[chaxus]

Exports could return bytes from a replacement document, failed opens could publish unmounted metadata, and incomplete AI output could advance tools or queued work. Bind these operations to their owners, retain incomplete output safely, and validate the resulting behavior through service-worker-controlled browser fixtures and balanced CI shards.

Merge Verdict

[APPROVE]

Independent reviews covered save/open ownership, AI completion/context, and browser/CI behavior. All actionable findings were fixed with regressions and focused re-review.

Summary

• Bind pending exports to the originating document and conversion, including cold exports and deferred native PDF pagination. Replacement/close reject stale requests; concurrent manual saves still reach disk.
• Publish document metadata only after successful mounting, preserving the mounted document when preprocessing or a newer download fails.
• Retain incomplete AI output, prevent incomplete tool execution, pause queued successors, and guard direct generation consumers. Normalize Gemini abnormal termination reasons, including future explicit reasons.
• Fit owned document excerpts within the existing UTF-8 context budget as later tool exchanges grow, while preserving terminal write execution and arbitrary tool-output contracts.
• Repair cross-engine HTTP, clipboard, startup-history and native-download fixtures while retaining production worker control and strict content, accessibility and failure assertions.
• Return a valid network-error response when an offline worker asset misses both network and cache. Preserve assistant focus across delayed native document refocus and explicit cross-frame handoffs, retaining genuine document input and native modal focus; contain Firefox native progress borders.
• Retain separate normal/serial reports, run serial cases after ordinary failures, balance PR shards using measured file durations, and run nightly WebKit/Firefox on independent runners.

Risk Analysis

Risk	Level	Mitigation
Export ownership across asynchronous native pagination	Medium	Actual SDK CheckPrint-boundary regressions, real PDF exports on all three engines, concurrent manual disk-save E2E
Provider termination and tool protocol compatibility	Medium	Runtime/queue/stream/direct-consumer regressions; partial text retained; explicit abnormal Gemini reasons fail closed
Context fitting across multiple tool calls	Medium	Structured opt-in excerpts, serialized UTF-8 accounting, Unicode/cancellation/sequential read-write and terminal-write regressions
Native SDK focus ownership	Medium	Exact document targets only; explicit pointer/Tab handoff; real document typing and native modal focus on all engines
Browser fixtures and CI selection	Low	Real worker-controlled HTTP checks, held-request/history preconditions, independent native filename calibration, complete/disjoint CLI selection and actual report-retention checks

Design Decisions

• Preserve public embed shapes, original-file fallback opt-in, dirty/save-point protection, read-only behavior and the existing context limit. Keep ownership in existing lifecycle modules; only owned document excerpts opt into fitting.
• WebKit networking was reproduced with Playwright 1.64 and WebKit 2370: a controlling production service worker bypasses page route mocks, so fake API/document URLs reach the real network. Local HTTP fixtures preserve actual CORS, streams and cancellation. Handler counters and real network-event checks prevent silent fixture bypass.
• Cross-frame focus ownership blocks only known native document targets while a visible assistant control owns focus. Explicit editor pointer/Tab intent releases the claim; native modal/toolbar focus remains unchanged. A single guarded frame retry handles Firefox rejecting a parent click without trapping later user intent.
• Native save labels accept the exact Ctrl/Command shortcut forms. Download checks assert the application's exact anchor name independently of native platform formatting, plus saved document/CSV content and formula escaping. Startup history interception uses the stable IDBFactory prototype and proves restoration is held before request submission. The cached-model UI fixture uses the storage prototype to select Cache API, seeds only after editor navigation and verifies both real entries before opening the assistant, so WebKit cannot silently restore an instance override or lose a cross-navigation fixture precondition.
• Cached WebKit/Firefox binaries still require runner system libraries. A real cache-hit run failed before navigation on missing libevent-2.1.so.7; the installer now requires bounded/retried install-deps for cached non-Chromium or mixed selections. Chromium’s existing fast path/advisory opt-in and cold installation remain unchanged. Executable Bash regressions replace the obsolete blanket cache-skip assumption. This follows Playwright’s CI dependency guidance.
• Keep required summary check names, per-runner worker counts, schedules and defaults. LPT sharding uses checked-in measured durations and a median fallback for new files. The nightly matrix disables fail-fast, selects one engine in both passes, and uploads unique per-engine artifacts containing both reports/results.
• Manual-only skip_corpus permits complete browser/budget validation without the unrelated weekly corpus matrix; scheduled corpus behavior is unchanged. Preserve multiple commits as requested.

