# Pass 4 integration proof audit — PASS

Read-only evidence audit of [#24263](https://git.cafe/pingdotgg/t3code/pulls/24263). **PASS scoped proof freshness; no source blocker found in the requested integration scope.** The old C++ byte totals are superseded by a fresh capture. This is not merge authorization, current-head CI approval, or native release validation.

## Exact pins and publication state

- Audited local head: [efa3bb6](https://git.cafe/pingdotgg/t3code/commit/efa3bb66a594c9d5d687ad460a73f3cfff6bb95c) (`efa3bb66a594c9d5d687ad460a73f3cfff6bb95c`).
- Integrated main / actual merge base: [bf5c483](https://git.cafe/pingdotgg/t3code/commit/bf5c483cbe298032fe5f97b05f31f8458aab0031) (`bf5c483cbe298032fe5f97b05f31f8458aab0031`).
- Prior first parent: [42a0cf3](https://git.cafe/pingdotgg/t3code/commit/42a0cf350f568e431e8884b9440a158df21875c9) (`42a0cf350f568e431e8884b9440a158df21875c9`).
- Published evidence endpoints: [26c3625](https://git.cafe/pingdotgg/t3code/commit/26c3625f484eadd4d5b6ca5a3dd1f8f8bd5533b4) → [6fc097e](https://git.cafe/pingdotgg/t3code/commit/6fc097e420b550849c74c780e746b6c0624b6a56).

The requested merge has precisely these two parents and the checkout was clean before and after all checks. The nine-file PR delta is recorded in pr-files.txt. Read-only `cafe pr view` still reports published head [42a0cf3](https://git.cafe/pingdotgg/t3code/commit/42a0cf350f568e431e8884b9440a158df21875c9), observed base [d31269e](https://git.cafe/pingdotgg/t3code/commit/d31269e46b32f359b58b4f040ed7d36863fedad3), open, source branch `t3/mobile-audit-markdown-20261023`, target `main`. Therefore local integration evidence is ahead of the forge observation; do not label prior green CI as validation of the audited head. No fetch or push was performed. forge-observation.json records the returned snapshot.

## Independent identity findings

All **1,043 SHA-256 entries** in the downloaded bundle verified, and all 15 source-manifest entries were checked against actual Git objects. source-identity.json contains complete before/prior/head/installed hashes; freshness-results.json includes the 70-package parser dependency closure, baseline coordinator hashes and retained result hashes.

- Both entire markdownDocument endpoint modules match the published evidence: baseline `d137da4f04e9a7f7f7feda120c1cc82a4f1dc163de1fe5d706490218fa009538`, head `3b920d1eae45d7d41619ab1ae3700edbe6379ef692517a4eca87dc1844ad6f2c`. Current-main versus archived-baseline markdownDocument and regex diff is empty. The whole HTML implementation, production file regex and parser algorithms are therefore unchanged. All three focused test files are byte-identical. The 70 transitive parser package resolution/integrity and snapshot blocks match the archived baseline lock; installed unified/remark-parse/remark-gfm versions are 11.0.5/11.0.0/4.0.1.
- Native test body is unchanged (`5f87570e5d43d190cf2840c91c7ad4b4b06297b41d7587f915db253636ad4632`). Wrapper matches the prior audited first parent (`8d3809b864154d14375b4ede35393137c1caa5f8bce112e2cc92c5e42cf4448b`), while differing from the older bundle as the follow-up audit already documented. Reviewed current argument dispatch, extraction, cleanup and Linux guard; no fresh Foundation execution or 13-case wrapper replay claimed.
- Patched t3.16 coordinator header and implementation match archived t3.15 patched sources exactly; unpatched t3.16 baseline coordinator also matches the archived baseline. Pending MODEL reuse is justified on both sides.
- Cache **class** matches exactly, SHA-256 `bfe3810ec78c952dc6240b7f3d177fbb1b31b323b7e668318548627c71617df2`. Whole cache header/key/hash do not: main adds `imageSourcesFingerprint`. Consequently **old cache measurement bytes cannot be reused**. Fresh proof below replaces them.
- The complete prefix before `class MeasurementCache` (key/equality/hash/prop helpers, including image fingerprint construction) is byte-identical to integrated main; the patch changes only cache storage methods there. The renderer differs from main only in the intended import/pipeline replacement (renderer-main.diff). Main's renderer/image integration survives intact. Portable added assertions check two differing image fingerprints remain distinct in equality, hash and cache lookups; omitted React prop helpers are proven by source identity, not host execution.
- t3.16 archive SHA-256 `2cbace50e25ac5ba20d839043b5c3e05e90cab36317522d22a9c1e6d8eb95b05`; patch `6211031776a487f3a0b1242420a47e1336c8ec1a18e987bf6369a4faff491bd0`. Archive is identical at main and head; patch applies successfully; installed cache/coordinator files exactly match extracted archive plus patch. Lock hash and workspace mapping select this patch. These are stronger identity checks than refreshed hunk offsets alone.

