[SamGu-NRX]

Head 75f6c37. Stacked on #188 (codex/public-coverage-20260930, bc21ace), which sits on #187 and #183. This PR is the combined app candidate. It merges #186, #190 and #188's fixes with their history and adds the changes below. #184 and #189 (corner shape, Sam's decision) and #192 (Hunter modules) are left out.

What changed

Merged in this update (75f6c37)

Each came through its own PR, reviewed and green on its head, and is merged here with its history:

• ios: bind placement answers to the submitted scene #198, placement answers are bound to the scene that was sent (6ec6912). The client now checks the answer's stats.input_sha256 against the scene bytes it sent and refuses a missing, malformed or mismatched hash through the existing "We couldn't read the server's answer" recovery. The bundled sample is exempt.
• fix(ios): results say they need an installer's review, never that one is coming #199, results say they need an installer's review (94f18ff). Nothing in the app contacts an installer, so the result, its footnotes, the AR title and the skip hints no longer promise that one will confirm, check or look. The headline for a result a person has to settle reads "Needs an installer's review".
• ios: say why House Scan asks for local network access #201, a purpose string for the local network (032eea5). NSLocalNetworkUsageDescription explains that the app connects to a House Scan server on the local network only when a developer has set one up for testing.
• CODEX-01, tap readiness in ScreenStatesUITests (b3c117d, test-only). The tap helper reads a button's frame and enabled state from one snapshot per poll against one deadline. Before, separate existence, layout and hittability waits used up the AR Done button's 20 s budget (37022177313 attempt 1). A control below the window now uses XCTest's own scroll-to-visible tap before any hit-point query; asking for a hit point first failed feature.ac in attempt 2. It adds TapReadiness with seven isolated tests and two regressions: an off-screen review chip at AX5, and closing AR through Done. Every identifier the helper taps resolved as a Button in the earlier hosted logs, so restricting the lookup to buttons drops no target.
• fix(ios): where the space ends: ground contact, late and lost far walls, stable measurement (#168) #188's bc21ace, the laid-out-frame wait ported to the old tap helper, is merged so this branch contains its base again. Its one file keeps this branch's version: TapReadiness replaces that helper and rejects the same unsettled frames.

An upload sends one captured scene and packet (737d921)

On LiDAR phones the upload measures the mesh for what faces the wall and what is overhead, off the main actor. It measured against the wall as it was before that await, then built scene.json and the capture packet from the engine's live wall after it. A ground refinement or an anchor correction during the measurement put clearances measured against the old wall into a scene describing the new one (CodeRabbit's finding on bd6b933).

The upload now captures the scene (without its mesh fields), the wall in world meters, the mesh and the packet's inputs in one main-actor turn, and marks the scene packaged there (ScanEngine+Export.swift, ScanEngine.swift). UploadPackaging.package measures the captured mesh against the captured world wall and span. It checks that the upload is still current (same scan, not cancelled), then serializes the captured scene with those measurements and gives the same bytes to the captured packet (UploadPackaging.swift). saveBundle writes those inputs and rereads nothing.

• A ground change during the measurement follows the packaged-upload rule below: the first change withdraws the upload and sends it again once, and a second one fails with "Try again". An anchor correction keeps the captured upload.
• A withdrawn, cancelled or reset upload serializes nothing, writes no bundle and submits nothing.
• After "It's clear", the bundle is written again from the upload's captured packet. Only the guidance log is reread, and it is placed with that packet's wall and meter frame. Before, the old scene was paired with a fresh mesh and the current wall.

The packet's recorder streams (trajectory, depth, motion) are still read when the packet is written. What holds is one wall and frame across the scene and the packet's geometry, not a byte-for-byte snapshot of one instant.

Coverage rebuilds reuse each kept frame's views (b926c92, a cherry-pick of the performance branch's 745a00ed)

When ARKit refines a plane that counts as a far surface (a corridor's far wall, a side yard's fence), the coverage map rebuilds from every kept frame on the main actor. Most of that work recomputes what each frame shows. The map now keeps those views per frame and reuses them while the frame's camera and depth, the wall chain, the ends and the far-surface lookup at every cell its depth readings consulted are unchanged (CoverageMap.swift). The merge still runs in capture order on every rebuild, so the recorded sightings, end clipping, past-limit replay and revision count are what they were. Any change to the wall or ends drops every kept view.

