# Proof audit, pass 1

## Findings

1. **Proof is insufficient.** The Verification section of [#32913](https://git.cafe/pingdotgg/t3code/pull/32913) has no uploaded fixture transcript, recording, or driver. Its fixture bullets name useful scenarios but omit per-endpoint request counts, actual retry intervals, final diagnostics, and cancellation/process-cleanup observations. None of the required synthetic capture rows below is fully satisfied by the PR body. A prose claim is not a recording.
2. **The advertised full 5xx coverage is contradicted by the launcher.** Its `TRANSIENT` set is exactly 408, 429, 500, 502, 503, 504. Responses such as 501, 505, 507, 524 and 599 fail on the first request, unlike the shell and PowerShell implementations. L04 needs either a changed implementation or a narrower, accurate claim; a capture cannot make the present full-5xx claim true.
3. **Network failures have two distinct boundaries.** The launcher retries rejection of `fetch`, but checksum `.text()` and archive iteration happen outside `get`'s retry loop. PowerShell's interactive HttpClient path similarly retries `GetAsync(...ResponseHeadersRead)` but not stream reads. A 200 response whose body subsequently breaks is therefore a separate fixture from a dropped connection before headers. L12, L13 and P17 are gaps in the broad network-error / “behave the same way” claims, not assertions that this PR newly introduced body-read failures.
4. **Existing real-GitHub evidence is contextual, not a deterministic retry proof.** The inline transcript contains final exits and whole-run durations, without the fix run's actual HTTP responses or requests. It cannot establish which request retried, four attempts, backoff, Retry-After handling, or Ctrl-C. The replaced `curl --retry` iteration proves no current row. The launcher source is byte-identical between the old recorded commit and the requested head; the shell and PowerShell files include later main changes, although their retry helper bodies are equivalent. The body must distinguish this from captures run at the requested merged head.
5. **Availability:** Linux dash, bash, Node 26.12.1, curl 8.5.0, GNU wget 1.21.4, BusyBox, and util-linux `script` are installed. Neither `pwsh` nor Windows PowerShell is installed or on PATH; common PowerShell installation locations are absent. Windows, macOS, old curl builds, and a real Windows installation were not verified in this audit. These are explicit limits, not inferred successes.

## Revision and scope

- Read-only checkout: `/home/user/wt/pr-32913`; clean before audit. No edits, pushes, comments, or ref updates there.
- Requested head: [bf2dd0eb6b](https://git.cafe/pingdotgg/t3code/commit/bf2dd0eb6b3ab7f17a032ae7e023fc29a192550f).
- Requested comparison: [bcee0f5d28](https://git.cafe/pingdotgg/t3code/commit/bcee0f5d2872ba193c66ed9ba979bbe424f89ff9), confirmed its merge-base with the requested head. Local `main` is a different revision; it was not substituted for the requested base.
- At retrieval, `cafe pr view` and `cafe pr status` still identified [2096050d4d](https://git.cafe/pingdotgg/t3code/commit/2096050d4d6b030ee50095521f643c700b2e67e2) as PR head. Existing checks/reviews therefore are not presented as fresh checks of the requested head.
- Full diff inspected: the three runtime scripts and the two changed test files. No web, desktop-render, or mobile paths change. No screenshots or browser pass apply.
- This pass derives required proof; it does not execute the full capture matrix or independently rerun the claimed test/check commands.
- Started 2026-11-10 10:15 UTC, with a 45-minute ceiling. Disk initially 107 GB available. All artifacts are under `/tmp/lead-32913-r1/proof-audit-1/`.

## Code and caller inventory

All links below are pinned to the requested head.

