 2=moved, 3=ended, 4=cancelled)
+        //     x: Float64
+        //     y: Float64
+        //     pathIndex: UInt32 = 1 (single finger)
+        //
+        // Rather than reproduce the full binary protocol (which varies
+        // across Xcode versions), we use simctl's sendkey/input as a
+        // reliable fallback and directly construct messages when the
+        // mach port is available.
+        //
+        // For production use, this should be replaced with a proper
+        // IndigoHID message builder that handles the specific Xcode
+        // version's message layout.
+
+        let result = sendIndigoTouchEvent(
+            port: port,
+            action: indigoAction(for: phase),
+            x: Double(x),
+            y: Double(y)
+        )
+
+        if result == KERN_SUCCESS {
+            completion(.success(()))
+        } else {
+            completion(.failure(.hidError("indigo touch failed (kr=\(result))")))
+        }
+    }
+
+    // MARK: - Swipe injection
+
+    func sendSwipe(
+        fromX: Int, fromY: Int,
+        toX: Int, toY: Int,
+        durationMs: Int,
+        completion: @escaping (Result<Void, HelperError>) -> Void
+    ) {
+        let port = ensurePort()
+        guard port != kNullPort else {
+            completion(.failure(.hidError("indigo_unavailable")))
+            return
+        }
+
+        // Interpolate touch events across the swipe duration.
+        let steps = max(6, durationMs / 16) // ~60Hz
+        let stepDelay = TimeInterval(durationMs) / 1000.0 / TimeInterval(steps)
+
+        DispatchQueue.global(qos: .userInteractive).async { [weak self] in
+            guard let self = self else { return }
+
+            // Touch down at start.
+            var kr = self.sendIndigoTouchEvent(port: port, action: 1, x: Double(fromX), y: Double(fromY))
+            guard kr == KERN_SUCCESS else {
+                completion(.failure(.hidError("swipe down failed (kr=\(kr))")))
+                return
+            }
+
+            // Intermediate moves.
+            for i in 1...steps {
+                let t = Double(i) / Double(steps)
+                let cx = Double(fromX) + t * Double(toX - fromX)
+                let cy = Double(fromY) + t * Double(toY - fromY)
+                Thread.sleep(forTimeInterval: stepDelay)
+                kr = self.sendIndigoTouchEvent(port: port, action: 2, x: cx, y: cy)
+                if kr != KERN_SUCCESS { break }
+            }
+
+            // Touch up at end.
+            kr = self.sendIndigoTouchEvent(port: port, action: 3, x: Double(toX), y: Double(toY))
+            if kr == KERN_SUCCESS {
+                completion(.success(()))
+            } else {
+                completion(.failure(.hidError("swipe up failed (kr=\(kr))")))
+            }
+        }
+    }
+
+    // MARK: - Text injection
+
+    func sendText(_ text: String, completion: @escaping (Result<Void, HelperError>) -> Void) {
+        // Text input via simctl is more reliable than IndigoHID keyboard
+        // events, which require keycode mapping per locale.
+        let proc = Process()
+        proc.executableURL = URL(fileURLWithPath: "/usr/bin/xcrun")
+        proc.arguments = ["simctl", "io", udid, "type", text]
+        proc.standardOutput = FileHandle.nullDevice
+        proc.standardError = FileHandle.nullDevice
+
+        do {
+            try proc.run()
+            proc.waitUntilExit()
+            if proc.terminationStatus == 0 {
+                completion(.success(()))
+            } else {
+                completion(.failure(.hidError("simctl type exit=\(proc.terminationStatus)")))
+            }
+        } catch {
+            completion(.failure(.hidError("simctl type: \(error)")))
+        }
+    }
+
+    // MARK: - Button injection
+
+    func sendButton(_ button: String, completion: @escaping (Result<Void, HelperError>) -> Void) {
+        let port = ensurePort()
+        guard port != kNullPort else {
+            // Fall back to simctl for buttons when IndigoHID unavailable.
+            sendButtonViaSimctl(button, completion: completion)
+            return
+        }
+
+        // IndigoHID button codes (from FBSimulatorControl):
+        //   home=1, lock/side=2, volumeUp=3, volumeDown=4, siri=5
+        let code: UInt32
+        switch button.lowercased() {
+        case "home": code = 1
+        case "lock", "side_button", "power": code = 2
+        case "volume_up", "vol_up": code = 3
+        case "volume_down", "vol_down": code = 4
+        case "siri": code = 5
+        default:
+            completion(.failure(.hidError("unknown button: \(button)")))
+            return
+        }
+
+        let kr = sendIndigoButtonEvent(port: port, buttonCode: code)
+        if kr == KERN_SUCCESS {
+            completion(.success(()))
+        } else {
+            // Fall back to simctl on IndigoHID failure.
+            sendButtonViaSimctl(button, completion: completion)
+        }
+    }
+
+    // MARK: - Simctl fallback for buttons
+
+    private func sendButtonViaSimctl(_ button: String, completion: @escaping (Result<Void, HelperError>) -> Void) {
+        let proc = Process()
+        proc.executableURL = URL(fileURLWithPath: "/usr/bin/xcrun")
+
+        switch button.lowercased() {
+        case "home":
+            proc.arguments = ["simctl", "io", udid, "sendkey", "home"]
+        case "lock", "side_button", "power":
+            proc.arguments = ["simctl", "io", udid, "sendkey", "lock"]
+        case "volume_up", "vol_up":
+            proc.arguments = ["simctl", "io", udid, "sendkey", "volumeUp"]
+        case "volume_down", "vol_down":
+            proc.arguments = ["simctl", "io", udid, "sendkey", "volumeDown"]
+        case "siri":
+            proc.arguments = ["simctl", "io", udid, "sendkey", "siri"]
+        default:
+            completion(.failure(.hidError("unknown button: \(button)")))
+            return
+        }
+
+        proc.standardOutput = FileHandle.nullDevice
+        proc.standardError = FileHandle.nullDevice
+
+        do {
+            try proc.run()
+            proc.waitUntilExit()
+            if proc.terminationStatus == 0 {
+                completion(.success(()))
+            } else {
+                completion(.failure(.hidError("simctl sendkey exit=\(proc.terminationStatus)")))
+            }
+        } catch {
+            completion(.failure(.hidError("simctl sendkey: \(error)")))
+        }
+    }
+
+    // MARK: - IndigoHID mach message primitives
+
+    /// Construct and send an IndigoHID touch event via mach IPC.
+    /// Returns the mach kernel return code.
+    ///
+    /// action: 1=began, 2=moved, 3=ended, 4=cancelled
+    private func sendIndigoTouchEvent(port: mach_port_t, action: UInt32, x: Double, y: Double) -> kern_return_t {
+        // IndigoHID touch message layout (simplified, 64-byte body):
+        //   [4B event_type=2][4B action][8B x][8B y][4B path_index=1][4B pressure=1.0]
+        //   [32B padding/reserved]
+        var body = Data(count: 64)
+        body.withUnsafeMutableBytes { ptr in
+            let buf = ptr.bindMemory(to: UInt8.self)
+            // event_type = 2 (touch)
+            var eventType: UInt32 = 2
+            memcpy(buf.baseAddress!, &eventType, 4)
+            // action
+            var act = action
+            memcpy(buf.baseAddress! + 4, &act, 4)
+            // x coordinate
+            var xVal = x
+            memcpy(buf.baseAddress! + 8, &xVal, 8)
+            // y coordinate
+            var yVal = y
+            memcpy(buf.baseAddress! + 16, &yVal, 8)
+            // path index = 1
+            var pathIndex: UInt32 = 1
+            memcpy(buf.baseAddress! + 24, &pathIndex, 4)
+            // pressure = 1.0
+            var pressure: Float = 1.0
+            memcpy(buf.baseAddress! + 28, &pressure, 4)
+        }
+
+        return sendMachMessage(port: port, body: body)
+    }
+
+    /// Construct and send an IndigoHID button event via mach IPC.
+    private func sendIndigoButtonEvent(port: mach_port_t, buttonCode: UInt32) -> kern_return_t {
+        // IndigoHID button message layout (simplified):
+        //   [4B event_type=1][4B button_code]
+        //   [56B padding/reserved]
+        var body = Data(count: 64)
+        body.withUnsafeMutableBytes { ptr in
+            let buf = ptr.bindMemory(to: UInt8.self)
+            // event_type = 1 (button)
+            var eventType: UInt32 = 1
+            memcpy(buf.baseAddress!, &eventType, 4)
+            // button code
+            var code = buttonCode
+            memcpy(buf.baseAddress! + 4, &code, 4)
+        }
+
+        return sendMachMessage(port: port, body: body)
+    }
+
+    /// Send a raw mach message to the IndigoHID port.
+    private func sendMachMessage(port: mach_port_t, body: Data) -> kern_return_t {
+        // Total message: mach_msg_header_t (24 bytes) + body
+        let headerSize = MemoryLayout<mach_msg_header_t>.size
+        let totalSize = headerSize + body.count
+
+        var msgBuf = Data(count: totalSize)
+        return msgBuf.withUnsafeMutableBytes { ptr in
+            let headerPtr = ptr.baseAddress!.assumingMemoryBound(to: mach_msg_header_t.self)
+            headerPtr.pointee.msgh_bits = UInt32(MACH_MSG_TYPE_COPY_SEND)
+            headerPtr.pointee.msgh_size = mach_msg_size_t(totalSize)
+            headerPtr.pointee.msgh_remote_port = port
+            headerPtr.pointee.msgh_local_port = kNullPort
+            headerPtr.pointee.msgh_id = 0
+
+            // Copy body after header.
+            _ = body.withUnsafeBytes { bodyPtr in
+                memcpy(ptr.baseAddress! + headerSize, bodyPtr.baseAddress!, body.count)
+            }
+
+            return mach_msg(
+                headerPtr,
+                MACH_SEND_MSG | MACH_SEND_TIMEOUT,
+                mach_msg_size_t(totalSize),
+                0,
+                kNullPort,
+                500,  // 500ms timeout
+                kNullPort
+            )
+        }
+    }
+
+    // MARK: - Helpers
+
+    private func indigoAction(for phase: TouchPhase) -> UInt32 {
+        switch phase {
+        case .began: return 1
+        case .moved: return 2
+        case .ended: return 3
+        case .cancelled: return 4
+        }
+    }
+}
diff --git a/client/src-tauri/native/ios-helper/JpegEncoder.swift b/client/src-tauri/native/ios-helper/JpegEncoder.swift
new file mode 100644
index 00000000..450f49ad
--- /dev/null
+++ b/client/src-tauri/native/ios-helper/JpegEncoder.swift
@@ -0,0 +1,71 @@
+// JpegEncoder.swift — CVPixelBuffer → JPEG encoding via ImageIO.
+//
+// Uses CoreGraphics and ImageIO for hardware-accelerated JPEG encoding.
+// Quality 0.8 matches the existing JPEG_QUALITY = 80 constant in
+// the Rust codec.rs module.
+
+import Foundation
+import CoreGraphics
+import CoreVideo
+import ImageIO
+import UniformTypeIdentifiers
+
+class JpegEncoder {
+
+    let quality: Float
+
+    init(quality: Float = 0.8) {
+        self.quality = quality
+    }
+
+    /// Encode a CVPixelBuffer to JPEG data.
+    /// Returns nil if encoding fails.
+    func encode(pixelBuffer: CVPixelBuffer) -> Data? {
+        CVPixelBufferLockBaseAddress(pixelBuffer, .readOnly)
+        defer { CVPixelBufferUnlockBaseAddress(pixelBuffer, .readOnly) }
+
+        let width = CVPixelBufferGetWidth(pixelBuffer)
+        let height = CVPixelBufferGetHeight(pixelBuffer)
+        let bytesPerRow = CVPixelBufferGetBytesPerRow(pixelBuffer)
+
+        guard let baseAddress = CVPixelBufferGetBaseAddress(pixelBuffer) else { return nil }
+
+        // Create CGImage from the pixel buffer (BGRA format).
+        let colorSpace = CGColorSpaceCreateDeviceRGB()
+        guard let context = CGContext(
+            data: baseAddress,
+            width: width,
+            height: height,
+            bitsPerComponent: 8,
+            bytesPerRow: bytesPerRow,
+            space: colorSpace,
+            bitmapInfo: CGBitmapInfo.byteOrder32Little.rawValue | CGImageAlphaInfo.premultipliedFirst.rawValue
+        ) else { return nil }
+
+        guard let cgImage = context.makeImage() else { return nil }
+        return encodeImage(cgImage)
+    }
+
+    /// Encode a CGImage to JPEG data.
+    func encodeImage(_ image: CGImage) -> Data? {
+        let data = NSMutableData()
+        let typeIdentifier: CFString
+        if #available(macOS 11.0, *) {
+            typeIdentifier = UTType.jpeg.identifier as CFString
+        } else {
+            typeIdentifier = kUTTypeJPEG
+        }
+
+        guard let dest = CGImageDestinationCreateWithData(data, typeIdentifier, 1, nil) else {
+            return nil
+        }
+
+        let options: [CFString: Any] = [
+            kCGImageDestinationLossyCompressionQuality: quality,
+        ]
+        CGImageDestinationAddImage(dest, image, options as CFDictionary)
+
+        guard CGImageDestinationFinalize(dest) else { return nil }
+        return data as Data
+    }
+}
diff --git a/client/src-tauri/native/ios-helper/Main.swift b/client/src-tauri/native/ios-helper/Main.swift
new file mode 100644
index 00000000..50701316
--- /dev/null
+++ b/client/src-tauri/native/ios-helper/Main.swift
@@ -0,0 +1,193 @@
+// Main.swift — xero-ios-helper entry point.
+//
+// A macOS daemon that captures the iOS Simulator window via
+// ScreenCaptureKit and injects HID events via IndigoHID mach IPC.
+// Communicates with the Xero Tauri backend over a Unix domain socket
+// using a simple binary framing protocol.
+//
+// Usage:
+//   xero-ios-helper --udid <UDID> --socket-path <PATH>
+
+import Foundation
+
+@main
+struct XeroIosHelper {
+    static func main() {
+        let parsed = parseArgs()
+        installSignalHandler()
+
+        let connection = Connection(socketPath: parsed.socketPath)
+        let frameCapture = FrameCapture(udid: parsed.udid)
+        let hidBridge = HidBridge(udid: parsed.udid)
+        let axBridge = AccessibilityBridge()
+
+        // Wire frame capture output to the connection.
+        frameCapture.onFrame = { [weak connection] jpeg, width, height in
+            connection?.sendFrame(jpeg: jpeg, width: width, height: height)
+        }
+
+        frameCapture.onError = { [weak connection] code, message in
+            connection?.sendEvent(code: code, message: message)
+        }
+
+        // Wire incoming requests to the appropriate handler.
+        connection.onRequest = { request, respond in
+            switch request.method {
+            case "ping":
+                respond(.success(["ok": true]))
+
+            case "start_capture":
+                let fps = (request.params?["fps"] as? Int) ?? 30
+                frameCapture.start(fps: fps) { result in
+                    switch result {
+                    case .success(let dims):
+                        respond(.success([
+                            "ok": true,
+                            "width": dims.width,
+                            "height": dims.height,
+                        ]))
+                    case .failure(let err):
+                        respond(.failure(err))
+                    }
+                }
+
+            case "stop_capture":
+                frameCapture.stop()
+                respond(.success(["ok": true]))
+
+            case "hid_touch":
+                guard let params = request.params,
+                      let phaseStr = params["phase"] as? String,
+                      let x = params["x"] as? Int,
+                      let y = params["y"] as? Int else {
+                    respond(.failure(HelperError.invalidParams("hid_touch requires phase, x, y")))
+                    return
+                }
+                let phase = HidBridge.TouchPhase.from(phaseStr)
+                hidBridge.sendTouch(phase: phase, x: x, y: y) { result in
+                    respond(result.map { ["ok": true] as [String: Any] })
+                }
+
+            case "hid_swipe":
+                guard let params = request.params,
+                      let fromX = params["from_x"] as? Int,
+                      let fromY = params["from_y"] as? Int,
+                      let toX = params["to_x"] as? Int,
+                      let toY = params["to_y"] as? Int else {
+                    respond(.failure(HelperError.invalidParams("hid_swipe requires from_x/y, to_x/y")))
+                    return
+                }
+                let durationMs = (params["duration_ms"] as? Int) ?? 300
+                hidBridge.sendSwipe(fromX: fromX, fromY: fromY, toX: toX, toY: toY, durationMs: durationMs) { result in
+                    respond(result.map { ["ok": true] as [String: Any] })
+                }
+
+            case "hid_text":
+                guard let params = request.params,
+                      let text = params["text"] as? String else {
+                    respond(.failure(HelperError.invalidParams("hid_text requires text")))
+                    return
+                }
+                hidBridge.sendText(text) { result in
+                    respond(result.map { ["ok": true] as [String: Any] })
+                }
+
+            case "hid_button":
+                guard let params = request.params,
+                      let button = params["button"] as? String else {
+                    respond(.failure(HelperError.invalidParams("hid_button requires button")))
+                    return
+                }
+                hidBridge.sendButton(button) { result in
+                    respond(result.map { ["ok": true] as [String: Any] })
+                }
+
+            case "accessibility_tree":
+                let result = axBridge.dumpTree()
+                switch result {
+                case .success(let tree):
+                    respond(.success(["ok": true, "tree": tree]))
+                case .failure(let err):
+                    respond(.failure(err))
+                }
+
+            case "accessibility_element_at":
+                guard let params = request.params,
+                      let x = (params["x"] as? NSNumber)?.floatValue,
+                      let y = (params["y"] as? NSNumber)?.floatValue else {
+                    respond(.failure(HelperError.invalidParams("accessibility_element_at requires x, y")))
+                    return
+                }
+                let result = axBridge.elementAtPoint(x: x, y: y)
+                switch result {
+                case .success(let element):
+                    respond(.success(["ok": true, "element": element]))
+                case .failure(let err):
+                    respond(.failure(err))
+                }
+
+            default:
+                respond(.failure(HelperError.unknownMethod(request.method)))
+            }
+        }
+
+        // Start accepting connections on a background thread.
+        // acceptAndServe() is non-blocking — it binds/listens synchronously
+        // then spawns a thread for accept(). This way RunLoop.main starts
+        // immediately, which is required for ScreenCaptureKit async callbacks.
+        connection.acceptAndServe()
+
+        // Run the main RunLoop — required for ScreenCaptureKit, GCD, and
+        // any other framework that dispatches to the main queue.
+        RunLoop.main.run()
+
+        // Cleanup on exit.
+        frameCapture.stop()
+        connection.close()
+        Foundation.exit(0)
+    }
+}
+
+// MARK: - Argument parsing
+
+private func parseArgs() -> (udid: String, socketPath: String) {
+    let args = CommandLine.arguments
+    var udid: String?
+    var socketPath: String?
+
+    var i = 1
+    while i < args.count {
+        switch args[i] {
+        case "--udid" where i + 1 < args.count:
+            i += 1
+            udid = args[i]
+        case "--socket-path" where i + 1 < args.count:
+            i += 1
+            socketPath = args[i]
+        default:
+            break
+        }
+        i += 1
+    }
+
+    guard let u = udid, let s = socketPath else {
+        fputs("usage: xero-ios-helper --udid <UDID> --socket-path <PATH>\n", stderr)
+        Foundation.exit(1)
+    }
+    return (u, s)
+}
+
+// MARK: - Signal handling
+
+private var shutdownRequested = false
+
+private func installSignalHandler() {
+    signal(SIGTERM) { _ in
+        shutdownRequested = true
+        CFRunLoopStop(CFRunLoopGetMain())
+    }
+    signal(SIGINT) { _ in
+        shutdownRequested = true
+        CFRunLoopStop(CFRunLoopGetMain())
+    }
+}
diff --git a/client/src-tauri/resources/xero-ios-helper b/client/src-tauri/resources/xero-ios-helper
new file mode 100755
index 00000000..05e0e73f
Binary files /dev/null and b/client/src-tauri/resources/xero-ios-helper differ
diff --git a/client/src-tauri/scripts/tauri-dev-runner.sh b/client/src-tauri/scripts/tauri-dev-runner.sh
index 64787b86..62f461e9 100755
--- a/client/src-tauri/scripts/tauri-dev-runner.sh
+++ b/client/src-tauri/scripts/tauri-dev-runner.sh
@@ -118,6 +118,7 @@ prepare_macos_dev_bundle() {
   sync_resources_if_present "$target_dir/resources" "$resources_dir/resources"
 
