fix(daemon): distrust post-gesture stability that matches the pre-gesture baseline (#1563)

* fix(daemon): distrust post-gesture stability that matches the pre-gesture baseline

#1542 defect 2: post-gesture-stabilization.ts treated two consecutive
matching AX-signature polls as proof the screen settled. On iOS's AX-free
synthesized gesture lane, XCTest's tree can serve a stale-but-internally-
consistent read for a window after a scroll/swipe, so that "match" can be
false: the daemon then evaluates pre-gesture node positions on the very
next interaction.

Fix: capture the interaction-surface signature before the gesture
dispatches (reusing session.snapshot, no extra capture), and when a quiet
poll-to-poll match still equals that baseline, don't trust it — keep
polling past the normal 1.5s deadline up to a bounded 3.5s cap. On cap
expiry with the signature still identical, accept the result (a genuine
no-op gesture is the honest answer) but flag it via a new
post_gesture_snapshot_stale_accept diagnostic so a stale-accept is
observable in ndjson.

Baseline comparison is subset-tolerant (interactionSurfaceMatchesBaseline)
rather than whole-array equality: the pre-gesture baseline and the
post-gesture capture are routinely fetched with different snapshot scopes,
so naive equality reported "changed" from scope drift alone and never
caught the real staleness on first implementation — live-verified and
fixed before shipping.

Platform-scoped to Apple only (requiresPostGestureBaselineDistrust):
Android's persistent helper clears its accessibility-node cache before
every capture (AccessibilityTreeCapture.capture, #1254/#1259), so an
Android post-gesture read is fresh by construction and never computes a
baseline signature — latency and semantics unchanged, confirmed live
(checkout-form-android.ad + gesture-lab-android.ad 2/2 on Pixel_7_CI).

Does not close #1542: live validation on checkout-form.ad still fails at
step 11, but now for a distinct reason this fix correctly surfaces rather
than causes — a corrupted ScrollView-ancestor viewport frame
((18,381,366,109) vs the true (18,62,366,729)) that the off-screen guard's
findNearestScrollableAncestorRect trusts, independent of whether the
signature matches the baseline. gesture-lab.ad (iOS) remains 2/2 clean,
confirming no regression on the passing scenario.

_Generated by Claude Code_

* refactor(daemon): decompose the stabilization loop's diagnostics and capture pair

The distrust integration pushed capturePostGestureStabilizedResult over the
complexity gate (cyclomatic 15, cognitive 24); extracting the settle-diagnostic
branching and the capture+signature pair restores a clean fallow pass with no
behavior change.

* fix(daemon): require discriminating overlap for a post-gesture baseline match

PR review on #1563 (P1): interactionSurfaceMatchesBaseline returned true
whenever ANY shared entry was frozen, including the application/window
viewport root, whose rect is invariant under any gesture. In the exact
scope-drift case this PR supports, a broad pre-gesture baseline and a
narrow post-gesture selector capture can share only that root after a
real, successful scroll — the boolean predicate called that a baseline
match and extended the interaction to the 3.5s stale-read cap on zero
real evidence.

Fix: replace the boolean with classifyBaselineSurfaceEvidence, a
subset-tolerant classifier reusing this module's existing
InteractionSurfaceChange vocabulary ('changed' | 'unchanged' |
'ambiguous') instead of a bespoke boolean or an Application-only special
case. An entry only counts as evidence when it is `discriminating` —
excludes the viewport root (minimal local equivalent of
snapshot-occlusion.ts's isViewportRoot) and keyboard chrome (minimal
local equivalent of snapshot-chrome.ts's keyboard-container check), both
computed once at signature-build time since the flat signature-entry
representation has no ref/parentIndex to reuse those modules' full
ancestor-walk classifiers directly. Zero discriminating overlap is now
'ambiguous' (insufficient evidence) rather than a match, and
decidePostGestureStabilityVerdict falls through 'ambiguous' to 'trust' —
the safe default, same as 'changed'.

Tests: the reviewer's exact shape (signatures sharing only the
Application root, with the real content swapped) at three layers —
classifyBaselineSurfaceEvidence directly, decidePostGestureStabilityVerdict,
and the full capturePostGestureStabilizedResult async loop (proving no
cap-tax: settles in 2 capture attempts, not 3.5s). Also: root+one real
element both frozen still matches (guards against over-excluding), and
keyboard chrome excluded from discriminating overlap. All prior tests
kept green unchanged.

Counterfactual: reverted to the old boolean predicate and reran — 5
tests went red, including the async regression test, which didn't just
fail an assertion but timed out after 5s because the boolean predicate
extended the interaction to the 3.5s distrust cap the test's 1s timer
advance never covered — exactly the "extends to cap" failure mode the
review predicted. Restored, 37/37 green.

