test: preserve mobile owners and real platform consumers

Author: sachk

.github/workflows/build-artifacts.yml

@@ -511,6 +511,11 @@ jobs:
     # Public repositories receive unlimited standard GitHub-hosted runner
     # minutes, so pushes, pull requests, and releases exercise macOS too.
     if: ${{ github.event_name != 'workflow_dispatch' || inputs.build_macos }}
+    env:
+      # MoltenVK's documented discrete-binding path avoids an unsupported
+      # argument-encoder selector in Apple's hosted paravirtualized Metal GPU.
+      # This still executes real Vulkan/Metal and retains every Vulkan selector.
+      MVK_CONFIG_USE_METAL_ARGUMENT_BUFFERS: "0"
     strategy:
       # Apple Silicon and Intel Macs each get a native build; one failing
       # architecture should still let the other produce its DMG.
@@ -847,6 +852,8 @@ jobs:
         run: nix develop .#native -c env DEPLOY_APP=0 bash tools/build-macos.sh
       - name: Run native traditional then GPU GUI tests in isolated Apple TV simulator
         if: ${{ matrix.sdk == 'appletvsimulator' }}
+        env:
+          SPOOL_TEST_DEVICE_CLEANUP_REGRESSIONS: "1"
         run: bash tools/apple/smoke-tvos.sh build/tvos/appletvsimulator-arm64/install/Spool.app
       - name: Package artifact-audited unsigned device IPA (no device runtime claim)
         if: ${{ matrix.sdk == 'appletvos' }}
@@ -871,8 +878,7 @@ jobs:
           name: internal-tvos-simulator-arm64
           path: |
             ${{ runner.temp }}/tvos-simulator-arm64.tar.gz
-            build/tvos/smoke/*.png
-            build/tvos/smoke/*.json
+            build/tvos/smoke/**/safe-export/**
           retention-days: ${{ inputs.release && 1 || 7 }}
       - name: Save coherent Apple dependency cache
         if: ${{ env.SPOOL_CACHE_WRITE == 'true' && !inputs.release && steps.tvos-source-cache.outputs.cache-hit != 'true' }}
@@ -1226,6 +1232,8 @@ jobs:
 
       - name: Run native and real app GUI phases on phone and actual Android TV images
         if: ${{ matrix.abi == 'x86_64' }}
+        env:
+          SPOOL_TEST_DEVICE_CLEANUP_REGRESSIONS: "1"
         run: |
           status=0
           for form_factor in phone tv; do
@@ -1241,8 +1249,7 @@ jobs:
         with:
           name: internal-spool-android-tests
           path: |
-            build/android/launch-test
-            build/android/emulator-*.log
+            build/android/launch-test/**/safe-export/**
             dist/android/spool-tests-x86_64.apk
             dist/android/spool-e2e-tests-x86_64.apk
             dist/android/spool-e2e-app-x86_64.apk

