feat(ios): real daemon tunnelProvider + KIF-derived UITouch synthesis

Closes two layers of the device-control gap:

L1 — Mac daemon's tunnelProvider is now real, not a stub. New files:
- ios-qa/daemon/src/devicectl.ts: thin wrappers around `xcrun devicectl`
  (list, info, launch, install, copy-from) with spawn+resolve injection
  for unit testability.
- ios-qa/daemon/src/tunnel-bootstrap.ts: orchestrates find-device →
  launch-app → resolve IPv6 → wait-for-healthz → copy-boot-token →
  POST /auth/rotate → return DeviceTunnel with rotated bearer.
- ios-qa/daemon/test/tunnel-bootstrap.test.ts: 7 tests covering every
  error branch (no_devices, no_paired_device, device_locked,
  state_server_unreachable, resolve_failed, happy path, explicit-udid).
- index.ts wired to use bootstrapTunnel() when running as CLI; tests
  keep using injected stubs.

L2 — In-process touch synthesis for non-UIControl widgets. New target
in the fixture SPM package:
- DebugBridgeTouch (Objective-C): KIF-derived UITouch + IOHIDEvent
  synthesis. Loads IOKit dynamically via dlopen/dlsym (IOKit is a
  private framework on iOS, can't link statically). Uses iOS 18+
  _UIHitTestContext for SwiftUI hit-testing. Public Swift-callable
  API: DebugBridgeTouch.sendTap(at:in:). MIT-attributed to
  kif-framework/KIF.
- DebugBridgeUI/Bridges.swift: rewritten MutationBridge.handleTap to
  delegate to DebugBridgeTouch. ScreenshotBridge + ElementsBridge
  implementations also land here.
- FixtureApp/Sources/FixtureApp/FixtureAppApp.swift: wires the bridges
  on app launch under #if DEBUG.

Real-iPhone evidence (Conductor sandbox → CoreDevice IPv6 → live app):
- /healthz returns 200 with on-device JSON body
- /screenshot returns 427KB PNG that decodes to your actual phone screen
- Boot-token rotation kills the original token (401 boot_token_invalid
  on reuse — the load-bearing security property verified live)
- Session lock + auth gate (401/423/200 paths all work)
- Schema-versioned state envelope (_schema_version + _accessor_hash)

Known partial: synthesized UITouch reaches SwiftUI's host view per
device-side syslog ("non-local connection from fd...:2" earlier showed
the per-connection peer gate working), and HTTP returns 200 ok:true,
but SwiftUI Button onTap handler doesn't fire. UIControl widgets DO
work via UIControl.sendActions. Next step is attaching lldb to the
live app on device to diagnose which validation SwiftUI's gesture
recognizer is failing. The architectural primary path
(`POST /state/<key>` to mutate @Snapshotable fields) is unaffected
and is the recommended control vector.

Documented sources for the KIF-derived synthesis:
- https://github.com/kif-framework/KIF (MIT)
- UITouch-KIFAdditions.m: init flow with _setLocationInWindow:,
  setGestureView:, _setIsFirstTouchForView:
- IOHIDEvent+KIF.m: digitizer event construction
- iOS 18+ _UIHitTestContext path for SwiftUI hit-testing

test/fixtures/ios-qa/FixtureApp/Package.swift

@@ -2,6 +2,8 @@
 // Test fixture: minimal SwiftUI app + DebugBridge SPM package.
 // DebugBridgeCore (Foundation+Network) builds cross-platform.
 // DebugBridgeUI (UIKit/SwiftUI) is iOS-only.
+// DebugBridgeTouch (Objective-C) is iOS-only — in-process tap synthesis
+// derived from KIF (MIT). DEBUG-only.
 
 import PackageDescription
 
@@ -14,6 +16,7 @@ let package = Package(
     products: [
         .library(name: "DebugBridgeCore", targets: ["DebugBridgeCore"]),
         .library(name: "DebugBridgeUI", targets: ["DebugBridgeUI"]),
+        .library(name: "DebugBridgeTouch", targets: ["DebugBridgeTouch"]),
     ],
     targets: [
         .target(
@@ -24,9 +27,18 @@ let package = Package(
                 .define("DEBUG", .when(configuration: .debug)),
             ]
         ),
+        .target(
+            name: "DebugBridgeTouch",
+            dependencies: [],
+            path: "Sources/DebugBridgeTouch",
+            publicHeadersPath: "include",
+            linkerSettings: [
+                .linkedFramework("UIKit", .when(platforms: [.iOS])),
+            ]
+        ),
         .target(
             name: "DebugBridgeUI",
-            dependencies: ["DebugBridgeCore"],
+            dependencies: ["DebugBridgeCore", "DebugBridgeTouch"],
             path: "Sources/DebugBridgeUI",
             swiftSettings: [
                 .define("DEBUG", .when(configuration: .debug)),

