# Read-only evidence audit — PASS (pinned scope)

[#24263](https://git.cafe/pingdotgg/t3code/pulls/24263), branch `t3/mobile-audit-markdown-20261023`. Before is the actual merge base of supplied main and requested head: [7bafc40](https://git.cafe/pingdotgg/t3code/commit/7bafc40c17ab2a1cb8f0eb675cde4d6d3153f119). After is [3b3cbb4](https://git.cafe/pingdotgg/t3code/commit/3b3cbb407d2300df278dd7977bf7de76f6712416). Checkout `/home/ubuntu/wt/pr-24263` was clean and exactly pinned before and after the work.

**Baseline reference limitation:** local `main` resolves to [728aba3](https://git.cafe/pingdotgg/t3code/commit/728aba305c479b9ed79a2fbbba982ad06475034f), and literal `git merge-base main HEAD` returns that older commit. The fresh evidence intentionally uses the explicitly supplied main SHA and its merge base, as pinned above. No fetch or ref mutation was performed. These results must not be relabeled as a comparison to the stale local alias.

**Freshness limitation:** the read-only forge response already named a later live head, [32cd033](https://git.cafe/pingdotgg/t3code/commit/32cd033c0e5423d96a7043fa9553f30c6c253bec). This audit does not certify that later head or current merge readiness. PASS means the requested host evidence is consistent and no output mismatch was found within the fixtures. It does not mean native release validation or a completed independent second audit.

## Fresh fixture matrix and exact equivalence

**63,538 comparisons; zero differences.** `fixture-matrix.json` and `.csv` contain 111 coverage rows. Inputs, scripts and raw results are retained.

- No callback: **40,225 comparisons**: 4,574 full/prefix/stream checks in `results.json`, 6,176 exhaustive fixture prefixes in `extra-equivalence-results.json`, and 29,475 seeded generated combined/file-only/table-only checks in `integration-differential-results.json`. The before pipeline is HTML → inline file links → tables; after calls the actual combined `markdownForNativeRendering` export. Both modules came from the pinned Git objects.
- Callback: **23,313 comparisons** across 19 fixture families, three line endings, every UTF-16 prefix and three callbacks (null labels, file-only labels, all-image labels). Before and after both run HTML → inline file links → file embeds → tables, as the pinned production component does. Comparisons include exact output, insertion-ordered fileHrefs and ordered callback arguments including standalone flags. No callback invocation or href difference was found.
- Coverage includes HTML details/summary, anchors/entities/unsafe hrefs, code/fences, direct/reference/nested/linked/HTML images, malformed embeds, file path forms, escaped pipes and pipe-reparse fallback, containers, CR/LF/CRLF, Unicode and split surrogate prefixes. Deterministic generated cases use seed 24263 and 1,200 documents; this is broad finite coverage, not a universal equivalence proof.
- The supplied **56 focused tests already passed** is upstream context, not a fresh result claimed here. No test suite or CI was rerun in this evidence-only pass.

## Fresh host stream benchmarks

Host runtime **v26.12.1**, Linux x64, reported CPU `19/01` on a shared VM. Two warmup rounds and five retained stream samples per endpoint. Updates grow by 1,024 UTF-16 units; the 50 ms cadence is virtual metadata only, with no sleeps or real-time stream scheduling. These are aggregate synchronous preprocessing observations, not device latency, frames or battery results. Raw samples are in the JSON artifacts.

**No callback / combined path:** 27 updates; final input 27,100 UTF-8 bytes, maximum output 29,100 bytes. Parse entries **81 → 54**. Median aggregate wall time **2,711.054 → 1,406.421 ms**. Logical stage traffic **1,555,548 → 1,138,401 bytes**; parser-input traffic **1,136,958 → 719,811 bytes**. Every update's exact output agrees and its output hash is recorded in `stream-stage-results.json`.

