115 Commits

Author	SHA1	Message	Date
Michał Pierzchała	03c3984066	perf(contracts): granularize entry surfaces so hub importers stop evaluating the facade clump (#1969) ... * perf(contracts): granularize entry surfaces so hub importers stop evaluating the facade clump `@agent-device/contracts/platform` unions 32 vocabulary modules and `/interaction` another 18. A file that value-imports either evaluates the whole union to reach one function, and because permanent hubs sat behind them — `command-descriptor/registry.ts`, `core/capabilities.ts`, `interactors/register-builtins.ts`, `command-descriptor/platform-execution-entry.ts` — that union rode into roughly half the unit suite's test graphs. Give every vocabulary module its own entry subpath and move all value-importers onto the module that owns the symbol. Type-only importers are left alone: `import type` is erased, so it already evaluated nothing. Measured with the #1950 eager-import-closure walker over all 974 unit-core test files, against base e5bfde3d1: aggregate eager module evaluations 143,248 -> 129,738 (-9.4%) facades/platform.ts carried by 466 -> 1 test graphs facades/interaction.ts carried by 451 -> 0 test graphs registry.ts 105 -> 66 capabilities.ts 113 -> 76 register-builtins.ts 111 -> 73 platform-execution-entry.ts 43 -> 3 dispatch.ts 134 -> 100 Three gate adjustments the split forces: - R11's pinned contracts subpath list grows to the new entries, and the resolver test's "must not resolve" example moves to `./clipboard`, since `./gesture-plan` is now a real entry. - R16 anchored the record-runtime join on the literal `contracts/platform` specifier. It now accepts any contracts entry — the assertion's provenance is what the rule pins, not which subpath carried it. - `gesture-plan.ts` became an entry target, and the no-bare-star rule rejects the `export * from './gesture-plan-types.ts'` it carried. Its one internal consumer now imports the owning module directly. Both facades keep their type re-exports for the ~490 type-only importers, so every symbol on them now reads as value-unused; one fallow entry records that and names retiring them as the follow-up. Closes #1959 * test(contracts): text-filter the facade scan before parsing The repo-wide scan parsed all ~3000 sources, which the coverage lane's instrumentation pushed past both the 5s test timeout and the 2.5s slow-test budget. A file that never names the specifier cannot import it, so filter on the text first and parse only the ~490 candidates. Non-vacuity moves with it: instead of counting narrow imports across every file, require that the surviving type-only importers were seen and classified as erased — which an empty scan cannot satisfy.	2026-08-22 15:35:38 +02:00
Michał Pierzchała	991c08561b	fix(ios): enforce regular snapshot clip invariant (#1946) ... * fix(ios): enforce regular snapshot clip invariant * fix(ios): restore typed snapshot failure construction * fix(ios): linearize snapshot clip validation * fix(ios): propagate snapshot presentation errors * fix(snapshot): clarify presentation failure recovery	2026-08-22 12:15:40 +02:00
Michał Pierzchała	3e584d1d5d	fix(ios): isolate snapshot acquisition timing from presentation (#1948) ... * fix(ios): isolate snapshot acquisition timing * fix(ios): pin snapshot phase timing fixture * fix(ios): avoid starving synthesized text commits	2026-08-21 22:10:47 +02:00
Michał Pierzchała	1f80c92a27	refactor: derive every --settle surface from the descriptor trait (#1652) (#1945)	2026-08-21 19:50:57 +02:00
Michał Pierzchała	d0547dcb97	refactor: complete the find cutover onto the request-bound runtime (#1944) ... * refactor: complete the find cutover onto the request-bound runtime The deferred Wave 4 unit for #1739 (R35), unblocked by focus (R40) and type (R41). Find's read-only legs, focus leg, and type leg already ran bound; the one remaining direct platform execution was the mutating-target capture, which built createSelectorCaptureRuntime without a bound capture and fell through the legacy dispatch branch reserved for "the last one to migrate". - The mutating path now enters resolveBoundSelectorCapture — the selector family's shared admit-then-bind entry, which already named find in its intent table — and threads the bound capture into the target capture. - Find was that last one: `capture` on SelectorCaptureRuntimeParams is now required and the legacy fallback branch is deleted. The backend's `bound` becomes required-to-state, with the observation-free duration wait (`wait 400`) as the one declared absence — its runtime now carries no capture backend at all, so an accidental capture fails loudly instead of falling anywhere. - The descriptor flips to device-runtime with findRuntimePlanUses (the selector-text plans shared with get, plus focusRuntimeUse and typeTextRuntimeUse); the capability bucket and both overlay memberships (HARMONYOS_SUPPORTED_COMMANDS, WEB_QUERY_COMMANDS) are deleted. - R35 lands with the selector family's shared operation owners; the capture and backend tests move off the dispatch mock onto the bound seam, which is where the poll-deadline and private-ax-pin assertions actually live now. Wave 4 is complete: layering recognizes 26 migrated commands. * fix(find): one action-selected bind per mutating handler (ADR 0019 §9) Review P1 on #1944: a mutating find performed up to three separate facts/admit/bind projections — capture, then focus, then type re-admitted per leg. The request handler now resolves ONE action-selected plan and binds once: - New selector intents find-focus / find-type carry combined uses (capture + focusPoint, capture + focusPoint + typeText) through the same admit-then-bind path and plan machinery every selector capture uses; the new bind arms reuse the existing capture selectors, so the shared operation owners stay single. Delegated click/fill resolve targets on the plain capture pair. - The handler threads the one bind's operations to the shared executors: executeFocusPoint is extracted as the single lexical owner of the focusPoint call (R40's owner claim follows it), and executeBoundTypeText's runtime param narrows to the operations it actually uses so find can pass its own broader bind through it. - findRuntimePlanUses becomes the full action-selected set (eight uses), and the descriptor test pins each use's exact requirement list. - Regression: find focus and find type each assert exactly one facts inspection and one bindDevice call — the pre-fix handler fails both (two and three binds respectively). Live re-verified on iPhone 17 Pro at this head: find focus and find type both execute through the single bind, route synthesized-first-responder, typed text visible in the captured tree.	2026-08-21 18:43:09 +02:00
Michał Pierzchała	81409f1a7c	refactor: migrate type to the request-bound device runtime (#1935) ... * refactor: migrate type to the request-bound device runtime Wave 5 unit 2 for #1739 (ADR 0019), find's last blocker. `type "text"` and `find <q> type "text"` now reach the device through one admitted, request-bound `typeText` operation instead of the `handleTypeCommand` interactor leaf and its dispatch-table arm. - New `TypeTextRuntimeOperations` contract riding the same `Interactor` seam as focus/screenshot/element-text; the operation returns the interactor's own closed `TypeTextBackendResult`, so Apple route evidence passes through and every other owner types blind, exactly as before. The iOS synthesized-type commit wait (#1676) is Apple-interactor-internal and moves nowhere. - The interaction backend's `typeText` member exists only when the `type` handler admitted and bound a runtime — no caller can fall back to legacy dispatch, so the command keeps exactly one execution path (R41). - `executeBoundTypeText` reproduces the retired leaf byte-for-byte: leading-ref rejection with the same hint, space-joined positionals, the 0-10000 delay bound, and only textEntryRoute surviving from the owner's result. Its parse pins moved from the dispatch-level tests into the daemon runtime test. - Exact-owner facts replace the capability bucket (apple sim+device, android all-but-simulator-row, harmonyos emulator+device, linux device, web device, vega unavailable, providers wherever their interactor is reachable) and `type` leaves HARMONYOS_SUPPORTED_COMMANDS / WEB_INTERACTION_COMMANDS. - The Linux desktop replay types a digit on real hardware; the coverage manifest promotes `type` contract -> live with the two-sided count pins. - Android/webdriver facts helpers extracted (androidTouchFact, interactorCell) to keep inspectFacts under the complexity gate. `find` stays legacy: both of its direct execution legs now share bound runtimes, so the atomic R35 cutover is next. * refactor(type): single-pass daemon routing, shared binder source, owner cell tests Review follow-ups on #1935. - The type handler now calls the bound executor directly: the interaction- runtime hop validated and formatted what executeBoundTypeText validates and formats again, so it is gone — no boundTypeText backend member, no second result rebuild. The ADR 0014 frame expiry moves to the handler. - New contracts/interactor-operation-binding.ts: one local resolver and one fail-closed provider resolver shared by the screenshot, focus, and type binders — three private copies retired, provider error text preserved. - provider-limrun/interaction-operations.ts: the interactor-backed interaction cells move out of the app-log owner (586 -> 563 lines, below its pre-unit size); text interaction is composed by that owner, not defined in it. - Every owner runtime test now pins the focusPoint/typeText fact cells and bound-operation presence for its exact kinds: apple, android (incl. the synthetic-simulator refusal), harmonyos, linux, web, vega (refusal + hint), webdriver (reachability-gated, incl. inactive session), limrun (live + recovery). The webdriver unsupported-capability row documents that interaction gates on interactor reachability, not capture declarations. - The Linux replay assertion is now change-sensitive: type "555" then wait for a 555 node — no calculator button carries that label, so the wait passes only if the keystrokes landed in the display; deleting the type step turns it red. * fix(replay): give the calculator focus before the Linux type assertion The change-sensitive wait exposed what the review predicted: the typed digits never landed, because `focus 100 100` clicks the DESKTOP and takes keyboard focus away from the calculator. The old broad assertion masked exactly this. The retries then wedged on a latent quirk: attempt-1 leaves