[fejelude]

Summary

Fix source/detection failures that could leave analysis stuck, miss webpage updates, or inherit stale position metadata. Rebuild the checked-in extension as 1.2.1, with the existing manual board, editor, recognition strategies, artwork, Stockfish binaries, Manifest V3 CSP and production permissions preserved.

Bugs and fixes

• Publish the initial position on every explicit reconnect, even when unchanged. Invalidate old source state at navigation/reload start; reject obsolete heartbeat, capture and worker callbacks and unrelated window/frame events.
• Read board-host open shadow roots and monitor in-place shadow changes, new roots and board replacement. Keep every discovery strategy inside the selected region; validate FEN candidates, recognize bare SVGs and reject overlapping pieces or competing vertical boards.
• Bound mutation scheduling so continuous updates cannot starve detection. Deduplicate readable positions while preserving canvas/WebGL screenshot polling. Clean up input listeners, observers, selectors, timers and delayed scans on stop.
• Preserve explicit turn/rights/clocks during reconciliation. Restore manual validity when cancelling Edit during connection, initialize correction fields from a complete FEN, and persist confirmed piece-style templates.
• Add visual-worker timeouts and screenshot bounds checks. Reject captures when the tab/page changes; retain monitoring until the last bound controller disconnects.
• Recover from malformed/storage settings errors and normalize finite UCI limits. Update development tooling to Vitest 5.0.5 and Sharp 0.35.5 to resolve the audit findings; runtime dependency versions are unchanged.
• Derive archive names from the package version, normalize engine asset file modes, regenerate dist/checksums, and add GitHub Actions validation plus expanded browser scenarios.

The root-cause/verification table and remaining limits are in TESTING.md.

Verified locally

• Baseline: 62 tests and production build passed. Eight added regression cases failed against the original source before their fixes.
• 97 tests passed across 10 files, including the real React-to-packaged-Stockfish WASM integration test.
• Production build and TypeScript unused-symbol checks passed.
• Real WASM smoke checks passed: legal MultiPV, mate in one, cancellation and rapid position replacement.
• Vision smoke checks passed: 29/32 default-template labels with no confidently incorrect labels; confirmed templates identify all 32 pieces and 32 empty cells.
• npm audit --json: 0 vulnerabilities.
• Package/ZIP integrity, every SHA-256 checksum, unchanged engine binary hashes, production MV3 permissions and git diff --check passed.
• Uploaded Git tree exactly matches the tested local tree.

Browser limits / follow-up

A complete local Chrome extension pass is not claimed. The Playwright Chrome download returned an empty/truncated archive. A separately obtained Chromium headless-shell build launched but did not load the extension service worker (30-second timeout).

The expanded browser suite and CI workflow cover actual extension-page analysis, native drag/drop, source mutations, Shadow DOM, reload/navigation, selection cancellation, renderer fixtures and screenshot recognition on a full Chromium host. CI results should be reviewed before merging.

The harness uses a temporary test manifest with host access for localhost automation. Desktop verification is still needed for production toolbar-granted activeTab access, cross-origin revocation, native side-panel close/reopen, protected pages and file-URL opt-in. Arbitrary artwork, closed shadow roots, inaccessible frames and perspective boards remain recognition limits.

Open for review only; do not merge automatically.