# Android user-CA native evidence — refreshed 2026-10-27

Base: `9bc0c334383a43af5390283e9b10f999acc021b8`.
Head: `853aceb5a1390badfe165d72266ce178bfee1886`.
Branch: `fix/issue-5639`; checkout `/home/ubuntu/wt/issue-5639`.
Fresh capture pass approximately 01:35–02:12 UTC, within the 120-minute budget. Earlier R0 captures were retained and re-inspected. Evidence-only pass: clean tracked worktree, no code edits, subagents, forge operations, pushes, or PR.

## Result

**The core private-user-CA fix is observed in the head native app.** HTTPS discovery and pairing succeed; WSS upgrades with 101; a provider status refresh receives fresh responses; disabling/re-enabling reconnects and another refresh succeeds. The same endpoint fails in the base app despite Chrome trusting it.

The packaged native gate passes. System-CA HTTPS/WSS and cleartext HTTP/WS also pass. With the private CA absent, fresh discovery/pairing and retained reconnect reject the chain. **Independent WSS TLS rejection without that CA remains UNVERIFIED:** the supported app flow fails its HTTPS descriptor preflight before it can attempt a WS upgrade. No bypass route was found; this is the “if reachable” limit of R2, not a claim of a directly observed WSS handshake failure.

## Environment and native identity

Pixel 9, Android API 36, portrait 1080×2424, light appearance, Android font_scale 1.0 (AgentDevice category large), session `issue-5639`. R0 was retained from an earlier Pixel 9 lease. R1–R3 were captured on the re-leased same named Pixel model after reinstalling the same test root; Simlock later ended that lease. Session naming is not a claim of one uninterrupted physical-device lease. The replacement Pixel 9 lease uses the same session and the exact cached head client. It has no private user root installed. No rendering paths changed, so no arbitrary viewport/theme matrix or pixel-diff assertion is appropriate. The labeled comparison shows state and behavior, not a visual-design change.

Head fingerprint: `e9cabfd8aa6930799024d4e47fefcd0c8220fc7d`.
Head APK SHA-256: `643269934f0ae53037e5fcb094303b67cb121034a4262916a941dc7695c1dcd7`.
Base fingerprint: `ed36a9cc9856c84a322bb71e6d67744f0a00877d`.
Base APK SHA-256: `f2c619ac816c354d22b9349dba6179a6a5239590c6de5abfdb65a385e69b14aa`.

The head build succeeded (16m48s, 1017 tasks). Its former infrastructure blocker is resolved. Packaged manifest inspection finds usesCleartextTraffic=true and networkSecurityConfig=@0x7f16000b; packaged res/xml/network_security_config.xml contains base-config cleartextTrafficPermitted=true and trust anchors system + user. The base manifest has no networkSecurityConfig reference. [Reviewed artifact inspection and native identity](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e1cdd1d4b2cea653/native-artifact-evidence.txt).

The installed package is com.t3tools.t3code.dev. Initial installation was confirmed in the handoff. Replacement installation again reported the exact fingerprint, source local, installed in 50s without rebuilding. This is a debug development client; no separate release artifact or iOS result is claimed.

All fixture origins use fs-24.tail131df4.ts.net and forward to the same isolated real backend on 15135: private CA HTTPS/WSS 18443; Let’s Encrypt/system CA HTTPS/WSS 18444; cleartext HTTP/WS 18080. Metro 8081 was reused. Private root: T3 Issue 5639 Test CA, SHA-256 `CA:41:95:BF:09:4D:6F:E0:72:6A:AB:11:BB:78:A7:6E:03:2A:E2:E5:B9:B8:31:CA:7F:15:5F:41:2C:1C:6C:4D`. Public chain was issued by Let’s Encrypt YE1 for the fixture hostname. No trust bypass was used.

