release: cut v2.0.5 "Harbor" ("Landfall" — first iOS finalization; iOS re-port onto Timebase) (#244)

Opens the iOS finalization window (v2.0.5→v2.0.8) by re-porting the frozen v1.9.9 SwiftUI/Metal app onto the v2.0.0 Timebase core. Host/iOS-only; core byte-identical to v2.0.4 (AccuracyCoin 141/141). Surfaces + localizes (EN+ES) the pre-Timebase movie warning via a single multiplexed alert; UniFFI-Swift surface re-confirmed; workspace 2.0.4→2.0.5, iOS MARKETING_VERSION 1.9.1→2.0.5. Copilot review adopted + resolved.

Author: doublegate

.github/release-notes/v2.0.5.md

@@ -0,0 +1,74 @@
+# RustyNES v2.0.5 — "Harbor" ("Landfall")
+
+**The iOS re-port onto Timebase.** The fifth release of the v2.0.x "Harbor" mobile-finalization train opens the **iOS finalization window (v2.0.5 → v2.0.8)** — the iOS/iPadOS analogue of the Android v2.0.1 → v2.0.4 window. It brings the frozen v1.9.9 SwiftUI / Metal app onto the **v2.0.0 "Timebase"** core. The cycle-accurate emulation core is **unchanged and byte-identical to v2.0.4** — **AccuracyCoin 141/141 (100.00%)**, nestest 0-diff, the deterministic `#![no_std]` chip stack untouched — so **no accuracy, save-state, or determinism number moves in this release**. This is a host / iOS-only cut.
+
+No store submission happens here (that is the future v2.1.0 joint Google Play + Apple App Store + AltStore PAL + F-Droid launch); v2.0.5 establishes the green iOS build path on the v2.0.0 core and re-ports the first host-side behaviour the timebase break requires.
+
+---
+
+## The core is unchanged (141/141)
+
+Nothing in the emulation core changed. The 2-cycle-ALE PPU fetch model promoted to default in v2.0.3 (ADR 0030) is the substrate here too; AccuracyCoin holds **141/141 (100.00%, RAM-authoritative)**, nestest is 0-diff, and the 60-ROM commercial byte-identity oracle is unmoved. If you only care about emulation accuracy, v2.0.5 is v2.0.4 with a bumped version number.
+
+## Host-side iOS re-port (what actually landed)
+
+- **The pre-Timebase movie warning, surfaced + localized on iOS.** The v2.0.0
+  "Timebase" rewrite bumped the `.rns`/`.rnm` save-state + movie epoch (ADR 0028):
+  a pre-v2.0.0 `.rnm` still **replays its input stream** on the new core, but exact
+  framebuffer / audio reproduction is no longer guaranteed across the timebase
+  change. The v2.0.3 bridge began queuing a machine-readable `HostWarning` code for
+  this so hosts can localize it; **v2.0.5 surfaces it on iOS** — a new, non-blocking
+  notice on its own channel (multiplexed through a single alert that prefers an error
+  when both are queued, so neither is dropped) presented after a movie load, drained
+  via `EmulatorCore.drainWarnings()` → `NesController.drainWarningCodes()`, localized
+  **EN + ES** with wording byte-identical to the Android v2.0.4 string (shared ES
+  copy). Loading a pre-Timebase movie now tells the user exactly what to expect
+  instead of silently diverging.
+- **UniFFI-Swift binding surface re-confirmed against the v2.0.0 bridge.** The
+  generated Swift surface (`drainWarningCodes() -> [HostWarning]`,
+  `HostWarning.preTimebaseMovie`, `moviePlay(bytes:)`) was regenerated from the
+  v2.0.0 `rustynes-mobile` and confirmed to match the host code — the iOS analogue
+  of the wasm-bindgen-pin discipline that keeps the Rust library and the generated
+  bindings in lockstep.
+- **Version realignment.** Workspace `2.0.4 → 2.0.5` (version-only `Cargo.lock`
+  cascade). The iOS `MARKETING_VERSION` is realigned from the frozen v1.9.x
+  checked-in default (`1.9.1`) to `2.0.5`, back in step with the workspace version;
+  the build number stays CI-injected by the fastlane `beta` lane.
+
+## Verification (host)
+
+- **Core unchanged / byte-identical to v2.0.4** — AccuracyCoin **141/141**, nestest
+  0-diff (not re-run for this host-only cut; the chip stack is untouched).
+- `cargo check --workspace` green after the version bump + `Cargo.lock` regen
+  (version-only lock diff, 18 crates); `cargo fmt --all --check` clean.
+- **UniFFI-Swift emit host-verified:** the Swift bindings generated from a host
+  build of `rustynes-mobile` contain `drainWarningCodes`, `HostWarning`
+  (`case preTimebaseMovie`), and `moviePlay(bytes:)` — the exact surface the new
+  Swift code references.
+- `Localizable.xcstrings` remains valid JSON (EN source + the added ES entry).
+- markdownlint (CI-pinned) clean on the new / edited docs.
+
+## Maintainer / on-device closeout (deferred to v2.0.9 / the TestFlight upload)
+
+These are inherently macOS / on-device / maintainer steps and are **not** done by
+this release (there is no Xcode / device in the build environment):
+
+- Regenerate the `RustyNESFFI.xcframework` on macOS (`scripts/build-ios-xcframework.sh`)
+  and archive the app with **Xcode 26 / the iOS 26 SDK** (the App Store submission
+  floor lands as a hard gate at v2.0.7).
+- On-device **save-state migration** from a v1.9.x install and the **AccuracyCoin /
+  SMB / Zelda determinism smoke** on Apple silicon.
+- A physical-device **TestFlight boot smoke** (iPhone 14+ / iPad); confirm the
+  pre-Timebase-movie notice renders correctly under both locales.
+
+## What's next — the rest of "Harbor"
+
+- **v2.0.6** — iOS feature-parity finalization against the v2.0.0 behaviour.
+- **v2.0.7** — iOS polish + performance + the **iOS 26 SDK / Xcode 26** App Store
+  submission-floor readiness + the privacy-manifest / required-reason-API audit.
+- **v2.0.8** — the iOS release candidate (App Store Connect listing staged,
+  TestFlight external beta, App-Review self-audit).
+- **v2.0.9** — joint on-device readiness verification for both apps.
+- **v2.1.0** — the **joint Google Play + Apple App Store + AltStore PAL + F-Droid launch**.
+
+Full detail: `CHANGELOG.md` `[2.0.5]` · `docs/STATUS.md` (single source of truth) · `docs/ios-v2.0.5-readiness.md` · `to-dos/plans/v2.0.5-v2.0.8-ios-finalization-plan.md`.

