The licence response lists KIDs a server vault supplied, the client proves them with the decode check, and a bad pair goes to the new session keys/bad route so the server flags its own row. Client vault keys go first over --remote, and the dashboard health warns when no SQLite vault can store flags.
Check a sequential download against the complete length whenever one is known, and settle the unknown-total case on the 416. An empty body of unknown length, a 206 with no complete length, and a 206 starting past the resume offset all passed the size checks before and were renamed into place. Four restart paths spent no attempt, so a host that always answered the same way cycled forever.
A PlayReady WRMHEADER can advertise fewer KIDs than its multi-key license returns, so a server-vault hit on the PSSH KID alone handed every track the same key subset and failed sibling tracks. Drop the pre-license vault shortcut for PlayReady and reuse the licensed bundle per PSSH.
imSp4rky