test: full test-suite refactor sweep (#61)

* chore(test): start test-suite refactor sweep

* test(ltl): pin exact multi-obligation residual AST

* test(ltl): table-test finalize Kleene connective combinations

* test(ltl): pin reduce over pending inner for bound, Or, Not

* test(ltl): marshal bounded Always steps/duration/deadline

* test(verifier): cover LTL combinator verdict transitions and within unit panic

* test(verifier): table-test DecodeAction kinds and lastAction field exposure

* test(verifier): assert WithPlatform(ios) reaches the picker host and key pool

* test(verifier): widen weighted-selection assertion to a 5x skew margin

* test(verifier): un-skip ax-find round trip with a committed tree fixture

* test(runner): pin isWDADrop to sidecar reconnect-failed message origin

* test(runner): assert PressKey/Wait trace encoding records kind-specific fields

* test(runner): cover RenderSummary unsupported-verbs surfacing branch

* test(trace): set Hierarchy in round-trip and lock lossy Tree contract

Also add a -race concurrent WriteStep test that asserts N well-formed JSONL lines, catching torn lines if the writer mutex is dropped.

* test(trace): round-trip witnesses/changes/metrics/exceptions, pin step-0 witness

* test(trace): document ViolationsAreGreppable grep contract and lock-free WriteScreenshot

* test(hierarchy): cover invalid-JSON and malformed-bounds parser paths

* test(trace): guard writer mutex via WriteStep/Close race on w.file

* test(replay): drop unfailable assets and devproxy assertions

* test(replay): cache reuses on equal mtime, reparses after append

* test(replay): violation marker falls back to detection step when attributed missing

* test(replay): corrupt meta/trace dirs return 500 with error body

* test(replay): SSE client receives runs.changed after a broadcast

* test(replay): Run coalesces creates, ignores write/chmod, closes subs on cancel

* fix(sidecar): synchronize health fixture writes and exercise healthError

* test(sidecar): cover swipe/longpress/doubletap/erase/presskey/metrics/logs translations

* test(sidecar): cover DoubleTapSelector composition and mid-gesture cancel

* test(sidecar): assert gRPC error status surfaces from action RPC

* fix(chrome): route action methods through runCtx so caller cancellation aborts CDP