## Matrix

| Row | Observed result | Selected public evidence |
| --- | --- | --- |
| R0 base, private CA installed | Chrome reads HTTPS descriptor; base T3 rejects discovery with Transport error. Retry yields CERTIFICATE_UNKNOWN. | [Chrome + base failure (50.36s)](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/618f12314c62b244/r0-before.mp4); [Observed TLS retry (1.54s)](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/73006b9ab9ea9cd6/r0-retry-observed.mp4) |
| R1 head, private CA installed | HTTPS discovery/pairing, authenticated WSS 101 + bidirectional frames, fresh provider read, off/on reconnect and fresh read pass. | [Pairing, redacted (60.12s)](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/556bd9cbd5b06f6f/r1-private-ca-pairing.mp4); [Read + reconnect (20.22s)](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ac26d331aded5816/r1-read-reconnect.mp4); [Connected + refreshed still](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/280465b4493b81ad/r1-after-still.png); [Installed user root](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4044a67e46fa6cee/head-user-ca.png) |
| R2 head, private CA absent | Fresh discovery rejects; fresh valid-code route rejects at discovery; retained connection after root removal and process restart cannot reconnect. Proxy records CERTIFICATE_UNKNOWN. Independent WSS handshake UNVERIFIED / unreachable after preflight failure. | [Root removal + process restart + failed reconnect (116.81s)](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1951203e427a33cb/r2-ca-removal-reconnect.mp4); [Empty user trust store](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/81e800f7a25135f3/r2-no-user-ca.png); [Fresh valid-code attempt, redacted (21.50s)](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2531b290160ea82d/r2-fresh-pairing-redacted.mp4); [Visible discovery retry (25.09s)](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2fbc409ccee4d710/r2-discovery-visible.mp4); [Legible rejection still](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/68d832404066f003/r2-discovery-rejected.png) |
| R3 head, system CA, private user root absent | HTTPS discovery and pairing pass; WSS 101 and fresh reads pass. Final read uses only the public-CA route, eliminating fallback ambiguity. | [System-CA pairing, redacted (39.40s)](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f48c78c28867f34a/r3-system-ca-pairing.mp4); [Isolated WSS read (11.29s)](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/56cd596082cf91e1/r3-read-complete.mp4); [System route + refreshed still](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/78f331791ff17247/r3-isolated-system-ca.png) |
| R4 head, HTTP/WS | HTTP discovery, pairing, WS 101, fresh provider refresh pass on a replacement fresh client with only the HTTP route. | [HTTP pairing, redacted (30.88s)](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0a13db81ac424733/r4-http-pairing.mp4); [WS fresh read (19.86s)](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9a4368c1067c07c7/r4-http-read.mp4); [HTTP-only route + refreshed still](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d9822826567101d5/r4-cleartext.png) |

## Narrated timeline and transport correlation

All times UTC on 2026-10-27. Socket IDs are local to a proxy run and restart at 02:00:03; always use timestamp plus ID.

- **R0, 00:50–00:53:** the 50s baseline video switches from T3 failure to Chrome’s successful descriptor response and back to a failed T3 retry. 123456 is an intentionally invalid placeholder; failure is before code redemption. The separate observed retry correlates with the TLS alert at 00:52:52.073. Android’s encoder retained only 1.54s for that mostly unchanged retry window.
- **Native gate, about 01:37:** aapt inspects the actual packaged head APK, not generated source alone.
- **R1, 01:39–01:43:** restore root through Chrome download and Settings certificate installer; long-press file then Select; verify it under Trusted credentials > User. At 01:41:37.819 discovery reaches the proxy; POST /oauth/token succeeds, then socket 7 upgrades to WSS 101 at 01:41:39.938. App reports Connected. The first provider refresh encounters a transient SocketReadError; a later refresh succeeds and is explicitly captured. Socket 15 is upgraded at 01:42:22.910; the successful 01:42:41.394 refresh sends a request and receives large response frames. The read/reconnect clip shows refresh, Off, Connecting, Connected. Socket 23 upgrades at 01:42:57.885 and receives fresh responses at 01:43:01–02 after the second refresh. The selected pairing clip stops before the transient refresh; the transient remains disclosed here.
- **R2, 01:43–01:45:** recording shows the root identity/fingerprint, Uninstall, confirmation, empty User tab, full app process relaunch, then failed retained reconnect. First post-removal certificate alerts begin 01:44:27.425; no new WSS upgrade follows. Fresh valid-code attempt at 01:45:26 is also rejected during descriptor TLS. At 02:03:26.657 the replacement clean client repeats visible discovery rejection against the same reachable private fixture. Its visible placeholder is deliberately invalid; the separately recorded valid-code attempt establishes that this is not merely a bad-code response. The 02:03 screenshot is stable and legible, without modal transition overlays.
- **R3, 01:45–01:47:** system fixture GET descriptor and POST /oauth/token both return 200 at 01:45:58; socket 34 upgrades WSS 101 at 01:46:00.400 and exchanges live data. Refresh succeeds. **Final isolated read 02:05–02:06:** on replacement lease, register system route, remove HTTP alternate, connect using system-only route; socket 28 upgrades 101 at 02:05:18.744. Refresh request at 02:06:48.844 receives response frames; the final clip shows refreshed status and a small scroll after completion, ensuring the encoder includes the completed state.
- **R4, first attempt 01:47–01:50:** HTTP/WS establishes but later falls back to saved public route; not used as the final isolated read proof. **Final isolated attempt 02:01–02:02:** on fresh replacement client, manual retry of fresh code after proxy recovery yields HTTP descriptor 200, /oauth/token 200 at 02:01:50.855, WS socket 7 upgrade 101 at 02:01:52.764. Refresh request at 02:02:09.046 receives fresh frames (12675, 9067, 9323 bytes). Full-screen read clip and still show the sole HTTP route In use and Provider status refreshed.

