iOS Simulator helper crashes in CoreImage/Metal on macOS 27, making tap/swipe unavailable

What happens

The bundled iOS Simulator helper (Claude iOS Sim.app / claude-ios-sim) crashes
deterministically on macOS 27 as soon as it captures a frame. attach succeeds and
returns the coordinate space, but the very next screenshot or tap aborts the
helper. After a few attempts the session gives up with:

Claude Code iOS Simulator has stopped retrying after repeated crashes. Retrying will not help; ask the user to re-open the simulator panel.

Re-opening the panel does not help — it crashes again the same way. The net effect
is that tap/swipe/type are completely unavailable, so the agent cannot drive a
simulator at all. The panel is left blank/white, which looks like the app under
test has hung when it has not.

Environment

• Claude Desktop 1.52386.6
• macOS 27.0 (26A428), Apple silicon
• Xcode 27.0 (27A266a)
• iOS 26.5 simulator (also reproduced with iOS 27.0 booted)

Crash

EXC_CRASH (SIGABRT), from an Objective-C exception thrown during CoreImage's
Metal context setup. Identical stack in 22 crash reports in one day:

libsystem_kernel.dylib        __pthread_kill
libsystem_c.dylib             abort
libc++abi.dylib               demangling_terminate_handler()
libobjc.A.dylib               _objc_terminate()
libc++abi.dylib               __cxa_throw
libobjc.A.dylib               objc_exception_throw
CoreFoundation                -[__NSPlaceholderArray initWithObjects:count:]
CoreFoundation                +[NSArray arrayWithObjects:count:]
Metal                         __39-[_MTLDevice recordBinaryArchiveUsage:]_block_invoke
libdispatch.dylib             _dispatch_once_callout
Metal                         -[_MTLDevice recordBinaryArchiveUsage:]
Metal                         -[_MTLBinaryArchive loadFromURL:error:]
Metal                         -[_MTLBinaryArchive initWithOptions:device:url:error:]
CoreImage                     +[CIKernelLibrary(Internal) internalBinaryArchiveWithName:device:]
CoreImage                     CI::PrecompiledUberFunctions::PrecompiledUberFunctions(CI::MetalContext const*)
CoreImage                     CI::new_uber_functions(CI::MetalContext const*)
CoreImage                     CI::MetalContext::init(id<MTLCommandQueue>, char const*)

Thread: com.apple.root.default-qos.cooperative. Reports are at
~/Library/Logs/DiagnosticReports/claude-ios-sim-*.ips.

Notes from narrowing it down

• Not the Xcode 27 rename. Simulator.app is now Device Hub on this release, but

that is a different code path — simctl works throughout (see below).

• Not a nil bundle identifier. That is the usual cause of a nil reaching

+[NSArray arrayWithObjects:count:], but the helper bundle has a valid
CFBundleIdentifier (com.anthropic.claude.ios-sim).

• Possible lead, unconfirmed: the helper's sandbox profile

(Claude.app/Contents/Resources/claude-ios-sim.sb) grants file-write* only to
the CoreSimulator home, CoreSimulator logs, DARWIN_TMP and /private/var/tmp.
It does not grant the Darwin cache directory, which is where
com.apple.metal lives. If recordBinaryArchiveUsage: writes there, a denial
could explain a nil reaching that array. I did not verify this — (deny default)
denies silently, so nothing appears in the sandbox log either way.

Workaround

xcrun simctl is unaffected — list, boot, install, launch, terminate and
io <udid> screenshot all work normally, so screenshots remain possible. There is
no substitute for tap/swipe: simctl has no tap, and devicectl has no tap
subcommand.