No AppModel test harness, so model-level behaviour is only ever proven through the UI

[lightcloud00]

What is missing

ParkNudgeTests/TestFixtures.swift provides a ParkingSession builder and a FixedClock, and nothing else. There are no fakes for the nine protocols in ServiceProtocols.swift, so AppModel — which owns most of the app's decision-making — cannot be constructed in a unit test.

Everything it does is therefore either untested or tested indirectly through XCUITest, which is slow, device-dependent, and cannot assert on things that have no visible representation.

Concrete cost, already paid

Issue #15 asked for "UI coverage using a fake requester; verify no prompt is requested on first completion". That could not be written. ReviewPromptPolicy is fully unit-tested as a pure decision, but the wiring — that finishActive() evaluates it after the paywall flag is set, and passes the real completion count — is unverified.

The same gap hides:

• whether the first-completion paywall and the rating request can ever fire together;
• whether alertMessage being set actually suppresses the rating request in practice;
• whether thumbnail(for:)'s updatedAt-keyed cache really retires a replaced photo.

Suggested approach

Add in-memory fakes for ParkingRepository, LocationProviding, NotificationScheduling, PhotoStoring, DirectionsOpening, PurchaseProviding, CSVExporting and ReviewRequesting — the last one recording calls — plus a builder that assembles an AppModel from them with a FixedClock. AppEnvironment.makeUITesting already contains most of these as private types; promoting them into the test target is the smaller move than writing new ones.

Acceptance

• AppModel constructible in a unit test with all dependencies faked.
• A test asserts no review is requested on the first completion, and one is on the third.
• A test asserts no review is requested while isPaywallPresented or alertMessage is set.
• ./scripts/verify.sh still green.

Deferred deliberately from #15; recorded here rather than left implicit.

Resolution plan

• Verified: 2026-08-25T04:51:16Z against main@04a6cd5e808720983471ee9595fd40bc94e1f0fe (commit time 2026-08-25T00:53:29Z).
• Source basis: Original issue body, all 0 comment(s), current default-branch tree, referenced pull-request states, and the protected top-90 dossier revalidated without modifying it.
• Disposition: Code or verification work - not complete on the verified default branch.
• Outcome: No AppModel test harness, so model-level behaviour is only ever proven through the UI

Current evidence and corrected premise

Verdict — NOT_STARTED. Confirmed by the shape of the test directory.

ParkNudge/Application/AppModel.swift exists. ParkNudgeTests/ contains 8 files and none of them
is an AppModel test:

CSVAndMoneyTests  FeatureAccessTests  MeterStateTests  ParkingCoordinatorTests
ReminderPlannerTests  ReviewPromptPolicyTests  SwiftDataParkingRepositoryTests  TestFixtures

The domain layer is well covered — MeterState, ReminderPlanner, ParkingCoordinator,
ReviewPromptPolicy, the repository. The application layer that composes them is not.
P2 · enhancement, area: ios, priority:p2, revenue:r3 · Canonical source: origin/main
Cluster: red or missing test suites — see CLUSTERS.md.
All 0 issue comment(s) were read. There are no comments.
Verified source paths on this head:

• ParkNudge/Application/AppEnvironment.swift
• ParkNudge/Application/AppModel.swift
• ParkNudge/Domain/Services/ServiceProtocols.swift
• ParkNudgeTests/ParkingCoordinatorTests.swift
• ParkNudgeTests/TestFixtures.swift
• scripts/verify.sh
  Filed or dossier path references not present on this head; treat them as stale until relocated:
• ParkNudgeTests/AppModelTests.swift

Resolution steps

Exact fix

Add ParkNudgeTests/AppModelTests.swift, following the conventions already in the directory:

1. Reuse ParkNudgeTests/TestFixtures.swift — it exists precisely to build domain objects for
   tests; do not introduce a second fixture style.
2. Follow ParkingCoordinatorTests.swift for the composition-under-test pattern; it is the closest
   analog (a coordinator over the same repository seam).
3. Inject rather than construct: AppEnvironment.swift is where ReviewRequester and
   ReviewPromptPolicy are wired (3 references), so AppModel should be constructible with test
   doubles through it. If it currently is not, making it injectable is the first task — and is
   the real content of this issue.
4. Cover at minimum: starting and ending a parking session updates state; the meter state exposed to
   the UI matches MeterState for the same inputs; the review prompt is requested exactly when
   ReviewPromptPolicy.shouldRequest says so (this closes a real gap — the policy is tested, its
   invocation is not).