_Generated by Claude Code_

* fix(daemon): exclude keyboard descendants (not just the container) from baseline evidence

PR review on #1563 (two findings, blocking merge):

1. isKeyboardChromeKind excluded only the [Keyboard] container node itself.
   collectKeyboardChrome (src/core/snapshot-chrome.ts, the established
   source of truth) classifies the WHOLE keyboard window/subtree — keys,
   AND the "Next keyboard"/"Dictate" assistant buttons, which are documented
   siblings of the container, not descendants, so a container-descendant
   walk alone provably misses them. In the scope-drift case this PR
   supports, a successful scroll can leave only those keyboard descendants
   shared between a baseline and a later capture, and the narrower check
   called that a baseline match — extending a fresh result to the 3.5s
   stale-read cap.

   Fixed by exporting a narrow predicate, collectKeyboardChromeRefs(nodes),
   from snapshot-chrome.ts (returns collectKeyboardChrome(nodes).refs, no
   Android union — this caller has no appBundleId in scope and only needs
   the iOS half). buildInteractionSurfaceSignature computes it once per
   signature build and threads it into buildInteractionSurfaceEntry, so
   discriminating is now `!isViewportRootKind(node) && !keyboardChromeRefs
   .has(node.ref)` — reusing the real ancestor-walk classification instead
   of a per-node type check, no ancestry needed in the signature entries
   themselves.

2. post-gesture-stabilization.test.ts had grown to 550 LOC, past the
   repository's 500-line extraction tripwire (AGENTS.md: "past 500,
   extract before adding behavior... Tests are not exempt"). Split along
   subject lines: the pure decidePostGestureStabilityVerdict coverage
   moved to a new sibling post-gesture-stabilization-verdict.test.ts, and
   shared fixtures (pickupSnapshot, deliverySnapshot, applicationRootNode,
   keyboardWindowNodes, makeSession) moved to a new non-test
   post-gesture-stabilization-fixtures.ts. The async capturePostGesture-
   StabilizedResult loop tests stay in the original file. Assertions
   unchanged, only relocation, plus the new regression tests below.
   Resulting LOC: post-gesture-stabilization.test.ts 381, -verdict.test.ts
   208, -fixtures.ts 129 (interaction-outcome-policy.test.ts grew to 413,
   still under the tripwire).

Tests: the reviewer's exact regression — a shared overlap consisting only
of keyboard descendants (a key + the "Next keyboard" sibling button, NOT
the container) plus real content that changed (Pickup -> Delivery) — at
three layers: classifyBaselineSurfaceEvidence directly (ambiguous), the
verdict function (trust, elapsedMs: 0), and the full async capture loop
(settles in 2 attempts, no cap tax).

Counterfactual: reverted isNonDiscriminatingSurfaceNode to a container-only
check (normalizeType(node.type) === 'keyboard') and reran — 3 of the new
tests went red across all three layers, including the async test, which
timed out after 5s (not just a failed assertion) because the container-only
exclusion genuinely extended the interaction to the 3.5s distrust cap the
test's 1s timer advance never covers — the same "extends to cap" failure
shape as the review's finding 1. Restored, 40/40 green.

_Generated by [Claude Code](https://claude.ai/code)_

Author: thymikee

src/core/snapshot-chrome.ts

@@ -325,6 +325,26 @@ export function collectSettleChromeRefs(
   return collectSettleChrome(nodes, appBundleId).refs;
 }
 
+/**
+ * Refs of iOS keyboard-window chrome ONLY — no Android union, so callers with
+ * no `appBundleId` in scope can still reuse the real subtree/window-aware
+ * classification (`collectKeyboardChrome`) instead of a narrower per-node type
+ * check. Container-descendant walk alone provably misses the "Next keyboard"
+ * / "Dictate" assistant buttons (siblings of the `[Keyboard]` container, not
+ * descendants — see `collectKeyboardChrome`'s doc comment), so a caller that
+ * only excludes nodes whose OWN type is `keyboard` still leaks every key and
+ * assistant control as "discriminating" evidence.
+ *
+ * Used by `src/daemon/interaction-outcome-policy.ts`'s post-gesture
+ * baseline-distrust discriminating-overlap classification (#1542 defect 2,
+ * #1563 review): that comparison operates on flat signature entries with no
+ * ref-selection budget of its own, so it needs the ref set directly rather
+ * than a node-filtering helper like `withoutSettleChrome`.
+ */
+export function collectKeyboardChromeRefs(nodes: SnapshotNode[]): ReadonlySet<string> {
+  return collectKeyboardChrome(nodes).refs;
+}
+
 /**
  * Windows eligible for whole-window chrome classification: nearest `[window]`
  * ancestor of each `[Keyboard]` container, minus windows hosting editable

