test: full test-suite refactor sweep (#61)

* chore(test): start test-suite refactor sweep

* test(ltl): pin exact multi-obligation residual AST

* test(ltl): table-test finalize Kleene connective combinations

* test(ltl): pin reduce over pending inner for bound, Or, Not

* test(ltl): marshal bounded Always steps/duration/deadline

* test(verifier): cover LTL combinator verdict transitions and within unit panic

* test(verifier): table-test DecodeAction kinds and lastAction field exposure

* test(verifier): assert WithPlatform(ios) reaches the picker host and key pool

* test(verifier): widen weighted-selection assertion to a 5x skew margin

* test(verifier): un-skip ax-find round trip with a committed tree fixture

* test(runner): pin isWDADrop to sidecar reconnect-failed message origin

* test(runner): assert PressKey/Wait trace encoding records kind-specific fields

* test(runner): cover RenderSummary unsupported-verbs surfacing branch

* test(trace): set Hierarchy in round-trip and lock lossy Tree contract

Also add a -race concurrent WriteStep test that asserts N well-formed JSONL lines, catching torn lines if the writer mutex is dropped.

* test(trace): round-trip witnesses/changes/metrics/exceptions, pin step-0 witness

* test(trace): document ViolationsAreGreppable grep contract and lock-free WriteScreenshot

* test(hierarchy): cover invalid-JSON and malformed-bounds parser paths

* test(trace): guard writer mutex via WriteStep/Close race on w.file

* test(replay): drop unfailable assets and devproxy assertions

* test(replay): cache reuses on equal mtime, reparses after append

* test(replay): violation marker falls back to detection step when attributed missing

* test(replay): corrupt meta/trace dirs return 500 with error body

* test(replay): SSE client receives runs.changed after a broadcast

* test(replay): Run coalesces creates, ignores write/chmod, closes subs on cancel

* fix(sidecar): synchronize health fixture writes and exercise healthError

* test(sidecar): cover swipe/longpress/doubletap/erase/presskey/metrics/logs translations

* test(sidecar): cover DoubleTapSelector composition and mid-gesture cancel

* test(sidecar): assert gRPC error status surfaces from action RPC

* fix(chrome): route action methods through runCtx so caller cancellation aborts CDP

