@@ -48,7 +48,7 @@ The versioned CLI help owns command semantics. To drive an app, start with the s
 - In a new worktree, run `pnpm install --frozen-lockfile && pnpm build` before you test.
 - Do not change other worktrees, devices, sessions, dirty files, or experiments. Do not use `git stash`; all worktrees share it.
 - Do not copy `.env` into a worktree. For host credentials, source the main checkout's file by its absolute path.
-- Give each parallel worker different files and a different device. `pnpm check:affected --run` and `pnpm check` run one at a time automatically.
+- Give each parallel worker different files and a different device. `pnpm check:affected --run`, `pnpm check`, and heavy `pnpm gate` ids share one lock.
 - The layering scan reads only tracked files. Stage new modules before you trust its result.
 - When you rename a file, move its Fallow baseline entry. Do not regenerate unrelated baselines.
 
 
@@ -55,6 +55,11 @@ Append `:clean` to any platform build when DerivedData may be stale, for example
 `pnpm build:xcuitest:macos:clean`. `pnpm build:xcuitest` remains the shared iOS-and-macOS gate for
 changes that affect both runners; it is not an all-platform build.
 
+`pnpm clean:xcuitest[:ios|:macos|:tvos|:visionos]` cleans the runner derived-data directory and prints
+it. When `AGENT_DEVICE_IOS_RUNNER_DERIVED_PATH` is set, the scripts clean only that directory, for
+every platform, and keep entries that are not build output. Otherwise they clean the default
+directory under `~/.agent-device/apple-runner/derived`.
+
 Android and macOS helper builds remain separate because they require their native toolchains:
 
 ```bash
 
@@ -110,6 +110,7 @@ @interface AgentDeviceRunnerViewController : UIViewController
 @property(nonatomic, assign) NSTimeInterval textEntryBurstMinGap;
 @property(nonatomic, assign) NSTimeInterval textEntryAcknowledgeWindowSeconds;
 @property(nonatomic, strong) NSLayoutConstraint *textEntryFieldTop;
+@property(nonatomic, weak) UITextField *textEntryField;
 @property(nonatomic, assign) BOOL alertFixtureStarted;
 @property(nonatomic, strong) NSTimer *alertActivationBusyBackstop;
 @property(nonatomic, strong) NSTimer *alertBannerRepost;
@@ -130,6 +131,39 @@ - (NSString *)accessibilityValue {
 }
 @end
 
+// XCTest reads every element's accessibility value each time it snapshots the app, which it does
+// for every element query and every attribute read from a live element. Counting this field's
+// value reads therefore counts the accessibility queries a command makes. The value is masked, so a
+// fill's read-back ends at its first read instead of polling through a stability window whose
+// poll count depends on how fast the host answers.
+static NSUInteger AgentDeviceTextEntryValueReads = 0;
+
+@interface AgentDeviceValueReadCountingTextField : AgentDeviceMaskedTextField
+@end
+
+@implementation AgentDeviceValueReadCountingTextField
+- (NSString *)accessibilityValue {
+  AgentDeviceTextEntryValueReads += 1;
+  return [super accessibilityValue];
+}
+@end
+
+// Reports the read count as its accessibility label and the counted field's text as its value, so
+// reading either changes no view state and the masked text stays checkable.
+@interface AgentDeviceValueReadCountLabel : UILabel
+@property(nonatomic, weak) UITextField *countedField;
+@end
+
+@implementation AgentDeviceValueReadCountLabel
+- (NSString *)accessibilityLabel {
+  return [NSString stringWithFormat:@"%lu", (unsigned long)AgentDeviceTextEntryValueReads];
+}
+
+- (NSString *)accessibilityValue {
+  return self.countedField.text;
+}
+@end
+
 // A field that reformats its own text on every edit into `## ### ## ##` digit groups, the way a
 // digit-grouping formatter in a Flutter or React Native input does. The accessibility value is
 // what the user sees — the formatted string — so it never equals the digits a `fill` sent (#2634).
