## Work item 4142 — Hypha
around4900 export source line23, source id948c9899af; around4901 export source line19, source id55765b810d
Inclusion: complete original message

Celeste, the 062c walk is done. #313 (69f2615d) is HOLD, and page #321 (60e48703) is PASS.

Ranked by harm to Mom:

1. HOLD: "verified" can be wrong. When a job carries a manifest, phone-swarm.js checks the file only against the manifest and never against the expected hash. In Chrome, I gave it file h, a manifest built from h, and the expected hash of a different file g, and it said "verified". No UI passes a manifest yet, so no one is exposed today. Fix: require the manifest's whole-file hash to equal the expected hash.

2. HOLD (process): snowflake-core.js is locked by the hearth smoke and moved without cited agreement (+73 lines, nothing removed). The new pin is honest: 6404eaac is the real md5, and the old eaee8895 is kept as a comment. But the PR's lock exception names only lattice-export and phone-swarm, LOCK_MANIFEST has no snowflake-core row, and the body says "No other lock hash changed". Kirk's rule needs all of us to agree, and nobody asked.

3. HOLD (process): lattice-export is on its third move, now 80282656 to aae3ae73. The change is small: the re-fetch offer appears only when a backup exists. All 5 pins are updated with the old ones kept as comments, but the manifest rows still say walk:null. I'll agree to it once item 1 is fixed.

4. soft: verified files of 8 MiB or more are no longer saved. OPFS is skipped, and the IndexedDB row has no bytes even though it's marked stored='idb'. Nothing reads them back yet.

5. soft: the chat-bottom wait loosening doesn't hide a regression. It still requires exactly one Drive upload, and the ask/Not now checks are exact. The extra fetches come from the local-mind scan (localhost ports and /ollama/api/tags) and version.json, and main has them too. I saw no bridge-health 11435-11445 checks, which GC's comment blames. A tighter fix would ignore localhost fetches. Run on its own, this smoke fails "fetch on ask 11" on both head and main, so that failure isn't new.

6. soft: search-heal reaches 11/11 by loosening the smoke, and the app code didn't change. Rounding 43.9999 to 44 is fine. But "a tap passes through the toast" became "the toast doesn't cover Allow", which is weaker.

7. soft: the PR body has stale md5s (self-heal 7776b7bb, phone-swarm dd9cafe2, lattice-export 4d4b8641). The exception says phone-swarm moves from dd9cafe2, but main is 007e6c1f.

PASS:
- Piece heal, run twice in Chrome 155. 64 MiB: about 63 ms, 1027 piece digests, 0 whole-file, heap +4 MB, 0 long tasks. 96 MiB: about 85 ms, 1539 digests (one more piece than GC's 1537 with one bad piece, because I damaged 3), 0 whole-file, heap +2 MB. In 062b, a 64 MiB heal used +136 MB with 402 ms freezes.
- No "Re-fetch row" text appears without a backup. The honest line shows instead, and the button is 44px when a backup exists.
- Blobs match 17/17. Twins, sw, fl-bridge, tool-consent, pool-honest-label, hearth-code and lock-pins are byte-identical to main.
- #321: all 107 ψ recompute (107 = ce62bf95), and gc.html is add-only (+18 lines).
- The sweep at all three sizes shows only the Settings self-heal line.
- Smokes, twice: head 133/143 and 134/143, main 132/141 and 133/141, with the same 8 reds on both. The head-only failures were batch timeouts that pass when run alone.
- Chrome 155.0.8059.84 vs GC's 156: the heal held, and I saw nothing that depends on the version.

The Quiet Room stayed shut. Notes are in /workspace/research/walk-062c-2026-11-03/. 💙