CMakeLists.txt

@@ -954,13 +954,39 @@ if(BUILD_TESTING AND NOT SPOOL_WEBOS)
     # mutable fixture packages. Keep every test process independent of the
     # persistent QML/JavaScript cache, not only the provider test group.
     set(SPOOL_TEST_ENV "QML_DISABLE_DISK_CACHE=1")
-    if(SPOOL_QT_CORE_LOCATION)
-        get_filename_component(SPOOL_QT_LIB_DIR "${SPOOL_QT_CORE_LOCATION}" DIRECTORY)
-        get_filename_component(SPOOL_QT_PREFIX "${SPOOL_QT_LIB_DIR}" DIRECTORY)
-        set(SPOOL_QT_PLUGIN_DIR "${SPOOL_QT_PREFIX}/lib/qt-6/plugins")
-        if(EXISTS "${SPOOL_QT_PLUGIN_DIR}")
-            list(APPEND SPOOL_TEST_ENV "QT_PLUGIN_PATH=${SPOOL_QT_PLUGIN_DIR}")
-        endif()
+    # Resolve the actual configured Qt packages, not a dylib's directory:
+    # macOS framework locations and Nix's split QML package differ from the
+    # ordinary Qt prefix layout. These are the same layouts the native launcher
+    # admits, pinned by the imported package configurations used in this build.
+    set(SPOOL_TEST_QML_DIRS "")
+    set(SPOOL_TEST_PLUGIN_DIRS "")
+    foreach(qt_package_dir IN ITEMS "${Qt6Core_DIR}" "${Qt6Qml_DIR}" "${Qt6Svg_DIR}")
+        get_filename_component(qt_package_prefix "${qt_package_dir}/../../.." ABSOLUTE)
+        foreach(qml_suffix IN ITEMS qml lib/qt-6/qml lib/qt6/qml)
+            if(IS_DIRECTORY "${qt_package_prefix}/${qml_suffix}")
+                list(APPEND SPOOL_TEST_QML_DIRS "${qt_package_prefix}/${qml_suffix}")
+            endif()
+        endforeach()
+        foreach(plugin_suffix IN ITEMS plugins lib/qt-6/plugins lib/qt6/plugins)
+            if(IS_DIRECTORY "${qt_package_prefix}/${plugin_suffix}")
+                list(APPEND SPOOL_TEST_PLUGIN_DIRS "${qt_package_prefix}/${plugin_suffix}")
+            endif()
+        endforeach()
+    endforeach()
+    list(REMOVE_DUPLICATES SPOOL_TEST_QML_DIRS)
+    list(REMOVE_DUPLICATES SPOOL_TEST_PLUGIN_DIRS)
+    if(WIN32)
+        set(qt_runtime_separator "\\;")
+    else()
+        set(qt_runtime_separator ":")
+    endif()
+    if(SPOOL_TEST_QML_DIRS)
+        list(JOIN SPOOL_TEST_QML_DIRS "${qt_runtime_separator}" qt_test_qml_paths)
+        list(APPEND SPOOL_TEST_ENV "QML2_IMPORT_PATH=${qt_test_qml_paths}" "QML_IMPORT_PATH=${qt_test_qml_paths}")
+    endif()
+    if(SPOOL_TEST_PLUGIN_DIRS)
+        list(JOIN SPOOL_TEST_PLUGIN_DIRS "${qt_runtime_separator}" qt_test_plugin_paths)
+        list(APPEND SPOOL_TEST_ENV "QT_PLUGIN_PATH=${qt_test_plugin_paths}")
     endif()
     set(SPOOL_TRADITIONAL_TEST_SOURCES src/platform/webos/WebOSAudioSyncPolicy.cpp)
     foreach(test_group IN LISTS SPOOL_TEST_GROUPS)
@@ -994,12 +1020,15 @@ if(BUILD_TESTING AND NOT SPOOL_WEBOS)
     else()
     find_package(Threads REQUIRED)
     find_package(Qt6 REQUIRED COMPONENTS QuickTest)
+    get_target_property(SPOOL_APP_SOURCES spool SOURCES)
+    set(SPOOL_TEST_PLATFORM_SOURCES ${SPOOL_APP_SOURCES})
+    list(FILTER SPOOL_TEST_PLATFORM_SOURCES INCLUDE REGEX "/[A-Za-z]+PlatformCapabilities\\.cpp$")
     add_executable(spool-tests tests/TestRunner.cpp tests/TestVariants.cpp ${SPOOL_TRADITIONAL_TEST_SOURCES})
     target_include_directories(spool-tests PRIVATE tests src "${CMAKE_CURRENT_BINARY_DIR}/generated")
     target_compile_definitions(spool-tests PRIVATE TEST_SOURCE_DIR="${CMAKE_CURRENT_SOURCE_DIR}"
         SPOOL_TEST_RUNNER=1)
     target_link_libraries(spool-tests PRIVATE spool-core Threads::Threads ${SPOOL_PROVIDER_BUNDLE_TARGET})
-    target_sources(spool-tests PRIVATE sdk/provider-contract-runner.cpp)
+    target_sources(spool-tests PRIVATE sdk/provider-contract-runner.cpp ${SPOOL_TEST_PLATFORM_SOURCES})
     if(TARGET spoolet)
         target_sources(spool-tests PRIVATE tests/automation/LocalControlProtocolTest.cpp
             tests/automation/LocalControlAdmissionTest.cpp src/automation/LocalControlProtocol.cpp
@@ -1106,6 +1135,8 @@ if(BUILD_TESTING AND NOT SPOOL_WEBOS)
     qt_add_executable(spool-e2e-tests ${SPOOL_E2E_SOURCES})
     file(GENERATE OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/native-spool-e2e-path.txt"
         CONTENT "$<TARGET_FILE:spool-e2e-tests>\n")
+    file(GENERATE OUTPUT "${CMAKE_CURRENT_BINARY_DIR}/native-spoolet-path.txt"
+        CONTENT "$<TARGET_FILE:spoolet>\n")
     target_include_directories(spool-e2e-tests PRIVATE tests src "${CMAKE_CURRENT_BINARY_DIR}/generated")
     target_compile_definitions(spool-e2e-tests PRIVATE TEST_SOURCE_DIR="${CMAKE_CURRENT_SOURCE_DIR}"
         SPOOL_E2E_APP="$<TARGET_FILE:spool>" SPOOL_E2E_SPOOLET="$<TARGET_FILE:spoolet>")
@@ -1168,9 +1199,6 @@ if(BUILD_TESTING AND NOT SPOOL_WEBOS)
             get_target_property(SPOOL_TEST_SCAN_ARGS spool QT_QML_IMPORT_SCANNER_EXTRA_ARGS)
             set_property(TARGET spool-e2e-tests PROPERTY QT_QML_IMPORT_SCANNER_EXTRA_ARGS ${SPOOL_TEST_SCAN_ARGS})
         endif()
-        get_target_property(SPOOL_APP_SOURCES spool SOURCES)
-        set(SPOOL_TEST_PLATFORM_SOURCES ${SPOOL_APP_SOURCES})
-        list(FILTER SPOOL_TEST_PLATFORM_SOURCES INCLUDE REGEX "/[A-Za-z]+PlatformCapabilities\\.cpp$")
         set(SPOOL_TEST_QML_RESOURCES ${SPOOL_APP_SOURCES})
         list(FILTER SPOOL_TEST_QML_RESOURCES INCLUDE REGEX "/qrc_(qmake_Spool|application_icons|trickplay_preview_shaders|spool_raw_qml_[0-9]+(_extra_qmldirs)?)\\.cpp$")
         # Reuse the application's generated resources rather than declaring a

