[ZhangHanDong]

Owner approvals could remain plain messages, expose inconsistent controls across cached room panes, or open at an old scroll position. This PR adds a shared canonical approval model, authenticated owner-room discovery, one-time verdict handling, and navigation to the latest approval while ordinary room selection preserves reading position.

It also includes the Studio E2E driver and its transport deadlines and strict widget path selectors, the room-action ownership and escaped message-preview fixes, Makepad compatibility updates, and room Info focus and pointer capture fixes.

Integration target: main. This branch includes all commits from #333, #334 and #335 and incorporates the fixes from #331 and #332; these Robrix PRs do not need to merge first. The complete change relative to main is reviewed here. It pins the tested Makepad source from #10 (including #8/#9); Makepad #11 has merged the remaining fixes directly into dev. It pairs with HAgency #160. External dependency PRs have their own merge and validation status.

The main-target CI exposed a spec-guard composition bug: each changed task contract received the entire integration diff and rejected files owned by other contracts. The guard now assigns every file to all matching active contracts, rejects uncovered paths and explicit denies, and still runs native boundary verification plus unchanged-contract regressions. Structured JSON handling also prevents a broken diagnostic pipe from aborting later checks. Existing task boundaries, test bindings and manual-skip policy are unchanged. The previous nonblocking uncertainty policy for unchanged regression contracts is also preserved, but those scenarios now print UNVERIFIED with counts and diagnostics; active-contract uncertainty blocks the gate.

Validation:

• cargo test --release --locked --lib from this publication checkout: 749 passed, 0 failed, 4 ignored. Source files were unchanged across the run.
• Final executable built with the locked Makepad pin. Product files in this checkout were compared byte-for-byte with the GUI-tested source.
• Local Docker Palpo + Studio + Computer Use checks covered native approve/deny and consumed status, expiry through a bridge restart, private approval navigation, jumping through tall messages, manual-scroll interruption, ordinary room position retention, and the final Info focus/modal pointer regressions. Results were checked against backend state or actual window content.
• Studio driver, transport and path-selector tests and task-contract parsing/lint checks passed. Manual UI scenarios remain incomplete; full product E2E acceptance is not claimed.
• CI guard regressions: nine subprocess cases passed; two Cargo integration tests passed, including generated shared-ownership cases. Ten path-matching cases agreed with the installed native agent-spec verifier.
• Current head 2c523dd7 changes only the guard, its tests and its new task contract. Final-head Cargo guard tests passed in a clean ordinary Git checkout, and the new native task contract passed all 7 verification items. All 13 final-head CI checks passed, including Clippy, the full spec gate, and all configured desktop/mobile builds. CI run, build matrix.
• Final Linux workspace tests: 806 passed, 0 failed, 5 ignored. Task-spec verification reports 297 passed, 0 failed, 285 skipped, 5 uncertain across 57 contracts; passing CI under the existing policy does not turn skipped/uncertain scenarios into passes. The earlier local gate exit 1 remains retained as an unsuccessful run.

Five historical Octos mention-gating scenarios bind octos-bus, which is outside this Cargo workspace. They remain UNVERIFIED, not passing or replaced by placeholder tests. The spec already documents separate Octos validation; this PR does not claim current verification in that repository. Other skipped scenarios also remain explicitly unverified.

Remaining E2E limitations: the latest full three-layer native task stopped at a Codex provider usage limit and has no verified lower-agent task result. Search and invitation modals did not dismiss themselves on Escape during the focused check, although they no longer close Info underneath. Mobile-device behavior and the full manual compatibility matrix remain unverified. These limitations are not counted as passing checks.