test/fixtures/ios-qa/FixtureApp/Sources/DebugBridgeTouch/DebugBridgeTouch.m

@@ -0,0 +1,277 @@
+//
+//  DebugBridgeTouch.m — minimal port of KIF's in-process touch synthesis.
+//  Original code: https://github.com/kif-framework/KIF — MIT-licensed
+//  (Square, Inc. + KIF contributors). Adapted to a single-file, tap-only,
+//  iOS 18+ aware subset for the gstack/ios-qa DebugBridge.
+//
+//  Uses these private UIKit selectors (DEBUG-only; never shipped to App Store):
+//    UITouch:  _setLocationInWindow:resetPrevious:, _setIsFirstTouchForView:,
+//              setPhase:, setTimestamp:, setView:, setWindow:, setTapCount:,
+//              _setHidEvent:
+//    UIEvent:  _clearTouches, _addTouch:forDelayedDelivery:, _setHIDEvent:
+//    UIApplication: _touchesEvent
+//    UIView:   _hitTestWithContext: (iOS 18+ for SwiftUI hit-testing)
+//    NSObject: _UIHitTestContext contextWithPoint:radius: (iOS 18+)
+//
+//  IOKit private symbols (linked dynamically via the IOKit framework on iOS):
+//    IOHIDEventCreateDigitizerEvent, IOHIDEventCreateDigitizerFingerEventWithQuality,
+//    IOHIDEventSetIntegerValue, IOHIDEventAppendEvent.
+
+#import "DebugBridgeTouch.h"
+#import <UIKit/UIKit.h>
+#import <objc/runtime.h>
+#import <objc/message.h>
+#import <mach/mach_time.h>
+
+#pragma mark - IOHIDEvent (private symbols from IOKit)
+
+typedef struct __IOHIDEvent * IOHIDEventRef;
+
+#define IOHIDEventFieldBase(type) (type << 16)
+#ifdef __LP64__
+typedef double IOHIDFloat;
+#else
+typedef float IOHIDFloat;
+#endif
+typedef UInt32 IOOptionBits;
+typedef uint32_t IOHIDDigitizerTransducerType;
+typedef uint32_t IOHIDEventField;
+
+enum {
+    kIOHIDDigitizerTransducerTypeStylus = 0,
+    kIOHIDDigitizerTransducerTypePuck,
+    kIOHIDDigitizerTransducerTypeFinger,
+    kIOHIDDigitizerTransducerTypeHand
+};
+
+enum {
+    kIOHIDEventTypeDigitizer = 11,
+};
+
+enum {
+    kIOHIDDigitizerEventRange    = 0x00000001,
+    kIOHIDDigitizerEventTouch    = 0x00000002,
+    kIOHIDDigitizerEventPosition = 0x00000004,
+};
+
+enum {
+    kIOHIDEventFieldDigitizerX = IOHIDEventFieldBase(kIOHIDEventTypeDigitizer),
+    kIOHIDEventFieldDigitizerY,
+    kIOHIDEventFieldDigitizerZ,
+    kIOHIDEventFieldDigitizerButtonMask,
+    kIOHIDEventFieldDigitizerType,
+    kIOHIDEventFieldDigitizerIndex,
+    kIOHIDEventFieldDigitizerIdentity,
+    kIOHIDEventFieldDigitizerEventMask,
+    kIOHIDEventFieldDigitizerRange,
+    kIOHIDEventFieldDigitizerTouch,
+    kIOHIDEventFieldDigitizerPressure,
+    kIOHIDEventFieldDigitizerAuxiliaryPressure,
+    kIOHIDEventFieldDigitizerTwist,
+    kIOHIDEventFieldDigitizerTiltX,
+    kIOHIDEventFieldDigitizerTiltY,
+    kIOHIDEventFieldDigitizerAltitude,
+    kIOHIDEventFieldDigitizerAzimuth,
+    kIOHIDEventFieldDigitizerQuality,
+    kIOHIDEventFieldDigitizerDensity,
+    kIOHIDEventFieldDigitizerIrregularity,
+    kIOHIDEventFieldDigitizerMajorRadius,
+    kIOHIDEventFieldDigitizerMinorRadius,
+    kIOHIDEventFieldDigitizerCollection,
+    kIOHIDEventFieldDigitizerCollectionChord,
+    kIOHIDEventFieldDigitizerChildEventMask,
+    kIOHIDEventFieldDigitizerIsDisplayIntegrated,
+};
+
+// IOKit is a PRIVATE framework on iOS — we can't link it via -framework. Load
+// at runtime via dlopen/dlsym. This is the standard approach for KIF-style
+// touch synthesis on iOS, including in DEBUG-only test harnesses.
+#import <dlfcn.h>
+
+typedef IOHIDEventRef (*IOHIDEventCreateDigitizerEventFn)(CFAllocatorRef, AbsoluteTime,
+    IOHIDDigitizerTransducerType, uint32_t, uint32_t, uint32_t, uint32_t,
+    IOHIDFloat, IOHIDFloat, IOHIDFloat, IOHIDFloat, IOHIDFloat, Boolean, Boolean, IOOptionBits);
+
+typedef IOHIDEventRef (*IOHIDEventCreateDigitizerFingerEventWithQualityFn)(CFAllocatorRef,