Tests and acceptance

Test / proof

xcodebuild test -scheme ParkNudge -only-testing:ParkNudgeTests/AppModelTests

The new tests must fail if AppModel stops calling a domain policy — verify by temporarily removing
one call and confirming a red.

Gate — the repo's unit scheme

• For every listed xcodebuild argv, submit the equivalent focused job through the shared fleet-build gate after iOS capacity admission; do not run xcodebuild directly.

Dependencies and stop gates

Out of scope — ParkNudgeUITests; #29's unrendered meter states

• Do not close this issue until every acceptance item is mapped to exact merged-head evidence.

Next AI first action

Reuse ParkNudgeTests/TestFixtures.swift** — it exists precisely to build domain objects for

[lightcloud00]

Verified issue disposition — diagnostic

This is the current managed disposition for lightcloud00/parknudge#30 at default-branch 5c3d185143a2.

Current evidence

• Current stable snapshot for No AppModel test harness, so model-level behaviour is only ever proven through the UI #30 at 5c3d185143a2 keeps the issue open with body hash dd38ee992ce5; the validated grounded planner classified it as diagnostic_ready.

Files or owner actions

• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30, inspect and change only ParkNudge/Application/AppEnvironment.swift after confirming it exists at the recorded SHA.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30, inspect and change only ParkNudge/Application/AppModel.swift after confirming it exists at the recorded SHA.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30, inspect and change only ParkNudge/Domain/Services/ServiceProtocols.swift after confirming it exists at the recorded SHA.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30, inspect and change only ParkNudgeTests/ParkingCoordinatorTests.swift after confirming it exists at the recorded SHA.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30, inspect and change only ParkNudgeTests/TestFixtures.swift after confirming it exists at the recorded SHA.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30, inspect and change only scripts/verify.sh after confirming it exists at the recorded SHA.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30, inspect and change only {'content_sha256': 'sha256:43771a1553809bace2bc0ed261813eaaa638b425539b1d8a59185e49ac839d2e', 'decode_state': 'content_hashed', 'decoded_bytes': 7032, 'default_branch': 'main', 'git_blob_sha': 'f8a20ac506846048f18c052f42611191da614fc7', 'github_size': 7032, 'matched_issue_hints': ['AppModel', 'DirectionsOpening', 'LocationProviding', 'NotificationScheduling', 'ParkNudgeUITests', 'ParkingCoordinator', 'ever', 'only', 'test'], 'path': 'ParkNudge/Application/AppEnvironment.swift', 'state': 'inspected'} after confirming it exists at the recorded SHA.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30, inspect and change only {'content_sha256': 'sha256:51f7ad2565cd4fda020b17fd2b5719c8373189b59efdfa5143d1055c42ff9d17', 'decode_state': 'content_hashed', 'decoded_bytes': 13027, 'default_branch': 'main', 'git_blob_sha': '38949ae2588a35537fe0859d7e711746e7a8ad49', 'github_size': 13027, 'matched_issue_hints': ['AppModel', 'CSVExporting', 'DirectionsOpening', 'LocationProviding', 'ParkingCoordinator', 'ever'], 'path': 'ParkNudge/Application/AppModel.swift', 'state': 'inspected'} after confirming it exists at the recorded SHA.

Bounded plan

• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: Use the recorded read-only Git blob identities as the source starting point; create a detached task-temporary clone only if implementation requires broader inspection.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: Record the canonical checkout, task branch/base SHA, source tree, issue body hash, and pre-existing owner dirt.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: Reproduce the reported behavior and constrain the change to the issue-named surfaces: ./scripts/verify.sh, ParkNudge/Application/AppEnvironment.swift, ParkNudge/Application/AppModel.swift, ParkNudge/Domain/Services/ServiceProtocols.swift, ParkNudgeTests/AppModelTests.swift, ParkNudgeTests/ParkingCoordinatorTests.swift, ParkNudgeTests/TestFixtures.swift, scripts/verify.sh.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: Implement the smallest source change satisfying the issue-authored acceptance context while preserving unrelated behavior and dirt.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: Run focused verification, then the broader gate: python3 -m pytest -q.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: Capture exact diff, source identity before/after, test results, rollback boundary, and independent-peer state.