RebuildViewCacheTests runs a cached map and a full-rebuild map through the same changes and compares their whole stored state and public readers (RebuildViewCacheTests.swift).

On this Mac, across 17 synthetic seeded walks, total rebuild time fell 1.9× to 15.7× and 61 % to 97 % of views were reused, at about +0.25 to +1.9 MB of heap. Under the worst jitter a cached rebuild's p90 is still 5 to 23 ms, against 35 to 42 ms uncached, so one can still exceed a 16.7 ms frame. These are Mac timings with synthetic scenes and plane feeds. Phone speed and ARKit's real refinement rate are unmeasured, so no phone gain is claimed.

Answering a wall end no longer brings back a request that just stalled (#56)

When the walk's aim request (say, the ground by the meter) gains nothing for 20 s, the planner defers it and the walk moves on. Answering anything else then ("Wall ends here" and its question, "Can't get there", an overhead answer, a followed corner, a refused finish) called GuidancePlanner.reset(), which also cleared the deferred stretches. With the camera still near the meter, the same request came straight back with a fresh 20 s clock. Those actions now call settleCurrentTask(), which drops only the current task. reset() still clears everything, and is used at the start of the walk, for a new scan and for a spatial reset, whose new world frame makes old stretches meaningless (ScanEngine.swift, GuidancePlanner.swift).

A follow-up request stays available whenever its evidence is still missing (#49)

After the server's answer, the app suppresses a request that asks for the same view as one already asked, skipped or earlier in the same answer. It used a 0.1 ft allowance on the Float-meter span, while progress measures the server's exact span_ft and counts any uncovered edge of 0.01 ft or more as missing. A request for 2 to 8.09 ft after one for 2 to 8 ft therefore vanished, though its last 0.09 ft could never be met, and after a skip the result marked it not capturable. Same-view now requires the same band and kind of need, a reach no higher than the other's, and a span inside the other's, compared exactly in the requested feet progress uses. Rounding tolerance is applied only by progress, against real coverage, so it can't stack: a request for 2 to 8.0175 ft after 2 to 8.0085 ft, met by coverage to 8.0 ft, stays available. Equal and contained requests are still suppressed, and the request limit and "Show my result" are unchanged (GapPlanner.swift).

Picked up from other PRs

• ios: clear stale scan dots after relocalization reset #195, the live dots (a9695be): a relocalization timeout or camera recovery restarts ARKit's world frame, but the dot field was kept, so new depth fused into old dots. The spatial reset now clears them, as Start over already did. These are ios: clear stale scan dots after relocalization reset #195's three lines only, nothing from Draw the prototype's fog and live dots over the walk #158.
• ios: gate coaching keeps the task card, holds through dark flicker, and says "Turn more slowly" for turns #104, the coaching (f9f5935, Aiden's 040d9a6 via cherry-pick -x): moving fast while aiming no longer builds up a "Slow down" for the next walking step, and the ride-along dark note keeps its advice, "It's dark here. Try your phone's flashlight, or come back in daylight." ios: gate coaching keeps the task card, holds through dark flicker, and says "Turn more slowly" for turns #104's a097c66 (blur reference) is not included; blur coaching stays as it was.

Earlier in this PR

A ground change can no longer leave a stale answer on screen

ARKit keeps refining the ground while the first upload is in flight. The scene sent to the server fixes the ground at packaging (ScanEngine+Export.swift:13-20). The spot check, 3D preview and AR draw against the current ground (ScanContract.swift:175-180). So a first answer could appear shifted by the change. GroundFreshness now treats a packaged first upload like an answer on screen: it withdraws the answer and resends once, and a second change before a new answer fails with "Try again". A change before packaging is ignored, because the scene is still built from the current ground.

A failed or refused upload has no answer up and none coming, so it maps to a new Screen.stopped, and a ground change keeps that screen. Before this, an offline failure after a ground resend lost its reason, and a refused resend lost "Back to review" and gained "Try again" for a scan the server had refused. The one-resend limit still applies when sending resumes.