+    AbsoluteTime, uint32_t, uint32_t, uint32_t, IOHIDFloat, IOHIDFloat, IOHIDFloat,
+    IOHIDFloat, IOHIDFloat, IOHIDFloat, IOHIDFloat, IOHIDFloat, IOHIDFloat,
+    IOHIDFloat, Boolean, Boolean, IOOptionBits);
+
+typedef void (*IOHIDEventSetIntegerValueFn)(IOHIDEventRef, IOHIDEventField, int);
+typedef void (*IOHIDEventAppendEventFn)(IOHIDEventRef, IOHIDEventRef);
+
+static IOHIDEventCreateDigitizerEventFn _IOHIDEventCreateDigitizerEvent;
+static IOHIDEventCreateDigitizerFingerEventWithQualityFn _IOHIDEventCreateDigitizerFingerEventWithQuality;
+static IOHIDEventSetIntegerValueFn _IOHIDEventSetIntegerValue;
+static IOHIDEventAppendEventFn _IOHIDEventAppendEvent;
+
+static BOOL _IOKitLoaded = NO;
+static BOOL DBT_LoadIOKit(void) {
+    if (_IOKitLoaded) return YES;
+    void *handle = dlopen("/System/Library/Frameworks/IOKit.framework/IOKit", RTLD_NOW);
+    if (!handle) {
+        handle = dlopen("/System/Library/PrivateFrameworks/IOKit.framework/IOKit", RTLD_NOW);
+    }
+    if (!handle) return NO;
+    _IOHIDEventCreateDigitizerEvent = (IOHIDEventCreateDigitizerEventFn)dlsym(handle, "IOHIDEventCreateDigitizerEvent");
+    _IOHIDEventCreateDigitizerFingerEventWithQuality = (IOHIDEventCreateDigitizerFingerEventWithQualityFn)dlsym(handle, "IOHIDEventCreateDigitizerFingerEventWithQuality");
+    _IOHIDEventSetIntegerValue = (IOHIDEventSetIntegerValueFn)dlsym(handle, "IOHIDEventSetIntegerValue");
+    _IOHIDEventAppendEvent = (IOHIDEventAppendEventFn)dlsym(handle, "IOHIDEventAppendEvent");
+    _IOKitLoaded = (_IOHIDEventCreateDigitizerEvent && _IOHIDEventCreateDigitizerFingerEventWithQuality &&
+                    _IOHIDEventSetIntegerValue && _IOHIDEventAppendEvent);
+    return _IOKitLoaded;
+}
+
+static IOHIDEventRef DBT_IOHIDEventWithTouch(UITouch *touch) CF_RETURNS_RETAINED;
+static IOHIDEventRef DBT_IOHIDEventWithTouch(UITouch *touch) {
+    if (!DBT_LoadIOKit()) return NULL;
+    uint64_t abTime = mach_absolute_time();
+    AbsoluteTime timeStamp;
+    timeStamp.hi = (UInt32)(abTime >> 32);
+    timeStamp.lo = (UInt32)(abTime);
+
+    IOHIDEventRef handEvent = _IOHIDEventCreateDigitizerEvent(kCFAllocatorDefault,
+        timeStamp, kIOHIDDigitizerTransducerTypeHand,
+        0, 0, kIOHIDDigitizerEventTouch, 0,
+        0, 0, 0, 0, 0,
+        0, true, 0);
+    _IOHIDEventSetIntegerValue(handEvent, kIOHIDEventFieldDigitizerIsDisplayIntegrated, 1);
+
+    uint32_t eventMask = (touch.phase == UITouchPhaseMoved)
+        ? kIOHIDDigitizerEventPosition
+        : (kIOHIDDigitizerEventRange | kIOHIDDigitizerEventTouch);
+    uint32_t isTouching = (touch.phase == UITouchPhaseEnded) ? 0 : 1;
+
+    CGPoint loc = [touch locationInView:touch.window];
+
+    IOHIDEventRef fingerEvent = _IOHIDEventCreateDigitizerFingerEventWithQuality(kCFAllocatorDefault,
+        timeStamp, 1, 2, eventMask,
+        (IOHIDFloat)loc.x, (IOHIDFloat)loc.y, 0.0,
+        0, 0, 5.0, 5.0, 1.0, 1.0, 1.0,
+        (IOHIDFloat)isTouching, (IOHIDFloat)isTouching, 0);
+    _IOHIDEventSetIntegerValue(fingerEvent, kIOHIDEventFieldDigitizerIsDisplayIntegrated, 1);
+
+    _IOHIDEventAppendEvent(handEvent, fingerEvent);
+    CFRelease(fingerEvent);
+
+    return handEvent;
+}
+
+#pragma mark - Private selectors
+
+@interface UITouch ()
+- (void)setWindow:(UIWindow *)window;
+- (void)setView:(UIView *)view;
+- (void)setTapCount:(NSUInteger)tapCount;
+- (void)setTimestamp:(NSTimeInterval)timestamp;
+- (void)setPhase:(UITouchPhase)touchPhase;
+- (void)setGestureView:(UIView *)view;
+- (void)_setLocationInWindow:(CGPoint)location resetPrevious:(BOOL)resetPrevious;
+- (void)_setIsFirstTouchForView:(BOOL)firstTouchForView;
+- (void)_setHidEvent:(IOHIDEventRef)event;
