@@ -99,9 +99,11 @@ appended warning:
 ### Proof the review asked for on this lane
 
 The false-attribution class is covered by unit tests rather than a device run, because the device
-cannot show a cache hit on command: `src/daemon/__tests__/capture-disclosure-target-activation.test.ts`
-pins that a cache-reused tree discloses nothing, and
-`src/daemon/interaction/internal/__tests__/interaction-target-activation-disclosure.test.ts` pins that
+cannot show a cache hit on command: `packages/daemon/src/execution/__tests__/selector-capture-runtime.test.ts`
+drives a session-snapshot cache hit and pins that the consumed tree earns no repair proof and
+discloses nothing, `packages/daemon/src/core/__tests__/capture-disclosure-target-activation.test.ts`
+pins that the response builder never borrows a repair the stored snapshot happens to carry, and
+`src/__tests__/daemon-composition/interaction/interaction-capture-disclosure.test.ts` pins that
 a press which consumed no capture is not disclosed against an older tree.
 
 ## Why the live activation lane is manual
 
@@ -324,8 +324,11 @@ jobs:
       # Gated on the coverage step's own outcome (#1781 A5): when `Run coverage`
       # fails, lcov.info is never written, so this step would just re-report that
       # failure as its own red ("no lcov report") instead of a coverage verdict.
+      # `!cancelled()` keeps it running when an unrelated step around it failed;
+      # it still needs `run-coverage` success because without lcov there is no
+      # verdict — only the coverage step's own red.
       - name: Enforce changed-line coverage gate
-        if: steps.run-coverage.outcome == 'success' && github.event_name == 'pull_request'
+        if: ${{ !cancelled() && steps.run-coverage.outcome == 'success' && github.event_name == 'pull_request' }}
         env:
           AGENT_DEVICE_COVERAGE_WAIVER: ${{ contains(github.event.pull_request.labels.*.name, 'coverage-waiver') }}
         uses: ./.github/actions/run-gate
@@ -335,21 +338,23 @@ jobs:
             --base
             ${{ github.event.pull_request.base.sha }}
 
-      # Report-only: scores the functions this PR touches with the coverage map the coverage step
-      # wrote (fallow-crap.json), as a job summary and warning annotations. It never fails the job:
-      # a tooling error marks only this step. `!cancelled()` keeps it running after a failed
-      # changed-line gate.
-      - name: Report coverage-based CRAP
+      # Blocking: scores the functions this PR touches against the coverage map the coverage step
+      # wrote, using the ceilings in `.fallowrc.json` and the CLI's `--max-crap` threshold, and
+      # fails the job when one is at or above the threshold, or when the map cannot be trusted to
+      # answer. `!cancelled()` keeps it running after a failed changed-line gate; it still needs
+      # `run-coverage` to have succeeded, because without a coverage map there is no verdict to
+      # report — only the coverage step's own red.
+      - name: Check coverage-based CRAP of touched functions
         if: ${{ !cancelled() && steps.run-coverage.outcome == 'success' && github.event_name == 'pull_request' }}
-        continue-on-error: true
         uses: ./.github/actions/run-gate
         with:
           gate: coverage-crap
           args: |
             --base
             ${{ github.event.pull_request.base.sha }}
 
-      # On main, the same report covers every function: the backlog of untested complex code.
+      # Report-only on main: the same scoring over every function is the backlog of untested
+      # complex code, which `main` carries on purpose, so it stays advisory.
       - name: Report coverage-based CRAP for the whole repository
         if: ${{ !cancelled() && steps.run-coverage.outcome == 'success' && github.event_name == 'push' }}
         continue-on-error: true
 
