src/cli.ts (buildIosProjectForOnboarding + discoverBuiltArtifacts): .nativeproof/ios/DerivedData persists across runs, so when a rebuild FAILS, discovery finds the previous run's .app, prints 'xcodebuild exited N, but produced …; continuing with that app', and onboards outdated bits. Also discoverBuiltArtifacts takes newest-mtime anywhere in the tree (device builds/Watch companions can win) and one unreadable directory aborts the walk (unguarded readdirSync). Suggested: record artifact mtimes before the build and only accept artifacts newer than build start; prefer Debug-iphonesimulator paths; try/catch the readdir. Found during adversarial review (2026-07-02).
src/cli.ts (buildIosProjectForOnboarding + discoverBuiltArtifacts): .nativeproof/ios/DerivedData persists across runs, so when a rebuild FAILS, discovery finds the previous run's .app, prints 'xcodebuild exited N, but produced …; continuing with that app', and onboards outdated bits. Also discoverBuiltArtifacts takes newest-mtime anywhere in the tree (device builds/Watch companions can win) and one unreadable directory aborts the walk (unguarded readdirSync). Suggested: record artifact mtimes before the build and only accept artifacts newer than build start; prefer Debug-iphonesimulator paths; try/catch the readdir. Found during adversarial review (2026-07-02).