Prepare iOS App Store review readiness

.github/workflows/ios-app-store.yml

@@ -146,6 +146,54 @@ jobs:
           APPLE_NIGHTLY_PROVISIONING_PROFILE_BASE64: ${{ secrets.APPLE_NIGHTLY_PROVISIONING_PROFILE_BASE64 }}
         run: ./.github/scripts/install-app-store-provisioning-profile.sh
 
+      - name: Prepare App Store version and metadata
+        run: |
+          set -euo pipefail
+          VERSION="$(sed -nE 's/^[[:space:]]*CMUX_IOS_APPSTORE_MARKETING_VERSION[[:space:]]*=[[:space:]]*([^[:space:]]+).*/\1/p' ios/Config/Shared.xcconfig | tail -n 1)"
+          VERSION_ID="$(
+            asc versions list --app "$ASC_APP_ID" --version "$VERSION" --platform IOS --output json |
+              python3 -c 'import json,sys; body=json.load(sys.stdin); data=body.get("data") if isinstance(body,dict) else body; data=data if isinstance(data,list) else ([data] if isinstance(data,dict) else []); print(data[0].get("id", "") if data else "")'
+          )"
+          if [ -z "$VERSION_ID" ]; then
+            asc versions create \
+              --app "$ASC_APP_ID" \
+              --version "$VERSION" \
+              --platform IOS \
+              --copyright "2026 Manaflow, Inc." \
+              --release-type MANUAL
+          else
+            asc versions update \
+              --version-id "$VERSION_ID" \
+              --copyright "2026 Manaflow, Inc." \
+              --release-type MANUAL
+          fi
+          asc metadata validate --dir ios/AppStoreReview/metadata
+          asc metadata apply \
+            --app "$ASC_APP_ID" \
+            --version "$VERSION" \
+            --platform IOS \
+            --dir ios/AppStoreReview/metadata
+          asc screenshots validate \
+            --path ios/AppStoreReview/screenshots/en-US/iphone \
+            --device-type IPHONE_69
+          asc screenshots upload \
+            --app "$ASC_APP_ID" \
+            --version "$VERSION" \
+            --platform IOS \
+            --path ios/AppStoreReview/screenshots \
+            --device-type IPHONE_69 \
+            --replace
+          asc screenshots validate \
+            --path ios/AppStoreReview/screenshots/en-US/ipad \
+            --device-type IPAD_PRO_3GEN_129
+          asc screenshots upload \
+            --app "$ASC_APP_ID" \
+            --version "$VERSION" \
+            --platform IOS \
+            --path ios/AppStoreReview/screenshots \
+            --device-type IPAD_PRO_3GEN_129 \
+            --replace
+
       - name: Archive, export, and upload production build
         id: upload
         env:
@@ -171,6 +219,8 @@ jobs:
             --version "$VERSION" \
             --build-number "$FINAL_BUILD_NUMBER" \
             --wait-build \
+            --screenshot-device-type IPHONE_69 \
+            --screenshot-device-type IPAD_PRO_3GEN_129 \
             --strict
           if [ -n "${INPUT_COPY_METADATA_FROM:-}" ]; then
             ./ios/scripts/validate-app-store-release.sh \
@@ -179,6 +229,8 @@ jobs:
               --build-number "$FINAL_BUILD_NUMBER" \
               --copy-metadata-from "$INPUT_COPY_METADATA_FROM" \
               --stage-dry-run \
+              --screenshot-device-type IPHONE_69 \
+              --screenshot-device-type IPAD_PRO_3GEN_129 \
               --strict
           fi
           if [ "${INPUT_SUBMIT_FOR_REVIEW:-false}" = "true" ]; then
@@ -188,6 +240,8 @@ jobs:
               --build-number "$FINAL_BUILD_NUMBER" \
               --submit \
               --confirm-submit \
+              --screenshot-device-type IPHONE_69 \
+              --screenshot-device-type IPAD_PRO_3GEN_129 \
               --strict
           fi
 

Packages/iOS/CmuxMobileAnalytics/Sources/CmuxMobileAnalytics/AnalyticsConsentGenerationGate.swift

@@ -0,0 +1,55 @@
+/// Synchronous consent state shared by fire-and-forget callers and the actor.
+///
+/// A generation makes an event captured before a revoke permanently stale even
+/// if consent is enabled again before the actor drains its FIFO. Synchronizing
+/// transport state inside the same critical section also closes the inverse
+/// race where UserDefaults reads enabled before its notification re-enables the
+/// uploader.
+final class AnalyticsConsentGenerationGate: Sendable {
+    private let state: AnalyticsCriticalState<(isEnabled: Bool, generation: UInt64)>
+
+    init(isEnabled: Bool) {
+        state = AnalyticsCriticalState(
+            initialValue: (isEnabled: isEnabled, generation: 0)
+        )
+    }
+
+    func snapshot() -> AnalyticsConsentSnapshot {
+        state.withCriticalRegion {
+            AnalyticsConsentSnapshot(isEnabled: $0.isEnabled, generation: $0.generation)
+        }
+    }
+
+    /// Reconciles an observed provider value against the snapshot taken before
+    /// reading it. If another thread changed consent during that read, the
+    /// original snapshot is returned so the caller's submission stays stale.
+    func synchronize(
+        observedEnabled: Bool,
+        basedOn base: AnalyticsConsentSnapshot,
+        publish: @Sendable (AnalyticsConsentSnapshot) -> Void
+    ) -> AnalyticsConsentSnapshot {
+        state.withCriticalRegion { state in
+            guard state.generation == base.generation else { return base }
+            guard state.isEnabled != observedEnabled else {
+                return AnalyticsConsentSnapshot(
+                    isEnabled: state.isEnabled,
+                    generation: state.generation
+                )
+            }
+            state.isEnabled = observedEnabled
+            state.generation &+= 1
+            let updated = AnalyticsConsentSnapshot(
+                isEnabled: state.isEnabled,
+                generation: state.generation
+            )
+            publish(updated)
+            return updated
+        }
+    }
+
+    func allows(_ snapshot: AnalyticsConsentSnapshot) -> Bool {
+        state.withCriticalRegion { state in
+            state.isEnabled && state.generation == snapshot.generation
+        }
+    }
+}