At AX5 the see-behind card leads with what to do

Root's full-scale review of #190's own see-behind frame found the card covering the camera, down to "Can't see past it". When the card folds at accessibility sizes, "Look around it" now leads. Ride-along coaching and the reply stay in view. "Something is in front of the wall here, about 5 ft right of your meter. Look at it from the side or step around it." moves under Details. Instruction.folded carries those words, and default sizes are unchanged. ScanCopy.withCoaching now copies the task, so coaching keeps the folded words.

At AX5 the find-meter card folds and its button fits (B-43)

Root's manual pass at b6ee153 found the next step after "Allow camera" unusable at AX5. The card filled the camera with the meter's description, the reticle at the screen's middle sat under it, and "This is my meter" ran below the screen. The screen now folds like the walk's aiming steps:

• "Find your electric meter" (or "Tap a spot on a wall" on a practice scan) stays on the card, and the description moves under Details.
• At least 180 pt of camera stays open above the button.
• The button shows its words without the pin, so "Put the sample meter here" fits.

The reticle and the button's mark point move to the middle of the open camera, the same mark a tap there makes (OpenCameraAim). "Hold on, finding your wall" leads with "Move your phone side to side". Coaching that replaces the task stays unfolded. Default sizes are unchanged.

Zero-width open camera, fixed in 2695268. At 0d4512b, OpenCameraAim required a non-zero width. The chrome's open camera is a Spacer that can be zero points wide, so at AX5 the reticle fell back to the screen's middle under the card (run 36877327250's frames; Greptile flagged it too). Only the height is required now, and OpenCameraAimTests feeds the zero-width window.

A privacy manifest for the required-reason APIs the app calls

The app had no PrivacyInfo.xcprivacy. This is a gap found while preparing a release, not an App Store rejection. The new file declares only what the code calls:

Category	Reason	Use
UserDefaults	CA92.1	The Practice meter switch, the app's own key
File timestamp	C617.1	ScanFolderCleanup reads scan.zip dates in the app's Caches
System boot time	35F9.1	Time between "can't get there" taps; the recorder's restart cutoff
System boot time	8FFB.1	The wall-clock time of the first recorded frame, the packet's capture.started_at

It makes no tracking or collected-data claims; those are App Store privacy answers. PrivacyManifestTests fails when shipped Swift uses a category the manifest lacks, or the manifest declares one nothing uses, and pins each reason.

Smaller changes

• Under Reduce Motion the instruction card snaps to its new height instead of easing; normal motion is unchanged.
• The iOS job limit goes from 60 to 75 minutes. ios: fold the AX5 aim card under Details, stack wall-walk actions, clear the page dots and badges #190's full run took 58 minutes, and the freshness UI tests add about 161 s.
• testEndScanQuestionKeepsWalkingOrEnds gets 15 s for its first tap, the same as its second. On run 36841096811 each hittability check took 1-2 s and 5 s ran out.

Verification

At 75f6c37:

• Full hosted run 37070075783 (workflow_dispatch) passed 651 package tests in 92 suites and 57 UI tests with 1 skip and 0 failures. Those UI tests include the every-state audit (779 s), testWholeFlowThroughTheButtons, both tap-helper regressions and InstallerReviewUITests.
• Pull-request run 37070081137 passed 56 UI tests with 1 skip and 0 failures. An earlier full run on d52ec50 (37069836265) was cancelled before any result, once the merge of fix(ios): where the space ends: ground contact, late and lost far walls, stable measurement (#168) #188's bc21ace superseded that head.
• Local, under the shared Mac's queue: the combined tree before CODEX-01's merge (db3e9d2) passed 651 package tests in 92 suites and built for testing. CODEX-01 changes only UI-test files; d52ec50 built for testing, and 75f6c37 has the same tree.
• CODEX-01's own local run at b3c117d on 0b35f65 passed all 14 selected UI tests, including testWholeFlowThroughTheButtons, the two new regressions and the seven TapReadiness tests. No UI test has run locally on this tree.
• ios: bind placement answers to the submitted scene #198, fix(ios): results say they need an installer's review, never that one is coming #199 and ios: say why House Scan asks for local network access #201 each passed their hosted iOS run on their own heads.

