milestone 15: make a green run mean a real pass

specs/milestone-15.md

@@ -85,6 +85,23 @@ The session must attempt a root cause, in this order:
 Either way: no check is loosened, no output is filtered, and the spec is
 updated afterward to record which outcome held (per the spec-update rule).
 
+**Outcome recorded (implementation): B — upstream, and this ruling's own
+diagnosis was wrong.** The label is not an abort and has nothing to do with
+mbedTLS. In Zig 0.16.0, `std/Build/Step/Run.zig:1540` sets
+`result_failed_command` unconditionally on every spawn and nothing clears it
+on success; `compiler/build_runner.zig:1381` prints a step's diagnostics
+whenever the child wrote to stderr, "no matter the result", and `:1515` then
+emits the `failed command:` label because the field is non-null. Any Run
+step that succeeds while writing one byte to stderr gets the label; our
+warning-path tests log through the real sink. Minimal reproducer: one
+passing test containing a `std.debug.print` shows the label; the same test
+without the print shows nothing. The old "exits 134 under `--listen=-`"
+observation was a manual-invocation artifact: the IPC runner panics with
+`EndOfStream` (test_runner.zig:88) reading a closed stdin when no build
+runner sits on the other end. Documented in the `b.addTest` comment in
+build.zig and in AGENTS.md ("Reading `zig build test` output"). No matching
+upstream issue found; the 0.16.0 source lines are the reference.
+
 ### 4. The test import list gets a completeness guard
 
 `src/tests.zig:3-119` is a hand-maintained `comptime` block of 115
@@ -182,10 +199,17 @@ arm alongside the existing compiler tests.
 `src/web/http_util.zig` imports only `std`, so the fuzz module roots at a new
 file `tests/fuzz/http_util_fuzz.zig` with `addImport("http_util", <module
 rooted at src/web/http_util.zig>)` — no aggregator. Targets: `parsePath`,
-`decodeInPlace` (both `PlusRule` values), `queryValue`. Invariants to assert,
-both already stated in the file: split-before-decode (a decoded segment never
-gains a `/`), and decode-only-shrinks (result length ≤ input length; result is
-a prefix-aliased slice of the buffer). `dnsParam`/`decodeDnsValue` stay
+`decodeInPlace` (both `PlusRule` values), `queryValue`. Invariants to assert:
+split-before-decode and decode-only-shrinks (result length ≤ input length;
+result is a prefix-aliased slice of the buffer). **Corrected during
+implementation:** the original phrasing "a decoded segment never gains a `/`"
+is false — `%2F` legitimately decodes to a literal `/` inside its segment
+(http_util.zig's own tests assert it), and the fuzz target caught that on its
+first run. The property that holds is a count: segmentation is decided by the
+raw bytes, so each decoded segment pairs with its raw `/`-delimited chunk in
+order, the segment counts match, and each segment is no longer than its
+chunk. A decode-then-split implementation still fails this.
+`dnsParam`/`decodeDnsValue` stay
 private in `doh_server.zig` and stay unfuzzed — recorded, out of scope.
 
 ### 7. The multi-read fetch path gets a real fixture route
@@ -208,7 +232,11 @@ forces the fixture to flush in parts.
 - Prove it can fail: during development, reintroduce the
   `readSliceShort(self.transfer_buf)` aliasing pattern locally and confirm the
   new test dies where the old suite stayed green. Record the proof in the
-  session notes; do not commit the revert.
+  session notes; do not commit the revert. **Proof recorded
+  (implementation):** with the aliasing reintroduced, the new test failed
+  (`expected 1500, found 1238`) while all 1378 other tests stayed green. On
+  this body the bug silently dropped 262 domains rather than crashing — the
+  count assertion does the real work, not the crash.
 
 ### 8. The rotation failure paths get tests