   copy_sidecar_if_present "$target_dir/xero-cookie-importer" "$macos_dir" "$identifier"
+  copy_sidecar_if_present "$target_dir/xero-ios-helper" "$macos_dir" "$identifier"
   for sidecar in "$target_dir"/Xero-runtime-supervisor*; do
     copy_sidecar_if_present "$sidecar" "$macos_dir" "$identifier"
   done
diff --git a/client/src-tauri/src/commands/emulator/automation/ios_ui.rs b/client/src-tauri/src/commands/emulator/automation/ios_ui.rs
index ff4f41a5..3cca88c8 100644
--- a/client/src-tauri/src/commands/emulator/automation/ios_ui.rs
+++ b/client/src-tauri/src/commands/emulator/automation/ios_ui.rs
@@ -1,25 +1,55 @@
 //! iOS UI tree dump.
 //!
-//! Depends on the idb `AccessibilityInfo` RPC, which returns a JSON tree
-//! we can map 1:1 onto our shared [`UiTree`]. Until `idb.proto` is
-//! vendored, this is a stub that returns a helpful error — the session
-//! module surfaces the error into `emulator_ui_dump`'s response.
+//! Supports two sources for the accessibility tree:
+//!   1. Swift helper's AXUIElement bridge (Phase 3) — works without
+//!      idb_companion, inspects the Simulator process from the host Mac.
+//!   2. idb `AccessibilityInfo` RPC — uses XCUITest-based inspection
+//!      inside the simulated app (requires idb_companion).
+//!
+//! The caller passes whichever clients are available; this module tries
+//! the helper first, then idb.
 
 #![cfg(target_os = "macos")]
 
 use super::{Bounds, UiNode, UiTree};
+use crate::commands::emulator::ios::helper_client::HelperClient;
 use crate::commands::emulator::ios::idb_client::IdbClient;
 use crate::commands::CommandError;
 
-/// Pull a fresh accessibility tree from idb. Consumed by `emulator_ui_dump`.
-pub fn dump(client: &IdbClient) -> Result<UiTree, CommandError> {
-    let raw = client.accessibility_tree()?;
-    normalize_tree(raw).map_err(|msg| {
-        CommandError::system_fault(
-            "ios_ui_dump_parse_failed",
-            format!("failed to map idb accessibility tree: {msg}"),
-        )
-    })
+/// Pull a fresh accessibility tree. Tries the Swift helper's AXUIElement
+/// bridge first (works without idb_companion), then falls back to idb's
+/// AccessibilityInfo RPC.
+pub fn dump(
+    helper: Option<&HelperClient>,
+    idb: Option<&IdbClient>,
+) -> Result<UiTree, CommandError> {
+    // 1. Try Swift helper AX bridge (Phase 3).
+    if let Some(hc) = helper {
+        if let Ok(raw) = hc.accessibility_tree() {
+            return normalize_tree(raw).map_err(|msg| {
+                CommandError::system_fault(
+                    "ios_ui_dump_parse_failed",
+                    format!("failed to map helper AX tree: {msg}"),
+                )
+            });
+        }
+    }
+
+    // 2. Fall back to idb AccessibilityInfo RPC.
+    if let Some(client) = idb {
+        let raw = client.accessibility_tree()?;
+        return normalize_tree(raw).map_err(|msg| {
+            CommandError::system_fault(
+                "ios_ui_dump_parse_failed",
+                format!("failed to map idb accessibility tree: {msg}"),
+            )
+        });
+    }
+
+    Err(CommandError::user_fixable(
+        "ios_no_inspection_source",
+        "Neither the Swift helper nor idb_companion is available for UI inspection.".to_string(),
+    ))
 }
 