* fix(chrome): route hierarchy/screenshot/waitidle/metrics through runCtx

* refactor(ios): extract pure simctl JSON parsers

* refactor(ios): add command-runner seams for EnsureSimulator

* test(ios): table-test simctl parsers and EnsureSimulator seams

* test(sidecarassets): cover placeholder build path

* test(sidecarassets): assert reuse via sentinel bytes not mtime

* test(bundler): cover properties-only spec registration

* refactor(testrun): extract prepareBundleInputs from Execute

* test(testrun): cover prepareBundleInputs aliases and missing-runtime error

* test(testrun): table-test resolveRuntimeSibling search edges

* test(testrun): exact-output tests for progressHandler line format

* fix(cmd): point bundle-check aliases at pkg/spec/src

* test(cmd): smoke-test bundle-check resolves spec aliases

* test(cmd): table-test hier-check parse and FindAll on fixture

* test(cmd): unit-test buildBrowseURL deep-link vs root

* test(cmd): drop flaky TestRun_Doctor that launched real Chromium

* test(cmd): pin pipeline error to bundle resolution on web platform

* test(replay-ui): add bun test script

* ci(replay-ui): run bun test via make web-test target

* ci(replay-ui): point bun cache key at replay-ui/bun.lock

* test(replay-ui): exercise real URL encoding and non-ok throw in getJson

* refactor(replay-ui): extract snapshot flatten/getAtPath into lib module

* test(replay-ui): pin snapshot flatten/getAtPath path round-trip

* refactor(replay-ui): extract action selector/format into lib module

* test(replay-ui): pin action selector parse and row formatting

* refactor(replay-ui): share one statusFor between panels

* refactor(replay-ui): extract run-history derivation into lib module

* test(replay-ui): pin shared statusFor precedence and ordering

* test(replay-ui): pin run-history derivation alignment

* refactor(replay-ui): export clampIndex for testing

* refactor(replay-ui): extract keyboard-nav dispatch into pure module

* refactor(replay-ui): extract metrics formatters into lib module

* test(replay-ui): pin clampIndex step boundaries

* test(replay-ui): pin keyboard-nav ownership and key routing

* test(replay-ui): pin metrics formatters and path gap handling

* refactor(sidecar): expose device-output parsers as internal for testing

* test(sidecar): table-test device-output parsers against malformed input

* test(sidecar): cover logcat parsing year inference and line skipping

* test(sidecar): pin pressKey keycode mapping and unknown-key rejection

* test(sidecar): metrics bundleId falls back to launched app and honors override

* test(sidecar): loosen deadline upper bound to tolerate slow CI scheduling

* test(web-runtime): export selector builders for unit tests

* test(web-runtime): guard sanitize cycle, function, and depth limits

* test(web-runtime): table-test selector builder quoting and escaping

* test(sidecar): collapse scalar-forwarding RPC tests into a table

* test(replay-ui): dedup step/summary fixtures into shared module

* test(ios): collapse pickSimulator point-tests into a table

internal/verifier/ax_integration_test.go

@@ -60,12 +60,12 @@ func TestStateAxObjectSelectorTestTagAlias(t *testing.T) {
 }
 
 // TestStateAxFindWorks verifies that a Parse+PushSnapshot+extract round trip
-// actually lets the spec resolve selectors through state.ax.find.
-// Reads /tmp/live-dump.json (sidecar TreeNode JSON format); skipped if absent.
+// actually lets the spec resolve selectors through state.ax.find. Reads a
+// committed sidecar TreeNode JSON fixture so the round trip always runs.
 func TestStateAxFindWorks(t *testing.T) {
-	jsonText, err := os.ReadFile("/tmp/live-dump.json")
+	jsonText, err := os.ReadFile("testdata/ax_find_tree.json")
 	if err != nil {
-		t.Skip("live-dump.json not present")
+		t.Skip("ax_find_tree.json fixture unreadable")
 	}
 	tree, err := hierarchy.Parse(string(jsonText))
 	if err != nil {

