4 Commits

Include renames

Author	SHA1	Message	Date
pj	f11bcd795e	test(folio): add commonTest source sets to core and shared	2026-08-15 20:30:59 +05:30
pj	b02e86b2e3	ci: dispatch workflows for folio and the replay ui (#73) ... * feat(runner): stop the step loop at the first violation on request * feat(testrun): report violations as a typed error under exit-on-violation * feat(cli): add --exit-on-violation and exit 2 when it fires * docs(cli): document --exit-on-violation, --max-steps, and exit codes * fix(web): enumerate and query across shadow roots in both producers * test(chrome): compare both producers on a shadow-dom parity page * test(browser): drive a canvas-under-shadow-root fixture end to end * fix(web): select the focused field inside a shadow root before typing * fix(web): report the pathname as the screen when there is no hash route * fix(web): settle on dom quiescence instead of returning at body ready * feat(replay-ui): add data-testid hooks the dogfood spec drives * feat(replay-ui): add the dogfood spec sanderling runs against the replay ui * fix(replay-ui): scope the screenshot property to the named state panel * chore(make): add per-platform sanderling build targets * ci: add dispatch workflows for folio and the replay ui * docs: describe the dispatch workflows and how to read a failure * ci(folio): give the ios leg its jdk, android sdk, just, and a clean app start * refactor(web): use max for the settle budget * ci: pin calibrated seeds, skip the flaky ios reinstall, bound every job * ci: authenticate and pin the buf setup step the anonymous release download hit the shared runner ip rate limit and failed the job with 'socket hang up' after three retries. * docs: record that canvas apps need a dom proxy to be text-fuzzable * fix(ios): bound lifecycle rpcs and claim the target device a launch the simulator rejects sent the xctest session into a recovery chain that answered minutes late or never, and the rpc had no deadline, so the run hung with no trace and no error. also take a per-udid flock: a second run's reinstall lands under the first's live automation session and wedges it. * docs(ci): correct the ios hang wording and note the device lock * refactor(verifier): derive the lastAction shape from one field list both hosts must show a spec the same lastAction. one ordered list now feeds the goja object and the json the web host installs, so they cannot drift. * fix(web): install lastAction in the page before extractors read it state.lastAction was hardcoded null on web, so every property reading it was silently vacuous: a correct property passed without ever firing. * fix(web): carry element identity on actions and fix findAll on paths an action's target was coordinates only, so a property matching on which element was acted upon could never fire. ax.findAll([a,b]) also returned nothing on web. * fix(chrome): wait out a route transition before sampling facts the tree stays byte-identical and quiet across a cross-fade, so both the quiet timer and the unchanged-tree escape called it settled mid-flight and extractors read two screens at once. * fix: bound the pre-run app launch launch happens before the runner starts, so --duration never covered it and a wedged driver hung with no trace and no error. * fix(folio): read balances from merged cards and treat unreadable as unknown compose for web merges the whole accountcard subtree, so the balance child never exists there and every card parsed as 0. the property then compared 0 to 0 and fired on any submit, which is a false positive generator. unknown is now null and null is vacuously true. * test(folio): cover merged-card parsing and unknown balances * ci(folio): make web an expect-the-bug leg the web runtime can observe the double submit now, so the health gate understates it. seed 1 finds it at step 109, 3 runs out of 3. * docs(ci): explain why a submit tap landing on home is the bug * fix(ios): read a StaticText's label as its text AXValue was the only source for text, but a StaticText carries its string in AXLabel, so nothing on screen had .text on ios: a spec reading it saw everything on android and nothing here. * docs(ci): correct the calibrated step ranges * fix(folio): stop convicting on arithmetic float64 cannot hold past 2^53 cents the gap between representable values is 128, so a real 1600-cent move reads back as something else and the equality is false for a healthy submit as readily as a double one. also match parseCents: a sign or an oversized amount is rejected, not read as an amount. * test(folio): pin the safe-integer guard and its boundary * docs: stop teaching the zero-default that caused a false alarm * docs: write down the silent-vacuity failure modes * feat(folio): tag the home total and the card transaction count the total was the only untagged node on the screen, so the spec had to sum cards and a clipped card broke the sum. * fix(folio): read the app's own total and refuse contaminated windows summing cards went null when one was clipped, and the null poisoned the carrier for the rest of the run. the balance window also spanned every transaction since the last home visit, so the property convicted on deltas it could not attribute: the old web witness was 3.16x the typed amount, not 2x. * test(folio): pin the window rules and the count invariant * fix(folio): never read a frame that shows two screens android dumps a cross-fade with both screens in the tree. the route said add-transaction while an unscoped find said home, so the oracle took a half-rendered total as fresh and convicted on a tap that committed nothing. one function now decides the route and returns null when the frame is ambiguous. * test(folio): cover transition frames, card readings and creation * fix(folio): only disambiguate counts that came from merged text the equal-length digit rule exists because web merges the card and an account named -1 makes '12' ambiguous. a dedicated count node has nothing to disambiguate, so applying it there threw away real evidence. * ci(folio): pin the recalibrated seeds and drop android to a health gate web 3 and ios 7 convict 3 runs out of 3 with an exactly 2x witness. android convicts 2 in 5 because the same seed does not walk the same trajectory there, so it proves the app runs instead. * docs(ci): describe the two properties and why android cannot convict * fix(android): wait out a route cross-fade before snapshotting the dump could hold two screens at once, and the runner refuses to act on such a tree, so a quarter of android steps applied no action and the count varied per run: the same seed never walked the same trajectory. the ios companion and the chrome driver already do this. * ci(folio): let the android leg run far enough to see its conviction * docs: only the repo owner merges * ci(folio): a thrown predicate is not a conviction exit 2 means the run recorded a violation, and a predicate that throws is recorded as one too. so was newAccountBalanceIsZero, an unrelated property in the same spec. the gate read the exit code and went green with detection dead. * ci: install idb-companion from its tap and stop interpolating inputs idb-companion is not in homebrew-core, so the ios leg died before it built anything. replay-ui expanded dispatch inputs into the shell. * docs: correct the snippets and numbers that drifted from the code * test(sidecar): pin that a slow read counts toward the stability streak * fix(web): read the page's extractors only on steps that count the page advances the spec's carriers when it evaluates, but the runner applied the result only on non-transitional steps. a discarded step moved the window forward anyway, so the next accepted pair bracketed two transactions while counting one submit, and convicted a healthy app. extractor errors now fail the run instead of leaving goja's values in current against v8's in previous. * fix(chrome): anchor the transition deadline when the dom goes quiet it was anchored at script start, so a page that churned past the window reached the check already expired and returned mid cross-fade. the driver now publishes the idle timeout it needs, since the caller's 1s could never spend the 800ms window. * fix(web): fail on a partial extractor override same mixed-producer hazard as the install error: some extractors hold the page's value and the rest hold goja's, and a property comparing across that split fires on a healthy app. * docs: six of seven, the seventh is the stock property * fix(folio): drop a name two cards answer to homeTxnCountsOf keyed on the account name and let the last card win, so two accounts the fuzzer named the same collapsed into one entry. a reading that saw one Travel card and a later one that saw both then subtracted two different accounts' counts, and submitCommitsOneTransactionPerAction convicted a healthy app of double-submitting. it is a gated property in folio-run.sh, so that reads as "found the submit bug" over a card scrolling into view. same rule createdAccountHasNonZeroBalance already applies: a name nothing can attribute is no evidence. counted over every card, since an unreadable twin spoils the identity too. * perf(folio): read each frame once every extractor