[BE-0424] feat(driver): detect an app-under-test crash and capture its report

[0x0c]

Summary

Implements BE-0424: when the app under test crashes mid-scenario, bajutsu run now fails the step with a message that names the event, and writes the platform's own crash report into runs/<run_id>/<sid>/app-crash/ — instead of the generic ElementNotFound a contributor previously had to rule out by elimination. This PR ships all 13 units of the item and moves its Status to Implemented in both roadmaps/BE-0424-app-crash-diagnostics/BE-0424-app-crash-diagnostics.md and its Japanese mirror.

The detection is reactive — a driver is only ever asked once a step has already failed, never polled — so a green run pays nothing for a failure mode that is rare by construction. Classification happens in-band, inside the step loop itself, so it never touches the run/CI verdict path and never triggers the existing backend-crash retry (that path is for infrastructure faults; this one is a likely defect in the app being tested).

What changed

• bajutsu/common/drivers/base/ (new: app_crashed_error.py, app_crash_signal.py, app_crash_poll_resettable.py) — a narrow, opt-in AppCrashSignal capability protocol (mirroring InterruptionPolicyTarget/SettledCacheInvalidator's existing shape) so only XCUITest and adb implement it, with no stub required on Driver's other implementers.
• bajutsu/common/orchestrator/loop/_step_runner.py, app_crash_latches.py (new) — a shared _finish_outcome settles every step kind (including the one early-return exit an earlier draft is documented to have missed) through one seam, backed by three scenario-scoped latches that bound when the probe fires: a deliberate relaunch termination, an unconfirmed app launch (the bare-count readiness rung can't tell the app from SpringBoard), and a confirmed crash (so at most one outcome per scenario ever carries the classification).
• iOS (bajutsu/common/drivers/xcuitest/, bajutsu/common/platform_lifecycle/environments/xcuitest/) — a new POST /app/state runner route reads XCUIApplication.state; scoped to the Simulator only (a real device's notRunning can mean an OS memory-pressure kill instead). A bounded sweep matches the crashed process's .ips report by executable name (read from Info.plist) and Simulator udid (parsed from the report's own payload), against a launch marker re-stamped at all four launch sites — cold spawn, a relaunch step, a crawl frontier reset, and BE-0291's cross-lease warm resume.
• Android (bajutsu/common/drivers/adb/, bajutsu/common/platform_lifecycle/environments/android/) — pidof corroborated by a bounded ApplicationExitInfo poll (API 30+ only); a logcat crash-buffer extraction covering both managed and native crash formats; a root-gated tombstone pull deliberately deferred to pipeline.py's post-return scan, since firing adb root mid-scenario would kill the resident channel a later step still needs.
• bajutsu/common/runner/pipeline.py, bajutsu/common/report/manifest.py — a post-return scan over every phase's outcomes finds the confirmed crash and writes its (already-captured) evidence through the redacting text path; the raw-bytes field is excluded from the manifest's JSON round trip the same way wall_offset_s already is.
• bajutsu/crawl/ — the UI-tree heuristic stays the detector unchanged; the artifact capture is gated on the driver positively confirming the event, so a covering system alert doesn't pay a full-timeout sweep on every false positive.
• Showcase fixtures (demos/showcase/ios/swiftui/Sources/CrashView.swift, demos/showcase/android/compose/.../CrashScreen.kt, demos/showcase/scenarios/app_crash.yaml, new) — a launch-env-gated affordance that faults the app on demand, plus scripts/assert_app_crash_evidence.py to check the finished run's manifest and its app-crash/ directory.
• CI (.github/workflows/ios-e2e.yml, android-e2e.yml) — a non-gating app-crash job on each lane, proving the platform mechanisms (ReportCrash, logcat's crash buffer, ApplicationExitInfo) this item depends on against a real Simulator/emulator, the same path every other new signal on these lanes has taken before promotion.
• Docs (docs/evidence.md, docs/ci.md, docs/architecture.md + docs/ja/ mirrors) — the new evidence kind, including its two documented and deliberately-accepted blind spots (a crash on a scenario's own last step with nothing declared after it; the same shape with only a scenario-level expect to surface it, which lands red but unclassified).

Scope

The web (Playwright) backend is explicitly left to a follow-up item — PlaywrightDriver implements no AppCrashSignal, so the check is a no-op there by construction, as the roadmap item's own Introduction scopes it.

Prime-directive compliance

• AI never judges — no LLM anywhere on this path; classification is a driver-level positive confirmation (XCUIApplication.state, pidof/ApplicationExitInfo), never inferred or guessed.
• Determinism first — every wait is a condition wait through base.deadline_ticks (the .ips sweep, the exit-info poll, the logcat re-dump); no fixed sleep anywhere in the new code. An ambiguous or missing selector still fails the step immediately.
• App-agnostic — the package name and platform-specific signals are threaded as plain constructor keywords from targets.<name> config, never baked into the deterministic core; pipeline.py's tombstone call is deliberately unconditional rather than branching on result.backend.

Verification

make check
  7954 passed, 6 skipped, 298 warnings
  Total coverage: 95.01% (floor 93.0%)
  coverage-floors: 521 file(s) at or above their recorded floor.

166 new tests across tests/orchestrator/test_app_crash.py, tests/test_app_crash_drivers.py, tests/test_app_crash_environments.py, tests/runner/test_app_crash_pipeline.py, tests/test_crawl_app_crash.py, plus additions to tests/test_crawl_repro.py and tests/runner/test_platform_lifecycle_seam.py, cover the step-loop classification and all three latches, the iOS .ips sweep and launch-marker ordering at all four launch sites, the Android signal (including tolerant exit-info reason parsing, since the exact AOSP rendering could not be verified against a live device — the parser matches known reason tokens as substrings rather than betting on one exact format), the pipeline write and manifest exclusion, and the crawl gate.

Not exercised by this gate: the Swift (BajutsuKit/) and Kotlin (showcase app) changes could not be compiled or run in this session (no Xcode/Gradle toolchain in the environment they were written in) — the new app-crash (xcuitest) / app-crash (adb) CI jobs on this PR are the first real verification of the runner route, the showcase affordances, and the on-device platform mechanisms (ReportCrash, logcat, ApplicationExitInfo) this item depends on.

Notes

This PR went through implement-be's 3-round self-review cap before opening. Round 1 found and fixed two correctness bugs (an Android exit-info parser field-order assumption that didn't match real dumpsys output order, and a logcat crash-block match window that could absorb a neighboring process's crash) plus a protocol-isinstance gap. Round 2, re-verifying round 1, found four new blocking issues the first pass missed — including that the exit-info reason-token format still couldn't be confirmed without a live device, so the parser was redesigned to match known tokens tolerantly rather than betting on one exact rendering — plus CI/script bugs that would have made both new app-crash jobs permanently red (a nonexistent --run-id CLI flag, a wrong manifest key, a stale Swift route-count assertion). Round 3 found only mechanical CI/Makefile issues (all fixed): an untracked run directory the new jobs would have left at the repo root, a shell guard blind spot, missing uv sync steps, and a Gradle build running inside the timed emulator-boot window. Per the skill's 3-round cap, a 4th review round was not run.

Two small, genuinely unrelated issues surfaced during review and were filed as separate follow-ups rather than fixed here: a pre-existing test-isolation flake in tests/test_xcuitest_bundled_runner.py that surfaces only under the full suite's parallel worker scheduling, and a stale route-count comment in a Swift file this PR's diff never touches.

🤖 Generated with Claude Code

[0x0c]

@claude review

[0x0c]

@claude review

[0x0c]

@claude review