# Independent proof auditor pass 2 — PASS

Read-only audit of [#24263](https://git.cafe/pingdotgg/t3code/pulls/24263), published head [32cd033](https://git.cafe/pingdotgg/t3code/commit/32cd033c0e5423d96a7043fa9553f30c6c253bec), against supplied main [7bafc40](https://git.cafe/pingdotgg/t3code/commit/7bafc40c17ab2a1cb8f0eb675cde4d6d3153f119). No blocking evidence discrepancy or reproduced output regression found in this scope. This addendum supersedes the original report's “independent pass 2 pending” and later-head applicability limitations; it does not change the original measurement pins or certify native devices.

## Freshness bridge

Git objects independently confirm the evidence pin [3b3cbb4](https://git.cafe/pingdotgg/t3code/commit/3b3cbb407d2300df278dd7977bf7de76f6712416) and published head have identical ordered parents: [88d9b10](https://git.cafe/pingdotgg/t3code/commit/88d9b101d9fc3cc1f55a67b5d956488181588963), then supplied main. Both merge bases against supplied main are supplied main. A complete tree diff changes only `apps/mobile/src/native/EnrichedMarkdownText.tsx`: one modified `if (!fileEmbedLabel)` line and two added braces enclose its existing return. An exact string transformation reproduces the published component, with no other source changes. There is no additional lexical declaration in that new block and the return still exits the same memo callback; this is semantically neutral. All preprocessing, dependency/archive, native, lockfile and remaining tree contents are identical. Evidence therefore applies to published head by source identity plus this inspected component change, **not by relabeling measurements as taken at published head**.

Read-only GitCafe view/status freshly report the expected branch/head/base, 30/30 successful checks, zero pending/failing checks, and a current conflict-free mergeability observation. Raw responses are retained. The exposed review list contains one older bot comment review; the two claimed final independent MERGE reviewers are user-supplied context, not independently discoverable from that forge review list. Resolved historical inline findings were checked against the corrected newline search and migrated argument parser. No forge approval/review was posted.

## Evidence integrity and independent rerun

All **10,056** regular-file SHA256SUMS entries independently pass on disk and inside `to24263-r8-evidence.tar.gz`; the bundled root manifest exactly equals the disk manifest. Original source-manifest hashes were re-read from Git objects. Original evidence was checked again after reruns and is unchanged. The original report's 3,685 count refers to the older downloaded bundle, not the fresh r8 root manifest.

The 111-row matrix reconciles independently: 4,574 original full/prefix/stream comparisons + 6,176 extra prefixes + 29,475 generated cases + 23,313 callback cases = **63,538**, with zero recorded differences. Freshly reexecuted **58,964 differential comparisons** (6,176 + 29,475 + 23,313) all have zero differences; this is a meaningful subset rather than a claim to rerun all 63,538. Additionally all 27 combined stream updates were reexecuted with exact recorded output hashes and parser counts, and all 20 callback stream traces match their original records.

Exact method: copied inputs/modules/scripts into `/tmp/to24263-r8-pass2`, rewrote only absolute scratch output paths, and linked dependency/native fixture directories read-only. Ran `node integration-differential.mjs`, `node callback-proof.mjs`, `node extra-equivalence.mjs`, `node parse-trace.mjs`, `node stream-stage.mjs`, `python3 cache-capture.py`, `node pending-model.mjs`, and `node verify-results.mjs`. The retained verifier's canned independence sentence still describes its original author; **this separate report records the independent review and rerun**. Raw logs/results and independent `bridge.json`, `independent-identity.json`, count reconciliation and harness token check are retained. The source modules exactly equal the pinned Git blobs and, for the after module, published-head source.

Production component inspection confirms: no-callback uses HTML normalization then combined file links/tables; callback uses HTML → file links → file embeds → tables. Callback comparisons include exact output, insertion-ordered fileHrefs, ordered arguments and standalone flags. Coverage includes HTML, file links, embeds, tables, pipe fallback, Unicode and every UTF-16 prefix of callback fixtures across LF/CRLF/CR. No callback pipeline change is introduced by the braces.