The only supported pairing paths inspected share preparePairingRegistration, which fetches discovery before redemption (packages/client-runtime/src/connection/onboarding.ts). Retained connection preparation also fetches the descriptor (connection/resolver.ts and driver.ts). No UI/manual/deep-link path bypasses TLS discovery, so R2 cannot separately reach a WSS handshake with the root absent. No thread or provider turn was started; Refresh providers is the harmless observed request.

## Visible before/after

![Before: base rejects the installed user CA. After: head connects to the same private-CA endpoint and refreshes provider status.](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/72a6e48c31eb23c6/before-after-private-ca.png)

## Evidence hygiene and drivers

[Capture, redaction, and interpretation notes](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3169a67e505850f2/evidence-drivers.md); [Exact observer driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6d31d19bdda0f726/observed-proxy.mjs); [Reviewed transport metadata snapshot](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dc173c950ca3d1fb/transport-evidence.jsonl).

Pairing clips have an explicit black region from y=880 to the bottom edge, covering real codes even during half-sheet transitions. R1 applies it for the first 45s; R2 valid-code, R3 pairing, and R4 pairing apply it throughout. Read/reconnect clips remain full-screen and contain no pairing credentials. Empty scan illustrations are UI placeholders. No actual QR, pairing URL/code, private key, auth header, cookie, token, raw application log, or raw native build log was uploaded. The raw build log remains local and unreviewed for publication.

Full-resolution stills and ffmpeg contact sheets from the selected videos were inspected on Linux. The conservative mask, rather than sparse frame sampling, protects the entire pairing input region. Selected final stills have no stale modal or keyboard overlays. Android video timelines omit unchanged frames; durations above are encoded durations, not wall-clock timing assertions. No performance or latency claim is made.

## Resources retained for lead

Session `issue-5639` is intentionally left leased, on the head app’s system-CA connection with private user CA absent. Only the system route is saved now; the HTTP route was removed from this disposable client for isolated R3 capture. Re-pair through the provided helper if another route is needed. The lease still has a 15-minute idle TTL; resume promptly. It is not closed by this pass.

Backend PID 2559717 on 15135 and Metro PID 2559550 on 8081 remain untouched and listening. CA-only HTTP server PID 2560636 on 18081 remains listening. Original observed proxy PID 2546972 exited; the same unedited driver was restarted at 02:00:03 as PID 2574030, exec session 47560, listening on 18443/18444/18080. Current live sanitized log remains /tmp/issue-5639/transport-safe.jsonl. Published transport-evidence.jsonl is a reviewed snapshot through about 02:08 UTC. Private fixture material stays under /tmp/issue-5639; no fixtures are committed.

