[BUG] iOS Simulator panel helper (claude-ios-sim) crash-loops in Metal binary-archive loading on macOS 27 beta / M4; panel never attaches

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet (searched: claude-ios-sim, simulator panel crash, MTLBinaryArchive — no hits)
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code (desktop app 1.25927.0, auto-updated and restarted today; see version notes below)

What's Wrong?

The desktop app's iOS Simulator panel never attaches. Its helper process claude-ios-sim (bundle com.anthropic.claude.ios-sim) crashes with SIGABRT the moment the panel starts streaming, and keeps crash-looping. The MCP attach action reports success (the panel UI opens), but every screenshot action returns "Claude Code iOS Simulator is restarting after a crash. Try again in 1s" indefinitely, and tap actions report success without any tap landing on the device.

The simulator itself is healthy throughout: simctl screenshots/installs and XCUITest input all work against the same booted device.

What Should Happen?

The panel attaches and streams the booted simulator; screenshot returns an image and tap lands on the device.

Error Messages/Logs

Tool result: "screenshot failed: Claude Code iOS Simulator is restarting after a crash. Try again in 1s. The simulator restarts itself; retry this call."

Crash reports (~/Library/Logs/DiagnosticReports/claude-ios-sim-*.ips), all identical:
  exception: EXC_CRASH (SIGABRT), termination: Abort trap: 6
  lastExceptionBacktrace:
    CoreFoundation    __exceptionPreprocess
    libobjc.A.dylib   objc_exception_throw
    CoreFoundation    -[__NSPlaceholderArray initWithObjects:count:]
    CoreFoundation    +[NSArray arrayWithObjects:count:]
    Metal             __39-[_MTLDevice recordBinaryArchiveUsage:]_block_invoke
    libdispatch.dylib _dispatch_client_callout
    libdispatch.dylib _dispatch_once_callout
    Metal             -[_MTLDevice recordBinaryArchiveUsage:]
    Metal             -[_MTLBinaryArchive loadFromURL:error:]
    Metal             -[_MTLBinaryArchive initWithOptions:device:url:error:]

Looks like NSArray arrayWithObjects:count: receiving a nil element inside Metal's binary-archive usage recording while the helper loads a Metal binary archive at startup — plausibly the app's bundled archive being rejected on this GPU/OS combination.

Steps to Reproduce

1. macOS 27.0 beta (Darwin 27.0.0) on a MacBook Pro M4, Xcode-beta partial install (no Simulator.app GUI), an iOS 26.2 simulator booted via xcrun simctl boot.
2. In a Claude Code desktop session, have Claude call the "Claude Code iOS Simulator" MCP tool with action: "attach" and the booted device's UDID — the call returns success and the panel opens.
3. Have Claude call action: "screenshot" — it fails with the "restarting after a crash" error, and a new claude-ios-sim-*.ips crash report appears. Every retry produces another identical crash.

100% reproducible on this machine over two days, dozens of identical crash reports.

Claude Model

Other (Fable 5)

Is this a regression?

I don't know

Last Working Version

Unknown (never worked on this machine/OS combination)

Claude Code Version

Desktop app: Claude.app 1.25927.0 (macOS, auto-updated, restarted today — crash persists across restart). Bundled CLI reports: 2.1.153 (Claude Code). The crashing component ships with the desktop app.

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

Other (Claude Code desktop app session)

Additional Information

Ruled out before filing:

• Fully quitting and reopening the desktop app: crash resumes immediately on the next attach
• Rebooting the simulator device and restarting CoreSimulatorService: no change
• Purging the app's Metal shader caches (com.apple.metal, com.apple.metalfe, com.apple.gpuarchiver under both com.anthropic.claudefordesktop and com.anthropic.claudefordesktop.helper in DARWIN_USER_CACHE_DIR): identical crash on a fresh cache, so the archive being loaded appears to ship with the app rather than come from local cache state

Full .ips crash reports available on request.