diff --git a/README.md b/README.md
index 40947da..9d0f745 100644
--- a/README.md
+++ b/README.md
@@ -421,6 +421,7 @@ See:
 
 - [MobileCore dual-app evidence](docs/mobilecore-dual-app-qa.md) - 30 real offline cross-app requests, buffered/SSE parity, unload/reload, background continuity, low-memory notification, and process restart recovery passed on Android emulator.
 - [Release assets](https://github.com/Harzva/mobilecode/releases/tag/v0.1.78) - the final signed Android `pure` APK is 33,073,027 bytes with SHA-256 `5123f48f93161838b166259061857b058ab63429051544e4ac0234088a886073`; the downloaded asset reports `0.1.78+68`, matches the MobileCode release certificate, contains no recognizable credential or concrete private-host-path value, and clean-launches with MobileCore ready on the Android 16 ARM64 emulator.
+- [iOS Simulator](https://github.com/Harzva/mobilecode/actions/runs/31135405199) and [unsigned archive](https://github.com/Harzva/mobilecode/actions/runs/31135408249) - `0.1.78+68` now passes generated-project verification, simulator build/install/launch survival and crash-log checks, plus unsigned device archive packaging. These private workflow artifacts are build evidence, not signed physical-iPhone acceptance.
 - [Signed Android v0.1.77 workflow](https://github.com/Harzva/mobilecode/actions/runs/31128587598) - the downloaded official `0.1.77+67` APK has SHA-256 `f008ede0e0305c835c3bf45bcc56f22c4fc911d0ae10b513f298d1bdfb0a1c1d`, verifies with the MobileCode release certificate, contains zero recognizable key/JWT/Bearer or private-host-path patterns, and clean-launches on the Android 16 ARM64 emulator.
 - v0.1.77 makes the public release workflows fail closed if they reference or compile raw provider keys, relay bearer tokens, or an OAuth client secret. Public relay URLs, OAuth client IDs, and redirect URIs remain allowed configuration; users may still save their own provider key through the app's secure-storage flow.
 - MobileCore `0.1.4-rc6` closes the emulator foreground-service regression. A 40-poll Android 16 lane kept MobileCode resumed while MobileCore retained its real local model and foreground service with zero failed health polls, freezes, FGS timeouts, ANRs, OOMs, or SIGABRTs. Android `background_restricted` is now a typed fail-closed routing state, not a hidden timeout.
diff --git a/docs/releases/v0.1.78.md b/docs/releases/v0.1.78.md
index 24643f3..f11b6ba 100644
--- a/docs/releases/v0.1.78.md
+++ b/docs/releases/v0.1.78.md
@@ -27,6 +27,8 @@ Release type: local-model linkage and Android background-safety pre-release patc
 - APK Signature Scheme v2 verifies with certificate subject `CN=MobileCode, OU=MobileCode, O=Harzva, L=Shanghai, ST=Shanghai, C=CN` and certificate SHA-256 `35a6eee3e2d81d4c6b5d426984d1b04d7d5ffc3eae7707c6225f5decd80fa2da`.
 - Post-download AOT scanning found zero recognizable GitHub-token, provider-key, bearer-token, JWT, or concrete private-host-path values.
 - A clean Android 16 ARM64 emulator install reported `0.1.78+68`; the final asset then cold-launched in 479 ms with controlled permissions, rendered `v0.1.78` and `TuiMa 就绪`, and produced no fatal exception, ANR, OOM, or SIGABRT marker. MobileCore remained a foreground protocol-v2 service with the real local Qwen2.5 model ready.
+- [iOS Simulator workflow 31135405199](https://github.com/Harzva/mobilecode/actions/runs/31135405199) rebuilt the generated iOS project, verified `0.1.78+68` plus top-level microphone and speech-recognition usage descriptions, built the simulator app, installed it, kept the same process alive through the smoke interval, rejected known privacy/crash signatures, and retained the screenshot and Runner log as private workflow artifacts.
+- [Unsigned iOS archive workflow 31135408249](https://github.com/Harzva/mobilecode/actions/runs/31135408249) built and packaged the `0.1.78+68` device `.xcarchive` successfully. Both iOS runs used `upload_to_release=false`; simulator and unsigned-archive evidence do not replace signed physical-iPhone acceptance.
 
 ## Remaining gates