fix ltl semantics and unify action enumeration (#71)

* fix(ltl): give every thunk a construction identity

Two distinct unnamed predicates both described as "Thunk(...)", so obligation
collapse merged their residuals and could drop a live violation. Identity is
assigned at construction and the fields are unexported, so a thunk cannot be
built without one.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* fix(ltl): reduce a thrown-predicate residual instead of panicking

The verifier substitutes an ErrorFormula for the residual of a property whose
predicate threw, and that residual is fed back in on the next step. reduce had
no case for it, so the run crashed. It re-reports the same failure now.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* fix(ltl): make a bounded always the dual of a bounded eventually

G<=n(f) and not F<=n(not f) disagreed on traces where the inner was still
pending when the window closed, so nnf's negation normal form was not semantics
preserving. Both sides now range over the observations at which their inner can
definitely resolve: the eventually keeps a pending inner as a disjunct, and the
always discharges vacuously at window close.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* fix(ltl): arm a one-shot root once per run

A root that carries its own horizon is one obligation for the whole run, not one
per observation. Re-instantiating a top-level eventually monitored G F<=n(p)
instead of F<=n(p) and left one live obligation per step behind; a bounded
always restarted its window every step and never closed.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* fix(verifier): stop wrapping a top-level eventually in always

`eventually(p).within(300, "seconds")` as a property meant "within 300 seconds
of every step", which spawned an obligation per step with its own resolved
deadline. A 553-step run carried 553 of them and serialized a 75 KB residual.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* fix(ltl): serialize the resolved deadline of a bounded window

Two obligations spawned at different steps from one duration-bounded formula
differ only in the deadline the evaluator resolved for them, so they serialized
identically and the trace erased a distinction the evaluator makes. The authored
window stays in amount/unit; the resolved deadline rides alongside.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* fix(verifier): split a witness's origin step from its detection step

A deferred obligation spans two steps: the one that armed it and the one whose
reduction failed. They were conflated under one index, so the extractor snapshot
(which is the detecting step's state) was reported against the origin step.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* fix(runner): record a witness's detection step in the trace

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* feat(replay-ui): show the step a violation was detected at

The witness evidence is the detecting step's state, so say which step that is
and let a reader jump to it.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* fix(verifier): record the extractor state the predicates actually read

On the web path extractor bodies are evaluated in V8 and injected here, but only
the goja value was replaced. The trace diff and the violation witness therefore
described a state no property ever saw.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* refactor(spec): one candidate producer over one target-eligibility rule

Both hosts routed verbs themselves and both policies enumerated their own
actions, and all four drifted. Web sent `swipes` to scrollable containers only,
so swipe-to-dismiss on a list row was reachable on native and unreachable on
web; the model policy folded gestures its own way and could not reach what the
seeded picker drew.

A host now reports facts about every element and never decides which verb may
act on it: targets.ts acceptsTarget owns that for both. pick.ts builtinCandidates
is the single enumeration, and the model policy reads it through
__sanderlingEnumerateBuiltin__ instead of reimplementing it in Go.

Gesture verbs change with it: scrolls stay vertical over scrollable containers,
swipes go free-form in all four directions from any element with real bounds.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* fix(runner): name a builtin scroll by its drag origin

A builtin gesture carries endpoints and no selector, so every scroll rendered as
"Scroll down " in the prompt's recent-action memory and two scrollable regions
were indistinguishable.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* fix(chrome): clear storage over cdp instead of scripting an opaque origin

Launch runs while the tab is still on about:blank, whose opaque origin denies
storage access, so localStorage.clear() threw SecurityError and every web run
died at launch. Storage.clearDataForOrigin needs no navigation. The exception
helper lands here because "Uncaught" is what hid this for so long.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* fix(chrome): enable the swiftshader webgl fallback

Headless Chrome runs with --disable-gpu, and without this flag it refuses the
software WebGL backend: getContext returns null, so a canvas-rendered app paints
nothing and every screenshot is identical black.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* fix(web): resolve testTag through data-testid or id

Compose Multiplatform emits its testTag into the element id, which the native
table already accepts via the resource-id alias. The two web selector tables
were the only place that rejected it.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* test(spec): type-check the spec api as part of make test

The fake runtime in api.test.ts did not return a chainable handle from extract,
so the file had not type-checked since named() was added. Wiring the check into
make test stops it drifting again.