Fresh traces reproduce combined **81 → 54 parses**, logical stage bytes **1,555,548 → 1,138,401**, parser-input bytes **1,136,958 → 719,811**. Callback remains **80 → 80 parses**, **1,185,421 → 1,185,421** logical stage bytes and **901,526 → 901,526** parser-input bytes. These are payload traffic counts, not heap or peak memory. Original timing medians recompute from retained samples: combined 2,711.054 → 1,406.421 ms; uninstrumented callback 3,029.064 → 2,880.538 ms. Their original pins remain intact.

An independently written `independent-stream.mjs` also compares all 27 exact outputs and measures two warmup/five retained aggregate rounds with alternating endpoint order: **2583.900 → 1364.537 ms**. It omits byte-length tracking in the timed loop. Fresh callback-proof timing (with call/stage collection) is **2906.233 → 3076.049 ms**. These fresh reruns used **Node v24.22.1**, while original measurements used v26.12.1; concurrent audit processes/shared-host load also limit comparison. No stable callback speedup, device latency or timing threshold is asserted.

## Native qualification

Published-head tarball SHA-256 independently equals `d9b75931bafb1847172550bb4eaafb7b8f59632a79b796e6174a93261e95c0fd`; its computed SHA-512 matches the published-head lockfile. All three actual native implementation files are byte-identical between retained exact-commit fork source archive, current packaged source and installed dependency. The source identity is [558767d](https://github.com/pingdotgg/enriched-markdown/commit/558767d9bccec81805d960f792ab0fcda7c1e7c8). The moved native harness independently has 1,410 equal tokens preserving strings, characters and comments, discarding only inter-token whitespace.

Fresh portable C++ extraction/compilation with `c++ -std=c++20 -O2 -pthread` reproduces **269,254,656 → 8,388,416 accounted bytes**, **512 → 8 entries**; after-cache assertions pass. This executes extracted actual cache code with CGFloat=double/private visibility exposed, excluding unrelated React helpers. Source inspection confirms an **8 MiB accounted-key-storage budget**, not an allocator-inclusive physical-memory bound. Cache timing includes introspection and is not a production lookup performance claim.

Fresh deterministic pending-model replay reproduces blocked-worker source payload **134,479,872 → 524,288 bytes**, applying revision 512. It is a **HOST MODEL ONLY**, not Objective-C/ARC/dispatch execution. Actual coordinator source retains one in-flight and one replaceable pending render, but each successful completion can enqueue an apply capture on main: starvation replay retains **134,479,872 bytes**. **No global two-revision bound exists or is claimed.**

**iOS Foundation/Objective-C/device: UNVERIFIED. Android emulator/rendering: UNVERIFIED.** No browser, server, emulator, other machine or userdata was used.

## FRICTION

The checkout and local main alias remain older than the published head/supplied main; explicit Git object pins and full-tree comparison resolve applicability without checkout/fetch. The fresh scratch runtime resolves Node 24 rather than the original Node 26, so fresh timings are separate observations. Instrumented callback timing reverses direction again; no reliable callback speedup follows. The first portable-cache attempt failed because my scratch copy omitted `prior-native-tests.mm`; copying that fixture into my own scratch and rerunning compilation/verifier resolved it. Initial failure logs were inspected; final verification passes. Platform runtime validation remains unavailable under this authorized scope.

No code edits, commits, pushes, forge writes, uploads, servers, browsers, devices or remote work. T3 PR-link registration only updates thread bookkeeping. Worktree remained clean at the original evidence pin; all original evidence hashes still pass. Writes are confined to this addendum and `/tmp/to24263-r8-pass2`. Parent owns publication.

Audited independently by gpt-6.1-sol through the Codex harness in T3 Code.