v3.22.0 (review fixes): the quota zero, the suite repair paths, the docs

Second review round on the unpushed v3.20.0-v3.22.0 batch:

- install parameters: a zero memory quota (nv_quota: 0 - the vendor
  reference form's C7 02 0000 C8 02 0000) is composed instead of being
  dropped as "unset" (only None/blank leaves the TLV out); a truncated EF
  length in stk_params is refused instead of read as an empty EF.
- test suites: a suite whose member script is gone is repairable - the
  update endpoint accepts pruning a dangling reference (a removal of a
  live script stays refused; the PWA's row Delete prunes it), and
  reconcile_scripts_to_suites() lists an orphan even when its suite_id
  write is refused by the validator, so a stored script that no longer
  validates stays visible in the editor and fails at run start with the
  message instead of disappearing.
- engine/PWA: the proactive action refuses a check.data (its result data
  is the drained-command list - the check was silently ignored); the
  vestigial _testScriptDraft is gone; berLenStr emits the 2/3-byte BER
  long form (a >255-byte C9 composes correctly).
- docs: api.md (the stop cleanup answers ok, never an automatic cancel;
  the server persists the counters - the PWA does not write them back; the
  suite bundle import always merges the scripts; the quota-0 note) and
  test-scripts.md (the event action covers all modelled events; the
  direct-create path needs a suite_id; the format history); help EN/RU
  counter wording.
- tests: the zero quota / truncated EF, the prune path, the invalid-script
  listing, the proactive data-check refusal, berLenStr and the >255-byte
  C9.  Tests: 839 frontend + 804 Python; sw cache simple-v403.

docs/api.md

@@ -775,8 +775,10 @@ INPUT, `dcs` `00` packed / `04` 8-bit / `08` UCS2; `item_id`; extra `raw`
 TLVs appended after the standard objects).
 
 The response is the initial state (`running: true`), the final counter
-(`scp80_counter`) and the step list; poll `/api/test/status`.  The PWA writes
-`scp80_counter` back to the card preset after the run.
+(`scp80_counter`) and the step list; poll `/api/test/status`.  The **server
+persists** every counter an SCP80 step consumed into the preset store as the
+run proceeds; the snapshot's `scp80_counter`/`scp80_counters` carry the
+latest values (the PWA only syncs its local copy - nothing is written back).
 
 A run that ends (an error, a stop, an unexpected pending command) with a
 command still announced **drains it with `ok` (0x00)** - fetching while the
@@ -853,9 +855,11 @@ the script endpoints, not here), `POST /api/test/suites/delete` (`{id}`)
 removes it - refused while the suite still holds scripts - and
 `POST /api/test/suites/import` takes
 `{suites: [...], scripts: [...], mode: "merge"|"replace"}`: the scripts are
-imported first (ids preserved; a collision gets a fresh uuid and the suites'
-references are remapped), then the suites; an unresolvable reference is
-reported in `errors` and the suite is skipped.  After the import the
+imported first **always with `merge`** (a script replace would wipe the other
+suites' scripts; the mode applies to the suite store), ids preserved, a
+collision gets a fresh uuid and the suites' references are remapped; then the
+suites are imported (`replace` wipes the suite store first); an unresolvable
+reference is reported in `errors` and the suite is skipped.  After the import the
 ownership invariant is reconciled: a script the imported suites list adopts
 its listing suite, and a script no suite lists any more — the `replace` mode
 wipes the suites that owned them — is **adopted into "Imported scripts"**
@@ -900,8 +904,9 @@ expected/actual pairs are reported per check.
 ### `POST /api/test/stop`
 
 Requests a stop (`{"stop": true}` is set on the run); the runner finishes the
-current step, answers any pending proactive command with a cancel TERMINAL
-RESPONSE and reports the run as `stopped`.
+current step, drains any pending proactive command with an **ok** (0x00)
+TERMINAL RESPONSE (the same bounded cleanup as a run that ends - a cancel is
+never sent automatically, v3.21.0) and reports the run as `stopped`.
 