| Script | Changed branches and all callers |
|---|---|
| [install.sh](https://git.cafe/pingdotgg/t3code/blob/bf2dd0eb6b3ab7f17a032ae7e023fc29a192550f/scripts/install.sh#L68) | `backoff`: 408/429 accepted; other 4xx final; every other status/error eligible; attempt <4 sleeps 1/2/4, attempt 4 stops. `fetch` curl: only exit 0 + 2xx breaks as success; nonzero curl exit is preserved as generic failure; 404 becomes exit 44; other final statuses print GET diagnostic. Callers: stable latest (197), nightly/preview paginated API (202), SHA256SUMS (243), noninteractive archive through `download` (120,251). Wget branch of `fetch` is unchanged and has its own retry policy. |
| [install.sh interactive download](https://git.cafe/pingdotgg/t3code/blob/bf2dd0eb6b3ab7f17a032ae7e023fc29a192550f/scripts/install.sh#L102) | `download_start` chooses curl or wget; curl adds `.status`, `.headers`, `.errors` sidecars. `download_retry` reaps PID, clears it, requires nonzero exit AND a status file AND successful backoff; otherwise stops. Successful backoff increments the same attempt and respawns. `download` runs its existing progress loop for every transfer, with length present/absent/malformed and redirect headers; success removes sidecars, failure emits downloader errors and leaves staging cleanup to EXIT. INT/TERM traps at 235-237 kill/wait only the current captured download PID. |
| [install.ps1](https://git.cafe/pingdotgg/t3code/blob/bf2dd0eb6b3ab7f17a032ae7e023fc29a192550f/scripts/install.ps1#L69) | `Wait-Retry`: attempt >=4 or ordinary 4xx returns false; 408/429, 5xx, status 0, and other values sleep 1/2/4. `Invoke-Retrying`: returns successful scriptblock output; catches exceptions, converts `Response.StatusCode` to int (missing response becomes 0), retries or rethrows the same final exception. Callers: stable `Invoke-RestMethod` (159), paginated nightly/preview `Invoke-RestMethod` (164), `Invoke-WebRequest` through `Fetch` (83). `Fetch` callers: checksums without `-progress` (196), archive with `-progress` (204). |
| [install.ps1 transport choice](https://git.cafe/pingdotgg/t3code/blob/bf2dd0eb6b3ab7f17a032ae7e023fc29a192550f/scripts/install.ps1#L80) | `!progress OR !interactive` uses IWR. Checksums always use IWR, including on a terminal. Archive redirected/no-terminal uses IWR with SilentlyContinue; terminal lacking ANSI/glyph support uses IWR with Continue. Only interactive archive uses HttpClient. HttpClient separately handles GetAsync exceptions as status 0, successful status, retryable status with response disposal, final status/EnsureSuccessStatusCode, then unwrapped stream reads and file writes with finally disposal. SHA256SUMS 404 is inspected by its caller and must retain `Response.StatusCode.value__` after rethrow. |
| [npm-launcher/t3.mjs](https://git.cafe/pingdotgg/t3code/blob/bf2dd0eb6b3ab7f17a032ae7e023fc29a192550f/scripts/npm-launcher/t3.mjs#L23) | `get`: fetch succeeds or rejects; attempt 4 short-circuits before retry classification/cancellation; six named transient statuses retry after optional body cancel; cancel rejection shares the catch; final fetch rejection is rethrown; sleeps 0.5/1/2. Final 404 has a special message; all other non-ok statuses use GET error. Exactly two HTTP callers: checksum `get(...).text()` (81), archive `download` -> `get` (47,93). No latest-release lookup: version comes from package.json. `main` skips install on a complete cached version. CLI args including `up` and service/IPC entry use the same install/get path before child spawn. Archive text/stream reads, hash, disk writes, extraction, validation, publishing, and post-spawn signal forwarding are outside get retries. |
| [install.test.ts](https://git.cafe/pingdotgg/t3code/blob/bf2dd0eb6b3ab7f17a032ae7e023fc29a192550f/scripts/install.test.ts#L64) | New table row is stable latest 504 once then JSON success, Linux `sh`, noninteractive, precompleted cached target. It isolates lookup and does not exercise archive retry, progress, timing assertions, or attempt exhaustion. The preview row is existing and injects zero failures. |
| [build-npm-launcher.test.ts](https://git.cafe/pingdotgg/t3code/blob/bf2dd0eb6b3ab7f17a032ae7e023fc29a192550f/scripts/build-npm-launcher.test.ts#L350) | New non-Windows regression injects one global first-request 504; the first request is asserted as SHA256SUMS. It verifies eventual executable/marker success. It does not inject archive failures, assert exact repeated request counts or intervals, or cover other retry classes. |