* fix(chrome): route hierarchy/screenshot/waitidle/metrics through runCtx

* refactor(ios): extract pure simctl JSON parsers

* refactor(ios): add command-runner seams for EnsureSimulator

* test(ios): table-test simctl parsers and EnsureSimulator seams

* test(sidecarassets): cover placeholder build path

* test(sidecarassets): assert reuse via sentinel bytes not mtime

* test(bundler): cover properties-only spec registration

* refactor(testrun): extract prepareBundleInputs from Execute

* test(testrun): cover prepareBundleInputs aliases and missing-runtime error

* test(testrun): table-test resolveRuntimeSibling search edges

* test(testrun): exact-output tests for progressHandler line format

* fix(cmd): point bundle-check aliases at pkg/spec/src

* test(cmd): smoke-test bundle-check resolves spec aliases

* test(cmd): table-test hier-check parse and FindAll on fixture

* test(cmd): unit-test buildBrowseURL deep-link vs root

* test(cmd): drop flaky TestRun_Doctor that launched real Chromium

* test(cmd): pin pipeline error to bundle resolution on web platform

* test(replay-ui): add bun test script

* ci(replay-ui): run bun test via make web-test target

* ci(replay-ui): point bun cache key at replay-ui/bun.lock

* test(replay-ui): exercise real URL encoding and non-ok throw in getJson

* refactor(replay-ui): extract snapshot flatten/getAtPath into lib module

* test(replay-ui): pin snapshot flatten/getAtPath path round-trip

* refactor(replay-ui): extract action selector/format into lib module

* test(replay-ui): pin action selector parse and row formatting

* refactor(replay-ui): share one statusFor between panels

* refactor(replay-ui): extract run-history derivation into lib module

* test(replay-ui): pin shared statusFor precedence and ordering

* test(replay-ui): pin run-history derivation alignment

* refactor(replay-ui): export clampIndex for testing

* refactor(replay-ui): extract keyboard-nav dispatch into pure module

* refactor(replay-ui): extract metrics formatters into lib module

* test(replay-ui): pin clampIndex step boundaries

* test(replay-ui): pin keyboard-nav ownership and key routing

* test(replay-ui): pin metrics formatters and path gap handling

* refactor(sidecar): expose device-output parsers as internal for testing

* test(sidecar): table-test device-output parsers against malformed input

* test(sidecar): cover logcat parsing year inference and line skipping

* test(sidecar): pin pressKey keycode mapping and unknown-key rejection

* test(sidecar): metrics bundleId falls back to launched app and honors override

* test(sidecar): loosen deadline upper bound to tolerate slow CI scheduling

* test(web-runtime): export selector builders for unit tests

* test(web-runtime): guard sanitize cycle, function, and depth limits

* test(web-runtime): table-test selector builder quoting and escaping

* test(sidecar): collapse scalar-forwarding RPC tests into a table

* test(replay-ui): dedup step/summary fixtures into shared module

* test(ios): collapse pickSimulator point-tests into a table

internal/driver/sidecar/client_test.go

@@ -9,6 +9,8 @@ import (
 	"time"
 
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 
 	driverpb "github.com/priyanshujain/sanderling/proto/driverpb"
 )
@@ -33,7 +35,18 @@ type fakeServer struct {
 	imageWidth       int32
 	imageHeight      int32
 
+	longPresses    []int32
+	doubleTaps     []int32
+	swipes         []*driverpb.SwipeRequest
+	erases         []int32
+	pressedKeys    []string
+	metricsBundles []string
+	logsRequests   []*driverpb.RecentLogsRequest
+	logEntries     []*driverpb.LogEntry
+	metrics        *driverpb.MetricsResponse
+
 	healthError error
+	tapError    error
 }
 
 func (s *fakeServer) Health(_ context.Context, _ *driverpb.Empty) (*driverpb.HealthStatus, error) {
@@ -68,6 +81,9 @@ func (s *fakeServer) Terminate(_ context.Context, _ *driverpb.Empty) (*driverpb.
 func (s *fakeServer) Tap(_ context.Context, point *driverpb.Point) (*driverpb.Empty, error) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
+	if s.tapError != nil {
+		return nil, s.tapError
+	}
 	s.taps = append(s.taps, point.GetX(), point.GetY())
 	return &driverpb.Empty{}, nil
 }
@@ -93,6 +109,58 @@ func (s *fakeServer) WaitForIdle(_ context.Context, duration *driverpb.Duration)
 	return &driverpb.Empty{}, nil
 }
 
+func (s *fakeServer) LongPress(_ context.Context, point *driverpb.Point) (*driverpb.Empty, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+	s.longPresses = append(s.longPresses, point.GetX(), point.GetY())
+	return &driverpb.Empty{}, nil
+}
+
+func (s *fakeServer) DoubleTap(_ context.Context, point *driverpb.Point) (*driverpb.Empty, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+	s.doubleTaps = append(s.doubleTaps, point.GetX(), point.GetY())
+	return &driverpb.Empty{}, nil
+}
+
+func (s *fakeServer) Swipe(_ context.Context, request *driverpb.SwipeRequest) (*driverpb.Empty, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+	s.swipes = append(s.swipes, request)
+	return &driverpb.Empty{}, nil
+}
+
+func (s *fakeServer) EraseText(_ context.Context, request *driverpb.EraseTextRequest) (*driverpb.Empty, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+	s.erases = append(s.erases, request.GetCharacterCount())
+	return &driverpb.Empty{}, nil
+}
+
+func (s *fakeServer) PressKey(_ context.Context, request *driverpb.PressKeyRequest) (*driverpb.Empty, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+	s.pressedKeys = append(s.pressedKeys, request.GetKey())
+	return &driverpb.Empty{}, nil
+}
+
+func (s *fakeServer) RecentLogs(_ context.Context, request *driverpb.RecentLogsRequest) (*driverpb.LogEntries, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+	s.logsRequests = append(s.logsRequests, request)
+	return &driverpb.LogEntries{Entries: s.logEntries}, nil
+}
+
+func (s *fakeServer) Metrics(_ context.Context, request *driverpb.MetricsRequest) (*driverpb.MetricsResponse, error) {
+	s.mutex.Lock()
+	defer s.mutex.Unlock()
+	s.metricsBundles = append(s.metricsBundles, request.GetBundleId())
+	if s.metrics != nil {
+		return s.metrics, nil
+	}
+	return &driverpb.MetricsResponse{}, nil
+}
+
 func (s *fakeServer) Hierarchy(_ context.Context, _ *driverpb.Empty) (*driverpb.HierarchyJSON, error) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
@@ -180,7 +248,9 @@ func TestClient_WaitForHealth_PollsUntilReady(t *testing.T) {
 