Code Concerns

No unresolved findings remain from independent code review. Latest-head main CI passed every quality and preview/Docker/Pages E2E job without test retries. The complete browser workflow passed under the unchanged retry policy, with one retried case per engine as recorded below.

Verification

• Latest remote full unit coverage: 251 files / 6763 tests passed; statements 87.49%, branches 83.56%, functions 88.30%, lines 90.03%; all configured thresholds passed.
• Formatting (including 1511 immutable evaluation artifacts), oxlint/TypeScript, production build and Compose configuration passed. Final test-only follow-ups passed full formatting and lint/TypeScript again.
• The recovery/manual-save overlap fixture now asserts exact live text before starting conversion and again before real Ctrl+S. A CI screencast proved the former missing letter was already present on the canvas before conversion. Atomic initial browser input preserves the real blank document, manual per-key edit and exact saved-byte/counter checks; Chromium and Firefox each passed 3 focused no-retry runs (WebKit keeps its existing writable-OPFS capability skip).
• Native SDK focus regressions passed both programmatic/sidebar entry paths on all three engines (6 cases, no retries), retaining actual document input and native modal focus. The original Firefox dictation case passed 3 consecutive runs without retries.
• All five full-nightly follow-up scenarios passed on Chromium, WebKit and Firefox: 15 cases, no retries. Earlier focused production-worker/offline/provider/open/save regressions passed 26 WebKit/Firefox cases, with real PDF export also passing all three engines and concurrent manual disk save passing Chromium.
• Focused workflow and installer regressions passed 79 tests. Actual CLI discovery confirmed complete/disjoint nightly selection: normal 692 = 346 + 346, serial 4 = 2 + 2. Root/nested same-basename specs are covered by selection regressions.
• The cached-model delete UI case failed three consecutive production-build WebKit runs before the final fixture repair. It then passed 3 consecutive runs on each engine (9 cases, no retries), preserving confirmation/cancellation, danger styling, held deletion and final removal assertions.
• Final-head Firefox: 321 passed / 25 existing skips in the ordinary pass without retries; serial 1 passed + 1 flaky. The service-worker update case first emitted a WASM streaming AbortError during reload, then passed its existing retry. Three focused reruns passed without retries; the abort was not reproduced.
• Final-head WebKit: ordinary 309 passed + 1 flaky / 36 existing skips; serial 2 passed. The structured-result theme-switch case first observed its input detach during scrollIntoViewIfNeeded, then passed its existing retry. The repaired cache-model fixture and native focus regressions passed on their first attempts. These two cases remain recorded as observed flakiness rather than a zero-retry full run.
• An actual failed normal pass followed by a successful serial pass retained both reports and attachments. Downloaded diagnostic artifacts confirmed both reports after WebKit normal failure; final-head engine artifacts also contain separate normal and serial reports.
• Gemini normalization follows the FinishReason API contract. No paid live-provider calls were made; deterministic provider parsing and consumer boundaries are covered.

Remote acceptance on latest head 052cead0: main CI, preview smoke, and the explicitly dispatched complete WebKit/Firefox and slow-network workflow all passed. All 31 commits are pushed. The weekly corpus matrix is intentionally excluded from this focused manual browser run; scheduled defaults are unchanged.

[cloudflare-workers-and-pages]

Deploying document with    Cloudflare Pages

Latest commit:	052cead
Status:	✅  Deploy successful!
Preview URL:	https://e252368c.document-7hm.pages.dev
Branch Preview URL:	https://codex-save-integrity-and-bro.document-7hm.pages.dev

View logs