## Fixture driver and capture contract

- **Synthetic data:** version `1.2.3`; stable JSON `{ "tag_name": "v1.2.3" }`; pretty-printed API arrays with 100 nonmatching nightly tags on page 1, matching non-draft nightly or preview on page 2. Use separate version strings `1.2.4-nightly.20261110.1` and `1.2.4-preview.20261110.1` for those runs. Serve a tiny platform-named archive with a synthetic executable printing its version, plus its actual SHA256SUMS. For Windows full-install proof, use a synthetic executable that actually runs on Windows; a Linux shebang file named `t3.exe` is only a Linux helper fixture.
- **Driver:** local HTTP server with per-path scripted sequences and timestamped request events. Log run name, exact command, script SHA256, base/head, shell/runtime/downloader versions, terminal detection, endpoint + response status, connection events, output chunks with timestamps, exit code, expected marker and final directory contents. Use monotonic relative intervals as well as wall timestamps. Run each endpoint independently unless a row explicitly tests the shared attempt budget.
- **Fresh state:** driver makes a new timestamped subdirectory under the designated scratch root for every run; use isolated `HOME`, `T3CODE_HOME`, `T3CODE_INSTALL_BIN_DIR`, `TMPDIR`, and analogous Windows temporary paths. Leave prior runs intact. Cache rows are intentionally preseeded. Never use live T3 state.
- **URL injection:** all three scripts accept `T3CODE_RELEASE_BASE_URL` for sums/archive. Shell and PS additionally accept `T3CODE_VERSION` to bypass discovery. Discovery URLs are hardcoded: the mirror variable does NOT redirect latest/API. For discovery, transparently remap curl/wget's URL via a PATH shim that execs the real downloader, or copy the source into scratch and replace only the two GitHub origins as the existing test does. Record source hashes and the exact replacement. For PS, use a scratch copy with only those origins replaced or a cmdlet wrapper forwarding to the real module-qualified cmdlet. Never simulate HTTP by replacing the request results. A source-transformed run is explicitly a fixture run, not a pristine public-origin install.
- **PTY:** noninteractive means stderr redirected or TERM=dumb, not merely stdin piped. To exercise the documented `curl ... | sh` entry with interactive download, pipe the script on stdin while leaving stderr on a PTY and TERM=xterm. Use Python pty or `script` with timing. Drive Ctrl-C through the terminal process group. Record the foreground shell, downloader PID obtained from spawn instrumentation, connection close, exit, absence of later requests, staging state, and that captured PID has exited. Never find a PID by pattern.
- **recording:** every row involving a wait, retry, no-retry timing assertion, progress transition, dropped connection, or interaction needs a timestamped transcript or asciinema-style recording. A still or un-timestamped final log is insufficient. One recording may contain multiple clearly delimited fixtures. Do not replace sleeps with no-ops in timing proof. The helper-only optional-branch probe may instrument timers but cannot substitute for actual interval recordings.
- **Equivalent inputs collapsed:** 408 and 429 have their own classifier rows; representative 504 covers the selected 5xx branch, with 507 covering the all-5xx-vs-enumerated-set distinction. 403 represents ordinary 4xx, while 404 has its own caller-specific error behavior. Alternate Retry-After syntax is ignored without parsing and is paired in a row rather than cross-multiplying every header/status/endpoint. Each named endpoint or transport in a cell is an explicit capture requirement; unrelated rendering/platform options are not blindly cross-multiplied.

### Minimum runtime notation

- **SC:** install.sh, curl 8.5.0, Linux dash. Repeat every shell row that changes retry/cancellation behavior under `bash --posix`; unchanged controls need one dash run. `F` = shared foreground fetch, representative SHA256SUMS unless a caller is specified; `D` = interactive archive download on a PTY. When a row says F+D it requires both.
- **SW:** install.sh with curl absent from a purpose-built PATH and real GNU wget present. Run the changed interactive loop on both dash and bash --posix; foreground wget control needs dash only. No fake downloader results.
- **P7:** install.ps1 request helpers under real PowerShell 7 on Linux, reporting exact version; **R** = IRM, **W** = IWR, **H** = HttpClient. Use real local HTTP, exact helper source, and `Fetch` with PTY when testing dispatch. A helper-only run does not prove full Windows installation. `pwsh` is absent on this host, so rows remain unverified, but become producible with a portable pwsh installed under scratch or another supplied runtime.
- **PW:** Windows PowerShell 5.1 on Windows. Required compatibility proof is explicitly listed in P24; cannot-verify windows here. A PS7 Linux transcript does not satisfy it.
- **N:** actual launcher copied into scratch as `package/bin/t3.mjs` beside synthetic package.json version 1.2.3; Node 26.12.1, Linux x64. Fresh home per run. The same get helper is used for both archive formats and all supported OSes, so the HTTP-classification matrix need not be multiplied by OS. Windows artifact extraction is unchanged and is outside this retry-only matrix.
- **Effects:** D = directly changed behavior; C = caller/integration behavior reached through the change; U = unchanged control; O = optional context outside the minimum set.
- **Status:** MISSING = requires a new uploaded recording/transcript; CLAIMED = related prose only, still needs a new upload; PARTIAL = an existing test or inline transcript covers only the stated subset; CONTRADICTED = source does not support the stated claim; CANNOT = unavailable runtime; OPTIONAL = not needed to close this proof audit. No required row is marked satisfied merely because its code exists.