asked routeOf, and routeOf does five ax.find calls. on web each find walks the document and every shadow root beneath it, so the spec cost 110 tree walks a step; homeCards was parsed four times over. now 5 and once. keyed on the identity of the state object because both hosts build a new one per step and hand that one object to every getter, so it cannot outlive its frame. holding the reference is what keeps that true rather than likely. * fix(web): keep an undefined reading's index through JSON json has no undefined, so an extractor whose getter returned one had its whole index dropped by JSON.stringify. that index then kept goja's dump-derived value while its neighbours held the page's, and a property comparing previous to current across the split fires on a healthy app. folio has nine on(route, tag) extractors, so this was most extractors on most steps. each reading is wrapped in a {value} envelope: the drop now happens inside the entry, and an absent value means the getter returned undefined, which is what the goja host records for the same getter. a json null would instead claim it returned null and x.current === undefined would answer differently on the two hosts. * feat(verifier): report the registered extractor count the web path needs it to check the page sent one reading per extractor. * fix(runner): fail when the page reports fewer readings than extractors the comment here already claimed a partial override was fatal. it was not: the skipped check only catches indices outside the extractor list, so a page reporting values for some extractors and not others left the rest holding goja's reading of the dump with nothing said. * test(browser): drive an undefined reading through the whole web path four layers carry it: the page's envelope, the driver's unwrap, the runner's count check and the verifier's decode. each has a unit test and only a run proves they compose. goes red both ways, decoding an absent value as null and dropping the envelope. * fix(web): offer the aria roles a user activates only role=button was in the tappable set, so link, checkbox, radio, switch, tab, option, the menuitems and treeitem were invisible to the enumeration however plain the control looked. the replay ui builds its step rows as <li role="option">, and the spec dogfooding it had to hand-write an action to reach them because no default verb could see a single row. both producers build the set from the same role list, since the parity test compares them element by element. * test(browser): tap a role-based control end to end every control on the page is an <li role="option">, the shape the replay ui gives its step rows, and the spec carries no action of its own: the property firing is the evidence the default enumeration offered a tap on one. * fix(web): read aria-disabled as disabled the enabled fact came off the disabled property, which only real form controls have. it reads undefined on the role-based controls the tappable set now covers, so every one of them looked enabled however plainly it was marked otherwise, and the fuzzer would spend actions on inert ones. both producers answer the same two ways, and the parity fixture carries a disabled row so the comparison covers it: reverting one side alone names the element and the fact. * docs(replay-ui): the enumeration reaches step rows now the comment said role="option" is not in the tappable selector set, which stopped being true a few commits ago. selectAStep stays, for the reason the tab weight below it stays: one row among the page's clickable elements is a thin chance, and both step-facing properties go vacuous on a run that never selects one. * test(runner): bound the last-action test by steps, not wall clock 100ms of wall clock against an assertion that two steps ran fatals under load with "the web path never installed it", which reads as a regression. every sibling test in the package uses a long duration and MaxSteps. * ci: run the kotlin tests in make test RouteTransitionTest and the stability poll cover the android settle and nothing in ci ran them. :sidecar:test needs no android sdk, checked by running it with ANDROID_HOME pointed at nothing. * fix(sidecar): measure the stability streak as observed quiet parameterising pollUntilStable also moved the clock to the start of the read that opened a run of identical snapshots, so a read's own duration counted as quiet. the pre-existing caller polls a real uiautomator dump: at 400ms a read, 750ms of required quiet became 250ms of observed quiet and the poll settled in two reads instead of four. the parameters stay, the