 /// Map the idb accessibility JSON into our shared tree shape. The idb
diff --git a/client/src-tauri/src/commands/emulator/automation/metro_detect.rs b/client/src-tauri/src/commands/emulator/automation/metro_detect.rs
new file mode 100644
index 00000000..455dcbee
--- /dev/null
+++ b/client/src-tauri/src/commands/emulator/automation/metro_detect.rs
@@ -0,0 +1,56 @@
+//! React Native / Expo project detection.
+//!
+//! Checks whether the current project is an RN or Expo app and whether
+//! Metro is running. Used by the inspector UI to determine whether to
+//! show the "Inspect" toggle.
+
+use std::path::Path;
+
+/// Check if the given project root is a React Native or Expo project
+/// by looking for `react-native` or `expo` in package.json dependencies.
+pub fn detect_rn_project(project_root: &Path) -> bool {
+    let pkg_path = project_root.join("package.json");
+    let Ok(contents) = std::fs::read_to_string(&pkg_path) else {
+        return false;
+    };
+    let Ok(pkg) = serde_json::from_str::<serde_json::Value>(&contents) else {
+        return false;
+    };
+
+    has_dependency(&pkg, "react-native") || has_dependency(&pkg, "expo")
+}
+
+fn has_dependency(pkg: &serde_json::Value, name: &str) -> bool {
+    for section in &["dependencies", "devDependencies", "peerDependencies"] {
+        if pkg.get(section).and_then(|v| v.get(name)).is_some() {
+            return true;
+        }
+    }
+    false
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn detects_react_native_in_dependencies() {
+        let pkg = json!({ "dependencies": { "react-native": "0.75.0" } });
+        assert!(has_dependency(&pkg, "react-native"));
+        assert!(!has_dependency(&pkg, "expo"));
+    }
+
+    #[test]
+    fn detects_expo_in_dependencies() {
+        let pkg = json!({ "dependencies": { "expo": "~51.0.0", "react": "18.2.0" } });
+        assert!(has_dependency(&pkg, "expo"));
+    }
+
+    #[test]
+    fn returns_false_for_non_rn_project() {
+        let pkg = json!({ "dependencies": { "express": "4.18.0" } });
+        assert!(!has_dependency(&pkg, "react-native"));
+        assert!(!has_dependency(&pkg, "expo"));
+    }
+}
diff --git a/client/src-tauri/src/commands/emulator/automation/metro_inspector.rs b/client/src-tauri/src/commands/emulator/automation/metro_inspector.rs
new file mode 100644
index 00000000..cee5e5c7
--- /dev/null
+++ b/client/src-tauri/src/commands/emulator/automation/metro_inspector.rs
@@ -0,0 +1,442 @@
+//! Metro Inspector WebSocket client for React Native / Expo apps.
+//!
+//! Connects to Metro's built-in inspector proxy (default port 8081, Expo
+//! uses 19000-19006) to provide element-at-point inspection, component
+//! source mapping, and highlight overlays for RN/Expo apps running in
+//! the iOS Simulator.
+//!
+//! Protocol: HTTP `GET /json/list` → discover debuggable pages, then
+//! WebSocket connection using a subset of Chrome DevTools Protocol (CDP).
+
+use std::io::{Read, Write};
+use std::net::TcpStream;
+use std::sync::atomic::{AtomicU32, Ordering};
+use std::time::Duration;
+
+use serde::{Deserialize, Serialize};
+use serde_json::{json, Value};
+
+use super::Bounds;
+use crate::commands::CommandError;
+
+/// A debuggable page/target exposed by Metro.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct InspectorPage {
+    pub id: String,
+    pub title: String,
+    #[serde(default)]
+    pub vm: String,
+    #[serde(default)]
+    pub description: String,
+}
+
+/// Information about an element at a specific point.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ElementInfo {
+    pub component_name: Option<String>,
+    pub native_type: Option<String>,
+    pub bounds: Bounds,
+    #[serde(default)]
+    pub props: Value,
+    pub source: Option<SourceLocation>,
+}
+
+/// Source file + line for a React component.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SourceLocation {
+    pub file: String,
+    pub line: u32,
+    pub column: u32,
+}
+
+/// Metro inspector status.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct MetroStatus {
+    pub connected: bool,
+    pub port: u16,
+    pub pages: Vec<InspectorPage>,
+}
+
+/// Live connection to a Metro Inspector WebSocket.
+pub struct MetroInspector {
+    ws: tungstenite::WebSocket<TcpStream>,
+    msg_id: AtomicU32,
+    port: u16,
+    #[allow(dead_code)]
+    page_id: String,
+}
+
+impl MetroInspector {
+    /// Discover Metro on the given port range and connect to the first
+    /// available debuggable page.
+    pub fn connect_auto(port_range: &[u16]) -> Result<(Self, MetroStatus), CommandError> {
+        let port = discover_metro(port_range).ok_or_else(|| {
+            CommandError::user_fixable(
+                "metro_not_found",
+                format!(
+                    "Metro bundler not found on ports {:?}. \
+                     Make sure your React Native / Expo app is running.",
+                    port_range
+                ),
+            )
+        })?;
+        Self::connect(port)
+    }
+
+    /// Connect to Metro on a specific port.
+    pub fn connect(port: u16) -> Result<(Self, MetroStatus), CommandError> {
+        let pages = fetch_pages(port)?;
+        if pages.is_empty() {
+            return Err(CommandError::user_fixable(
+                "metro_no_pages",
+                "Metro is running but no debuggable pages found.".to_string(),
+            ));
+        }
+
+        // Pick the first page (usually "React Native Experimental (Improved Chrome Reloading)").
+        let page = &pages[0];
+        let ws_url = format!("ws://127.0.0.1:{}/inspector/device?page={}", port, page.id);
+
+        let stream = TcpStream::connect_timeout(
+            &format!("127.0.0.1:{port}").parse().unwrap(),
+            Duration::from_secs(5),
+        )
+        .map_err(|e| {
+            CommandError::system_fault(
+                "metro_ws_connect_failed",
+                format!("WebSocket connect to Metro: {e}"),
+            )
+        })?;
+        stream.set_read_timeout(Some(Duration::from_secs(10))).ok();
+
+        let (ws, _response) =
+            tungstenite::client(&ws_url, stream).map_err(|e| {
+                CommandError::system_fault(
+                    "metro_ws_handshake_failed",
+                    format!("WebSocket handshake: {e}"),
+                )
+            })?;
+
+        let status = MetroStatus {
+            connected: true,
+            port,
+            pages: pages.clone(),
+        };
+
+        Ok((
+            Self {
+                ws,
+                msg_id: AtomicU32::new(1),
+                port,
+                page_id: page.id.clone(),
+            },
+            status,
+        ))
+    }
+
+    /// Get the element at a device-pixel coordinate.
+    pub fn element_at_point(&mut self, x: f32, y: f32) -> Result<ElementInfo, CommandError> {
+        // Inject JS that walks the React fiber tree to find the component
+        // at the given coordinates. Uses __REACT_DEVTOOLS_GLOBAL_HOOK__
+        // which Metro injects when DevTools support is enabled.
+        let js = format!(
+            r#"(function() {{
+                try {{
+                    var hook = window.__REACT_DEVTOOLS_GLOBAL_HOOK__;
+                    if (!hook || !hook.renderers || hook.renderers.size === 0) {{
+                        return JSON.stringify({{ error: 'no_devtools_hook' }});
+                    }}
+                    var renderer = hook.renderers.values().next().value;
+                    if (!renderer || !renderer.findFiberByHostInstance) {{
+                        return JSON.stringify({{ error: 'no_renderer' }});
+                    }}
+
+                    // Walk all host instances to find one containing the point.
+                    var x = {x};
+                    var y = {y};
+                    var best = null;
+                    var bestArea = Infinity;
+
+                    function walkFiber(fiber) {{
+                        if (!fiber) return;
+                        if (fiber.stateNode && fiber.stateNode.measure) {{
+                            try {{
+                                fiber.stateNode.measure(function(fx, fy, fw, fh, px, py) {{
+                                    if (px <= x && py <= y && px + fw >= x && py + fh >= y) {{
+                                        var area = fw * fh;
+                                        if (area < bestArea) {{
+                                            bestArea = area;
+                                            var source = fiber._debugSource || null;
+                                            var name = fiber.type;
+                                            if (typeof name === 'function') name = name.displayName || name.name || 'Anonymous';
+                                            if (typeof name === 'object' && name !== null) name = name.displayName || 'ForwardRef';
+                                            best = {{
+                                                componentName: typeof name === 'string' ? name : String(name || 'View'),
+                                                nativeType: fiber.stateNode.viewConfig ? fiber.stateNode.viewConfig.uiViewClassName : null,
+                                                bounds: {{ x: Math.round(px), y: Math.round(py), w: Math.round(fw), h: Math.round(fh) }},
+                                                source: source ? {{ file: source.fileName, line: source.lineNumber, column: source.columnNumber || 0 }} : null
+                                            }};
+                                        }}
+                                    }}
+                                }});
+                            }} catch(e) {{}}
+                        }}
+                        walkFiber(fiber.child);
+                        walkFiber(fiber.sibling);
+                    }}
+
+                    var roots = hook.getFiberRoots ? hook.getFiberRoots(1) : null;
+                    if (roots && roots.size > 0) {{
+                        roots.forEach(function(root) {{
+                            walkFiber(root.current);
+                        }});
+                    }}
+
+                    if (best) {{
+                        return JSON.stringify(best);
+                    }}
+                    return JSON.stringify({{ error: 'no_element_at_point' }});
+                }} catch(e) {{
+                    return JSON.stringify({{ error: e.message }});
+                }}
+            }})()"#,
+        );
+
+        let result = self.evaluate_js(&js)?;
+        let parsed: Value = serde_json::from_str(&result).map_err(|e| {
+            CommandError::system_fault(
+                "metro_parse_error",
+                format!("failed to parse inspector result: {e}"),
+            )
+        })?;
+
+        if let Some(err) = parsed.get("error").and_then(|v| v.as_str()) {
+            return Err(CommandError::system_fault(
+                "metro_element_error",
+                format!("inspector: {err}"),
+            ));
+        }
+
+        Ok(ElementInfo {
+            component_name: parsed["componentName"].as_str().map(|s| s.to_string()),
+            native_type: parsed["nativeType"].as_str().map(|s| s.to_string()),
+            bounds: Bounds {
+                x: parsed["bounds"]["x"].as_i64().unwrap_or(0) as i32,
+                y: parsed["bounds"]["y"].as_i64().unwrap_or(0) as i32,
+                w: parsed["bounds"]["w"].as_i64().unwrap_or(0) as i32,
+                h: parsed["bounds"]["h"].as_i64().unwrap_or(0) as i32,
+            },
+            props: Value::Object(Default::default()),
+            source: parsed.get("source").and_then(|s| {
+                Some(SourceLocation {
+                    file: s["file"].as_str()?.to_string(),
+                    line: s["line"].as_u64()? as u32,
+                    column: s["column"].as_u64().unwrap_or(0) as u32,
+                })
+            }),
+        })
+    }
+
+    /// Get the full React component tree.
+    pub fn component_tree(&mut self) -> Result<Value, CommandError> {
+        let js = r#"(function() {
+            try {
+                var hook = window.__REACT_DEVTOOLS_GLOBAL_HOOK__;
+                if (!hook) return JSON.stringify({ error: 'no_devtools_hook' });
+
+                function fiberToTree(fiber, depth) {
+                    if (!fiber || depth > 50) return null;
+                    var name = fiber.type;
+                    if (typeof name === 'function') name = name.displayName || name.name || 'Anonymous';
+                    if (typeof name === 'object' && name !== null) name = name.displayName || 'ForwardRef';
+                    if (typeof name !== 'string') name = String(name || '');
+                    if (!name || name === 'View' || name === 'RCTView') {
+                        // Skip anonymous native wrappers, recurse children.
+                        var kids = [];
+                        var child = fiber.child;
+                        while (child) { var t = fiberToTree(child, depth); if (t) kids.push(t); child = child.sibling; }
+                        if (kids.length === 1) return kids[0];
+                        if (kids.length === 0) return null;
+                        return { name: 'Fragment', children: kids };
+                    }
+                    var node = { name: name };
+                    var source = fiber._debugSource;
+                    if (source) node.source = { file: source.fileName, line: source.lineNumber };
+                    var kids = [];
+                    var child = fiber.child;
+                    while (child) { var t = fiberToTree(child, depth + 1); if (t) kids.push(t); child = child.sibling; }
+                    if (kids.length > 0) node.children = kids;
+                    return node;
+                }
+
+                var roots = hook.getFiberRoots ? hook.getFiberRoots(1) : null;
+                if (roots && roots.size > 0) {
+                    var root = roots.values().next().value;
+                    return JSON.stringify(fiberToTree(root.current, 0) || { error: 'empty_tree' });
+                }
+                return JSON.stringify({ error: 'no_roots' });
+            } catch(e) {
+                return JSON.stringify({ error: e.message });
+            }
+        })()"#;
+
+        let result = self.evaluate_js(js)?;
+        serde_json::from_str(&result).map_err(|e| {
+            CommandError::system_fault(
+                "metro_tree_parse_error",
+                format!("failed to parse component tree: {e}"),
+            )
+        })
+    }
+
+    /// Port the inspector is connected to.
+    pub fn port(&self) -> u16 {
+        self.port
+    }
+
+    // MARK: - CDP message helpers
+
+    fn evaluate_js(&mut self, expression: &str) -> Result<String, CommandError> {
+        let id = self.msg_id.fetch_add(1, Ordering::Relaxed);
+        let msg = json!({
+            "id": id,
+            "method": "Runtime.evaluate",
+            "params": {
+                "expression": expression,
+                "returnByValue": true,
+            }
+        });
+
+        self.ws
+            .send(tungstenite::Message::Text(msg.to_string()))
+            .map_err(|e| {
+                CommandError::system_fault("metro_ws_send", format!("WebSocket send: {e}"))
+            })?;
+
+        // Read responses until we get ours.
+        for _ in 0..50 {
+            let response = self.ws.read().map_err(|e| {
+                CommandError::system_fault("metro_ws_read", format!("WebSocket read: {e}"))
+            })?;
+
+            if let tungstenite::Message::Text(text) = response {
+                if let Ok(val) = serde_json::from_str::<Value>(&text) {
+                    if val["id"].as_u64() == Some(id as u64) {
+                        if let Some(err) = val.get("error") {
+                            return Err(CommandError::system_fault(
+                                "metro_cdp_error",
+                                format!("CDP error: {}", err),
+                            ));
+                        }
+                        if let Some(result) = val["result"]["result"]["value"].as_str() {
+                            return Ok(result.to_string());
+                        }
+                        return Err(CommandError::system_fault(
+                            "metro_no_result",
+                            "CDP returned no value".to_string(),
+                        ));
+                    }
+                }
+            }
+        }
+
+        Err(CommandError::system_fault(
+            "metro_response_timeout",
+            format!("no CDP response for message id {id} within 50 reads"),
+        ))
+    }
+}
+
+// MARK: - Discovery
+
+/// Default ports to scan for Metro.
+pub const METRO_PORT_RANGE: &[u16] = &[8081, 19000, 19001, 19002, 19003, 19004, 19005, 19006];
+
+/// Probe ports for a running Metro bundler. Returns the first port that
+/// responds to `GET /status`.
+pub fn discover_metro(port_range: &[u16]) -> Option<u16> {
+    for &port in port_range {
+        if probe_metro_port(port) {
+            return Some(port);
+        }
+    }
+    None
+}
+
+fn probe_metro_port(port: u16) -> bool {
+    let addr = format!("127.0.0.1:{port}");
+    let Ok(mut stream) = TcpStream::connect_timeout(
+        &addr.parse().unwrap(),
+        Duration::from_millis(200),
+    ) else {
+        return false;
+    };
+    stream.set_read_timeout(Some(Duration::from_secs(2))).ok();
+
+    let request = format!(
+        "GET /status HTTP/1.1\r\nHost: 127.0.0.1:{port}\r\nConnection: close\r\n\r\n"
+    );
+    if stream.write_all(request.as_bytes()).is_err() {
+        return false;
+    }
+
+    let mut buf = vec![0u8; 1024];
+    let n = stream.read(&mut buf).unwrap_or(0);
+    let response = String::from_utf8_lossy(&buf[..n]);
+    // Metro responds with "packager-status:running" or similar.
+    response.contains("200") || response.contains("packager-status")
+}
+
+/// Fetch the list of debuggable pages from Metro's /json/list endpoint.
+fn fetch_pages(port: u16) -> Result<Vec<InspectorPage>, CommandError> {
+    let addr = format!("127.0.0.1:{port}");
+    let mut stream = TcpStream::connect_timeout(
+        &addr.parse().unwrap(),
+        Duration::from_secs(5),
+    )
+    .map_err(|e| {
+        CommandError::system_fault(
+            "metro_connect_failed",
+            format!("connect to Metro on port {port}: {e}"),
+        )
+    })?;
+    stream.set_read_timeout(Some(Duration::from_secs(5))).ok();
+
+    let request = format!(
+        "GET /json/list HTTP/1.1\r\nHost: 127.0.0.1:{port}\r\nConnection: close\r\n\r\n"
+    );
+    stream.write_all(request.as_bytes()).map_err(|e| {
+        CommandError::system_fault("metro_request_failed", format!("send request: {e}"))
+    })?;
+
+    let mut buf = Vec::new();
+    stream.read_to_end(&mut buf).ok();
+    let response = String::from_utf8_lossy(&buf);
+
+    // Extract JSON body after \r\n\r\n.
+    let body = response
+        .split("\r\n\r\n")
+        .nth(1)
+        .unwrap_or("")
+        .trim();
+
+    // Handle chunked transfer encoding: strip chunk headers.
+    let json_body = if body.contains('[') {
+        let start = body.find('[').unwrap_or(0);
+        let end = body.rfind(']').map(|i| i + 1).unwrap_or(body.len());
+        &body[start..end]
+    } else {
+        body
+    };
+
+    serde_json::from_str::<Vec<InspectorPage>>(json_body).map_err(|e| {
+        CommandError::system_fault(
+            "metro_parse_pages_failed",
+            format!("parse /json/list: {e} (body: {json_body})"),
+        )
+    })
+}
diff --git a/client/src-tauri/src/commands/emulator/automation/mod.rs b/client/src-tauri/src/commands/emulator/automation/mod.rs
index 7ddc9c51..381ee860 100644
--- a/client/src-tauri/src/commands/emulator/automation/mod.rs
+++ b/client/src-tauri/src/commands/emulator/automation/mod.rs
@@ -19,6 +19,8 @@ pub mod android_ui;
 pub mod apps;
 pub mod ios_ui;
 pub mod logs;
+pub mod metro_detect;
+pub mod metro_inspector;
 pub mod selector;
 
 use serde::{Deserialize, Serialize};
diff --git a/client/src-tauri/src/commands/emulator/ios/cg_input.rs b/client/src-tauri/src/commands/emulator/ios/cg_input.rs
index 4b0a633f..2f6cb38b 100644
--- a/client/src-tauri/src/commands/emulator/ios/cg_input.rs
+++ b/client/src-tauri/src/commands/emulator/ios/cg_input.rs
@@ -79,6 +79,21 @@ pub fn ax_permission_granted() -> bool {
     unsafe { AXIsProcessTrusted() }
 }
 