the pointer at (100,100), and the next attempt's `xdotool mousemove --sync` to the same point waits for a motion event that never comes, so every retry dies at the focus step with a 10s timeout — which is why the lane reported step 7, not the failing wait. New tail: `focus 100 100` (R40 evidence + survival assert), then `click "label=1"` — a resolved press inside the window that restores keyboard focus, proves pointer input lands in the app, and moves the pointer off (100,100) so retries cannot trip the mousemove no-op hang — then `type "55"` and `wait "label=155 || text=155 || value=155"`. No button is labelled 155, so the wait passes only if the typed keystrokes reached the display. * refactor(type): delete the fallow SDK typeText surface, drop dead surface fields Thermo-nuclear review follow-ups (reviewed at 82fb8c2dc; the three-hop relay it names was already deleted in 3d44b6dea — these are the residuals). - typeTextCommand had zero production callers after the direct-executor routing: the daemon was its only consumer, and the released SDK types over the wire (executeCommand('type')), not through the embedded runtime catalog. Deleted: the command, its Options/Result types, the catalog registrations, the AgentDeviceBackend.typeText member, and every fixture/pin that kept the dead surface alive. R41's retirement claim now names typeTextCommand, so a revival fails the gate. One parse/compose owner remains: executeBoundTypeText. - TypeTextInput.options.surface and FocusPointInput.options.surface were dead clones — never set by a projector, never read by a binder. Removed both. - The Linux replay click disambiguates with role=button: the calculator tree carries [text] digit nodes beside the buttons, so a bare label=1 was an AMBIGUOUS_MATCH rejection on attempt-1 — which parked the pointer at (100,100) and made every retry hang in the xdotool no-op move, reporting as the step-7 focus timeout. Live-verified on iPhone 17 Pro at this head: coordinate focus -> bare type -> route synthesized-first-responder -> text observable in the captured tree. * fix(ci): lower the settle.test.ts pin, add pixel evidence to the Linux type wait - settle.test.ts shrank to 2359 lines when its dead typeText fixture member left; the ratchet pin follows it down (the history-backed gate caught the gap on CI while the local affected run had not re-selected the ratchet). - The Linux replay now screenshots the calculator right after the type step. The lane uploads test/screenshots/replays/*.png on pass and fail, so a wait-155 timeout becomes diagnosable from the artifact: display showing 155 means a tree-exposure gap; an empty display means the input never landed. The 20-ref divergence dump cannot show the entry node either way. * fix(replay): assert the Linux type through the computed result Run 32485981780's typed-state artifact settled both open questions with one image: the display shows "55" — the bound typeText keystrokes LAND on Linux CI — while the wait for that value timed out, so the calculator entry does not expose its text to selectors; and the display shows no leading "1", so the resolved click on button 1 missed its target entirely. Both discoveries leave the replay: the click dependency goes (a pre-existing click-coordinate defect is not this unit's evidence chain), and the assertion moves to where the tree can answer — the typed string is now a full calculation ("100+55=") whose `=` creates a history row, and the wait matches the computed 155. No button carries that label and the typed string never contains it, so the wait passes only if the keystrokes executed; deleting the type step turns it red. The typed-state screenshot stays as per-run pixel evidence either way. * fix(linux): guard the no-op --sync mousemove; assert typed digits via value= Two artifact PNGs decided this. Run 32485981780 shows "55" in the entry while the wait for it timed out on a mismatched target; run 32487868346 shows "100+55" — digits and + land, the = keystroke does not, and the retries died in the focus step again because the previous commit removed the pointer-moving click. - moveTo now probes `xdotool getmouselocation --shell` and skips the --sync move when the pointer already sits on the target: a no-op move emits no motion event and hangs until the action timeout, which is what reported every failed replay retry as its first coordinate step. A failed probe never blocks the move. The provider test pins both sequences, including the skip case. - The replay types digits only ("155") and waits on `value=155`: the AT-SPI dumper reads the entry's Text interface into the node's value and the selector engine matches it — the earlier "exposure gap" conclusion came from a pair that never tested the matching value. No button carries 155, so the wait passes only if the keystrokes executed. * fix(replay): keep Linux type at contract tier — GTK4 exposes no entry text Run 32490373693 closed the investigation: the typed-state artifact shows "155" in the calculator entry while the wait for value=155 timed out with no interactive filtering in play and a matcher that does compare node.value. The AT-SPI dumper's get_text_iface() route returns nothing for GTK4 gnome-calculator, so no tree-level assertion on typed text can hold on this lane today. The replay keeps the type step and uploads the typed-entry screenshot every run — live pixel evidence that the migrated typeText path lands keystrokes on real Linux hardware — and closes with the survival assertion. The manifest claim returns to the contract tier with the reason written at the entry, and the count pins follow. The GTK4 exposure defect joins the Linux input-defect chip; fixing PyGObject-vs-GTK4 blind through CI rounds is not a sane loop. The moveTo no-op guard from the previous commit stays: it is why this run finally reported the true failing step on every attempt instead of the step-7 hang.	2026-08-21 17:15:35 +02:00
Michał Pierzchała	17da776350	feat(ios): add snapshot backend conformance (#1930) ... * feat(ios): add snapshot backend conformance * fix(ios): load built SDK at live runtime * test(client): isolate snapshot forwarding regression * refactor(snapshot): keep backend capability metadata internal * fix(test): merge backend conformance imports * fix(snapshot): keep backend forcing internal * refactor(snapshot): isolate backend capability fixtures * refactor(snapshot): keep capability governance internal * fix(ios): align snapshot actionability contract	2026-08-21 15:01:10 +02:00
Michał Pierzchała	46eff36f85	refactor: migrate focus to the request-bound device runtime (#1925) ... * refactor: migrate focus to the request-bound device runtime Wave 5's first unit (#1739, ADR 0019). `focus x y` and `find <q> focus` now reach the device through one admitted, request-bound `focusPoint` operation instead of the `handleFocusCommand` interactor leaf and its dispatch-table arm. - New `FocusRuntimeOperations` contract with local and provider interactor binders, mirroring the screenshot/element-text seam rather than inventing a second way for one operation class to reach its mechanics. - Exact-owner facts replace the capability bucket: apple simulator/device, android emulator/device/unknown, harmonyos emulator/device, linux device, web device, vega none, providers wherever their interactor is reachable. That is the retired bucket's cell table, restated as facts. - `focus` leaves BASE_COMMAND_CAPABILITY_MATRIX and both hand-maintained overlays (HARMONYOS_SUPPORTED_COMMANDS, WEB_INTERACTION_COMMANDS). - R40 is the new parametrized cutover row; `focusPoint` has exactly one owner. - The `x y` positional parse moves to utils and is shared with the still-legacy touch siblings, so a migrated command cannot drift from them. `find` stays legacy: this unit owns its focus leg only, its `type` leg still dispatches, and R35 waits on the Wave 5 `type` unit. * test(focus): cover the owning interactor binders, lower the find ratchet Review follow-ups on #1925. P1: focus-runtime.test.ts bound a fake focusPoint, so deleting the interactor call inside bindLocalFocusInteractor left focus a successful no-op with every test green. Adds packages/contracts/src/focus-runtime.test.ts, which executes both binders and asserts resolver context, positional (x, y) forwarding, the structured missing-provider failure, and that an already-cancelled request never resolves an interactor at all. Two planted mutants confirm it bites: removing `await interactor.focus(input.point.x, input.point.y)` and transposing its two arguments each fail exactly the two forwarding tests, while the daemon-level focus and find suites stay green — which is the gap the reviewer named. Coverage: find.test.ts shrank to 1204 lines when its focus assertion moved off the dispatch mock; the ratchet pin follows it down. * test(focus): add live Linux focus coverage to the desktop replay The Linux `focus` claim rested on the provider scenario at command-contract level. The desktop replay runs on real Linux hardware in the Smoke lane, so it now runs a coordinate focus and re-asserts the session survived it. Coordinate, not selector: the step exists to prove the migrated `focusPoint` path executes on real hardware, so it must not be able to fail on match ambiguity or CI layout drift. Reclassifies focus contract -> live in the Linux coverage manifest and updates the two pinned counts. The manifest gate is two-sided — a live claim must name a command the replay actually invokes — so the claim cannot drift from the file.	2026-08-21 11:34:22 +02:00
Michał Pierzchała	1f8fdd0b5d	fix: preserve Maestro clickable-first ordering (#1917) ... * fix: preserve Maestro clickable-first ordering * test: cover Android Maestro clickable-first path * fix: keep Maestro fixture Android-only * fix: reveal Android Maestro targets in smoke scenario * fix: quote Maestro smoke assertion text * fix: retain Android Maestro clickability evidence	2026-08-21 08:48:36 +02:00
Michał Pierzchała	6604746d49	refactor(web): drop duplicate viewport facts spread in webRuntimeFacts (#1928) ... `webRuntimeFacts` spread `viewportRuntimeOperationFacts` twice in the same object literal. Both spreads declared the same `setViewport` cell — the first inlined `device.kind === 'device' ? available : openTargetKindUnavailable`, the second passed `browserDevice`, which is defined as exactly that expression — so the second silently won and the first was dead. Keep the `browserDevice` spread, which sits next to the other cells reading the same value. Behavior-neutral: the resulting facts object is unchanged.	2026-08-21 08:48:14 +02:00