At 0b35f65 (test-only on top of b926c92; app, package and project sources are byte-identical):

• Full hosted run 37022244049 (workflow_dispatch) passed 644 package tests in 91 suites and 47 UI tests with 1 skip and 0 failures. Those UI tests include the every-state audit, both changed tests and testWholeFlowThroughTheButtons.
• Pull-request run 37022177313 failed one UI case on each of its two attempts, a different case each time. Both cases passed in 37022244049 and in both b926c92 runs.
  • Attempt 1 ran 46 UI tests with 1 skip and 1 failure. testWholeFlowThroughTheButtons reported "missing or not tappable: action.closeAR" on the AR screen. One existence query for the button took 7 s and later queries 3 to 4 s each, so the tap helper's 20 s budget ran out; in the passing runs the button was found in about 1 s.
  • Attempt 2 was the one rerun of the failed job, at the same head. It also ran 46 UI tests with 1 skip and 1 failure. testWholeFlowThroughTheButtons passed this time, and testAddSomethingFromTheReviewMarksOnTheCamera failed instead: XCTest reported "Activation point invalid" for feature.ac on the review, about 4 s after the review appeared, while the helper waited for it to become hittable.
  • The app code is byte-identical to b926c92. The timings point to slow accessibility answers on the hosted runner, but the cause is unproven and no reliability fix is claimed. The pull-request run is still red on this head. It isn't a branch-protection requirement (the repository has no rulesets), but a green run on the current head is the candidate's acceptance target.
• Both hosted runs at b926c92 failed one case, testRejectedUploadGoesBackToReview: 37013846307 ran 28 UI tests with 1 failure, and 37013940503 ran 46 with 1 skip and 1 failure, its every-state audit passing. The test runs on the demo engine, which this update doesn't touch. It tapped "I can't get there" on the review's own gap request while the demo's script was covering that request and sending by itself, about 3.9 s after it opened. The tap's event came 3.2 to 3.5 s into the wait in the passing bd6b933 runs, and after 4.3 s in both b926c92 runs, when the button had gone. This was a race in the test, not an app regression.
• 0b35f65 lets the script finish and goes on to the spot check, with the test's other assertions and waits unchanged (ScreenStatesUITests.swift). No other test checked that skipping sends the scan, so the new testSkippingTheGapRequestSends taps "I can't get there" on a frozen gap request and expects the upload screen. Locally both tests passed on the iPhone 17 Simulator.
• Root's manual pass on the b926c92 build in the Simulator still applies, since the app code is unchanged:
  • The dark walk and gap cards show their advice, and their "Can't get there" actions advance.
  • The AR view opens from the result, is labeled as an example spot, and returns.
  • A real capture sent to an unreachable server shows "Try again" and "Share scan". A manual retry fails the same way, and Share scan offers a 2.1 MB ZIP.
  • The rejected fixture's "Back to review" keeps the review's answers.
  • That pass didn't cover VoiceOver, Reduce Motion, or anything on a phone.

At b926c92:

• Local runs on the same tree (built as d8192b15, which differs only in its commit message), under the shared Mac's queue:
  • 644 package tests in 91 suites passed. This is the first full run that includes the cache's last test, viewsFollowTheLookupWhereReadingsMetTheFence.
  • On the iPhone 17 Simulator, 12 UI tests ran with 1 skipped and 0 failures: GroundFreshnessUITests (2), FullFlowUITests including the LiDAR replay (6, with the real-recording skip), SourceRestartUITests (1), and the share, rejected-upload and offline screens (3). testPracticeMeterFromReplay was left out locally because that Simulator's Vision can't create an inference context; it runs in the hosted suites.
• UploadPackagingTests (7 tests) runs the real package and the real mesh measurement behind a gate that holds the measurement while the test changes the source.
  • With nothing changed, the facing and overhead measurements come from the world's ground, set 0.5 m up.
  • When ground, wall, span and marks change mid-measurement, the scene bytes and packet geometry stay the captured set.
  • An anchor correction keeps the capture without a resend. A ground change rejects the old completion and sends the replacement, and a second change keeps the failure.
  • A reset or a cancel sends nothing, and a scan without a mesh or a packet still sends its scene.
  • Removing the post-measurement check, or measuring against the ground-zeroed scene wall, fails 6 of the 7 tests.
• Limit of those tests: the app has no unit-test target, so a small stand-in follows upload()'s order, with the real GroundFreshness deciding. The engine's own wiring is covered by review and the Simulator runs. Replay UI tests have no mesh, so no UI test reaches this await.
• The cache's tests catch both injected faults in what it records as read. Its comparison probe checked final state only; the per-change comparison is the test suite. Separate Sol and Astra reviews of 745a00ed found nothing.