@@ -513,20 +547,33 @@ - (void)agentDeviceTextEntryDidChange:(UITextField *)textField {
   }
   if ((codeComplete && [arguments containsObject:@"--agent-device-text-entry-auto-submit"]) ||
       (textField.text.length > 0 && [arguments containsObject:@"--agent-device-text-entry-replace-after-input"])) {
-    UITextField *nextScreenField = [[UITextField alloc] initWithFrame:textField.frame];
-    if (![arguments containsObject:@"--agent-device-text-entry-unnamed-input"]) {
-      nextScreenField.accessibilityIdentifier = @"agent-device-auto-submit-next-screen-input";
-    }
-    nextScreenField.borderStyle = UITextBorderStyleRoundedRect;
-    [textField.superview addSubview:nextScreenField];
-    [textField removeFromSuperview];
-    [nextScreenField becomeFirstResponder];
+    [self replaceTextEntryFieldWithNextScreenInput:textField];
   } else if (codeComplete &&
              [arguments containsObject:@"--agent-device-text-entry-auto-submit-without-successor"]) {
     [textField removeFromSuperview];
   }
 }
 
+- (void)replaceTextEntryFieldWithNextScreenInput:(UITextField *)textField {
+  UITextField *nextScreenField = [[UITextField alloc] initWithFrame:textField.frame];
+  if (![NSProcessInfo.processInfo.arguments containsObject:@"--agent-device-text-entry-unnamed-input"]) {
+    nextScreenField.accessibilityIdentifier = @"agent-device-auto-submit-next-screen-input";
+  }
+  nextScreenField.borderStyle = UITextBorderStyleRoundedRect;
+  [textField.superview addSubview:nextScreenField];
+  [textField removeFromSuperview];
+  [nextScreenField becomeFirstResponder];
+}
+
+// The same navigation as `replace-after-input`, landing when a test presses the button instead of on
+// an edit, so the test decides which runner step it lands between.
+- (void)agentDeviceTextEntryReplaceDidPress:(UIButton *)sender {
+  (void)sender;
+  if (self.textEntryField.superview != nil) {
+    [self replaceTextEntryFieldWithNextScreenInput:self.textEntryField];
+  }
+}
+
 // Stops answering the element-type query that found it, the moment it takes focus, under
 // `--agent-device-text-entry-unqueryable-on-focus`. #3060's Flutter password field reaches this shape
 // because its two accessibility channels disagree once focused — `TextField` through the legacy
@@ -690,6 +737,8 @@ - (void)viewDidLoad {
         [NSProcessInfo.processInfo.arguments containsObject:@"--agent-device-text-entry-submit-clears"];
     BOOL maskedValue =
         [NSProcessInfo.processInfo.arguments containsObject:@"--agent-device-text-entry-masked-value"];
+    BOOL countsValueReads =
+        [NSProcessInfo.processInfo.arguments containsObject:@"--agent-device-text-entry-counts-value-reads"];
     UITextField *textField;
     if (digitCountValue) {
       textField = [[AgentDeviceDigitCountTextField alloc] init];
@@ -702,6 +751,8 @@ - (void)viewDidLoad {
       textField = [[AgentDeviceSubmitClearingTextField alloc] init];
     } else if (maskedValue) {
       textField = [[AgentDeviceMaskedTextField alloc] init];
+    } else if (countsValueReads) {
+      textField = [[AgentDeviceValueReadCountingTextField alloc] init];
     } else {
       textField = [[UITextField alloc] init];
     }
@@ -724,6 +775,7 @@ - (void)viewDidLoad {
         forControlEvents:UIControlEventEditingChanged];
     textField.translatesAutoresizingMaskIntoConstraints = NO;
     [self.view addSubview:textField];
+    self.textEntryField = textField;
     self.textEntryFieldTop = [textField.topAnchor constraintEqualToAnchor:label.bottomAnchor
                                                                  constant:AgentDeviceTextEntryFieldTopInset];
     [NSLayoutConstraint activateConstraints:@[
@@ -732,6 +784,18 @@ - (void)viewDidLoad {
       [textField.widthAnchor constraintEqualToConstant:240],
       [textField.heightAnchor constraintEqualToConstant:AgentDeviceTextEntryFieldHeight],
     ]];
+    if (countsValueReads) {
+      AgentDeviceValueReadCountLabel *valueReads = [[AgentDeviceValueReadCountLabel alloc] init];
+      valueReads.countedField = textField;
+      valueReads.accessibilityIdentifier = @"agent-device-text-entry-value-reads";
+      valueReads.text = @"value reads";
+      valueReads.translatesAutoresizingMaskIntoConstraints = NO;
+      [self.view addSubview:valueReads];
+      [NSLayoutConstraint activateConstraints:@[
+        [valueReads.centerXAnchor constraintEqualToAnchor:self.view.centerXAnchor],
+        [valueReads.topAnchor constraintEqualToAnchor:textField.bottomAnchor constant:12],
+      ]];
+    }
     if (currencyValue || submitClears) {
       UILabel *entryStatus = [[UILabel alloc] init];
       entryStatus.accessibilityIdentifier = @"agent-device-text-entry-events";
@@ -774,6 +838,21 @@ - (void)viewDidLoad {
       ]];
       [self updateTapWitnessStatus];
     }
+    if ([NSProcessInfo.processInfo.arguments containsObject:@"--agent-device-text-entry-replace-on-request"]) {
+      // Above the title, so the software keyboard never covers it.
