September 8, 2026. Independent reviewer owns tests/core.test.cjs and this report; the builder owns production code. Tests use original synthetic profiles and the public parse → aggregate → compare API. No external profiles, installs, accounts, or network operations were used for this verification.
Final result: 28 tests passed, 0 failed; exit status 0. The first run found one defect: unit: ["seconds"] and unit: ["none"] passed Object.hasOwn(UNITS, p.unit) because JavaScript coerces the property key. These values violate the schema's string type. The builder fixed the guard to require a string before looking up the unit. The independent regression now passes. No other defect was found in this bounded core review.
Hand-calculated assertions cover unequal sample weights, inactive/empty-stack contributions, recursive inclusive weight counted once per flat identity, repeated recursion in the call-path tree, evented self intervals, equal-time events, explicit profile selection, normalized time units, reordered frame indices, added/removed functions, absolute differences and percentage-point changes, zero denominators, source-location matching, and mixed profile-type warnings.
Parser and resource assertions cover malformed JSON, the required schema identifier, invalid metadata and units, missing/mismatched/nonnumeric/negative/overflowing weights, malformed frame metadata, invalid frame references including zero-weight samples, invalid events and nesting, string-shaped script content as inert core data, input immutability, and all published byte/frame/profile/record/depth/visit/call-path caps. The byte fixture distinguishes UTF-8 bytes from JavaScript string length.
The suite tests core numeric behavior and boundaries. It does not establish browser rendering, DOM injection safety, every third-party exporter's compatibility, benchmark significance, actual speedups, or customer adoption. Function matching is a declared heuristic, not symbol resolution. Metadata is validated across profiles; detailed event/sample payloads are validated when a profile is selected, as the documented contract states.
Execution used an existing Bun 1.3.14 installation. From the repository root:
bun test tests/core.test.cjsThe initially proposed command without test failed before executing any test: Bun requires its test runner for node:test. This is a runner invocation correction, not a production code failure. The suite uses node:test and node:assert/strict; this local result is Bun compatibility evidence, not a separately executed Node runtime check.
bun test v1.3.14 (0d9b296a)
tests/core.test.cjs:
(pass) sample weights, empty stacks, and recursion have hand-calculated totals [1.68ms]
(pass) evented intervals include idle gaps and preserve recursive call paths [0.24ms]
(pass) equivalent time scales compare equally without mutating source units [0.58ms]
(pass) comparison joins frame identity across reordered indices and computes percentage points [0.35ms]
(pass) removed functions retain their baseline evidence and negative deltas [0.11ms]
(pass) zero totals keep share deltas unavailable rather than infinity or zero [0.21ms]
(pass) sampled shares use supplied weights and disclose disagreement with bounds [0.08ms]
(pass) equal-time events and an idle-only profile do not invent active functions [0.09ms]
(pass) location matching distinguishes lines while function matching warns on merges [0.19ms]
(pass) exact identity keeps source columns and absent locations distinct [0.12ms]
(pass) profile selection is explicit and validates only selected payloads [0.49ms]
(pass) incompatible dimensions and matching policies cannot be compared [0.24ms]
(pass) comparing evented and sampled profiles discloses their denominator difference [0.12ms]
(pass) aggregation and comparison leave parsed inputs and operands unchanged [0.08ms]
(pass) JSON and root schema boundary rejects malformed or foreign input [0.22ms]
(pass) unit types cannot use JavaScript property-key coercion [0.17ms]
(pass) weights are mandatory, numeric, nonnegative, and bounded after conversion and summation [0.40ms]
(pass) profile bounds, types, names and active indices are validated [0.37ms]
(pass) frame metadata rejects invalid optional locations and oversized strings [0.21ms]
(pass) samples reject invalid stack and frame references even at zero weight [0.15ms]
(pass) events reject invalid frame references, unknown types and nonnumeric positions [0.29ms]
(pass) event ordering and balanced nesting are enforced without sorting or repair [0.22ms]
(pass) untrusted names remain literal data and do not collide with object properties [0.40ms]
(pass) published depth limit accepts its boundary and rejects deeper sampled and evented stacks [8.05ms]
(pass) published frame, profile, and record caps reject oversized collections [48.50ms]
(pass) published visit cap refuses excessive cumulative stack work [505.74ms]
(pass) published call-path cap refuses wide deep trees before unlimited allocation [60.62ms]
(pass) published byte cap measures UTF-8 bytes before parsing [36.74ms]
28 pass
0 fail
Ran 28 tests across 1 file. [689.00ms]
Reviewed src/app.js, src/template.html, and src/style.css without changing production files. Three concrete findings were sent to the builder and their source fixes were verified: native file inputs now clear during import, swap, and restore to prevent stale selections and enable same-file replacement; displayed hashes now say “Decoded-text SHA-256,” with JSON provenance using decodedTextSha256 and an explicit hashBasis; and the inspector remains visible below 1,050 pixels. The hash distinction matters because a Bun File.text() probe confirmed a five-byte BOM-prefixed input becomes two decoded bytes with a different hash. No finding from this bounded UI review remains open.
Static inspection also found generation checks preventing older successful file imports from replacing newer selections, immediate invalidation of failed replacement comparisons, profile payload validation on selection, consistent focus-relative graph widths with disclosed rendering limits, and snapshot embedding through escaped JSON in a non-executable data script. Imported strings reach UI text nodes rather than HTML interpretation. These are bounded source-review findings, not a complete browser security audit.
The builder separately executed Firefox 155.0 integration checks. This reviewer inspected the final result record: 15 of 15 checks passed, including snapshot escaping and interactive reopening, asynchronous import ordering, native file selection with active-profile handling, swap behavior, stale-result invalidation, provenance export, and pagination with 100,000 synthetic samples per file. Responsive checks separately reported a visible inspector and no page overflow. The reviewer inspected that recorded browser evidence rather than rerunning the browser suite; the independent core result above remains a separate verification.