semantics go back. * test(sidecar): pin the transition cap by driving it it asserted 1500 >= 700 + 300, two constants, which can only fail if someone edits a constant. it now drives awaitSettledTree against a fade that lands after 700ms and asserts it hands back the settled tree before the cap. cut the cap to 1000 and it goes red. * ci: pin buf-setup-action to a commit it takes a token now, so a floating tag is a token handed to whatever that tag moves to. note v1 there is a branch, not a tag, so the ref lookup that resolves it is matching-refs/heads/v1. * ci: declare least-privilege permissions none of the three declared any, so each got the repository default. release.yml and docs.yml already do this. all three only check out, build, test and upload artifacts. * ci: fail fast when a server never comes up the readiness loops fell through silently after 30 tries, so a server that never started surfaced as an opaque driver failure minutes later. each now says what did not answer and on which port. * ci(folio): a missing trace is not a verdict with no trace the android gate ran its grep against ./trace.jsonl and reported "never reached AddTransactionScreen, so it never got past login", which is not what happened. the web and ios branches had the same misdiagnosis on exit 0. same class, one line up: the classifier's own failure was swallowed, so with the evidence reader dead the gate printed a healthy run and exited 0. * ci(replay-ui): skip a run directory with no trace the summarise step is if: always(), and under github's bash -eo pipefail an unmatched glob stays literal, the redirect fails, pipefail carries it into the assignment and -e kills the step. so a failed fuzz run went red twice, once for the real reason.	2026-08-15 13:01:27 +05:30
pj	7343085614	llm action-selection backend (#68) ... * feat(spec): add llm() action-backend marker * feat(spec): make llm marker inert on the JS picker * feat(spec): expose __sanderlingSampleInput__ corpus draw * feat(openrouter): minimal chat-completions client * test(openrouter): cover request shape, parse, and errors * feat(verifier): thread screenshot + capture corpus sampler * feat(verifier): LLM accessors — candidates, config, sampler * test(verifier): cover AllCandidates, LLMConfig, SampleInput * feat(trace): record action Source and LLMReasoning * feat(runner): thread step screenshot into PushSnapshot * feat(runner): llmSource selects actions via OpenRouter * feat(runner): wire llmSource selection and trace stamping * test(runner): cover llmSource selection, mapping, downscale * docs(folio): add llm action-backend example spec * docs(folio): document the LLM action backend run * feat(llmclient): support OPENAI_API_KEY, openrouter wins * refactor(runner): rename openrouter package to llmclient * docs: both api keys, example model gpt-5.4-nano * docs: add pr style rules to claude.md * fix(runner): explain action kinds in llm prompt to stop swipe loops * feat(trace): record llm ranked list and chosen rank * feat(runner): stamp llm ranked list and chosen rank on trace * fix(runner): tap by selector to survive layout shift after observe * revert(runner): drop selector-first tap; broke path/testTag selectors * feat(spec): llm() accepts optional instructions * feat(verifier): read llm instructions off config * feat(runner): append spec instructions to llm system prompt * docs(folio): describe app in llm spec instructions * feat(bundler): map generator export to globalThis.generator * feat(verifier): read llm config off globalThis.generator * feat(runner): gate llm source on --generator flag * feat(cmd): add --generator llm|seeded flag * test: cover --generator flag parsing and pickSources gating * feat(verifier): enumerate llm candidates by walking actionsRoot collect-walk the weighted action tree: recurse weighted branches accumulating selection probability, call authored leaves once for concrete actions, enumerate builtins per element. label controls by visible text (borrowing descendant text), fold gestures into directional scrolls over scrollable containers, drop disabled, dedup descriptions. * test(verifier): cover candidate enumeration walk * feat(verifier): add SetupAction to walk setup without the seeded root * test(verifier): cover SetupAction setup-only precedence * refactor(llmclient): make JSONSchema.Schema raw json for pinned field order * feat(trace): record llm choice number and chosen_action echo * feat(runner): llm picks one number from weighted candidates drop the seeded-root call for a setup-only precedence path, render a numbered weighted candidate list, pin a