@@ -1,4 +1,4 @@
-name: Mutation Affected
+name: Mutation Harness Canary
 
 # PR-side half of the decision-kernel mutation lane (issue #1415).
 #
@@ -9,7 +9,7 @@ name: Mutation Affected
 # spends mutants on one thing only — proving the harness still runs end to end
 # when the harness itself changes. `select` therefore returns an empty matrix
 # unless the diff touches the lane's own sources. Selecting on derived kernel
-# ownership instead would run the full ten-shard sweep on 24 of the last 40
+# ownership instead would run the full sweep on 24 of the last 40
 # merged PRs.
 #
 # On a harness diff the matrix is the canary (`LANE_CANARY`, selected by
@@ -22,14 +22,20 @@ name: Mutation Affected
 on:
   pull_request:
     paths:
-      # Exactly `LANE_TOOLING` in scripts/mutation/run.ts plus this file — the
+      # Exactly `LANE_TOOLING` in scripts/mutation/run.ts — the
       # only diffs that can produce a non-empty matrix, asserted both ways by
       # scripts/mutation/workflow.test.ts. A kernel or test path here would only
       # start a job that selects nothing.
       - 'scripts/mutation/**'
       - 'scripts/lib/**'
       - 'stryker.config.json'
+      - 'vitest.mutation.config.ts'
+      - 'vitest.config.ts'
+      - '.github/workflows/mutation-weekly.yml'
       - '.github/workflows/mutation-affected.yml'
+      - 'package.json'
+      - 'pnpm-lock.yaml'
+      - 'packages/*/package.json'
 
 permissions:
   contents: read
@@ -40,7 +46,7 @@ concurrency:
 
 jobs:
   select:
-    name: Select affected kernels
+    name: Select harness validation kernels
     runs-on: ubuntu-latest
     timeout-minutes: 10
     outputs:
@@ -71,13 +77,13 @@ jobs:
       # The self-test and the derivation run before any mutant, so a failure here
       # would leave the lane with no envelope at all (#1430).
       - name: Record a failed lane envelope
-        if: failure()
+        if: failure() || cancelled()
         run: |
           pnpm gate mutation --affected --fail-envelope \
             "affected selection failed before any mutant ran (run ${{ github.run_id }})" || true
 
       - name: Upload selection envelope
-        if: failure()
+        if: failure() || cancelled()
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: mutation-affected-select
@@ -97,12 +103,15 @@ jobs:
         include: ${{ fromJSON(needs.select.outputs.modules) }}
     steps:
       - name: Checkout
+        timeout-minutes: 1
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup toolchain
+        timeout-minutes: 2
         uses: ./.github/actions/setup-node-pnpm
 
       - name: Run mutants for ${{ matrix.name }}
+        timeout-minutes: 22
         uses: ./.github/actions/run-gate
         with:
           gate: mutation
@@ -113,7 +122,7 @@ jobs:
             ${{ matrix.shard || '' }}
 
       - name: Record a failed shard envelope
-        if: failure()
+        if: failure() || cancelled()
         run: |
           pnpm gate mutation --affected --modules ${{ matrix.module }} --fail-envelope \
             "shard ${{ matrix.name }} failed before producing a report (run ${{ github.run_id }})" || true
@@ -167,7 +176,7 @@ jobs:
           fi
 
       - name: Record a failed lane envelope
-        if: failure()
+        if: failure() || cancelled()
         run: |
           pnpm gate mutation --affected --fail-envelope \
             "affected report failed before producing a score table (run ${{ github.run_id }})" || true
 
@@ -5,10 +5,8 @@ name: Mutation Weekly
 # decorative"; a full-suite sweep is unaffordable, so the scope is the kernel
 # registry in scripts/mutation/modules.ts and nothing else.
 #
-# Sharded one job per module: the whole sweep is ~2,150 mutants, and the selector
-# module alone is ~1,280 of them, so a single job would sit near the 30-minute
-# acceptance budget on an ubuntu runner. The shards' JSON reports are merged into
-# one score table by the report job (`--report-dir`).
+# Sharded from the decision-kernel registry. Oversized sources are partitioned
+# at syntax boundaries; the report job merges all required shards into one table.
 #
 # The lane reports and never gates (#1457): the per-kernel table lands in the job
 # summary and the artifact, and a low score is an input for a human-authored
@@ -31,9 +29,7 @@ jobs:
   shard:
     name: Mutants (${{ matrix.name }})
     runs-on: ubuntu-latest
-    # The acceptance budget is 30 minutes of wall clock for the lane, and shards
-    # run in parallel, so the budget is per shard. The observed rate on a 2-core
-    # runner is ~3s/mutant, which is why selectors (~1,280 mutants) is sliced.
+    # Bound setup and mutation separately, leaving headroom for evidence and upload.
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -42,24 +38,35 @@ jobs:
         # scripts/mutation/workflow.test.ts, which also pins --expect-shards to
         # the number of entries here.
         include:
-          - { name: kernel-errors, module: kernel-errors }
+          - { name: kernel-errors-1, module: kernel-errors, shard: 1/5 }
+          - { name: kernel-errors-2, module: kernel-errors, shard: 2/5 }
+          - { name: kernel-errors-3, module: kernel-errors, shard: 3/5 }
+          - { name: kernel-errors-4, module: kernel-errors, shard: 4/5 }
+          - { name: kernel-errors-5, module: kernel-errors, shard: 5/5 }
           - { name: daemon-ref-frame, module: daemon-ref-frame }
           - { name: interaction-settle, module: interaction-settle }
           - { name: scroll-edge-state, module: scroll-edge-state }
-          - { name: selectors-1, module: selectors, shard: 1/4 }
-          - { name: selectors-2, module: selectors, shard: 2/4 }
-          - { name: selectors-3, module: selectors, shard: 3/4 }
-          - { name: selectors-4, module: selectors, shard: 4/4 }
+          - { name: selectors-1, module: selectors, shard: 1/8 }
+          - { name: selectors-2, module: selectors, shard: 2/8 }
+          - { name: selectors-3, module: selectors, shard: 3/8 }
+          - { name: selectors-4, module: selectors, shard: 4/8 }
+          - { name: selectors-5, module: selectors, shard: 5/8 }
+          - { name: selectors-6, module: selectors, shard: 6/8 }
+          - { name: selectors-7, module: selectors, shard: 7/8 }
+          - { name: selectors-8, module: selectors, shard: 8/8 }
           - { name: target-annotation-serde, module: target-annotation-serde }
           - { name: snapshot-occlusion, module: snapshot-occlusion }
     steps:
       - name: Checkout
+        timeout-minutes: 1
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup toolchain
+        timeout-minutes: 2
         uses: ./.github/actions/setup-node-pnpm
 