## Matrix

| ID | Named fixture and data | Effect | Minimum script × runtime × path capture | Required observations / media | Existing evidence and status |
|---|---|---|---|---|---|
| S01 | Stable lookup: latest 504 once, then 200 stable object | D+C | SC, stable discovery, cached version to isolate lookup | **recording**: same latest URL twice, Accept JSON, ~1s gap, resolved version; base fails first response | New install.test row + body test claim; no upload or request timing. **PARTIAL** |
| S02 | Train lookup: page1 nonmatching tags; page2 504 once then matching nightly/preview array | D+C | SC, one nightly and one preview run | **recording**: page2 retried in place, page1 not replayed; matching version | Existing preview test has no error. **MISSING** |
| S03 | Stable lookup recovers to 200 with no matching tag | C | SC latest, object with nightly-only or missing tag | **recording**: exactly one retry, then could-not-find error; no asset request | **MISSING** |
| S04 | Train lookup recovers to empty page OR ten nonmatching populated pages | C | SC API, one empty-page run and one page-cap run | **recording**: empty ends discovery; cap stops at page10; retry itself does not consume page budget | **MISSING** |
| S05 | Checksums 504 once then valid 200; archive healthy | D+C | SC checksum F, full fresh install | **recording**: only checksums repeated; correct marker, executable and symlink | Shell fixture prose does not identify endpoint. **CLAIMED** |
| S06 | Piped/non-TTY archive 504 once then valid 200 | D+C | SC archive via F, stderr pipe/TERM=dumb | **recording**: archive repeated, valid checksum/executable, no progress path | Broad piped fixture claim. **CLAIMED** |
| S07 | Interactive archive 504 once then slow 200 with Content-Length | D+C | SC D, script piped on stdin and stderr PTY | **recording**: new transfer PID, progress resumes, 100%, sidecars removed, installed marker | Broad PTY fixture claim; no recording. **CLAIMED** |
| S08 | Interactive retry ends in chunked/no-length 200, with partial output followed by success | D+C | SC D; valid archive streamed without length; include a redirect whose length differs | **recording**: no stale length, indeterminate progress then completion; valid file | **MISSING** |
| S09 | HTTP 408 once then 200 | D | SC F+D | **recording**: two requests, ~1s gap and success | Broad status fixture claim. **CLAIMED** |
| S10 | HTTP 429 once then 200, no Retry-After | D | SC F+D | **recording**: two requests and success | Broad status fixture claim. **CLAIMED** |
| S11 | Other 5xx: 507 once then 200; use 503 as common-status control | D | SC F+D, 507 required; 503 may share run bundle | **recording**: full 5xx policy, not just 504, retries once | Body names 503, not omitted-Node-set statuses. **PARTIAL** |
| S12 | HTTP 403 permanent, followed by a sentinel 200 that must never be requested | D | SC F+D | **recording**: one request, immediate failure, final downloader/GET diagnostic | 403 immediate-error prose only. **CLAIMED** |
| S13 | SHA256SUMS 404 | C | SC F, exact version set | **recording**: one request, preserved exit44 mapping, special old-release/no-archive message; no archive | 404 same-message prose only. **CLAIMED** |
| S14 | 404 at discovery or archive | C | SC latest; API; archive F; archive D | **recording**: each makes one request; lookup exits, archive paths preserve their own final diagnostics | Body does not identify callers/interactive diagnostics. **CLAIMED** |
| S15 | HTTP 504 four times; sentinel fifth 200 | D | SC F+D | **recording**: exactly four requests, gaps ~1/2/4s, none after fourth; final errors vs base | Four-504/~7s prose only. **CLAIMED** |
| S16 | 504 three times, success on fourth | D | SC F+D | **recording**: all three backoffs occur and fourth success is accepted; no fifth | **MISSING** |
| S17 | Disconnect before headers once, then healthy 200 | D | SC F+D | **recording**: curl nonzero/000; successful retry, no partial error body installed | Dropped-connection prose lacks boundary/caller. **CLAIMED** |
| S18 | Connection refused on every attempt | D | SC F+D, reserved closed loopback port | **recording**: four connection attempts/curl exits, ~7s wait; same terminal network error | Refused/~7s prose only. **CLAIMED** |
| S19 | 200 headers plus truncated checksum/archive body once, then healthy response | D | SC checksum F; archive F; archive D | **recording**: curl nonzero with HTTP200 still retries, destination overwritten, correct final hash | “Dropped connection” is ambiguous; no explicit body-read proof. **MISSING** |
| S20 | Retry-After 120 on 429 and 503, then 200; paired HTTP-date variant | D | SC F+D, two status runs plus one date variant | **recording**: ~1s gap, not 120s; no library-added wait | Body claims 503/429 integer120, not uploaded. **CLAIMED** |
| S21 | Status transition 504 ->403/404; network failure ->504 ->200 | D+C | SC F+D, one permanent-status run plus one mixed-success run | **recording**: permanent 4xx stops immediately; mixed failures share attempt counter (1s then2s), final error policy correct | **MISSING** |