CHANGELOG.md

@@ -14,6 +14,25 @@ cycle-accurate core later replaced.
 
 ## [Unreleased]
 
+## [2.0.5] - 2026-07-09 - "Harbor" (iOS re-port onto Timebase — "Landfall")
+
+- Opens the iOS finalization window (v2.0.5–v2.0.8) of the v2.0.x "Harbor" train:
+  the iOS/iPadOS app is re-ported onto the v2.0.0 "Timebase" core — the iOS
+  analogue of the Android v2.0.1 re-port. Host/iOS-only; the emulation core is
+  unchanged and byte-identical to v2.0.4 (AccuracyCoin 141/141, nestest 0-diff).
+- The iOS host now localizes bridge warnings (device-locale strings, EN + ES) for
+  the pre-Timebase movie notice: loading a pre-v2.0.0 `.rnm` still replays its
+  input, but surfaces a non-blocking notice that byte-exact framebuffer/audio
+  reproduction is not guaranteed across the ADR-0028 timebase change — the iOS
+  analogue of the Android v2.0.4 warning, verbatim wording and shared ES copy.
+- The UniFFI-Swift binding surface is re-confirmed against the v2.0.0 bridge
+  (`drainWarningCodes` / `HostWarning.preTimebaseMovie`); the iOS
+  `MARKETING_VERSION` is realigned from the frozen v1.9.x default to `2.0.5`.
+- TestFlight-only; the App Store + AltStore PAL launch stays deferred to the
+  v2.1.0 joint milestone. On-device re-port verification (save-state migration +
+  the AccuracyCoin / SMB / Zelda determinism smoke on Apple silicon) is flagged
+  for the v2.0.9 dual-app readiness pass.
+
 ## [2.0.4] - 2026-07-08 - "Harbor" (Android release candidate)
 
 - Android release-candidate milestone; the emulation core is unchanged and

Cargo.lock

@@ -21,7 +21,7 @@ members = [
 ]
 
 [workspace.package]
-version = "2.0.4"
+version = "2.0.5"
 edition = "2024"
 rust-version = "1.96"
 license = "MIT OR Apache-2.0"