At bd6b933: full run 37001843593 passed 631 package tests and 46 UI tests, every-state audit included, with 1 skip and 0 failures. Push run 37001782118 passed 631 package and 45 UI tests with 1 skip.

• Guidance tests added at bd6b933: settlingATaskKeepsWhatStalledButANewScanForgetsIt (the same planner state settled versus reset); an eight-case sweep moving one span edge outward by 0.009, 0.010, 0.011 and 0.09 ft, after asked, after skipped and within one answer; aRoundingAllowanceUsedOnceIsNotUsedAgain; equal and contained spans; stricter, equal and lower reaches. Two older expectations encoded the 0.1 ft allowance and were updated: a refused view coming back at 4.9 ft after 4.833334 ft, and a 0.05 ft-wider "jitter" item. Both now ask for evidence progress requires.
• Fresh Sol reviews checked the ios: gate coaching keeps the task card, holds through dark flicker, and says "Turn more slowly" for turns #104 coaching commits (which led to excluding a097c66), the four inherited guidance findings against 693271e (Tests for #24, #28 and #29: synthetic walk-guidance cases modeled on field runs 1 and 2 #56 and ios: 'I can't get there' moves on to the next requested view (#39) #49 present, ios: ground needs a plausible meter height and never rises; estimated meter taps are checked and re-fitted to the detected wall #108 and Mark an existing battery or another box on the wall (#27) #52 absent), and both repairs; the second review's accumulation finding is fixed in bd6b933.

Earlier heads, kept for history: full run 36991598066 at 693271e passed 625 package tests and 46 UI tests (1 skip, 0 failures) with the every-state audit. Full run 36860048623 at b6ee153 passed the audit. Focused runs at 0d4512b, d88f762, efb7ab6 and 1f7e076 each failed one UI case that a later commit fixed. A local run at d837c4e stalled 36 s after the spot check in testCantGetThereEndsWhereThePhoneIs, with the same engine decisions as hosted; the cause is unproven, and the test passed at bd6b933.

UI changes

The dark coaching line is longer. Before is wallWalk-tooDark in run 36991598066 (693271e); after is the same state in run 37001843593 (bd6b933). Matched captures are pending root's visual check. The upload and cache changes show nothing new on screen.

Earlier in this PR, at AX5 on the iPhone 17 Simulator: the folded see-behind card and its Details (wallWalk-seeBehind-AX5-* in run 36860048623), and the folded find-meter card (findMeter-AX5-*).

Risk

• After an upload, the spot check keeps that upload's packet, mesh included, in memory until the scan resets.
• Nothing in this update ran on a phone: the upload repair, the cache's speed (measured only on a Mac), relocalization clearing the dots, the planner on a real walk, and server requests from the deployed backend after the same-view change are unverified.
• Exact containment can raise a request again when the server works it out with an edge a hair wider after "I can't get there". The automatic request limit and "Show my result" still end the loop.
• Nothing ran on a phone. VoiceOver, Reduce Motion rendering, AX1 to AX4 and other screen sizes weren't checked. The physical tilt from arrow to ring isn't exercised by the frozen demo.
• No UI test can make an upload fail, so the stopped-screen mapping in ScanEngine is covered by the pure rule test and review only.
• The shared packet carries capture.started_at (8FFB.1) beside uptime-based ARKit frame times. A receiver could subtract them to estimate boot time. Apple's wording doesn't settle whether that pair counts as sending information derived from boot time. The packet contract is unchanged and the question is open.

Checklist

• The scope is focused; related changes belong together
• I explained what changed and why
• N/A before/after images in the body: the dark-copy frames are named above and await root's visual check.
• N/A video: no motion changes in this update.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes
  • Ground refinements during upload now account for whether the scan has been packaged. Packaged scans are resent without showing the withdrawn answer; un-packaged uploads continue, while further refinements during a pending resend fail rather than risk showing an outdated result.
  • Upload results and saved scans now use the same captured scan data, including after a clear spot check. Answers are checked against the submitted scan before they’re displayed. Skipping guidance preserves deferred tasks, and aiming no longer accumulates walking-speed warnings.
• Accessibility
  • At larger text sizes, camera instructions and legends can fold into Details, wall-walk actions stack vertically, and result badges move above the answer card. Camera guidance and find-meter controls adapt to the visible camera space, and onboarding pages remain accessible.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

🧰 Additional context used

📚 Code guidelines (1)

ios/README.md — configured

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: cd0c6075-e6ee-4e97-a625-0fca232ce6f9

📥 Commits

Reviewing files that changed from the base of the PR and between 0b35f65 and 75f6c37.