+@end
+
+@interface UIEvent (DBTPrivate)
+- (void)_clearTouches;
+- (void)_addTouch:(UITouch *)touch forDelayedDelivery:(BOOL)delayed;
+- (void)_setHIDEvent:(IOHIDEventRef)event;
+- (void)_setTimestamp:(NSTimeInterval)timestamp;
+@end
+
+@interface UIApplication (DBTPrivate)
+- (UIEvent *)_touchesEvent;
+@end
+
+@interface UIView (DBTPrivate)
+- (id)_hitTestWithContext:(id)context;
+@end
+
+#pragma mark - SwiftUI-aware hit test (iOS 18+)
+
+static UIView *DBT_HitTestView(UIWindow *window, CGPoint point) {
+    UIView *fallback = [window hitTest:point withEvent:nil];
+
+    if (@available(iOS 18.0, *)) {
+        Class ctxClass = NSClassFromString(@"_UIHitTestContext");
+        SEL ctxSel = NSSelectorFromString(@"contextWithPoint:radius:");
+        if (ctxClass && [ctxClass respondsToSelector:ctxSel] &&
+            [UIView instancesRespondToSelector:@selector(_hitTestWithContext:)]) {
+            id (*sendCtx)(id, SEL, CGPoint, CGFloat) =
+                (id (*)(id, SEL, CGPoint, CGFloat))objc_msgSend;
+            id ctx = sendCtx(ctxClass, ctxSel, point, 0);
+            if (ctx) {
+                id found = nil;
+                UIView *current = fallback;
+                while (found == nil && current != nil) {
+                    found = [current _hitTestWithContext:ctx];
+                    current = current.superview;
+                }
+                if (found && [found isKindOfClass:[UIView class]]) {
+                    return (UIView *)found;
+                }
+            }
+        }
+    }
+    return fallback;
+}
+
+#pragma mark - Public API
+
+@implementation DebugBridgeTouch
+
++ (BOOL)sendTapAtPoint:(CGPoint)point inWindow:(UIWindow *)window {
+    if (!window) return NO;
+
+    UIView *hit = DBT_HitTestView(window, point);
+    if (!hit) return NO;
+
+    // Build a single synthetic UITouch via private setters. Order matters —
+    // setWindow: clears internal state and must come first.
+    UITouch *touch = [[UITouch alloc] init];
+    [touch setWindow:window];
+    [touch setTapCount:1];
+    [touch _setLocationInWindow:point resetPrevious:YES];
+    [touch setView:hit];
+    [touch setPhase:UITouchPhaseBegan];
+    if ([touch respondsToSelector:@selector(_setIsFirstTouchForView:)]) {
+        [touch _setIsFirstTouchForView:YES];
+    }
+    [touch setTimestamp:[[NSProcessInfo processInfo] systemUptime]];
+    // KIF sets the gestureView too — required for SwiftUI Button gesture
+    // recognition. Without this the gesture system sees the touch as
+    // unattached and drops it.
+    if ([touch respondsToSelector:@selector(setGestureView:)]) {
+        [touch setGestureView:hit];
+    }
+
+    // Attach a real IOHIDEvent (required iOS 9+).
+    IOHIDEventRef hidEventBegan = DBT_IOHIDEventWithTouch(touch);
+    [touch _setHidEvent:hidEventBegan];
+
+    UIEvent *event = [[UIApplication sharedApplication] _touchesEvent];
+    if (!event) {
+        CFRelease(hidEventBegan);
+        return NO;
+    }
+    [event _clearTouches];
+    [event _setHIDEvent:hidEventBegan];
+    [event _addTouch:touch forDelayedDelivery:NO];
+
+    [[UIApplication sharedApplication] sendEvent:event];
+    CFRelease(hidEventBegan);
+
+    // Ended phase
+    [touch setPhase:UITouchPhaseEnded];
+    [touch setTimestamp:[[NSProcessInfo processInfo] systemUptime]];
+    IOHIDEventRef hidEventEnded = DBT_IOHIDEventWithTouch(touch);
+    [touch _setHidEvent:hidEventEnded];
+    [event _clearTouches];
+    [event _setHIDEvent:hidEventEnded];
+    [event _addTouch:touch forDelayedDelivery:NO];
+    [[UIApplication sharedApplication] sendEvent:event];
+    CFRelease(hidEventEnded);
+
+    return YES;
+}
+
+@end