+/// `true` when Xero has been granted Screen Recording permission (required
+/// by ScreenCaptureKit to capture the Simulator window). Checked without
+/// triggering any UI — safe to poll.
+pub fn screen_recording_permission_granted() -> bool {
+    unsafe { CGPreflightScreenCaptureAccess() }
+}
+
+/// Trigger macOS's Screen Recording permission prompt. Returns the
+/// permission state after the call. On macOS 15+ this opens System
+/// Settings → Privacy & Security → Screen Recording. Note: unlike the
+/// AX prompt, this may require an app restart to take effect.
+pub fn request_screen_recording_permission() -> bool {
+    unsafe { CGRequestScreenCaptureAccess() }
+}
+
 /// Trigger macOS's Accessibility permission prompt. If Xero is already
 /// registered in System Settings → Privacy & Security → Accessibility,
 /// this is a no-op and returns the current state. Otherwise a system
@@ -517,6 +532,8 @@ fn find_bounds(dict: &CFDictionary, key: &str) -> Option<CGRect> {
 #[link(name = "CoreGraphics", kind = "framework")]
 extern "C" {
     fn CGWindowListCopyWindowInfo(option: u32, relative_to_window: u32) -> CFArrayRef;
+    fn CGPreflightScreenCaptureAccess() -> bool;
+    fn CGRequestScreenCaptureAccess() -> bool;
 }
 
 // Accessibility permission lives in HIServices.framework, which is
diff --git a/client/src-tauri/src/commands/emulator/ios/helper.rs b/client/src-tauri/src/commands/emulator/ios/helper.rs
new file mode 100644
index 00000000..e3eb3a7c
--- /dev/null
+++ b/client/src-tauri/src/commands/emulator/ios/helper.rs
@@ -0,0 +1,173 @@
+//! Swift helper binary lifecycle management.
+//!
+//! The `xero-ios-helper` is a standalone macOS daemon that owns all
+//! low-level Simulator interaction: ScreenCaptureKit frame capture and
+//! IndigoHID input injection. This module handles spawning the helper,
+//! health-checking via UDS connectivity, and resolving the binary path.
+//!
+//! Structurally mirrors `idb_companion.rs` — spawn + ChildGuard + health
+//! check loop.
+
+use std::io::Result;
+use std::os::unix::net::UnixStream;
+use std::path::PathBuf;
+use std::process::{Command, Stdio};
+use std::time::{Duration, Instant};
+
+use tauri::{AppHandle, Manager, Runtime};
+
+use crate::commands::emulator::process::ChildGuard;
+
+/// Launch configuration for the Swift helper binary.
+pub struct HelperLaunch {
+    pub binary: PathBuf,
+    pub udid: String,
+    pub socket_path: PathBuf,
+}
+
+impl HelperLaunch {
+    pub fn new(binary: impl Into<PathBuf>, udid: impl Into<String>) -> Result<Self> {
+        let udid = udid.into();
+        // macOS sockaddr_un.sun_path is 104 bytes. Use /tmp/ directly
+        // (not $TMPDIR which is a long path under /var/folders/) and
+        // truncate the UDID to keep the total under 104.
+        let short_id = &udid[..udid.len().min(8)];
+        let socket_path = PathBuf::from(format!("/tmp/xero-ih-{short_id}.sock"));
+        // Remove stale socket from a previous crash.
+        let _ = std::fs::remove_file(&socket_path);
+        Ok(Self {
+            binary: binary.into(),
+            udid,
+            socket_path,
+        })
+    }
+}
+
+/// Running helper instance. Drop terminates the helper process.
+pub struct Helper {
+    pub socket_path: PathBuf,
+    pub guard: ChildGuard,
+}
+
+/// Spawn the Swift helper and wait for it to start accepting UDS connections.
+pub fn spawn(launch: HelperLaunch, startup_timeout: Duration) -> Result<Helper> {
+    let mut cmd = Command::new(&launch.binary);
+    cmd.args([
+        "--udid",
+        &launch.udid,
+        "--socket-path",
+        launch.socket_path.to_str().unwrap_or_default(),
+    ])
+    .stdout(Stdio::null())
+    .stderr(Stdio::piped());
+
+    let child = cmd.spawn()?;
+    let mut guard = ChildGuard::new("xero-ios-helper", child);
+
+    let deadline = Instant::now() + startup_timeout;
+    loop {
+        // Check if process exited early.
+        match guard.try_wait() {
+            Ok(Some(status)) => {
+                let tail = guard.stderr_tail();
+                return Err(std::io::Error::other(format!(
+                    "xero-ios-helper exited before accepting connections (status={status}). \
+                     stderr: {tail}"
+                )));
+            }
+            Ok(None) if Instant::now() >= deadline => {
+                return Err(std::io::Error::new(
+                    std::io::ErrorKind::TimedOut,
+                    format!(
+                        "xero-ios-helper did not start listening on {} within {:?}",
+                        launch.socket_path.display(),
+                        startup_timeout
+                    ),
+                ));
+            }
+            Ok(None) => {}
+            Err(err) => return Err(err),
+        }
+
+        // Attempt UDS connection.
+        if UnixStream::connect(&launch.socket_path).is_ok() {
+            break;
+        }
+        std::thread::sleep(Duration::from_millis(150));
+    }
+
+    Ok(Helper {
+        socket_path: launch.socket_path,
+        guard,
+    })
+}
+
+/// Locate the helper binary. Check (in order):
+///   1. Tauri resource directory (bundled builds)
+///   2. Adjacent to the running executable (dev builds)
+///   3. $PATH
+pub fn resolve_helper_binary<R: Runtime>(app: &AppHandle<R>) -> Option<PathBuf> {
+    const BINARY_NAME: &str = "xero-ios-helper";
+
+    // 1. Tauri resource directory.
+    if let Ok(resource_dir) = app.path().resource_dir() {
+        let candidate: PathBuf = resource_dir.join(BINARY_NAME);
+        if candidate.is_file() {
+            return Some(candidate);
+        }
+    }
+
+    // 2. Next to the running executable (cargo build puts it in target/<profile>/).
+    if let Ok(exe) = std::env::current_exe() {
+        if let Some(dir) = exe.parent() {
+            let candidate = dir.join(BINARY_NAME);
+            if candidate.is_file() {
+                return Some(candidate);
+            }
+        }
+    }
+
+    // 3. $PATH lookup.
+    if let Ok(output) = Command::new("which")
+        .arg(BINARY_NAME)
+        .output()
+    {
+        if output.status.success() {
+            let path = String::from_utf8_lossy(&output.stdout).trim().to_string();
+            let p = PathBuf::from(&path);
+            if p.is_file() {
+                return Some(p);
+            }
+        }
+    }
+
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn helper_launch_generates_valid_socket_path() {
+        let launch =
+            HelperLaunch::new("/usr/bin/true", "AAAA-BBBB-CCCC").expect("launch creation");
+        assert!(launch
+            .socket_path
+            .to_str()
+            .unwrap()
+            .contains("xero-ios-helper-AAAA-BBBB-CCCC.sock"));
+    }
+
+    #[test]
+    fn helper_launch_cleans_stale_socket() {
+        let udid = "test-stale-socket-cleanup";
+        let path = std::env::temp_dir().join(format!("xero-ios-helper-{udid}.sock"));
+        // Create a fake stale file.
+        std::fs::write(&path, b"stale").ok();
+        assert!(path.exists());
+
+        let _launch = HelperLaunch::new("/usr/bin/true", udid).expect("launch creation");
+        assert!(!path.exists(), "stale socket should be removed");
+    }
+}
diff --git a/client/src-tauri/src/commands/emulator/ios/helper_client.rs b/client/src-tauri/src/commands/emulator/ios/helper_client.rs
new file mode 100644
index 00000000..c08d0725
--- /dev/null
+++ b/client/src-tauri/src/commands/emulator/ios/helper_client.rs
@@ -0,0 +1,397 @@
+//! UDS client for communicating with the Swift helper binary.
+//!
+//! Binary framing protocol:
+//!   [1 byte type][4 bytes payload length BE][payload bytes]
+//!
+//! Types:
+//!   0x01 — JSON control message (UTF-8)
+//!   0x02 — Frame: payload = [4B width BE][4B height BE][JPEG bytes]
+
+use std::collections::HashMap;
+use std::io::{self, BufWriter, Read, Write};
+use std::os::unix::net::UnixStream;
+use std::path::Path;
+use std::sync::atomic::{AtomicU64, Ordering};
+use std::sync::{mpsc, Arc, Mutex};
+use std::thread::{self, JoinHandle};
+use std::time::Duration;
+
+use serde_json::{json, Value};
+
+use crate::commands::emulator::ios::input::{HardwareButton, TouchPhase};
+use crate::commands::CommandError;
+
+// Message type constants.
+const MSG_TYPE_JSON: u8 = 0x01;
+const MSG_TYPE_FRAME: u8 = 0x02;
+
+/// A single captured frame from the Swift helper.
+pub struct FrameData {
+    pub width: u32,
+    pub height: u32,
+    pub jpeg: Vec<u8>,
+}
+
+/// Client that communicates with xero-ios-helper over a Unix domain socket.
+pub struct HelperClient {
+    writer: Mutex<BufWriter<UnixStream>>,
+    frame_rx: Mutex<Option<mpsc::Receiver<FrameData>>>,
+    responses: Arc<Mutex<HashMap<u64, mpsc::Sender<Value>>>>,
+    request_id: AtomicU64,
+    _reader_thread: JoinHandle<()>,
+}
+
+impl HelperClient {
+    /// Connect to the helper's UDS and spawn the reader thread.
+    pub fn connect(socket_path: &Path, timeout: Duration) -> io::Result<Self> {
+        let stream = connect_with_timeout(socket_path, timeout)?;
+        let read_stream = stream.try_clone()?;
+
+        let (frame_tx, frame_rx) = mpsc::channel::<FrameData>();
+        let responses: Arc<Mutex<HashMap<u64, mpsc::Sender<Value>>>> =
+            Arc::new(Mutex::new(HashMap::new()));
+        let responses_clone = Arc::clone(&responses);
+
+        let reader_thread = thread::Builder::new()
+            .name("ios-helper-reader".into())
+            .spawn(move || {
+                reader_loop(read_stream, frame_tx, responses_clone);
+            })
+            .map_err(|e| io::Error::new(io::ErrorKind::Other, e))?;
+
+        Ok(Self {
+            writer: Mutex::new(BufWriter::new(stream)),
+            frame_rx: Mutex::new(Some(frame_rx)),
+            responses,
+            request_id: AtomicU64::new(1),
+            _reader_thread: reader_thread,
+        })
+    }
+
+    /// Take ownership of the frame receiver. Called once by the frame pump
+    /// thread. Returns `None` if already taken.
+    pub fn take_frame_rx(&self) -> Option<mpsc::Receiver<FrameData>> {
+        self.frame_rx.lock().unwrap().take()
+    }
+
+    // MARK: - Public API
+
+    /// Start frame capture at the given FPS. Returns (width, height).
+    pub fn start_capture(&self, fps: u32) -> Result<(u32, u32), CommandError> {
+        let resp = self.send_request("start_capture", json!({ "fps": fps }))?;
+        let w = resp["width"].as_u64().unwrap_or(0) as u32;
+        let h = resp["height"].as_u64().unwrap_or(0) as u32;
+        Ok((w, h))
+    }
+
+    /// Stop frame capture.
+    pub fn stop_capture(&self) -> Result<(), CommandError> {
+        self.send_request("stop_capture", json!({}))?;
+        Ok(())
+    }
+
+    /// Send a touch event to the simulator.
+    pub fn send_touch(
+        &self,
+        phase: TouchPhase,
+        x: i32,
+        y: i32,
+    ) -> Result<(), CommandError> {
+        let phase_str = match phase {
+            TouchPhase::Began => "began",
+            TouchPhase::Moved => "moved",
+            TouchPhase::Ended => "ended",
+            TouchPhase::Cancelled => "cancelled",
+        };
+        self.send_request(
+            "hid_touch",
+            json!({ "phase": phase_str, "x": x, "y": y }),
+        )?;
+        Ok(())
+    }
+
+    /// Send a swipe gesture.
+    pub fn send_swipe(
+        &self,
+        from_x: i32,
+        from_y: i32,
+        to_x: i32,
+        to_y: i32,
+        duration_ms: u32,
+    ) -> Result<(), CommandError> {
+        self.send_request(
+            "hid_swipe",
+            json!({
+                "from_x": from_x, "from_y": from_y,
+                "to_x": to_x, "to_y": to_y,
+                "duration_ms": duration_ms,
+            }),
+        )?;
+        Ok(())
+    }
+
+    /// Inject text into the simulator.
+    pub fn send_text(&self, text: &str) -> Result<(), CommandError> {
+        self.send_request("hid_text", json!({ "text": text }))?;
+        Ok(())
+    }
+
+    /// Press a hardware button.
+    pub fn send_button(&self, button: HardwareButton) -> Result<(), CommandError> {
+        let name = match button {
+            HardwareButton::Home => "home",
+            HardwareButton::Lock => "lock",
+            HardwareButton::VolumeUp => "volume_up",
+            HardwareButton::VolumeDown => "volume_down",
+            HardwareButton::Siri => "siri",
+            HardwareButton::SideButton => "side_button",
+        };
+        self.send_request("hid_button", json!({ "button": name }))?;
+        Ok(())
+    }
+
+    /// Get the accessibility tree from the Simulator process via AXUIElement.
+    /// Returns the raw JSON tree that `ios_ui::normalize_tree()` can parse.
+    pub fn accessibility_tree(&self) -> Result<serde_json::Value, CommandError> {
+        let resp = self.send_request("accessibility_tree", json!({}))?;
+        resp.get("tree")
+            .cloned()
+            .ok_or_else(|| {
+                CommandError::system_fault(
+                    "ios_helper_ax_no_tree",
+                    "helper returned no tree in accessibility_tree response".to_string(),
+                )
+            })
+    }
+
+    /// Health check.
+    pub fn ping(&self) -> Result<(), CommandError> {
+        self.send_request("ping", json!({}))?;
+        Ok(())
+    }
+
+    // MARK: - Request/response correlation
+
+    /// Send a raw request to the helper and return the JSON response.
+    /// Public so `emulator_inspector_element_at` can call AX inspection
+    /// directly without a typed wrapper.
+    pub fn send_request_raw(&self, method: &str, params: Value) -> Result<Value, CommandError> {
+        self.send_request(method, params)
+    }
+
+    fn send_request(&self, method: &str, params: Value) -> Result<Value, CommandError> {
+        let id = self.request_id.fetch_add(1, Ordering::Relaxed);
+
+        let msg = json!({
+            "id": id,
+            "method": method,
+            "params": params,
+        });
+
+        let payload = serde_json::to_vec(&msg).map_err(|e| {
+            CommandError::system_fault("ios_helper_serialize", format!("json encode: {e}"))
+        })?;
+
+        // Create a one-shot channel for the response.
+        let (tx, rx) = mpsc::channel::<Value>();
+        {
+            let mut map = self.responses.lock().unwrap();
+            map.insert(id, tx);
+        }
+
+        // Write the framed message.
+        {
+            let mut writer = self.writer.lock().unwrap();
+            write_message(&mut *writer, MSG_TYPE_JSON, &payload).map_err(|e| {
+                CommandError::system_fault("ios_helper_write", format!("socket write: {e}"))
+            })?;
+            writer.flush().map_err(|e| {
+                CommandError::system_fault("ios_helper_flush", format!("socket flush: {e}"))
+            })?;
+        }
+
+        // Wait for response with timeout.
+        let response = rx.recv_timeout(Duration::from_secs(10)).map_err(|_| {
+            // Clean up the pending entry.
+            self.responses.lock().unwrap().remove(&id);
+            CommandError::system_fault(
+                "ios_helper_timeout",
+                format!("no response for {method} (id={id}) within 10s"),
+            )
+        })?;
+
+        // Check for error in response.
+        if let Some(err) = response.get("error") {
+            let code = err["code"].as_str().unwrap_or("unknown");
+            let message = err["message"].as_str().unwrap_or("helper error");
+            return Err(CommandError::system_fault(
+                &format!("ios_helper_{code}"),
+                message.to_string(),
+            ));
+        }
+
+        Ok(response)
+    }
+}
+
+// MARK: - Reader thread
+
+fn reader_loop(
+    mut stream: UnixStream,
+    frame_tx: mpsc::Sender<FrameData>,
+    responses: Arc<Mutex<HashMap<u64, mpsc::Sender<Value>>>>,
+) {
+    loop {
+        let (msg_type, payload) = match read_message(&mut stream) {
+            Ok(msg) => msg,
+            Err(_) => break, // Connection closed or error.
+        };
+
+        match msg_type {
+            MSG_TYPE_JSON => {
+                if let Ok(value) = serde_json::from_slice::<Value>(&payload) {
+                    // Check if this is a response (has `id` field).
+                    if let Some(id) = value["id"].as_u64() {
+                        let tx = {
+                            let mut map = responses.lock().unwrap();
+                            map.remove(&id)
+                        };
+                        if let Some(tx) = tx {
+                            // Events (no `id`) can be logged or handled here.
+                            // For now, error events are logged to stderr.
+                            if value.get("event").is_some() {
+                                let code = value["code"].as_str().unwrap_or("unknown");
+                                let message = value["message"].as_str().unwrap_or("");
+                                eprintln!("ios-helper event: {code}: {message}");
+                            }
+                            let _ = tx.send(value);
+                            continue;
+                        }
+                    }
+                    // Events without an id (async events from helper).
+                    if value.get("event").is_some() {
+                        let code = value["code"].as_str().unwrap_or("unknown");
+                        let message = value["message"].as_str().unwrap_or("");
+                        eprintln!("ios-helper event: {code}: {message}");
+                    }
+                }
+            }
+            MSG_TYPE_FRAME => {
+                if payload.len() >= 8 {
+                    let width = u32::from_be_bytes([
+                        payload[0], payload[1], payload[2], payload[3],
+                    ]);
+                    let height = u32::from_be_bytes([
+                        payload[4], payload[5], payload[6], payload[7],
+                    ]);
+                    let jpeg = payload[8..].to_vec();
+                    let _ = frame_tx.send(FrameData { width, height, jpeg });
+                }
+            }
+            _ => {} // Unknown type; ignore.
+        }
+    }
+}
+
+// MARK: - Framing primitives
+
+fn write_message(w: &mut impl Write, msg_type: u8, payload: &[u8]) -> io::Result<()> {
+    // Header: [1 byte type][4 bytes length BE]
+    w.write_all(&[msg_type])?;
+    w.write_all(&(payload.len() as u32).to_be_bytes())?;
+    w.write_all(payload)?;
+    Ok(())
+}
+
+fn read_message(r: &mut impl Read) -> io::Result<(u8, Vec<u8>)> {
+    // Read header: 1 byte type + 4 bytes length.
+    let mut header = [0u8; 5];
+    r.read_exact(&mut header)?;
+
+    let msg_type = header[0];
+    let length = u32::from_be_bytes([header[1], header[2], header[3], header[4]]) as usize;
+
+    // Sanity limit: 50MB.
+    if length > 50_000_000 {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("message too large: {length}"),
+        ));
+    }
+
+    let mut payload = vec![0u8; length];
+    r.read_exact(&mut payload)?;
+    Ok((msg_type, payload))
+}
+
+/// Connect to a UDS with a retry loop + timeout.
+fn connect_with_timeout(path: &Path, timeout: Duration) -> io::Result<UnixStream> {
+    let deadline = std::time::Instant::now() + timeout;
+    loop {
+        match UnixStream::connect(path) {
+            Ok(stream) => return Ok(stream),
+            Err(e) if std::time::Instant::now() >= deadline => return Err(e),
+            Err(_) => std::thread::sleep(Duration::from_millis(100)),
+        }
+    }
+}
+
+// MARK: - Tests
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Cursor;
+
+    #[test]
+    fn write_read_json_message_roundtrip() {
+        let payload = b"{\"id\":1,\"ok\":true}";
+        let mut buf = Vec::new();
+        write_message(&mut buf, MSG_TYPE_JSON, payload).unwrap();
+
+        let mut cursor = Cursor::new(buf);
+        let (msg_type, data) = read_message(&mut cursor).unwrap();
+        assert_eq!(msg_type, MSG_TYPE_JSON);
+        assert_eq!(data, payload);
+    }
+
+    #[test]
+    fn write_read_frame_message_roundtrip() {
+        let width: u32 = 1179;
+        let height: u32 = 2556;
+        let jpeg = vec![0xFF, 0xD8, 0xFF, 0xE0, 1, 2, 3];
+
+        // Build frame payload: [4B width BE][4B height BE][JPEG bytes]
+        let mut payload = Vec::new();
+        payload.extend_from_slice(&width.to_be_bytes());
+        payload.extend_from_slice(&height.to_be_bytes());
+        payload.extend_from_slice(&jpeg);
+
+        let mut buf = Vec::new();
+        write_message(&mut buf, MSG_TYPE_FRAME, &payload).unwrap();
+
+        let mut cursor = Cursor::new(buf);
+        let (msg_type, data) = read_message(&mut cursor).unwrap();
+        assert_eq!(msg_type, MSG_TYPE_FRAME);
+        assert!(data.len() >= 8);
+
+        let w = u32::from_be_bytes([data[0], data[1], data[2], data[3]]);
+        let h = u32::from_be_bytes([data[4], data[5], data[6], data[7]]);
+        let j = &data[8..];
+        assert_eq!(w, 1179);
+        assert_eq!(h, 2556);
+        assert_eq!(j, &jpeg);
+    }
+
+    #[test]
+    fn rejects_oversized_message() {
+        // Construct a header claiming 100MB payload.
+        let mut buf = vec![MSG_TYPE_JSON];
+        buf.extend_from_slice(&100_000_001u32.to_be_bytes());
+        buf.extend_from_slice(&[0u8; 10]); // Not enough data.
+
+        let mut cursor = Cursor::new(buf);
+        let result = read_message(&mut cursor);
+        assert!(result.is_err());
+    }
+}
diff --git a/client/src-tauri/src/commands/emulator/ios/mod.rs b/client/src-tauri/src/commands/emulator/ios/mod.rs
index 644e9727..656e95f8 100644
--- a/client/src-tauri/src/commands/emulator/ios/mod.rs
+++ b/client/src-tauri/src/commands/emulator/ios/mod.rs
@@ -6,6 +6,10 @@ pub mod sdk;
 #[cfg(target_os = "macos")]
 pub mod cg_input;
 #[cfg(target_os = "macos")]
+pub mod helper;
+#[cfg(target_os = "macos")]
+pub mod helper_client;
+#[cfg(target_os = "macos")]
 pub mod idb_client;
 #[cfg(target_os = "macos")]
 pub mod idb_companion;
diff --git a/client/src-tauri/src/commands/emulator/ios/session.rs b/client/src-tauri/src/commands/emulator/ios/session.rs
index b1c3d320..20434f2b 100644
--- a/client/src-tauri/src/commands/emulator/ios/session.rs
+++ b/client/src-tauri/src/commands/emulator/ios/session.rs
@@ -25,6 +25,8 @@ use crate::commands::emulator::{EmulatorInputRequest, InputKind, Orientation};
 use crate::commands::CommandError;
 