Michał Pierzchała	56f2671a66	perf: reduce cold iOS runner startup latency (#1927)	2026-08-20 21:47:29 +02:00
Michał Pierzchała	be51870118	fix: make iOS scroll release controlled (#1906) ... * fix: reduce iOS scroll overshoot * fix: make iOS scroll release controlled * fix: make controlled iOS scrolls deterministic * fix: preserve continuous drag sampling	2026-08-20 19:49:39 +02:00
Michał Pierzchała	5df5ec469d	feat(maestro): add positional selectors (#1911) ... * feat(maestro): add positional selectors * perf(maestro): resolve selectors once per snapshot	2026-08-20 18:21:57 +02:00
Michał Pierzchała	0f05fa38a5	feat(maestro): add recursive tree selectors (#1910) ... * feat(maestro): add recursive tree selectors * perf(maestro): resolve scroll selectors once	2026-08-20 18:21:57 +02:00
Michał Pierzchała	f065e6aeb4	fix(maestro): align label metadata ownership (#1909) ... * fix(maestro): align label metadata ownership * fix(maestro): centralize command label parsing * test(maestro): cover runFlow label ownership	2026-08-20 18:21:56 +02:00
Michał Pierzchała	17bdca76cc	refactor: migrate wait to request-bound runtime (#1875) ... * refactor: migrate wait to request-bound runtime * fix: preserve native selector wait observation * fix: classify wait observations as conditional * refactor: compact conditional runtime declarations * fix: isolate selector runtime intents	2026-08-20 15:59:38 +02:00
Michał Pierzchała	494eb52f66	refactor: migrate get to the request-bound device runtime (#1877) ... * refactor: migrate get to the request-bound device runtime `get` declares `elementReadRuntimeUse` (required `captureSnapshot`, preferred `readTextAtPoint`), admits once from exact owner facts, refuses before binding, and binds exactly once. Its capability bucket, the static HarmonyOS/Web command sets that augmented it, and `requireCommandSupported` admission for `get` are gone; `'get'` leaves the `createSelectorRuntime` capability union. The neutral `readTextAtPoint` operation replaces the branch-per-family legacy `read` dispatch on the `get` path. Every local family and both providers now classify it exhaustively — Web, HarmonyOS, Vega and every provider row report it unavailable, which is behaviour-preserving because the legacy dispatch had no arm for them and threw on every call before falling back. R36 is the new parametrized cutover row. * fix(get): admit before the direct-iOS fast path; close the element-read outcome Review blockers on #1877. 1. `dispatchGetViaRuntime` could complete the direct-iOS selector query before `resolveBoundGetRuntime`. Once `get` declares `device-runtime`, ADR 0019 requires resolve -> admit -> bind before anything in the request path operates, so admission now runs first for every target shape and the fast path is a fast path *within* an admitted request. Regression: an eligible direct selector cannot operate when facts refuse admission. 2. `readTextAtPoint` returned `Promise<string>` and `readTextForNode` caught any throw and fell back, assigning a typed diagnostic after an untyped failure. It now returns a closed `ElementTextReadOutcome`; fallback happens only for the contract's classified reasons; unexpected errors propagate. The reason union is derived from its runtime list so the two cannot drift, and an unhandled reason is a compile error at the consumer. This retires the generic catch the start record promised. * feat(daemon): land the selector capture seam with get as its first consumer Takes ownership of the request-bound selector capture seam from #1876, which cannot ship standalone: with find's cutover deferred it had no consuming command (ADR 0019 §10) and was not dead-code clean (check:production-exports 19 -> 20). `get` is its first consumer, so it lands here. Adopts find's handoff as given. The one shape change, approved by the coordinator: the selector family gets its own capture uses carrying a PREFERRED `readTextAtPoint`, declared ALONGSIDE the snapshot uses so `snapshot`/`diff` keep binding exactly what they bind today. The read is surfaced through the existing arms of `bindSnapshotCaptureRuntime`, reusing the same selectActiveAppSnapshot / selectSnapshotWithoutActiveApp selectors — no second plan-to-operation dispatch. `get` now runs through `createBoundSelectorRuntime`; `resolveBoundGetRuntime` and its test are deleted as superseded, and `'get'` leaves the `createSelectorRuntime` capability union. The legacy read adapter survives for `find <q> get text` and is selected by which command constructed the runtime — never by failure, family, environment, or flag — so `get` cannot reach it. It retires in find's cutover, where the last consumer moves. * refactor: retire the read dispatch alias across both selector consumers Read-only `find` now constructs a BOUND selector backend, so `get text` and `find <q> get text` execute the same bound `readTextAtPoint` instead of one binding it and the other dispatching the legacy `read`. This moves find's READ LEG only: find's descriptor stays LEGACY_PLATFORM_EXECUTION and it claims no cutover row. With no consumer left, the whole chain goes: the `read` registry entry and its `dispatch: {}` projection, `DISPATCH_HANDLERS.read`, `handleReadCommand`, `interaction-read-legacy-dispatch.ts`, and the duplicate platform reader branches it carried. `read` was the only `dispatch-alias` descriptor, so that catalog group goes too. Deleting the registry entry drops 'read' from DescriptorDispatchCommandName, which makes a surviving DISPATCH_HANDLERS.read a compile error rather than something R36 has to police. R36 now claims the retirement it can prove. `find.test.ts` is over the size tripwire, so its handler invocation is extracted to find-handler-fixture.ts and the pin lowered 1237 -> 1221. * refactor(daemon): apply the seam addendum after #1876 was re-scoped Two edits, per find's ADDENDUM.md: 1. `includeRects` returns to `buildRuntimeCaptureInput`. It was removed from #1876 as unconsumed; the selector capture path is genuinely its first consumer (a Web rect capture requests bounds explicitly), so it lands here under the same rule that moved the seam. `snapshot`/`diff` pass nothing. 2. The per-capture `signal` is dropped, not restored. `CaptureSnapshotInput` has no such field on this stack — it moved to `wait` (#1875) with the regression that proves per-poll abort and quiescence. `get` captures once per resolution and never polls, so nothing here needs it. The seam test and fixture coverage for it moves with the contract rather than being kept against a field that no longer exists. * refactor(get): retire the direct-iOS selector shortcut `get` declares device-runtime, so its request path must reach the platform only through operations R36 declares. `dispatchDirectIosSelectorGet` reached `runAppleRunnerCommand` through a path the row declares no operation for; admitting before a bypass is not executing through the seam, so the bypass is removed rather than ordered after admission. Every target shape — including the simple iOS `id=` selector — now resolves through the bound capture. `queryDirectIosSelector` itself stays: `offscreen-target-probe.ts` still consumes it and it remains single-copy. `dispatchDirectIosSelectorIs` belongs to `is` (#1883). Two get-only helpers (`readDirectIosGetSelector`, `buildDirectIosGetResult`) became unreachable and are deleted with the caller. Declaring `querySelector` as a fact-admitted preferred operation was rejected on duplication, not correctness: the offscreen probe takes a plain session and cannot consume a bound operation, so it would ship the query twice until Wave 5 moves the probe — the deferred-duplication shape this PR was already overruled for on the `read` alias. It returns as a declared, §9-measured operation in a later unit that also moves the probe. Cost, stated plainly: `get text id=…` loses its tree-capture skip on iOS. No fallback was added and the latency is not recovered elsewhere. R36's singularExecution claim is now what the code does rather than aspirational. * refactor: ride the Interactor seam for the element read; drop the bespoke host Two operations of the same class were reaching their mechanics two different ways: `findText` rides `Interactor` via `localInteractors.resolve`, while `readTextAtPoint` had its own host port. That is duplication of MECHANISM, so the read now rides the same seam. `Interactor` gains `readTextAtPoint?`, implemented on the Apple, Android and Linux interactors where those mechanics already live. `src/platform-runtime-element-text-host.ts` and its `elementText` host wiring are deleted; the contract binds through the resolver exactly as the snapshot runtime does. Size honesty: this removes an 89-line module but the four readers still have to exist, so they moved into the interactors rather than vanishing. Net production change is ~4 lines, not ~89. The duplication of mechanism is what is actually fixed; Wave 5/6 retires the seam for both operations together. Also from the size investigation: - `ElementTextRuntimeExecution` was byte-identical to `SnapshotRuntimeExecution`; removed and reused, as `find-text-runtime.ts` does. - Removed a stranded, stale comment in `selector-capture-binding.ts` that still claimed a duplication this branch had already retired. - `FrozenUnavailablePlatformRuntimeFacts` is derived from its input type rather than restated, removing a 14-line clone group my new cell had pushed over the detector threshold. * refactor: migrate is to the request-bound device runtime (#1883) * refactor: migrate is to the request-bound device runtime `is` declares the shared selector capture use, admits once from exact owner facts, refuses before binding, and binds exactly once. Its capability bucket, the static HarmonyOS/Web command sets that augmented it, and `requireCommandSupported` admission for `is` are gone; `'is'` leaves the `createSelectorRuntime` capability union. Admission now runs BEFORE the direct-iOS selector fast path. ADR 0019 requires resolve -> admit -> bind before anything in a `device-runtime` command's request path reaches the device, so that query becomes a fast path *within* an admitted request rather than a way around exact-owner facts. The rule is documented once, on `createBoundSelectorRuntime`, replacing the two duplicated call-site comments `get` and `is` were each carrying. Declared behaviour change: `is` takes the active-app plan split, so the facts decide per family. On iOS `appBundleId` is the XCUITest attach target — with no tracked app the runner's own process comes to the foreground, displaces the app under test, and