| S22 | Unresolved 302 with no Location | D+U | SC F and D, separate runs | **recording**: F retries four times then GET302 error; D curl exit0 does not restart and later checksum validation fails. No generic promise that only 5xx are retried | **MISSING** |
| S23 | Download/output write error with HTTP200, not a network error | D | SC F+D helper-level destination in nonexistent/unwritable parent | **recording**: curl exit !=0, bounded four attempts; records current broad error eligibility without calling it network recovery | **MISSING** |
| S24 | Ctrl-C while second/restarted slow archive transfer is active | D+C | SC D PTY, first504 then held 200 stream | **recording**: terminal Ctrl-C, exit130, captured active curl PID exits, socket closes, no install/marker/staging leak or next request | Body asserts Ctrl-C works; no evidence of interaction. **CLAIMED** |
| S25 | Ctrl-C during backoff, with download_pid already cleared | D+C | SC D PTY, signal during 2s or4s wait | **recording**: exit130; no respawn after signal, no downloader left, staging cleaned | **MISSING** |
| S26 | wget-only foreground 504 ->200, plus SHA256SUMS404 | U | SW F, two runs | **recording**: native retries retain existing behavior; 404 exit44 mapping. Do not assert curl's four-attempt/7s policy for wget | Audit spot-probe GNU wget1.21.4: 504 then200 ~1s later, exit0. Not a full installer capture or uploaded fixture log. **PARTIAL** |
| S27 | wget-only interactive success and permanent403 failure | D+U | SW D PTY, healthy/504->200 success and403 failure runs | **recording**: changed reaping loop works without `.status`; native retries only; failures emit headers and clean staging | Body says wget unchanged but changed download loop still reaches it. **MISSING** |
| S28 | Existing complete cache and exact version | U | SC one dash run, mirror points to server that records unexpected calls | Transcript: no discovery/sums/archive requests; same launcher link result | Existing install tests exercise cached targets; not retry proof. **PARTIAL** |
| S29 | Older curl ignores long Retry-After in both helper paths | D | install.sh under dash: curl7.68 and7.74, F+D, 429/503 with120; bash portability already covered by SC | **recording**: report actual curl versions, exact source, ~1s retry rather than120s | Body claims both builds, no driver/log. **CLAIMED** |
| S30 | macOS /bin/sh compatibility and BusyBox wget compatibility | C+U | macOS arm64 /bin/sh: S07/S15/S24/S25; Linux BusyBox wget-only: S26/S27 | **recording**: platform versions, retry/process semantics; wget differences remain explicit | Body explicitly not checked. macOS unavailable here; BusyBox installed but not run. **CANNOT macOS / MISSING BusyBox** |
| P01 | IRM stable504 ->200 stable object | D+C | P7 R, exact discovery URL remapped; cached version | **recording**: two requests, output remains parsed object, correct version | Generic PS7.4.6 helper prose. **CLAIMED; local pwsh unavailable** |
| P02 | IRM train page2 504 ->200 matching array | D+C | P7 R, nightly and preview, page1 nonmatch | **recording**: same page retried, output array preserved, draft filtering still works | No endpoint-specific claim. **MISSING; local pwsh unavailable** |
| P03 | IWR SHA256SUMS504 ->200 | D+C | P7 W, Fetch without-progress, including terminal run | **recording**: checksums always use W; two requests, valid bytes | Generic helper prose. **CLAIMED; local pwsh unavailable** |
| P04 | IWR archive504 ->200 with stderr redirected | D+C | P7 W, Fetch -progress noninteractive | **recording**: W selected, output file complete, no unhandled progress output | Generic helper prose. **CLAIMED; local pwsh unavailable** |
| P05 | Terminal archive fallback when ANSI/glyph check rejects interaction | C | P7/PW W, actual terminal with unsupported ANSI or encoding; alternatively exact dispatch helper probe labelled as such | **recording**: terminal=true, interactive=false, ProgressPreference Continue, retries W rather than H | No terminal/encoding evidence. **MISSING; Windows case cannot-verify windows** |
| P06 | HttpClient archive504 ->slow200 with known length | D+C | P7 H, actual interactive Fetch -progress/PTY | **recording**: non-success response disposed, second response consumed, progress and file complete; client disposed | Generic helper prose, no PTY or disposal evidence. **CLAIMED; local pwsh unavailable** |
| P07 | HttpClient retry succeeds with chunked/no-length body | C | P7 H, slow chunked200 after503 | **recording**: indeterminate progress, no stale content length, finally disposals and valid bytes | **MISSING; local pwsh unavailable** |
| P08 | HTTP408 once then200 | D | P7 R+W+H | **recording**: ~1s, two requests, preserves transport return/file behavior | “Behave the same way” unspecified probes. **CLAIMED; local pwsh unavailable** |
| P09 | HTTP429 once then200 | D | P7 R+W+H | **recording**: ~1s, two requests | Generic helper prose. **CLAIMED; local pwsh unavailable** |
