Inc 1: the loop closes on the documented path (C1, C2, C4, C5, C7, C9, C11, C15, L3, E1)

[fluxxion82]

Inc 1's "see the screen -> act on it" half, plus round 1 (coordinator) and round 2 (Codex xhigh). Rebased onto 0c40d27 — #12's recordings, #13's quoting and #15's exit codes are all in, and app_launcher.launch() keeps both sides of the #13 merge: every argument quoted for the device shell and -W.

Suite: 1287 passed / 22 xfailed at the branch point → 1613 passed, 1 skipped, 0 xfailed now (the last xfails were #15's to delete, not mine). Black and Ruff clean. All three required checks pass, including the real-AVD lane — which is the only place the live rectangle check and the focus wait can be exercised. Every mutation transcript below was run on the pushed tree, restored with cp from a snapshot, never with git checkout.

---

Round 2 (Codex) and round 1 (coordinator)

INC1-02 = O1 — am start -W, from the recording instead of from memory

#12 recorded both halves, and both carry a trap:

• success (am_start_wait_settings): Activity: names the component that actually came up, which for an alias is not the one requested — asking for com.android.settings/.Settings reports com.android.settings/.homepage.SettingsHomepageActivity. A launch therefore cannot be confirmed by comparing those strings. It is confirmed by Status: ok; the resolved component is information.
• failure (am_start_wait_missing): no Status: line at all — Starting: Intent {...}, Error type 3, Error: Activity class {...} does not exist., all on stdout with stderr empty (stderr_bytes: 0), exit 1.

The parser's old "no Status: means inert success" is exactly the failure shape, so it is gone: success requires status == "ok", and am_start_error() reads the Error: line off stdout. Both the exit-1 path and the bad-report path build the same message through _launch_failure, which names the remedy (cmd package resolve-activity --brief). The docstring claiming no ground truth is gone; four tests now read the two recordings, and _ok()-with-empty-stdout no longer stands in for a launch anywhere.

launch() returns (success, message, report) — the resolved activity has to reach the caller as data, not as prose, for INC1-10.

$ cp .../scripts/app_launcher.py $SNAP/app_launcher.py.snapshot
$ python3 /tmp/m3.py
MUTATED: no Status line is treated as success again
$ uvx ... pytest tests/test_app_launcher.py -k no_status_line -q
E  AssertionError: a launch with no `Status: ok` was reported as one
E  assert True is False
1 failed, 52 deselected
$ cp $SNAP/app_launcher.py.snapshot .../scripts/app_launcher.py

INC1-04 — ownership is structural, and a passive label is refused

The name test on the owner silently un-fixed C1 for every control named by a resource id: search_action_bar carries an id, so it recovers no caption, so it did not "answer to" Search settings and the tap went back to the passive TextView inside it. Ownership now asks only where the caption sits: nearest interactive ancestor, else the row-adjacent interactive sibling — next before previous, documented, because a caption follows its control in both recorded Compose layouts.

What makes that safe is the other end: a name-only search that resolves to nothing operable is refused — Not actionable: "X" is a passive label with no control — and exits non-zero rather than tapping a no-op.

$ cp .../scripts/navigator.py $SNAP/navigator.py.snapshot
$ python3 /tmp/m4.py
MUTATED: an owner must carry a name of its own again
$ uvx ... pytest tests/test_navigator.py -k caption_inside_a_control -q
E  AssertionError: fuzzy=True: Element(type='TextView', text='Search settings', ...
E    resource_id='com.android.settings:id/search_action_bar_title', bounds=(200, 638, 553, 709), ...)
E  assert (200, 638, 553, 709) == (42, 605, 1038, 742)
1 failed, 15 deselected
$ cp $SNAP/navigator.py.snapshot .../scripts/navigator.py

test_navigator_scroll.py's coordinate test is reverted from "any enclosing ancestor" to the exact row rectangle [0,1899][1080,2130], and a new test holds that literal to the recorded dump so it cannot rot.

INC1-08 — the bare id, in both scripts

Brief and Codex agreed and I was wrong: com.android.settings:id/search_action_bar now prints as search_action_bar in both scripts. --find-text accepts either form, matched whole (never as a substring — ids embed the package). --find-id is unchanged. Compose test tags were already bare, so this is the only choice under which both toolkits name things alike.

The loop spec's three inventory entries and its independent resolver move to the bare form. That is a deliberate spec change, marked as one in the file — not an adaptation of the expectation to the code: the two scripts printed different strings for one control and one of them had to give. test_navigator_scroll.py:541 is back to title.