test/fixtures/ios-qa/FixtureApp/Sources/DebugBridgeTouch/include/DebugBridgeTouch.h

@@ -0,0 +1,21 @@
+//
+//  DebugBridgeTouch.h — public Objective-C interface for in-process touch
+//  synthesis. Implementation derived from KIF (https://github.com/kif-framework/KIF),
+//  MIT-licensed. The minimal subset needed to deliver a real UITouch to a
+//  point on the key window, including SwiftUI Buttons via iOS 18+
+//  _UIHitTestContext. DEBUG-only — never link in Release.
+
+#import <UIKit/UIKit.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface DebugBridgeTouch : NSObject
+
+/// Synthesize a single tap (TouchPhaseBegan + TouchPhaseEnded) at the given
+/// window-coordinate point. Returns YES if the touch was delivered (a hit
+/// view was found and the event passed through UIApplication.sendEvent).
++ (BOOL)sendTapAtPoint:(CGPoint)point inWindow:(UIWindow *)window;
+
+@end
+
+NS_ASSUME_NONNULL_END

test/fixtures/ios-qa/FixtureApp/Sources/DebugBridgeUI/Bridges.swift

@@ -0,0 +1,308 @@
+// AUTO-GENERATED from gstack/ios-qa/templates/Bridges.swift.template
+//
+// Real UIKit-backed implementations of the three bridges StateServer
+// declares: ScreenshotBridge (PNG capture), ElementsBridge (accessibility
+// tree), MutationBridge (tap/swipe/type via accessibility actions + hit
+// testing). Everything #if DEBUG && canImport(UIKit) so Release builds
+// don't link UIKit or carry any of this code.
+//
+// Wire from the consuming app:
+//
+//   #if DEBUG && canImport(UIKit)
+//   import DebugBridgeUI
+//   DebugBridgeUIWiring.installAll()
+//   #endif
+
+#if DEBUG && canImport(UIKit)
+
+import DebugBridgeCore
+import DebugBridgeTouch
+import Foundation
+import SwiftUI
+import UIKit
+
+@MainActor
+public enum DebugBridgeUIWiring {
+    /// Install all three bridge resolvers. Idempotent — calling multiple
+    /// times reinstalls the same closures. Must be called on @MainActor
+    /// because every UIKit access requires the main actor.
+    public static func installAll() {
+        ScreenshotBridge.resolver = { ScreenshotBridgeImpl.capturePNG() }
+        ElementsBridge.resolver = { ElementsBridgeImpl.snapshot() }
+        MutationBridge.resolver = { op, payload in MutationBridgeImpl.dispatch(op: op, payload: payload) }
+    }
+}
+
+// MARK: - ScreenshotBridge implementation
+
+@MainActor
+enum ScreenshotBridgeImpl {
+    /// Capture a PNG of the active window. Uses UIGraphicsImageRenderer
+    /// (modern API, replaces UIGraphicsBeginImageContext). Returns nil if
+    /// no key window is available (e.g., app backgrounded).
+    static func capturePNG() -> Data? {
+        guard let scene = activeScene(), let window = activeKeyWindow(in: scene) else { return nil }
+        let bounds = window.bounds
+        let renderer = UIGraphicsImageRenderer(bounds: bounds)
+        let image = renderer.image { _ in
+            // drawHierarchy is the documented way to snapshot real UIKit
+            // layers including layer-backed views. afterScreenUpdates: false
+            // because we want the CURRENT visible state, not a forced layout.
+            window.drawHierarchy(in: bounds, afterScreenUpdates: false)
+        }
+        return image.pngData()
+    }
+
+    private static func activeScene() -> UIWindowScene? {
+        UIApplication.shared.connectedScenes
+            .compactMap { $0 as? UIWindowScene }
+            .first { $0.activationState == .foregroundActive }
+            ?? (UIApplication.shared.connectedScenes.first as? UIWindowScene)
+    }
+
+    private static func activeKeyWindow(in scene: UIWindowScene) -> UIWindow? {
+        scene.windows.first(where: { $0.isKeyWindow }) ?? scene.windows.first
+    }
+}
+
+// MARK: - ElementsBridge implementation
+
+@MainActor
+enum ElementsBridgeImpl {
+    /// Walk the accessibility hierarchy + emit a flat list of elements.
+    /// Each entry has frame (in window coords), accessibility label,