 ### `POST /api/test/clear`
 
@@ -936,7 +941,7 @@ Install a Java Card `.cap` file on the card via GlobalPlatform commands (INSTALL
 | `sd_aid` | no | Security Domain AID for INSTALL[for load]; empty → default ISD `A000000003000000` |
 | `install_params` | no | Hex of the install-parameter field — the mandatory `C9` TLV (application-specific parameters; `C900` when empty), the System Specific Parameters `EF`, extra raw TLVs. When empty the server **composes** it from `volatile_quota`/`nv_quota` and `stk_params` (see below) |
 | `stk_params` | no | The STK part appended to the install parameters: the **EF-wrapped** CA (`EF <len> CA <len> …`, TS 102 226 §8.2.1.3.2.1 — the SIM access domain leads the CA value as `01 <ad>` / `00`) or the UICC template (`EA <len> 80 … [81 …]`). A bare `CA` is refused (it belongs inside the EF) |
-| `nv_quota` / `volatile_quota` | no | Integer memory quotas (bytes) coded as `C8` / `C7` in the install EF; only composed when `install_params` is empty |
+| `nv_quota` / `volatile_quota` | no | Integer memory quotas (bytes) coded as `C8` / `C7` in the install EF; only composed when `install_params` is empty.  `0` is a valid quota (the vendor reference form carried `C7 02 0000 C8 02 0000`); omit the field to leave the TLV out |
 | `make_selectable` | no | If true (default), final INSTALL uses P1=`0C` (install + make selectable) |
 | `load_block_size` | no | Bytes of load-file payload per LOAD APDU, 1–240 (default 240 when omitted). SCP80 concatenation carries a secured packet larger than one SMS over up to 5 SMs, so the block size is no longer clamped to fit a single SMS. |
 | `ram_format` | no | RAM command format: `auto` (default — the read-only probe decides, recorded as `FORMAT CHECK (...)` steps), `compact` or `expanded` to pin it |

docs/test-scripts.md

@@ -36,7 +36,8 @@ RESPONSE codings since 3.17.0, the semantic `event` action since 3.18.0, the
 `envelope` action's `src` override since 3.18.1, the inline `por` object, the
 `alpha`/`sms` checks, `scp80.params.format` and the case-insensitive
 `menu-select` text match since 3.19.0, the `proactive` cleanup action and the
-ok-answering bounded cleanup since 3.21.0, the suites since 3.22.0.
+ok-answering bounded cleanup since 3.21.0, the suites and the Simulator's
+event forms for all modelled events since 3.22.0.
 
 ## Writing a test for an applet
 
@@ -158,7 +159,8 @@ PoR-in-submit:
 1. **Client-side**: the PWA import (or `testScriptProblem`) rejects structural
    mistakes; the server validates again with the same engine at run start.
 2. **Import** the JSON (PWA → Simulator → Test script → Import, or
-   `POST /api/test/scripts`), select the matched preset, **Run**.
+   `POST /api/test/scripts/import`; a direct `POST /api/test/scripts` needs a
+   `suite_id`), select the matched preset, **Run**.
 3. **Read the report**: every action/expectation shows expected vs actual per
    check; ⚠ = warning (continues), ✗ = error (stops).  A failed step names the
    reason (`note`).
@@ -348,7 +350,9 @@ next step.
 
 - `sw` - default `{"mode": "exact", "value": "9000"}` (a `status` action with
   `attempts > 1` defaults to the `91??` mask).
-- `data` - the response data (for SCP80: the inline PoR packet).
+- `data` - the response data (for SCP80: the inline PoR packet).  The
+  `proactive` action does not take a `data` check - assert the drained
+  commands with `require` and the final status with `sw`.
 - `por` (SCP80 actions only) - `"any"` (default, no check), `"ok"`
   (`response_status == por_ok`), `"none"` (no PoR expected), or an **object**
   `{"status"?, "sw"?, "data"?}` asserting the decoded PoR of this very
@@ -605,6 +609,7 @@ expectation's `respond`, or the proactive action's `first`).
   same format).
 - `files` matches the File List as a set (order-insensitive); duplicate paths
   are kept.
-- Semantic `event` actions cover four events (0x03/0x0B/0x12/0x1D); every
-  other event uses the raw `envelope` action with the data hex from the
-  Phone tab's event form.
+- Semantic `event` actions cover every event the Simulator models: the four
+  server-built events (0x03/0x0B/0x12/0x1D) from `fields`, every other event
+  from the editor-built `data` hex (the raw `envelope` action stays for
+  hand-built data).