Commands

• Run git grep -n -F AppEnvironment.makeUITesting main for No AppModel test harness, so model-level behaviour is only ever proven through the UI #30 and retain sanitized output.
• Run git grep -n -F AppEnvironment.swift main for No AppModel test harness, so model-level behaviour is only ever proven through the UI #30 and retain sanitized output.
• Run git grep -n -F AppModel main for No AppModel test harness, so model-level behaviour is only ever proven through the UI #30 and retain sanitized output.
• Run git grep -n -F CLUSTERS.md main for No AppModel test harness, so model-level behaviour is only ever proven through the UI #30 and retain sanitized output.
• Run git grep -n -F CSVExporting main for No AppModel test harness, so model-level behaviour is only ever proven through the UI #30 and retain sanitized output.
• Run python3 -m pytest -q for No AppModel test harness, so model-level behaviour is only ever proven through the UI #30 and retain sanitized output.

Acceptance tests

• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: [ ] AppModel constructible in a unit test with all dependencies faked.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: [ ] A test asserts no review is requested on the first completion, and one is on the third.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: [ ] A test asserts no review is requested while isPaywallPresented or alertMessage is set.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: [ ] ./scripts/verify.sh still green.
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: For every listed xcodebuild argv, submit the equivalent focused job through the shared fleet-build gate after iOS capacity admission; do not run xcodebuild directly.

Risks

• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30, a false source binding could widen the change or invalidate this plan; Revert only the exact task-branch change after capturing source and runtime identity; never reset or restore an owner worktree.

Stop gates

• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: no issue close, reopen, body edit, pull-request, branch, or merge mutation while implementing this plan
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: the managed plan comment and disposition-specific readiness labels are the only authorized issue mutations in the planning lane
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: no push, protected-branch update, force-push, or merge
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: no deploy, upload, App Store Connect, TestFlight, or public release
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: no credential value disclosure, rotation, billing, or provider change
• For No AppModel test harness, so model-level behaviour is only ever proven through the UI #30: no owner-worktree restore, reset, checkout, process signal, or queue reorder

---

Ledger schema: aos.github-issue-plan-coverage.v1 · issue body: dd38ee992ce5

[lightcloud00]

Implementation checkpoint, 2026-08-25:

• Root cause reproduced: AppModel constructed concrete side-effecting dependencies internally, so its completion, review-request, paywall, and alert behavior could not be exercised deterministically at model level.
• Clean isolated candidate 4a1d2ef349b8394436f584b4b53c9cfb924a6afc is rebased onto current main@460aa110a8edebafc4a855dda2c81dcf17bf12a5.
• The candidate adds protocol-backed fakes and a test harness; it covers first/third completion review behavior, paywall and alert suppression, missing foreground-scene retry semantics, failed completion, and normalized once-per-version persistence.
• Self-review corrected a bounded version-normalization gap before publication.
• Source gates pass: XcodeGen double-generation idempotence (04555701b844867fd3040de353a451d1c1df7937b5838128502f0860791d0834), website checks for 9 pages, privacy/store JSON validation, shell syntax, whole-tree Swift parsing, and git diff --check.

Issue #30 remains open. Exact blocker: the required AppModel unit suite and broad verifier need the occupied shared iOS fleet lane. Owner: repository delivery lane. Next action: after the existing FIFO queue drains and shared admission passes, submit this exact head once; only a passing native receipt admits guarded push and a canonical PR.

[lightcloud00]

Exact verifier 20260828T195156Z-codex-app-a90169 ran clean candidate 97814e6001578a7b007315a26be27df3753b65f5. All 54 unit tests passed. Three UI assertions failed because they still expected finishing the first free parking session to open a paywall, which contradicts the approved earned-intent contract.

The task-owned repair is committed locally at 0d3aeda22c5cc08a60ba7d263ab6c41a97ed441b: completion now explicitly proves no paywall, then the test selects the Settings premium intent and verifies the immediate Close, purchase CTA, legal links, free history, and Restore reachability. Swift parsing, shell syntax, and diff checks pass. Governed push admission sequence 1207 is waiting behind the existing shared pre-push owner; no duplicate push or fleet retry has been started.