From 39ad097e6df0fee07554b5bef1055cdf042a4f95 Mon Sep 17 00:00:00 2001
From: Mihawk <163614687+mihawk-99@users.noreply.github.com>
Date: Sat, 10 Oct 2026 10:11:53 -0400
Subject: [PATCH] Record saved username mismatch without account values

Read-only comparison confirms both saved passwords match the working pair, while the inherited username differs and no WebUI username override exists. Formatting does not explain the difference. Validation: tools/verify.sh evidence; 125 captures passed. Console settings unchanged.
---
 evidence/ra-host-login-provided/capture.json  | 19 +++++++++++++++++--
 .../ra-host-login-provided/expectation.json   |  4 +++-
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/evidence/ra-host-login-provided/capture.json b/evidence/ra-host-login-provided/capture.json
index 95bb767..7c55bfd 100644
--- a/evidence/ra-host-login-provided/capture.json
+++ b/evidence/ra-host-login-provided/capture.json
@@ -10,6 +10,21 @@
     "HTTP status=200 content_type=application/json",
     "Success=true token_received=true authenticated=true",
     "Credentials and token not saved by the diagnostic or displayed in its result",
-    "Console settings unchanged; console authentication not tested by this PC request"
-  ]
+    "Console settings unchanged; console authentication not tested by this PC request",
+    "Saved password matches provided password exactly in both main and WebUI configs",
+    "Saved main username differs; WebUI username override absent",
+    "Username difference is not fixed by whitespace trim, case folding or Unicode normalization",
+    "Read-only comparison; console settings unchanged"
+  ],
+  "format_comparison": {
+    "recorded_utc": "2026-10-10T14:11:51.327495+00:00",
+    "main_username_matches_provided": false,
+    "main_password_matches_provided": true,
+    "webui_username_present": false,
+    "webui_password_matches_provided": true,
+    "effective_username_matches_after_trim_casefold_or_normalization": false,
+    "effective_username_has_controls_or_non_ascii": false,
+    "token_present": false,
+    "console_settings_changed": false
+  }
 }
diff --git a/evidence/ra-host-login-provided/expectation.json b/evidence/ra-host-login-provided/expectation.json
index edc88da..d42c993 100644
--- a/evidence/ra-host-login-provided/expectation.json
+++ b/evidence/ra-host-login-provided/expectation.json
@@ -4,7 +4,9 @@
   "must_contain": [
     "HTTP status=200",
     "authenticated=true",
-    "Console settings unchanged"
+    "Console settings unchanged",
+    "Saved password matches provided password exactly",
+    "Saved main username differs; WebUI username override absent"
   ],
   "must_not_contain": [
     "authenticated=false"