| P10 | HTTP507 once then200 | D | P7 R+W+H | **recording**: confirms full5xx policy beyond launcher set | No explicit507 probe. **MISSING; local pwsh unavailable** |
| P11 | Ordinary4xx:403 permanent;404 on lookup/archive | D+C | P7 R+W+H, 403 each; 404 R and archive W/H | **recording**: one request per run, final original exception retained, H EnsureSuccessStatusCode error | Body only explicitly mentions checksum404. **MISSING; local pwsh unavailable** |
| P12 | SHA256SUMS404 preserves original Response.StatusCode | C | P7 W through actual checksums caller | **recording**: one request, special no-release-archive message through `.value__`, not generic error | Explicit PS404 status-carrying prose, no transcript. **CLAIMED; local pwsh unavailable** |
| P13 | Four HTTP504s, fifth sentinel200 | D | P7 R+W+H | **recording**: four requests, gaps1/2/4s, rethrow last exception; disposal on H retries/final | Generic “same way” does not give counts/errors. **CLAIMED; local pwsh unavailable** |
| P14 | Three504s then fourth200; mixed network ->504 ->200 | D | P7 R+W+H, two runs each | **recording**: fourth success, shared budget across catch/status branches, no reset | **MISSING; local pwsh unavailable** |
| P15 | Preheader drop once then200; permanent refused connection | D | P7 R+W+H, two runs each | **recording**: missing Response casts0 for R/W; H catch uses0; four attempts only on persistent failure, original last error | Generic network probe prose, no boundary/counts. **CLAIMED; local pwsh unavailable** |
| P16 | Truncated 200 body in IRM/IWR, then healthy200 | D | P7 R+W; W sums and archive representative | **recording**: real cmdlet body-read exception retries, output overwritten, no mixed object/file output | Not proven by broad network prose. **MISSING; local pwsh unavailable** |
| P17 | Truncated200 body in interactive HttpClient archive | U boundary | P7 H PTY, declared larger Content-Length, socket closes after partial bytes | **recording**: read fails outside retry loop, only one archive request, finally disposal. Claim of all transports behaving alike for network drops is too broad | Source confirms unwrapped read boundary. **CONTRADICTED broad claim; capture missing** |
| P18 | Retry-After120/date on429 or503 | D | P7 R+W+H, integer120 plus one date variant | **recording**: no implicit long cmdlet/HttpClient wait; ~1s gap | Generic same-way prose only. **CLAIMED; local pwsh unavailable** |
| P19 | Retryable error then403/404 | D+C | P7 R+W+H; checksum caller specifically ends404 | **recording**: stops after second request; error retains final status and special checksum mapping | **MISSING; local pwsh unavailable** |
| P20 | Successful200 has missing tag/empty API page, or invalid checksum content | C+U | P7 R latest missing tag; R API empty/page10-cap; W sums wrong digest or absent archive line | **recording** when preceded by504: HTTP-success content is not retried; caller's existing error/end condition remains | **MISSING; local pwsh unavailable** |
| P21 | Local destination write failure | D+U | P7 W invalid destination; H valid headers followed by invalid file path | **recording**: W exception without Response is retried as0; H file creation is outside retry loop. Distinguish local I/O from network recovery | **MISSING; local pwsh unavailable** |
| P22 | Ctrl-C during retry sleep | D+C | P7 R/W/H, representative retry wait for each mechanism | **recording**: terminal interrupt stops retries, no later requests/success; resources and staging state shown | **MISSING; local pwsh unavailable** |
| P23 | Ctrl-C in restarted active HttpClient archive stream | D+C | P7 H PTY, first504 then slow200 | **recording**: cancellation, connection/disposal, no marker, no running request/child after exit | **MISSING; local pwsh unavailable** |
| P24 | Windows PowerShell5.1 exception/terminal compatibility and complete install | C | PW on Windows: R/W/H status504 recovery + ordinary403 + sums404 + preheader network failure; full fresh install; Ctrl-C active/backoff; archive IWR fallback with legacy encoding | **recording**: actual Windows5.1 version, status extraction not masked by cast errors; actual executable/shim; no terminal/cleanup regression. PS7 Linux helpers do not substitute | Body expressly not checked. **CANNOT-VERIFY windows** |
| L01 | SHA256SUMS504 once then200 | D+C | N checksum get, full fresh install | **recording**: same sums URL twice, ~0.5s gap, marker/executable success; base fails first504 | New launcher regression + test-pass claim; no uploaded capture/counts. **PARTIAL** |
| L02 | Archive504 once then200 | D+C | N archive get, first with stderr pipe and then PTY slow body | **recording**: only archive repeats, reset-free successful hash/install, progress appears in PTY | Real-GitHub outcomes do not identify fix-side archive responses. **MISSING** |