## FRICTION

FRICTION | category | happened | avoidance
FRICTION | Native build | Old index claimed head unavailable; build is now successful and cached. | Treat that infrastructure blocker as resolved; never rebuild during this pass.
FRICTION | Native install workspace | Replacement installer from worktree conflicted with device ownership in /home/ubuntu/t3code. | Run the worktree installer script from the directory that owns the session.
FRICTION | Device lease | Simlock ended an actively used lease; commands briefly returned Remote daemon unavailable. | Reacquire same named Pixel session, install exact cached fingerprint, recheck trust and routes; do not infer retained state.
FRICTION | Development startup | Cold dev client temporarily showed a blank screen. | Open existing Metro deep link and await named app content; no Metro restart.
FRICTION | Settings launch | System Settings failed run-as sandbox probe. | Open the CA-installed system notification, Check certificate, and uninstall through system UI.
FRICTION | Certificate picker | Ordinary tap did not select the downloaded root. | Long-press file then Select.
FRICTION | Transport fixture | Original observer process exited; fixture ports were closed while backend/Metro stayed healthy. | Confirm listeners, restart same unedited observer only, retain new PID and timestamps.
FRICTION | Route fallback | Saved alternative route obscured which transport powered a read. | Final R4 uses HTTP-only client; final R3 removes HTTP alternate and uses system-only route.
FRICTION | Runtime transient | First private-CA refresh hit SocketReadError; later refresh and reconnect/read succeeded. | Disclose transient; correlate later UI success with new socket and response frames, rather than claiming every attempt succeeded.
FRICTION | Pairing redaction | Modal transition placed code below an initial fixed band. | Mask from y=880 through bottom edge; keep full-screen read evidence separate.
FRICTION | Android recording | Static frames are omitted and clips can stop before capture wall time. | Inspect ffmpeg frames, explicitly reveal completed result, report encoded duration without latency claims.
FRICTION | R2 reachability | TLS discovery blocks any subsequent WSS attempt with private root absent. | Report failed retained reconnect and certificate alert; leave independent WSS handshake rejection UNVERIFIED.

## Public artifact list

![before-after-private-ca.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/72a6e48c31eb23c6/before-after-private-ca.png)
[r0-before.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/618f12314c62b244/r0-before.mp4)
[r0-retry-observed.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/73006b9ab9ea9cd6/r0-retry-observed.mp4)
[r1-private-ca-pairing.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/556bd9cbd5b06f6f/r1-private-ca-pairing.mp4)
[r1-read-reconnect.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ac26d331aded5816/r1-read-reconnect.mp4)
![r1-after-still.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/280465b4493b81ad/r1-after-still.png)
![head-user-ca.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4044a67e46fa6cee/head-user-ca.png)
[r2-ca-removal-reconnect.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1951203e427a33cb/r2-ca-removal-reconnect.mp4)
![r2-no-user-ca.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/81e800f7a25135f3/r2-no-user-ca.png)
[r2-fresh-pairing-redacted.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2531b290160ea82d/r2-fresh-pairing-redacted.mp4)
[r2-discovery-visible.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/2fbc409ccee4d710/r2-discovery-visible.mp4)
![r2-discovery-rejected.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/68d832404066f003/r2-discovery-rejected.png)
[r3-system-ca-pairing.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f48c78c28867f34a/r3-system-ca-pairing.mp4)
[r3-read-complete.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/56cd596082cf91e1/r3-read-complete.mp4)
![r3-isolated-system-ca.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/78f331791ff17247/r3-isolated-system-ca.png)
[r4-http-pairing.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0a13db81ac424733/r4-http-pairing.mp4)
[r4-http-read.mp4](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9a4368c1067c07c7/r4-http-read.mp4)
![r4-cleartext.png](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d9822826567101d5/r4-cleartext.png)
[native-artifact-evidence.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e1cdd1d4b2cea653/native-artifact-evidence.txt)
[observed-proxy.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6d31d19bdda0f726/observed-proxy.mjs)
[transport-evidence.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/dc173c950ca3d1fb/transport-evidence.jsonl)
[evidence-drivers.md](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3169a67e505850f2/evidence-drivers.md)