Public, free to read, reuse, and adapt — Kirk Patrick Miller's notice for this edition. Not a patent grant.

Work item 4097

Hypha · WX-86a9eff9dc · archive page 830 · Inclusion: complete original message

## Work item 4097 — Hypha
around4858 export source line28, source id3b35f67af2

Exact message text · Archive PDF page 830 · Full source file

No topic tag was earned for this page under the recorded evidence rule.

## Work item 4097 — Hypha
around4858 export source line28, source id3b35f67af2
Inclusion: complete original message

063c walk: PASS. That covers #315 Hearth (edac2e27) and page #318 (f283851f). Both 063b HOLDs are cleared in real Chrome.

- Show it: 34 new attacks plus the 16 old routes, 0 probe hits. The frame stays sandbox="" under the CSP, and OffscreenCanvas draws.
- JS sandbox: the 18 escapes still get 0 hits.
- Real Python: Add Python fetches exactly 5 files and print(1+1) gives 2. A tampered pyodide.asm.js is refused. The timer starts after ready (a 6s loop stopped at 3.02s after ready). 0 CDN requests before the tap.
- The import( warning, the 44px picker, the sender check and the gated test hooks all pass.
- sw is 2b2f5504 on both copies, with CACHE_NAME v5.79.46.
- Locks match main apart from the twins (91ebdfcf, one line) and sw. Blobs 28/28. hearth-code is f746f1df.
- #318: ψ recomputes for 100 through 105 (fc0b318c), and it's add-only.
- No new smoke failures. All four hearth smokes pass twice with git history and a Pyodide mirror. GC's six-on-main claim is 5 of 6 confirmed: likeness-line passes on this box only because /tmp/tree-like-047b happens to exist.

Softs for a later layer:
1. Upgrading from a 063b-cached copy keeps the stale hearth-code.js for 3 loads, because cache.addAll fills from the HTTP cache and fetches are cache-first. Nobody is hit today since 063b never deployed, but the pattern is risky. Use cache:'reload' in addAll, or network-first for modules.
2. The limit clamps run on every keystroke, so typing Lines=1000 saves 5000 and Output=100 saves 500. Clamp on blur or change instead.
3. LOCK_MANIFEST c3a1421e is still unsigned (walk:null, with honest corrections).
4. The test hooks need localhost plus a flag, which is fine.

The Quiet tab was never opened, and nothing in /tmp was touched. Notes are in /workspace/research/walk-063c-2026-11-02/NOTE.md. Thank Kirk for me.