the capture then answers confidently about the runner's own blank screen. An iOS `is` on a session with no tracked app is now a typed SESSION_NOT_FOUND refusal carrying the `open` hint. Refusing beats displacing-and-lying. Android captures the real launcher in that state and is unchanged, which is what the platform facts already encoded. The two Apple watchOS cells move from capability-admitted-then-runner-failure to a typed unavailable refusal, the same classification snapshot, diff, and get already landed. R37 is the new parametrized cutover row. `find` keeps `createSelectorRuntime` and its `requireCommandSupported` call, so `captureData` stays optional and `captureSnapshotWithInteractor` stays: this unit is not the last selector unit. * fix(is): a failing iOS assertion fails instead of exiting zero Reverses part of #557, on thymikee's explicit instruction. `is` is an assertion: the docs state it "exits non-zero on failure". The direct-iOS fast path broke that contract — it reported a failed predicate as a completed command, so on device $ agent-device is text id=… "Wrong Expected Text" Passed: is text (exit 0) because `{ok: true, pass: false}` reaches `isCliOutput`, which renders "Passed: is <predicate>" without reading `pass`. A failing assertion reported as success lets a replay run on past a broken state. Now: Error (COMMAND_FAILED): is text failed for selector id=…: expected="Wrong Expected Text" actual="Apple Account, …" (exit 1) The renderer needed no patch: a negative can no longer produce a success envelope, so it is correct by construction. Direction chosen deliberately. Making the two paths agree could have gone either way, and "an agent asked a question and got an answer" is a real argument for the other one. This follows the DOCUMENTED contract rather than merely the incumbent behaviour, and the alternative is a far larger change: a zero-exit `is` would alter every platform and path, break scripts that rely on it failing the shell, and needs its own PR, docs, and probably a major version. It is also already how `is hidden` and `is exists` behave end to end. PASSING assertion, and that arm still answers with zero captures (pinned). Only the negative falls through — what #557's own summary asked for, "preserving snapshot fallback for misses", refusing fallback only for hard failures like ambiguity. The fall-through was #557's own design, never armed: the `| null` return and the caller's `if (!payload) return null;` guard were unreachable. This makes that dead guard live. Measured on iPhone 17 (median of 9, warm daemon): predicate holds 0.14s / 0 snapshots, unchanged; predicate fails 0.25s / 1 snapshot. ~+0.11s on failing assertions only. Correctness gain beyond the envelope: the fast path evaluates a ONE-NODE tree, so `visible` cannot see the ancestor geometry a list row inherits and its negative can be wrong. Falling through re-asks the real tree and can turn a spurious negative into a pass. The #557 pin moved with its reasoning at the pin site. * fix(layering): let a cutover row state a data-only admission retirement Review blocker on #1883: R37 claimed `legacyRetirement.routeNames: ['WEB_QUERY_COMMANDS_WITH_IS', 'HARMONYOS_IS_SUPPORT']`. Neither identifier has ever existed. They satisfied the non-empty shape check while proving nothing — the vacuous registry claim AGENTS.md warns about, and a green gate that would stay green if the deletion were reverted. The cause was the model, not the row. Every `LegacyRetirementClaim` form names something that must NOT exist, which a row can always satisfy by inventing a name. `is` retired no module, route, or dispatch projection because it had none: its legacy admission was a capability bucket plus membership in two static platform command sets, so its real retirement is a DATA deletion the model could not express. Rather than patch around that with sentinels or a per-command policy file — both forbidden by the playbook — this generalizes the model. `staticCommandSets` names the sets themselves and is proven from both sides: each must still be DECLARED in production source, and must no longer list the command. A fictional set fails the first half; a skipped deletion fails the second. That is what an identifier-shaped claim cannot state. R37 now claims HARMONYOS_SUPPORTED_COMMANDS and WEB_QUERY_COMMANDS, which is the deletion it actually performed. Planted red, both halves, against the real gate: [R37 is-runtime-cutover] 2 violation(s): (is cutover row):1 — claims retired static command set 'WEB_QUERY_COMMANDS_WITH_IS', which no production source declares (is cutover row):1 — claims retired static command set 'HARMONYOS_IS_SUPPORT', which no production source declares [R37 is-runtime-cutover] 2 violation(s): src/core/capabilities.ts:59 — static command set WEB_QUERY_COMMANDS still admits is so the exact claim that shipped is now rejected by name, and so is restoring the membership it claims to have removed. Mechanism cases live with the other planted-row tests; layering goes 177 -> 181. * test(is): pin the exit-code guarantee independently of what answers the predicate Prep for the Blocker 1 retirement, which deletes `buildDirectIosIsResult` — the function the #557 reversal fixed. The reversal's guarantee must not evaporate with it, so it gets a case that does not know how the daemon decided. `is` is documented to "exit non-zero on failure". The reversal proved that at the JSON envelope; nothing pinned it at the CLI boundary, which is where the defect was actually visible (`Passed: is text`, exit 0). This asserts the CLI contract directly: a `predicate_failed` response exits 1 and never renders as passed. It survives the retirement untouched, because it asserts the outcome rather than the path. Planted red with the exact pre-#1739 envelope the shortcut produced (`{ok: true, data: {pass: false}}`): `exitSpy.calls` is `[]` — no exit call at all — so the case fails, which is the regression it exists to catch. Unpushed on purpose: the restack will carry it into the retirement cycle. * refactor(is): retire the direct-iOS selector shortcut thymikee's ruling (option b). `is` declares `device-runtime`, so its request path must reach the device only through the operations R37 declares. It did not: a simple iOS `id=`/`label=` target was answered by a direct XCUITest querySelector without any capture, ordered after admission but not executing through the seam. This is not retired because it was wrong. `wait` hypothesized that the degenerate one-node evaluation mis-answers `is visible` for off-viewport nodes, traced it through the code convincingly, then tested it on device and it did not reproduce — XCUITest's own query is conservative about visibility, so the degenerate evaluation never gets the chance. It is retired because it was an undeclared, unmeasured bypass that made R37's singularExecution claim false: the same class of untruth as the sentinel retirement names fixed in the previous commit. Declaring querySelector as a real operation instead was rejected for a concrete reason: offscreen-target-probe.ts consumes queryDirectIosSelector with a plain session and cannot take a bound operation, so declaring it now would ship it twice until Wave 5 moves the probe — the deferred-duplication shape that got get's read deferral overruled. It returns as a declared, fact-admitted, section 9-measured operation in the unit that also moves the probe. Retired: dispatchDirectIosSelectorIs, its call site, buildDirectIosIsResult, and resolveDirectIosSelectorQuery — each had exactly one caller, all on this path — plus the ResolvedDirectIosSelectorQuery type they orphaned and two imports. queryDirectIosSelector itself stays: the offscreen probe still consumes it and it remains single-copy. Latency cost, stated plainly and not softened: a held predicate on a simple iOS selector goes from ~0.14s with no capture to ~0.25s with one, measured as the median of 9 warm runs on iPhone 17. There is no fallback and no fast path. R37's comment finally describes the code: "every predicate answers from the resolved tree" was written while the shortcut existed. Its scope is now stated too, so it is not read as absolute — the Android foreground-blocker diagnostic still reaches adb on the failure path, where it cannot produce or change a verdict; that edge is pre-existing, co-owned with wait, and recorded as Wave 6 denominator work with R22's appState as its declared replacement. Seven tests lost their subject. Those whose only content was the shortcut's own mechanics are deleted; the outcome-level ones are retargeted and keep asserting what survives. --------- Co-authored-by: agent <agent@local> * fix(contracts): a falsely advertised element read fails as a contract bug An owner whose facts advertised `readTextAtPoint` but whose interactor cannot perform it was reported as `{ status: 'unreadable', reason: 'surface-not-readable' }`. That put a contract violation inside the closed reason set that licenses falling back to the captured tree, so `get text` answered from potentially stale snapshot text precisely because the runtime lied about itself. ADR 0019 §2 requires the mismatch to fail as `runtime-contract-invalid`; it now throws. Removing the only producer of `surface-not-readable` made that reason dead: no path can reach it, since an interactor that HAS the read maps a blank or absent answer to `no-text-at-point` via `elementTextRead`. Dropped from the union, its consumer switch arm, and both test lists. `classifiedFallbackReason`'s `never` arm stays — it is what makes adding a reason a compile error rather than a silent untyped fallback. Deduplication found while auditing the change: - `invalidRuntimeContract` was module-private in `platform-runtime.ts`. It now owns its own module so both runtime modules share one construction. It is deliberately not exported through the platform facade: that facade must stay exhaustive over its sources, which would make this a public symbol with no external consumer. - The 8-field runner execution projection was written out three times (`snapshot-runtime-capture-input.ts`, `interaction-read.ts`, `screenshot-runtime.ts`). One `runtimeExecutionFromContext` now serves all three; `screenshotExecutionFromContext` keeps its name and delegates, since `ScreenshotRuntimeExecution` and `SnapshotRuntimeExecution` are the same type. Dropping a field here silently strips request id, log/trace paths, XCUITest overrides, or runner lease context — an operation that still answers but runs unconfigured, which is exactly the defect the wait unit hit as a P1. Red before green: with the old guard restored the new regression fails with "Missing expected rejection" — the call resolves instead of throwing, which is the silent degradation it exists to forbid. --------- Co-authored-by: agent <agent@local>	2026-08-20 15:59:38 +02:00