       - name: Run mutants for ${{ matrix.name }}
+        timeout-minutes: 22
         uses: ./.github/actions/run-gate
         with:
           gate: mutation
@@ -73,7 +80,7 @@ jobs:
       # without this the artifact is absent and "shard failed" is indistinguishable
       # from "lane never ran". --fail-envelope leaves a real verdict untouched.
       - name: Record a failed shard envelope
-        if: failure()
+        if: failure() || cancelled()
         run: |
           pnpm gate mutation --modules ${{ matrix.module }} --fail-envelope \
             "shard ${{ matrix.name }} failed before producing a report (run ${{ github.run_id }})" || true
@@ -126,12 +133,12 @@ jobs:
             --report-dir
             .tmp/mutation/shards
             --expect-shards
-            10
+            18
 
       # The self-test and the artifact download both run before the scoring step,
       # so a failure there would otherwise leave the aggregate lane with no envelope.
       - name: Record a failed lane envelope
-        if: failure()
+        if: failure() || cancelled()
         run: |
           pnpm gate mutation --fail-envelope \
             "weekly report job failed before producing a score table (run ${{ github.run_id }})" || true
 
@@ -58,25 +58,7 @@ jobs:
           profile: pixel_7
           target: google_apis_playstore
           emulator-options: -no-window -gpu swiftshader_indirect -no-snapshot -noaudio -no-boot-anim -no-metrics
-          script: |
-            # android-emulator-runner executes this with /usr/bin/sh, which is dash on
-            # ubuntu runners and rejects `-o pipefail`. The serial assignment below is
-            # validated by the `test -n` guard instead.
-            set -eu
-            ANDROID_SERIAL="$(adb devices | awk 'NR > 1 && $2 == "device" { print $1; exit }')"
-            test -n "$ANDROID_SERIAL"
-            BOOT_FINISHED_AT="$(date +%s)"
-            pnpm gate build
-            pnpm clean:daemon
-            adb -s "$ANDROID_SERIAL" install -r "${{ steps.fixture-app.outputs.apk-path }}"
-            node --experimental-strip-types src/bin.ts replay examples/test-app/replays/drag-android.ad --platform android --serial "$ANDROID_SERIAL" --session nightly-android-target-drag --json
-            pnpm clean:daemon
-            FULL_STARTED_AT="$(date +%s)"
-            AGENT_DEVICE_ANDROID_E2E=1 AGENT_DEVICE_ANDROID_E2E_TIER=full AGENT_DEVICE_ANDROID_SERIAL="$ANDROID_SERIAL" AGENT_DEVICE_FIXTURE_APP_PATH="${{ steps.fixture-app.outputs.apk-path }}" AGENT_DEVICE_FIXTURE_APP_ID="${{ steps.fixture-app.outputs.app-id }}" node --experimental-strip-types scripts/node-test-tmpdir.ts --test test/integration/smoke-android-emulator.test.ts
-            FULL_FINISHED_AT="$(date +%s)"
-            echo "Android setup before emulator: $((BOOT_FINISHED_AT - ${{ steps.android-setup.outputs.seconds }}))s"
-            echo "Android full scenario wall time: $((FULL_FINISHED_AT - FULL_STARTED_AT))s"
-            pnpm gate replay-android --retries 2 --artifacts-dir test/artifacts/replays-android --report-junit test/artifacts/replays-android.junit.xml
+          script: sh scripts/replays/android-manual.sh "${{ steps.fixture-app.outputs.apk-path }}" "${{ steps.fixture-app.outputs.app-id }}" "${{ steps.android-setup.outputs.seconds }}"
 
