fix(ios): restore two-phase stabilization and the rebased plan-state switch

Takeover of #1573 on top of #1587.

- The rebase onto main merged textually but not semantically: #1587 turned the
  plan-state -> pre-seeded first-failure mapping into an exhaustive switch, and
  this branch's new `.preferredIndependentBackend` case was never added to it.
  Counterfactual: without the added case the runner does not compile
  ("switch must be exhaustive", RunnerTests+SnapshotCapturePlan.swift:159).

- That switch and `countsAsRecovery` were two independent encodings of the same
  question — did this plan state degrade the capture. They had to agree, or the
  runner could stamp a `recovered` verdict with no reason to render. Dropped
  `countsAsRecovery` and derived the recovered flag from the single mapping, so
  a future state cannot satisfy one and not the other.

- Reapplied b113f17's reviewed two-phase stabilization refactor, which the
  earlier rebase silently dropped (412 -> 377 LOC, no flag-driven orchestration).
  Behavior is unchanged; the two budgets are modeled as the two sequential
  phases they actually are.

- Documented the freshness-probe reorder on `effectiveSnapshotCapturePlan`, and
  replaced the normal-path comment that contradicted the change under it: the
  available-tier filter is not a fallback-attribution change for its own sake,
  it stops the all-tiers-failed stamp from naming a simulator-only backend on a
  physical device.

Author: thymikee

apple/runner/AgentDeviceRunner/AgentDeviceRunnerUITests/RunnerTests+SnapshotCapturePlan.swift

@@ -57,15 +57,6 @@ enum SnapshotXCTestChannelPlanState: Equatable {
   case preferredIndependentBackend
   case deferredToIndependentBackend
   case boundedXCTestProbe
-
-  var countsAsRecovery: Bool {
-    switch self {
-    case .normal, .preferredIndependentBackend:
-      return false
-    case .deferredToIndependentBackend, .boundedXCTestProbe:
-      return true
-    }
-  }
 }
 
 struct EffectiveSnapshotCapturePlan {
@@ -154,16 +145,19 @@ extension RunnerTests {
     return pending
   }
 
-  /// The pre-seeded first-failure a penalized plan stamps into its verdict. The deferred case
-  /// uses the dedicated 'deferred' code: the breaker pre-selected the backend, nothing new
-  /// degraded on this capture, and the daemon keys warning suppression and the settle budget
-  /// reset off exactly that distinction. The bounded probe keeps 'budget': its short XCTest
-  /// slice genuinely constrains what this capture could read.
+  /// The pre-seeded first-failure a penalized plan stamps into its verdict, and the single
+  /// source for whether a plan state degraded this capture at all: a nil result is exactly the
+  /// set of states whose first tier still counts as healthy. The deferred case uses the
+  /// dedicated 'deferred' code: the breaker pre-selected the backend, nothing new degraded on
+  /// this capture, and the daemon keys warning suppression and the settle budget reset off
+  /// exactly that distinction. The bounded probe keeps 'budget': its short XCTest slice
+  /// genuinely constrains what this capture could read. The freshness probe reorders a healthy
+  /// plan by request, so like `.normal` it degrades nothing.
   static func xcTestChannelStateFirstFailure(
     _ state: SnapshotXCTestChannelPlanState
   ) -> (reason: String, code: String)? {
     switch state {
-    case .normal:
+    case .normal, .preferredIndependentBackend:
       return nil
     case .deferredToIndependentBackend:
       return (
@@ -181,6 +175,12 @@ extension RunnerTests {
   /// Pure plan-reorder rule: a penalized XCTest accessibility channel uses independent backends
   /// when the platform has one, otherwise it keeps XCTest work on a short probe. The raw
   /// diagnostic plan keeps tree-first errors, and unknown plans are left untouched.
+  ///
+  /// `preferIndependentBackend` is the daemon's post-gesture freshness probe (#1569): it moves
+  /// the independent tier first while KEEPING the XCTest tiers as recovery, because the caller
+  /// wants a backend XCTest cannot serve stale, not a narrower plan. It is strictly weaker than
+  /// the penalty — a penalized channel still drops XCTest tiers outright — and it is a no-op
+  /// where no independent backend exists, so physical devices keep their ordinary plan.
   static func effectiveSnapshotCapturePlan(
     _ plan: [SnapshotBackendKind],
     xCTestChannelPenalized: Bool,
@@ -219,7 +219,10 @@ extension RunnerTests {
         treeCaptureSliceBudgetOverride: nil
       )
     }
-    // Preserve the ordinary plan after removing tiers unavailable on the current platform.
+    // The ordinary plan, minus tiers this platform cannot serve — the same filtering the
+    // penalized branches above already do. A tier that is compiled out returns nil anyway, so
+    // this changes no capture; it only stops the all-tiers-failed fallback from stamping a
+    // backend that never ran (physical devices attributed `private-ax`, which is simulator-only).
     return EffectiveSnapshotCapturePlan(
       plan: availablePlan,
       xCTestChannelState: .normal,
@@ -261,7 +264,8 @@ extension RunnerTests {
       preferIndependentBackend: options.preferIndependentBackend
     )
     let effectivePlan = effective.plan
-    firstFailure = Self.xcTestChannelStateFirstFailure(effective.xCTestChannelState)
+    let planStateFailure = Self.xcTestChannelStateFirstFailure(effective.xCTestChannelState)
+    firstFailure = planStateFailure
     switch effective.xCTestChannelState {
     case .normal:
       break
@@ -349,7 +353,7 @@ extension RunnerTests {
         continue
       }
 
-      let recovered = kind != effectivePlan.first || effective.xCTestChannelState.countsAsRecovery
+      let recovered = kind != effectivePlan.first || planStateFailure != nil
       if recovered {
         NSLog(
           "AGENT_DEVICE_RUNNER_SNAPSHOT_RECOVERED backend=%@ reason=%@",
@@ -695,6 +699,9 @@ extension RunnerTests {
 
   func testXCTestChannelStateFirstFailureStampsDeferredCodeOnlyForDeferral() {
     XCTAssertNil(Self.xcTestChannelStateFirstFailure(.normal))
+    // Also the recovered/healthy discriminator: a requested freshness reorder degrades nothing,
+    // so its first tier must stamp `healthy` exactly like an unmodified plan.
+    XCTAssertNil(Self.xcTestChannelStateFirstFailure(.preferredIndependentBackend))
     XCTAssertEqual(Self.xcTestChannelStateFirstFailure(.deferredToIndependentBackend)?.code, "deferred")
     XCTAssertEqual(Self.xcTestChannelStateFirstFailure(.boundedXCTestProbe)?.code, "budget")
   }