PR 23418 real Linux runtime verification
Head: bdc1dfb8e2906d84dc22c2aa534a0d9bda059bc3
Baseline github/main: 575579d68ac4bae09f8426a345d4a3eac1e90c67

Downloaded the actual v0.1.6 Linux x64 release from GitHub.
SHA256: 7cf31da90dee41f524dd5b679ebb6d404637ca5d9dc6fd8bc019511d57bb77e6
Archive size: 123152548 bytes; matches published SHA256SUMS.
Built each npm launcher with:
node scripts/build-npm-launcher.ts --version 0.1.6 --output-dir /tmp/launcher-{main,pr}

Fault injection: real HTTP release relay serves published SHA256SUMS and
streams two copies of the real archive, either chunked or with declared length.
No launcher source changes, reduced limits, fetch mocks, or fake executable.
Invoked each package bin/t3.mjs --version with isolated T3CODE_HOME and
T3CODE_RELEASE_BASE_URL=http://127.0.0.1:18888/<mode>.

MAIN chunked overflow:
server sent 246305096 bytes; launcher consumed whole response before rejecting:
t3: checksum mismatch for t3-0.1.6-linux-x64.tar.gz
exit=1

PR declared overflow (Content-Length=246305096):
t3: download exceeds 134217728-byte limit
exit=1; versions directory empty

PR chunked overflow:
t3: download exceeds 134217728-byte limit
exit=1; versions directory empty
strace -f -yy -e trace=write,openat,unlink,unlinkat confirms
134133632 archive bytes written, below 134217728; partial archive unlinked.
Socket buffering means relay bytes sent can exceed bytes written to disk.

PR normal release:
t3 v0.1.6
exit=0
Real archive downloaded, SHA256 checked, extracted, native binary executed.

PR cached install with release URL returning 404:
t3 v0.1.6
cached-exit=0

PR fresh install with archive 404:
t3: http://127.0.0.1:18888/404/v0.1.6/t3-0.1.6-linux-x64.tar.gz does not exist yet. If 0.1.6 was just released, try again in a few minutes.
missing-exit=1

Blacksmith: vp test run scripts/build-npm-launcher.test.ts: 1 passed.
Blacksmith: vp run check:changed e5909e53c32a9d5b51caf6352d1f17fd73e86db7:
format, lint, both knip passes, affected scripts typecheck, launcher test passed.
Explicit base used because snapshot runner omits history; fetched PR history first.
Hosted CI checks also green at inspected head.

Real dev web client: Playwright 1.60 from repo dependencies, /usr/bin/google-chrome.
Started PR dev server with explicit --home-dir /home/user/t3code/.t3.
Created project /home/user/t3code through Add project > Local folder.
Selected GPT-6.1-Sol, sent a real provider turn asking it to read git HEAD.
Client streamed and persisted the reply:
bdc1dfb8e2906d84dc22c2aa534a0d9bda059bc3 launcher verification complete
Provider turn completed in 7.4s as shown by client. Working tree unchanged.
The npm-launcher download path was exercised separately from source dev startup;
a dev server alone does not execute the npm downloader.