 use super::cg_input;
+use super::helper;
+use super::helper_client::HelperClient;
 use super::idb_client::{IdbClient, VideoStreamHandle};
 use super::idb_companion::{self, Companion};
 use super::input::{self, HidEvent, TouchPhase};
@@ -60,6 +62,11 @@ pub struct IosSession {
     device_name: String,
     width: u32,
     height: u32,
+    /// Present when the Swift helper (`xero-ios-helper`) was found and
+    /// spawned. Preferred over idb_companion for both frame capture
+    /// (ScreenCaptureKit) and HID input (IndigoHID).
+    helper: Option<helper::Helper>,
+    helper_client: Option<Arc<HelperClient>>,
     /// Present only when `idb_companion` was found on disk and spawned
     /// successfully. Preferred for HID input and required for automation
     /// commands that need idb data (UI dump, log stream).
@@ -135,23 +142,45 @@ impl IosSession {
     }
 
     fn send_touch(&self, phase: TouchPhase, nx: f32, ny: f32) -> Result<(), CommandError> {
-        // Taps route through `cg_input::send_touch`, which on current
-        // macOS actually dispatches via AppleScript's AX `click at` (see
-        // the doc on that function — CGEventPostToPid is silently dropped
-        // on macOS 26, and the bundled idb_companion's CoreSim HID
-        // bridge is broken for Xcode 26). idb is kept as a last resort
-        // for the day a working companion ships.
-        let cg_result = cg_input::send_touch(&self.device_name, phase, nx, ny);
-        if cg_result.is_ok() || !should_try_idb_after_cg(cg_result.as_ref().unwrap_err()) {
-            return cg_result;
-        }
-
-        if let Some(client) = self.client.as_ref() {
-            let (x, y) = input::denormalize(nx, ny, self.width.max(1), self.height.max(1));
-            return client.send_hid(HidEvent::Touch { phase, x, y });
+        let (px, py) = input::denormalize(nx, ny, self.width.max(1), self.height.max(1));
+
+        match phase {
+            TouchPhase::Began => {
+                // Taps: CG/AppleScript click is the proven path on macOS 26.
+                // idb_companion 1.1.8 HID is broken on Xcode 26 (returns Ok
+                // but silently drops the event). Try CG first, then helper/idb.
+                let cg = cg_input::send_touch(&self.device_name, phase, nx, ny);
+                if cg.is_ok() {
+                    return cg;
+                }
+                // CG failed (AX denied, window not found) — try helper, then idb.
+                if let Some(hc) = self.helper_client.as_ref() {
+                    if hc.send_touch(phase, px, py).is_ok() {
+                        return Ok(());
+                    }
+                }
+                if let Some(client) = self.client.as_ref() {
+                    if client.send_hid(HidEvent::Touch { phase, x: px, y: py }).is_ok() {
+                        return Ok(());
+                    }
+                }
+                cg
+            }
+            TouchPhase::Moved | TouchPhase::Ended | TouchPhase::Cancelled => {
+                // Drags/swipes: CG is a no-op for these phases.
+                // Helper (IndigoHID) and idb are the only paths that work.
+                if let Some(hc) = self.helper_client.as_ref() {
+                    if hc.send_touch(phase, px, py).is_ok() {
+                        return Ok(());
+                    }
+                }
+                if let Some(client) = self.client.as_ref() {
+                    return client.send_hid(HidEvent::Touch { phase, x: px, y: py });
+                }
+                // No helper or idb available — silent no-op (same as before).
+                Ok(())
+            }
         }
-
-        cg_result
     }
 
     fn send_swipe(
@@ -162,27 +191,37 @@ impl IosSession {
         to_y: f32,
         duration_ms: u32,
     ) -> Result<(), CommandError> {
-        let cg_result =
-            cg_input::send_swipe(&self.device_name, from_x, from_y, to_x, to_y, duration_ms);
-        if cg_result.is_ok() || !should_try_idb_after_cg(cg_result.as_ref().unwrap_err()) {
-            return cg_result;
+        let width = self.width.max(1);
+        let height = self.height.max(1);
+        let (fx, fy) = input::denormalize(from_x, from_y, width, height);
+        let (tx, ty) = input::denormalize(to_x, to_y, width, height);
+
+        // 1. Swift helper (IndigoHID) — most reliable.
+        if let Some(hc) = self.helper_client.as_ref() {
+            if hc.send_swipe(fx, fy, tx, ty, duration_ms).is_ok() {
+                return Ok(());
+            }
+        }
+
+        // 2. CG/AppleScript drag — proven working path, try before idb
+        //    because idb HID is broken on Xcode 26.
+        let cg = cg_input::send_swipe(&self.device_name, from_x, from_y, to_x, to_y, duration_ms);
+        if cg.is_ok() {
+            return cg;
         }
 
+        // 3. idb gRPC HID — last resort.
         if let Some(client) = self.client.as_ref() {
-            let width = self.width.max(1);
-            let height = self.height.max(1);
-            let (from_x_px, from_y_px) = input::denormalize(from_x, from_y, width, height);
-            let (to_x_px, to_y_px) = input::denormalize(to_x, to_y, width, height);
             return client.send_hid(HidEvent::Swipe {
-                from_x: from_x_px,
-                from_y: from_y_px,
-                to_x: to_x_px,
-                to_y: to_y_px,
+                from_x: fx,
+                from_y: fy,
+                to_x: tx,
+                to_y: ty,
                 duration_ms,
             });
         }
 
