merge origin/master into llm-recording-and-analysis

both sides independently fixed the same three bugs, so each one had to pick a
winner rather than keep both implementations.

extractor encoding: master's recordableValue in worker.go wins over ours in
marshal.go, since master's is pinned by extractor_encoding_test.go and ours had
no tests. our error semantics stay: encodeExtractorValue still returns an error
instead of nil, so an extractor cannot vanish from the trace silently.

apply errors: only the residual generic branch takes master's unconfirmed copy,
where the device may have committed the action before the call failed. the
finer branches that know nothing was dispatched keep lastAction = nil, and our
actionSkipReason taxonomy stays alongside master's held/skippedVerification.

selector matching: our matchAttr with matchSelectorKind wins over master's
match, since ours also handles idPrefix. matchSelector now calls it, which git
did not flag as a conflict and left calling a function our side had deleted.

the ltl doc comment takes master's correction: an unbounded eventually that
never fires IS violated at run end.

replay-ui/sanderling/spec.ts

@@ -170,11 +170,44 @@ const switchATab = actions(() => {
   return tabs.length === 0 ? [] : [Tap({ on: from(tabs).generate() })];
 });
 
+// badgeCountMatchesThePanel needs two readings on ONE step: the badge, which a
+// tab strip renders only for a step that HAS a violation, and a violations
+// panel to compare it against, which exists while the properties or violations
+// tab is selected. Undirected actions put both on the same step 0 times in the
+// 80 of the first dogfood run: the property was reachable in principle and
+// judged nothing in practice.
+//
+// Both halves have to be aimed at. Aiming at the step alone just moved the
+// misses to the other side, 0 judged either way. So this selects a step the
+// list marks as violating, and once standing on one, opens a panel if none is
+// up. It opens the AFTER panel's, because the before panel's screenshot is what
+// screenshotShowsTheSelectedStep reads and covering that up trades one
+// property's evidence for another's.
+const violatingRows = extract("violatingRows", (s) =>
+  s.ax.findAll({ "data-testid": "step-row" }).filter((row) => dataOf(row, "violations") === "true"),
+);
+const afterPropertiesTabs = extract("afterPropertiesTabs", (s) =>
+  s.ax
+    .findAll([{ "data-testid": "state-after" }, { "data-testid": "tab" }])
+    .filter((tab) => dataOf(tab, "tabId") === "properties"),
+);
+
+const showAViolatingStepWithItsPanel = actions(() => {
+  const rows = violatingRows.current;
+  if (!rows.some((row) => dataOf(row, "active") === "true")) {
+    return rows.length === 0 ? [] : [Tap({ on: from(rows).generate() })];
+  }
+  if (violationPanelCounts.current.length > 0) return [];
+  const tabs = afterPropertiesTabs.current;
+  return tabs.length === 0 ? [] : [Tap({ on: from(tabs).generate() })];
+});
+
 // defaultActions carries the rest: the jump-to-violation button, the theme
 // toggle, the link back to the run list, and the scrolling.
 export const actionsRoot = weighted(
   [30, selectAStep],
   [20, navigateByKeyboard],
   [25, switchATab],
+  [20, showAViolatingStepWithItsPanel],
   [25, defaultActions],
 );

replay-ui/src/components/Tabs.css

@@ -6,8 +6,15 @@
   font-family: var(--font-mono);
 }
 
+/* Wrapping is what keeps the last tabs reachable. In a narrow column the five
+   tabs are wider than the panel, and the overflow scrolls .detail-panel-body,
+   which carries that tab's own panel out of the column with it. In a 756px
+   viewport (what a headless run gets) Properties and Violations then sit under
+   the neighbouring panel, where neither a person nor the fuzzer can click
+   them. */
 .tabs-header {
   display: flex;
+  flex-wrap: wrap;
   gap: 0;
   border-bottom: 1px solid var(--border);
   flex: 0 0 auto;