fix(ios): Simulator AX bridge reports enabled from the NotEnabled trait (#2644)

* fix(ios): Simulator AX bridge reports enabled from the NotEnabled trait

The bridge requested no state attribute, so a disabled control read as a plain
button and clients could not observe it; the XCTest runner answered the same
screen with `enabled: false`. The guest now reads `XC_kAXXCAttributeTraits`
and the decoder derives `enabled` from `UIAccessibilityTraitNotEnabled`. The
word is masked as a BigInt because `UIAccessibilityTraitToggleButton` is 2^53,
so every switch carries a value past the safe integer range; a missing word
leaves `enabled` unknown and a non-integer or negative one is a malformed tree.
Source version v1.6.0 rebuilds the cached bridge.

Verified on an iPhone 17 Pro simulator (iOS 26.5) against a React Native app
with `Pressable disabled` and `accessibilityState={{ disabled: true }}`: the
bridge-served raw snapshot now carries `enabled: false` on both controls, and a
client `toBeDisabled` assertion that failed on 0.21.1 passes.

* fix(ios): a source-declared disabled node folds to non-hittable without hittability evidence

Review found the new `enabled` fact never reached presentation on the bridge
path: hittability evidence is unavailable there, so the fold returned before
consulting `enabled`, and a disabled control kept an open `hittable`. The fold
now marks a node the source declared disabled as `hittable: false` regardless
of evidence availability, which is what the runner path already presents.

The tree test asserts the typed `failureCode` instead of matching error text.

* fix(ios): a promoted navigation title affordance retracts the field's hittability

The navigation title rule presents a disabled title field as an enabled
Button for the whole row, but the fold had already marked the field
`hittable: false` from its disabled state, so the Button carried a claim
it contradicted; the cloud iOS provider scenario caught it. A replacement
patch may now retract a fact by setting it `undefined`, and the rule
retracts `hittable`, leaving the row's actionability to the evidence the
acquisition actually has.

* fix(ios): keep retracted facts through later patches and carry the traits word exactly

Review (thymikee): `currentReplacement` rebuilt a node from its source under
the stored replacement, so a later patch on the same node — a scroll clip, a
row label — brought back a fact an earlier rule had retracted: the web
Heading's `value`, and the promoted navigation title's `hittable`. The stored
replacement is now authoritative, as every other reader of the map already
treats it; a regression applies two patches in sequence.

The guest sends the accessibility traits word as a decimal string and the
decoder parses it with BigInt, so a bit set past 2^53 cannot round into or out
of the NotEnabled bit on the way through JSON; the test covers a word past
2^60. The navigation title test moves to transitions.test.ts, keeping
presentation.test.ts under the size ratchet. The CHANGELOG names the two
presentation effects: bridge disabled controls leave the interactive and
Maestro atomic-dispatch counts, and the runner-path title Button joins them.

Author: okwasniewski

CHANGELOG.md

@@ -7,6 +7,18 @@
   `session.name` (`default`) instead of the store address (`cwd:<hash>:default`), so the record
   read as missing, the `log stream` child leaked, and the next `logs start` on that device failed
   with "has not reached a confirmed terminal state" (#2647).
+- Fixed (ios): Simulator AX bridge snapshots report `enabled`. The bridge requested no state
+  attribute, so a disabled control — a React Native `Pressable` with `disabled`, for example — read
+  as a plain button while the XCTest runner answered the same screen with `enabled: false`. The
+  bridge now reads the element's accessibility traits (sent as a decimal string, since the word has
+  bits past 2^53) and derives `enabled` from `UIAccessibilityTraitNotEnabled`. Source version
+  `agent-device-simulator-ax-v1.6.0` rebuilds the cached bridge on first use.
+- Changed (ios): a node the source declares disabled is presented `hittable: false` even when the
+  capture has no hittability evidence, so on the Simulator bridge a disabled control stops counting
+  as an interactive node and as a Maestro atomic-dispatch candidate. The navigation title affordance
+  (a disabled title field presented as an enabled Button for the whole row) no longer carries the
+  field's `hittable: false`; on the XCTest runner path that Button now counts as interactive and
+  becomes a Maestro atomic-dispatch candidate where it was excluded before.
 - Added (limrun): `longpress` on Limrun iOS direct sessions. The interactor refused it as
   unsupported although the SDK exposes the HID primitives; it now holds one touch as a
   `performActions` batch of `touchDown`, `wait`, `touchUp`, defaulting to the 800 ms the Android