Primary no-callback stream timing also includes output byte-length/max tracking. Stage definition for that mixed fixture: before counts input/HTML/file-link/output; after counts input/normalized parser input/output. Equal contents at separate stages are counted repeatedly. Parse entries instrument unified's public parse method, including helper calls. Stage tracing is separate from primary timing and intentionally retains strings in the harness.

**Callback path:** 20 updates; final input 19,530 UTF-8 bytes. Parse entries **80 → 80**, logical stage traffic **1,185,421 → 1,185,421 bytes**, parser-input traffic **901,526 → 901,526 bytes**. Stage order is input/HTML/file links/embeds/table output. Output hashes, hrefs and callback-call hashes agree for all 20 updates. Fresh uninstrumented timing, alternating endpoint order each round: **3,029.064 → 2,880.538 ms**. The earlier instrumented call/stage-collection run was **2,894.839 → 3,030.061 ms**, retained separately. No reliable callback speedup is asserted.

**3,000 malformed tokens:** `malformed3000Tokens` is 3,000 repeated `[x](<` fragments plus an inline file path. Fresh full-fixture medians **50.885 → 47.108 ms**, one parse each. In the separate scaling process the same 3,000-fragment input measured **248.984 → 36.691 ms**. These different baseline observations show runtime/load/JIT sensitivity and must not be presented as a stable speed ratio. The 3,000-backtick scaling fixture measured **8.513 → 0.021 ms**; the HTML malformed-delimiter fixture measured **3.546 → 3.537 ms**. Eight retained samples after two warmups; exact input construction and all samples are preserved in `capture.mjs`, `scaling.mjs`, `results.json` and `scaling-results.json`. No timing threshold was used as a pass criterion.

**All byte counts above are logical UTF-8 payload traffic, not live/peak heap, RSS, AST storage, allocator/GC behavior or native memory.** Fixture arrays, tracing and sample retention belong to the harness.

## Native migration identity and qualified reuse

[88d9b10](https://git.cafe/pingdotgg/t3code/commit/88d9b101d9fc3cc1f55a67b5d956488181588963) moved the local patch/harness into the maintained [fork at 558767d](https://github.com/pingdotgg/enriched-markdown/commit/558767d9bccec81805d960f792ab0fcda7c1e7c8). Current archive metadata records that commit and version 1.2.0-t3.16. Its SHA-256 is `d9b75931bafb1847172550bb4eaafb7b8f59632a79b796e6174a93261e95c0fd`; its SHA-512 integrity matches the pinned lockfile.

Actual `MeasurementCache.h`, `ENRMAsyncRenderCoordinator.h` and `.m` are **byte-identical across current tarball, installed package, prior proof's patched source, and a newly downloaded source archive addressed by the exact fork commit**. The prior patched source was independently reconstructed from Git at [4cd5524](https://git.cafe/pingdotgg/t3code/commit/4cd55246672e1090c710dbb7ded76be1ea34a554). The actual merge-base unpatched archive and all three baseline files are identical to the prior proof baseline. This compares these three native files, not every package file. Native identity results and all hashes are in `native-identity-results.json` and `fork-source-identity-results.json`.

The moved native harness is not byte-identical because of formatting. Its C/Objective-C token sequence is identical with string literals and comments preserved (only inter-token whitespace discarded). Its wrapper explicitly requires macOS Foundation and the Apple clang toolchain. No Foundation run is claimed here.

**Portable C++ recapture:** **269,254,656 → 8,388,416 accounted bytes**, **512 → 8 entries**, with 512 growing 1,024-byte revisions. This freshly reproduces the historical corrected totals using extracted actual baseline/current key/hash/cache bodies. CGFloat is double, private visibility is exposed for measurement, unrelated React prop helpers are omitted, and the token-equivalent prior native cache assertions execute in the after harness. Key/entry structs are 280/296 bytes. The accounting counts two key copies, six string sizes and structs; it excludes allocator/node/bucket/capacity overhead, callers and rendering state. The native source's 8 MiB budget applies to its defined accounting, not all physical cache storage. Host C++20/O2 timing **304.351 → 88.708 ms** includes introspection summing all retained keys after every insertion and is not a production lookup/insert performance claim. Two warmups/eight retained samples.