INC1-01 — fullmatch, and eligibility means a rectangle

parse_bounds used re.match, so [1,2][3,4]junk parsed as (1,2,3,4) — a confident answer to a value nobody wrote. And is_interactive waved through a node whose bounds were missing or unreadable, which is "operable" asserted about something whose position is unknown.

$ python3 /tmp/m1.py
MUTATED: parse_bounds uses re.match again
$ uvx ... pytest tests/test_hierarchy.py -k trailing -q
E  AssertionError: trailing text -- re.match would take the numbers in front
E  assert (33, 754, 159, 880) is None
1 failed, 27 deselected

$ python3 /tmp/m2.py
MUTATED: is_interactive waves through unreadable bounds again
$ uvx ... pytest tests/test_hierarchy.py -k not_operable -q
E  AssertionError: assert not True
E   +  where True = hierarchy.is_interactive(_recorded_control(..., '[33,754]'))
1 failed, 2 passed, 25 deselected

Knock-on: an unreadable-bounds node can no longer be reached by name at all, so the C5 refusal test is re-derived onto the --find-id route (the route that still gets an agent there) using the recorded search_action_bar with its bounds truncated.

INC1-03 — a deadline that bounds the slow part

The clock now starts before the first capture (which is inside the search), is re-checked after the settle, and is passed into every dump — divided by CAPTURE_ATTEMPTS, so the retries cannot run past it either. The progress line prints when the scroll happens, not after the dump that follows it. And ANDROID_EMU_MAX_SCROLLS goes through the same validator as the flag, so the env default can no longer walk past the ceiling the flag enforces (it warns and clamps rather than crashing at import).

INC1-05 — one eligibility rule in the audit too

accessibility_audit computed is_interactive(node) for check 1 and still used clickable and enabled for the touch-target and resource-id checks. Now it is computed once and used by all three. The visible consequence: missing_resource_id on the Compose screen moves 6 → 7, the new one being the scrolling list at [32,1164][1048,1637], which is driven by scrollable and carries no clickable — a control the audit could not see while the rest of the skill could.

INC1-06 — the bounds cases are derived, not invented

test_hierarchy.py's parse_bounds cases were literals. Each is now the recorded Compose CheckBox with only its bounds attribute replaced (empty / one corner / trailing junk / wrong brackets / negative), with the reason stated: API 35 clips every rectangle to the display, so an unreadable one cannot be recorded on demand.

INC1-07 — one failure contract under --json

{"error": ...} on stdout with a non-zero exit for every navigator failure: not-found, no-usable-bounds, passive-label, a failed tap, and the argparse usage error C2 added (exit 2 — correct for usage — but the payload is now printed instead of nothing). A _JsonAwareParser reads --json from argv, because a usage error happens before there are parsed arguments. app_launcher's launch failure goes through #13's _report_failure unchanged.

INC1-09 — the guard says "one", not "none here"

The bounds guard enumerated zero sites outside common/hierarchy.py and checked only that the file existed — satisfied by a skill with no parser at all, or by two grammars in the shared file. It now enumerates the shared module positively: exactly one site, common/hierarchy.py (<module>) [regex] signed.

$ python3 /tmp/m5.py
MUTATED: the shared grammar is gone from common/hierarchy.py
$ uvx ... pytest tests/test_shape_guards.py -k shared_module -q
E  AssertionError: the guard no longer reports ['common/hierarchy.py (<module>) [regex] signed'].
E    Everything it did report, with the line it is on now: [].
1 failed, 28 deselected

INC1-10 = O2 — the live lane checks geometry, and waits for the right screen

The e2e no longer verifies the tap by navigator's own Tapped: line. It captures the screen the way the skill does (common.hierarchy.capture_hierarchy), resolves the target's rectangle with _expected_rect imported from test_agent_loop_from_output (not re-implemented, so the live lane and the mocked one cannot disagree about "the right control"), and takes the tap point from navigator's new --json field tapped_at: [x, y], documented in SKILL.md.

The focus wait no longer accepts "any activity in the package": --launch --json reports the activity am start -W resolved, and the fixture polls until the focused component equals that.

---

Round 4 — Codex's verification pass

All twelve earlier items came back RESOLVED. Four new ones, all P1, all small.