📒 Files selected for processing (15)

• ios/Config/Info.plist
• ios/HouseScan/Runtime/ResultClient.swift
• ios/HouseScan/UI/Copy/ScanCopy.swift
• ios/HouseScan/UI/Copy/SpotCheckCopy.swift
• ios/HouseScan/UI/Preview/DemoEngine.swift
• ios/HouseScan/UI/Screens/GapRequestScreen.swift
• ios/HouseScan/UI/Screens/MeterCloseUpScreen.swift
• ios/HouseScan/UI/Screens/ResultARScreen.swift
• ios/HouseScan/UI/Screens/ResultScreen.swift
• ios/HouseScanKit/Sources/HouseScanKit/Scene/ResultBinding.swift
• ios/HouseScanKit/Tests/HouseScanKitTests/ResultBindingTests.swift
• ios/HouseScanUITests/FullFlowUITests.swift
• ios/HouseScanUITests/InstallerReviewUITests.swift
• ios/HouseScanUITests/ScreenStatesUITests.swift
• ios/HouseScanUITests/TapReadiness.swift

🚧 Files skipped from review as they are similar to previous changes (2)

• ios/HouseScan/UI/Screens/ResultScreen.swift
• ios/HouseScan/UI/Copy/ScanCopy.swift

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The changes update upload packaging and freshness decisions, validate server answers against submitted scenes, revise guidance rules, and adapt camera and screen layouts for accessibility text sizes. They also add coverage-map rebuild caching, privacy declarations, and Vision failure logging.

Changes

Upload freshness and guidance

Layer / File(s)	Summary
Ground-change resend policy ios/HouseScanKit/Sources/HouseScanKit/Upload/GroundFreshness.swift, ios/HouseScan/Runtime/ScanEngine.swift, ios/HouseScanKit/Tests/HouseScanKitTests/GroundFreshnessTests.swift, ios/HouseScanUITests/GroundFreshnessUITests.swift	GroundFreshness distinguishes stopped uploads and uses packaging state to decide whether a ground change keeps an upload, requests a resend, or fails. Tests cover the decisions and resend flow.
Captured upload packaging ios/HouseScan/Runtime/ScanEngine+Export.swift, ios/HouseScan/Runtime/ScanEngine+Packet.swift, ios/HouseScan/Runtime/ScanEngine+Confirm.swift, ios/HouseScan/Runtime/ScanEngine.swift, ios/HouseScanKit/Sources/HouseScanKit/Scene/UploadPackaging.swift, ios/HouseScanKit/Tests/HouseScanKitTests/UploadPackagingTests.swift, ios/HouseScan/Runtime/LaunchOptions.swift, .github/workflows/ios.yml	ScanEngine captures upload inputs and passes them to packaging. UploadPackaging measures and serializes captured inputs, checks whether the upload is current, and attaches the scene bytes to the packet. Bundle saving and exchange logging use the resulting packet.
Guidance task settlement and coaching ios/HouseScanKit/Sources/HouseScanKit/Guidance/GuidancePlanner.swift, ios/HouseScanKit/Sources/HouseScanKit/Guidance/CoachingDebouncer.swift, ios/HouseScan/Runtime/ScanEngine.swift, ios/HouseScanKit/Tests/HouseScanKitTests/GuidancePlannerTests.swift, ios/HouseScanKit/Tests/HouseScanKitTests/CoachingDebouncerTests.swift	GuidancePlanner settles the current task without clearing deferred stretches. CoachingDebouncer clears moving-fast evidence while aiming. Tests cover both behaviors.
Gap progress and same-view comparisons ios/HouseScanKit/Sources/HouseScanKit/Guidance/GapPlanner.swift, ios/HouseScanKit/Tests/HouseScanKitTests/ServerGapTests.swift	GapPlanner measures progress and requested spans in feet. It compares requested spans and reaches without the previous tolerance. Tests cover contained spans, extensions, changed reaches, and coverage rounding.