Cargo.toml

@@ -1,6 +1,30 @@
 # RustyNES — Project Status Matrix
 
-> **Current release: v2.0.4 "Harbor"** (2026-07-08) — the fourth release of the v2.0.x
+> **Current release: v2.0.5 "Harbor"** (2026-07-09) — the fifth release of the v2.0.x
+> mobile-finalization train, and the **first iOS finalization release** ("Landfall"),
+> opening the iOS window (v2.0.5–v2.0.8) that mirrors the Android v2.0.1–v2.0.4 window.
+> This is a **host / iOS-only** cut: the cycle-accurate emulation core is **unchanged and
+> byte-identical to v2.0.4** — AccuracyCoin still **141/141 (100.00%, RAM-authoritative)**,
+> nestest 0-diff, the deterministic `#![no_std]` chip stack untouched — so no accuracy /
+> save-state / determinism number moves. It re-ports the frozen v1.9.9 SwiftUI / Metal app
+> onto the v2.0.0 "Timebase" core: **(1)** the pre-Timebase movie warning is surfaced +
+> localized on iOS (a non-blocking notice on its own channel — not an error, **EN + ES**,
+> drained via `EmulatorCore.drainWarnings()` → `NesController.drainWarningCodes()`, wording
+> byte-identical to the Android v2.0.4 string) so loading a pre-v2.0.0 `.rnm` tells the user
+> byte-exact framebuffer/audio reproduction isn't guaranteed across the ADR-0028 timebase
+> change; **(2)** the UniFFI-Swift binding surface (`drainWarningCodes` /
+> `HostWarning.preTimebaseMovie` / `moviePlay`) is re-confirmed against the v2.0.0 bridge
+> (host-verified Swift emit); and the **version bump** (workspace `2.0.4 -> 2.0.5`; iOS
+> `MARKETING_VERSION 1.9.1 -> 2.0.5`, realigned from the frozen v1.9.x default). The core is
+> untouched, so the chip stack / `no_std` / AccuracyCoin contract is unaffected.
+> **TestFlight-only**; App Store + AltStore PAL stay deferred to the v2.1.0 joint launch.
+> The **on-device closeout is a maintainer / v2.0.9 step** — the xcframework build on macOS
+> (**Xcode 26 / iOS 26 SDK**, the App Store submission floor that lands as a hard gate at
+> v2.0.7), save-state migration from a v1.9.x install, and the AccuracyCoin / SMB / Zelda
+> determinism smoke on Apple silicon. See `CHANGELOG.md` `[2.0.5]` +
+> `docs/ios-v2.0.5-readiness.md` + `to-dos/plans/v2.0.5-v2.0.8-ios-finalization-plan.md`.
+>
+> **The preceding release: v2.0.4 "Harbor"** (2026-07-08) — the fourth release of the v2.0.x
 > mobile-finalization train, and the **Android release-candidate** milestone. This is a
 > **host / Android-only** cut: the cycle-accurate emulation core is **unchanged and
 > byte-identical to v2.0.3** — AccuracyCoin still **141/141 (100.00%, RAM-authoritative)**,
@@ -28,7 +52,7 @@
 > them to the monetization `feature_enabled` façade without on-device validation). See
 > `CHANGELOG.md` `[2.0.4]` + `to-dos/plans/v2.0.4-android-rc-plan.md`.
 >
-> **The preceding release: v2.0.3 "Harbor"** (2026-07-08) — the third release of the v2.0.x
+> **The release before that: v2.0.3 "Harbor"** (2026-07-08) — the third release of the v2.0.x
 > mobile-finalization train, and the one that makes the octal-latch accuracy work
 > real at the shipped default. The **2-cycle-ALE PPU fetch model is promoted from the
 > experimental `mc-ppu-2cycle-ale` flag to the unconditional, only PPU fetch path**

