Validate result views on real evidence and expose file-hash matches

VALIDATION.txt

@@ -140,3 +140,25 @@ prepared inputs remain under inputs/. Tests cover separation of context from
 matches, preservation of JSON evidence, authorized-test labels, spreadsheet
 formula protection and no-matches wording. Direct engine.scan callers retain
 the flat layout. A synthetic CLI smoke check confirmed the new directory layout.
+
+REAL-DATA OUTPUT PRESENTATION CHECK — 2026-10-05
+
+The CLI was run against 19,625 referenced original lines from two independent
+private datasets, with each dataset's own IOC pack. Source files were verified
+against their recorded hashes before and after processing. This was a bounded
+presentation regression, not a new full-dataset scan.
+
+The runs produced 14,633 and 2,461 matched-event CSV rows respectively. Every
+CSV event ID, source reference, indicator status and defanged indicator was
+checked against the full JSON event. Summary counts and partial status agreed
+with the JSON summary. The JSON retained 123 and 1,448 additional context/error
+events excluded from the matched-event CSV. Decoding output was present in
+13,019 and 344 matched events; authorized-test labels were preserved.
+
+Both runs exited 2 with partial coverage: 12,510 and 1,584 failed decoding
+candidates remain reported. No matching errors occurred in these runs. Private
+source mapping and validation results remain outside the public release.
+
+A subsequent presentation correction exposes original-file SHA-256 matches in
+SUMMARY.txt even without an event match. Three focused presentation tests passed,
+including this separate hash-only case; Ruff, formatting and strict mypy passed.