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

* docs(manual): one-shot eventually and the gesture verbs

Claude-Session: https://claude.ai/code/session_01Fj4wJUikdABuMQEETwW55J

internal/runner/llm_source.go

@@ -302,7 +302,14 @@ func describeAction(action verifier.Action) string {
 	case verifier.ActionKindInputText:
 		return fmt.Sprintf("InputText %s = %q", actionTarget(action), action.Text)
 	case verifier.ActionKindScroll:
-		return fmt.Sprintf("Scroll %s %s", action.Direction, action.On)
+		// A builtin gesture carries endpoints rather than a selector, so name the
+		// container by where the drag starts; that is what tells two scrollable
+		// regions apart in the recent-action memory.
+		target := action.On
+		if target == "" {
+			target = fmt.Sprintf("(%d,%d)", action.FromX, action.FromY)
+		}
+		return fmt.Sprintf("Scroll %s %s", action.Direction, target)
 	case verifier.ActionKindSwipe:
 		// Coordinates make a repeated identical swipe recognizable in the
 		// prompt's recent-action memory.

internal/runner/llm_source_test.go

@@ -62,6 +62,20 @@ func TestActionForCandidatePassesNonTypingThrough(t *testing.T) {
 	}
 }
 
+func TestDescribeActionNamesGesturesByOrigin(t *testing.T) {
+	builtin := verifier.Action{
+		Kind: verifier.ActionKindScroll, Direction: "down",
+		FromX: 200, FromY: 500, ToX: 200, ToY: 340,
+	}
+	if got := describeAction(builtin); got != "Scroll down (200,500)" {
+		t.Errorf("builtin gesture described as %q, want the drag origin", got)
+	}
+	authored := verifier.Action{Kind: verifier.ActionKindScroll, Direction: "up", On: "id:List"}
+	if got := describeAction(authored); got != "Scroll up id:List" {
+		t.Errorf("authored scroll described as %q, want its selector", got)
+	}
+}
+
 func TestActionForCandidateUsesModelText(t *testing.T) {
 	source := &llmSource{}
 	candidate := verifier.ActionCandidate{

internal/runner/runner.go

@@ -1006,7 +1006,9 @@ func violationRecords(properties []string, witnesses map[string]trace.Witness, d
 
 // collectWitnesses gathers the violation witness for each newly-violated
 // property, logs its cause, and returns them keyed by property name for the
-// trace. Properties without a captured witness are skipped.
+// trace. Properties without a captured witness are skipped. stepIndex is the
+// trace line the witness lands on, and stands in as the detection step for a
+// verifier that observed no labeled step (a run-end finalize).
 func collectWitnesses(verifierInstance *verifier.Verifier, properties []string, logger *slog.Logger, stepIndex int) map[string]trace.Witness {
 	if len(properties) == 0 {
 		return nil
@@ -1017,14 +1019,19 @@ func collectWitnesses(verifierInstance *verifier.Verifier, properties []string,
 		if witness == nil {
 			continue
 		}
+		detectedStep := witness.DetectedStep
+		if detectedStep == 0 {
+			detectedStep = stepIndex
+		}
 		logger.Warn("property violated",
-			"step", witness.Step, "detected_step", stepIndex,
+			"step", witness.Step, "detected_step", detectedStep,
 			"property", name, "reason", witness.Reason, "error", witness.IsError)
 		witnesses[name] = trace.Witness{
-			Reason:     witness.Reason,
-			IsError:    witness.IsError,
-			Step:       witness.Step,
-			Extractors: witness.Extractors,
+			Reason:       witness.Reason,
+			IsError:      witness.IsError,
+			Step:         witness.Step,
+			DetectedStep: detectedStep,
+			Extractors:   witness.Extractors,
 		}
 	}
 	if len(witnesses) == 0 {

internal/runner/runner_test.go

@@ -363,6 +363,11 @@ globalThis.actions = actions(() => []);
 		if witness.Step != 2 {
 			t.Errorf("witness step: got %d, want 2 (causing step)", witness.Step)
 		}
+		// The two indices the witness spans are recorded separately: the
+		// extractor snapshot it carries is step 3's state, not step 2's.
+		if witness.DetectedStep != 3 {
+			t.Errorf("witness detected step: got %d, want 3", witness.DetectedStep)
+		}
 	}
 	if err := scanner.Err(); err != nil {
 		t.Fatalf("scan trace: %v", err)