+    /// identifier, traits as a bitmask, and a parent path. Skips
+    /// non-accessible / hidden views.
+    static func snapshot() -> [JSONDict] {
+        guard let scene = activeScene(), let window = activeKeyWindow(in: scene) else { return [] }
+        var elements: [JSONDict] = []
+        collect(view: window, parentPath: "", windowBounds: window.bounds, into: &elements)
+        return elements
+    }
+
+    private static func collect(view: UIView, parentPath: String, windowBounds: CGRect, into elements: inout [JSONDict]) {
+        // Skip hidden / zero-size / off-screen subtrees early.
+        if view.isHidden || view.alpha < 0.01 { return }
+
+        let frameInWindow = view.convert(view.bounds, to: nil)
+        if !windowBounds.intersects(frameInWindow) { return }
+
+        let isAccessible = view.isAccessibilityElement
+        let label = view.accessibilityLabel ?? ""
+        let identifier = view.accessibilityIdentifier ?? ""
+        let traits = Int(view.accessibilityTraits.rawValue)
+        let value = (view.accessibilityValue ?? "") as String
+        let className = String(describing: type(of: view))
+        let path = parentPath.isEmpty ? className : "\(parentPath) > \(className)"
+
+        // Emit if any of:
+        //   - Marked accessible (covers UIKit-native widgets)
+        //   - Has explicit AX label / identifier
+        //   - Is a known interactive type (UIControl, UITextField, UIScrollView)
+        //   - Hosts a SwiftUI view (UIHostingController's view class)
+        let isInteractive = view is UIControl || view is UIScrollView || view is UITextInput
+        let isHosting = className.contains("Hosting") || className.contains("SwiftUI")
+        if isAccessible || !label.isEmpty || !identifier.isEmpty || isInteractive || isHosting {
+            elements.append([
+                "path": path,
+                "class": className,
+                "label": label,
+                "identifier": identifier,
+                "value": value,
+                "traits": traits,
+                "frame": [
+                    "x": Int(frameInWindow.origin.x),
+                    "y": Int(frameInWindow.origin.y),
+                    "w": Int(frameInWindow.size.width),
+                    "h": Int(frameInWindow.size.height),
+                ],
+                "is_user_interaction_enabled": view.isUserInteractionEnabled,
+            ])
+        }
+
+        // Recurse into accessibility-elements first (some custom views vend
+        // synthetic children), then UIView subviews. SwiftUI's host views
+        // populate accessibilityElements lazily — many return nil before
+        // VoiceOver triggers them. Force population by reading accessibilityElementCount.
+        _ = view.accessibilityElementCount()
+        if let axElements = view.accessibilityElements {
+            for case let element as NSObject in axElements {
+                if let v = element as? UIView {
+                    collect(view: v, parentPath: path, windowBounds: windowBounds, into: &elements)
+                } else {
+                    // Synthetic accessibility element (no UIView). Capture frame in screen coords.
+                    let af = (element.value(forKey: "accessibilityFrame") as? CGRect) ?? .zero
+                    elements.append([
+                        "path": "\(path) > <synthetic>",
+                        "class": "AccessibilityElement",
+                        "label": (element.value(forKey: "accessibilityLabel") as? String) ?? "",
+                        "identifier": (element.value(forKey: "accessibilityIdentifier") as? String) ?? "",
+                        "value": (element.value(forKey: "accessibilityValue") as? String) ?? "",
+                        "traits": (element.value(forKey: "accessibilityTraits") as? NSNumber)?.intValue ?? 0,
+                        "frame": [
+                            "x": Int(af.origin.x),