apple/snapshot-bridge/SnapshotBridgeRuntime.m

@@ -18,7 +18,7 @@
 NSString *const kProtocolVersionKey = @"protocolVersion";
 NSString *const kSourceVersionKey = @"sourceVersion";
 NSString *const kRequestIdKey = @"requestId";
-NSString *const kSourceVersion = @"agent-device-simulator-ax-v1.5.5";
+NSString *const kSourceVersion = @"agent-device-simulator-ax-v1.6.0";
 const NSUInteger kProtocolVersion = 1;
 const uint32_t kMaximumFrameBytes = 16 * 1024 * 1024;
 const NSUInteger kMaximumDepth = 128;
@@ -32,6 +32,7 @@
 static NSString *const kAttributeIdentifier = @"XC_kAXXCAttributeIdentifier";
 static NSString *const kAttributeFrame = @"XC_kAXXCAttributeFrame";
 static NSString *const kAttributeAutomationType = @"XC_kAXXCAttributeAutomationType";
+static NSString *const kAttributeTraits = @"XC_kAXXCAttributeTraits";
 static NSString *const kAttributeChildren = @"XC_kAXXCAttributeChildren";
 static NSString *const kSnapshotAttributes = @"UIAccessibilitySnapshotKeyAttributes";
 static NSString *const kSnapshotChildren = @"UIAccessibilitySnapshotKeyChildren";
@@ -185,6 +186,11 @@ - (BOOL)isPrimaryForegroundProcess:(pid_t)pid
 - (nullable id)jsonValue:(id)value name:(NSString *)name
 {
   if (!value || value == [NSNull null]) return nil;
+  // The traits word is a uint64 bit set; JSON numbers lose its high bits past 2^53, a decimal
+  // string keeps every bit for the host to parse exactly.
+  if ([name isEqualToString:kAttributeTraits] && [value isKindOfClass:NSNumber.class]) {
+    return ((NSNumber *)value).stringValue;
+  }
   if ([value isKindOfClass:NSString.class] || [value isKindOfClass:NSNumber.class]) return value;
 
   const void *raw = (__bridge const void *)value;
@@ -291,6 +297,7 @@ - (nullable NSDictionary *)snapshotForProcess:(pid_t)pid
     kAttributeIdentifier,
     kAttributeFrame,
     kAttributeAutomationType,
+    kAttributeTraits,
     kAttributeChildren,
   ];
   NSArray<NSNumber *> *numbers = _attributeNumbersForNames(names);

packages/capture-kit/src/ios-snapshot-engine/engine.test.ts

@@ -324,6 +324,22 @@ test('unavailable hittability never becomes regular actionability', () => {
   );
 });
 
+test('a source-declared disabled node is not actionable without hittability evidence', () => {
+  const request = createIosSnapshotRequest();
+  const nodes = nestedNodes().map((entry) =>
+    entry.label === 'Partially visible' ? { ...entry, enabled: false } : entry,
+  );
+  const unavailable = {
+    ...acquisition(request, nodes),
+    residue: [{ kind: 'unavailable-fact' as const, fact: 'hittability' as const }],
+  } satisfies IosSnapshotAcquisition;
+  const acquired = publishIosSnapshot({ stage: 'acquired', acquisition: unavailable }, request);
+  const disabled = acquired.payload.nodes.find((node) => node.label === 'Partially visible');
+  assert.ok(disabled);
+  assert.equal(disabled.enabled, false);
+  assert.equal(disabled.hittable, false);
+});
+
 test('interactive compaction stays available through the engine boundary', () => {
   const rowRect = { x: 16, y: 80, width: 288, height: 52 };
   const compacted = presentIosInteractiveSnapshot([