VER-01 — open_url was the last E1-shaped site in scripts/

It ran a bare am start and answered "Opened URL: …" unless the word "Error" appeared in stdout. An intent that resolves to nothing — a typo in the scheme, an app that does not declare the filter — was reported as a link the agent had followed. It now passes -W, reads its verdict through the same parse_am_start, requires Status: ok, and reports the device's own Error: line with a remedy.

The failure test uses the recorded am_start_wait_missing. Its docstring states plainly what is derived: that capture came from am start -W -n <component>, not from -a VIEW -d <url>, and what the two share is the shape the parser keys on — an Error: line and no Status: line. Every byte is the device's; only the command that produced them differs. The success control uses the recorded report, and test_device_shell_quoting's open_url case is repointed at it too, since an empty stdout is no longer a launch.

$ cp .../scripts/app_launcher.py $SCRATCH/app_launcher.v4.snapshot
$ python3 -   # verdict back to "no Error substring seen"
MUTATED: open_url infers success from the absence of an error again
$ uvx ... pytest tests/test_app_launcher.py -k deep_link -q
E  AssertionError: a link that opened nothing was reported as opened
E  assert True is False
1 failed, 1 passed, 53 deselected
$ cp $SCRATCH/app_launcher.v4.snapshot .../scripts/app_launcher.py

VER-02 — the live-scroll helper could still run against the wrong screen

It discarded the results of force-stop and am start -W, then fell out of the focus loop without asserting anything. Both are checked now, and the loop's else raises with the focused activity in the message. A test that runs navigator against the wrong screen and then blames navigator for what it finds is worse than one that does not run.

VER-03 — a force-stop nobody read is not a guarantee

The e2e's snapshot/ANR mitigation ignored --terminate's result, so a failed force-stop permitted exactly the stale state it was added to prevent. It now asserts exit 0 and the JSON success — hence --json on that call, and the Quick-Start baseline gains the flag.

VER-04 — the component comparison is backed by recordings

Both halves now come from recorded output, read with the production parsers:

• equality: dumpsys_window_focus carries one activity spelled two ways — mCurrentFocus fully qualified, mFocusedApp with the leading dot. That is the entire phenomenon in two lines of real output, and parse_focused_activity reads each. (The pair is the launcher's activity rather than Settings, which is what that recording actually contains.)
• inequality: the resolved activity from am_start_wait_settings via parse_am_start, against the requested component read out of that fixture's own manifest command — so neither side is retyped. If expansion collapsed the alias difference, the launch wait would accept any screen in the package.

The inline Compose pair is gone.

---

Round 3 — an owner must be tappable, not merely interactive

The trade I flagged at the end of round 2, and it was a real defect. _owning_control took the first ancestor whose .interactive was true, and is_interactive counts scrollable. A ScrollView or RecyclerView encloses nearly the whole screen, so for a caption in a list whose rows are not themselves clickable, the container was the first interactive ancestor — the tap went to its centre and the message still named the caption.

Measured on the recorded Settings screen with one row's clickable cleared:

MUTANT resolves 'Battery' to: ScrollView main_content_scrollable_container (0, 784, 1080, 2361) -> tap at (540, 1572)

(540, 1572) is the middle of the screen, reported as Tapped: ... "Battery" — C2's defect wearing different clothes.

common/hierarchy.py now answers two questions instead of conflating them, with one implementation behind both (_operable), so the enabled check and the rectangle check cannot drift apart:

• is_interactive — unchanged, still counts scrollable. This is eligibility: what gets enumerated, counted and listed. A scroll container belongs there; an agent acts on it by scrolling, and it stays findable by its own name.
• is_actionable — clickable / long-clickable / checkable. _owning_control requires this of an owner, in both the ancestor walk and the sibling rule.

A scrollable-only ancestor is passed over rather than accepted, so the walk continues upward, then tries the row, and failing both the existing refusal fires: exit non-zero, {"error": ...} under --json, naming the label.

Mutation — drop the action-property condition:

$ cp .../scripts/navigator.py $SCRATCH/navigator.r3.snapshot
$ python3 -   # owner need only be .interactive again, in both places
MUTATED: an owner need only be interactive again (scrollable counts)
$ uvx ... pytest tests/test_navigator.py -k owned_only_by_a_scroll -q
E  AssertionError: a caption owned by nothing tappable reported success
E  assert 0 != 0  +  where 0 = SystemExit(0).code
1 failed, 19 deselected
$ cp $SCRATCH/navigator.r3.snapshot .../scripts/navigator.py

Four tests, all derived from recordings per the fixture policy: the Battery caption resolving to its clickable row on the unmodified dump; the same caption refused once that row's clickable is cleared (no input tap issued, JSON error shape, "passive label"); the container still enumerable and still findable by its own name; and the Compose Checkbox/Switch/logo sibling cases restated, since ownership is exactly what would break them.

