Base SHA 71ba6b374c0b0181130c0cc3b3d5aaa3387ada67; native fingerprint ed36a9cc9856c84a322bb71e6d67744f0a00877d.
Head SHA bbb9042e92b21c2341a392677bbb9715468359d7; native fingerprint 0b110f6b762ef37e6f8d41fced4244ec904ac21a.
Both APKs installed through the official mobile-native-client workflow; real development clients, not Expo Go. Base Metro from base checkout on 8082; head Metro from head checkout on 8081.
The merged base manifest has usesCleartextTraffic=true, debuggable=true, and no networkSecurityConfig. Head has debuggable=true and networkSecurityConfig=@0x7f16000b. Resolved APK XML is base-config cleartextTrafficPermitted=true with certificates system and user. No debug-overrides element in the resolved policy. Plugin is included unconditionally and writes main source-set resource, with no build-variant branch. These are dev APK observations and source-policy parity, not a production-device capture.

f2c619ac816c354d22b9349dba6179a6a5239590c6de5abfdb65a385e69b14aa  /home/ubuntu/.cache/t3code/native-clients/artifacts/android/development-x86_64/ed36a9cc9856c84a322bb71e6d67744f0a00877d/app-debug.apk
2b800278578e610f6be9d9d3e108150036638db6468339d4eb8797f388c5f587  /home/ubuntu/.cache/t3code/native-clients/artifacts/android/development-x86_64/0b110f6b762ef37e6f8d41fced4244ec904ac21a/app-debug.apk

Resolved head resource:
E: network-security-config (line=2)
    E: base-config (line=3)
      A: cleartextTrafficPermitted=true
        E: trust-anchors (line=4)
            E: certificates (line=5)
              A: src="system" (Raw: "system")
            E: certificates (line=6)
              A: src="user" (Raw: "user")

Leaf:
subject=CN = fs-13.tail131df4.ts.net
issuer=CN = Android CA proof 25730
notBefore=Oct 28 00:14:52 2026 GMT
notAfter=Oct 30 00:14:52 2026 GMT
X509v3 Subject Alternative Name: 
    DNS:fs-13.tail131df4.ts.net, IP Address:100.122.65.41

Merged manifest network attributes, aapt2 output:
base:
        A: http://schemas.android.com/apk/res/android:debuggable(0x0101000f)=true
        A: http://schemas.android.com/apk/res/android:usesCleartextTraffic(0x010104ec)=true
head:
        A: http://schemas.android.com/apk/res/android:debuggable(0x0101000f)=true
        A: http://schemas.android.com/apk/res/android:usesCleartextTraffic(0x010104ec)=true
        A: http://schemas.android.com/apk/res/android:networkSecurityConfig(0x01010527)=@0x7f16000b