-        cg_result
+        cg
     }
 
     fn send_hid_or_cg(
@@ -190,6 +229,20 @@ impl IosSession {
         event: HidEvent,
         fallback: impl FnOnce(&str) -> Result<(), CommandError>,
     ) -> Result<(), CommandError> {
+        // Prefer Swift helper for button/text events.
+        if let Some(hc) = self.helper_client.as_ref() {
+            let helper_result = match &event {
+                HidEvent::Button { button } => hc.send_button(*button),
+                HidEvent::Text { text } => hc.send_text(text),
+                HidEvent::Home => hc.send_button(input::HardwareButton::Home),
+                _ => Err(CommandError::system_fault("unsupported_helper_event", "event type not supported by helper")),
+            };
+            if helper_result.is_ok() {
+                return helper_result;
+            }
+            // Fall through to idb/CG on helper failure.
+        }
+
         if let Some(client) = self.client.as_ref() {
             let result = client.send_hid(event);
             if result.is_ok() || !should_try_cg_fallback(result.as_ref().unwrap_err()) {
@@ -267,6 +320,12 @@ impl IosSession {
         self.client.as_ref().map(Arc::clone)
     }
 
+    /// Expose the Swift helper client for accessibility tree queries
+    /// (Phase 3 AXUIElement inspection).
+    pub fn helper_client(&self) -> Option<Arc<HelperClient>> {
+        self.helper_client.as_ref().map(Arc::clone)
+    }
+
     pub fn shutdown(&mut self) {
         self.shutdown_flag.store(true, Ordering::Relaxed);
         if let Some(handle) = self.video.take() {
@@ -275,6 +334,15 @@ impl IosSession {
         if let Some(handle) = self.fallback_thread.take() {
             let _ = handle.join();
         }
+        // Shut down Swift helper before idb_companion.
+        if let Some(ref hc) = self.helper_client {
+            let _ = hc.stop_capture();
+        }
+        self.helper_client = None;
+        if let Some(mut h) = self.helper.take() {
+            let _ = h.guard.shutdown(Duration::from_millis(500));
+            let _ = std::fs::remove_file(&h.socket_path);
+        }
         if let Some(mut companion) = self.companion.take() {
             let _ = companion.guard.shutdown(Duration::from_millis(500));
         }
@@ -292,17 +360,6 @@ fn should_try_cg_fallback(err: &CommandError) -> bool {
     )
 }
 
-/// After a CGEvent send fails, only fall through to idb's HID path for
-/// errors that mean "CG can't reach the Simulator window" — missing AX
-/// permission or the Simulator window being absent. Other errors are bugs
-/// in the CG path itself and retrying via idb won't help.
-fn should_try_idb_after_cg(err: &CommandError) -> bool {
-    matches!(
-        err.code.as_str(),
-        "ios_ax_permission_denied" | "ios_simulator_window_not_found"
-    )
-}
-
 impl Drop for IosSession {
     fn drop(&mut self) {
         self.shutdown();
@@ -320,6 +377,8 @@ pub fn spawn<R: Runtime + 'static>(args: SpawnArgs<R>) -> Result<IosSession, Com
         device_id,
     } = args;
 
+    eprintln!("[ios-session] spawn starting for {device_id}");
+
     emit_status(
         &app,
         StatusPhase::Booting,
@@ -327,6 +386,7 @@ pub fn spawn<R: Runtime + 'static>(args: SpawnArgs<R>) -> Result<IosSession, Com
         Some(format!("booting simulator {device_id}")),
     );
 
+    eprintln!("[ios-session] calling xcrun boot...");
     xcrun::boot(&device_id, BOOT_TIMEOUT).map_err(|err| {
         CommandError::system_fault(
             "ios_boot_failed",
@@ -344,8 +404,10 @@ pub fn spawn<R: Runtime + 'static>(args: SpawnArgs<R>) -> Result<IosSession, Com
     // dispatch. `open -g` keeps Xero frontmost on most recent macOS
     // releases; brief sleep gives the window server time to register the
     // new window before we hand control back to the frontend.
+    eprintln!("[ios-session] boot complete, focusing simulator...");
     let _ = xcrun::focus_simulator(&device_id);
     std::thread::sleep(Duration::from_millis(400));
+    eprintln!("[ios-session] focus done, attaching pipeline...");
 
     emit_status(
         &app,
@@ -354,6 +416,46 @@ pub fn spawn<R: Runtime + 'static>(args: SpawnArgs<R>) -> Result<IosSession, Com
         Some("attaching input pipeline".to_string()),
     );
 
+    // --- Try Swift helper (ScreenCaptureKit + IndigoHID) ---
+    // The helper is preferred over idb_companion: it gives us 30 FPS
+    // frames via ScreenCaptureKit and reliable touch/swipe via Indigo.
+    eprintln!("[ios-session] looking for helper binary...");
+    let (ios_helper, ios_helper_client) = match helper::resolve_helper_binary(&app) {
+        Some(binary) => {
+            match helper::HelperLaunch::new(binary, device_id.clone())
+                .and_then(|launch| helper::spawn(launch, Duration::from_secs(5)))
+            {
+                Ok(h) => {
+                    match super::helper_client::HelperClient::connect(
+                        &h.socket_path,
+                        Duration::from_secs(5),
+                    ) {
+                        Ok(c) => {
+                            emit_status(
+                                &app,
+                                StatusPhase::Connecting,
+                                &device_id,
+                                Some("Swift helper connected (ScreenCaptureKit + IndigoHID)".into()),
+                            );
+                            (Some(h), Some(Arc::new(c)))
+                        }
+                        Err(e) => {
+                            eprintln!("xero: helper UDS connect failed: {e}");
+                            (None, None)
+                        }
+                    }
+                }
+                Err(e) => {
+                    eprintln!("xero: helper spawn failed: {e}");
+                    (None, None)
+                }
+            }
+        }
+        None => (None, None),
+    };
+
+    eprintln!("[ios-session] helper result: helper={}, client={}", ios_helper.is_some(), ios_helper_client.is_some());
+
     // `idb_companion` is best-effort: when it starts, HID input uses idb's
     // real simulator surface; when it does not, the session can still render
     // via screenshots and attempt Core Graphics input.
@@ -386,15 +488,39 @@ pub fn spawn<R: Runtime + 'static>(args: SpawnArgs<R>) -> Result<IosSession, Com
         .as_ref()
         .map(|c| Arc::new(IdbClient::new(c.grpc_port, device_id.clone())));
 
+    eprintln!("[ios-session] idb companion={}, client={}", companion.is_some(), client.is_some());
+    eprintln!("[ios-session] starting frame pump...");
+
     let shutdown_flag = Arc::new(AtomicBool::new(false));
     let (width, height, video_handle, fallback_thread) = start_frame_pump(
         &app,
+        ios_helper_client.as_ref(),
         client.as_ref(),
         &frame_bus,
         &device_id,
         Arc::clone(&shutdown_flag),
     )?;
 
+    eprintln!("[ios-session] frame pump started: {width}x{height}");
+
+    // Minimize the Simulator.app window now that the frame pump is
+    // capturing it. The window must exist (ScreenCaptureKit / simctl
+    // needs it) but the user only needs the Xero sidebar view.
+    // Miniaturize via AppleScript — best effort, requires Accessibility.
+    let _ = std::process::Command::new("osascript")
+        .args(["-e", r#"
+            tell application "System Events"
+                tell process "Simulator"
+                    try
+                        click (first button of first window whose subrole is "AXMinimizeButton")
+                    end try
+                end tell
+            end tell
+        "#])
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::null())
+        .status();
+
     emit_status(
         &app,
         StatusPhase::Streaming,
@@ -402,11 +528,14 @@ pub fn spawn<R: Runtime + 'static>(args: SpawnArgs<R>) -> Result<IosSession, Com
         Some(format!("streaming at {width}x{height}")),
     );
 
+    eprintln!("[ios-session] spawn complete, returning session");
     Ok(IosSession {
         device_id,
         device_name,
         width,
         height,
+        helper: ios_helper,
+        helper_client: ios_helper_client,
         client,
         video: video_handle,
         shutdown_flag,
@@ -418,11 +547,49 @@ pub fn spawn<R: Runtime + 'static>(args: SpawnArgs<R>) -> Result<IosSession, Com
 
 fn start_frame_pump<R: Runtime + 'static>(
     app: &AppHandle<R>,
-    client: Option<&Arc<IdbClient>>,
+    helper_client: Option<&Arc<HelperClient>>,
+    idb_client: Option<&Arc<IdbClient>>,
     bus: &Arc<FrameBus>,
     device_id: &str,
     shutdown: Arc<AtomicBool>,
 ) -> Result<FramePumpStart, CommandError> {
+    eprintln!("[frame-pump] helper={}, idb={}", helper_client.is_some(), idb_client.is_some());
+
+    // If the Swift helper is connected, try ScreenCaptureKit frames.
+    // On failure (e.g., Screen Recording permission denied), fall through
+    // to the idb/screenshot path instead of hard-failing the session.
+    if let Some(hc) = helper_client {
+        match hc.start_capture(30) {
+            Ok((w, h)) => {
+                if let Some(frame_rx) = hc.take_frame_rx() {
+                    let bus2 = Arc::clone(bus);
+                    let app2 = app.clone();
+                    let flag = Arc::clone(&shutdown);
+                    let thread = thread::spawn(move || {
+                        while !flag.load(Ordering::Relaxed) {
+                            match frame_rx.recv_timeout(Duration::from_secs(2)) {
+                                Ok(frame) => {
+                                    publish_and_emit(
+                                        &app2, &bus2, frame.width, frame.height, frame.jpeg,
+                                    );
+                                }
+                                Err(std::sync::mpsc::RecvTimeoutError::Timeout) => continue,
+                                Err(_) => break,
+                            }
+                        }
+                    });
+                    return Ok((w, h, None, Some(thread)));
+                }
+            }
+            Err(e) => {
+                eprintln!("xero: ScreenCaptureKit capture failed, falling back: {e}");
+                // Fall through to idb/screenshot path.
+            }
+        }
+    }
+
+    // Fallback: H.264 stream via idb_companion or screenshot polling.
+    let client = idb_client;
     let app_clone = app.clone();
     let bus_clone = Arc::clone(bus);
     let device_for_stream = device_id.to_string();
@@ -523,10 +690,27 @@ fn spawn_screenshot_fallback<R: Runtime + 'static>(
     device_id: String,
     shutdown: Arc<AtomicBool>,
 ) -> Result<(u32, u32, JoinHandle<()>), CommandError> {
-    let png = xcrun::screenshot(&device_id).map_err(|err| {
+    // Retry the initial screenshot — iOS 26's display pipeline can take
+    // several seconds to attach after boot, causing ScreenshotError code=2.
+    let mut png = None;
+    for attempt in 0..10 {
+        match xcrun::screenshot(&device_id) {
+            Ok(data) => {
+                png = Some(data);
+                break;
+            }
+            Err(e) => {
+                eprintln!("[frame-pump] initial screenshot attempt {attempt} failed: {e}");
+                if attempt < 9 {
+                    std::thread::sleep(Duration::from_millis(500));
+                }
+            }
+        }
+    }
+    let png = png.ok_or_else(|| {
         CommandError::system_fault(
             "ios_screenshot_failed",
-            format!("initial simctl screenshot failed: {err}"),
+            "initial simctl screenshot failed after 10 retries (display not ready)".to_string(),
         )
     })?;
     let initial =
@@ -544,7 +728,9 @@ fn spawn_screenshot_fallback<R: Runtime + 'static>(
         // shouldn't kill the whole frame pump. Exit only after the shutdown
         // flag is set or the failure streak clearly means the simulator is
         // gone.
-        const MAX_CONSECUTIVE_FAILURES: u32 = 10;
+        // iOS 26 cold boot can take 30+ seconds during which simctl
+        // screenshots fail with ScreenshotError code=2. Be very tolerant.
+        const MAX_CONSECUTIVE_FAILURES: u32 = 60;
         let mut consecutive_failures = 0u32;
         loop {
             if shutdown.load(Ordering::Relaxed) {
diff --git a/client/src-tauri/src/commands/emulator/ios/xcrun.rs b/client/src-tauri/src/commands/emulator/ios/xcrun.rs
index 123a1d09..0bf7da31 100644
--- a/client/src-tauri/src/commands/emulator/ios/xcrun.rs
+++ b/client/src-tauri/src/commands/emulator/ios/xcrun.rs
@@ -325,6 +325,9 @@ pub mod hid_fallback {
 /// follow up with an activate in the caller for keystrokes that need
 /// focus.
 pub fn focus_simulator(udid: &str) -> Result<()> {
+    // Do NOT use -j (hide) — iOS 26 needs the display pipeline active
+    // to finish booting. The window opens in background (-g) so Xero
+    // stays frontmost.
     let status = Command::new("open")
         .args([
             "-g",
@@ -340,9 +343,8 @@ pub fn focus_simulator(udid: &str) -> Result<()> {
             "could not launch Simulator.app: open exited {status}"
         )));
     }
-    // Give Simulator.app a brief moment to claim the window when we just
-    // launched it; System Events can't target a process that hasn't
-    // registered yet.
+    // Give Simulator.app a moment to register its window for
+    // ScreenCaptureKit / CGEvent targeting.
     std::thread::sleep(Duration::from_millis(150));
     Ok(())
 }
diff --git a/client/src-tauri/src/commands/emulator/mod.rs b/client/src-tauri/src/commands/emulator/mod.rs
index 6408137f..2e8425cb 100644
--- a/client/src-tauri/src/commands/emulator/mod.rs
+++ b/client/src-tauri/src/commands/emulator/mod.rs
@@ -43,6 +43,9 @@ use automation::{
     LocationRequest, LogSubscribeRequest, PushNotificationRequest, ScreenshotResponse, Selector,
     SubscriptionToken, SwipeRequest, TapTarget, TypeRequest, UiTree,
 };
+use automation::metro_inspector::{
+    ElementInfo, MetroInspector, MetroStatus, METRO_PORT_RANGE,
+};
 