---

What the emulator lane found (three pushes, three real defects)

The lane is a required check and it earned it. None of the three was visible to the mocked suite.

1. The live scroll helper had the same launch race E1 fixed in the e2e. It force-stopped Settings, ran a bare am start, and dumped immediately — so navigator answered "nothing on it scrolls, so there is no content below" about the launcher. Now am start -W plus a bounded poll on dumpsys window through the shared parse_focused_activity. (The same push also fixed a live test still reading payload["message"] from a failed lookup, which INC1-07 renamed to error.)

2. A saved snapshot brings back an ANR dialog. The e2e mapped two controls — "Close app" and "Wait" — with the fixture app focused. That is an ANR dialog, and the failure message said so rather than blaming R11, which is exactly what E1 asked of it. The lane boots from a snapshot saved at the end of the previous run, so the fixture now force-stops the app before launching it.

3. One component, two spellings. am start -W echoes the class as passed (com.example.composefixture/.DefaultActivity); dumpsys window prints it fully qualified (.../com.example.composefixture.DefaultActivity). My "focused == reported" comparison called a correctly launched activity the wrong screen. Both sides are expanded before comparison now, with a test holding that to the exact pair the lane produced and to the alias pair from the recording — the alias must still compare unequal, which is the whole reason the wait is against what am start reported. The emulator mark moved from the module to the two device-backed tests so this one runs in the mocked check.

4. The e2e used a fixture it never requested. capture_hierarchy(compose_device) with compose_device absent from the signature: pytest's fixture definition object reached adb, and build_command reported 'FixtureFunctionDefinition' object has no attribute 'startswith'. Deselected without -m emulator, so only the lane could see it.

---

Round 0 — the original Inc 1 work

C2 — an action with no target

--tap/--enter-text with no --find-* and no --tap-at matched every enabled node; the first was the <hierarchy> root, so input tap 0 0 was issued and the exit status was 0. Now a parser.error before anything reaches the device, and _flatten_tree no longer emits the root.

$ python3 /tmp/m7.py
MUTATED: the criterion check is deleted
$ uvx ... pytest tests/test_agent_loop_from_output.py -k no_criterion -q
E  AssertionError: navigator --tap with no --find-* reported success (exit 0) and said: 'Tapped: FrameLayout "Unnamed" at (540, 1212)'
E  AssertionError: navigator --enter-text x with no --find-* reported success (exit 0) and said: 'Entered text in: FrameLayout "Unnamed"'

C1 — a printed name is findable, and resolves to the control it names

_find_in matched text + content_desc only, so recovered_label — the caption both --list and the screen report print — was not searchable: five of seven Compose names and ten of eleven Settings names returned "Not found". Where a name did match it matched the caption, whose centre is outside the control.

$ python3 /tmp/m6.py
MUTATED: _find_in matches text + content_desc only
$ uvx ... pytest tests/test_agent_loop_from_output.py -q
E  AssertionError: a name the screen report printed produced 0 taps, not one.
E      name:     'Order #4821 2 items Ships tomorrow'
E      control:  (32, 353, 1048, 584)
E      exit:     1
E      said:     "Not found: text='Order #4821 2 items Ships tomorrow' (searched 1 screen; ...)"
15 failed, 12 passed

(Before INC1-08 the same mutation also reproduced 'Remember me' → (302, 816), the caption TextView, against the CheckBox at (33, 754, 159, 880).)

Seed switch: the case inventory is read off the default text report, not --json — JSON always exposed Control names, which is how a loop test passes with C4 unfixed.

C4 — the default report names what it counts

One line per interactive bucket, capped per bucket at BUTTONS_PREVIEW with , ... (N total); --hints seeded from the same buckets and printed as the navigator command to run next. The Compose report went from three lines naming nothing to naming all seven controls.

C7 + C5 — one bounds grammar, one eligibility rule

common/hierarchy.py owns parse_bounds, is_interactive, node_attributes and now bare_resource_id; navigator, screen_mapper and accessibility_audit consume them. An unparseable value is None, never (0, 0, 0, 0), whose centre is a real tappable pixel.

