[Mjones13]

The bottom-right update control now reviews an immutable qualified Jones Code build before Download. It retains up to five qualified choices, rechecks the exact artifact identity before native selection and plan admission, and requires a new review after identity or eligibility drift. Providers-only stays usable for an empty/unavailable catalog and creates or advances no Jones plan; both confirmation choices share the duplicate-dispatch latch. Staged Install remains a separate reviewed action.

This is the successor for the accepted picker portion of #872 and historic #879, whose original branch, PR and head 8ab36a82c167ec44ef7040839ca8f0a21ac117ea remain untouched. All 11 original commits, including PICKER-01 17b834976bd27d4191e5176cb68ea9377bb89e53, remain ancestors. PICKER-02 remains deferred.

Normally merged the preserved picker with the agreed sync source, then receiving main after #929 merged: final sync head fa5606de5b54341371b4928a8b536c24aa49d798, sync merge 2a20eb152a2603381e70f651f64ad0ee9a06baf3. Frozen local qualification base: e2d9956c36a667f6a5359e5ad414e38b2453e36f. Qualified source head: 3250bc8dcc4caaf723b32ffdedaebe2e054b254d, tree 577923396ee48174701e966e59b003d162de31b6. No rebase or history rewrite. All 25 picker added/removed-line deltas survived receiving-main integration unchanged; current sync/provider refresh, client notices, protected state, status/refusal/date behavior and optional bridge compatibility are retained.

Added direct native provenance/drift coverage, catalog wire-bound coverage, and a renderer test through the real bulk handoff for alternate selection, repeat/combined/providers clicks, providers-only, empty/unavailable catalogs, stale identity and lost eligibility. Boundary records retain the new seams.

Validation on the exact committed file contents (one serial qualification process, frozen lockfile):

• 485 tests passed in 16 focused Vitest files; 70 qualification-agent Node tests and 2 owned-scratch lifecycle tests passed.
• All 37 affected package typechecks passed.
• All 7 changed-source React Compiler cases passed; 1,651 unrelated cases were filtered out by the explicit changed-file selector.
• Changed-file format/lint, strict Jones boundary and scoped Knip passed. Existing lint warnings remain. The normal unmodified commit hook additionally ran and passed its full Knip gate; it left checked source bytes unchanged.
• Initial new-fixture format/lint/type and duplicate-boundary issues were corrected; final reruns passed. The initial long scratch path failed the existing nested supervisor socket limit, then passed with a short task-owned disk scratch path. No lockfile, hook, sandbox policy or test assertion was weakened.

Independent code review, visual review, successor current-head CI, source-bound hosted/Native Preview before/after captures, and actual packaged/native arm64 artifact/handler qualification are pending with the continuity owner. No application fixture build/dev server or Native Preview run was started in this stage; Node coverage used only its owned synthetic fixtures. No installed-success, production/runtime proof, issue #872 completion, release or deployment is claimed. No CI watching or receiving-main merge is performed by this lane.

Contributors and continuity: historic picker commits authored by Malcolm Jones; source composition and focused coverage by the Codex implementation continuation (Sol/high/default, explicit Blended Frontier Max), thread mcp:launch:03d1824dd7b8cb174fb4d1d24927b810765349b24013affb0d2a08da36733d56; sync source owned by Jace Claude, thread 183ea91a-c246-44bb-8fd2-798fc740bdd3; parent continuity thread 6b0f3bc6-e53e-4f0f-ab10-bd7166439e46. No child agents were used.

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}