       - name: Upload Android artifacts
         if: always()
 
@@ -12,6 +12,8 @@
     "scripts/maestro-conformance/corpus/**",
     "fallow-baselines/**",
     // One entry per line, so each pinned runner request changes as one reviewable diff line.
-    "contracts/fixtures/runner-requests.json"
+    "contracts/fixtures/runner-requests.json",
+    // One captured node per line, so the real keyboard capture stays a compact reviewable table.
+    "packages/capture-kit/src/snapshot-chrome.fixtures.ts"
   ]
 }
@@ -36,6 +36,8 @@ normal app-driving startup follows the skill's routing card.
   in names, types, boundaries, and tests; reserve comments for public API docs, tool directives,
   and non-obvious constraints that cannot be encoded.
 - Key behavior on typed reasons and details, never error text; do not copy existing message sniffs.
+- A claim about a platform family in code, help, or docs holds for every backend in it (Appium as
+  well as ADB on Android), or names the backends it covers.
 - Keep metadata at response level when it applies to the whole snapshot. Append warnings through
   the shared response builder; never replace prior warnings.
 - Before preserving a compatibility shape, run `git tag --contains <commit>`. Unreleased API has no
@@ -47,11 +49,11 @@ Read the declaration rather than maintaining a prose copy:
 
 - commands and their surface, runtime-use, batch, and timeout traits:
   `packages/command-registry/src/registry.ts`
-- daemon route ownership and request-policy traits: `src/daemon/daemon-command-registry.ts`
+- daemon route ownership and request-policy traits: `packages/daemon/src/core/daemon-command-registry.ts`
 - interaction paths and guarantees: `packages/contracts/src/interaction-guarantees.ts`
 - canonical command names: `packages/command-registry/src/catalog.ts`
 - device runtime-use declarations and fact admission:
-  `packages/command-registry/src/registry.ts`, `src/daemon/runtime-admission.ts`, and
+  `packages/command-registry/src/registry.ts`, `packages/daemon/src/core/runtime-admission.ts`, and
   `src/platform-runtime-gateway.ts`
 - common command input fields, and which surface may write an input key (model, operator, retired):
   `src/commands/common-input-fields.ts` and `src/commands/input-audience.ts`
@@ -108,7 +110,7 @@ under `contracts/fixtures/`.
 ## Runtime and diagnostics seams
 
 Diagnostics use `@agent-device/host-kit/diagnostics`. Request diagnostics belong in the session request log;
-session artifact paths come from `src/daemon/session-artifact-paths.ts`. App/device logs remain in `app.log`;
+session artifact paths come from `packages/daemon/src/core/session-artifact-paths.ts`. App/device logs remain in `app.log`;
 Apple runner and xcodebuild output remains in `runner.log`.
 
 Normalize failures with `normalizeError` and preserve `hint`, `diagnosticId`, `logPath`, and typed
 
@@ -0,0 +1,5 @@
+# Changelog
+
+## Unreleased
+
+- Carry provider keyboard facts through snapshots. Appium captures, including wait polls and fill pre-captures, add one sequential keyboard visibility probe with a 500 ms timeout. Probe results preserve tap-time docked-tree checks; unavailable probes leave visibility unknown.
Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,8 @@`
`12`	`12`	`"scripts/maestro-conformance/corpus/**",`
`13`	`13`	`"fallow-baselines/**",`
`14`	`14`	`// One entry per line, so each pinned runner request changes as one reviewable diff line.`
`15`		`- "contracts/fixtures/runner-requests.json"`
	`15`	`+ "contracts/fixtures/runner-requests.json",`
	`16`	`+ // One captured node per line, so the real keyboard capture stays a compact reviewable table.`
	`17`	`+ "packages/capture-kit/src/snapshot-chrome.fixtures.ts"`
`16`	`18`	`]`
`17`	`19`	`}`