 func TestClient_WaitForHealth_HonorsContext(t *testing.T) {
 	state := newHarness(t)
+	state.fake.mutex.Lock()
 	state.fake.healthReady = false
+	state.fake.mutex.Unlock()
 	client, err := Dial(state.address)
 	if err != nil {
 		t.Fatal(err)
@@ -195,6 +265,22 @@ func TestClient_WaitForHealth_HonorsContext(t *testing.T) {
 	}
 }
 
+func TestClient_Health_SurfacesRPCError(t *testing.T) {
+	state := newHarness(t)
+	state.fake.mutex.Lock()
+	state.fake.healthError = status.Error(codes.Unavailable, "boom")
+	state.fake.mutex.Unlock()
+	client, err := Dial(state.address)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer client.Close()
+
+	if _, err := client.Health(context.Background()); err == nil {
+		t.Fatal("expected Health to surface the RPC error, got nil")
+	}
+}
+
 func TestClient_LaunchAndTerminate(t *testing.T) {
 	state := newHarness(t)
 	client, _ := Dial(state.address)
@@ -234,16 +320,47 @@ func TestClient_TapAndTapSelector(t *testing.T) {
 	}
 }
 
-func TestClient_InputText(t *testing.T) {
-	state := newHarness(t)
-	client, _ := Dial(state.address)
-	defer client.Close()
-
-	if err := client.InputText(context.Background(), "hello world"); err != nil {
-		t.Fatal(err)
+// TestClient_ScalarForwardingRPCs pins that each single-payload RPC forwards
+// its argument unchanged to the captured request: a dropped/mistyped text,
+// idle duration, erase count, or logical key would change device behavior with
+// no other field to disambiguate it.
+func TestClient_ScalarForwardingRPCs(t *testing.T) {
+	tests := []struct {
+		name  string
+		call  func(c *Client) error
+		check func(t *testing.T, s *fakeServer)
+	}{
+		{"InputText", func(c *Client) error { return c.InputText(context.Background(), "hello world") }, func(t *testing.T, s *fakeServer) {
+			if len(s.inputs) != 1 || s.inputs[0] != "hello world" {
+				t.Errorf("inputs wrong: %v", s.inputs)
+			}
+		}},
+		{"WaitForIdle", func(c *Client) error { return c.WaitForIdle(context.Background(), 250*time.Millisecond) }, func(t *testing.T, s *fakeServer) {
+			if len(s.idleMillis) != 1 || s.idleMillis[0] != 250 {
+				t.Errorf("idleMillis wrong: %v", s.idleMillis)
+			}
+		}},
+		{"EraseText", func(c *Client) error { return c.EraseText(context.Background(), 7) }, func(t *testing.T, s *fakeServer) {
+			if len(s.erases) != 1 || s.erases[0] != 7 {
+				t.Errorf("erase count wrong: %v", s.erases)
+			}
+		}},
+		{"PressKey", func(c *Client) error { return c.PressKey(context.Background(), "back") }, func(t *testing.T, s *fakeServer) {
+			if len(s.pressedKeys) != 1 || s.pressedKeys[0] != "back" {
+				t.Errorf("pressed key wrong: %v", s.pressedKeys)
+			}
+		}},
 	}
-	if len(state.fake.inputs) != 1 || state.fake.inputs[0] != "hello world" {
-		t.Errorf("inputs wrong: %v", state.fake.inputs)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			state := newHarness(t)
+			client, _ := Dial(state.address)
+			defer client.Close()
+			if err := tt.call(client); err != nil {
+				t.Fatal(err)
+			}
+			tt.check(t, state.fake)
+		})
 	}
 }
 
@@ -286,15 +403,191 @@ func TestClient_SnapshotPairsHierarchyAndScreenshot(t *testing.T) {
 	}
 }
 