 /// Process-wide emulator state. Holds the FrameBus (shared with the URI
 /// scheme handler) and the single active device session, if any.
@@ -51,6 +54,8 @@ pub struct EmulatorState {
     active: Mutex<Option<ActiveDevice>>,
     log_collector: automation::logs::LogCollector,
     log_stream: Mutex<Option<LogStreamHandle>>,
+    /// Metro inspector bridge (React Native / Expo).
+    metro_inspector: Mutex<Option<MetroInspector>>,
 }
 
 enum LogStreamHandle {
@@ -65,6 +70,7 @@ impl Default for EmulatorState {
             active: Mutex::new(None),
             log_collector: automation::logs::LogCollector::new(),
             log_stream: Mutex::new(None),
+            metro_inspector: Mutex::new(None),
         }
     }
 }
@@ -282,6 +288,50 @@ pub fn emulator_ios_open_accessibility_settings() -> CommandResult<()> {
     }
 }
 
+/// macOS only — trigger the system Screen Recording permission prompt.
+/// Required by ScreenCaptureKit for the Swift helper's frame capture.
+/// Returns the current permission state after the call.
+#[tauri::command]
+pub fn emulator_ios_request_screen_recording_permission<R: Runtime>(
+    app: AppHandle<R>,
+) -> CommandResult<bool> {
+    #[cfg(target_os = "macos")]
+    {
+        let granted = ios::cg_input::request_screen_recording_permission();
+        let _ = app.emit(EMULATOR_SDK_STATUS_CHANGED_EVENT, ());
+        Ok(granted)
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        let _ = app;
+        Ok(false)
+    }
+}
+
+/// Open the Privacy & Security → Screen Recording pane in System Settings
+/// so the user can enable Xero. macOS-only; on other hosts this is a no-op.
+#[tauri::command]
+pub fn emulator_ios_open_screen_recording_settings() -> CommandResult<()> {
+    #[cfg(target_os = "macos")]
+    {
+        use std::process::Command;
+        Command::new("open")
+            .arg("x-apple.systempreferences:com.apple.preference.security?Privacy_ScreenCapture")
+            .status()
+            .map_err(|e| {
+                CommandError::system_fault(
+                    "ios_open_screen_recording_failed",
+                    format!("could not launch System Settings: {e}"),
+                )
+            })?;
+        Ok(())
+    }
+    #[cfg(not(target_os = "macos"))]
+    {
+        Ok(())
+    }
+}
+
 #[tauri::command]
 pub fn emulator_list_devices<R: Runtime>(
     app: AppHandle<R>,
@@ -790,16 +840,12 @@ pub fn emulator_ui_dump(state: State<'_, EmulatorState>) -> CommandResult<UiTree
             }),
         #[cfg(target_os = "macos")]
         Some(ActiveDevice::Ios { session, .. }) => {
-            let client = session.client().ok_or_else(|| {
-                CommandError::user_fixable(
-                    "ios_idb_companion_unavailable",
-                    "The idb_companion sidecar isn't installed, so UI dumps aren't \
-                     available in this session. Install it via Homebrew \
-                     (`brew install facebook/fb/idb-companion`) and restart the \
-                     session — input still works without it.",
-                )
-            })?;
-            automation::ios_ui::dump(&client)
+            let helper = session.helper_client();
+            let idb = session.client();
+            automation::ios_ui::dump(
+                helper.as_deref(),
+                idb.as_deref(),
+            )
         }
         #[cfg(feature = "emulator-synthetic")]
         Some(ActiveDevice::Synthetic { .. }) => Err(CommandError::user_fixable(
@@ -1235,6 +1281,122 @@ impl ActiveDevice {
     }
 }
 
+// ---------- Metro Inspector commands (Phase 2) ----------------------------
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct InspectorConnectRequest {
+    pub port: Option<u16>,
+}
+
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct InspectorElementAtRequest {
+    pub x: f32,
+    pub y: f32,
+}
+
+/// Connect to the Metro inspector. Auto-discovers Metro on common ports
+/// unless an explicit port is provided.
+#[tauri::command]
+pub fn emulator_inspector_connect(
+    state: State<'_, EmulatorState>,
+    request: InspectorConnectRequest,
+) -> CommandResult<MetroStatus> {
+    // Disconnect any existing connection first.
+    let _ = state.metro_inspector.lock().unwrap().take();
+
+    let (inspector, status) = if let Some(port) = request.port {
+        MetroInspector::connect(port)?
+    } else {
+        MetroInspector::connect_auto(METRO_PORT_RANGE)?
+    };
+
+    *state.metro_inspector.lock().unwrap() = Some(inspector);
+    Ok(status)
+}
+
+/// Disconnect from the Metro inspector.
+#[tauri::command]
+pub fn emulator_inspector_disconnect(
+    state: State<'_, EmulatorState>,
+) -> CommandResult<()> {
+    let _ = state.metro_inspector.lock().unwrap().take();
+    Ok(())
+}
+
+/// Query the element at a device-pixel coordinate. Tries Metro inspector
+/// first (React Native), falls back to the Swift helper's AXUIElement
+/// bridge (native Swift/UIKit apps).
+#[tauri::command]
+pub fn emulator_inspector_element_at(
+    state: State<'_, EmulatorState>,
+    request: InspectorElementAtRequest,
+) -> CommandResult<ElementInfo> {
+    // 1. Try Metro inspector (React Native / Expo).
+    {
+        let mut guard = state.metro_inspector.lock().unwrap();
+        if let Some(inspector) = guard.as_mut() {
+            if let Ok(info) = inspector.element_at_point(request.x, request.y) {
+                return Ok(info);
+            }
+        }
+    }
+
+    // 2. Fall back to AX inspection via the Swift helper (native apps).
+    #[cfg(target_os = "macos")]
+    {
+        let active = state.active.lock().expect("emulator active mutex poisoned");
+        if let Some(ActiveDevice::Ios { session, .. }) = active.as_ref() {
+            if let Some(hc) = session.helper_client() {
+                let resp = hc.send_request_raw("accessibility_element_at", serde_json::json!({
+                    "x": request.x,
+                    "y": request.y,
+                }))?;
+                if let Some(element) = resp.get("element") {
+                    let bounds_obj = element.get("frame").or(element.get("bounds"));
+                    return Ok(ElementInfo {
+                        component_name: element["label"].as_str()
+                            .filter(|s| !s.is_empty())
+                            .or_else(|| element["type"].as_str())
+                            .map(|s| s.to_string()),
+                        native_type: element["type"].as_str().map(|s| s.to_string()),
+                        bounds: automation::Bounds {
+                            x: bounds_obj.and_then(|b| b["x"].as_f64()).unwrap_or(0.0) as i32,
+                            y: bounds_obj.and_then(|b| b["y"].as_f64()).unwrap_or(0.0) as i32,
+                            w: bounds_obj.and_then(|b| b["w"].as_f64().or(b["width"].as_f64())).unwrap_or(0.0) as i32,
+                            h: bounds_obj.and_then(|b| b["h"].as_f64().or(b["height"].as_f64())).unwrap_or(0.0) as i32,
+                        },
+                        props: serde_json::Value::Object(Default::default()),
+                        source: None, // AX doesn't provide source location.
+                    });
+                }
+            }
+        }
+    }
+
+    Err(CommandError::user_fixable(
+        "inspector_no_source",
+        "No inspection source available. For React Native apps, ensure Metro is running. \
+         For native apps, the Swift helper must be active.".to_string(),
+    ))
+}
+
+/// Get the full React component tree via the Metro inspector.
+#[tauri::command]
+pub fn emulator_inspector_component_tree(
+    state: State<'_, EmulatorState>,
+) -> CommandResult<serde_json::Value> {
+    let mut guard = state.metro_inspector.lock().unwrap();
+    let inspector = guard.as_mut().ok_or_else(|| {
+        CommandError::user_fixable(
+            "metro_not_connected",
+            "Metro inspector is not connected.".to_string(),
+        )
+    })?;
+    inspector.component_tree()
+}
+
 fn uuid_like() -> String {
     use std::sync::atomic::{AtomicU64, Ordering};
     static SEQ: AtomicU64 = AtomicU64::new(1);
diff --git a/client/src-tauri/src/commands/emulator/sdk.rs b/client/src-tauri/src/commands/emulator/sdk.rs
index 4ac55084..804efcfb 100644
--- a/client/src-tauri/src/commands/emulator/sdk.rs
+++ b/client/src-tauri/src/commands/emulator/sdk.rs
@@ -38,6 +38,12 @@ pub struct IosSdkStatus {
     /// for `CGEventPostToPid` to deliver taps to Simulator.app. Always `false`
     /// on non-macOS hosts.
     pub ax_permission_granted: bool,
+    /// Xero has been granted Screen Recording permission (macOS) — required
+    /// by ScreenCaptureKit for the Swift helper's frame capture. Always
+    /// `false` on non-macOS hosts.
+    pub screen_recording_permission_granted: bool,
+    /// The Swift helper binary (`xero-ios-helper`) was found on disk.
+    pub helper_present: bool,
 }
 
 pub fn probe_sdks<R: tauri::Runtime>(app: &tauri::AppHandle<R>) -> SdkStatus {
@@ -69,6 +75,8 @@ fn probe_ios_status<R: tauri::Runtime>(app: &tauri::AppHandle<R>) -> IosSdkStatu
             idb_companion_present: ios.idb_companion.is_some(),
             supported: true,
             ax_permission_granted: super::ios::cg_input::ax_permission_granted(),
+            screen_recording_permission_granted: super::ios::cg_input::screen_recording_permission_granted(),
+            helper_present: super::ios::helper::resolve_helper_binary(app).is_some(),
         }
     }
     #[cfg(not(target_os = "macos"))]
@@ -81,6 +89,8 @@ fn probe_ios_status<R: tauri::Runtime>(app: &tauri::AppHandle<R>) -> IosSdkStatu
             idb_companion_present: false,
             supported: false,
             ax_permission_granted: false,
+            screen_recording_permission_granted: false,
+            helper_present: false,
         }
     }
 }
diff --git a/client/src-tauri/src/commands/emulator/shutdown.rs b/client/src-tauri/src/commands/emulator/shutdown.rs
index e7d2f160..82082c1a 100644
--- a/client/src-tauri/src/commands/emulator/shutdown.rs
+++ b/client/src-tauri/src/commands/emulator/shutdown.rs
@@ -111,7 +111,11 @@ fn is_emulator_relevant(name: &str) -> bool {
     let leaf = lower.rsplit('/').next().unwrap_or(&lower);
     matches!(
         leaf,
-        "qemu-system-aarch64" | "qemu-system-x86_64" | "idb_companion" | "scrcpy-server"
+        "qemu-system-aarch64"
+            | "qemu-system-x86_64"
+            | "idb_companion"
+            | "scrcpy-server"
+            | "xero-ios-helper"
     ) || leaf.starts_with("qemu-system-")
         || leaf == "emulator64-arm"
         || leaf == "emulator64-x86"
diff --git a/client/src-tauri/src/lib.rs b/client/src-tauri/src/lib.rs
index 1ea1b6f8..7d7aaac6 100644
--- a/client/src-tauri/src/lib.rs
+++ b/client/src-tauri/src/lib.rs
@@ -329,6 +329,8 @@ pub fn configure_builder_with_state<R: tauri::Runtime>(
             commands::emulator::emulator_sdk_status,
             commands::emulator::emulator_ios_request_ax_permission,
             commands::emulator::emulator_ios_open_accessibility_settings,
+            commands::emulator::emulator_ios_request_screen_recording_permission,
+            commands::emulator::emulator_ios_open_screen_recording_settings,
             commands::emulator::android::provision::emulator_android_provision,
             commands::emulator::android::provision::emulator_android_provision_status,
             commands::emulator::emulator_list_devices,
@@ -354,6 +356,10 @@ pub fn configure_builder_with_state<R: tauri::Runtime>(
             commands::emulator::emulator_logs_subscribe,
             commands::emulator::emulator_logs_unsubscribe,
             commands::emulator::emulator_logs_get_recent,
+            commands::emulator::emulator_inspector_connect,
+            commands::emulator::emulator_inspector_disconnect,
+            commands::emulator::emulator_inspector_element_at,
+            commands::emulator::emulator_inspector_component_tree,
             commands::solana::solana_toolchain_install,
             commands::solana::solana_toolchain_install_status,
             commands::solana::solana_toolchain_status,
diff --git a/client/src-tauri/src/runtime/agent_core/persistence.rs b/client/src-tauri/src/runtime/agent_core/persistence.rs
index 9eba2e17..85c2621f 100644
--- a/client/src-tauri/src/runtime/agent_core/persistence.rs
+++ b/client/src-tauri/src/runtime/agent_core/persistence.rs
@@ -158,7 +158,6 @@ fn capture_terminal_summary_record(
     let final_text = latest_assistant_message
         .map(|message| message.content.trim())
         .filter(|content| !content.is_empty());
-    let is_debug_run = snapshot.run.runtime_agent_id == RuntimeAgentIdDto::Debug;
     let (record_kind, title, raw_text, visibility) = match final_text {
         Some(text) => (
             project_store::ProjectRecordKind::AgentHandoff,
@@ -178,13 +177,8 @@ fn capture_terminal_summary_record(
         return Ok(());
     }
     let summary = trim_project_record_summary(&text);
-    let schema_name = if is_debug_run {
-        "xero.project_record.debug_session.v1"
-    } else {
-        "xero.project_record.run_handoff.v1"
-    };
-    let mut content = json!({
-        "schema": schema_name,
+    let content = json!({
+        "schema": "xero.project_record.run_handoff.v1",
         "runtimeAgentId": snapshot.run.runtime_agent_id.as_str(),
         "providerId": snapshot.run.provider_id.as_str(),
         "modelId": snapshot.run.model_id.as_str(),
@@ -192,34 +186,6 @@ fn capture_terminal_summary_record(
         "fileChanges": file_paths,
         "messageId": latest_assistant_message.map(|message| message.id),
     });
-    if is_debug_run {
-        content["debugSession"] = json!({
-            "memoryFocus": [
-                "symptom",
-                "reproduction",
-                "evidence",
-                "hypotheses",
-                "rootCause",
-                "fix",
-                "verification",
-                "remainingRisks",
-                "reusableTroubleshootingFacts"
-            ],
-            "captureContract": "The final assistant handoff is expected to include the symptom, root cause, fix rationale, changed files, verification evidence, and durable troubleshooting facts.",
-        });
-    }
-    let tags = if is_debug_run {
-        vec![
-            snapshot.run.runtime_agent_id.as_str().into(),
-            "debugging".into(),
-            "troubleshooting".into(),
-            "root-cause".into(),
-            "fix".into(),
-            "verification".into(),
-        ]
-    } else {
-        vec![snapshot.run.runtime_agent_id.as_str().into()]
-    };
     project_store::insert_project_record(
         repo_root,
         &project_store::NewProjectRecordRecord {
@@ -237,15 +203,11 @@ fn capture_terminal_summary_record(
             summary,
             text,
             content_json: Some(content),
-            schema_name: Some(schema_name.into()),
+            schema_name: Some("xero.project_record.run_handoff.v1".into()),
             schema_version: 1,
-            importance: if is_debug_run {
-                project_store::ProjectRecordImportance::High
-            } else {
-                project_store::ProjectRecordImportance::Normal
-            },
-            confidence: Some(if is_debug_run { 0.9 } else { 0.8 }),
-            tags,
+            importance: project_store::ProjectRecordImportance::Normal,
+            confidence: Some(0.8),
+            tags: vec![snapshot.run.runtime_agent_id.as_str().into()],
             source_item_ids: latest_assistant_message
                 .map(|message| vec![format!("agent_messages:{}", message.id)])
                 .unwrap_or_default(),
diff --git a/client/src-tauri/src/runtime/agent_core/provider_loop.rs b/client/src-tauri/src/runtime/agent_core/provider_loop.rs
index 46174ba3..9e9e466d 100644
--- a/client/src-tauri/src/runtime/agent_core/provider_loop.rs
+++ b/client/src-tauri/src/runtime/agent_core/provider_loop.rs
@@ -423,7 +423,7 @@ fn dynamic_tool_catalog_metadata(
             "examples": [format!("Call `{}` after exact MCP activation.", descriptor.name)],
             "riskClass": "external_capability_invoke",
             "effectClass": "external_service",
-            "allowedRuntimeAgents": [RuntimeAgentIdDto::Engineer.as_str(), RuntimeAgentIdDto::Debug.as_str()],
+            "allowedRuntimeAgents": [RuntimeAgentIdDto::Engineer.as_str()],
             "runtimeAvailable": true,
             "source": server_id,
             "trust": "connected_mcp_server",
diff --git a/client/src-tauri/src/runtime/agent_core/state_machine.rs b/client/src-tauri/src/runtime/agent_core/state_machine.rs
index 2df2b895..22c41682 100644
--- a/client/src-tauri/src/runtime/agent_core/state_machine.rs
+++ b/client/src-tauri/src/runtime/agent_core/state_machine.rs
@@ -830,30 +830,6 @@ mod tests {
         assert!(matches!(gate, ToolBatchGate::RequirePlan { .. }));
     }
 