Packages/iOS/CmuxMobileAnalytics/Sources/CmuxMobileAnalytics/AnalyticsConsentProviding.swift

@@ -42,9 +42,9 @@ public struct AnalyticsConsentProvider: AnalyticsConsentProviding {
 ///
 /// The iOS app cannot import the macOS-only `CmuxSettings` package, so this reads
 /// the same backing key that `CmuxSettings.catalog.app.sendAnonymousTelemetry`
-/// writes (`"sendAnonymousTelemetry"`), with the same default of `true`. The
-/// value is read on every capture so toggling the Settings switch takes effect
-/// immediately without rewiring.
+/// writes (`"sendAnonymousTelemetry"`). iOS defaults to telemetry off until the
+/// user enables the Settings toggle. The value is read on every capture so
+/// toggling the switch takes effect immediately without rewiring.
 public struct UserDefaultsAnalyticsConsentProvider: AnalyticsConsentProviding {
     /// The `UserDefaults` key shared with the settings catalog's
     /// `app.sendAnonymousTelemetry` entry.
@@ -61,7 +61,6 @@ public struct UserDefaultsAnalyticsConsentProvider: AnalyticsConsentProviding {
     }
 
     public var isTelemetryEnabled: Bool {
-        // Absent key defaults to opted-in (true), matching the catalog default.
-        defaults.object(forKey: Self.telemetryKey) as? Bool ?? true
+        defaults.object(forKey: Self.telemetryKey) as? Bool ?? false
     }
 }

Packages/iOS/CmuxMobileAnalytics/Sources/CmuxMobileAnalytics/AnalyticsConsentRevocationObserver.swift

@@ -0,0 +1,44 @@
+internal import CMUXMobileCore
+internal import Foundation
+
+// Safety: NotificationCenter owns the callback concurrently, while this type's
+// stored token and center are immutable after initialization. The callback only
+// synchronizes injected thread-safe consent/uploader seams and yields into a
+// thread-safe AsyncStream.
+final class AnalyticsConsentRevocationObserver: @unchecked Sendable {
+    private let notificationCenter: NotificationCenter
+    private let token: any NSObjectProtocol
+
+    init(
+        notificationCenter: NotificationCenter,
+        consent: any AnalyticsConsentProviding,
+        uploader: any AnalyticsUploading,
+        generationGate: AnalyticsConsentGenerationGate,
+        onConsentChange: @escaping @Sendable (AnalyticsConsentSnapshot) -> Void
+    ) {
+        self.notificationCenter = notificationCenter
+        uploader.setUploadsEnabled(consent.isTelemetryEnabled)
+        self.token = notificationCenter.addObserver(
+            forName: UserDefaults.didChangeNotification,
+            object: nil,
+            queue: nil
+        ) { _ in
+            let base = generationGate.snapshot()
+            let observedEnabled = consent.isTelemetryEnabled
+            _ = generationGate.synchronize(
+                observedEnabled: observedEnabled,
+                basedOn: base
+            ) { snapshot in
+                // Publish transport state before the FIFO command. A capture
+                // racing notification delivery therefore cannot be accepted by
+                // consent and then dropped by a still-disabled uploader.
+                uploader.setUploadsEnabled(snapshot.isEnabled)
+                onConsentChange(snapshot)
+            }
+        }
+    }
+
+    deinit {
+        notificationCenter.removeObserver(token)
+    }
+}

Packages/iOS/CmuxMobileAnalytics/Sources/CmuxMobileAnalytics/AnalyticsConsentSnapshot.swift

@@ -0,0 +1,4 @@
+struct AnalyticsConsentSnapshot: Equatable, Sendable {
+    let isEnabled: Bool
+    let generation: UInt64
+}

Packages/iOS/CmuxMobileAnalytics/Sources/CmuxMobileAnalytics/AnalyticsCriticalState.swift

@@ -0,0 +1,17 @@
+internal import os
+
+/// Synchronous state for non-async telemetry entrypoints and revocation hooks.
+final class AnalyticsCriticalState<State: Sendable>: Sendable {
+    // lint:allow lock - synchronous consent and cancellation entrypoints cannot await an actor without reopening revoke races.
+    private let state: OSAllocatedUnfairLock<State>
+
+    init(initialValue: State) {
+        state = .init(initialState: initialValue)
+    }
+
+    func withCriticalRegion<Result: Sendable>(
+        _ body: @Sendable (inout State) throws -> sending Result
+    ) rethrows -> sending Result {
+        try state.withLock(body)
+    }
+}