follow-ups from the pr #73 review (#77)

* ci(folio): run gradle on jdk 21 for the metro plugin

the metro gradle plugin folio builds with publishes org.gradle.jvm.version 21
and java 21 class files, so every leg failed at the folio build on a 17
runtime. local builds pass on jdk 25, which is why only ci saw it.

* fix(build): clean pkg/spec/dist, not the dead spec-api path

* chore: point stale spec-api comments at pkg/spec

* fix(spec): publish src so an installed package carries the runtime entries

* fix(testrun): alias the installed spec package so one module graph loads

* fix(spec): export Direction, ScrollAction and LongPressAction from the entry

* docs(spec): cut the package readme to a description and doc links

* docs: say how the cli and spec package versions relate

* fix(verifier): report whether the last action was confirmed applied

Both hosts get applied: true when the runner saw the dispatch succeed and
applied: null when it could not, so an unconfirmed action stops arriving at
the spec as no action at all.

* fix(runner): an apply error leaves the action's fate unknown, not undone

A deadline that fires after the tap was dispatched leaves the effect
committed. Reporting nil made the spec see an effect with no action to cause
it, which is how the counting property convicts a healthy app.

* fix(release): stage the sidecar jar at the renamed embed path

* test(replay-ui): trace fixtures for the vacuity counts

one real green run, one run that rendered nothing, one that judges every property at least once.

* ci(replay-ui): count the steps each property judged

the exit code says no property returned false; it does not say any property was ever evaluated. this reads the trace and reports judged vs declined per property, and fails when the step page never rendered.

* test(replay-ui): cover the summary script from make test

* ci(replay-ui): summarise through the vacuity script

* docs(ci): explain the replay-ui judged/declined counts

* fix(verifier): encode element-valued extractors into the trace

An ax element exports with its find/findAll host functions attached, and
json.Marshal refuses the whole value over them: json: unsupported type:
func(goja.FunctionCall) goja.Value. The encoding failed, curr stayed nil,
and the goja hosts (ios, android) recorded null for every element-valued
extractor in both the per-step diff and the violation witness.

Apply the web host's sanitize rule before marshaling, so one rule encodes
an element on both hosts.

* test(verifier): pin element encoding to one rule on both hosts

* test(runner): assert an element reaches trace.jsonl and its witness

* feat(spec): give state.lastAction an applied field

Three states, not two: no action is a null lastAction, applied: true is an
action the runner confirmed, applied: null is one it dispatched and never
learned the fate of.

* fix(folio): do not attribute an effect to an unconfirmed action

submitChangesBalanceByTypedAmount and createdAccountHasNonZeroBalance both
convict by pinning an effect on the last action, so both decline unless the
runner saw it applied. The fixtures now say which fate they mean.

* test(folio): an unconfirmed submit belongs in the window

The count is an upper bound on the submits a window holds, so the tap that may
have landed counts and committedTransactionsExceedSubmits has nothing to
convict on.

* test(runner): a tap that lands under a failed apply is not a double submit

Drives the real folio counting predicates through the runner against a device
that commits the tap and then times out. The double-submit case is the control:
without it a green proves only that the property never fired.

* test(verifier): pin the three lastAction states on both hosts

The web page is handed the same applied field the goja object exposes, so a
property cannot read one thing on native and another on web.