Michał Pierzchała	fed7251336	fix: calibrate iOS scroll execution (#1905)	2026-08-20 15:19:08 +02:00
Michał Pierzchała	f9d8618318	fix(maestro): make iOS presentation correspondence authoritative (#1899) ... * fix(maestro): make iOS presentation correspondence authoritative * refactor(maestro): simplify presentation target resolution	2026-08-20 15:06:58 +02:00
Michał Pierzchała	5bdc1554f2	refactor(maestro): remove obsolete presentation mapping (#1896)	2026-08-20 13:22:19 +02:00
Michał Pierzchała	d072819632	refactor: reuse kernel uniqueStrings instead of local copies (#1892) ... Three modules hand-rolled local uniqueStrings helpers despite the AGENTS.md reuse rule and the canonical export in @agent-device/kernel/collections: - src/platforms/apple/core/perf-frame.ts (identical semantics) - src/platforms/web/agent-browser-lifecycle.ts (empty-string filter now composed at the one call site that receives caller input; the home marker call site passes path.join results that are never empty) - packages/selectors/src/internal/build.ts (identical semantics) All three files' packages already depend on @agent-device/kernel and siblings import the same subpath.	2026-08-20 12:52:18 +02:00
Michał Pierzchała	2d7a310dd0	fix(maestro): restore conformance invariants (#1889) ... * fix(maestro): restore conformance invariants * fix(maestro): use exact iOS presentation mappings	2026-08-20 12:51:43 +02:00
Michał Pierzchała	b0f9c050ce	test: make hard-coded caps overridable behind seams (#1781 B5) (#1858) ... * test: make hard-coded caps overridable behind seams (#1781 B5) HarmonyOS snapshot gains a maxNodes seam (mirroring the Android helper and Linux AT-SPI capture options) so the node cap's truncation signal is exercised below the 5,000 default; the durable descriptor JSON node cap gets its boundary test alongside the existing depth one. * test: cover both durable-JSON node-cap guards (#1781 B5) * fix(harmonyos): keep snapshot analysis counting past the emitted-node cap The walk returned as soon as the cap filled, so an omitted node's descendants reached neither rawNodeCount nor maxDepth and analysis under-reported exactly the oversized trees the cap exists for. Emission is now capped while accounting continues, matching the whole-tree claim the Android helper's analysis makes. Also pins the durable descriptor JSON node cap at its exact boundary: 4,096 nodes accepted, 4,097 rejected, through both the object-owned and array-owned counting sites. * refactor(harmonyos): own the snapshot traversal policy in a pure function B5 asked for caps to be overridable so tests can reach them; for this cap the better answer is to extract the policy rather than widen the production interface. collectArkUiNodes takes every bound explicitly, so the emission limit and the accounting-continues-below-it rule are tested at their owning interface, and snapshotHarmony keeps its SnapshotOptions shape with no option no caller sets.	2026-08-20 10:37:20 +02:00
Michał Pierzchała	2eeb9c644f	fix(maestro): refresh target after selector miss (#1886)	2026-08-20 10:31:59 +02:00
Michał Pierzchała	9ce1ef7587	feat(snapshot): move scope into presentation (#1855) ... * feat(snapshot): move scope into presentation Use one preorder label/identifier/value policy across Swift and TypeScript, keep scoped iOS acquisition conservative, and remove the daemon's second scope pass. Non-vacuity: label-only matching failed identifier/value parity fixtures; Android pass-through failed its boundary test; disconnecting Swift applyScope produced eight scope/depth/projection failures. * fix(snapshot): select scopes with presented content * docs(snapshot): describe presentation-owned scope * docs(snapshot): record contribution-aware scope * refactor(snapshot): drop unrelated provider churn * fix(snapshot): accept healthy empty scoped capture * refactor(snapshot): isolate empty-scope admission * fix(snapshot): align scope ownership across runtimes * test(snapshot): pin post-wire scope owner * test(snapshot): retain find test shrink	2026-08-20 10:30:18 +02:00
Michał Pierzchała	139e3aa7f4	fix: surface remote install network causes (#1863) ... * fix: surface remote install network causes * fix: sanitize remote error causes * fix: bound sanitized error causes after redaction	2026-08-19 18:17:26 +02:00
Michał Pierzchała	d8e03aea9b	refactor: migrate screenshot to request-bound runtime (#1878) ... Retires the last dispatchCommand edges for screen capture: the generic-route command, the sparse-snapshot fallback, and the Android snapshot-timeout evidence capture all admit exact owner facts and bind once (ADR 0019, cutover rule R39). --overlay-refs becomes part of the declared use, so a target that can capture pixels but not a tree is refused before anything is written to disk.	2026-08-19 17:33:48 +02:00
Michał Pierzchała	67ce19b50c	fix(daemon,kernel): device-selection safety — identity conflicts and ambiguity fail instead of retargeting (#1880) ... * fix(daemon): session-lock identity conflicts fail instead of changing device identity `--session-lock strip` resolved every conflict by deleting the offending selector, including --udid/--serial/--device. The command then ran against the BOUND session's device rather than the one the caller named, and the error hint that produced this state actively recommended strip. A wrong-device tap that reports success is worse than any loud failure, so: - a conflict on a device IDENTITY selector now fails under both reject and strip; strip keeps resolving platform/scope selectors (--platform, --target, --ios-simulator-device-set, --android-device-allowlist), which is what it exists for; - the structured error carries both sides (requestedDevice, boundDevice) so a caller can choose a recovery without parsing prose; - the fresh-session hint offers the two real recoveries — close the bound session if the requested device is intended, drop the selector if the bound device is — and never mentions strip for an identity conflict. The existing bound-session hint already stated both and is unchanged. Admission-layer only: this is device/session resolution policy, evaluated before any interaction dispatch path is selected, so no ADR 0011 guarantee cells move. One table pins the crossing: fresh vs existing session, matching/conflicting/absent identity, reject vs strip, binding vs inventory command, Android serial / Android udid / Apple udid, with the exact error details and hint asserted. 7 of its 13 rows are red against the previous policy. * fix(kernel): validate platform-specific device flags before resolution `--udid` enters Apple resolution unconditionally, so `--platform android --udid emulator-5580` answered "No Apple device with UDID emulator-5580" — an answer about a platform the request had explicitly excluded, which reads as a missing device rather than a mistyped flag. Both directions now fail as INVALID_ARGS naming the correct flag (--serial for Android/HarmonyOS, --udid for Apple). Requests that name no platform keep the existing DEVICE_NOT_FOUND behavior, since nothing contradicts the selector there. * fix(kernel): refuse ambiguous singular device resolution instead of picking one resolveDevice answers with exactly one device, so every caller of it needs one concrete device. When the request carried no identity and several candidates were equally preferred, it returned the first by discovery order (or alphabetically for Apple) — a successful response describing a device the caller never selected. That is worse than any loud failure, and reads are not safer than writes: a snapshot of the wrong emulator is a wrong answer that looks right. Ambiguity is now a refusal at the resolver boundary, not a command-kind allowlist: - established preference tiers are preserved (virtual over physical, the Apple kind/target rank, then booted over offline); only what survives them equally is ambiguous, since the comparator's remaining tie-breaks are name and discovery order, which encode nothing about intent; - one booted emulator beside offline candidates still resolves, as do explicit --device/--udid/ --serial and any command inside an existing session, whose identity is already fixed; - multi-device commands ("devices") never enter singular resolution; - the error reuses the declared device-candidate details domain (AMBIGUOUS_MATCH + "devices"), so CLI and MCP already render the bounded list, with a hint naming the platform-appropriate selector. * fix(kernel): drop the mismatched article from the selector-flag hint "Use --serial X to select a android device by serial" — the platform name is interpolated, so no article fits every value. Names the flag's platform family instead.	2026-08-19 16:51:44 +02:00
Michał Pierzchała	79dddaf781	refactor: tighten viewport runtime facts (#1873)	2026-08-19 11:06:18 +02:00
Michał Pierzchała	37b1bc8cbd	refactor: migrate viewport to request runtime (#1864) ... * refactor: migrate viewport to request runtime * fix: preserve viewport cutover evidence	2026-08-19 10:38:27 +02:00
