fix: gate HID connection reuse on launchd_sim process identity

[onevcat]

Summary

Fixes #55 — after an out-of-band simctl shutdown && boot, the surviving per-UDID daemon kept sending HID events through the previous boot's dead mach port: tap reported success while delivering nothing, the worst failure mode for an agent-facing tool.

Root cause

The existing boot-identity gate (HIDBootIdentity, #23-era) keyed cache reuse solely on the mtime of <dataDirectory>/var/run/launchd_bootstrap.plist, assuming CoreSimulator rewrites it on every boot. The investigation showed that assumption is conditional: forensics on the 2026-07-22 repro device found the marker frozen at 17:46:09 while var/run siblings showed boot-cycle activity through 19:20:39 (Xcode 27 B4 / CoreSimulator 1169.1; a CoreSimulatorService restart at 20:57 that evening suggests a mixed-version service state during the repro window). Equal mtimes across different boots ⇒ the dead connection was judged reusable. Notably, a clean-state re-run of the exact repro steps on both Xcode 27 B4 and an iOS 26.5 runtime did not reproduce — the marker advanced and the gate rebuilt correctly — which is exactly why the fix moves off the marker as the primary signal.

Fix

• LaunchdSimLocator (new) — resolves the launchd_sim process serving a UDID via sysctl(KERN_PROC_ALL) + KERN_PROCARGS2 (~1–2 ms per probe; the /bin/ps pattern used elsewhere measures ~40 ms). launchd_sim's lifetime IS the boot; its (pid, kernel start time) is an unforgeable boot identity, immune to marker-rewrite semantics and pid reuse.
• HIDBootIdentity — token becomes compound. Decision table: process identities on both sides → reuse iff equal (authoritative, the iOS daemon holds a stale HID connection across simulator reboot — tap reports success but is not delivered #55 fix); one-sided → fail closed; neither → previous marker-mtime rule as fallback.
• HIDSendDeadline (new) — defence in depth for the residual window (reboot mid-command, or an unknown future token failure): each send runs under a 30 s deadline (SIM_USE_HID_SEND_TIMEOUT_MS, 0 disables) so a dead-port hang (the Xcode 26.5-observed mode) fails loudly instead of wedging the daemon. The timeout wording deliberately matches none of HIDPerformRecovery's dead-transport markers, so a timed-out composite is never blind-retried — pinned by a unit test.

The durable logic (token + reuse decision + locator) is pure and transport-agnostic; the planned idb/DTUHID migration replaces HIDInteractor and re-wires the same gate in one line.

Tests

• HIDBootIdentityTests — compound-token decision table, including the iOS daemon holds a stale HID connection across simulator reboot — tap reports success but is not delivered #55 regression row (marker equal, process identity changed → reject).
• LaunchdSimLocatorTests — pure matching on fixture tables (exact-comm filter, per-UDID argv scoping, overlapping-boot resolution, case-insensitivity) + a live sysctl smoke test.
• HIDSendDeadlineTests — race mechanics, cancellation propagation, and the invalidateOnly classification pin.
• HIDRebootRecoveryTests (opt-in E2E, registered in scripts/test-runner.sh) — tap → simctl shutdown && boot → tap through the same daemon (pidfile-asserted), with a dtuhidd-confounder guard.

Verification

• make build / make test: 1115 unit tests green, no warnings.
• SIMULATOR_UDID=… ./scripts/test-runner.sh HIDRebootRecoveryTests on Xcode 27 Beta 4 / iOS 27.0: passed live (27 s).
• Manual protocol on an iOS 26.5 runtime with the fixed binary: baseline tap → reboot → tap through the surviving daemon (same pid 21858 throughout) — landed.

🤖 Generated with Claude Code