* docs(spec-language): document the three lastAction states

.github/scripts/replay-ui-summary-test.sh

@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+# Drives replay-ui-summary.sh over the traces in testdata/ and checks the
+# summary it renders. Run under the flags GitHub Actions uses for a `run:`
+# block, because that is where a swallowed failure hides.
+#
+# testdata/replay-ui-real-run.jsonl is the first 10 steps of the dogfood run in
+# actions run 31873049857 on master, with the per-step `hierarchy` dumps and the
+# rowElements/tabElements extractors removed so the file stays readable. Nothing
+# else was touched. That run was green, and badgeCountMatchesThePanel judged
+# nothing in all 80 of its steps. The other two traces are written by hand.
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+script="$here/replay-ui-summary.sh"
+testdata="$here/testdata"
+work="$(mktemp -d)"
+trap 'rm -rf "$work"' EXIT
+
+failed=0
+rendered=""
+status=0
+
+summarise() { # <case name> <output dir>
+  rendered="$work/$1.md"
+  : > "$rendered"
+  status=0
+  GITHUB_STEP_SUMMARY="$rendered" SEED=3 MAX_STEPS=80 \
+    bash -eo pipefail "$script" "$2" >/dev/null 2>"$work/$1.err" || status=$?
+}
+
+fail() {
+  echo "FAIL: $*" >&2
+  failed=1
+}
+
+expect_status() { # <want> <case>
+  [ "$status" = "$1" ] || fail "$2: exit $status, want $1"
+}
+
+expect_line() { # <line> <case>
+  grep -qxF -- "$1" "$rendered" || fail "$2: summary has no line '$1'"
+}
+
+expect_absent() { # <pattern> <case>
+  if grep -q -- "$1" "$rendered"; then fail "$2: summary should not mention '$1'"; fi
+}
+
+plant() { # <case name> <fixture> -> echoes the output dir
+  local dir="$work/$1/runs/20260815-075347"
+  mkdir -p "$dir"
+  cp "$testdata/$2" "$dir/trace.jsonl"
+  echo "$work/$1/runs"
+}
+
+# A green run of the real thing. Every count here was measured, not chosen.
+summarise real "$(plant real replay-ui-real-run.jsonl)"
+expect_status 0 real
+expect_line "- 10 steps recorded, 10 verified, 0 with violations" real
+expect_line "| selectedStepIsInRange | 10 | 0 |" real
+expect_line "| exactlyOneStepIsSelected | 10 | 0 |" real
+expect_line "| stepCountMatchesTheList | 10 | 0 |" real
+expect_line "| screenshotShowsTheSelectedStep | 10 | 0 |" real
+expect_line "| switchingTabsKeepsTheStep | 2 | 8 |" real
+expect_line "| badgeCountMatchesThePanel | **0** | 10 |" real
+expect_line "- \`badgeCountMatchesThePanel\` judged nothing on this run: no step had a violations badge on screen" real
+expect_absent "checked nothing" real
+
+# Every property judged at least once, including the one the real run never
+# reached. Without this the counts above are consistent with a guard that can
+# only ever return zero.
+summarise every "$(plant every replay-ui-every-property.jsonl)"
+expect_status 0 every
+expect_line "- 4 steps recorded, 3 verified, 0 with violations" every
+expect_line "| noUncaughtExceptions | 3 | 0 |" every
+expect_line "| screenshotShowsTheSelectedStep | 3 | 0 |" every
+expect_line "| switchingTabsKeepsTheStep | 2 | 1 |" every
+expect_line "| badgeCountMatchesThePanel | 1 | 2 |" every
+
+# The fuzzer sat on the run list: the step page never rendered, so nothing was
+# ever compared. This is the run that used to pass.
+summarise blind "$(plant blind replay-ui-nothing-rendered.jsonl)"
+expect_status 1 blind
+expect_line "| selectedStepIsInRange | **0** | 4 |" blind
+expect_line "| badgeCountMatchesThePanel | **0** | 4 |" blind
+expect_line "- \`exactlyOneStepIsSelected\` judged nothing on this run: no step had a row in the step list" blind
+grep -q "this run checked nothing" "$rendered" || fail "blind: no checked-nothing verdict"
+grep -q "the step page never rendered" "$work/blind.err" || fail "blind: nothing on stderr"
+
+# The run directory exists but the trace does not, and the glob matches nothing
+# at all. Both are the harness dying before it checked anything.
+mkdir -p "$work/empty-run/runs/20260815-075347"
+summarise empty-run "$work/empty-run/runs"
+expect_status 1 empty-run
+grep -q "no trace at" "$rendered" || fail "empty-run: no missing-trace line"
+
+summarise no-glob "$work/no-glob/runs"
+expect_status 1 no-glob
+grep -q "nothing under" "$rendered" || fail "no-glob: no missing-directory line"
+
+# A property this summary does not know about is a summary that silently counts
+# six of seven properties, which is the bug one level up.
+drifted="$(plant drift replay-ui-every-property.jsonl)"
+sed 's/badgeCountMatchesThePanel/badgeAgreesWithThePanel/g' \
+  "$testdata/replay-ui-every-property.jsonl" > "$drifted/20260815-075347/trace.jsonl"
+summarise drift "$drifted"
+expect_status 1 drift
+grep -q "these counts cannot be trusted" "$rendered" || fail "drift: no untrusted verdict"
+
+# Same for a reading the spec no longer declares: the count would quietly go to
+# zero and read as a UI that stopped rendering.
+sed 's/extract("violationBadges"/extract("violationCounters"/' \
+  "$here/../../replay-ui/sanderling/spec.ts" > "$work/renamed-spec.ts"
+rendered="$work/renamed.md"
+: > "$rendered"
+status=0
+GITHUB_STEP_SUMMARY="$rendered" SPEC="$work/renamed-spec.ts" \
+  bash -eo pipefail "$script" "$(plant renamed replay-ui-real-run.jsonl)" \
+  >/dev/null 2>&1 || status=$?
+expect_status 1 renamed
+grep -q "no longer declares violationBadges" "$rendered" || fail "renamed: no drift verdict"
+
+if [ "$failed" = 0 ]; then
+  echo "replay-ui-summary.sh: ok"
+fi
+exit "$failed"