fix(a11y-android): carry the device's own node ref, don't infer it

[xxx]

The on-device-service reader assumed AxNodeId(n) equalled the companion's ref n, on the grounds that both sides number the same nodes in the same pre-order. That holds only while the host keeps every node the device sent. The Depth and Siblings caps drop a subtree and then continue with later siblings, so past the first pruned subtree a host id is lower than the device's own ref — an action dispatched by it reaches a different node and reports success.

The companion has emitted ref on every node since its first release, and resolves an action against its own freshly re-read, untruncated tree. The ref namespace was therefore never the host's kept set.

What changed

• json_to_node reads each node's ref and records it in the pre-order assign_ids numbers by; tree_from_json returns a RefTree pairing the tree with that table.
• invoke and set_value dispatch by RefTree::device_ref(..) — what the device calls the node — instead of the host id. set_value addresses the node its guard approved rather than the id the caller named.
• A node with no ref fails the snapshot, like malformed bounds: dropping it would shift every later id, and inferring it is the bug this removes.
• The guard refusing a native click on a Depth/Siblings-truncated tree is gone. Such a tree now actuates natively rather than falling back to a pointer click.

The uiautomator reader carries no equivalent inference — it acts by tap coordinates and consults truncation only to explain an element missing from its own re-read tree.

Verification

cargo test --workspace, cargo clippy --workspace --all-targets -- -D warnings and cargo fmt --check are clean.

Both action paths are covered end-to-end against the fake device, over a tree shaped root > [Card > (c1, c2, c3), trailing] where the trailing node is device ref 5:

• depth: 1 makes it host id 2 — a click by host id would actuate c1.
• siblings: 2 makes it host id 4 — a write by host id would land in c3.

Both assert the exact ref on the wire, and both were confirmed to fail against the id-dispatching code.

The Android device suite is schedule-only, so PR CI does not exercise this on a real emulator. Default limits (depth 30, siblings 4096) do not fire on a real app, so an on-device run would cover the untruncated path as a regression check rather than the fix itself.

Fixes #288

🤖 Generated with Claude Code