merge origin/master into llm-recording-and-analysis

both sides independently fixed the same three bugs, so each one had to pick a
winner rather than keep both implementations.

extractor encoding: master's recordableValue in worker.go wins over ours in
marshal.go, since master's is pinned by extractor_encoding_test.go and ours had
no tests. our error semantics stay: encodeExtractorValue still returns an error
instead of nil, so an extractor cannot vanish from the trace silently.

apply errors: only the residual generic branch takes master's unconfirmed copy,
where the device may have committed the action before the call failed. the
finer branches that know nothing was dispatched keep lastAction = nil, and our
actionSkipReason taxonomy stays alongside master's held/skippedVerification.

selector matching: our matchAttr with matchSelectorKind wins over master's
match, since ours also handles idPrefix. matchSelector now calls it, which git
did not flag as a conflict and left calling a function our side had deleted.

the ltl doc comment takes master's correction: an unbounded eventually that
never fires IS violated at run end.

internal/verifier/ax_integration_test.go

@@ -2,6 +2,7 @@ package verifier
 
 import (
 	"os"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -176,3 +177,77 @@ func TestStateAxObjectSelectorKeepsCrossPlatformKeysSilent(t *testing.T) {
 		t.Fatalf("probe = %q, want miss", got)
 	}
 }
+
+// axSelectorFormsTree carries one node per id shape a dump produces: the bare
+// tag Compose and the web driver emit, the package-qualified resource id
+// Android emits, and the iOS accessibility identifier.
+const axSelectorFormsTree = `{
+	"attributes": {"resource-id": "root", "bounds": "[0,0,400,800]"},
+	"children": [
+		{"attributes": {"resource-id": "BareThing", "text": "bare", "bounds": "[0,0,100,50]"},
+		 "children": []},
+		{"attributes": {"resource-id": "com.example.app:id/AndroidThing", "text": "android",
+		 "bounds": "[0,50,100,100]"}, "children": []},
+		{"attributes": {"accessibilityIdentifier": "IosThing", "text": "ios",
+		 "bounds": "[0,100,100,150]"}, "children": []}
+	]
+}`
+
+// TestStateAxSelectorFormsAgree drives both selector forms a spec can write
+// through state.ax.find and holds them to the same element. The two forms
+// dispatch to different lookups (findNodeFromJS sends a string to FindNode and
+// an object to FindBySelector), and the object one used to skip the id rule
+// that knows an Android resource id is package-qualified, so a spec that wrote
+// ax.find({id: "AddAccountSubmit"}) got undefined on Android and every property
+// reading it passed while checking nothing.
+func TestStateAxSelectorFormsAgree(t *testing.T) {
+	tree, err := hierarchy.Parse(axSelectorFormsTree)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, test := range []struct {
+		value string
+		want  string
+	}{
+		{"BareThing", "bare"},
+		{"AndroidThing", "android"},
+		{"com.example.app:id/AndroidThing", "android"},
+		{"IosThing", "ios"},
+	} {
+		t.Run(test.value, func(t *testing.T) {
+			verifier := newVerifier(t)
+			mustLoad(t, verifier, `
+				globalThis.fromObject = __sanderling__.extract(
+					state => state.ax.find({ id: `+strconv.Quote(test.value)+` })?.text, "fromObject");
+				globalThis.fromString = __sanderling__.extract(
+					state => state.ax.find("id:" + `+strconv.Quote(test.value)+`)?.text, "fromString");
+				globalThis.properties = {};
+			`)
+			if err := verifier.PushSnapshot(SnapshotInput{Tree: tree}); err != nil {
+				t.Fatal(err)
+			}
+			fromObject := readCurrent(t, verifier, "fromObject")
+			fromString := readCurrent(t, verifier, "fromString")
+			if fromString != test.want {
+				t.Fatalf(`ax.find("id:%s") read %v, want %q`, test.value, fromString, test.want)
+			}
+			if fromObject != fromString {
+				t.Errorf(
+					`one selector, two answers: ax.find({id: %q}) read %v and ax.find("id:%s") read %v`,
+					test.value, fromObject, test.value, fromString,
+				)
+			}
+		})
+	}
+}
+
+// readCurrent returns a named extractor's current value, or nil when the getter
+// returned undefined, which is what an unresolved selector produces.
+func readCurrent(t *testing.T, verifier *Verifier, name string) any {
+	t.Helper()
+	handle := verifier.runtime.GlobalObject().Get(name)
+	if handle == nil {
+		t.Fatalf("%s is not defined", name)
+	}
+	return handle.ToObject(verifier.runtime).Get("current").Export()
+}