iOS hardware target for the experiments sweep; not-loadable judged by evidence

Two lab findings. The experiments suite shells out to t1_experiments,
whose iOS class only knew simctl - so on the MacBook's real devices
every launch failed. It now takes --ios-target simulator|device;
device mode uses devicectl with the '--' separator, port 80 on the
device and the caller's existing forward, and the lab passes it for
every iOS device.

And 'remote API not reachable' was a hard error on Android while iOS
treated it as scoping - but a Pixel 9 Pro declines depth.phyphox for
want of depth hardware exactly as the simulator declines its missing
sensors. The verdict is now platform-independent AND evidence-based:
provisional not-loadable during the sweep, converted back into a real
failure afterwards only if NOTHING on that target reached the API,
which is precisely when a broken switch or forward is the explanation.
Verified on the Pixel 9 Pro: depth alone reports the switch question,
depth plus doppler correctly scopes depth and exits green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Staacks

tools/lab/lab.yml

@@ -11,17 +11,17 @@ hosts:
       android: /home/dicon/phyphox/git/phyphox-android/app/regular/release/phyphox-release.apk
       ios: /Users/sebastianstaacks/phyphox.ipa
     devices:
-      iphone-14-pro: {platform: ios, serial: "00008120-001C31520EC0C01E", port: 80}
-      iphone-8:      {platform: ios, serial: "abff2ed0b2ee61af08467e4381063a5e45da4ad0", port: 80}
-      ipad-pro:      {platform: ios, serial: "00008103-0015196202A3001E", port: 80}
-      pixel-9-pro:   {platform: android, serial: "53291FDAP0026B", port: 8080}
-      pixel-3:       {platform: android, serial: "8C5X1J8JL", port: 8080}
-      nexus-5x:      {platform: android, serial: "025e9f6567c4d0e5", port: 8080}
-      galaxy-a3:     {platform: android, serial: "33007f6cd2ab1445", port: 8080}
+      iphone-14-pro: {platform: ios, serial: "00008120-001C31520EC0C01E", port: 8181}
+      iphone-8:      {platform: ios, serial: "abff2ed0b2ee61af08467e4381063a5e45da4ad0", port: 8182}
+      ipad-pro:      {platform: ios, serial: "00008103-0015196202A3001E", port: 8183}
+      pixel-9-pro:   {platform: android, serial: "53291FDAP0026B", port: 8184}
+      pixel-3:       {platform: android, serial: "8C5X1J8JL", port: 8185}
+      nexus-5x:      {platform: android, serial: "025e9f6567c4d0e5", port: 8186}
+      galaxy-a3:     {platform: android, serial: "33007f6cd2ab1445", port: 8187}
 
   linuxbox:           # the split: Android (+ boards, phase 6) here,
     devices:          # iOS stays with the MacBook
-      pixel-9-pro:   {platform: android, serial: "53291FDAP0026B", port: 8080}
-      pixel-3:       {platform: android, serial: "8C5X1J8JL", port: 8080}
-      nexus-5x:      {platform: android, serial: "025e9f6567c4d0e5", port: 8080}
-      galaxy-a3:     {platform: android, serial: "33007f6cd2ab1445", port: 8080}
+      pixel-9-pro:   {platform: android, serial: "53291FDAP0026B", port: 8184}
+      pixel-3:       {platform: android, serial: "8C5X1J8JL", port: 8185}
+      nexus-5x:      {platform: android, serial: "025e9f6567c4d0e5", port: 8186}
+      galaxy-a3:     {platform: android, serial: "33007f6cd2ab1445", port: 8187}

tools/lab/suites.py

@@ -227,6 +227,10 @@ def run_experiments_suite(dev, args):
            "--serial", getattr(dev, "serial", None) or dev.udid,
            "--port", str(dev.port), "--seconds", str(args.seconds),
            "--require-rows", "--out", out]
+    if dev.platform == "ios":
+        # lab devices are real hardware: devicectl, port 80 on the
+        # device, and the forward this handle already established
+        cmd += ["--ios-target", "device"]
     r = subprocess.run(cmd, capture_output=True, text=True, timeout=7200)
     findings = []
     if r.returncode != 0:

tools/t1_experiments.py

@@ -195,9 +195,15 @@ def inject(self, t):
 
 
 class IOS:
-    def __init__(self, udid, port):
+    """Simulator by default (what CI drives); --ios-target device switches
+    to devicectl for real hardware, where the app serves port 80 and the
+    host-side forward is set up by the caller (the lab driver's
+    IOSDevice.prepare) rather than here."""
+
+    def __init__(self, udid, port, target="simulator"):
         self.udid = udid or "booted"
         self.port = port
+        self.target = target
 