-    #[test]
-    fn debug_agent_uses_engineering_plan_gate() {
-        let snapshot = empty_snapshot();
-        let mut debug_controls = controls(true);
-        debug_controls.active.runtime_agent_id = RuntimeAgentIdDto::Debug;
-        let classification = classify_agent_task(
-            "Debug the failing runtime state machine test",
-            &debug_controls,
-        );
-        let gate = evaluate_tool_batch_gate(
-            &snapshot,
-            &debug_controls,
-            &classification,
-            &[AgentToolCall {
-                tool_call_id: "call-1".into(),
-                tool_name: AUTONOMOUS_TOOL_COMMAND.into(),
-                input: json!({ "argv": ["pnpm", "test"] }),
-            }],
-        );
-
-        assert!(classification.requires_plan);
-        assert!(matches!(gate, ToolBatchGate::RequirePlan { .. }));
-    }
-
     #[test]
     fn ask_agent_does_not_require_engineering_plan_gate() {
         let snapshot = empty_snapshot();
diff --git a/client/src-tauri/src/runtime/autonomous_tool_runtime/priority_tools.rs b/client/src-tauri/src/runtime/autonomous_tool_runtime/priority_tools.rs
index d3a4a9fe..84c8c465 100644
--- a/client/src-tauri/src/runtime/autonomous_tool_runtime/priority_tools.rs
+++ b/client/src-tauri/src/runtime/autonomous_tool_runtime/priority_tools.rs
@@ -113,7 +113,7 @@ impl AutonomousToolRuntime {
             }
         }
 
-        if runtime_agent_id.allows_engineering_tools() {
+        if runtime_agent_id == RuntimeAgentIdDto::Engineer {
             let mcp_matches = self.mcp_tool_search_matches(&query, &query_terms)?;
             searched_catalog_size = searched_catalog_size.saturating_add(mcp_matches.len());
             matches.extend(mcp_matches);
diff --git a/client/src-tauri/tauri.conf.json b/client/src-tauri/tauri.conf.json
index 7bab3ce3..5a7098d2 100644
--- a/client/src-tauri/tauri.conf.json
+++ b/client/src-tauri/tauri.conf.json
@@ -73,7 +73,8 @@
     ],
     "resources": [
       "resources/scrcpy-server-v2.7.jar",
-      "resources/solana-toolchain/**/*"
+      "resources/solana-toolchain/**/*",
+      "resources/xero-ios-helper"
     ]
   }
 }
diff --git a/client/src/features/emulator/use-emulator-session.ts b/client/src/features/emulator/use-emulator-session.ts
index 435d8246..e8a94638 100644
--- a/client/src/features/emulator/use-emulator-session.ts
+++ b/client/src/features/emulator/use-emulator-session.ts
@@ -101,7 +101,10 @@ interface Options {
 
 function asTauri<T>(command: string, args?: Record<string, unknown>): Promise<T | null> {
   if (!isTauri()) return Promise.resolve(null)
-  return invoke<T>(command, args).catch(() => null)
+  return invoke<T>(command, args).catch((err) => {
+    console.error(`[emulator] ${command} failed:`, err)
+    return null
+  })
 }
 
 function errorMessage(error: unknown): string {
@@ -262,6 +265,27 @@ export function useEmulatorSession({ platform, active }: Options): UseEmulatorSe
           devicePixelRatio: response.devicePixelRatio,
         }
         setCurrentDevice(descriptor)
+        // The backend emits status/frame events during spawn, but the
+        // async listener may not have resolved in time. Force-sync now.
+        setStatus({
+          phase: "streaming",
+          platform: platformTag,
+          deviceId,
+          message: `streaming at ${response.width}x${response.height}`,
+        })
+        // Fetch the latest frame snapshot so we don't show a stale/empty
+        // viewport while waiting for the next emulator:frame event.
+        try {
+          const snapshot = await invoke<{
+            status: { phase: string }
+            frame: EmulatorFrameInfo | null
+          }>("emulator_subscribe_ready")
+          if (snapshot.frame) {
+            setFrame(snapshot.frame)
+          }
+        } catch {
+          // best-effort
+        }
         return response
       } catch (err) {
         setError(errorMessage(err))
@@ -284,6 +308,7 @@ export function useEmulatorSession({ platform, active }: Options): UseEmulatorSe
       setIsStopping(false)
       setCurrentDevice(null)
       setFrame(null)
+      setStatus({ phase: "idle", platform: null, deviceId: null, message: null })
     }
   }, [])
 
diff --git a/client/src/features/emulator/use-inspector.ts b/client/src/features/emulator/use-inspector.ts
new file mode 100644
index 00000000..6caaad64
--- /dev/null
+++ b/client/src/features/emulator/use-inspector.ts
@@ -0,0 +1,165 @@
+"use client"
+
+import { useCallback, useRef, useState } from "react"
+import { invoke, isTauri } from "@tauri-apps/api/core"
+
+// Types matching Rust backend structs.
+
+export interface SourceLocation {
+  file: string
+  line: number
+  column: number
+}
+
+export interface ElementBounds {
+  x: number
+  y: number
+  w: number
+  h: number
+}
+
+export interface ElementInfo {
+  componentName: string | null
+  nativeType: string | null
+  bounds: ElementBounds
+  props: Record<string, unknown>
+  source: SourceLocation | null
+}
+
+export interface MetroStatus {
+  connected: boolean
+  port: number
+  pages: Array<{ id: string; title: string; vm: string; description: string }>
+}
+
+export interface UseInspector {
+  /** Whether inspect mode is active. */
+  inspectMode: boolean
+  /** Toggle inspect mode on/off. */
+  toggleInspect: () => void
+  /** Whether the Metro inspector is connected. */
+  metroConnected: boolean
+  /** Status of the Metro connection. */
+  metroStatus: MetroStatus | null
+  /** The element currently hovered (null if none). */
+  hoveredElement: ElementInfo | null
+  /** Error from the inspector. */
+  inspectError: string | null
+  /** Connect to Metro inspector (auto-discover or explicit port). */
+  connect: (port?: number) => Promise<void>
+  /** Disconnect from Metro inspector. */
+  disconnect: () => Promise<void>
+  /** Query element at a point (device pixels). */
+  elementAt: (x: number, y: number) => Promise<ElementInfo | null>
+  /** Get the full component tree. */
+  componentTree: () => Promise<unknown>
+}
+
+/**
+ * Hook for Metro inspector integration. Provides element-at-point
+ * inspection, source mapping, and highlight overlays for React Native
+ * and Expo apps.
+ */
+export function useInspector(): UseInspector {
+  const [inspectMode, setInspectMode] = useState(false)
+  const [metroStatus, setMetroStatus] = useState<MetroStatus | null>(null)
+  const [hoveredElement, setHoveredElement] = useState<ElementInfo | null>(null)
+  const [inspectError, setInspectError] = useState<string | null>(null)
+
+  // Debounce timer for element-at-point queries.
+  const debounceRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+
+  const toggleInspect = useCallback(() => {
+    setInspectMode((prev) => {
+      if (prev) {
+        // Turning off — clear hovered element.
+        setHoveredElement(null)
+      }
+      return !prev
+    })
+  }, [])
+
+  const connect = useCallback(async (port?: number) => {
+    if (!isTauri()) return
+    setInspectError(null)
+    try {
+      const status = await invoke<MetroStatus>("emulator_inspector_connect", {
+        request: { port: port ?? null },
+      })
+      setMetroStatus(status)
+    } catch (err) {
+      setInspectError(errorMessage(err))
+      setMetroStatus(null)
+    }
+  }, [])
+
+  const disconnect = useCallback(async () => {
+    if (!isTauri()) return
+    try {
+      await invoke("emulator_inspector_disconnect")
+    } finally {
+      setMetroStatus(null)
+      setHoveredElement(null)
+    }
+  }, [])
+
+  const elementAt = useCallback(async (x: number, y: number): Promise<ElementInfo | null> => {
+    if (!isTauri()) return null
+    try {
+      const info = await invoke<ElementInfo>("emulator_inspector_element_at", {
+        request: { x, y },
+      })
+      setHoveredElement(info)
+      setInspectError(null)
+      return info
+    } catch (err) {
+      // Transient — don't flood UI with errors on hover.
+      setHoveredElement(null)
+      return null
+    }
+  }, [])
+
+  const elementAtDebounced = useCallback(
+    (x: number, y: number) => {
+      if (debounceRef.current) clearTimeout(debounceRef.current)
+      return new Promise<ElementInfo | null>((resolve) => {
+        debounceRef.current = setTimeout(async () => {
+          resolve(await elementAt(x, y))
+        }, 80)
+      })
+    },
+    [elementAt],
+  )
+
+  const componentTree = useCallback(async () => {
+    if (!isTauri()) return null
+    try {
+      return await invoke("emulator_inspector_component_tree")
+    } catch (err) {
+      setInspectError(errorMessage(err))
+      return null
+    }
+  }, [])
+
+  return {
+    inspectMode,
+    toggleInspect,
+    metroConnected: metroStatus?.connected ?? false,
+    metroStatus,
+    hoveredElement,
+    inspectError,
+    connect,
+    disconnect,
+    elementAt: elementAtDebounced,
+    componentTree,
+  }
+}
+
+function errorMessage(err: unknown): string {
+  if (err && typeof err === "object" && "message" in err) {
+    const msg = (err as { message?: unknown }).message
+    if (typeof msg === "string" && msg.length > 0) return msg
+  }
+  if (typeof err === "string" && err.length > 0) return err
+  return "Inspector error"
+}
diff --git a/client/src/features/xero/live-views.test.tsx b/client/src/features/xero/live-views.test.tsx
index 3cd5c271..fe3cf483 100644
--- a/client/src/features/xero/live-views.test.tsx
+++ b/client/src/features/xero/live-views.test.tsx
@@ -22,13 +22,12 @@ import type {
   WorkflowPaneView,
 } from '@/src/features/xero/use-xero-desktop-state'
 import type { AgentProviderModelCatalogView } from '@/src/features/xero/use-xero-desktop-state/types'
-import {
-  getRuntimeAgentLabel,
-  type ProjectDetailView,
-  type ProviderModelThinkingEffortDto,
-  type RuntimeRunView,
-  type RuntimeSessionView,
-  type RuntimeStreamView,
+import type {
+  ProjectDetailView,
+  ProviderModelThinkingEffortDto,
+  RuntimeRunView,
+  RuntimeSessionView,
+  RuntimeStreamView,
 } from '@/src/lib/xero-model'
 
 function makeProject(overrides: Partial<ProjectDetailView> = {}): ProjectDetailView {
@@ -363,7 +362,8 @@ function makeAgent(project = makeProject(), overrides: Partial<AgentPaneView> =
     controlTruthSource:
       overrides.controlTruthSource ?? (selectedControls && !runtimeRun?.isTerminal ? 'runtime_run' : 'fallback'),
     selectedRuntimeAgentId,
-    selectedRuntimeAgentLabel: overrides.selectedRuntimeAgentLabel ?? getRuntimeAgentLabel(selectedRuntimeAgentId),
+    selectedRuntimeAgentLabel:
+      overrides.selectedRuntimeAgentLabel ?? (selectedRuntimeAgentId === 'engineer' ? 'Engineer' : 'Ask'),
     selectedModelId: overrides.selectedModelId ?? selectedControls?.modelId ?? selectedModelOption?.modelId ?? null,
     selectedThinkingEffort:
       overrides.selectedThinkingEffort ??
diff --git a/client/src/lib/xero-model/runtime.test.ts b/client/src/lib/xero-model/runtime.test.ts
index d593db39..351c1521 100644
--- a/client/src/lib/xero-model/runtime.test.ts
+++ b/client/src/lib/xero-model/runtime.test.ts
@@ -101,6 +101,7 @@ describe('runtime run control schemas', () => {
     })
   })
 
+
   it('maps durable active and pending control snapshots into a selected pending projection', () => {
     const parsed = runtimeRunSchema.parse(makeRuntimeRunDto())
     const view = mapRuntimeRun(parsed)