diff --git a/.github/workflows/zed-cli-380-expanded-source-fallback.yml b/.github/workflows/zed-cli-380-expanded-source-fallback.yml
new file mode 100644
index 0000000..f08d810
--- /dev/null
+++ b/.github/workflows/zed-cli-380-expanded-source-fallback.yml
@@ -0,0 +1,202 @@
+name: zed-cli 380 expanded source fallback
+
+on:
+  push:
+    branches:
+      - "test/zed-cli-380-source-fallback-matrix"
+    paths:
+      - ".github/workflows/zed-cli-380-expanded-source-fallback.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  ZED_CLI_SHA: a6795384d13fa903dae9d902ba8e207888f437f3
+  DEAD_REGISTRY: https://registry-write-intentionally-unavailable.invalid
+  DEAD_R2: http://127.0.0.1:1
+
+jobs:
+  expanded-source-fallback:
+    name: Five-language source fallback plus negative identity check
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - name: Check out exact zed-cli candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: zed-pkg/zed-cli
+          ref: ${{ env.ZED_CLI_SHA }}
+          path: product/zed-cli
+          fetch-depth: 1
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install candidate Rust toolchain
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          toolchain: 1.98.1
+
+      - name: Refresh only the known stale zed-lock entry
+        working-directory: product/zed-cli
+        run: |
+          set -Eeuo pipefail
+          cargo update -p zed-lock
+          test "$(git diff --name-only)" = "Cargo.lock"
+
+      - name: Build exact candidate
+        run: |
+          set -Eeuo pipefail
+          cargo build --locked --release --manifest-path product/zed-cli/Cargo.toml --bin zed
+          test "$(git -C product/zed-cli rev-parse HEAD)" = "$ZED_CLI_SHA"
+
+      - name: Create five-language consumer
+        run: |
+          set -Eeuo pipefail
+          mkdir -p consumer
+          cat > consumer/.zpkg.toml <<'EOF'
+          [package]
+          org = "zed-pkg-test"
+          name = "expanded-source-fallback-consumer"
+          version = "0.0.0"
+          description = "Five-language public source archive fallback matrix"
+
+          [package.repository]
+          vcs = "git"
+          url = "https://github.com/zed-pkg-test/github-api-fallback-canary"
+
+          [install]
+          dir = "zed_modules"
+          adapter = "none"
+
+          [dependencies]
+          "zed-pkg-test/go-lib" = "=1.0.0"
+          "zed-pkg-test/python-lib" = "=1.0.0"
+          "zed-pkg-test/dart-lib" = "=1.0.0"
+          "zed-pkg-test/node-lib" = "=1.0.0"
+          "zed-pkg-test/gleam-lib" = "=1.0.0"
+          EOF
+
+      - name: Force direct GitHub source fallback for five release-free repos
+        working-directory: consumer
+        env:
+          ZED_PKG_SOURCE_FALLBACK: "true"
+          ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }}
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true
+          "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-source-a" install \
+            --install-mode copy --adapter none --allow-ecosystem-mismatch \
+            2>&1 | tee "$RUNNER_TEMP/source-a.log"
+
+          test "$(grep -c 'using GitHub fallback' "$RUNNER_TEMP/source-a.log")" -ge 5
+          test -s .zpkg.lock
+          python3 - <<'PY'
+          from pathlib import Path
+          manifests = list(Path("zed_modules").rglob(".zpkg.toml"))
+          text = "\n".join(p.read_text(encoding="utf-8") for p in manifests)
+          expected = ("go-lib", "python-lib", "dart-lib", "node-lib", "gleam-lib")
+          missing = [name for name in expected if f'name = "{name}"' not in text]
+          if missing:
+              raise SystemExit(f"missing installed packages {missing}; manifests={manifests}")
+          if len(manifests) < len(expected):
+              raise SystemExit(f"expected >= {len(expected)} installed manifests, got {manifests}")
+          print("installed", sorted(str(p) for p in manifests))
+          PY
+          cp .zpkg.lock "$RUNNER_TEMP/lock-a"
+
+      - name: Fresh clean-store resolution is deterministic
+        working-directory: consumer