reasoning-first choice schema, strict-skip when chosen_action does not echo the numbered entry, and let the model supply typed values (corpus fallback when empty). * test(runner): cover choice schema, strict-skip, and setup precedence * refactor(verifier): drop the superseded AllCandidates enumeration * feat(folio): drive spec.ts under --generator llm; drop spec-llm.ts * fix(verifier): label editable fields by hint, not the typed value an editable field's own text is its transient content; prefer the hint so the field is named by purpose and the label stays stable. * test(runner): cover weight-suffixed echo and stripWeightSuffix * fix(runner): accept chosen_action echo that carries the weight suffix real runs showed the model copies the whole numbered line including the trailing (w34) weight annotation, so strict-skip rejected ~91% of picks and the llm was paralyzed. strip the weight suffix before comparing. also nudge the prompt to stress-test repeated submissions (idempotency). * fix(verifier): skip llm enumeration on cross-fade frames a navhost mid-transition carries >1 route *Screen in a collapsed coordinate space; acting on it taps garbage (soft keyboard). real runs showed the llm acting on 44% of steps being such frames. skip them so the llm re-observes a settled frame next step. * feat(folio): show current balance on the add-transaction screen renders the account's balance (testTag TxnCurrentBalance) below the account name, above the credit/debit toggle, so before/after screenshots carry comparison data. * fix(replay): derive device space from screen extent, not first node the first positive-bounds element is often a short status-bar node (320x24 on android); using it gave a 320/24 aspect ratio that squashed the screenshot overlay into a grey horizontal band. use the max extent across elements (like the runner's screenBounds) instead. * fix(folio): show balance as a compact one-line label per review: one line, account-name-sized, e.g. "Balance: $0.00" instead of a large balance card. * fix(folio): move balance into the header, one compact line under the account name * fix(replay): attribute deferred violations to the causing step, not detection * fix(replay): show a step's own violations in both panels, no next-step bleed * refactor(hierarchy): one Tree.Transitional, drop the duplicated cross-fade check * chore: ignore .playwright-mcp scratch output * docs: document the llm generator and --generator flag * docs(spec): correct the llm() comment; config reads off globalThis.generator * docs: add pr description rules	2026-07-31 21:12:00 +05:30
pj	c76745e5f1	WIP: folio refactor - KotlinConf-style production-app shape (#47) ... * feat(hierarchy): testTag alias resolves to resource-id and accessibilityIdentifier Compose's testTag surfaces as resource-id on Android and as accessibilityIdentifier on iOS. Selectors written as { testTag: "Foo" } now match either, so Sanderling specs can use the same tag on both platforms. Also rounds out the iOS identifier aliases so resource-id / identifier / accessibilityIdentifier all resolve to one another. * chore(folio): add gradle/libs.versions.toml Centralises versions for all folio modules ahead of the module split. Adds new entries for kotlinx-serialization, navigation3, Metro, KSP, and the JetBrains lifecycle-viewmodel-compose multiplatform artifact. * refactor(folio): introduce nested KotlinConf-style modules Split the monolithic :composeApp into :core, :app:shared, :app:ui-components, and :app:androidApp. The old module is still present and remains the source of truth until the next commits remove it; both compile in parallel to keep iOS/Android builds green during the cut-over. Highlights: - :core - SQLDelight schema + LedgerStore + Repository (now an injectable class, not a singleton object). Methods are suspend to match generateAsync = true. - :app:ui-components - design system primitives. IconButton/AppButton APIs revised: label = real contentDescription, testTag = stable selector. Drops the data-carrier description argument. - :app:shared - per-screen ViewModels colocated with screens; pure composables on (state, onEvent); LocalAppComponent CompositionLocal for hand-rolled DI; @Serializable Route. Hosts the iOS framework (baseName Shared). - :app:androidApp - thin Android entry that constructs the DriverFactory and hands it to App(). - gradle/libs.versions.toml centralises versions; settings.gradle.kts enables type-safe project accessors. Deferred to follow-up PRs (per the design discussion): - Metro DI: hand-rolled AppComponent for now; Metro graphs are mostly ceremony for an