| L03 | Other named transient statuses408/429/500/502/503 | D | N get helper via checksum, one run per explicit set member; archive wiring covered L02 | **recording**: each retries once then200; failed response body cancelled before retry | No deterministic launcher probes claimed beyond504. **MISSING** |
| L04 | Unlisted5xx:507 then sentinel200 | D boundary | N checksum get; representative501/505/524/599 may share bundle | **recording**: current source fails after one request. Full5xx claim requires narrowing or fix | `TRANSIENT` excludes these statuses. **CONTRADICTED** |
| L05 | Ordinary403 and special404 | C+U | N sums and archive, each status at each caller | **recording**: one request only;403 GET diagnostic,404 version-aware does-not-exist message | No launcher permanent-status transcript. **MISSING** |
| L06 | Four504s then sentinel fifth200 | D | N checksum get; archive error wrapping covered byL02/L05 | **recording**: exactly4 requests, ~0.5/1/2s gaps, GET504 after last; no fourth response cancellation for retry | **MISSING** |
| L07 | Three504s then success on fourth | D | N checksum get | **recording**: final successful response returned/read; no fourth wait | **MISSING** |
| L08 | Disconnect before headers once then200 | D | N get via sums and archive | **recording**: fetch rejects, then success;0.5s gap, no consumed/partially reused response | **MISSING** |
| L09 | Preheader network failure on every attempt | D | N get via closed loopback port or four reset connections | **recording**: four attempts then throws final fetch exception, not stale prior HTTP response diagnostic; ~3.5s wait | **MISSING** |
| L10 | Mixed504 ->network rejection ->200;504 ->403/404 | D | N checksum get, one mixed-success and one permanent-status run | **recording**: shared attempt budget; final nontransient stops without another wait | **MISSING** |
| L11 | Retry-After120/date on429 and503 | D | N checksum get, both integer-status runs plus one date variant | **recording**:0.5s first gap; no120s stall | Body says ignored generally but supplies no launcher fixture probe. **MISSING** |
| L12 | Checksums200 headers then truncated body | U boundary | N checksum `.text()`, declared oversized body then close | **recording**: `.text()` failure outside retries, no second sums request. Broader network-recovery promise needs narrowing or fix | Source boundary confirmed. **CONTRADICTED broad claim; capture missing** |
| L13 | Archive200 headers then truncated stream | U boundary | N archive download, valid sums but oversized declared archive body then close | **recording**: stream failure outside retries; one archive request; staging cleanup/no marker | Source boundary confirmed. **CONTRADICTED broad claim; capture missing** |
| L14 | `response.body` missing or cancel rejects | D synthetic helper branch | N exact `get` in a synthetic fetch wrapper: transient response with null body; transient with cancel throwing; fourth transient response with cancel spy | Timestamped helper transcript: null branch tolerates absence; cancellation exception still consumes attempt/backoff; fourth attempt skips cancel. Local HTTP alone cannot produce every artificial Response shape; label injection, do not claim end-to-end HTTP | **MISSING helper-branch proof** |
| L15 |200 invalid SHA256SUMS/missing archive line, or wrong archive digest | U | N sums missing line and archive wrong-digest runs | Transcript: no network retries after HTTP success solely due to content/hash validation; no complete install | Existing unusable-release tests are relevant controls; no new upload. **PARTIAL** |
| L16 | Complete cache, `up`/ordinary argv, service IPC re-entry | U+C | N cached invocation records zero HTTP; one fresh `up` and one service-style IPC invocation with first504 | **recording** for retried invocations: both use same install path before spawn; existing post-spawn forwarding need not be reaudited | Existing launcher lifecycle test covers shared entry path without injected retry. **PARTIAL** |
| L17 | Ctrl-C during retry wait and during restarted slow archive | D+C | N PTY, two runs: retry sleep, first504 then active200 stream | **recording**: SIGINT exit, no later request/child launch/complete marker; report actual staging leftovers rather than assuming JS finally runs on default signal | **MISSING** |
| T01 | Claimed regression is red on base and green on requested head | C | Exact two changed test scenarios against requested base/head; tests/drivers scoped to scratch | Uploaded transcript: exact commands, revisions, assertions and results; these prove lookup and checksum504 only, not other rows | Body says both fail main and11 pass. Tests inspected, not rerun here. **PARTIAL** |
| R01 | Optional real-GitHub alternating baseline/fix install outcomes | O | Public origin, fresh homes; stable install.sh and packaged launcher | Timestamped transcript with exact source hashes, full fix-side HTTP observation if used to claim retries. Real outages cannot replace fixture matrix | Inline table/log already supplies historical outcomes and durations; no uploaded log/driver. **OPTIONAL / PARTIAL context only** |