internal/runner/web_extractor_trace_test.go

@@ -0,0 +1,118 @@
+package runner
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	mockdriver "github.com/priyanshujain/sanderling/internal/driver/mock"
+	"github.com/priyanshujain/sanderling/internal/trace"
+)
+
+// engineDisagreementSpec makes the two runtimes disagree on purpose: the
+// extractor body returns "goja" when it runs in-process, and the web driver
+// below reports "v8" for the same extractor. The property is true of one value
+// and false of the other, so the verdict names the engine the verdict used.
+const engineDisagreementSpec = `
+import { actions, always, extract } from "@sanderling/spec";
+const engine = extract("engine", () => "goja");
+globalThis.properties = {
+  ranInGoja: always(() => engine.current === "goja"),
+};
+globalThis.actions = actions(() => []);
+`
+
+// webMockDriver presents the mock device driver as a web target so the runner
+// takes the V8 path, where extractor values come from the page rather than
+// from goja.
+type webMockDriver struct {
+	*mockdriver.Driver
+	overrides map[int]json.RawMessage
+}
+
+func (d *webMockDriver) InstallBundle(context.Context, []byte) error { return nil }
+
+func (d *webMockDriver) EvaluateExtractors(context.Context) (map[int]json.RawMessage, error) {
+	return d.overrides, nil
+}
+
+func (d *webMockDriver) NextActionFromV8(context.Context) (json.RawMessage, error) {
+	return nil, nil
+}
+
+// TestRunner_TraceRecordsTheValueTheVerdictUsed fails if the trace and the
+// verdict disagree about an extractor. A witness is only an explanation of a
+// violation if it holds the state the violated property was evaluated against.
+func TestRunner_TraceRecordsTheValueTheVerdictUsed(t *testing.T) {
+	state := newHarnessWithSpec(t, engineDisagreementSpec)
+	const pageValue = `"v8"`
+	web := &webMockDriver{
+		Driver:    state.mock,
+		overrides: map[int]json.RawMessage{0: json.RawMessage(pageValue)},
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	summary, err := Run(ctx, Options{
+		Duration:    100 * time.Millisecond,
+		IdleTimeout: 20 * time.Millisecond,
+		Driver:      web,
+		Verifier:    state.verifier,
+		TraceWriter: state.writer,
+	})
+	if err != nil {
+		t.Fatalf("Run: %v", err)
+	}
+	if !containsProperty(summary.Violations, "ranInGoja") {
+		t.Fatalf("ranInGoja did not violate, so the page value never reached the verdict: %v",
+			summary.Violations)
+	}
+
+	file, err := os.Open(filepath.Join(state.writer.Directory(), "trace.jsonl"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer file.Close()
+
+	type traceLine struct {
+		Step             int                              `json:"step"`
+		ExtractorChanges map[string]trace.ExtractorChange `json:"extractor_changes"`
+		Witnesses        map[string]trace.Witness         `json:"witnesses"`
+	}
+	changes, witnesses := 0, 0
+	scanner := bufio.NewScanner(file)
+	scanner.Buffer(make([]byte, 0, 64*1024), 8*1024*1024)
+	for scanner.Scan() {
+		var line traceLine
+		if err := json.Unmarshal(scanner.Bytes(), &line); err != nil {
+			t.Fatalf("trace line decode: %v", err)
+		}
+		if change, ok := line.ExtractorChanges["engine"]; ok {
+			changes++
+			if got := string(change.Curr); got != pageValue {
+				t.Errorf("step %d: trace records engine=%s, verdict used %s",
+					line.Step, got, pageValue)
+			}
+		}
+		for name, witness := range line.Witnesses {
+			witnesses++
+			if got := string(witness.Extractors["engine"]); got != pageValue {
+				t.Errorf("step %d: %s witness records engine=%s, verdict used %s",
+					line.Step, name, got, pageValue)
+			}
+		}
+	}
+	if err := scanner.Err(); err != nil {
+		t.Fatalf("scan trace: %v", err)
+	}
+	if changes == 0 {
+		t.Error("no extractor change reached the trace; nothing was compared")
+	}
+	if witnesses == 0 {
+		t.Error("no witness reached the trace; nothing was compared")
+	}
+}