merge origin/master into llm-recording-and-analysis

both sides independently fixed the same three bugs, so each one had to pick a
winner rather than keep both implementations.

extractor encoding: master's recordableValue in worker.go wins over ours in
marshal.go, since master's is pinned by extractor_encoding_test.go and ours had
no tests. our error semantics stay: encodeExtractorValue still returns an error
instead of nil, so an extractor cannot vanish from the trace silently.

apply errors: only the residual generic branch takes master's unconfirmed copy,
where the device may have committed the action before the call failed. the
finer branches that know nothing was dispatched keep lastAction = nil, and our
actionSkipReason taxonomy stays alongside master's held/skippedVerification.

selector matching: our matchAttr with matchSelectorKind wins over master's
match, since ours also handles idPrefix. matchSelector now calls it, which git
did not flag as a conflict and left calling a function our side had deleted.

the ltl doc comment takes master's correction: an unbounded eventually that
never fires IS violated at run end.

internal/runner/runner_test.go

@@ -253,6 +253,23 @@ func TestRenderSummary_OmitsUnsupportedLineWhenNone(t *testing.T) {
 	}
 }
 
+// A step nothing judged is not a step that passed. The run prints its count so
+// a green summary cannot hide a run that skipped most of its steps, which is
+// what a screen that keeps moving under the reads would produce.
+func TestRenderSummary_CountsTheStepsNothingJudged(t *testing.T) {
+	var out bytes.Buffer
+	RenderSummary(&out, Summary{Steps: 10, SkippedVerification: 4}, "android")
+	if !strings.Contains(out.String(), "4 step(s) judged by nothing") {
+		t.Errorf("expected the unjudged-step count, got:\n%s", out.String())
+	}
+
+	out.Reset()
+	RenderSummary(&out, Summary{Steps: 10}, "android")
+	if strings.Contains(out.String(), "judged by nothing") {
+		t.Errorf("a run that judged every step must not print the line, got:\n%s", out.String())
+	}
+}
+
 func TestRunner_ViolationSurfacesInSummary(t *testing.T) {
 	state := newHarnessWithSpec(t, violationSpec)
 
@@ -1507,8 +1524,15 @@ func TestRunner_UsesAtomicSnapshot(t *testing.T) {
 	if snapshotCalls == 0 {
 		t.Errorf("expected at least one Snapshot call, got %d", snapshotCalls)
 	}
-	if hierarchyCalls != 0 {
-		t.Errorf("expected zero standalone Hierarchy calls (runner must use Snapshot), got %d", hierarchyCalls)
+	// The recorded pair still comes from Snapshot. The standalone hierarchy
+	// reads are the composition detector (changedOnReread), one per step at
+	// most, and they are never the source of what the step records.
+	if hierarchyCalls > summary.Steps {
+		t.Errorf("expected at most one standalone Hierarchy call per step (runner must observe through Snapshot), got %d over %d steps",
+			hierarchyCalls, summary.Steps)
+	}
+	if snapshotCalls < summary.Steps {
+		t.Errorf("expected a Snapshot per step, got %d over %d steps", snapshotCalls, summary.Steps)
 	}
 	if screenshotCalls != 0 {
 		t.Errorf("expected zero standalone Screenshot calls (runner must use Snapshot), got %d", screenshotCalls)
@@ -2339,8 +2363,10 @@ func TestEnsureForeground_DismissesSystemOverlay(t *testing.T) {
 	logger := slog.New(slog.NewTextHandler(io.Discard, &slog.HandlerOptions{Level: slog.LevelWarn}))
 	options := Options{BundleID: "app.folio", Driver: m, IdleTimeout: 10 * time.Millisecond}
 
-	if !ensureForeground(context.Background(), options, logger, 5) {
-		t.Fatal("expected the guard to act on the focus-stealing overlay")
+	got := ensureForeground(context.Background(), options, logger, 5)
+	if got != foregroundOverlayDismissed {
+		t.Fatalf("the guard reported %v, want foregroundOverlayDismissed; "+
+			"an obscured app is not a relaunched one", got)
 	}
 	backs, relaunches := 0, 0
 	for _, a := range m.Actions() {