internal/verifier/combinator_test.go

@@ -0,0 +1,118 @@
+package verifier
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/priyanshujain/sanderling/internal/ltl"
+)
+
+// TestCombinators_VerdictTransitions loads real specs through the goja runtime
+// using the chainable LTL combinators (implies/or/and/not + now + within steps)
+// and drives them across snapshots. Bug class: a user spec built from these
+// combinators silently mis-evaluates (wrong verdict at the wrong step).
+func TestCombinators_VerdictTransitions(t *testing.T) {
+	const heads = `
+globalThis.p = __sanderling__.extract(state => state.snapshots["p"] ?? false, "p");
+globalThis.q = __sanderling__.extract(state => state.snapshots["q"] ?? false, "q");
+`
+	type step struct {
+		p, q string
+		want ltl.Verdict
+	}
+	cases := []struct {
+		name  string
+		body  string
+		steps []step
+	}{
+		{
+			name: "implies",
+			body: `globalThis.properties = { r: __sanderling__.always(__sanderling__.now(()=>p.current).implies(__sanderling__.now(()=>q.current))) };`,
+			steps: []step{
+				{"false", "false", ltl.VerdictHolds}, // antecedent false -> vacuously holds
+				{"true", "true", ltl.VerdictHolds},
+				{"true", "false", ltl.VerdictViolated},  // p true, q false
+				{"false", "false", ltl.VerdictViolated}, // sticky
+			},
+		},
+		{
+			name: "or",
+			body: `globalThis.properties = { r: __sanderling__.always(__sanderling__.now(()=>p.current).or(__sanderling__.now(()=>q.current))) };`,
+			steps: []step{
+				{"true", "false", ltl.VerdictHolds},
+				{"false", "true", ltl.VerdictHolds},
+				{"false", "false", ltl.VerdictViolated},
+			},
+		},
+		{
+			name: "and",
+			body: `globalThis.properties = { r: __sanderling__.always(__sanderling__.now(()=>p.current).and(__sanderling__.now(()=>q.current))) };`,
+			steps: []step{
+				{"true", "true", ltl.VerdictHolds},
+				{"true", "false", ltl.VerdictViolated}, // one conjunct false
+			},
+		},
+		{
+			name: "not",
+			body: `globalThis.properties = { r: __sanderling__.always(__sanderling__.now(()=>p.current).not()) };`,
+			steps: []step{
+				{"false", "false", ltl.VerdictHolds},
+				{"true", "false", ltl.VerdictViolated},
+			},
+		},
+		{
+			name: "within_steps_deadline",
+			body: `globalThis.properties = { r: __sanderling__.always(__sanderling__.eventually(()=>p.current).within(2,'steps')) };`,
+			steps: []step{
+				{"false", "false", ltl.VerdictPending},  // obligation open
+				{"false", "false", ltl.VerdictViolated}, // deadline blown, never fired
+			},
+		},
+		{
+			name: "within_steps_satisfied",
+			body: `globalThis.properties = { r: __sanderling__.always(__sanderling__.eventually(()=>p.current).within(2,'steps')) };`,
+			steps: []step{
+				{"false", "false", ltl.VerdictPending},
+				{"true", "false", ltl.VerdictHolds}, // fired before deadline
+			},
+		},
+	}
+
+	for _, testCase := range cases {
+		t.Run(testCase.name, func(t *testing.T) {
+			verifier := newVerifier(t)
+			mustLoad(t, verifier, heads+testCase.body)
+			for i, s := range testCase.steps {
+				if err := verifier.PushSnapshot(SnapshotInput{
+					Snapshots: Snapshots{"p": json.RawMessage(s.p), "q": json.RawMessage(s.q)},
+					StepIndex: i + 1,
+				}); err != nil {
+					t.Fatal(err)
+				}
+				if got := verifier.EvaluateProperties()["r"]; got != s.want {
+					t.Errorf("step %d (p=%s q=%s): got %v, want %v", i+1, s.p, s.q, got, s.want)
+				}
+			}
+		})
+	}
+}
+
+// TestWithin_InvalidUnitPanics verifies an unrecognized within() unit surfaces
+// as a spec load error rather than silently constructing an unbounded
+// eventually. Bug class: a typo'd unit ('ms'/'s') would otherwise build a
+// formula that never enforces its deadline.
+func TestWithin_InvalidUnitPanics(t *testing.T) {
+	for _, unit := range []string{"ms", "s", "minutes", ""} {
+		verifier := newVerifier(t)
+		src := `globalThis.properties = { r: __sanderling__.always(__sanderling__.eventually(()=>true).within(2,'` + unit + `')) };`
+		err := verifier.Load(src)
+		if err == nil {
+			t.Errorf("unit %q: expected load error, got nil", unit)
+			continue
+		}
+		if !strings.Contains(err.Error(), "within unit must be") {
+			t.Errorf("unit %q: error = %v, want within-unit diagnostic", unit, err)
+		}
+	}
+}