Scene answer validation

Layer / File(s)	Summary
Bind server answers to submitted scenes ios/HouseScanKit/Sources/HouseScanKit/Scene/ResultBinding.swift, ios/HouseScan/Runtime/ResultClient.swift, ios/HouseScanKit/Tests/HouseScanKitTests/ResultBindingTests.swift	ResultBinding checks that a server answer contains a valid SHA-256 matching the submitted scene. ResultClient checks successful responses before returning them. Tests cover matching hashes and refusals.

Accessibility layouts

Layer / File(s)	Summary
Folded instruction and camera guidance ios/HouseScan/UI/Components/CameraChrome.swift, ios/HouseScan/UI/Components/InstructionCard.swift, ios/HouseScan/UI/Copy/ScanCopy.swift, ios/HouseScan/UI/Camera/*, ios/HouseScan/UI/Screens/GapRequestScreen.swift, ios/HouseScan/UI/Screens/WallWalkScreen.swift, ios/HouseScanUITests/ScreenStatesUITests.swift	At accessibility text sizes, instruction details and the legend can appear under Details. Camera chrome reports the open camera region, which screens share with the wayfinding overlay.
Find-meter aim positioning ios/HouseScan/UI/Screens/FindMeterScreen.swift, ios/HouseScanKit/Sources/HouseScanKit/Overlay/OpenCameraAim.swift, ios/HouseScanKit/Tests/HouseScanKitTests/OpenCameraAimTests.swift, ios/HouseScanUITests/ScreenStatesUITests.swift	FindMeterScreen uses the measured camera region to position its reticle and marking action at accessibility text sizes. OpenCameraAim calculates the visible region midpoint. Tests cover positioning.
Onboarding, result, and accessibility UI validation ios/HouseScan/UI/Screens/OnboardingScreen.swift, ios/HouseScan/UI/Screens/ResultScreen.swift, ios/HouseScanUITests/ScreenStatesUITests.swift	Onboarding content is clipped and its footer receives an opaque background. Result badges move above the answer card at accessibility text sizes. UI tests cover these layouts and related interactions.
Installer wording ios/HouseScan/UI/Copy/ScanCopy.swift, ios/HouseScan/UI/Copy/SpotCheckCopy.swift, ios/HouseScan/UI/Screens/GapRequestScreen.swift, ios/HouseScan/UI/Screens/MeterCloseUpScreen.swift, ios/HouseScan/UI/Screens/ResultARScreen.swift, ios/HouseScan/UI/Preview/DemoEngine.swift, ios/HouseScanUITests/FullFlowUITests.swift, ios/HouseScanUITests/InstallerReviewUITests.swift	Installer-related result copy and accessibility text is revised. UI tests check sample and demo result wording.

Coverage rebuild-view cache

Layer / File(s)	Summary
Visibility views and cache reuse ios/HouseScanKit/Sources/HouseScanKit/Coverage/CoverageMap.swift, ios/HouseScanKit/Tests/HouseScanKitTests/RebuildViewCacheTests.swift	CoverageMap separates visibility calculations from state recording and reuses per-frame views when frame inputs, lookup reads, and cache basis match. Tests compare cached rebuilds with full rebuilds.

Privacy and platform updates

Layer / File(s)	Summary
Privacy declarations and validation ios/HouseScan/PrivacyInfo.xcprivacy, ios/HouseScanKit/Tests/HouseScanKitTests/PrivacyManifestTests.swift	The manifest declares User Defaults, file timestamp, and system boot time access reasons. Tests scan shipped Swift source and verify manifest categories and reason codes.
Local network prompt and build timeout ios/Config/Info.plist, .github/workflows/ios.yml	The app adds a local-network usage description for developer-configured testing. The iOS build timeout increases to 75 minutes.

Diagnostics

Layer / File(s)	Summary
Vision request failure logging ios/HouseScan/Runtime/MeterReader/VisionMeterNumberReader.swift	The Vision request failure path logs the error domain and code as public fields, and the localized description as a private field. It still returns retakeNoNumber.