**Coordinator HOST MODEL replay:** identity validates reuse of the same source scheduling model. Fresh replay again gives **134,479,872 → 524,288 modeled captured UTF-8 source bytes** for a burst while the worker is blocked; revision 512 applies. Pending/inflight invalidation and replacement cases are retained. The model does not execute Objective-C, ARC, dispatch, native parsing/layout or UI application. **There is no global two-revision bound**: when background renders complete while main is stalled, completed apply captures can accumulate, and the starvation scenario retains 134,479,872 modeled bytes. This is source-payload accounting only.

## Verification, independence and reproduction

The [published prior report](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/312ff8212f44fe7d/REPORT.md) exactly matches its bundled copy. All **3,685 entries** in the downloaded bundle's final checksum manifest passed. Installed unified/remark-parse/remark-gfm versions are 11.0.5/11.0.0/4.0.1. Relevant lockfile changes only select the native tarball; both JS endpoints use that same installed parser dependency tree. Registry package byte identity was not independently checked.

`verify-results.mjs` re-reads Git object hashes and checks clean pinned state, reexecutes all 27 combined stream updates and parse counts, recomputes stage totals and medians, reconciles all 63,538 matrix comparisons, reruns both portable binaries and checks native identity/model totals. **PASS**. This is same-auditor consistency verification. **Independent pass 2 is still required later and was not performed or represented as complete.**

Reproduce sequentially with the pinned checkout and installed mobile dependencies available: `node capture.mjs`, `node parse-trace.mjs`, `node stream-stage.mjs`, `node extra-equivalence.mjs`, `node integration-differential.mjs`, `node scaling.mjs`, `node callback-proof.mjs`, `node callback-benchmark.mjs`, `python3 native-identity.py`, `python3 cache-capture.py`, `node pending-model.mjs`, `python3 source-manifest.py`, `python3 run-remaining.py`, `node verify-results.mjs`. Scripts use the absolute scratch path. `run-remaining.py` repeats several listed runs and generates the aggregate matrix; for a minimal rerun execute capture, callback-proof, callback-benchmark, native-identity, source-manifest, run-remaining, verify-results in that order. `native-identity.py` expects the retained current native extraction and prior bundle; fork identity results refer to the retained fork source archive. Reruns change timing samples and require regenerating report/checksums.

**iOS Objective-C/Foundation/device: UNVERIFIED. Android emulator/rendering: UNVERIFIED.** Neither platform is available within this audit scope. No UI, native scheduling latency, global memory bound or heap claim is made.

## FRICTION

Local `main` is older than the explicitly supplied main SHA, so the supplied pin governs baseline selection. The live PR moved beyond the requested head; results remain pinned and require a later-head check before reuse for landing. The migrated native harness changed whitespace, so byte equality applies to native implementation files and token equality applies to the harness. Callback timing changes direction between instrumented and uninstrumented runs, and malformed-fragment timing differs substantially across processes; wall times are observational on a shared VM. Historical native cache/model counts are reusable for this source identity, with the stated host/accounting caveats, not as fresh native runtime measurements. No source defect or failing output comparison was found. Independent pass 2 remains pending.

All writes stayed under `/tmp/to24263-r8-proof`. No source edits, commits, fetch/checkout, forge writes, uploads, servers, browsers, userdata access, remote machines, devices/emulators or delegated work. Read-only forge inspection and T3 PR-link registration were performed. Parent owns ghdrop publication. Final SHA256SUMS covers regular delivery files except itself and the bundle; symlink targets are recorded separately and never followed.

Audited by gpt-6.1-sol through the Codex harness in T3 Code.