README.md

@@ -714,6 +714,12 @@ nix develop .#android -c bash tools/android/build.sh
 
 That runs the three cached stages -- `build-dependencies.sh`, `build-qt6.sh`,
 `build-apks.sh` -- which can also be invoked on their own.
+Android's libmpv cache includes the actual source revision, tracked/untracked
+source changes, NDK/API/ABI, build recipe and feature manifests as well as its
+static dependency stamps. `MPV_SRC` can select another verified source checkout;
+the default remains the repository's `mpv` submodule. A matching revision alone
+never admits stale dirty source bytes.
+
 
 Entering the Android shell may build native Qt host tools before the Android
 cross-build starts. These must match the pinned Qt version: `moc`, QML generators,
@@ -839,6 +845,11 @@ Android's host import scanner uses the same pinned recursive-exclusion patch as
 tvOS/webOS. This keeps vendored Qt's intentionally malformed test QML outside the
 application/test targets' source-root scan while their exact resource QML and
 real plugin dependencies remain scanned and packaged.
+Windows QML selectors direct QtTest's ordinary text logger to their retained
+stdout/stderr pipe instead of the debugger-only OutputDebugString sink. Explicit
+CLI logging choices remain available. Retry checks compare the original native
+failure bytes before/after retry, independent of the host's text newline encoding.
+
 
