[2026-10-01] eagle: work/projects/vscode-migration/findings.md work/projects/vscode-migration/vscode-migration.md

work/projects/vscode-migration/findings.md

@@ -2,6 +2,22 @@
 
 Back to [[projects/vscode-migration/vscode-migration]]. Verified on Xcode 26.6 / Swift 6.3.3, Sep 2026.
 
+## Browser package (Xcode 27.2, Oct 2026)
+
+- The project targets Xcode 27 now; Xcode 26 isn't a constraint any more.
+- A package folder can overlap project groups: other targets keep compiling files inside `macOS/DuckDuckGo` by path, and the app target keeps resource file references there (verified with a small xcodegen project and the real app).
+- Asset catalogs in a package: Xcode (26.6 and 27.2) and `swift build --build-system swiftbuild` (27.2) compile `Assets.car` and generate `ImageResource`/`ColorResource`, but **not** `NSImage.foo`/`NSColor.foo`/`Color.foo` extensions → ~575 call sites moved to `NSImage(resource:)` / `NSColor(resource:)` / `Color(.foo)` (found by building with `ASSETCATALOG_COMPILER_GENERATE_SWIFT_ASSET_SYMBOL_EXTENSIONS=NO`). Native `swift build` handles neither.
+- Core Data models with `codeGenerationType="class"` work in a package (Xcode and swiftbuild): entity classes are generated in the package module, `.momd` goes to the package resource bundle → load with `Bundle.module`. Don't keep a copy in the app target (duplicate `@objc` entity classes).
+- Xcode treats only a configuration named `Debug` as debug for packages: `CI` builds packages as release (no `DEBUG`, no testability). `SPM_FORCE_DEBUG=1` (read by `Package.swift`) + `ENABLE_TESTABILITY=true` on the command line fix it; command-line build settings reach package targets, project-level settings don't.
+- SwiftPM caches evaluated manifests by content in `~/Library/Caches/org.swift.swiftpm/manifests`, not by environment: after building without `SPM_FORCE_DEBUG`, a `CI` build reuses the manifest without `DEBUG` until `Package.swift` changes. Fresh CI runners are fine; locally edit `Package.swift` or clear the cache.
+- Storyboard objects with `customModuleProvider="target"` resolve to the module of the target compiling the storyboard → after moving the code into a package, classes weren't found (crash in `NavigationBarViewController`). Moot now that the last storyboard is dropped.
+- Transitive modules used only through extensions (e.g. Punycode's `String.idnaDecoded`) link in Debug but not in release configurations → declare them as explicit package dependencies.
+- `DataBrokerProtection-macOS/Package.swift` had `.package(path: "../VPN")` (doesn't exist; Xcode resolves it by identity through the workspace) — breaks `swift build`; fixed to `../../../SharedPackages/VPN`.
+- Building the host app without `-onlyUsePackageVersionsFromResolvedFile` re-resolved packages and rewrote the project `Package.resolved` (`xctest-dynamic-overlay` → `swift-issue-reporting`).
+- VSCode host app: the app has system extension entitlements → the hardened runtime refuses `disable-library-validation` ("Hardened Runtime relaxation entitlements disallowed on System Extensions", process killed at exec). Instead `sign-dylib.sh` signs the `swift build` dylib and the frameworks it links with the host app's identity.
+- `swift build --build-system swiftbuild --product DuckDuckGoBrowserDynamic` output: `.build/out/Products/Debug/libDuckDuckGoBrowserDynamic.dylib`; links GRDB, Sparkle, OpenSSL, Lottie frameworks next to it. At runtime the dylib finds its resource bundle in the host app (`Contents/Resources/DuckDuckGoBrowser_DuckDuckGo_Privacy_Browser.bundle`).
+- Concurrency warnings ("error in the Swift 6 language mode") are the same in the old app target and in the package on Xcode 27 — existing debt, not caused by the move.
+
 ## App target readiness
 
 - DMG and App Store targets compile identical sources (1398 files); `FEATURE_FLAGS` is empty for the app — only `DEBUG` remains (SPM handles it).