[yummybomb]

Summary

• Add public flight status with snake_case schemas and bounded same-origin output.
• Extend existing cash flight search with opt-in award miles and displayed taxes; preserve login.
• Add current-page cabin fare/loaded-calendar exploration and exact-option, no-write itinerary previews.
• Reject malformed numeric grouping instead of silently converting displayed fare or tax amounts.
• No fare selection, booking, hold, cancellation, check-in, seat, payment or account execution. Preview IDs are not approval; execution is unavailable.
• Populated trip reads omitted because populated schemas and target verification were not observed.

Validation

• Registry validator passes. Full Node suite: 4,536 pass (aa.com: 125); extension suite: 14 pass; Go tests pass.
• Independent final-source QA signed off on de4079e after one parser fix/recheck. Later commit changes README/registry only; all source/tests remain identical.
• Independent adversarial quote/calendar/status checks, schema validation and safety mutants passed. get_flight_status is verified. search_flights, get_fare_options and prepare_itinerary are draft: their source changed after that QA (see below) and needs fresh independent QA.

Runtime evidence and limits

• Final-source Kernel: flight status succeeded; all five tools discovered after atomic namespace replacement. Cash search returned blocked after one submission; fare/preview blocked and malformed-input refusals passed. No fare-selection clicks or consequential actions.
• Final-source local extension: all five source hashes matched, namespace discovery and blocked/malformed/confirmation refusals passed. Access Denied prevented successful flows; no search was invoked.
• Earlier public Kernel cash/award searches, cabin/calendar reads and previews succeeded before the parser fix. Those successes are not substituted for final-source verification. No successful runtime parity is claimed.
• Current outbound rendered page only; adults only; no return selection, committed fare product or party total; calendar only includes loaded dates.
• No merges. Live QA resources cleaned up. Detailed per-tool evidence and remaining gaps are in the registry notes.

Review fixes

• K award mileages are computed from their digits. Before, 16.1K, 32.2K and 64.4K multiplied to non-integers (16.1 × 1000 = 16100.000000000002), and every award read containing one failed (site_changed in get_fare_options/prepare_itinerary, error in search_flights).
• get_fare_options and prepare_itinerary inline the shared page model from lib/aa-choose-flights.js instead of copying it.
• A loaded calendar date shown without a price has amount: null instead of failing the whole read; a malformed price still fails closed.
• search_flights includes its own row-format reason in its error message, never site or browser text.
• New regression tests; the float test fails on the previous source.