iOS Simulator live panel crash-loops on macOS 27.0 beta: Metal recordBinaryArchiveUsage nil-array during CoreImage init in claude-ios-sim helper

Bug report: Claude Code iOS Simulator helper crash-loops on macOS 27.0 beta

Summary. The bundled live-simulator helper (Claude iOS Sim.app / claude-ios-sim)
crashes with SIGABRT on every frame capture on macOS 27.0 beta. attach succeeds and
the panel opens; the first screenshot/stream frame kills the helper, it restarts, and
the next frame kills it again — a deterministic crash loop. Device access was granted
("Let Claude use it" clicked); the grant is not the issue.

Environment (all verified on the machine, 2026-08-30).

• macOS 27.0 beta, build 26A5406e, Apple Silicon (arm64)
• Claude desktop app 1.40609.0
• Helper: /Applications/Claude.app/Contents/Helpers/Claude iOS Sim.app/Contents/MacOS/claude-ios-sim,

bundle id com.anthropic.claude.ios-sim, native arm64 (not translated),
built against SDK 26.1 (minos 14.0, per otool -l LC_BUILD_VERSION)

• Simulator target: iPhone 17, udid 7D1129D8-529A-462D-A144-7C39065E2E77, booted and healthy
• Xcode 26.6 (17F113) selected via xcode-select; Xcode 27.0 beta also installed

Reproduction. MCP control {action: attach} → succeeds. control {action: screenshot}
→ "Claude Code iOS Simulator is restarting after a crash" every time. Seven+ crash
reports in ~/Library/Logs/DiagnosticReports/claude-ios-sim-*.ips, all identical.

Crash signature (identical in every report). Uncaught ObjC exception → SIGABRT.
lastExceptionBacktrace:

CoreFoundation  -[__NSPlaceholderArray initWithObjects:count:]   <- nil element
CoreFoundation  +[NSArray arrayWithObjects:count:]
Metal           __39-[_MTLDevice recordBinaryArchiveUsage:]_block_invoke
libdispatch     _dispatch_once_callout
Metal           -[_MTLDevice recordBinaryArchiveUsage:]
Metal           -[_MTLBinaryArchive loadFromURL:error:]
Metal           -[_MTLBinaryArchive initWithOptions:device:url:error:]
CoreImage       +[CIKernelLibrary(Internal) internalBinaryArchiveWithName:device:]
CoreImage       CI::PrecompiledUberFunctions::PrecompiledUberFunctions(...)
CoreImage       CI::MetalContext::init(...)
CoreImage       -[CIContext initWithOptions:]
FBSimulatorControl  FBSurfaceImageGenerator.image()
FBSimulatorControl  FBSimulatorImage.image()

Metal's once-per-process binary-archive usage telemetry inserts a nil object into an
NSArray while CoreImage creates its Metal context during the helper's frame capture.

Ruled out on this machine.

• Not universal on this OS build: an equivalent test binary (Swift, CIContext on a

Metal command queue, forced render via createCGImage) built with the local
toolchain (SDK 26.5) runs clean — including re-signed with the hardened runtime and
rebuilt with a macOS 14.0 deployment target.

• Helper has empty entitlements (no app sandbox), so not a sandbox denial.
• Simulator itself is fine: xcrun simctl io <udid> screenshot works throughout, and

full Flutter/React Native app runs on this same device succeeded headlessly.

Best remaining hypothesis (likely, not confirmed). A linked-on-SDK behavior gate:
the helper is built against SDK 26.1, and Metal's binary-archive telemetry path taken
for older-SDK binaries produces a nil array element on this beta seed. Not testable
here — no 26.1 SDK is installed to rebuild the repro against.

Impact / workaround. Live panel unusable on this OS build. Headless verification
(simctl io screenshot, app test suites) is unaffected and is the workaround in use.