Clear the strict audit: test-file shapes, Android recaptures, JDK floor

[jaredcosulich]

Takes the strict audit from 152 findings to 0 and produces the first clean full finalize, which is what main's red Merge-readiness gates check has been waiting on.

The dominant blocker was a false positive

99 of the 152 findings were SOURCE_TEST_FILE_MATCHED_BY_NO_RUNNER, naming every non-test source file in the repo (32 Kotlin + 67 Swift) as "a test file no runner executes". None contain a single test.

The cause is in the invariant, not this repo. It derives its test-file recognizer by discarding every directory segment of each testFilePattern and keeping the basename:

**/Tests/**/*.swift          ->  *.swift
android/**/src/test/**/*.kt  ->  *.kt

Both of this project's test conventions are directory-scoped (SwiftPM Tests/, Gradle src/test/), so both collapse to bare extensions and match everything. The guard against over-broad shapes only rejects a basename that is entirely wildcard, so it catches tests/** but not **/Tests/**/*.swift. It reproduces identically on the production channel, so it is not a dev-build regression.

Setting audit.testFileShapes explicitly replaces that derivation. This is a declaration of the project's real convention, not a suppression - a genuinely unrun test file matching either shape is still reported. Verified it covers all 17 real test files with no gaps.

Commits

Commit	Change
badd86c	testFileShapes + capture-script sync + 23 glossarySkip entries + registered defaultContentInsets
9f360c2	Recaptured all 26 Android screenshots
005141f	Corrected the declared JDK floor 17 -> 21
b09ebc0	Finalize state

The screenshots were genuinely stale

The Android goldens were 16 days older than their source and predated the edge-to-edge / API 36 work in #8. All 26 shifted by 5.26-5.55% - a tight uniform band consistent with a systematic inset change.

Captured on codeyam_pixel (pixel_6, API 34, 1080x2400 @ 420dpi), animations disabled. API 34 is representative because the app opts in explicitly via AndroidX enableEdgeToEdge, which applies from API 21 rather than relying on API 35's unconditional enforcement.

The first attempt captured a "System UI isn't responding" ANR dialog overlaying the app - the emulator had booted while a Gradle build saturated the host. That frame was discarded, the emulator cold-restarted, and every capture re-verified. All 26 were scanned for the dialog signature (a bright band spanning ~87% of frame width); the widest bright row in the set is 59.3%, which is the hero numeral.

Also fixed along the way

Unregistered tests from #8. The four CounterScreenInsetsTest cases - the edge-to-edge tests - were never added to the test registry, and blocked Phase 2 as RUNNER_HAS_UNREGISTERED_TEST. Now registered with descriptions of what each asserts.

The declared JDK floor was wrong. stack.json claimed "Java 17+" while CI has required 21 since #8 (Paparazzi 2.0.0-alpha05 is a JDK 21 artifact; 1.3.5 cannot compile against compileSdk 36). A fresh clone provisioned from stack.json installs 17 and then fails the first Android build with nothing pointing at the cause.

Verification

Full suite green: 298 tests, 0 failures. session-finalize passes all five phases; screenshot coverage reports 0 stale / 0 missing. Pushed with no deferred-finalize override.

Known remaining

One non-blocking advisory: ne--os-neutral-privacy-policy was archived by a hollow commit.

The upstream basename_shape bug is unfixed and will hit any client repo with directory-scoped test conventions. A second latent false-positive source sits next to it: matching_test_files uses raw glob::glob, which does not brace-expand, so a pattern like **/*_{test,spec}.kt would light up every matching file the same way.

🤖 Generated with Claude Code

https://claude.ai/code/session_0164CaGthrJAHNbacwgkRcLv