[ymote]

A Splash tool that forwards a native host.request response unchanged can fail with invalid_result: unknown JSON key: Makepad created is_ok, data and error LiveIds without registering their string names. Explicit field reconstruction happened to intern those names, hiding the failure. Register the six static envelope keys at creation, including immediate capability refusals; leave the bounded JSON converter unchanged.

Add a fresh-process regression for success, native error and capability refusal, plus a reproducible signed Android fixture that forwards complete Wasm responses. The OnePlus 6 passed 22/22 checks from clean source e67ce63ebca6054961899691e1644a54c2b4f081, runtime tree 0fc8e29e2411fd7eb94d845ba16a261d2ebc9dfc; the checked-in receipt includes APK and source hashes. Its guest intentionally retains input if reused, so the checks also exercise fresh instances after success, guest error, trap and deadline through real app-tool dispatch. No personal account or model was used; the isolated package was stopped afterward.

Validation:

• Six Makepad splash_host tests passed, including the fresh-child success/error/refusal test and existing cyclic/oversized JSON protections.
• Actual OnePlus 6 Android 15: 22/22, including compiled source/runtime identity, raw response forwarding, account/tool/schema refusals and closed endpoint refusal.
• Runtime graph, native-app mapping, 29 CI mapping tests, privacy guard and whitespace checks passed.
• Android release-profile test APK build passed. Live model/peer relay, performance and release APK behavior remain unverified.

This PR is stacked on #367 so its exact-head local CI remains unchanged. Earlier 19/19 explicit-field evidence did not validate raw forwarding; the repaired private run passed 20/20, and the public reproducible harness adds two compiled-identity checks. The receipt-only follow-up commit preserves the exact compiled source revision.

Listing-image follow-up: replaced the unrelated permission-lab screenshot with an actual hidden native macOS capture after this fixture’s signed Wasm tool completed (source d3535a95). The fixture digest was refreshed and unsigned development admission passed. This later image-only revision does not alter or extend the original OnePlus receipt.

[ymote]

Implemented on main through #370, merged as 28e2ac11401621cad3d6a77e6ecab17024b72c8f. The five commits were integrated into the combined host: four have identical stable patch IDs; the raw-response commit differs only in runtime-patch lock context and the combined tree hash needed to retain the desktop browser patch. Its executable patch and acceptance changes are preserved. Closing the stacked PR as incorporated.

The final 933abbcf runtime passed all 44 required local CI steps, exact-head Windows browser acceptance, and isolated OnePlus publisher/L0 regression checks. The RC tag exists; release assets are still building.