[ATLKR]

Scope

Adds genuine HWPX editing/saving to the pinned HOP Windows app, both HWP/HWPX Save As formats, native staged writes with revision/external-change validation, and preservation of edits made during asynchronous saves. Existing HWP persistence is retained. This is not a filename-only conversion.

Required release gates

Standard runners only: two Windows native UI environments (14 scenarios each), Chromium/Firefox/WebKit (8 scenarios each), and ephemeral test-sign/install/association/uninstall validation of a COPY of the unsigned MSIX. Independent ZIP/XML validation, bounded evidence, and no skipped required tests or automatic flaky retries. PRs do not publish. No fonts, private documents, signing keys or app test backdoors are shipped.

Repairs made during actual verification

• Isolate native editor and standalone Skia CLI Cargo target directories; create fixtures against the tested debug graph, avoiding the observed skparagraph.lib relink collision.
• Preserve inherited namespace declarations on detached HWPX header fragments, including numbering, bullets, memo properties and document-option tail. Rebuild WASM from the same patched source used natively, retaining original provenance and verifying source/artifact hashes.
• Preserve final composition text through the original input path; no Firefox-specific bypass or synthetic test-only editor API.
• Select real Windows file dialogs by HWND/PID, enter filenames in the visible filename control, and activate the real buttons. Resolve native TaskDialog message text through its verified HWND rather than pretending it is a JavaScript alert.
• For elevated hosts on disposable GitHub-hosted runners only, use documented, temporary, exact-OpenGeul.exe WebView2 debugging overrides. Refuse pre-existing values and clean up owned values on exit; no wildcard, runtime downgrade or disabled sandbox.
• Wait for observable editor readiness and real new-page events rather than suppressing timing failures with retries.

Current evidence and limits

Final candidate: c9094979e86ffeab5b5db1e38fd47e2a0c76ae43.
Full required run: https://github.com/ATLKR/OpenGeul/actions/runs/37391332552 . Policy run 37391331550 passed. The source-built WASM and all three browser E2E jobs have passed; the final Windows build/native/install gates are still running at this checkpoint. This remains a draft and must not be merged until the complete required run succeeds.

The isolated native harness probe 37391088827 passed all 14 scenarios on BOTH windows-2022 and windows-2025, including actual HWPX editing/saving, HWP conversion, cancellation, multi-window behavior and corrupt-file recovery. That probe reuses the previous candidate binary and verifies harness repairs only; it is NOT substituted for final-candidate package/E2E evidence.

Local Python policy/automation unit suite: 51 passed. Node save-format/composition suite: 22 passed. Earlier native/frontend regression results and limitations remain in the repair ledger. HWPX XML validation has not been weakened, failing input has not been normalized away, and all 52 required UI executions remain enabled.

Remaining product limits

Real OS IME composition, real printers, complex third-party documents, all font-license rights, trusted distribution signing and Microsoft Store certification are not established by these automated tests. Autosave/recovery and LibreOffice are not included. OpenGeul-owned changes remain MIT with upstream notices preserved. HOP keyboard/toolbar follow-ups are isolated in #2.

[gitnotebooks]

Review these changes at https://app.gitnotebooks.com/ATLKR/OpenGeul/pull/1

[ATLKR]

Continuation checkpoint (candidate 86a62d99ce064d5649f543ebc9c26da64900184e):

• Brought the real composition-finalization fix (4bdbd34) into this PR. This is production input handling, not a Firefox-only test bypass.
• Diagnosed Windows 2025 with the exact previous packaged executable: WebView2 153 starts normally but, in an elevated host, ignores environment debugging overrides. Microsoft's WebView2 security documentation specifies the app-specific HKLM path for this case. The harness now uses only the OpenGeul.exe values on disposable GitHub-hosted runners, refuses existing values, binds loopback, and removes its values in cleanup. No wildcard, runtime downgrade, sandbox disabling, test IPC or production setting is added.
• Diagnosed real native file dialogs: Win32 HWND/PID lookup sees the shell dialogs where UIA did not. Visible controls and physical input successfully cancel/save the real dialog on the 2025 image. Window creation now waits for a Playwright page event instead of blocking event delivery with sleep.
• Added 9 cleanup/scope tests and 4 native-control selection tests. Local Python suite: 51 passed; composition helper: 8 passed with the Node 22 type-stripping flag. The Actions build uses Node 24.

Full required candidate checks: https://github.com/ATLKR/OpenGeul/actions/runs/37389896622 . These are still running; the PR remains draft. The isolated native probe reuses the prior executable to validate the harness only and is not counted as candidate release evidence. All original 52 UI executions and MSIX installation checks remain required.