## Existing evidence mapping and what must be uploaded

| Existing PR item | What it supports | What it does not satisfy |
|---|---|---|
| New shell regression test source and claimed test run | S01 eventual stable lookup recovery; T01 claimed red/green | No recorded exact counts, timing, downloads, other statuses, other shells or PTY |
| New launcher regression test source and claimed test run | L01 eventual checksum504 recovery; T01 claimed red/green | No archive retry, other statuses, attempt exhaustion, Retry-After, body/network/cancel boundaries |
| Shell local-probe bullets | Claims related to S05-S07,S09-S18,S20,S29; endpoint assignment is not stated | No uploaded artifact or driver; cannot close any named capture row or infer the full endpoint × mode product |
| PS7.4.6 helper-probe bullet | Claims related to P01,P03,P04,P06,P08,P09,P12,P13,P15,P18 | No per-mechanism record, exception details, timing, real PTY, body boundary or full Windows installation |
| Inline real-GitHub final-loop shell/launcher results | R01 historical outcome counts/durations; Node source is byte-identical to requested head | Does not reveal fix-side status sequence or prove any bounded-retry row; shell complete file differs after main merge |
| Earlier replaced curl--retry transcript | Historical context only | Zero coverage of present helper implementation, long Retry-After policy, or interactive loop |
| Check/test command success prose and stored older-head checks | General reported validation of the earlier revision | Not a fixture recording and not fresh CI evidence for requested merged head |
| URLs already present in body | Install script and public release URLs appearing as commands/errors | They are not uploaded capture/driver links. No existing uploaded fixture evidence to inspect |

**Upload required:** timestamped fixture recordings for all required S/P/L rows (except an explicit accepted cannot-verify platform limitation), with a reusable synthetic driver, run manifest, and per-row result index. Multiple rows can share one timestamped transcript if every fixture is separately named and its requests/outcome are visible. Upload exact test red/green proof for T01 if relying on that claim. Narrow or fix L04 and the P17/L12/L13 broad claims before calling the stated matrix sufficient. The matrix itself is a plan/audit artifact, not the missing runtime proof.

## Audit diagnostic, cleanup, and limits

One local diagnostic was run for the wget claim, independently of the full installer. A scoped Python ThreadingHTTPServer scripted504 then200; `/usr/bin/wget -q --server-response <loopback>/fixture -O <scratch>/body` on GNU wget1.21.4 made two requests at10:18:23.521 UTC and10:18:24.522 UTC, then exited0. This supports only S26's native-downloader subcase. The server was shut down/closed and its thread joined in finally; the subprocess completed. Its synthetic record remains in `probe-20261110T101823.514173Z/wget-probe.json`. No fixture evidence was deleted and no server or long-running process remains from this audit.

The local PowerShell absence is recorded rather than installing or substituting an unrequested runtime. The unavailable Windows/macOS cases require an appropriate host. BusyBox is installed and can be driven by the same isolated PATH method. Old curl builds may be placed under scratch and selected by PATH; their absence from the current PATH is not evidence that those historical PR probes ran.

FRICTION:
- infra | `pwsh` and Windows/macOS runtimes are absent here, so their claimed behavior cannot be independently exercised in this pass | supply an identified runtime/host and upload per-mechanism recordings.
- forge | GitCafe metadata/checks still name the pre-merge head while the brief pins the merged head | refresh forge metadata or include an explicit pinned-head manifest with new proof.

VERDICT: INSUFFICIENT S01-S30, P01-P24, L01-L17, T01 missing complete uploaded proof; L04 and broad P17/L12/L13 claims contradicted