fix: harden ownership, model loading, and provenance handling f37ebd2 BitCheck Codex commited on May 14