Michał Pierzchała	294654a3a5	fix(android): resolve snapshot scope once and disclose the API 23 occlusion-scan gap (#1832 C1/C2) (#1846) ... * fix(android): resolve snapshot scope once and disclose the API 23 occlusion-scan gap (#1832 C1/C2) - Android resolves --scope inside its projection only, under the shared scope specification (matchesSnapshotScope in @agent-device/contracts/snapshot: first document-order match over label/value/identifier, empty on no match). The daemon post-wire scopeSnapshotNodes pass skips the android backend, so scope has one owner and one no-match semantics instead of BFS+fallback followed by document-order+empty. - Golden table contracts/fixtures/snapshot-scope-policy.json is asserted against the predicate, the Android projection, and the daemon pass; the Swift runner twin (#1797) consumes the same table. - androidSnapshot.occlusionScanUnavailable discloses helper trees without drawing-order (API 23), where the covered-sibling pruner cannot run. Disclosure only; C1 stays open until occlusion moves to the daemon annotator. * fix(android): resolve scope over the presented tree and stop dropping it on interaction captures Adversarial review findings on the first commit: - BLOCKER: captureSnapshotData spread `snapshotScope: undefined` over flags, so an interaction capture (press/click/fill/longpress/hover --scope, --settle observation) reached the Android platform unscoped while buildSnapshotState still saw the scope. The post-wire pass used to rescue it; after skipping android it returned the unscoped tree. One effective scope now feeds both. - Scope resolves over the PRESENTED nodes of the requested projection, not the acquired tree, so an acquired match that membership drops no longer empties the snapshot, and Android matches the domain iOS's pass uses. - Slicing after the walk keeps ancestor context (hittable/collection/chrome) above the scope root, so scoped -i is a subset of unscoped -i; --depth stays scope-relative. - Shared findSnapshotScopeRange/reindexSnapshotNodes so the daemon pass and the Android projection run one implementation; scope slice extracted to ui-hierarchy-scope.ts (mirrors its test). - parseUiHierarchy moved to a test fixture module (it had no production caller left). - Golden rows sharpened (value row no longer matches via label on Android); the Android leg runs raw AND regular. CHANGELOG entry; docs wording corrected for iOS/@ref. * fix(layering): keep the contracts snapshot façade exhaustive over snapshot-scope * fix(android): scope to the first match whose subtree still has presented content Review P1 on #1846: with scope resolved strictly over presented nodes, `snapshot -i --scope panel` answered "no nodes" whenever the matched container was a structural view membership drops — even though the button inside it was exactly what was asked for — and `--depth 0` then hid a node the response prints at depth 0. The scope root is now the first document-order match whose subtree contributes at least one node to the requested projection, and the result is that subtree's presented nodes re-rooted at depth 0. Both failure modes die: a decorative match membership drops no longer empties the snapshot, and a dropped container still scopes to its content. `--depth` under scope filters the depths the response emits, so a node shown at depth 0 survives `--depth 0`. Tests: the golden legs stay raw+regular (bare TextViews cannot survive -i, so an -i leg would measure membership, not scope) with the projection interplay pinned by two dedicated tests on actionable shapes; the 'not re-scoped after the wire' case now runs a real parsed scoped tree instead of fabricated depth-0 siblings.	2026-08-18 18:44:13 +02:00
Michał Pierzchała	d76e0f94e9	refactor: migrate snapshot to device runtime (#1779) ... * refactor: migrate snapshot to device runtime * refactor: complete snapshot runtime policy cutover * test: enforce snapshot owner-facts admission * refactor: consolidate desktop snapshot capture * fix: scroll to visible iOS smoke targets * fix: close snapshot cutover alias bypasses * fix: constrain snapshot admission identity flow * fix: enforce snapshot admission through owner facts * fix: adapt replay source tests to snapshot runtime	2026-08-18 15:49:24 +02:00
Michał Pierzchała	a853734f0c	fix(webdriver): give cloud session creation its own budget and stop leaking billed sessions (#1782) ... * fix(webdriver): give cloud session creation its own budget and stop leaking billed sessions Cloud lease allocation ran under the generic 30s/1-retry request policy, so BrowserStack iOS real-device session creation (45-90s) aborted client-side at ~60s on most runs. Each timed-out POST /session still completed server-side and, being non-idempotent, was retried — leaving two billed provider sessions per failed open with no id to release them. - POST /session is its own phase: a 180s create budget (default), zero retries, and no request-bound abort, so the daemon always learns the session id. - lease_allocate carries a 300s allocation budget surfaced to providers as LeaseLifecycleContext.deadline, and a matching 330s client envelope that preserves the daemon on timeout (a reset would SIGKILL mid-create and orphan every billed session the daemon held). - The request's cancellation signal is ownership evidence: a session that completes after the requester left is released, not registered; a create that the transport gives up on surfaces typed evidence (provider + lease) so an operator can find and stop the maybe-orphaned session. Closes #1774 * refactor: one canceled-request error, and tighten the #1774 shapes Review pass over the session-create fix: - The canceled-request error had nine hand-rolled copies (src/request/cancel, maestro shared, exec, retry, install-source x2, and the new provider one). It now has one definition in @agent-device/kernel/errors: createRequestCanceledError(details?, cause?) + isRequestCanceledError + REQUEST_CANCELED_REASON. Callers add evidence or a sharper hint; the reason itself is not overridable, so nothing can build one the predicate misses. - lease_allocate's timeout bundle moves beside INSTALL_TIMEOUT_POLICY in the registry (same {...DEFAULT, envelopeMs, onTimeout} shape); the request timeout constant stays exported from timeout-policy like its siblings. - Transport: fetch helper returns Response's own ok/status; the timeout reason const is private behind isWebDriverRequestTimeout. - Client: one-use options type inlined; the two deadline helpers share one floor. - Session-manager tests: shared makeRuntime/jsonResponse/afterEach restore. Net -29 lines with the feature in. * chore: keep the canceled-request reason private to the kernel * fix: typed cancellation everywhere + own the AWS remote-access ARN through startup Second-order follow-ups the #1774 refactor made cheap: - markRequestCanceled aborts the request signal WITH the kernel's typed canceled error as its reason. Every signal.throwIfAborted(), aborted fetch, and 'throw signal.reason' in the daemon (20+ sites) now surfaces a canceled request as such instead of a bare DOMException that normalized to UNKNOWN — and no site has to know the factory exists. - AWS Device Farm prepareSession owns the remote-access ARN from the moment create-remote-access-session answers: a startup timeout, the allocation deadline, or a canceled request now stops it before the failure surfaces (previously a timed-out startup left a RUNNING billed session behind — the same leak class as the WebDriver session, one phase earlier). The startup wait is capped by LeaseLifecycleContext.deadline and wakes on cancellation. - BrowserStack's pre-session local app upload honors the request signal (an upload is not billed, so plain abort is right there). - lease_heartbeat/lease_release share lease_allocate's preserve-daemon policy: the rationale — the daemon owns billed sessions; a reset orphans them all — applies verbatim. Each AWS ownership test proven red without the guard (3/3). * refactor: dedupe billed-resource cleanup and lease-signal wiring Shrink pass — same behavior, less duplication: - releaseOnFailure(primaryError, release) in webdriver-utils replaces the two identical 'best-effort stop the billed resource, attach cleanupError to the primary AppError' helpers (WebDriver session + AWS remote-access ARN); shared errorMessage too. - The lease handler pulls the request signal from getRequestSignal(requestId) like every sibling handler, instead of threading a requestSignal arg through LeaseHandlerArgs and the request-handler chain. Drops the field, the wiring, and five mechanical test edits; the handler test now proves the request-bound signal (abort it, watch the provider's signal flip) rather than arg identity. - Inlined the one-use requestHeaders back into fetchWebDriver. Handler-signal test proven red without the wiring. * fix(lease): the daemon releases a lease allocated for a gone requester; honest release evidence Review follow-up. The provider was doing the daemon's job: it treated the request signal as 'ownership evidence, not an interrupt' and needed three paragraphs to say so. The daemon owns the request, so it now decides — generically, for every provider — what happens to a lease that finished allocating after its requester left: release it (provider + registry) and answer with the canceled error. - lease.ts: after allocate returns, isRequestCanceled(requestId) → releaseAllocationForGoneRequester(). Release evidence is claimed ONLY on a clean release (no warnings, no throw); a WEBDRIVER_SESSION_DELETE_FAILED release is reported released:false with providerSessionId + a stop-by-hand hint (thymikee's finding: the previous evidence was success-shaped even when DELETE failed). - WebDriverSessionManager: the createOwnedSession/releaseCanceledSession trio is gone; allocate is plain 'create with a budget; on failure clean up' again. - LeaseLifecycleContext.signal is just cancellation, like everywhere else; the ownership-semantics comments on the contract, client, registry, AWS prepare and utils shrink to what the code no longer says itself. - Tests: the two provider-level cancellation tests move to the daemon handler (where the logic now lives), plus the failing-DELETE regression; both proven red without the post-allocate check. * fix(aws): the allocation deadline bounds remote-access startup, not the 120s default Live iOS real-device run: startup needed ~128s and hit the standalone 120s default while the daemon's 300s allocation budget still had room — the new ownership guard correctly stopped the ARN, but the open failed for no reason. When the daemon supplies a deadline it is the bound; the default only applies standalone. Rerun: open in 112s, snapshot, clean close, session STOPPING. * test(aws): pin that the allocation deadline outlives the 120s startup default; drop empty import Review follow-ups on 7f9d1481a: a virtual-clock test (Date.now advanced 10s per poll, RUNNING at 150s, deadline 300s) that fails on the old min(default, deadline) logic and passes now; and the empty 'import {} from kernel/errors' left in maestro/shared.ts is removed. * refactor: finish the dedupe — one release path, kernel errorMessage, AWS on releaseOnFailure Code-quality review at 7f9d1481a: 1. aws-device-farm.ts still carried its own copy of releaseOnFailure (the dedupe commit's script aborted before reaching it and I mis-verified). Now uses the shared helper; private copy deleted. 2. Empty 'import {} from kernel/errors' in maestro/shared.ts removed (273870099). 3. errorMessage() lives in @agent-device/kernel/errors; the two copies this PR had added (lease.ts, webdriver-utils.ts) import it. Sweeping the pre-existing copies is a follow-up. 4. lease.ts has ONE release path: releaseLease(registry, provider, lease, request, ctx) → { released (registry), provider } used by both the lease_release case (wire shape unchanged) and the gone-requester branch, which folds a throwing provider release into releaseError. 