src/daemon/__tests__/interaction-outcome-policy.test.ts

@@ -3,6 +3,7 @@ import { test } from 'vitest';
 import type { SnapshotState } from '@agent-device/kernel/snapshot';
 import {
   buildInteractionSurfaceSignature,
+  classifyBaselineSurfaceEvidence,
   classifyInteractionSurfaceChange,
   markPendingInteractionOutcome,
   stripInternalInteractionFlags,
@@ -38,6 +39,266 @@ test('classifyInteractionSurfaceChange detects material layout movement', () =>
   assert.equal(classifyInteractionSurfaceChange(before, after), 'changed');
 });
 
+// ---------------------------------------------------------------------------
+// classifyBaselineSurfaceEvidence (#1542 defect 2, #1563 review): subset-
+// tolerant, three-valued baseline comparison. Live evidence on
+// checkout-form.ad showed the pre-gesture baseline (captured by an earlier
+// `wait`, a broad query) and the post-gesture quiet signature (captured by
+// the click's interactive-only selector resolution) never line up as whole
+// arrays even when the target element never moved — the first version of
+// this check has to see through that scope drift.
+//
+// The #1563 review then caught a SECOND failure mode in that first version
+// (a plain "any shared entry frozen" boolean): the viewport root
+// (Application/Window) is always present and its rect is invariant under any
+// gesture, so a broad baseline and a narrow post-gesture capture can share
+// ONLY the root even after a real, successful scroll — and the boolean
+// predicate called that a match. `classifyBaselineSurfaceEvidence` requires
+// at least one DISCRIMINATING shared entry (excluding the viewport root and
+// keyboard chrome) before calling it `'unchanged'`; a root-only (or
+// no-discriminating-evidence) overlap is `'ambiguous'` instead.
+// ---------------------------------------------------------------------------
+
+test('classifyBaselineSurfaceEvidence reports unchanged for identical signatures', () => {
+  const baseline = buildInteractionSurfaceSignature(makeSnapshot('Inbox').nodes);
+  const current = buildInteractionSurfaceSignature(makeSnapshot('Inbox').nodes);
+
+  assert.equal(classifyBaselineSurfaceEvidence(baseline, current), 'unchanged');
+});
+
+test('classifyBaselineSurfaceEvidence is ambiguous when either side is empty', () => {
+  const baseline = buildInteractionSurfaceSignature(makeSnapshot('Inbox').nodes);
+
+  assert.equal(classifyBaselineSurfaceEvidence([], baseline), 'ambiguous');
+  assert.equal(classifyBaselineSurfaceEvidence(baseline, []), 'ambiguous');
+  assert.equal(classifyBaselineSurfaceEvidence([], []), 'ambiguous');
+});
+
+test('classifyBaselineSurfaceEvidence reports unchanged through a broader baseline scope when the shared discriminating element is frozen', () => {
+  // The exact live shape: the baseline came from a broader capture (extra
+  // "Loading" text node the interactive-only capture never sees), but the
+  // shared "primary-action" button never moved.
+  const baseline = buildInteractionSurfaceSignature(makeSnapshotWithExtraText('Inbox', 500).nodes);
+  const current = buildInteractionSurfaceSignature(makeSnapshot('Inbox', 500).nodes);
+
+  assert.equal(classifyBaselineSurfaceEvidence(baseline, current), 'unchanged');
+});
+
+test('classifyBaselineSurfaceEvidence reports unchanged through a broader current scope when the shared discriminating element is frozen', () => {
+  const baseline = buildInteractionSurfaceSignature(makeSnapshot('Inbox', 500).nodes);
+  const current = buildInteractionSurfaceSignature(makeSnapshotWithExtraText('Inbox', 500).nodes);
+
+  assert.equal(classifyBaselineSurfaceEvidence(baseline, current), 'unchanged');
+});
+
+test('classifyBaselineSurfaceEvidence detects real movement even through a scope difference', () => {
+  const baseline = buildInteractionSurfaceSignature(makeSnapshotWithExtraText('Inbox', 500).nodes);
+  const current = buildInteractionSurfaceSignature(makeSnapshot('Inbox', 120).nodes);
+
+  assert.equal(classifyBaselineSurfaceEvidence(baseline, current), 'changed');
+});
+
+test('classifyBaselineSurfaceEvidence is ambiguous when the signatures share no key at all', () => {
+  const baseline = buildInteractionSurfaceSignature([