## Fixture matrix and measured proof

Full cases, scope, freshness and artifacts are in fixture-matrix.csv / fixture-matrix.json.

| Proof | Disposition | Result |
|---|---|---|
| Focused source tests | Fresh at audited head | **29 / 29**, three files |
| JS full/streamed/generated fixtures | Reused by exact endpoint + parser dependency identity | **40,225 comparisons, 0 differences** (4,574 + 6,176 + 29,475) |
| Mixed growing JS stream | Archived host samples, applicable source | 27 updates; **81 → 54 parses**, **2896.152 → 1632.552 ms** median; final 27,100 input / 29,100 maximum output UTF-8 bytes |
| Portable C++ growing cache | **Fresh actual extracted t3.16 C++** | **269,254,656 → 8,388,416 accounted bytes**, **512 → 8 entries** |
| Pending burst / inflight / invalidation | Reused **HOST MODEL ONLY**, both coordinator endpoints identical | **134,479,872 → 524,288** modeled captured source bytes; latest revision **512** applies |
| Stalled main queue | Retained MODEL limit | Completed apply captures can accumulate; **no global two-revision memory bound** |
| Foundation/ObjC/iOS/device / Android render | **UNVERIFIED** | No native runtime, device, emulator, app layout or native memory execution |

JS families include plain, mixed file/table/HTML, unmatched backticks, 3,000 malformed fragments, main anchors/entities/fenced anchors, pipe/escaped-pipe fallback, nested fences, LF/CRLF/CR and every UTF-16 prefix including surrogate boundaries. The archived comparisons are retained observations, not newly executed tests here. JS bytes are logical UTF-8 payload/stage counts, not heap/RSS/AST/GC peaks; wall times are host observations, not device speed guarantees. No relevant JS or pending recapture was required after exact endpoint identity; no native package upgrade claim extends the JS proof to actual rendering.

Fresh portable C++ compiles and runs actual extracted key/hash/cache bodies with Ubuntu GCC 13.3, C++20/O2, CGFloat=double, private state exposed, unrelated React prop helpers omitted. Two warmups/eight retained samples per side; 512 growing revisions × 1024 ASCII bytes; no timer waits or performance assertions. Key/entry structs are now **280 / 296 bytes**, previously 272 / 288. Fresh before/after median wall times **317.386632 / 87.558696 ms** include instrumentation summing all keys after each insertion. This is narrow portable host proof, not iOS execution or native speed/heap/RSS evidence. The 8 MiB cap counts both key copies and structs; it excludes allocator/node/bucket overhead, string capacity, callers and rendering state. All current native harness cache assertions passed: byte eviction/LRU, all six oversized string fields, update/removal, exact boundary/overflow and 512-entry eviction, plus image-key separation assertions. Raw samples and generated source hashes are in cache-results.json; source and stdout in before/after-cache.cpp/log.

## Reproduction

Run sequentially from the existing pinned checkout. All generated proof data is outside Git. The downloaded/extracted published bundle remains unchanged in `evidence/`; its hardcoded legacy scripts should not be run blindly because they write the earlier scratch location and pins.

```sh
cd /home/ubuntu/wt/pr-24263
python3 /tmp/takeover-24263/integration-pass4/identity.py
python3 /tmp/takeover-24263/integration-pass4/freshness.py
python3 /tmp/takeover-24263/integration-pass4/cache-proof.py
cd apps/mobile
vp test run --config /tmp/takeover-24263/integration-pass4/evidence/focused.config.mjs --cache false
cd /tmp/takeover-24263/integration-pass4/evidence
sha256sum -c SHA256SUMS
```

identity.py re-extracts the pinned archive and applies only the scratch patch; it reads installed files but never modifies them. freshness.py verifies actual Git/archived sources and parser lock closure. cache-proof.py rebuilds both actual portable harnesses from current pins and the unchanged test body. write-report.py creates the fixture matrix and this report from retained results. Re-running capture replaces observational samples and requires regenerating this report and pass4-SHA256SUMS.

## Limits and FRICTION

**No confirmed integration source defect. Evidence correction required and completed:** t3.16 key layout changed even though the cache class did not. The previous 269,246,464 → 8,388,288 counts describe the old key layout only; use the fresh counts above for this head. The published prior report's broad whole-native-source identity claim must not be carried forward to t3.16.

FRICTION: forge publication lags local audited head; parent must reconcile before merge. The source-proof lock reader initially encountered the lockfile's early package/snapshot diff metadata and empty entries; corrected it to read the final actual sections and quoted/empty blocks, then all 70 dependency checks passed. No dependency installation, native facilities, browser/server/emulator/remote machine/userdata access, source edits, commits, pushes, uploads or subdelegation occurred. T3 PR registration and read-only forge queries were the only app/forge interactions. Parent owns evidence upload and publication. Linux emulator reservation is not a blocker for this expressly scoped audit.

Audited by gpt-6.1-sol through the Codex harness in T3 Code.