+      UIButton *replace = [UIButton buttonWithType:UIButtonTypeSystem];
+      replace.accessibilityIdentifier = @"agent-device-text-entry-replace";
+      [replace setTitle:@"Replace input" forState:UIControlStateNormal];
+      replace.translatesAutoresizingMaskIntoConstraints = NO;
+      [replace addTarget:self
+                  action:@selector(agentDeviceTextEntryReplaceDidPress:)
+        forControlEvents:UIControlEventTouchUpInside];
+      [self.view addSubview:replace];
+      [NSLayoutConstraint activateConstraints:@[
+        [replace.centerXAnchor constraintEqualToAnchor:self.view.centerXAnchor],
+        [replace.bottomAnchor constraintEqualToAnchor:label.topAnchor constant:-24],
+      ]];
+    }
     if ([NSProcessInfo.processInfo.arguments containsObject:@"--agent-device-text-entry-unqueryable-on-focus"]) {
       self.textEntryFocusWitness = [[UILabel alloc] init];
       self.textEntryFocusWitness.accessibilityIdentifier = @"agent-device-text-entry-focus";
 
@@ -335,7 +335,7 @@ extension RunnerTests {
 
   /// Shared ordering for point-hit candidates: smallest area wins, then top-to-bottom,
   /// left-to-right, then stable element-type order for ties.
-  func smallestElementFirst(_ left: XCUIElement, _ right: XCUIElement) -> Bool {
+  func smallestElementFirst(_ left: any XCUIElementAttributes, _ right: any XCUIElementAttributes) -> Bool {
     let leftArea = max(1, left.frame.width * left.frame.height)
     let rightArea = max(1, right.frame.width * right.frame.height)
     if leftArea != rightArea {
@@ -352,7 +352,7 @@ extension RunnerTests {
 
   func readTextAt(app: XCUIApplication, x: Double, y: Double) -> String? {
     let point = CGPoint(x: x, y: y)
-    let textInputCandidates = textInputCandidatesAt(app: app, point: point)
+    let textInputCandidates = textInputCandidatesAt(app: app, point: point).map(\.element)
     for element in textInputCandidates where prefersExpandedTextRead(element) {
       if let text = readableText(for: element) {
         return text
@@ -363,7 +363,7 @@ extension RunnerTests {
       .filter { element in
         element.exists && !element.frame.isEmpty && element.frame.contains(point)
       }
-      .sorted(by: smallestElementFirst)
+      .sorted { smallestElementFirst($0, $1) }
 
     for element in candidates where prefersExpandedTextRead(element) {
       if let text = readableText(for: element) {
 
@@ -138,15 +138,15 @@ extension RunnerTests {
     observe: () -> TextValueRead,
     waitForNextObservation: () -> Void
   ) {
-    let field = resolveTextEntryElement(app: app, target: target)
+    let field = resolveTextEntryInput(app: app, target: target)?.attributes
     let placeholder = field?.placeholderValue
     let waitStartedAt = Date()
     return (
       placeholder: placeholder,
       fieldIsUnreadable: textValueRead(for: field) == .unreadable,
       observe: {
         let observed = self.textValueRead(
-          for: self.resolveTextEntryElement(app: app, target: target),
+          for: self.resolveTextEntryInput(app: app, target: target)?.attributes,
           treatingPlaceholderAsEmpty: true
         )
         var observedText: String?