[speak-agent]

Plan, review rulings (R1–R10) and readings: .agents/docs/2026-09-29-download-attribution-and-install-noise-plan.md.
Consumes libxpkg 0.0.60 (openxlings/libxpkg#45) through mcpplibs/mcpp-index#490.
Companion index change: openxlings/xim-pkgindex (7-Zip quiet + build dep, chatgpt without the Qt shims).

What a user saw on 2026.9.29.1 (a real home)

• install chatgpt@26.917.71314 → sha256 mismatch … got 68e23f…. The recipe was right; the disk was at 100 %. 68e23f… is the sha256 of the correct file's first 220,979,200 bytes: tinyhttps never checks ofs.write, the truncated file was hashed, the host was demoted and its retries skipped.
• The same failure printed three errors: a reasonless [pkg] failed: in the middle of the progress frames, the reason, and download artifact missing.
• install chatgpt reinstalling qt-base printed 7-Zip's banners, listings and a repaired ERROR between [74/88] and [75/88].
• self update on a current home printed xlings -> 2026.9.29.1 twice.
• info chatgpt printed the same 35 deps as runtime deps and again as build deps.

Changes

Area	Change
Download attribution (A2)	xlings::tinyhttps::FailureKind {Source, Transfer, Local, Cancelled}, decided once in the xhttp wrapper. What landed on disk is compared with what the transfer reported before onVerify: a file shorter than received is Local; a short transfer is Transfer (retried); only a complete file with the wrong content is Source (next candidate, host demoted). A destination that cannot be opened is Local
Local failures (A3)	Stop every candidate (another mirror writes to the same disk), demote no host, E_DISK_FULL + hint, the free space in the message. The duplicate "incomplete transfer" check in the downloader is gone (one answerer). indexfetch stops on Local too
Space pre-check (A4)	At the first Content-Length, a disk that cannot hold the rest stops the transfer before it is spent. An unreadable free-space figure never refuses. XLINGS_DOWNLOAD_SPACE_CHECK=off
One error per failed download (B)	The progress callback's -1 only marks the panel row; the result loop emits one Failed status with the reason, code, hint and plan key; the per-node loop no longer reports the consequence
Hook output (C2)	Every run_hook gets ctx.hook_log = <home>/logs/hooks/<ns>-<name>@<ver>.<hook>.log (libxpkg 0.0.60 redirects the hook's children there). A failure prints the last 20 lines and full log: <path>; a hook past 15 s prints … <pkg> install hook running 2m: <last log line> (interface: progress phase hook, protocol 1.5). XLINGS_HOOK_OUTPUT=inherit / -v restore the terminal (never in the interface or TUI); XLINGS_HOOK_HEARTBEAT=<first>:<every>
use / self update (D)	use announces a switch only when something moved (alreadyActive: the target AND every release member already at the selected versions). self update on a current home ends with xlings is already at <v> (latest)
info (E1)	A recipe written deps = { ... } shows one deps row
Build	xpkg 0.0.60; version 2026.9.30.1

Tests

• unit: DownloadAttribution.* (5), XimDownloaderTest.ALocalWriteFailureIsReportedAsDiskFullNotAsTheSource, XvmSwitchPlan.AlreadyActiveOnlyWhenTheWholeReleaseIsInPlace; protocol version 1.5.
• E2E-127 hook_output_log_test.sh H1..H5 — H1 fails on 2026.9.29.1 (the hook's commands in the install output).
• E2E-128 download_failure_report_test.sh F1..F3 — F1 fails on 2026.9.29.1 (reasonless failed: and download artifact missing).
• libc++: mcpp build --toolchain llvm@20.1.7 on Linux.

Corrected during implementation (plan §8.4)

• The interface never leaked children's stdout into NDJSON: StdoutCapture already forwarded it to stderr as [stray stdout]. C2's gain there is the log and the tail on failure.
• "The target is active" is not "nothing moved": a release member can still move.