 The additional `linux-sanitizers` CI job uses `SPOOL_SANITIZERS=ON` to instrument
 the actual production core, official upstream libzstd static decoder, and unified
@@ -856,6 +867,14 @@ The traditional binary is `spool-tests`; the GUI binary is `spool-e2e-tests`.
 Each contains a selector registry and supervises fresh executions of **itself**.
 The binary CLI exposes `--list`, `--child SELECTOR`, and
 `--run-all --workers N --results FILE`, with `--resume`/`--retry-failed`.
+Device adapters also pass `--log ABSOLUTE_PRIVATE_PATH` so Activity/UIKit native
+stdout/stderr conditions survive even when the OS does not expose a console.
+Those raw native diagnostics stay owner-private; safe exports remain allowlisted.
+Each device attempt has a fresh private directory nonce, so a new invocation
+cannot overwrite earlier fault evidence or collide with its private capability
+files. Kernel-wide CPU and memory availability are checked independently; denied
+CPU proc access does not discard readable Android memory counters.
+
 Separate selectors isolate QApplication ownership, mutable environments,
 explicit exits and crashes without creating an executable for every test.
 All traditional selectors finish before GUI e2e starts, and either phase's
@@ -882,7 +901,14 @@ See `tools/patches/mesa-wayland-fifo-presentation-clock.patch` for the exact
 upstream source, introducing commit and protocol references.
 
 macOS uses its real graphics device and bundled/Nix MoltenVK, not a software
-scenegraph. Windows deliberately tests the supported OpenGL embedding path with
+scenegraph. Hosted Apple paravirtualized GPUs use MoltenVK's documented
+`MVK_CONFIG_USE_METAL_ARGUMENT_BUFFERS=0` discrete-binding configuration, avoiding
+an unsupported Metal argument-encoder probe while retaining every real Vulkan
+selector. This is the [upstream-recommended VM configuration](https://github.com/KhronosGroup/MoltenVK/issues/2373),
+not a Metal implementation fork or a change to users' default graphics backend.
+QtTest QML/plugin paths come from the configured matching-version Qt package
+prefixes, including split Nix modules and macOS frameworks.
+Windows deliberately tests the supported OpenGL embedding path with
 SHA-256-pinned Mesa WGL llvmpipe: Qt and real libmpv share OpenGL, not D3D WARP or
 Qt's software scenegraph. This Windows configuration is not proof of Vulkan or
 D3D playback. The real host app journey additionally needs Tesseract English OCR
@@ -900,6 +926,9 @@ native launcher and stages the product's shipped fonts. Failed journeys retain
 owner-private screenshots, logs and isolated data under `test-artifacts`
 (`SPOOL_E2E_ARTIFACT_DIR` can select its parent); raw logs and credentials are
 never printed. Successful journeys remove their temporary data.
+Screenshot requests use the public Qt Quick repaint API, await a real swapped
+frame, then perform GUI-thread framebuffer readback. This remains an actual
+graphics capture, not a software scenegraph substitute or screenshot-only test.
 The loopback Jellyfin fixture supplies a quiet real event WebSocket. During the
 offline-download scenario it rejects every new authenticated HTTP request or
 WebSocket handshake, including playback negotiation and media requests; the
@@ -913,6 +942,38 @@ Android and tvOS simulator adapters launch each selector in the same installed
 phase APK/bundle and require a fresh native nonce receipt. Then the same host GUI
 binary drives the actual mobile application; `native-spool-e2e-path.txt` in the
 host build directory supplies its generated target path without bundle guesses.
+`native-spoolet-path.txt` supplies the matching public CLI consumer for cleanup
+regressions. Both native phase bundles include the same filesystem fixture
+loader and real shipped OSD fonts; host-only fork/process-supervisor code is not
+compiled into UIKit/Activity bundles.
+Android receipt/file operations use shell-v2 without a PTY, preserving actual
+remote exit codes and binary bytes. Mobile screenshot checks match the real
+window's logical size times device-pixel ratio and the returned framebuffer
+dimensions, rather than imposing a desktop-width threshold on small phones.
+Mobile consumer tests retain real persistence, audio-policy, decoded-media,
+download-byte and font-loader checks; extracted fixture paths are canonicalized
+and downloads use the platform's actual allowed destination choice.
+
+
+The host adapter owns each production mobile launch and its exact Android
+forward/reverse mappings. A private nonce-bound capability file lets the
+controller request those operations; adapter cleanup still runs if the controller
+crashes or times out, without relying on C++ destructors or removing unrelated
+device resources. Request framing has an absolute deadline, including before
+authentication. CI enables `SPOOL_TEST_DEVICE_CLEANUP_REGRESSIONS=1` to inject
+real controller timeout/crash after public `spoolet` readiness, test an
+unauthenticated slow client, verify process/mapping retirement, and exercise
+another actual consumer. The inner controller fault remains crashed/timed-out;
+only the independent cleanup assertion can pass.
+
+Mobile attempts receive their own `SPOOL_E2E_ARTIFACT_DIR`. CI uploads only the
+adapter's `safe-export` subtree: schema-generated native/controller results,
+sanitized journals and attempt diagnostics, and named screenshots. Capability
+files, control descriptors, credentials, raw product logs and isolated data roots
+remain private. Standalone fault checks use `tools/run-device-tests.py --phase
+e2e --cleanup-regression timeout|crash` with the actual isolated device and host
+controller/CLI paths supplied by the platform driver.
+
 Device phases run serially because one installed activity/application cannot
 host parallel native processes safely. Native traditional coverage includes
 the package consumer's compressed, corrupt, truncated and checksummed inputs