     def launch(self, asset_path):
         url = "phyphox://asset=" + urllib.parse.quote(asset_path, safe="")
@@ -207,6 +213,15 @@ def launch(self, asset_path):
         # report a false ok. -phyphoxRemotePort keeps the served port and
         # the driver's base URL in step; -phyphoxAutoConfirm accepts the
         # dialogs a headless run cannot tap (network privacy).
+        if self.target == "device":
+            # hardware: devicectl needs "--" before the app's own
+            # dash-prefixed arguments, and the app serves port 80 there
+            r = sh(["xcrun", "devicectl", "device", "process", "launch",
+                    "--terminate-existing", "--device", self.udid, "--",
+                    IOS_BUNDLE, "-phyphoxUrl", url, "-phyphoxRemote",
+                    "-phyphoxRemotePort", "80", "-phyphoxAutoConfirm"],
+                   timeout=60)
+            return r.returncode == 0
         r = sh(["xcrun", "simctl", "launch", "--terminate-running-process",
                 self.udid, IOS_BUNDLE,
                 "-phyphoxUrl", url, "-phyphoxRemote",
@@ -218,6 +233,8 @@ def cleanup(self):
         pass
 
     def stop_app(self):
+        if self.target == "device":
+            return          # --terminate-existing on launch
         sh(["xcrun", "simctl", "terminate", self.udid, IOS_BUNDLE])
 
     def inject(self, t):
@@ -285,16 +302,16 @@ def run_experiment(dev, base, rel, path, args):
         if elapsed is not None:
             elapsed += args.api_wait
     if elapsed is None:
-        if args.platform == "ios":
-            # the simulator lacks most sensors; the app declines the
-            # experiment ("sensor not available") and returns to the
-            # collection. That is the scoped iOS subset, not a failure -
-            # but a hung loadable experiment ends up here too, which is
-            # why the slow path above gets its own verdict.
-            result["not_loadable"] = True
-            return result
-        result["errors"].append("remote API not reachable (is remote access "
-                                "enabled for launched experiments?)")
+        # The app declines an experiment the target cannot run ("sensor
+        # not available") and returns to the collection, so no API comes
+        # up. That is scoping, not failure - on EITHER platform: the iOS
+        # simulator lacks most sensors, and a phone without depth
+        # hardware declines depth.phyphox just the same (Pixel 9 Pro,
+        # found by the lab 2026-08-26). It is only indistinguishable
+        # from a broken remote switch in the abstract - run_all() has
+        # the evidence and reclassifies afterwards, so this verdict is
+        # provisional.
+        result["not_loadable"] = True
         return result
     if elapsed > args.api_wait:
         result["slow_api"] = round(elapsed, 1)
@@ -373,6 +390,11 @@ def main():
     ap.add_argument("--require-rows", action="store_true",
                     help="an export set without rows is a finding")
     ap.add_argument("--include-bluetooth", action="store_true")
+    ap.add_argument("--ios-target", choices=["simulator", "device"],
+                    default="simulator",
+                    help="iOS only: simulator (simctl, the CI default) or "
+                         "device (devicectl; the caller provides the port "
+                         "forward)")
     ap.add_argument("--out", default="t1-results.json")
     args = ap.parse_args()
 
@@ -394,14 +416,26 @@ def main():
     if args.platform == "android":
         dev = Android(args.serial, args.port)
     else:
-        dev = IOS(args.serial, args.port)
+        dev = IOS(args.serial, args.port, args.ios_target)
     base = f"http://127.0.0.1:{args.port}"
 
     results, hard_failures = [], 0
     try:
         run_all(dev, base, collection, experiments, args, results)
     finally:
         dev.cleanup()
+
+    # Provisional not-loadable verdicts, judged with the whole run as
+    # evidence: if NOTHING reached the remote API, the switch or the
+    # forward is broken and every one of them is a real failure; if some
+    # experiments did, the app simply declined the others.
+    if not any(r.get("remote") for r in results):
+        for r in results:
+            if r.pop("not_loadable", None):
+                r["errors"].append(
+                    "remote API not reachable, and no experiment on this "
+                    "target reached it - remote-enable switch or port "
+                    "forward broken?")
     hard_failures = sum(
         1 for r in results
         if not r.get("skipped") and not r.get("not_loadable")
@@ -424,7 +458,8 @@ def run_all(dev, base, collection, experiments, args, results):
             print(f"   - skipped: {r['skipped']}")
             continue
         if r.get("not_loadable"):
-            print("   - not loadable on this target (simulator subset)")
+            print("   - not loadable on this target (the app declined it - "
+                  "hardware or simulator lacks what it needs)")
             continue
         if r.get("slow_api"):
             print(f"   ~ remote API answered late ({r['slow_api']} s) - "