+    {
+      ref: 'e1',
+      index: 0,
+      type: 'Button',
+      identifier: 'checkout-only-button',
+      label: 'Checkout',
+      rect: { x: 0, y: 0, width: 100, height: 40 },
+    },
+  ]);
+  const current = buildInteractionSurfaceSignature([
+    {
+      ref: 'e1',
+      index: 0,
+      type: 'Button',
+      identifier: 'settings-only-button',
+      label: 'Settings',
+      rect: { x: 0, y: 0, width: 100, height: 40 },
+    },
+  ]);
+
+  assert.equal(classifyBaselineSurfaceEvidence(baseline, current), 'ambiguous');
+});
+
+test('classifyBaselineSurfaceEvidence tolerates tiny rect drift on the shared discriminating element', () => {
+  const baseline = buildInteractionSurfaceSignature(makeSnapshotWithExtraText('Inbox', 500).nodes);
+  const current = buildInteractionSurfaceSignature(makeSnapshot('Inbox', 500.4).nodes);
+
+  assert.equal(classifyBaselineSurfaceEvidence(baseline, current), 'unchanged');
+});
+
+// --- #1563 review regression: root-only overlap must NOT read as evidence ---
+
+test('classifyBaselineSurfaceEvidence is ambiguous (NOT unchanged) when a real scroll leaves only the application root shared — the reviewer-caught false-distrust shape', () => {
+  // baseline = {Application, Pickup@y=500}; current = {Application,
+  // OtherButton@...} — a genuine, successful scroll replaced every real
+  // element in view, so the only entry the two signatures still share is the
+  // always-present, always-identical viewport root. A boolean "any shared
+  // entry frozen" predicate calls this a baseline match (the root always
+  // "matches") and would extend the interaction to the 3.5s stale-read
+  // deadline on zero real evidence — exactly the bug this test pins.
+  const baseline = buildInteractionSurfaceSignature([
+    applicationRootNode(),
+    {
+      ref: 'e2',
+      index: 1,
+      parentIndex: 0,
+      type: 'Button',
+      identifier: 'shipping-pickup',
+      label: 'Pickup',
+      rect: { x: 20, y: 500, width: 200, height: 44 },
+    },
+  ]);
+  const current = buildInteractionSurfaceSignature([
+    applicationRootNode(),
+    {
+      ref: 'e2',
+      index: 1,
+      parentIndex: 0,
+      type: 'Button',
+      identifier: 'shipping-delivery',
+      label: 'Delivery',
+      rect: { x: 20, y: 120, width: 200, height: 44 },
+    },
+  ]);
+
+  assert.equal(classifyBaselineSurfaceEvidence(baseline, current), 'ambiguous');
+});
+
+test('classifyBaselineSurfaceEvidence is ambiguous when the current capture is the application root alone', () => {
+  const baseline = buildInteractionSurfaceSignature(makeSnapshot('Inbox', 500).nodes);
+  const current = buildInteractionSurfaceSignature([applicationRootNode()]);
+
+  assert.equal(classifyBaselineSurfaceEvidence(baseline, current), 'ambiguous');
+});
+
+test('classifyBaselineSurfaceEvidence excludes the keyboard container from discriminating overlap', () => {
+  const keyboardNode = {
+    ref: 'e3',
+    index: 2,
+    parentIndex: 0,
+    type: 'Keyboard',
+    rect: { x: 0, y: 500, width: 390, height: 300 },
+  };
+  const baseline = buildInteractionSurfaceSignature([applicationRootNode(), keyboardNode]);
+  // The keyboard's own container rect never changes; only the app content
+  // does. A capture sharing just the root and the keyboard container (no
+  // real content) must not read as a baseline match.
+  const current = buildInteractionSurfaceSignature([applicationRootNode(), keyboardNode]);
+
+  assert.equal(classifyBaselineSurfaceEvidence(baseline, current), 'ambiguous');
+});
+
+// #1563 review, finding 2: a container-only exclusion still misses keyboard
+// DESCENDANTS (individual keys) and SIBLINGS (assistant buttons like "Next
+// keyboard"/"Dictate", which live outside the container per
+// src/core/snapshot-chrome.ts's collectKeyboardChrome doc comment — a
+// container-descendant walk alone provably misses them, hence the whole-
+// window classification that module reuses here via collectKeyboardChromeRefs).
+test('classifyBaselineSurfaceEvidence excludes keyboard DESCENDANTS and window SIBLINGS, not just the container, from discriminating overlap', () => {
+  const shared = keyboardWindowNodes(); // window + [Keyboard] container + a key + a sibling "Next keyboard" button