src/automation/LocalCommandServer.cpp

@@ -391,7 +391,9 @@ void LocalCommandServer::screenshot(QIODevice *socket, const QString& id, const
                 { { QStringLiteral("id"), id }, { QStringLiteral("ok"), true }, { QStringLiteral("result"), result } });
         },
         Qt::ConnectionType(Qt::QueuedConnection | Qt::SingleShotConnection));
-    m_window->requestUpdate();
+    // Request a scene-graph repaint, not just a platform-window update event.
+    // QQuickWindow::update() schedules a frame even when the scene is unchanged.
+    m_window->update();
 }
 
 void LocalCommandServer::dispatch(QIODevice *socket, const QJsonObject& request)

tests/QmlTestRunner.cpp

@@ -72,7 +72,23 @@ public slots:
 
 int spoolRunQml(int argc, char **argv, const char *input)
 {
-    std::vector<char *> arguments(argv, argv + argc);
+#ifdef Q_OS_WIN
+    // Qt's plain stdout logger otherwise uses OutputDebugString when the
+    // selector has no console. The supervisor retains stdout/stderr in its
+    // private per-attempt log, so explicitly keep test results on that stream.
+    qputenv("QT_FORCE_STDERR_LOGGING", "1");
+#endif
+    std::vector<char *> arguments;
+    arguments.reserve(size_t(argc) + 5);
+    arguments.insert(arguments.end(), argv, argv + argc);
+    char logOption[] = "-o";
+    char logOutput[] = "-,txt";
+    // Normal supervised selectors have no QtTest arguments. Leave explicit
+    // command-line logging/format choices intact for targeted invocations.
+    if (argc == 1) {
+        arguments.push_back(logOption);
+        arguments.push_back(logOutput);
+    }
     QByteArray option("-input");
     QByteArray path(input);
     arguments.push_back(option.data());