$ python3 /tmp/m8.py
MUTATED: Element.center falls back to (0,0,0,0)
$ uvx ... pytest tests/test_navigator.py -k will_not_parse -q
E  AssertionError: acting on an element of unknown position reported success
E  assert 0 != 0  +  where 0 = SystemExit(0).code

Bounds guard enumeration — before:

accessibility_audit.py  _parse_bounds  function        :70
accessibility_audit.py  _parse_bounds  regex, signed   :72
navigator.py            _parse_bounds  function        :290
navigator.py            _parse_bounds  regex, unsigned :301
screen_mapper.py        _bounds        function        :268
screen_mapper.py        _bounds        regex, unsigned :270

after: zero outside common/hierarchy.py, exactly one inside it (INC1-09), and test_bounds_are_parsed_in_one_place has no marker.

Correction to the brief's premise, from #12: uiautomator on API 35 clips every rectangle to the display; eight recipes for an off-screen node all came back clipped, so no recorded dump has a negative bound. The signed grammar is kept as precaution, and the comments claiming otherwise are corrected.

L3, C9, C11, C15

• L3 — missing_content_description keys off is_interactive and "nothing in this node or its subtree names it". Marker deleted, test otherwise unchanged.
• C9 — screen_mapper asks device_utils.get_current_activity; its own second parser is deleted.
• C11 — capture_hierarchy(display=...) deleted: no caller, no recording.
• C15 — see INC1-03.

E1 — the launch waits, and the lane stops mis-diagnosing

--launch passes am start -W, bounded by run_adb's timeout. The e2e fixture polls dumpsys window through the shared parse_focused_activity, and the mapping assertion reports the focused activity — so "the wrong screen was in front" is never again reported as "R11 has regressed". test_agent_task_e2e.py walks every Quick Start command literally, seeding step 3 from step 2's default text output.

---

Markers deleted (24 cases, 6 declarations)

C1 ×15, C2 ×4, C4 ×2, QS ×1, L3 ×1, bounds guard ×1. No assertion was loosened to make one pass.

Tests changed beyond a marker deletion, and why

Test	Change	Why
test_agent_loop_from_output.py inventory + _captions	three resource-id names to the bare form	INC1-08: one name per control; deliberate spec change, marked in the file
test_agent_loop_from_output.py inventory source	seeded from the default report, not --json	the plan's own step 1; JSON hid C4
test_navigator_scroll.py coordinate test	exact row rectangle + a test pinning that literal to the recording	INC1-04: "encloses" also accepts the RecyclerView and the window
test_navigator_scroll.py --find-id	asserts the bare title	INC1-08
test_navigator_scroll.py VISIBLE lookup	asserts the control that answers to the name, not the caption node	C1 resolves a caption to its control; the old assertion pinned the defect
test_screen_mapper.py preview-cap tests	per-bucket cap on the dialer's 17-name Control bucket	C4 caps per bucket, not per report
test_accessibility_audit.py missing_resource_id	6 → 7	INC1-05: the scrolling list was invisible to clickable and enabled
test_accessibility_audit.py _parse_bounds unit tests	replaced by one on a finding's payload shape	the function is deleted (bounds guard to zero)
test_app_launcher.py launch/restart tests	fed the recorded am start -W report	INC1-02: they proved a launch from empty output
test_hierarchy.py bounds cases	derived from the recorded CheckBox	INC1-06
test_quick_start_contract.py E2E_BASELINE	5 → 8 entries, --json on two	the e2e grew steps; updated in the same commit
test_navigator_scroll.py live helper	am start -W + focus poll	the lane's own launch race (finding 1 below)
test_navigator_scroll.py live absent-text	reads payload["error"]	INC1-07's failure contract
test_agent_task_e2e.py marks	emulator per test, not per module	so the component comparison runs in the mocked check
test_navigator.py (round 3)	four tests on tappable ownership	the scroll-container defect above
test_device_shell_quoting.py open_url	fed the recorded am start -W report	VER-01: empty stdout is no longer a launch
test_app_launcher.py (round 4)	two deep-link tests	VER-01
test_agent_task_e2e.py component test	rebuilt from two recordings	VER-04

Still open, and named as debt

• am start -W on an already-foreground activity (Warning: Activity not started..., Status: ok, TotalTime: 0) is described in Inc 0: recordings on two API levels and a real JUnit XML, plus T5 and T14 #12's manifest but not recorded as a file; nothing in this PR depends on distinguishing it, and the launcher treats it as the success it reports.
• No adb, emulator or -m emulator run at any point from this worktree; the attached phone was never touched. Everything above is the mocked suite against recorded fixtures.