Read the request lifecycle on the wire

Before you start

You are handed the real artifacts of one request lifecycle — the moment "example.com" becomes pixels — and asked to read each control claim's truth directly off them. A name resolved (DNS), a channel opened and secured (TCP/TLS), an identity proven (the certificate): every stage is a place a claim can be made or broken, and you will point to the exact message, byte, or field that holds each one. This surface composes the real lifecycle. The DNS query and response are PEELable byte-range trees — select a region and the RFC 1035 parser shows the real decode. The DNS delegation and the TLS 1.3 handshake are orderable sequences run by their real state machines — route the leaf query to the root and it returns the real referral; play data before the handshake finishes and TLS returns the real unexpected_message alert. The certificate is the real www.google.com leaf (and a broken twin). Nothing is invented; the message, the state machine, and the certificate are the answer key. Start on the DNS query panel.