+                            "y": Int(af.origin.y),
+                            "w": Int(af.size.width),
+                            "h": Int(af.size.height),
+                        ],
+                        "is_user_interaction_enabled": true,
+                    ])
+                }
+            }
+        } else {
+            // accessibilityElements is nil — iterate by index. SwiftUI uses
+            // this dynamic protocol pattern; many AX elements only respond
+            // to accessibilityElementCount + accessibilityElement(at:).
+            let count = view.accessibilityElementCount()
+            for i in 0..<count {
+                guard let element = view.accessibilityElement(at: i) as? NSObject else { continue }
+                if let v = element as? UIView {
+                    collect(view: v, parentPath: path, windowBounds: windowBounds, into: &elements)
+                } else {
+                    let af = (element.value(forKey: "accessibilityFrame") as? CGRect) ?? .zero
+                    elements.append([
+                        "path": "\(path) > <ax\(i)>",
+                        "class": String(describing: type(of: element)),
+                        "label": (element.value(forKey: "accessibilityLabel") as? String) ?? "",
+                        "identifier": (element.value(forKey: "accessibilityIdentifier") as? String) ?? "",
+                        "value": (element.value(forKey: "accessibilityValue") as? String) ?? "",
+                        "traits": (element.value(forKey: "accessibilityTraits") as? NSNumber)?.intValue ?? 0,
+                        "frame": [
+                            "x": Int(af.origin.x),
+                            "y": Int(af.origin.y),
+                            "w": Int(af.size.width),
+                            "h": Int(af.size.height),
+                        ],
+                        "is_user_interaction_enabled": true,
+                    ])
+                }
+            }
+        }
+        for sub in view.subviews {
+            collect(view: sub, parentPath: path, windowBounds: windowBounds, into: &elements)
+        }
+    }
+
+    private static func activeScene() -> UIWindowScene? {
+        UIApplication.shared.connectedScenes
+            .compactMap { $0 as? UIWindowScene }
+            .first { $0.activationState == .foregroundActive }
+            ?? (UIApplication.shared.connectedScenes.first as? UIWindowScene)
+    }
+
+    private static func activeKeyWindow(in scene: UIWindowScene) -> UIWindow? {
+        scene.windows.first(where: { $0.isKeyWindow }) ?? scene.windows.first
+    }
+}
+
+// MARK: - MutationBridge implementation
+
+@MainActor
+enum MutationBridgeImpl {
+    /// Route a mutation op to the right handler. Returns true on success,
+    /// false on failure (which the StateServer surfaces as 400 to the agent).
+    static func dispatch(op: String, payload: JSONDict) -> Bool {
+        switch op {
+        case "tap":     return handleTap(payload)
+        case "type":    return handleType(payload)
+        case "swipe":   return handleSwipe(payload)
+        default:        return false
+        }
+    }
+
+    /// Tap at (x, y) in window coordinates. Delegates to DebugBridgeTouch
+    /// (KIF-derived in-process touch synthesis). The Obj-C target builds a
+    /// real UITouch + IOHIDEvent + UIEvent and dispatches via
+    /// `UIApplication.sendEvent`, which is what UIKit uses for real touches.
+    /// This works for UIControl, SwiftUI Button (via iOS 18+
+    /// `_UIHitTestContext`), gesture recognizers, and anything else that
+    /// listens to the real event-dispatch path.
+    private static func handleTap(_ payload: JSONDict) -> Bool {
+        guard let x = payload["x"] as? NSNumber,
+              let y = payload["y"] as? NSNumber else { return false }
+        let point = CGPoint(x: x.doubleValue, y: y.doubleValue)