+  const baseline = buildInteractionSurfaceSignature([
+    applicationRootNode(),
+    {
+      ref: 'e-pickup',
+      index: 20,
+      parentIndex: 0,
+      type: 'Button',
+      identifier: 'shipping-pickup',
+      label: 'Pickup',
+      rect: { x: 20, y: 500, width: 200, height: 44 },
+    },
+    ...shared,
+  ]);
+  // Real content changed (Pickup -> Delivery, a genuine successful scroll);
+  // the keyboard subtree is identical — a keyboard does not move when app
+  // content scrolls.
+  const current = buildInteractionSurfaceSignature([
+    applicationRootNode(),
+    {
+      ref: 'e-delivery',
+      index: 20,
+      parentIndex: 0,
+      type: 'Button',
+      identifier: 'shipping-delivery',
+      label: 'Delivery',
+      rect: { x: 20, y: 120, width: 200, height: 44 },
+    },
+    ...shared,
+  ]);
+
+  assert.equal(classifyBaselineSurfaceEvidence(baseline, current), 'ambiguous');
+});
+
+/**
+ * A keyboard-window subtree: a `[Keyboard]` container plus a SIBLING "Next
+ * keyboard" assistant button under the same window — matches the shape in
+ * `src/daemon/__tests__/post-gesture-stabilization-fixtures.ts`'s
+ * `keyboardWindowNodes` (kept local here rather than imported: this file's
+ * fixtures are raw node literals consumed directly by
+ * `buildInteractionSurfaceSignature`, not `SnapshotState`-wrapped like that
+ * module's).
+ */
+function keyboardWindowNodes() {
+  return [
+    {
+      ref: 'e-kb-window',
+      index: 10,
+      parentIndex: 0,
+      type: 'Window',
+      rect: { x: 0, y: 400, width: 390, height: 444 },
+    },
+    {
+      ref: 'e-kb-container',
+      index: 11,
+      parentIndex: 10,
+      type: 'Keyboard',
+      rect: { x: 0, y: 500, width: 390, height: 300 },
+    },
+    {
+      ref: 'e-kb-key-a',
+      index: 12,
+      parentIndex: 11, // descendant of the container
+      type: 'Key',
+      label: 'A',
+      rect: { x: 10, y: 520, width: 30, height: 40 },
+    },
+    {
+      ref: 'e-kb-next',
+      index: 13,
+      parentIndex: 10, // sibling of the container, NOT a descendant
+      type: 'Button',
+      label: 'Next keyboard',
+      rect: { x: 340, y: 520, width: 40, height: 40 },
+    },
+  ];
+}
+
+test('classifyBaselineSurfaceEvidence still reports unchanged when the root AND a real discriminating element both match (guards against over-excluding)', () => {
+  // Root-sharing alone is not disqualifying — it just cannot be the ONLY
+  // evidence. Once a real, frozen discriminating element is also shared
+  // (the ordinary "genuinely stuck" case), the verdict must still be
+  // 'unchanged', not swing to 'ambiguous' just because the root is present.
+  const snapshotNodes = makeSnapshot('Inbox', 500).nodes; // [Application, primary-action Button]
+  const baseline = buildInteractionSurfaceSignature(snapshotNodes);
+  const current = buildInteractionSurfaceSignature(snapshotNodes);
+
+  assert.equal(classifyBaselineSurfaceEvidence(baseline, current), 'unchanged');
+});
+
+function applicationRootNode() {
+  return {
+    ref: 'e1',
+    index: 0,
+    type: 'Application',
+    label: 'App',
+    rect: { x: 0, y: 0, width: 390, height: 844 },
+  };
+}
+
 test('markPendingInteractionOutcome stores retry state only for explicit retry flags', () => {
   const session = makeSession();
   markPendingInteractionOutcome({
@@ -128,3 +389,25 @@ function makeSnapshot(label: string, y = 100): SnapshotState {
     backend: 'xctest',
   };
 }
+
+// A broader-scope variant of makeSnapshot: the same Application + Button
+// entries, plus a non-interactive text node an interactive-only capture would
+// never return. Models the real shape mismatch between a pre-gesture baseline
+// snapshot and a post-gesture interactive-only selector-resolution capture.
+function makeSnapshotWithExtraText(label: string, y = 100): SnapshotState {
+  const base = makeSnapshot(label, y);
+  return {
+    ...base,
+    nodes: [
+      ...base.nodes,
+      {
+        ref: 'e3',
+        index: 2,
+        parentIndex: 0,
+        type: 'Text',
+        label: 'Loading',
+        rect: { x: 20, y: 20, width: 200, height: 20 },
+      },
+    ],
+  };
+}