Priority: ➖ Normal

Estimated code review effort: 4 (Complex) | ~60 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant ScanEngine
  participant GroundFreshness
  participant UploadPackaging
  participant ResultClient
  participant Server
  ScanEngine->>GroundFreshness: Evaluate ground change and packaging state
  GroundFreshness->>ScanEngine: Return keep, resend, or fail action
  ScanEngine->>UploadPackaging: Package captured scene, mesh, and packet
  UploadPackaging->>ScanEngine: Return packaged scene and packet if current
  ScanEngine->>Server: Submit packaged scene
  Server->>ResultClient: Return answer
  ResultClient->>ResultClient: Check answer hash against submitted scene

Loading

Suggested reviewers: aidenjohnston

Merge Risk: ⚪ Minimal · up to 75f6c

The previously identified risk of uploading measurements from the wrong wall is resolved. No actionable merge-blocking issue remains after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 75f6c

The reviewed upload path strengthens answer validation and keeps submitted scan data consistent with its captured geometry. No introduced security weakness was established. Some persistence and broader security coverage remains incomplete, so the assessment is not a complete assurance of safety.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The inspected network exposure remains the device's scene JSON sent to its configured placement server. The request authority, endpoint and body are unchanged from base; the local capture packet is written separately and is not uploaded by this path.

Trust Boundaries and Controls

• inferred — The new hash check rejects answers declaring another input, but does not authenticate the server or prove the answer's substantive correctness. A malicious configured server can compute the submitted scene's hash and return false content with a matching hash; that server trust relationship predates this PR.
• observed — The bundled-sample exemption is isolated to the offline SampleResultClient. Selecting HTTPResultClient always applies response binding; the sample branch does not bypass validation for a network response.

Resilience and Maintainability Implications

• observed — Reset invalidates answer and shareable-scan publication, but a detached packet write already in progress can finish before its post-write guard rejects publication. The inspected reset and writer do not explicitly erase that completed archive. This persistence pattern predates the PR; it is not an established introduced security concern.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 61.88% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 223 functions across 43 files. (1 skipped…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title identifies the combined iOS changes, including upload consistency, coverage caching, ground freshness, privacy, accessibility, and guidance fixes. It is long, but it clearly describes the ch…
Description check	✅ Passed	The description covers the required What changed, Why, UI changes, Verification, Risk, and Checklist sections. It includes detailed behavior, test results, known limitations, and applicable media note…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 61.88% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 223 functions across 43 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-03T09:07:41.088256Z	75f6c37	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codemetrics-ai]

Note

Review skipped

Codemetrics is installed on this repository, but it hasn't been added to your team yet.

To enable AI code reviews for this repo, go to your dashboard and add BaseScanning to your team's repositories.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1f7e076b17

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[SamGu-NRX]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[SamGu-NRX]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[SamGu-NRX]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[SamGu-NRX]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 75f6c37773

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reset folded details for every new aiming task

At accessibility text sizes, consecutive aiming tasks can have the same title while targeting different stretches—for example, two .aimAtGround tasks both render “Tilt down to show the ground,” with only their detail changing. Because this resets detailsShown only when the title changes, a disclosure opened for the first task remains expanded for the next one, leaving the new task's detail and legend occupying the camera space that this folding behavior is intended to reopen. Reset using the task identity (such as replyTask or the full instruction excluding transient coaching) rather than just instruction.title.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Invalidate queued dot publications during spatial reset

When a LiDAR integration or anchor correction is already running during a spatial reset, LiveDotsFeed.reset() only queues its field clear behind that work; the older work can first enqueue send back to the main actor. After this method sets .empty and returns, that queued publication is accepted because a spatial reset does not increment generation, so dots in the discarded AR world frame reappear until a new keyframe replaces them. Give dot resets their own generation/epoch and reject publications queued before the reset, as resetAll() already effectively does by changing the scan generation.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Cancel superseded mesh measurements before resending

On a LiDAR phone, if the ground changes while the first packaged upload is measuring its mesh, startUpload() cancels the outer upload task and immediately starts the replacement, but this Task.detached is independent and never receives that cancellation. The withdrawn upload therefore continues all of its per-cell mesh ray casts while the replacement starts another full measurement, retaining both mesh snapshots and competing for CPU until the old calculation finishes. This is precisely the newly supported ground-change-during-measurement path; use cancellable structured work or cancellation checks/serialization so a superseded measurement stops before the resend begins.

Useful? React with 👍 / 👎.