Add automated assertion coverage for the upload-button path

[JSvandijk]

Why this matters

The upload path is one of the core product claims, but the current evidence is still stronger visually than it is mechanically asserted.

The app injects an upload affordance into the T3 composer flow in apk/app/src/main/java/com/t3code/app/MainActivity.java. We already have emulator-backed runtime evidence in docs/evidence/v1.1.0-emulator/, but we should tighten the automated proof so a regression is easier to catch before release.

Scope

• Review the current harness and verification flow for the upload path.
• Add at least one direct automated assertion that the upload control is present and reachable when the expected composer UI is available.
• Document exactly what is guaranteed by the automated check and what still requires runtime evidence.

Acceptance criteria

• The automated verification flow fails if the upload control is no longer injected into the expected composer path.
• The documented test flow explains the boundary between automated assertions and manual runtime evidence.
• The release/runtime docs are updated if the verification story changes.
• The change does not weaken the current npm test / smoke-test path.

Notes

This should stay honest about what can and cannot be asserted without a full real-device media interaction.

[JSvandijk]

Maintenance check on May 5, 2026 after merging #19 and #20.

Current state:

• The upload button path remains a core product claim and the Android code still injects the upload affordance through MainActivity.java.
• docs/evidence/v1.1.0-emulator/README.md still explicitly says machine-verifiable upload-button assertion is not proven by the current evidence set.
• Today's checks passed (npm ci, npm test, GitHub node-checks, GitHub android-build, and local cmd /c build-apk.bat), but none of those add the missing assertion.

Keeping this open. Next useful implementation is a focused assertion that fails when the expected composer upload control is not injected, plus a doc note separating automated proof from real-device media-picker evidence.

[JSvandijk]

Fixed by #21.

What is now covered:

• npm test runs test/test-upload-injection.js.
• The new test executes the proxy upload-injection script in a fake DOM and asserts preferred composer-footer placement, hidden image file input creation, paste-event dispatch into the composer target, and fallback placement.
• The test also checks the Android WebView source for the critical upload-injection markers: composer selectors, t3-file-input, t3-img-btn, t3-mobile-actions, ClipboardEvent, MutationObserver, and fallback logging.
• GitHub node-checks and android-build passed on Improve proxy guidance and upload assertions #21.

Boundary: this closes the missing automated assertion coverage. It does not replace real-device upload evidence for a release, which remains covered by the runtime verification docs.

[JSvandijk]

Closed by #21.