[DamianReeves]

Connected model sources previously retained originals without inspecting the host's semantic projection. This change verifies complete/projection transfers with the existing bounded MoonBit parser, holds the genuine application inspection command before enqueue, and atomically adopts the actual worker result with its original files. Unsupported or unusable projections keep verified originals and clearly disclose when the explorer still shows the previous model.

The dedicated worker path accepts receiver-owned projection bytes up to 64 MiB. Ordinary imports retain their 16 MiB policy. Close, replacement, cancellation and late results retain explicit ownership checks. The fixed observed entry shares one inspection controller with ordinary bootstrap and retains its actual startup handle. A capture armed before Connect binds controls to the next actual opening. Replacement wakes its waits; disposal targets that captured opening. All business controls share one outstanding slot and refuse after STOP or channel failure. Cleanup remains available for the captured owner.

Source and project selection now use the genuine UI buttons under the captured-owner guard. The operation reports selection only when that same nominal row is actually accepted by the application. A click alone remains pending. Wrong-row selection, missing choices, retirement and replacement have distinct outcomes. The DOM row count must match the actual discovered choice count before scanning attributes; ambiguous, disabled or detached buttons refuse. A phase marker represents rendered empty lists so the runner need not wait for a nonexistent button. The fixed port accepts identities as data and exposes no callback, program or module argument.

Previously stacked on #200, which landed as e163171; this PR now targets main. Includes the shared receiver, compiled header bridge, pure adoption transition and pending owner prerequisites. No new CI jobs, matrices or triggers; tests join existing groups and reuse the application build.

Validation on a42427d:

• Full application build; 476 grouped application tests and 143 MoonBit state/routing tests pass. Lint including its formatter subtask, clean-environment validation and diff checks pass. The 23 channel tests and 27 opening-owner tests are subsets of that total. They cover capture registration, actual choice acceptance, wrong rows, bounded DOM matching, replacement, stored settlement, cleanup ownership, copied-owner refusal, overlapping controls, STOP, revocation, lost channel, late replies and actual error identity.
• Actual compiled-worker controls cover supported inspection, a projection larger than 16 MiB, unsupported-version refusal and cancellation. These run under Bun, not a browser/platform qualification lane.
• Browser test sources pass static checking. The existing held-inspection and Close-before-core cases use the actual built observed index/fixed entry, arm capture before Connect, retain its actual opening handle and select exact fixture identities over real HTTP/WebSocket transport. The full current-head browser workflow passes in CI. Local Chrome remains held because of the previously reported keychain prompts.

Head 32e89f2 added bounded event tracing to the existing argument-delivery assertion. The preceding 4bc222b passed all three headless OS lanes, but its browser log showed default empty-text/false arguments after selection and insertion. The trace records real focus, keyboard and input events to distinguish focus loss from a host replacement. It does not weaken the result assertions or deadlines, add retries, or establish the cause of the earlier failure. The earlier folder reload correction still waits for exact edited bytes in the committed manifest. Focused typechecking, lint/format, validation and actual clean-environment pre-push hooks pass. Both preceding workflows finished before this push; none was cancelled. Current-head normal CI run39839012605 and headless run39839012942 both completed successfully, including the full browser build and all three headless OS lanes. Runtime application code and the source-a424 input receipt are unchanged. This current-head CI evidence is distinct from the earlier preserved source-specific local build; no product fix or full MCK/profile qualification is claimed.

This is application integration, not full MCK/profile qualification. Fresh source authority, the acquired image and fixed source-action factories, physical joins, shared report/replay, the original campaign allocation and required platform/strict gates remain open. Inventory observations are not relabeled as semantic-model adoption facts.

Refresh after #200 landed: head 5d28d23 merges main in two signed-off steps. The first takes #242 and resolves its overlap in elm-workflow.ts with main's waitForSavedCoreSource, which covers the same edited-source save race as 26e54cd and scopes it to the active workspace. The second records the #200 squash commit with the ours strategy, which is exact because its tree equals the merge of 39df05e and 6a0c4fb, both already in this branch. Against main, 40 of 41 changed files are byte-identical to this PR's previous diff; elm-workflow.ts differs only by that resolution. Local lint, format, validation, bun check --all, type tests, the workbench MoonBit JS tests, the build and the non-browser workbench tests pass on 5d28d23. Browser lanes run in CI only.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T20:06:12.279795Z	32e89f2	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.