app this size and add KSP/version risk. - Navigation3: kept the existing Navigator-as-backstack class, injected rather than singleton; nav3 isn't shipping a stable multiplatform artifact for commonMain consumption yet. - :app:webApp + OPFS sqlite worker: web persistence is real new wiring (custom worker on @sqlite.org/sqlite-wasm). Master's WebLedgerStore + Snapshot is being removed by this PR; web stays buildable as a klib but no app-level wasm binary lands here. * refactor(folio): delete :composeApp and retarget tooling Removes the old monolithic module now that :core / :app:shared / :app:ui-components / :app:androidApp own the source. Updates: - justfile install/uninstall recipes -> :app:androidApp - iosApp/project.yml framework path -> ../app/shared/..., baseName Shared (was ComposeApp); pre-build script invokes :app:shared:linkDebugFrameworkIosSimulatorArm64 - iosApp/iosApp/iOSApp.swift -> import Shared - README -> mentions SQLDelight unification, drops the data-carrier contentDescription notes (now stale), no Layout section per repo convention * refactor(folio-spec): query testTag and identify items by visible text Replaces every accessibilityText / descPrefix data-carrier read with testTag selectors that resolve to resource-id (Android) or accessibilityIdentifier (iOS) via the SDK's alias table. - Routes detected via testTag (LoginScreen, HomeScreen, etc.) - Account identity = visible account name (no synthetic id encoded in semantics). - Ledger row identity = joined text content of the row. - Active account derived from route alone (not parsed from contentDescription). - Focused input read from native focused="true" attribute, not from a custom focused_input data carrier. * fix(folio): build green on Android assemble + iOS framework link - Drop ksp/metro/navigation3 plugin aliases - not actually applied by any module in this PR (deferred follow-up). - import awaitAsOne from app.cash.sqldelight.async.coroutines for the suspend single-row reads enabled by generateAsync = true. - Drop kotlin.js.ExperimentalWasmJsInterop opt-in from common compilerOptions (it isn't valid for android/jvm targets). - :app:shared androidMain pulls in androidx.activity:activity-compose for the BackHandler actual. * fix(folio): testTagsAsResourceId at App root + JS-bridge regression test App.kt sets testTagsAsResourceId=true on the root Box semantics so Compose's testTag surfaces as Android resource-id (and equivalent on iOS via accessibilityIdentifier). Without this, testTag stays in the Compose semantics tree but never reaches the runtime hierarchy that UIAutomator and Sanderling read. Also adds TestStateAxObjectSelectorTestTagAlias as a regression test for the {testTag: ...} object selector resolving through the SDK alias to resource-id at the JS bridge layer. * test(verifier): expose PredicateError latching across steps The runner logs PredicateError once per step. The current implementation latches the first error per thunk, so the log freezes on step 1 forever even when later steps would observe different errors. This test fails today and locks in the contract: PredicateError must reflect the most recent step. * fix(verifier): refresh predicate errors per step EvaluateProperties short-circuits once an Always-property latches to violated, so the underlying goja predicate stops being called and formula.err keeps whatever it threw at step 1. The runner logs PredicateError every step a property is violated, which made every subsequent log line repeat the step-1 throw. That looks like the spec runtime is seeing stale state, but it is just stale error reporting. EvaluateProperties now invokes every registered predicate once per step purely to refresh formula.err. Verdicts are unaffected. The thunk itself stops latching so the new value wins on whichever path runs first. * chore(folio): add Metro DI plugin (1.0.0-RC4) to versions catalog Adds dev.zacsweers.metro plugin alias and applies it to :core as a smoke test. Compiler-plugin only, no KSP required. * chore(folio): apply Metro plugin to :app:shared and :app:androidApp * feat(folio-core): annotate Repository and SqlLedgerStore with @Inject * feat(folio-core): scope Repository and SqlLedgerStore as @SingleIn(AppScope) Both are app-wide singletons so the SqlDelight-backed flows remain shared across the graph. * feat(folio): annotate ViewModels with Metro @Inject / @AssistedInject LedgerViewModel and AddTransactionViewModel use @AssistedInject for their accountId param plus a nested @AssistedFactory; the rest are plain @Inject constructor classes. * feat(folio): introduce Metro AppGraph in