internal/verifier/marshal_test.go

@@ -0,0 +1,149 @@
+package verifier
+
+import (
+	"encoding/json"
+	"errors"
+	"testing"
+
+	"github.com/dop251/goja"
+)
+
+// TestDecodeAction_AllKinds decodes the flat camelCase wire contract for every
+// action kind from raw JSON. Bug class: an action field rename or a missing
+// case silently mangles or drops actions on the decode side.
+func TestDecodeAction_AllKinds(t *testing.T) {
+	cases := []struct {
+		name string
+		raw  string
+		want Action
+	}{
+		{
+			name: "Tap",
+			raw:  `{"kind":"Tap","selector":"id:btn","x":10,"y":20}`,
+			want: Action{Kind: ActionKindTap, On: "id:btn", X: 10, Y: 20},
+		},
+		{
+			name: "DoubleTap",
+			raw:  `{"kind":"DoubleTap","selector":"id:btn","x":1,"y":2}`,
+			want: Action{Kind: ActionKindDoubleTap, On: "id:btn", X: 1, Y: 2},
+		},
+		{
+			name: "LongPress",
+			raw:  `{"kind":"LongPress","selector":"id:btn","x":3,"y":4}`,
+			want: Action{Kind: ActionKindLongPress, On: "id:btn", X: 3, Y: 4},
+		},
+		{
+			name: "InputText",
+			raw:  `{"kind":"InputText","selector":"id:field","text":"hi","x":5,"y":6}`,
+			want: Action{Kind: ActionKindInputText, On: "id:field", Text: "hi", X: 5, Y: 6},
+		},
+		{
+			name: "Swipe",
+			raw:  `{"kind":"Swipe","fromX":1,"fromY":2,"toX":3,"toY":4,"durationMillis":250}`,
+			want: Action{Kind: ActionKindSwipe, FromX: 1, FromY: 2, ToX: 3, ToY: 4, DurationMillis: 250},
+		},
+		{
+			name: "Scroll",
+			raw:  `{"kind":"Scroll","direction":"down","fromX":1,"fromY":2,"toX":3,"toY":4,"durationMillis":100}`,
+			want: Action{Kind: ActionKindScroll, Direction: "down", FromX: 1, FromY: 2, ToX: 3, ToY: 4, DurationMillis: 100},
+		},
+		{
+			name: "PressKey",
+			raw:  `{"kind":"PressKey","key":"back"}`,
+			want: Action{Kind: ActionKindPressKey, Key: "back"},
+		},
+		{
+			name: "Wait",
+			raw:  `{"kind":"Wait","durationMillis":500}`,
+			want: Action{Kind: ActionKindWait, DurationMillis: 500},
+		},
+	}
+	for _, testCase := range cases {
+		t.Run(testCase.name, func(t *testing.T) {
+			got, err := DecodeAction(json.RawMessage(testCase.raw))
+			if err != nil {
+				t.Fatalf("DecodeAction(%s): %v", testCase.raw, err)
+			}
+			if got != testCase.want {
+				t.Errorf("DecodeAction(%s) = %+v, want %+v", testCase.raw, got, testCase.want)
+			}
+		})
+	}
+}
+
+// TestDecodeAction_NullAndUnknown verifies a null/empty payload reports
+// ErrNoAction and an unrecognized kind returns an error. Bug class: an unknown
+// kind silently decoding to a zero Action (a no-op the runner dispatches).
+func TestDecodeAction_NullAndUnknown(t *testing.T) {
+	for _, raw := range []string{"null", ""} {
+		if _, err := DecodeAction(json.RawMessage(raw)); !errors.Is(err, ErrNoAction) {
+			t.Errorf("DecodeAction(%q): err = %v, want ErrNoAction", raw, err)
+		}
+	}
+	if _, err := DecodeAction(json.RawMessage(`{"kind":"Teleport"}`)); err == nil {
+		t.Error("DecodeAction(unknown kind): err = nil, want error")
+	}
+}
+
+// TestLastActionObject_ExposesKindSpecificFields pushes a LastAction of each
+// kind and asserts the JS-side lastAction object the spec reads carries the
+// kind plus that kind's fields (on/from/direction/key). Bug class: specs
+// gating on lastAction see wrong or missing fields.
+func TestLastActionObject_ExposesKindSpecificFields(t *testing.T) {
+	verifier := newVerifier(t)
+	mustLoad(t, verifier, `
+		globalThis.last = __sanderling__.extract(state => state.lastAction);
+	`)
+
+	read := func(t *testing.T, action *Action) *goja.Object {
+		t.Helper()
+		if err := verifier.PushSnapshot(SnapshotInput{Snapshots: Snapshots{}, LastAction: action}); err != nil {
+			t.Fatal(err)
+		}
+		current := verifier.runtime.GlobalObject().Get("last").ToObject(verifier.runtime).Get("current")
+		if goja.IsNull(current) || goja.IsUndefined(current) {
+			t.Fatal("lastAction current is null/undefined")
+		}
+		return current.ToObject(verifier.runtime)
+	}
+
+	t.Run("Tap", func(t *testing.T) {
+		obj := read(t, &Action{Kind: ActionKindTap, On: "id:btn"})
+		if obj.Get("kind").String() != "Tap" {
+			t.Errorf("kind = %q, want Tap", obj.Get("kind"))
+		}
+		if obj.Get("on").String() != "id:btn" {
+			t.Errorf("on = %q, want id:btn", obj.Get("on"))
+		}
+	})
+
+	t.Run("Swipe", func(t *testing.T) {
+		obj := read(t, &Action{Kind: ActionKindSwipe, FromX: 1, FromY: 2, ToX: 3, ToY: 4})
+		from := obj.Get("from").ToObject(verifier.runtime)
+		if from.Get("x").ToInteger() != 1 || from.Get("y").ToInteger() != 2 {
+			t.Errorf("from = (%v,%v), want (1,2)", from.Get("x"), from.Get("y"))
+		}
+		to := obj.Get("to").ToObject(verifier.runtime)
+		if to.Get("x").ToInteger() != 3 || to.Get("y").ToInteger() != 4 {
+			t.Errorf("to = (%v,%v), want (3,4)", to.Get("x"), to.Get("y"))
+		}
+	})
+
+	t.Run("Scroll", func(t *testing.T) {
+		obj := read(t, &Action{Kind: ActionKindScroll, Direction: "down", FromX: 5, FromY: 6})
+		if obj.Get("direction").String() != "down" {
+			t.Errorf("direction = %q, want down", obj.Get("direction"))
+		}
+		from := obj.Get("from").ToObject(verifier.runtime)
+		if from.Get("x").ToInteger() != 5 || from.Get("y").ToInteger() != 6 {
+			t.Errorf("from = (%v,%v), want (5,6)", from.Get("x"), from.Get("y"))
+		}
+	})
+
+	t.Run("PressKey", func(t *testing.T) {
+		obj := read(t, &Action{Kind: ActionKindPressKey, Key: "back"})
+		if obj.Get("key").String() != "back" {
+			t.Errorf("key = %q, want back", obj.Get("key"))
+		}
+	})
+}