'released' now means the same thing in both; the provider verdict is a separate 'providerReleased' (warnings-free, no throw) that drives the stop-by-hand hint. -~35 lines. 5. sessionCreateTimeoutMs is Omit-ed at the WebDriverTransportOptions boundary instead of Pick-ed back out internally. * fix(lease): 'released' on a canceled allocation means the billed session is confirmed gone Re-review at 3665ea06: unifying the release path had made the cancellation error report released:true from the daemon's registry record while the provider DELETE had failed — success-shaped again, with the operator verdict demoted to a second key. Fixed at the source of the ambiguity: - LeaseReleaseOutcome names its bookkeeping field registryReleased. - On the canceled error, 'released' is true only when registryReleased AND the provider released without warnings AND without throwing; the registry record is exposed as 'registryReleased'. The stop-by-hand hint keys on 'released'. - lease_release keeps its existing wire field ('released' = registry; provider cleanup rides in 'provider'), unchanged. - Regressions: failed DELETE and throwing release both pin released:false / registryReleased:true (+ providerSessionId, warnings|releaseError, hint); both proven red on registry-only semantics. * ci: retrigger default-setup CodeQL Run 32051017472 is wedged on GitHub's side: status=completed with Analyze (python) still queued and Analyze (java-kotlin) failed only at SARIF upload (503, 'No server is currently available'). It can be neither cancelled nor rerun, and default-setup CodeQL has no dispatchable workflow, so a new push is the only way to get a fresh run. No source change. * test(webdriver): assert the typed timeout contract on the shared-budget probe main's #1790 tightened this test to expect the raw TimeoutError DOMException, which this PR intentionally normalizes into AppError{reason: webdriver_request_timeout}. On the merge ref the two met and Coverage went red. The regression now asserts the structured contract and that the second request's budget is the shared remainder (~118ms of 200 after an 80ms first call).	2026-08-18 15:48:58 +02:00
Michał Pierzchała	d0d5c8594c	fix: serve remote daemon request diagnostics to the caller (#1801) (#1814)	2026-08-18 15:36:09 +02:00
Michał Pierzchała	60f6356b04	fix: read replay scripts on the caller and ship them with the request (#1810) ... * fix: read replay scripts on the caller and ship them with the request Closes #1802 * test: assert the caller-side replay path as a substring, not a hand-escaped regex * perf(cli): load the Maestro engine only when a replay entry is a flow The command registry evaluates every command family on CLI startup, so the replay script-source builder's static @agent-device/maestro import put the YAML parser on the --help path. It now loads on demand behind the format check, and the startup import-closure guard covers the engine the way it already covers node:http. * refactor: share the replay request field vocabulary across the CLI and client views The new replay script-source flags appear in both CliFlags and CommandExecutionOptions, which fallow flagged as a clone; ReplayRequestFields declares them once. The test-suite handler's missing-sources rejection now travels the typed-error path its sibling rejections already use, so the fix adds no branch to handleSessionReplayCommands.	2026-08-18 14:56:34 +02:00
Michał Pierzchała	f843dc2df1	fix(scroll): keep saturated scroll gestures out of the status bar; gate Android replays from android/emulator (#1781 A1) (#1820) ... * fix(scroll): keep saturated scroll gestures out of the status bar; gate Android replays from android/emulator (#1781 A1) `pnpm gate replay-android` failed 4/8 whenever it ran after the full-tier Android E2E (replays-nightly run 32107665052, job 95620294899): 05-app-lifecycle, 06-swipe-gestures and both fixture replays diverged under "A system surface covers the app". The E2E was not the cause. Reproduced on a pixel_7 / API 36 AVD with the same cutout geometry CI's `avdmanager --device pixel_7` produces (status bar 136px, not the 63px of a plain 1080x2400 skin): - `03-scroll-discovery.ad` runs `scroll up 3`. The scroll planner clamps travel to the viewport minus a 5% band, so the touch-down landed at y=120 — inside the 136px status bar — and pulled the notification shade instead of scrolling. On API 36 the app window is edge-to-edge, so the reported viewport starts at y=0 and includes that bar. - The shade then covered every replay until `04`'s `back` closed it. Native readdir order on the runner (03, 05, 06, fixture/02, fixture/01, 04, 01, 02) put four files in that window; the last green run (2026-07-30) had 04 right after 03, so the pull was masked. Fix in the product, not the lane: DEFAULT_EDGE_PADDING_FRACTION 0.05 -> 0.1 in the TS scroll planner and its Swift port. Every real Pixel has a cutout (5.7% of a Pixel 7's height) and an iPhone's Dynamic Island status bar is 6.9%, so any saturated `scroll up` opened the shade / Notification Center for real agents too. Parity vectors updated in both suites plus a Pixel 7 regression vector (1080x2400, amount 3 -> touch-down y=240 > 136). Second contamination the same order exposed once the shade was gone: `fixture/02-selector-routes-covered-diagnosis.ad` is a #1715 reproduction recipe that FAILS BY DESIGN at step 9 (covered-target refusal) and leaves the device in landscape, yet the gate enumerated `test/integration/replays/android` recursively. iOS keeps gate replays in `replays/ios/simulator` and fixture recipes in `replays/ios/fixture`; Android now mirrors that: the six Settings replays move to `replays/android/emulator`, `test:replay:android` points there, and `fixture/` stays E2E-owned (`full:fixture-replays` already runs 01 by path). android.yml and the workflow-evidence fixture follow the path; the replay-compat manifest keeps the historical paths it pins at released tags. Verified live (Pixel 7 geometry, API 36, --retries 0): control run at main head in CI order reproduces exactly CI's 4/8; with the fix, `pnpm gate replay-android` 6/6 in both native and CI order, and `03` leaves Settings on screen (scroll up 3 now touches down at y=240). * test(scroll): drive the TS and Swift scroll-plan parity vectors from one table (#1820 review) The two suites hand-mirrored the same vectors and #1820 had to edit both by hand — the drift class the repo already closes for the tap-point rule via contracts/fixtures/tap-point-policy.json. The scroll vectors (plus both planner constants, pinned behaviourally on a 1000px axis) now live in contracts/fixtures/scroll-gesture.json; scroll-gesture.test.ts and RunnerTests+ScrollGesture.swift iterate it. Verified: vitest 10/10; the four XCTests run on an iOS 26.2 simulator with the unit flag on (Executed 4 tests, 0 failures). Also: test/ci/android-workflow-evidence.json says what it guards. Follow-up for content-safe viewport bounds + discovery order: #1821.	2026-08-18 14:31:54 +02:00
Michał Pierzchała	8db36299e4	feat(web): add hover command for hover-gated UI (#1783) (#1786) ... * feat(web): add hover command for hover-gated UI (#1783) Add a first-class `hover <x y|@ref|selector> [--settle]` verb, admitted on web only, that moves the pointer without pressing via the agent-browser backend (mouse move). It rides the existing targeted-touch pipeline (ref/selector/coordinate resolution, occlusion/off-screen guards, settle observation, response builder, recording) through a new optional Interactor/backend `hover` op that only the web provider implements. Touch platforms have no hover state: capabilities advertise it on web only and iOS/Android/Linux reject it at admission with a --platform web hint; longpress stays the mobile hold-gesture verb. Closes #1783 * fix(hover): native hoverRef route for web @ref, android coverage pin, revert skill edit Review follow-ups on #1786: - hover @ref on web now dispatches through the provider's own element handle (agent-browser `hover <ref>`) via a new backend hoverTarget, mirroring click/fill's ADR 0011 native-ref path — web ref frames carry no rects, so the coordinate route could never resolve them. The shared preflight + exact-ref dispatch is extracted into dispatchNativeRefInteraction and used by tap/fill/hover; the guarantee matrix native-ref row now lists hover. - Daemon regression test is production-faithful: rect-less web ref frame, scoped provider, asserts no coordinate dispatch. Selector→coordinate and provider hoverRef tests added. - Android emulator coverage summary pin 2/53 → 3/54. - skills/agent-device/SKILL.md reverted (out of scope, AGENTS.md rule). - Docs/help disclose that --settle with @ref on web shares click's existing limitation; use a selector or coordinates for the settled diff. * test: drive hover through the apple output guard; cover direct hover dispatch The provider-integration apple-leak guard partitions every public command into driven/skipped; hover was neither, which failed Integration Tests and took Coverage down with it. Drive it (it reaches the Apple capability refusal, which is scanned like any other error response). Also cover the direct-dispatch handleHoverCommand seam. * test(web): drive hover @ref in the provider-backed web scenario The integration-progress gate requires every public command to be referenced by a provider-backed scenario. Add hover @ref to the web desktop flow: it must reach the provider's hoverRef handle (never a coordinate) and be recorded on the session without fabricated x/y, like click @ref.	2026-08-18 11:32:48 +02:00