commonMain Single shared @DependencyGraph(AppScope::class) that exposes Repository, Navigator, and ViewModels. LedgerDatabase enters the graph via @DependencyGraph.Factory.create(database) so the suspend DriverFactory.create() can stay outside the DI surface. @Binds wires SqlLedgerStore to LedgerStore; Navigator is provided explicitly so its Route.Home start state stays in DI rather than relying on a default-parameter being honored by the graph. * fix(folio): expect/actual testTagsAsResourceId so iOS link succeeds Compose's androidx.compose.ui.semantics.testTagsAsResourceId is Android-only. Calling it directly from commonMain broke linkDebugFrameworkIosSimulatorArm64. Replace with an expect Modifier extension that wires the semantics on Android and is a no-op on iOS / wasmJs. * refactor(folio): replace AppComponent with Metro AppGraph in App.kt App now takes a suspend graph builder; the platform constructs LedgerDatabase off the suspend DriverFactory.create() before invoking the Metro graph factory. Routes resolve VMs through LocalAppGraph instead of the hand-rolled LocalAppComponent. Drops the loading-state placeholder comment (the empty Box is enough). * refactor(folio): resolve ViewModels through LocalAppGraph in routes Each *Route composable now reads the AppGraph from CompositionLocal and pulls its VM via the appropriate accessor or AssistedFactory. * refactor(folio): build AppGraph from platform entry points MainActivity (Android) and MainViewController (iOS) now own the suspend DriverFactory.create() and feed the resulting LedgerDatabase into Metro's createGraphFactory<AppGraph.Factory>(). * chore(folio): add navigation-compose 2.9.2 dependency Adds the JetBrains KMP navigation-compose library to the shared module. Used in subsequent commits to replace the hand-rolled Navigator with a typed-route NavHost. * refactor(folio): replace custom Navigator with NavHost backstack Wraps androidx.navigation.NavHostController behind the existing push/replace/back surface so call sites in ViewModels stay unchanged. App.kt now wires a typed NavHost with @Serializable Route entries and observes the controller's currentBackStackEntry to drive the session-based Login/Home redirect. * fix(folio-core): wire kotlinx-browser so wasmJs DriverFactory compiles org.w3c.dom.Worker on wasmJs lives in kotlinx-browser, not the stdlib. Pin 0.5.0 alongside the @sqlite.org/sqlite-wasm 3.53.0-build1 version that the upcoming web app will depend on, and switch the worker constructor to the module-worker form that webpack expects. * feat(folio): scaffold :app:webApp wasmJs module Compose Multiplatform target that depends on :app:shared and pulls @sqlite.org/sqlite-wasm 3.53.0-build1 as the npm runtime for the SQLDelight web worker. * feat(folio-webApp): add main entrypoint and index.html main.kt mirrors the iOS entry point: builds DriverFactory + AppGraph factory, hooks browser back-gesture into WebBackGesture, then mounts the shared App composable into ComposeViewport. * feat(folio-webApp): OPFS-backed sqlite worker + webpack config sqlite.worker.js implements the SQLDelight web-worker protocol (exec/begin_transaction/end_transaction/rollback_transaction) on top of @sqlite.org/sqlite-wasm. Prefers the OPFS SAH pool VFS for persistent storage and falls back to in-memory when OPFS is unavailable. webpack.config.d/coopcoep.js sends COOP/COEP headers on the dev server so cross-origin isolation is available, even though the SAH pool itself does not require it. webpack.config.d/sqlite-wasm.js enables asyncWebAssembly so webpack can bundle sqlite3.wasm via the 'new URL("sqlite3.wasm", import.meta.url)' reference inside the sqlite-wasm package. * chore(folio): add web/web-build just recipes and refresh yarn lock Yarn lock picks up @sqlite.org/sqlite-wasm 3.53.0-build1. * fix(folio-core): probe schema before create on wasmJs Wasm SqlDriver doesn't auto-track user_version like the Android driver, so awaitCreate() ran on every page load and tripped over already-created tables. Read PRAGMA user_version, run awaitCreate/awaitMigrate based on it, and self-heal pre-existing tables with version 0 by stamping the current schema version. * chore(folio-webApp): pin dev-server port and trim worker logging webpack-dev-server now binds 8088 (or WEBAPP_PORT) so it doesn't collide with the docs server on 8080. Drop the per-message reply log; keep only the OPFS init line and error logging. * chore(folio): nest iosApp under app/ for KotlinConf parity Match KotlinConf-app's filesystem layout where every entry point (android, ios, web, shared, ui-components) lives under