internal/verifier/testdata/ax_find_tree.json

@@ -0,0 +1,15 @@
+{
+  "attributes": {"resource-id": "com.example:id/root", "bounds": "[0,0,1080,2340]"},
+  "children": [
+    {
+      "attributes": {"resource-id": "com.example:id/header", "bounds": "[0,0,1080,200]"},
+      "children": []
+    },
+    {
+      "attributes": {"resource-id": "com.example:id/select_language", "text": "Select language", "bounds": "[40,400,1040,520]"},
+      "clickable": true,
+      "enabled": true,
+      "children": []
+    }
+  ]
+}

internal/verifier/verifier_test.go

@@ -339,8 +339,11 @@ func TestNextAction_WeightedSelectsByWeight(t *testing.T) {
 			awayCount++
 		}
 	}
-	if awayCount <= homeCount {
-		t.Errorf("expected away-skewed distribution, got home=%d away=%d", homeCount, awayCount)
+	// Weights are 99:1, so away must dominate by a wide margin. Requiring a 5x
+	// skew (rather than a bare >) keeps the assertion robust to harmless picker
+	// reshuffles while still failing if the weight is ignored or inverted.
+	if awayCount <= 5*homeCount {
+		t.Errorf("expected away to outweigh home by >5x (weights 99:1), got home=%d away=%d", homeCount, awayCount)
 	}
 }
 
@@ -1296,3 +1299,46 @@ func TestUnsupportedVerbs_CollectedDedupedInOrder(t *testing.T) {
 		t.Errorf("UnsupportedVerbs = %v, want %v", got, want)
 	}
 }
+
+// TestWithPlatform_IOSReachesPicker asserts WithPlatform("ios") is plumbed all
+// the way to the host binding the shared picker reads (host.platform()), and
+// that a platform-gated builtin (pressKeys) still resolves on iOS, drawing from
+// the native key pool. Bug class: the platform option is dropped before the
+// picker, so iOS silently runs the android (default) verb matrix / key pool.
+func TestWithPlatform_IOSReachesPicker(t *testing.T) {
+	verifier := newVerifier(t, WithPlatform("ios"))
+
+	platform, ok := goja.AssertFunction(
+		verifier.runtime.GlobalObject().Get("__sanderlingHost__").
+			ToObject(verifier.runtime).Get("platform"),
+	)
+	if !ok {
+		t.Fatal("platform host binding missing")
+	}
+	value, err := platform(goja.Undefined())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if value.String() != "ios" {
+		t.Errorf("host.platform() = %q, want ios", value.String())
+	}
+
+	loadActionSpec(t, verifier, `
+		import { pressKeys } from "@sanderling/spec";
+		globalThis.actions = pressKeys;
+	`)
+	if err := verifier.PushSnapshot(SnapshotInput{Snapshots: Snapshots{}}); err != nil {
+		t.Fatal(err)
+	}
+	action, err := verifier.NextAction()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if action.Kind != ActionKindPressKey {
+		t.Fatalf("kind = %v, want PressKey", action.Kind)
+	}
+	// iOS draws from NATIVE_PRESS_KEYS (corpus.ts), which contains only "back".
+	if action.Key != "back" {
+		t.Errorf("key = %q, want back (native press-key pool)", action.Key)
+	}
+}