Michał Pierzchała	681cad2222	test: assert the specific error code instead of any failure (#1781 B4) (#1790) ... Converts the 20 test assertions across the repo that accepted ANY failure (bare `expect(...).toThrow()`, bare `assert.throws(fn)`, bare `assert.rejects(p)`) into assertions on the specific AppError `code` each test is actually about, or — where the propagated error is genuinely opaque (a mocked upstream failure whose identity, not its shape, is the point) — identity assertions with a comment explaining why. Added a synchronous `assertThrowsAppError(fn, {code, message?})` sibling to the existing `assertRejectsAppError` helper in src/__tests__/test-utils/app-error.ts, exported via the test-utils index, for the two src/ sites that needed it. packages/provider-limrun and packages/provider-webdriver have no test-utils dir and cannot import from src/, so those sites use vitest's `expect(...).toThrow(expect.objectContaining({ code }))` or an inline `assert.rejects(p, matcherFn)` instead. Sites converted: - packages/provider-limrun/src/app-log-runtime.test.ts:153-155 (bare `.toThrow()` x3 -> `UNSUPPORTED_OPERATION`) - src/daemon/__tests__/app-log.test.ts:39 (bare `.toThrow()` -> message match; plain Error, not AppError, from verified-file's identity check) - src/daemon/__tests__/resumable-upload-range.test.ts:13 (bare `assert.throws(fn)` -> `INVALID_ARGS`); also fixed line 19's `assert.throws(fn, value)`, a documented Node.js gotcha where a string second argument is the failure message, not a matcher, so it was equally bare in effect - packages/provider-webdriver/src/webdriver-client.test.ts:229 (bare `assert.rejects(p)` -> asserts the raw AbortSignal.timeout() rejection's `name`, since the transport re-throws it unwrapped) - src/daemon/handlers/__tests__/session-device-claims.test.ts:129, 151, 174 (bare `assert.rejects(p)` x3 -> identity assertions; each test's point is device-claim rollback/retention around an opaque mocked upstream failure) - src/platforms/android/__tests__/settings.test.ts:109 (bare `assert.rejects(p)` -> `UNSUPPORTED_OPERATION`) - src/platforms/android/__tests__/snapshot.test.ts:1071, 1342 (bare `assert.rejects(p)` x2 -> `COMMAND_FAILED` + message) - src/platforms/android/__tests__/touch-helper-session.test.ts:526 (bare `assert.rejects(p)` -> `COMMAND_FAILED`, wrong-protocol message) - src/platforms/apple/core/__tests__/runner-command-retry.test.ts:472, 527, 550, 762, 881, 1016 (bare `assert.rejects(p)` x6 -> `COMMAND_FAILED` with the recovery-path-specific details/message) - src/platforms/apple/core/__tests__/runner-transport.test.ts:61 (bare `assert.rejects(p)` -> identity assertion; fetchWithTimeout does not wrap fetch() failures into an AppError) No repo-wide scanner/lint rule added (explicitly out of scope per #1781); no test loosened.	2026-08-18 10:13:28 +02:00
Michał Pierzchała	0d3b7413c5	fix: prevent private AX subtree leaks at source (#1807) ... * fix: prevent private AX subtree leaks at source * fix: preserve values in settle signals * fix: normalize settle signal semantics	2026-08-18 09:23:39 +02:00
Michał Pierzchała	ed1d44fa62	fix: unify private AX scroll visibility (#1798) ... * fix: unify iOS scroll snapshot visibility * fix: preserve composed scroll hints	2026-08-18 00:47:25 +02:00
Michał Pierzchała	f378050586	feat(snapshot): attach a fallback screenshot to sparse captures (#1764) ... A sparse verdict already tells the caller to use a screenshot as visual truth, which made that screenshot the guaranteed next command on every unreadable screen — a second round trip to obey advice we authored. The user-facing `snapshot` dispatch now takes the shot itself and links the path in its warnings. The fallback is deliberately hung off `dispatchSnapshotViaRuntime` and skipped for internal observations: selector resolution, settle, and wait polling reach `captureSnapshot` directly, so a wait polling an unreadable screen cannot turn into a screenshot per poll. A failed shot is swallowed — the verdict's own warning still carries the manual remedy, so the fallback can never fail the snapshot that was asked for. Sparse captures also say when the screen is the app's problem. Only the `sparse-tree` reason code is evidence about the app: every backend reached the screen and it published no semantic content, which is the same emptiness assistive tech gets. `ax-rejected`, `budget`, `no-nodes` and `capture-failed` are limits of this tool and stay unattributed, so readers are not sent to file bugs against code that is not broken.	2026-08-16 16:06:10 +02:00
Michał Pierzchała	d8a7d03faf	refactor: route application lifecycle through runtime facts (#1759) ... * refactor: route application lifecycle through runtime facts Moves the canonical `open`, `prepare`, `close` and internal `runtime` descriptors behind package-owned lifecycle bindings admitted from device runtime facts, while daemon request/session policy and public response construction stay put. Based on main, which already carries the boot unit, the parametrized cutover gate and the apps unit. Readiness is package-owned there, so the Apple and Android bindings call ensureAppleReady/ensureAndroidReady rather than a root readiness bag; ensureAppleReady gained an onColdBootStart hook so open keeps warming the runner cache in parallel with a cold boot, and a narrow markBooted port publishes readiness' fresh observation so a flow still makes one simctl listing. Cutover rows take R24-R27, clear of the accepted catalog and the sibling install stack, and cutoverTableDefects rejects a duplicate rule id. Two defects this unit introduced are fixed here rather than shipped: `open <app> <url>` dropped the URL on a first open, and test-IME activation was first fatal on an unobtainable helper and then over-caught. Helper unavailability is a typed non-activation outcome now; fence, lock and post-record failures propagate. The duplication the unit had accumulated is gone: one runtime-admission module instead of five per-command copies, one direct-lifecycle binding factory instead of six hand-rolled packages, one transport-hint predicate, one session finalization path, and no identity-wrapper module. * fix: allocate lifecycle cutover rows after deployment * chore: preserve lifecycle union reconstruction * fix: reconcile lifecycle runtime stack * refactor: tighten lifecycle runtime topology * refactor: remove superseded runtime adapters * fix: preserve stacked runtime cutovers * test: preserve migrated runtime ownership * test: move Android deployment retry ownership * test: extract runtime hint fixtures * fix: preserve lifecycle stack invariants * fix: complete lifecycle runtime cutover * fix: remove lifecycle cutover residue	2026-08-16 15:13:10 +02:00
Michał Pierzchała	66cca1a5b8	refactor: route install commands through platform runtime (#1758) ... * refactor: route install commands through platform runtime * fix: preserve stacked runtime facts * fix: align deployment facts with shutdown runtime * refactor: simplify capability facts projection * style: format capability facts projection * fix: preserve migrated capability ownership * fix: propagate deployment artifact cancellation * refactor: move Harmony deployment mechanics into package * refactor: move Apple deployment tools into package * refactor: move Android deployment tools into package * refactor: inject deployment temporary storage * refactor: remove superseded deployment helpers * fix: preserve provider deployment transport	2026-08-16 15:13:09 +02:00
Michał Pierzchała	5855dfc2e0	refactor: route shutdown through device runtime (#1757) ... * refactor: route shutdown through device runtime * fix: cover shutdown cutover review gaps * fix: propagate shutdown cancellation * fix: move shutdown mechanics to platform owners * fix: pass device to shutdown fact fixture * test: cover shutdown facts in session state fixtures * test: simplify Android shutdown assertions * fix: preserve Apple shutdown cancellation	2026-08-16 15:13:08 +02:00
Michał Pierzchała	39cd4d346a	refactor: route appstate through platform runtime (#1755) ... * refactor: route appstate through platform runtime * test: keep appstate capability fixture below complexity limit * test: cover appstate required readiness fact * fix: align appstate facts with boot readiness * fix: keep appstate use declaration minimal * fix: close appstate parity and ownership gaps * docs: record final appstate size accounting * fix: merge neutral runtime imports * docs: align final appstate size totals * fix: remove stale runtime dependency edges * docs: correct appstate size accounting * refactor: keep runtime-use factory internal * docs: itemize runtime-use relocation * fix: move appstate queries into runtime packages * refactor: retire root foreground query paths * refactor: share Android foreground parser ownership * fix: preserve Android appstate parser precedence * docs: keep appstate evidence in review artifacts * fix: keep appstate runtime loading lazy * fix: fail closed for stale limrun appstate * fix: preserve limrun recovery and abort appstate * fix: narrow limrun exact-owner recovery * fix: allocate appstate cutover rule * fix: reconcile appstate with merged main * style: format harmony runtime test * fix: allocate appstate rule id * fix: allocate appstate layering rule * fix: remove stale app command admissions * fix: close appstate layering regressions * fix: align Harmony capability parity with runtime facts * test: cover limrun recovery-only readiness * fix: keep Limrun recovery binding app-log only * fix: parse Android app state in linear time	2026-08-12 16:55:50 +02:00
Michał Pierzchała	c7565cb1f8	refactor(snapshot): clean snapshot ownership (#1754) ... * refactor(snapshot): clean snapshot ownership * fix(snapshot): address ownership review feedback	2026-08-12 13:44:21 +02:00
Michał Pierzchała	15133b587f	fix: validate macOS recording finalization (#1732) ... * fix: validate macOS recording finalization * fix: preserve local macOS recording ownership * fix: resolve recording teardown session keys	2026-08-12 12:51:13 +02:00
Michał Pierzchała	f98814ff10	fix: preserve recording evidence across fault boundaries (#1734) ... * fix(recording): preserve native evidence across fault boundaries * fix(android): retire evidence after active publish rollback	2026-08-12 12:11:37 +02:00
Michał Pierzchała	eabc936a0f	refactor: route apps through request runtime (#1756) ... * refactor: route apps through request runtime * test: remove stale apps adapter mock * fix: clean apps runtime replay artifacts * fix: remove stale runtime test exports * refactor: simplify apps runtime admission * test: exercise runtime use through facade * fix: close apps runtime admission gaps * fix: disambiguate doctor app inventory callback * fix: keep capability fixture below complexity limit * fix: keep HarmonyOS app inventory fail-closed * test: type HarmonyOS app admission fixture * fix: restore HarmonyOS app inventory parity * test: align HarmonyOS readiness fixture * fix: preserve HarmonyOS doctor app parity * test: type HarmonyOS doctor fixture * fix: isolate HarmonyOS doctor policy * fix: align apps cutover with shared rule catalog	2026-08-12 11:55:09 +02:00
Michał Pierzchała	b13c06338e	refactor: route boot through readiness runtime (#1747) ... * refactor: route boot through readiness runtime * fix: separate boot admission from readiness * fix: register boot cutover policy * refactor(runtime): move readiness into platform owners * fix(test): tolerate provider temp cleanup races	2026-08-12 11:55:09 +02:00