app/. iosApp is still an Xcode project, not a Gradle module, so settings.gradle.kts is unchanged. * feat(folio): testTag identity for AccountName and ledger row cells Replaces string-heuristic identity in the spec extractors with stable testTags. AccountCard exposes AccountName; LedgerRow exposes TxnNote and TxnDate. Spec extractors read those directly instead of filtering visible text by "starts with $" / "matches digit". * fix(folio-app): branch start destination on initial session Read repository.session.value at first composition and pick Route.Home or Route.Login as the NavHost startDestination. Avoids the one-frame Home flash on cold start with no persisted session. * refactor(folio-webApp): hard-fail when OPFS unavailable Drops the silent in-memory fallback. The README claims OPFS persistence; falling back without surfacing the degrade made data loss invisible across reloads. Now the worker errors out and the Kotlin DriverFactory rejects the create() call instead. * docs(verifier): document extractor advancement and refresh invariants Extractor previous/current advance only on PushSnapshot, never per thunk-call. refreshPredicateErrors depends on this for safe re-entry. Also flags that re-invoked predicates run outside their LTL gate, so they must be side-effect-free reads. * fix(hierarchy): populate ResourceID from accessibilityIdentifier iOS Compose surfaces testTag as accessibilityIdentifier. Previously only resource-id and identifier seeded element.ResourceID, leaving element.id empty for iOS Compose nodes and forcing specs to walk attrs to recover stable identifiers. * refactor(folio-spec): use element.id for focused field tag Now that ResourceID populates uniformly across Android/iOS Compose, the spec can read element.id directly instead of probing attrs for each platform's underlying field name. * fix(folio-spec): pick account card via seeded from(), not Math.random Math.random() breaks --seed reproducibility. The verifier's seeded RNG flows through from(), so re-running a seed now produces the same card pick sequence. * docs(spec): fix README example to use scoped extractors The previous snippet referenced `state.ax.find` inside an actions() body where state is not in scope, and shadowed the imported actions helper with an export of the same name. * feat(hierarchy): add FindBySelectorPath for chained object selectors Each selector in the chain is matched within the descendants of the previous match. Returns the deepest match (or nil) for FindBySelectorPath and every deepest match for FindAllBySelectorPath. * feat(verifier): dispatch JS array selectors to FindBySelectorPath `state.ax.find([{...}, {...}])` now walks each segment scoped under the previous match. Strings and single objects keep their existing single-shot lookup. * feat(spec): expose SelectorPath in find/findAll signatures * fix(spec): satisfy AccessibilityElement interface in Tap test fixture * refactor(folio-spec): collapse chained finds into selector paths * feat(spec): add keyedBy(element, tags) identity helper Joins element.find({testTag: tag})?.text per tag with U+001F as the delimiter so user-visible text can never collide with the separator. Returns empty string for an undefined element. * refactor(folio-spec): use keyedBy for ledger row identity * feat(spec): add whenRoute action gating helper whenRoute(route, allowedRoutes, body) wraps an actions() generator that returns [] unless route.current matches one of the allowed values. Accepts a single route or an array. * test(spec): cover whenRoute matching, gating, and array routes * refactor(folio-spec): gate addAccount and addTxn with whenRoute * refactor(hierarchy): use maps.Copy for attribute merge Linter flagged the manual loop after recent edits surfaced the hint. * feat(verifier): dispatch setup generator before actions root Setup is consulted every step; when it returns ErrNoAction the call falls through to the existing actionGenerator retry loop. This lets specs split deterministic preconditions (login, onboarding) out of the weighted action pool while auto-reengaging if state regresses (e.g. logout under fuzz). * docs(spec): document setup precondition action generator * refactor(folio-spec): export login as setup, remove from action pool Login is deterministic and yields no actions once the app is past the login screen; sitting at weight 50 in the action pool wasted half of step picks on a no-op. Promote it to setup so the runner only consults it while it has work to do, and rebalance remaining weights to round numbers (addAccount 50, addTxn 40, back 10).	2026-04-27 00:33:57 +07:00