fix(core): stop AppMeta trapping when there is no app bundle (#762)

AppMeta force-unwrapped both Info.plist lookups, so reading version or build
outside an app bundle trapped. The FlipcashCore package test host has no
bundle, so UserAgentClientInterceptorTests took the whole process down with
SIGTRAP and no suite in the package could run under `swift test`. Only filtered
runs that excluded that test worked.

Both lookups now fall back to AppMeta.unknown. The stand-in is deliberately
non-numeric: SessionAuthenticator.requiresUpgrade parses build and treats an
unparseable value as "allow access", whereas "0" would parse as a build below
any server minimum and gate the app behind a forced upgrade it can never
satisfy.

The package already compiled for macOS, so the trap was the only thing in the
way: `swift test` now runs all 933 tests. That makes the testing doc's blanket
"packages are iOS-only" rule wrong for FlipcashCore and FlipcashCoreVectors,
which declare .macOS, so it is narrowed to the packages where it still holds.

UserAgentClientInterceptorTests is unchanged. The new AppMetaTests assert only
what is true under both hosts, since the app target does have a bundle.

Author: bmc08gt

.claude/docs/testing.md

@@ -53,7 +53,11 @@ snapshots. The crash is inside the sanitizer, not app code, in both cases. Detai
 repro steps in [2026-08-25-tsan-ui-test-crash.md](../plans/2026-08-25-tsan-ui-test-crash.md).
 Don't move TSan back onto `AllTargets` without re-checking that analysis against the current Xcode.
 
-**Never run `swift test` in a package directory** (`FlipcashCore`, `FlipcashUI`, etc.). Packages are iOS-only; `swift test` targets the macOS host and fails with code-signing errors. Always go through `./Scripts/test.sh` (which routes through the `Flipcash` scheme on the iOS Simulator).
+**`swift test` works in `FlipcashCore` only.** It and `FlipcashCoreVectors` declare `.macOS`, so `swift test` builds and runs their suites on the macOS host. Every other package (`FlipcashUI`, `FlipcashAPI`, `CodeScanner`, `CrossPlatformVectors`) is iOS-only and cannot be tested that way.
+
+A macOS run has no app bundle, so anything reading `Bundle.main` sees nil — `AppMeta` returns `AppMeta.unknown` instead of trapping. A test that needs a real bundle value belongs in a simulator run.
+
+`./Scripts/test.sh` (the `Flipcash` scheme on the iOS Simulator) stays the check that counts, because it runs on the platform we ship. Treat `swift test` as a fast inner loop for pure-logic suites, not a substitute for it.
 
 For paired-device builds, see [Xcode MCP Server](quick-reference.md#xcode-mcp-server).
 

FlipcashCore/Sources/FlipcashCore/Clients/AppMeta.swift

@@ -6,11 +6,21 @@
 import Foundation
 
 public enum AppMeta {
+
+    /// Stand-in returned when the host has no Info.plist value, as in a package test host.
+    public static let unknown = "unknown"
+
+    /// The app's marketing version, or ``unknown`` when the host bundle doesn't declare one.
     public static var version: String {
-        Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as! String
+        Bundle.main.object(forInfoDictionaryKey: "CFBundleShortVersionString") as? String ?? unknown
     }
 
+    /// The app's build number, or ``unknown`` when the host bundle doesn't declare one.
+    ///
+    /// Deliberately not a numeric stand-in: `SessionAuthenticator.requiresUpgrade` parses this and
+    /// treats an unparseable value as "allow access", whereas `"0"` would parse and read as a build
+    /// older than any server minimum, gating the app behind a forced upgrade it can never satisfy.
     public static var build: String {
-        Bundle.main.object(forInfoDictionaryKey: "CFBundleVersion") as! String
+        Bundle.main.object(forInfoDictionaryKey: "CFBundleVersion") as? String ?? unknown
     }
 }

FlipcashCore/Tests/FlipcashCoreTests/AppMetaTests.swift

@@ -0,0 +1,29 @@
+//
+//  AppMetaTests.swift
+//  FlipcashCoreTests
+//
+
+import Testing
+@testable import FlipcashCore
+
+@Suite("AppMeta — Info.plist lookups degrade instead of trapping")
+struct AppMetaTests {
+
+    // Assertions hold under both hosts: the package test host has no Info.plist and gets the
+    // stand-in, the app target has one and gets the real value.
+
+    @Test("Version reads without trapping and is never empty")
+    func versionDegrades() {
+        #expect(!AppMeta.version.isEmpty)
+    }
+
+    @Test("Build reads without trapping and is never empty")
+    func buildDegrades() {
+        #expect(!AppMeta.build.isEmpty)
+    }
+
+    @Test("The build stand-in stays unparseable, so requiresUpgrade allows access")
+    func buildStandInIsNotNumeric() {
+        #expect(UInt32(AppMeta.unknown) == nil)
+    }
+}