docs/STATUS.md

@@ -0,0 +1,90 @@
+# RustyNES v2.0.5 "Harbor" ("Landfall") — iOS re-port readiness
+
+This is the readiness record for **v2.0.5 "Landfall"**, the first iOS/iPadOS release of
+the v2.0.x "Harbor" mobile-finalization train — the iOS re-port of the frozen v1.9.9 app
+onto the **v2.0.0 "Timebase"** core. It is the iOS analogue of the Android v2.0.1
+re-port, and opens the iOS finalization window (**v2.0.5 → v2.0.8**). `docs/STATUS.md`
+remains the per-suite source of truth; this file is the authoritative v2.0.5 summary.
+
+v2.0.5 is a **host / iOS-only** cut. The deterministic core and chip crates are
+untouched; the shipped / native / `no_std` / wasm core stays **byte-identical to
+v2.0.4** and **AccuracyCoin holds 141/141 (100.00%, RAM-authoritative)**, nestest is
+0-diff. Every change is presentation / host-side.
+
+## 1. What landed
+
+- **The pre-Timebase movie warning, surfaced + localized on iOS.** The v2.0.0 timebase
+  rewrite bumped the `.rns`/`.rnm` epoch (ADR 0028): a pre-v2.0.0 `.rnm` still replays
+  its input on the new core, but byte-exact framebuffer / audio reproduction is no
+  longer guaranteed. The v2.0.3 bridge queues a machine-readable `HostWarning` code for
+  this; v2.0.5 surfaces it on iOS:
+  - `EmulatorCore.drainWarnings() -> [String]` drains `NesController.drainWarningCodes()`
+    and maps each `HostWarning` to a localized string (idempotent — the queue empties on
+    read, so each warning surfaces exactly once).
+  - `AppModel.surfaceWarnings()` is called after every successful `moviePlay` (both the
+    saved-`.rnm` `playMovie(at:)` path and the foreign-movie `importForeignMovie(at:)`
+    path) and routes the text to a new `@Published var warningMessage`.
+  - `ContentView` presents `warningMessage` through a **single alert that multiplexes
+    the error + warning channels** — it prefers the error when both are queued and
+    clears only the visible channel on dismissal, so neither is dropped (two chained
+    `.alert` modifiers on one view would race — SwiftUI presents only one) and a
+    warning still never reads as a failure.
+  - `Localizable.xcstrings` gains the EN source string + its ES translation; the English
+    key and the ES copy are **byte-identical to the Android `host_warning_pre_timebase_movie`
+    resource**, so both platforms surface the same wording.
+- **UniFFI-Swift binding surface re-confirmed against the v2.0.0 bridge.** The generated
+  Swift surface (`drainWarningCodes() -> [HostWarning]`, `HostWarning.preTimebaseMovie`,
+  `moviePlay(bytes:)`) matches the new host code, verified by a host emit (see §2).
+- **Version realignment.** Workspace `2.0.4 → 2.0.5` (version-only `Cargo.lock` cascade,
+  18 crates). iOS `MARKETING_VERSION 1.9.1 → 2.0.5` in `ios/project.yml` (the frozen
+  v1.9.x default is realigned to the workspace version); the build number stays
+  CI-injected by the fastlane `beta` lane.
+
+## 2. Verification / validation
+
+### Host gate suite
+
+| Gate | Result |
+|---|---|
+| `cargo check --workspace` (version bump + lock regen) | PASS (46 crates; version-only lock diff) |
+| `cargo fmt --all --check` | PASS |
+| `cargo clippy --workspace --all-targets -- -D warnings` | PASS |
+| `RUSTDOCFLAGS="-D warnings" cargo doc --workspace --no-deps` | PASS |
+| `cargo build -p rustynes-core --target thumbv7em-none-eabihf --no-default-features` (`no_std`) | PASS |
+| both wasm clippy gates | PASS |
+| `markdownlint` (pinned v0.39.0, changed docs) | PASS |
+| **UniFFI-Swift emit** (`uniffi-bindgen generate --library <host build> --language swift`) | PASS — emits `drainWarningCodes`, `HostWarning.preTimebaseMovie`, `moviePlay(bytes:)` |
+| `Localizable.xcstrings` JSON validity (EN source + added ES entry) | PASS |
+
+The Swift-side change references only symbols confirmed present in the regenerated
+bridge surface; the exhaustive `switch` over `HostWarning` is sound (the generated enum
+is compiled into the app module).
+
+### Not host-certifiable (macOS / device)
+
+The Xcode build, the `RustyNESFFI.xcframework` assembly (`scripts/build-ios-xcframework.sh`),
+and any on-device run are **not** reproducible on the Linux host and remain the documented
+TestFlight carryover (§3).
+
+## 3. On-device / maintainer carryovers (v2.0.9 / the TestFlight upload)
+
+- Regenerate the xcframework on macOS and archive with **Xcode 26 / the iOS 26 SDK** (the
+  App Store submission floor — a hard gate at v2.0.7; deployment target may stay iOS 16/17).
+- **Save-state migration** from a v1.9.x install onto the v2.0.0 epoch, and the
+  **AccuracyCoin / SMB / Zelda determinism smoke** on Apple silicon.
+- A physical-device **TestFlight boot smoke** (iPhone 14+ / iPad); confirm the
+  pre-Timebase-movie notice renders correctly under both EN and ES locales, and that a
+  post-v2.0.0 `.rnm` produces **no** warning.
+- The full v1.9.9 on-device TestFlight checklist (ROM import, save / rewind, MFi
+  controller, audio interruptions, ProMotion pacing, an accurate privacy label).
+
+## 4. Carryovers to v2.0.6 → v2.0.8 (unchanged from v1.9.9 §5)
+
+Feature-parity re-verify against the v2.0.0 behaviour (Game Center, CloudKit save sync,
+controllers, capture/PiP, accessibility) lands in **v2.0.6**; polish / performance + the
+**privacy-manifest + required-reason-API audit** + the submission-floor wiring in
+**v2.0.7**; the App Store Connect listing + signing scaffold + §4.7 self-audit in the
+**v2.0.8** iOS RC. The post-Timebase feature carryovers (FDS/NSF, the 20-band EQ, `.dbg`
+source maps, a cheats DB, box-art scraping, a dedicated external-display output) remain
+deferred for re-evaluation at/after v2.1.0. Full phasing:
+`to-dos/plans/v2.0.5-v2.0.8-ios-finalization-plan.md`.