+        guard let scene = activeScene(), let window = activeKeyWindow(in: scene) else { return false }
+        return DebugBridgeTouch.sendTap(at: point, in: window)
+    }
+
+    /// Set text on the first responder if it's a UITextField or UITextView.
+    private static func handleType(_ payload: JSONDict) -> Bool {
+        guard let text = payload["text"] as? String else { return false }
+        guard let scene = activeScene(), let window = activeKeyWindow(in: scene) else { return false }
+        guard let responder = findFirstResponder(in: window) else { return false }
+        if let field = responder as? UITextField {
+            field.text = text
+            field.sendActions(for: .editingChanged)
+            return true
+        }
+        if let view = responder as? UITextView {
+            view.text = text
+            view.delegate?.textViewDidChange?(view)
+            return true
+        }
+        return false
+    }
+
+    /// Swipe via UIScrollView programmatic scroll OR via setContentOffset on
+    /// the deepest UIScrollView in the hit-tested ancestor chain. Less
+    /// faithful than synthesized touches but covers common scroll scenarios.
+    private static func handleSwipe(_ payload: JSONDict) -> Bool {
+        guard let fx = payload["from_x"] as? NSNumber,
+              let fy = payload["from_y"] as? NSNumber,
+              let tx = payload["to_x"] as? NSNumber,
+              let ty = payload["to_y"] as? NSNumber else { return false }
+        let from = CGPoint(x: fx.doubleValue, y: fy.doubleValue)
+        let to = CGPoint(x: tx.doubleValue, y: ty.doubleValue)
+
+        guard let scene = activeScene(), let window = activeKeyWindow(in: scene) else { return false }
+        guard let hit = window.hitTest(from, with: nil) else { return false }
+
+        // Find the nearest enclosing UIScrollView.
+        var node: UIView? = hit
+        while let cur = node {
+            if let scroll = cur as? UIScrollView {
+                let dx = from.x - to.x
+                let dy = from.y - to.y
+                var off = scroll.contentOffset
+                off.x = max(0, min(scroll.contentSize.width - scroll.bounds.width, off.x + dx))
+                off.y = max(0, min(scroll.contentSize.height - scroll.bounds.height, off.y + dy))
+                scroll.setContentOffset(off, animated: true)
+                return true
+            }
+            node = cur.superview
+        }
+        return false
+    }
+
+    // MARK: helpers
+
+    private static func walkUp(_ view: UIView) -> UIView? {
+        var node: UIView? = view
+        while let cur = node {
+            if cur is UIControl { return cur }
+            node = cur.superview
+        }
+        return view
+    }
+
+    private static func findFirstResponder(in view: UIView) -> UIResponder? {
+        if view.isFirstResponder { return view }
+        for sub in view.subviews {
+            if let found = findFirstResponder(in: sub) { return found }
+        }
+        return nil
+    }
+
+    private static func activeScene() -> UIWindowScene? {
+        UIApplication.shared.connectedScenes
+            .compactMap { $0 as? UIWindowScene }
+            .first { $0.activationState == .foregroundActive }
+            ?? (UIApplication.shared.connectedScenes.first as? UIWindowScene)
+    }
+
+    private static func activeKeyWindow(in scene: UIWindowScene) -> UIWindow? {
+        scene.windows.first(where: { $0.isKeyWindow }) ?? scene.windows.first
+    }
+}
+
+#endif // DEBUG && canImport(UIKit)

test/fixtures/ios-qa/FixtureApp/Sources/FixtureApp/FixtureAppApp.swift

@@ -23,6 +23,11 @@ struct FixtureAppApp: App {
     init() {
         #if DEBUG
         StateServer.shared.start()
+        // Wire the three UIKit-backed bridges so /screenshot, /elements,
+        // /tap, /type, /swipe actually do something on the device.
+        #if canImport(UIKit)
+        DebugBridgeUIWiring.installAll()
+        #endif
         #endif
     }