[isomorphisms]

Part of #151. Draft implementation; not a phone-browser acceptance claim. Stacked on the preserved Binder-first host branch from #112. No application-side HTTP, WebView fetch or separate canonical store.

ICU #35 integration (2026-10-14)

• The Binder-shaped ICU capability and Shizuku/rish lowering now consume ICU PR #35's paired ICU_CAPTURE_BODY_PATH and ICU_CAPTURE_METADATA_PATH outputs from one checked request. The shell-side files are transferred together in a bounded length-framed packet; no status, MIME or resolved URL is invented from stdout or document content.
• Prior to the request the provider checks the deployed DEX/native-library SHA-256 pins. The precise ICU Make CSS selector matching a browser control-flow benchmark #35 candidate source head was 0da041fbe906657f4f705da45a842d96832e5ee1 at integration. Artifact SHA-256 values and physical installation are not yet qualified; do not claim this branch deploys ICU Make CSS selector matching a browser control-flow benchmark #35 on C67.
• The producer rejects missing/duplicate/inconsistent metadata, refused Shizuku authority, ICU failure, oversized/truncated response, invalid final URL, HTTP non-2xx, unsafe source generation and reused request ID.
• The canonical sd-card-append-fat userspace Arena stores only bounded body bytes. The producer independently reopens the committed range with the native C reader and compares bytes before publishing an immutable ib-icu-arena-v2 receipt.
• v2 records observed HTTP status, final resolved URL, redirect count, MIME, explicit charset, content encoding, UTF-8 observation, requested URL, source key/generation, exact Arena offsets/length and SHA-256. HTML navigation_admitted=YES is conditional on observed HTTP 200, text/html, explicit UTF-8 charset, identity encoding, UTF-8-valid bytes and complete verified acquisition. Otherwise navigation remains denied. Source-generation ordering is still the browser/source owner's responsibility.
• The source consumer checks v2 admission semantics and independently verifies the entire committed range/digest before emitting any bytes. Existing v1 receipts remain byte-readable but can never authorize navigation.

Checks

• Exact-head checked Arena run 38652958137: PASS, compiled pinned canonical appendfat storage and native range reader; host mocked ICU Make CSS selector matching a browser control-flow benchmark #35 framing/metadata; tested redirects, binary bytes, v1 compatibility, v2 admission, malformed/missing/duplicate metadata and forged navigation, plus Android ARM32/ARM64 native reader cross-builds.
• Browser foundation run 38652958169: PASS.
• Universal merge gate run 38652958139: PASS.
• ICU PR Make CSS selector matching a browser control-flow benchmark #35 has its own separate native redirect/capture integration test. No passing IB mock proves that the actual ICU binary or physical Shizuku path has run.

Remaining / no merge or release authority

ICU #35 remains draft/unmerged; signed/pinned Android DEX + ARM32 production artifact and hashes not qualified. NOT_RUN: actual HTTPS via app_process and Shizuku on the C67, end-to-end binary/metadata delivery to a private Binder/PFD consumer (#153), Idriç HTML→Prepaint (#154), native URL-field APK and clickable navigation (#129), or physical durable restart tests. Coordinate with #151, #142, #153, #154 and ICU #35. Keep this PR draft; do not conflate host-source validation with device acceptance.

2026-10-14: actual ICU native bridge qualification

At exact head 1180b237e02a297b7c2ae9c4603af2b73ec64ae3, checked Arena run 38664123465 PASSED. In addition to mocked refusal tests, it compiled dilapidated-shed/icu@0da041fbe906657f4f705da45a842d96832e5ee1's real native HTTP/TLS response parser with ICK and exercised HTTPS, redirects, final URL/status/MIME/charset, binary response fidelity, HTTP 404 and truncated length refusals, pinned-hash mismatch, the unchanged Shizuku framing contract and canonical Arena v2 readback. The Android app_process and Shizuku shell authority in that test are explicit host substitutes, not actual Idriç DEX or C67 execution. Produced host receipts and digests are uploaded in the same workflow artifact.

The dependent IB PFD draft #153 now consumes admitted v2 source receipts and matches source_generation to the reader epoch; native PFD run 38664402695 PASSED. FP independent acceptance tracked by SUN #142, still open. Do not merge/release solely from these host checks.

Main-target promotion candidate

IB #158 selects the unchanged tested blobs from this PR and #153, plus the unchanged lib/android_shizuku_host.grease required from the preserved Binder host, onto a minimal additive main branch. #112 (binder-first-host) was closed after consolidation without merging to main, so a merge of #152 into its old base would not promote the feature. Do not treat branch-local merges as completion; require exact #158 checks and FP approval.

[isomorphisms]

Dependency from IB HTML→Prepaint draft #154. The existing ib-icu-arena-v1 receipt is not admissible HTML: final resolved URL/status/MIME/charset/source generation are not observed and navigation_admitted=NO. New narrow adapter bin/ib_arena_to_html_prepaint.grease intentionally requires navigation_admitted=YES, acquisition_complete=YES, source_key=arena:REQUEST_ID, a pinned source_generation, HTTP 200, mime_type=text/html, admitted UTF-8 charset, requested/resolved URLs, checked byte count/SHA and reopen_check=MATCH before it calls the #152 verified reader. Please extend the producer and bin/ib_android_arena_read.grease together: reader currently requires NR == 14 in receipt structure and will reject a receipt enlarged with new fields. Do not synthesize metadata or label the existing body-only capture live/accepted. Companion metadata origin is ICU PR #35. Converter/AICI tests remain separate; physical C67 NOT_RUN.