packages/capture-kit/src/ios-snapshot-engine/geometry.ts

@@ -139,7 +139,7 @@ function foldedHittability(
   options: IosSnapshotFoldOptions,
 ): Partial<Pick<RawSnapshotNode, 'hittable'>> {
   if (options.hittabilityAvailable === false) {
-    return sourceHittable === false ? { hittable: false } : {};
+    return sourceHittable === false || !enabled ? { hittable: false } : {};
   }
   return {
     hittable:

packages/capture-kit/src/ios-snapshot-engine/transitions.test.ts

@@ -0,0 +1,57 @@
+import { expect, test } from 'vitest';
+import type { RawSnapshotNode } from '@agent-device/kernel/snapshot';
+import { presentIosInteractiveSnapshot } from '@agent-device/capture-kit/ios-snapshot-engine';
+
+test('a disabled navigation title field is promoted to a Button without its hittability', () => {
+  const nodes: RawSnapshotNode[] = [
+    {
+      index: 0,
+      depth: 0,
+      type: 'Application',
+      label: 'Demo',
+      rect: { x: 0, y: 0, width: 390, height: 844 },
+    },
+    {
+      index: 1,
+      depth: 1,
+      parentIndex: 0,
+      type: 'NavigationBar',
+      label: 'Team Standup',
+      rect: { x: 0, y: 56, width: 390, height: 44 },
+    },
+    {
+      index: 2,
+      depth: 2,
+      parentIndex: 1,
+      type: 'Image',
+      identifier: 'RoomDetailsIconImageView',
+      rect: { x: 81, y: 80, width: 14, height: 14 },
+    },
+    {
+      index: 3,
+      depth: 2,
+      parentIndex: 1,
+      type: 'TextField',
+      label: 'Team Standup',
+      value: 'Team Standup',
+      identifier: 'DisplayNameTextField',
+      enabled: false,
+      hittable: false,
+      rect: { x: 100, y: 67, width: 113, height: 22 },
+    },
+    {
+      index: 4,
+      depth: 2,
+      parentIndex: 1,
+      type: 'StaticText',
+      label: 'Team Standup',
+      rect: { x: 219, y: 58, width: 85, height: 40 },
+    },
+  ];
+
+  const presented = presentIosInteractiveSnapshot(nodes);
+  const affordance = presented.find((node) => node.identifier === 'DisplayNameTextField');
+
+  expect(affordance).toMatchObject({ type: 'Button', label: 'Team Standup', enabled: true });
+  expect(affordance && 'hittable' in affordance).toBe(false);
+});

packages/capture-kit/src/ios-snapshot-engine/transitions.ts

@@ -28,10 +28,12 @@ function collectNavigationTitleAffordances(
     );
     if (candidates.length !== 1) continue;
     const { field, title, image, label } = candidates[0]!;
+    // The affordance is the whole row, so the disabled field's own actionability does not carry.
     mergeReplacement(context.replacements, field, {
       type: 'Button',
       label,
       enabled: true,
+      hittable: undefined,
       rect: unionRects([image.rect!, field.rect!, title.rect!]),
     });
     context.semanticRepresentativeIndexes.add(field.index);

packages/capture-kit/src/ios-snapshot-engine/tree.test.ts

@@ -18,3 +18,23 @@ test('replacement updates derive patches from the composed node', () => {
     hiddenContentBelow: true,
   });
 });
+
+test('a retracted fact stays retracted when a later rule patches the same node', () => {
+  const heading: RawSnapshotNode = {
+    index: 3,
+    depth: 3,
+    parentIndex: 2,
+    type: 'Other',
+    label: 'Welcome',
+    value: '1',
+    rect: { x: 0, y: 700, width: 390, height: 300 },
+  };
+  const replacements = new Map<number, RawSnapshotNode>();
+  mergeReplacement(replacements, heading, { type: 'Heading', value: undefined });
+  mergeReplacement(replacements, heading, { rect: { x: 0, y: 700, width: 390, height: 144 } });
+  updateReplacement(replacements, heading, () => ({ label: 'Welcome!' }));
+
+  const presented = replacements.get(heading.index);
+  expect(presented).toMatchObject({ type: 'Heading', label: 'Welcome!' });
+  expect(presented && 'value' in presented).toBe(false);
+});

