[hideouts-io]

Summary

Make same-Mac before/after comparisons traceable to both parsed evidence and retained original input, while preserving the existing snapshot-history and optional explanation improvements in this draft.

• Check existing Hardware overview machine identifiers. Conflicts block comparison; missing usable common identifiers require explicit confirmation and leave a persistent Same Mac not verified warning. Matching metadata does not authenticate report contents. No additional identifiers are collected.
• Keep the change list visible alongside a baseline/current evidence inspector. Show value types, typed source addresses, reconstructed structured JSON, exact original UTF-8 token excerpts and byte ranges, with surrounding record context on demand. Missing fields, null, unavailable source, and source-resolution errors remain distinct.
• Capture owned source bytes in memory before decoding raw collection/import input or a full exported JSON file. Never reopen a source file during inspection. Original input and its capture identity are not added to stored exports, snapshots, caches, logs, or model requests. Older snapshots still provide structured evidence and explicitly show Original source unavailable.
• Keep ambiguous top-level and nested record groups unresolved instead of rejecting the whole comparison or guessing occurrence pairings. Expose original candidate addresses from both reports; exclude unresolved subtrees from confirmed totals while comparing independent findings. Exact indistinguishable duplicates remain unresolved.
• Show all detected confirmed differences by default, including potentially noisy values. Search and kind filters report visible, matching, total, and hidden-by-filter counts; unresolved groups remain accessible independently of filters.
• Retain the earlier explicit snapshot loading/failure/unreadable-history states and direct file picker. Refresh preserves the selected report and completed comparison; redacted snapshot baselines remain ineligible.
• Retain optional on-device plain-English guidance limited to maintained field context, corrected PDF emoji shaping, Camera identifier redaction, uninterpreted network values, invented compatibility fixtures, older-Intel procedure, and the Open Layers branding already present in this draft.

Dependency: this draft follow-on PR includes and depends on open PR #14. Resolve that review/integration relationship before merging. No merge, release, deployment, workflow, dependency, security-policy, or repository-settings change is included. Cross-Mac comparison, manual pairing, and persistent original-byte storage are deferred.

Current validation

Candidate: 8539747778f9d4740ca5e282bb9287f9b6992105 (implementation 3a0d707, followed by the native accessibility correction).

• Native Xcode 27.1/build 27A9275 arm64 build test: 303 total, 301 passed, 2 intentional skips, 0 failures, 0 xcresult runtime warnings.
• Framework-free x86_64 build test with SYSTEM_PROFILER_WITHOUT_ON_DEVICE_MODEL: 302 total, 300 passed, 2 intentional skips, 0 failures, 0 runtime warnings. Executed through Rosetta on Apple silicon, not physical Intel hardware.
• Focused import, file-loading, comparison and evidence suites: 72 passed, no skips or failures.
• Synthetic real file tests cover exact source offsets/formatting/escapes/Unicode, raw and exported envelopes, literal typed keys, absent source after stored-report/snapshot round trips, duplicate-key ambiguity, source/value mismatch and invalid addresses. A POSIX shared mapping verifies the backing file really changes while both loaded reports retain the original bytes; this replaces an invalid assumption that Foundation's mapping option always produces a mutable alias.
• Matching/identity cases cover missing, malformed, placeholder and conflicting metadata, repeated overviews, peripheral identifiers, original addresses after reordering, unresolved duplicate multiplicity, independent sibling/parent differences and 10,000-record cases.
• Native stable-ID/keyboard smoke imported invented reports: 0 added, 0 removed, 3 changed, 1 unresolved group. Both structured and original escaped strings were visible side by side. Search narrowed 3 changes to 1 with 2 explicitly hidden, without hiding the unresolved group. Missing-identity Cancel published no results; selecting the pair again required confirmation; affirmative confirmation retained the warning; an actually selected conflicting fixture produced a blocking error.
• Independent read-only final review found no actionable correctness, security or privacy defects and no specification discrepancy. No assertions or gates were weakened.
• Final native follow-up corrected disclosure identifier propagation: context and candidate toggles have dedicated IDs, structured/original paging IDs include their typed address, and summary containers no longer swallow the persistent warning's identifier. Native expansion verified original surrounding-record and unresolved-candidate evidence with distinct paging controls. A scoped independent follow-up review found no actionable issues; final normal/framework-free suites were rerun after the two summary-containment changes.
• Publication-boundary check, complete staged-diff/privacy review, git diff --check, project plist validation, and branding npm run check passed.

Both local skips are intentional: the installed-model test requires opt-in, and the optional private-report performance fixture was not supplied. Xcode 27.1 emits the existing FoundationModels initializer deprecation warning; this follow-up does not change that Xcode-26-compatible initializer. No model generation or distribution packaging was rerun.

Fresh push CI and PR CI passed at this candidate on Xcode 26.4.1/build 17E202. Each ran 303 total tests with 2 intentional skips and 0 failures. PR CI tested merge abb61524431cc446316ac8b5a0456c84430bdbdb, whose parents are this head and main at eba926097f4bd3bccbab974a693d11f4772bde6b.

The current three-language CodeQL run passed all analyses, all processed uploads and the aggregate gate. Code Scanning API analyses 1993056160 (Swift), 1993056307 (JavaScript/TypeScript) and 1993056227 (Actions) are bound to PR test merge abb61524431cc446316ac8b5a0456c84430bdbdb, each with zero query results and an empty processing error. Downloaded current-run SARIF reports successful execution; Actions and JavaScript/TypeScript have no extraction-error notification category. The earlier 3a0d707 run was superseded/canceled and is not this candidate's evidence.

Swift extraction remains limited, not repaired: inspection of every execution/configuration notification level found 112 extraction diagnostics, all level: none: 54 SDK compiler-branch mismatches, 54 failed precompiled SDK module emissions, 3 Swift module-compiler mismatches and 1 accessibility ambiguity. Located successful-extraction entries exactly match all 107 Git-tracked Swift files, including the new source-retention parser; nine further success notices have no location. This does not establish complete imported-module semantics or absence of vulnerabilities. CLI version is 2.27.2; PR file-coverage metrics are unavailable under the Action's default policy. The separate PR #17 extraction/toolchain investigation remains the appropriate boundary. No query, diagnostic, gate, source exclusion, or workflow permission is weakened here.

Remaining validation boundaries

• Native screenshot capture returned a distorted thumbnail; full-resolution layout review is not claimed. Spoken VoiceOver and physical older-Intel/macOS 13–15 runtime remain unverified.
• Source-less stored reports are covered by integration tests; their unavailable label was not exercised in an isolated native snapshot account. Shared-account snapshots were not modified.
• Formatting-only report replacement during active asynchronous preparation, cancellation during an active long source walk, UTF-32/BOM-less encoding and exact nesting-limit boundaries were not directly exercised. Source identity, stale-result guards, pre-cancellation and UTF-16 failure behavior are tested/reviewed, but do not substitute for those interleavings and boundaries.
• Large-source performance, additional actual model-availability states, Gatekeeper distribution approval, Developer ID signing and notarization remain outside verified scope.

Privacy and publication review

• Only reviewed application source, tests, four project-registration lines, and current README behavior are committed.
• No real profiler report, private snapshot, actual identifier, installed-software inventory, host path, private log, screenshot, build cache, or local test artifact is included.
• Native checks used invented data; source bytes remain local session state and collection remains read-only.
• Merging, release/deployment/publication, settings and device operations still require separate authorization.