-func TestClient_WaitForIdleForwardsMillis(t *testing.T) {
+// TestClient_RPCErrorSurfaces is the representative check that a gRPC error
+// status from the sidecar propagates out of an action RPC instead of being
+// swallowed into a nil error. Per-method coverage of the sidecar-side status
+// mapping lives in the sidecar server tests.
+func TestClient_RPCErrorSurfaces(t *testing.T) {
+	state := newHarness(t)
+	state.fake.mutex.Lock()
+	state.fake.tapError = status.Error(codes.Internal, "device offline")
+	state.fake.mutex.Unlock()
+	client, _ := Dial(state.address)
+	defer client.Close()
+
+	err := client.Tap(context.Background(), 1, 2)
+	if err == nil {
+		t.Fatal("expected Tap to surface the gRPC error, got nil")
+	}
+	if status.Code(err) != codes.Internal {
+		t.Errorf("expected INTERNAL code, got %v", status.Code(err))
+	}
+}
+
+// TestClient_DoubleTapSelectorFiresTwice confirms the selector fallback
+// composes exactly two taps; a broken composition would single-tap and the
+// double-tap gesture would silently degrade.
+func TestClient_DoubleTapSelectorFiresTwice(t *testing.T) {
 	state := newHarness(t)
 	client, _ := Dial(state.address)
 	defer client.Close()
 