packages/capture-kit/src/ios-snapshot-engine/tree.ts

@@ -187,12 +187,13 @@ export function isRepeatedStaticNode(node: RawSnapshotNode, parentLabel: string)
   return type === 'other' || type === 'statictext' || type === 'link';
 }
 
+/** A patch key set to `undefined` retracts that fact from the presented node. */
 export function mergeReplacement(
   replacements: Map<number, RawSnapshotNode>,
   node: RawSnapshotNode,
   patch: Partial<RawSnapshotNode>,
 ): void {
-  replacements.set(node.index, { ...currentReplacement(replacements, node), ...patch });
+  replacements.set(node.index, patched(currentReplacement(replacements, node), patch));
 }
 
 export function updateReplacement(
@@ -201,14 +202,22 @@ export function updateReplacement(
   update: (current: RawSnapshotNode) => Partial<RawSnapshotNode>,
 ): void {
   const current = currentReplacement(replacements, node);
-  replacements.set(node.index, { ...current, ...update(current) });
+  replacements.set(node.index, patched(current, update(current)));
+}
+
+function patched(current: RawSnapshotNode, patch: Partial<RawSnapshotNode>): RawSnapshotNode {
+  const next: Record<string, unknown> = { ...current, ...patch };
+  for (const [key, value] of Object.entries(patch)) {
+    if (value === undefined) delete next[key];
+  }
+  return next as RawSnapshotNode;
 }
 
 function currentReplacement(
   replacements: ReadonlyMap<number, RawSnapshotNode>,
   node: RawSnapshotNode,
 ): RawSnapshotNode {
-  return { ...node, ...replacements.get(node.index) };
+  return replacements.get(node.index) ?? node;
 }
 
 export function findLargestViewportRect(nodes: Iterable<RawSnapshotNode>): RawSnapshotNode['rect'] {

packages/platform-apple/src/snapshot-source/fixtures/wire-vocabulary.json

@@ -1,6 +1,6 @@
 {
   "protocolVersion": 1,
-  "sourceVersion": "agent-device-simulator-ax-v1.5.5",
+  "sourceVersion": "agent-device-simulator-ax-v1.6.0",
   "requestKeys": [
     "verb",
     "requestId",
@@ -37,6 +37,7 @@
     "XC_kAXXCAttributeIdentifier",
     "XC_kAXXCAttributeFrame",
     "XC_kAXXCAttributeAutomationType",
+    "XC_kAXXCAttributeTraits",
     "XC_kAXXCAttributeChildren"
   ]
 }

packages/platform-apple/src/snapshot-source/protocol.test.ts

@@ -142,7 +142,7 @@ test('wire vocabulary guard keeps TS and Objective-C literals aligned', async ()
   assert.deepEqual(wireVocabulary.responseKeys, SNAPSHOT_SOURCE_RESPONSE_KEYS);
   assert.deepEqual(wireVocabulary.attributeKeys, SNAPSHOT_SOURCE_ATTRIBUTE_KEYS);
   assert.match(nativeSource, /kProtocolVersion = 1/);
-  assert.match(nativeSource, /kSourceVersion = @"agent-device-simulator-ax-v1\.5\.5"/);
+  assert.match(nativeSource, /kSourceVersion = @"agent-device-simulator-ax-v1\.6\.0"/);
   for (const key of [
     ...wireVocabulary.requestKeys,
     ...wireVocabulary.responseKeys,