test(conformance): g4 sees a doubling appended to what the field held

Redaction cost the gate this shape on android: the driver typed the value twice
onto existing content, so the whole value is not its own doubling and the typed
value is not in the trace to compare against. The recorded-value check still
catches it on the backends that record one.

Red at this commit: G4 reports PASS on a field that grew by one string twice.

conformance/gates.sh

@@ -517,6 +517,8 @@ self_test() {
     "$(gate_no_doubled_text "${testdata}/pass" && echo PASS || echo FAIL)"
   assert "G4 doubled text caught with the typed value redacted" FAIL \
     "$(gate_no_doubled_text "${testdata}/g4-doubled-text" && echo PASS || echo FAIL)"
+  assert "G4 doubling appended to existing content caught" FAIL \
+    "$(gate_no_doubled_text "${testdata}/g4-appended-doubling" && echo PASS || echo FAIL)"
   assert "G4 repeated character is not doubling" PASS \
     "$(gate_no_doubled_text "${testdata}/g4-repeated-character" && echo PASS || echo FAIL)"
   assert "G4 doubled text caught from the recorded value" FAIL \

conformance/testdata/g4-appended-doubling/exit_status

@@ -0,0 +1 @@
+0

conformance/testdata/g4-appended-doubling/output.log

@@ -0,0 +1 @@
+run complete

conformance/testdata/g4-appended-doubling/trace.jsonl

@@ -0,0 +1,2 @@
+{"step": 1, "timestamp": "2026-06-06T12:00:00.600000+05:30", "hierarchy": {"elements": [{"resourceId": "LoginScreen", "class": "android.view.View", "editable": true, "bounds": {"left": 34, "top": 87, "right": 286, "bottom": 135}, "attrs": {"resource-id": "LoginScreen", "class": "android.view.View", "text": ""}}, {"resourceId": "LoginEmail", "class": "android.widget.EditText", "editable": true, "bounds": {"left": 34, "top": 87, "right": 286, "bottom": 135}, "attrs": {"resource-id": "LoginEmail", "class": "android.widget.EditText", "text": "demo@"}}, {"resourceId": "LoginPassword", "class": "android.widget.EditText", "editable": true, "bounds": {"left": 34, "top": 87, "right": 286, "bottom": 135}, "attrs": {"resource-id": "LoginPassword", "class": "android.widget.EditText", "text": ""}}, {"resourceId": "LoginSubmit", "class": "android.view.View", "editable": true, "bounds": {"left": 34, "top": 87, "right": 286, "bottom": 135}, "attrs": {"resource-id": "LoginSubmit", "class": "android.view.View", "text": ""}}]}, "next_action": {"kind": "InputText", "text": "[redacted]", "selector": "testTag:LoginScreen > testTag:LoginEmail"}}
+{"step": 2, "timestamp": "2026-06-06T12:00:01.200000+05:30", "hierarchy": {"elements": [{"resourceId": "LoginScreen", "class": "android.view.View", "editable": true, "bounds": {"left": 34, "top": 87, "right": 286, "bottom": 135}, "attrs": {"resource-id": "LoginScreen", "class": "android.view.View", "text": ""}}, {"resourceId": "LoginEmail", "class": "android.widget.EditText", "editable": true, "bounds": {"left": 34, "top": 87, "right": 286, "bottom": 135}, "attrs": {"resource-id": "LoginEmail", "class": "android.widget.EditText", "text": "[email protected]"}}, {"resourceId": "LoginPassword", "class": "android.widget.EditText", "editable": true, "bounds": {"left": 34, "top": 87, "right": 286, "bottom": 135}, "attrs": {"resource-id": "LoginPassword", "class": "android.widget.EditText", "text": ""}}, {"resourceId": "LoginSubmit", "class": "android.view.View", "editable": true, "bounds": {"left": 34, "top": 87, "right": 286, "bottom": 135}, "attrs": {"resource-id": "LoginSubmit", "class": "android.view.View", "text": ""}}]}}

conformance/testdata/generate.py

@@ -152,6 +152,16 @@ write_run(
     ],
 )
 
+# G4: the driver typed the value twice onto what the field already held, so the
+# whole value is not its own doubling. What it grew by is.
+write_run(
+    "g4-appended-doubling",
+    [
+        step(1, 600, login_screen("demo@", ""), input_action("LoginEmail")),
+        step(2, 600, login_screen("[email protected]", "")),
+    ],
+)
+
 # G4: an action typed at coordinates names no field. The step carries nothing
 # the gate can check, and it may not stop the gate checking the rest.
 write_run(