Matrx Extend bug fix

Own one real defect through a pushed, independently checked result. A paused or unavailable coordinator is not a user hold: continue an already assigned, authorized slice without asking that coordinator for permission. An explicit user stop or hold still binds. The durable source of truth is the stabilization plan, current checkpoint, case inventory, and docs/stabilization/defects/EXT-D-*.json. Read their current state and this repo's CLAUDE.md at the start; inherited reports are leads, not current findings. Apply diagnose to establish cause, forcing-function-tests to a regression guard, and agent-review-queue if a user-visible result needs Arman's UI review. Do not invent a bug or assign a case without evidence.

Claim one slice and make it durable

1. Fetch origin/main and inspect dirty files, active defect ownership, the exact EXT-F-* feature and EXT-F-*-T* case IDs, current run and release activity. Keep one owner per defect. Before taking a stale-looking claim, check its latest pushed record and whether its owner or runner is still active. A paused coordinator does not erase an active claim. If a truly unowned defect is found, record its stable ID, owner, bounded scope, applicable guest/member/admin modes, acceptance criteria, allowed files, and next action in its defect JSON; preserve transition history. Allocate new IDs only after checking remote main for collisions, and recheck ownership after the claim push.
2. Reproduce the reported symptom on the exact relevant build and auth/organization state. Use the defect schema and state path: id, feature_id, case_ids, surface, auth/role/org/permission context, preconditions, numbered reproduction, expected, actual, sanitized evidence and build receipt, reproducibility, severity, priority, state, owner, cause/sibling census, fix SHA, original and surrounding retest runs, reviewer, and timestamped transitions. open → triaged → in-fix → fixed → retest-pass → closed; failed retest follows fixed → retest-fail → in-fix. A failed infrastructure run is invalid evidence, not a product failure. Keep an open investigation when behavior is intermittent or cause remains unknown. Update only your owned defect and uniquely named run/report/evidence files; the shared inventory.json and COORDINATOR.md are integration surfaces. If the coordinator is unavailable, reconcile those surfaces on current main and make one narrow, evidence-backed update so a later coordinator can resume without your chat.
3. Fix the cause and its siblings. Show a meaningful guard fail on the old behavior and pass on the corrected behavior. Run focused checks and relevant repository gates, including pnpm compile; handler/config/env changes also require generated tool docs per CLAUDE.md. Update docs/feature-tests.md for a user-visible change. Treat source checks, component tests, native behavior, and Store installation as distinct verdicts.

Test and close only what passed

Use the resource plan and scripts/stabilization-resource.mjs for every admitted heavy build, test suite, or browser run. The limit is one heavy job and browser profile per host. Two hosted browser lanes require isolated hosts, profiles and fixtures plus independent review that the guard enforces host-local ownership; until that review, serialize launches. Check active jobs on the host you will use, including hosted workflow concurrency. Unrelated CI on another host is not a global veto. Serialize shared secret staging, account/organization use and mutable fixtures across hosts. Read current policy and lease state; never bypass a refusal, remove a lease, lower a threshold, or start an unguarded heavy job. Unique run IDs and completed resource journals belong in sanitized run evidence. Keep scratch on the external volume when required. Stop and record unsafe/pending journals as unverified; account for every owned process before handing off.

For UI closure, bind the actual running extension to source SHA, artifact hash, mode, extension ID, Chrome/profile, auth role, organization, backend, and fixture; verify warm and full-reload behavior and the original repro plus surrounding cases. Use real sign-in and service responses for native acceptance. An independent peer must retest the original symptom and adjacent behavior, with separate behavior and code-quality verdicts. Record fixed, retest-pass, and closed transitions only when their specific gates are met; leave installed/Store acceptance unverified until observed. Run python3 scripts/generate-stabilization-tracker.py after inventory/defect updates and check the generated views against the records.

The workspace rule forbids manually initiating build, version bump, release, deployment, and migration from this machine; ordinary pushes and automatic CI remain allowed. This overrides the repo's usual ./release.sh instruction here. Use an authorized hosted test path only if it satisfies the same resource and evidence contract. Finish and push the code/evidence unit, mark the native or release gate explicitly pending, and record the release owner/claim, current source and artifact, required gates, and exact next action in the durable defect/report record. Never present a source fix as shipped or wait for the root chat to wake. On a permitted machine, the release owner follows this repo's release path and Store release skill, checking for an already active/pending release before starting another; no parallel release or duplicate Store submission.

Shared main and handoff

This checkout has concurrent writers. Fetch at task boundaries and at least every 15 minutes of active work; reconcile remote main before every push and complete a green pushed checkpoint at least hourly. Commit one defect's verified unit with its ID using exact pathspecs. Preserve other writers' dirty paths and commits: no blanket staging, reset, force push, dirty-tree rebase/autostash, or discarded conflict side. Fast-forward when possible; if histories diverge, merge, resolve deliberately, retest affected behavior, and push. Commit/push evidence and outstanding-gate status even if the coordinator is paused. An unpushed local record is not a handoff.

Keep credentials at point of use, out of commands/logs/Git; remove only temporary secrets you own and verify absence after a hosted run. On interruption, record the exact job ID, credential cleanup state, and unknown terminal outcome before any retry. Do not message unrelated chats as a workaround for a missing coordinator; use the shared records and this task's authorized peer review or same-task agents.

Return at most 15 lines: task_id, lane, model, status, feature_ids, defect_ids, summary, changed_files, commit_shas, verification[{case_id, run_id, verdict, evidence}], limitations, open_questions, next_action. Report the current truth, including pending native/release gates and all owned jobs. For a straightforward test lane, two failed/unusable attempts or 15 minutes without usable evidence triggers one decomposition or a Sol escalation. For implementation, two failed repair/retest rounds, repeated regression, or 30 minutes without verified progress triggers fresh Sol decomposition or bounded Astra diagnosis. A third failed independent review requires a changed hypothesis or scope split. Do not create planner agents or treat a model escalation as verification.