-	if err := client.WaitForIdle(context.Background(), 250*time.Millisecond); err != nil {
+	if err := client.DoubleTapSelector(context.Background(), "id:home"); err != nil {
 		t.Fatal(err)
 	}
-	if len(state.fake.idleMillis) != 1 || state.fake.idleMillis[0] != 250 {
-		t.Errorf("idleMillis wrong: %v", state.fake.idleMillis)
+	state.fake.mutex.Lock()
+	defer state.fake.mutex.Unlock()
+	if len(state.fake.tapSelectors) != 2 || state.fake.tapSelectors[0] != "id:home" || state.fake.tapSelectors[1] != "id:home" {
+		t.Errorf("expected two taps on id:home, got %v", state.fake.tapSelectors)
+	}
+}
+
+// TestClient_DoubleTapSelectorCancelBetweenTaps confirms a context cancelled
+// during the inter-tap gap fires exactly one tap and returns ctx.Err() - it
+// must neither double-fire nor swallow the cancellation.
+func TestClient_DoubleTapSelectorCancelBetweenTaps(t *testing.T) {
+	state := newHarness(t)
+	client, _ := Dial(state.address)
+	defer client.Close()
+
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		for {
+			state.fake.mutex.Lock()
+			n := len(state.fake.tapSelectors)
+			state.fake.mutex.Unlock()
+			if n >= 1 {
+				cancel()
+				return
+			}
+		}
+	}()
+
+	err := client.DoubleTapSelector(ctx, "id:home")
+	if err == nil || !strings.Contains(err.Error(), "context") {
+		t.Fatalf("expected context error, got %v", err)
+	}
+	state.fake.mutex.Lock()
+	defer state.fake.mutex.Unlock()
+	if len(state.fake.tapSelectors) != 1 {
+		t.Errorf("expected exactly one tap before cancellation, got %d", len(state.fake.tapSelectors))
+	}
+}
+
+// TestClient_SwipeForwardsEndpointsInOrder pins down that From keeps the start
+// point and To the end point. A from/to transposition would send the swipe in
+// the reverse direction on-device while every other assertion still passed.
+func TestClient_SwipeForwardsEndpointsInOrder(t *testing.T) {
+	state := newHarness(t)
+	client, _ := Dial(state.address)
+	defer client.Close()
+
+	if err := client.Swipe(context.Background(), 10, 20, 300, 400, 150*time.Millisecond); err != nil {
+		t.Fatal(err)
+	}
+	if len(state.fake.swipes) != 1 {
+		t.Fatalf("expected 1 swipe, got %d", len(state.fake.swipes))
+	}
+	got := state.fake.swipes[0]
+	if got.GetFrom().GetX() != 10 || got.GetFrom().GetY() != 20 {
+		t.Errorf("from wrong: %+v", got.GetFrom())
+	}
+	if got.GetTo().GetX() != 300 || got.GetTo().GetY() != 400 {
+		t.Errorf("to wrong: %+v", got.GetTo())
+	}
+	if got.GetDurationMillis() != 150 {
+		t.Errorf("duration wrong: %d", got.GetDurationMillis())
+	}
+}
+
+// TestClient_PointRPCsForwardCoordinates guards against x/y swaps in the point
+// RPCs that have no other field to disambiguate which axis is which.
+func TestClient_PointRPCsForwardCoordinates(t *testing.T) {
+	tests := []struct {
+		name string
+		call func(c *Client) error
+		got  func(s *fakeServer) []int32
+	}{
+		{"LongPress", func(c *Client) error { return c.LongPress(context.Background(), 12, 34) }, func(s *fakeServer) []int32 { return s.longPresses }},
+		{"DoubleTap", func(c *Client) error { return c.DoubleTap(context.Background(), 12, 34) }, func(s *fakeServer) []int32 { return s.doubleTaps }},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			state := newHarness(t)
+			client, _ := Dial(state.address)
+			defer client.Close()
+			if err := tt.call(client); err != nil {
+				t.Fatal(err)
+			}
+			got := tt.got(state.fake)
+			if len(got) != 2 || got[0] != 12 || got[1] != 34 {
+				t.Errorf("coordinates wrong: %v", got)
+			}
+		})
+	}
+}
+
+// TestClient_MetricsMapsResponseFields catches CPU/heap/total being read off
+// the wrong proto field, which would mislabel a memory regression as CPU.
+func TestClient_MetricsMapsResponseFields(t *testing.T) {
+	state := newHarness(t)
+	state.fake.mutex.Lock()
+	state.fake.metrics = &driverpb.MetricsResponse{CpuPercent: 12.5, HeapBytes: 100, TotalMemoryBytes: 200}
+	state.fake.mutex.Unlock()
+	client, _ := Dial(state.address)
+	defer client.Close()
+
+	got, err := client.Metrics(context.Background(), "com.example")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.CPUPercent != 12.5 || got.HeapBytes != 100 || got.TotalMemoryBytes != 200 {
+		t.Errorf("metrics mapping wrong: %+v", got)
+	}
+	if len(state.fake.metricsBundles) != 1 || state.fake.metricsBundles[0] != "com.example" {
+		t.Errorf("bundle id not forwarded: %v", state.fake.metricsBundles)
+	}
+}
+
+// TestClient_RecentLogsSinceBranches pins both arms of the zero-time guard: a
+// zero time must send sinceMillis=0 (don't accidentally floor to epoch via
+// UnixMilli of a zero Time, which is a huge negative number), a real time must
+// forward its unix-millis. The response decode is checked alongside.
+func TestClient_RecentLogsSinceBranches(t *testing.T) {
+	realTime := time.UnixMilli(1_700_000_000_000)
+	tests := []struct {
+		name      string
+		since     time.Time
+		wantMilli int64
+	}{
+		{"zero time forwards 0", time.Time{}, 0},
+		{"real time forwards unix millis", realTime, realTime.UnixMilli()},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			state := newHarness(t)
+			state.fake.mutex.Lock()
+			state.fake.logEntries = []*driverpb.LogEntry{{UnixMillis: 5, Level: "E", Tag: "t", Message: "boom"}}
+			state.fake.mutex.Unlock()
+			client, _ := Dial(state.address)
+			defer client.Close()
+
+			logs, err := client.RecentLogs(context.Background(), tt.since, "E")
+			if err != nil {
+				t.Fatal(err)
+			}
+			state.fake.mutex.Lock()
+			defer state.fake.mutex.Unlock()
+			req := state.fake.logsRequests[len(state.fake.logsRequests)-1]
+			if req.GetSinceUnixMillis() != tt.wantMilli {
+				t.Errorf("sinceUnixMillis = %d, want %d", req.GetSinceUnixMillis(), tt.wantMilli)
+			}
+			if req.GetLevelAtLeast() != "E" {
+				t.Errorf("levelAtLeast = %q, want E", req.GetLevelAtLeast())
+			}
+			if len(logs) != 1 || logs[0].Level != "E" || logs[0].Message != "boom" || logs[0].UnixMillis != 5 || logs[0].Tag != "t" {
+				t.Errorf("decoded logs wrong: %+v", logs)
+			}
+		})
 	}
 }