+        env:
+          ZED_PKG_SOURCE_FALLBACK: "true"
+          ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }}
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true
+          rm -rf zed_modules .zpkg.lock "$RUNNER_TEMP/zed-home-source-b"
+          "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-source-b" install \
+            --install-mode copy --adapter none --allow-ecosystem-mismatch \
+            2>&1 | tee "$RUNNER_TEMP/source-b.log"
+          cmp "$RUNNER_TEMP/lock-a" .zpkg.lock
+
+      - name: Frozen replay from another clean store is lock-stable
+        working-directory: consumer
+        env:
+          ZED_PKG_SOURCE_FALLBACK: "true"
+          ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }}
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true
+          rm -rf zed_modules "$RUNNER_TEMP/zed-home-frozen"
+          "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-frozen" install --frozen \
+            --install-mode copy --adapter none --allow-ecosystem-mismatch \
+            2>&1 | tee "$RUNNER_TEMP/frozen.log"
+          cmp "$RUNNER_TEMP/lock-a" .zpkg.lock
+          test "$(find zed_modules -name .zpkg.toml -type f | wc -l)" -ge 5
+
+      - name: Reject a tagged repo whose manifest claims the wrong org
+        run: |
+          set -Eeuo pipefail
+          mkdir -p negative
+          cat > negative/.zpkg.toml <<'EOF'
+          [package]
+          org = "zed-pkg-test"
+          name = "negative-source-fallback-consumer"
+          version = "0.0.0"
+          description = "Identity-mismatch negative fallback test"
+
+          [package.repository]
+          vcs = "git"
+          url = "https://github.com/zed-pkg-test/github-api-fallback-canary"
+
+          [install]
+          dir = "zed_modules"
+          adapter = "none"
+
+          [dependencies]
+          "zed-pkg-test/awkward-lib" = "=0.1.0"
+          EOF
+
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true
+          set +e
+          (
+            cd negative
+            ZED_PKG_SOURCE_FALLBACK=true ZED_PKG_R2_PUBLIC_BASE="$DEAD_R2" \
+              "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-negative" install \
+                --install-mode copy --adapter none --allow-ecosystem-mismatch
+          ) >"$RUNNER_TEMP/negative.log" 2>&1
+          status=$?
+          set -e
+          cat "$RUNNER_TEMP/negative.log"
+          test "$status" -ne 0
+          grep -E 'tagged .*\.zpkg\.toml claims zedtest/awkward-lib@0\.1\.0, expected zed-pkg-test/awkward-lib@0\.1\.0|expected zed-pkg-test/awkward-lib@0\.1\.0' "$RUNNER_TEMP/negative.log"
+
+      - name: Use registry.zpkg.net as a Worker-edge control
+        working-directory: consumer
+        env:
+          ZED_PKG_SOURCE_FALLBACK: "true"
+          ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }}
+        run: |
+          set -Eeuo pipefail
+          python3 - <<'PY'
+          import urllib.error, urllib.request
+          url = "https://registry.zpkg.net/v1/packages/zed-pkg-test/go-lib/versions/1.0.0"
+          req = urllib.request.Request(url, headers={"Accept":"application/json", "User-Agent":"zed-expanded-source-fallback/1.0"})
+          try:
+              res = urllib.request.urlopen(req, timeout=20)
+          except urllib.error.HTTPError as exc:
+              res = exc
+          body = res.read(1024).decode("utf-8", errors="replace")
+          print("registry.zpkg.net", res.status, dict(res.headers), body)
+          edge = res.headers.get("x-zed-edge", "")
+          if edge.lower() != "registry":
+              raise SystemExit(f"registry.zpkg.net did not traverse registry Worker: x-zed-edge={edge!r}")
+          PY
diff --git a/.github/workflows/zed-cli-380-public-source-fallback.yml b/.github/workflows/zed-cli-380-public-source-fallback.yml
new file mode 100644
index 0000000..eb6a2b5
--- /dev/null
+++ b/.github/workflows/zed-cli-380-public-source-fallback.yml
@@ -0,0 +1,148 @@
+name: zed-cli 380 public source fallback
+
+on:
+  push:
+    branches:
+      - "test/zed-cli-380-source-fallback-matrix"
+    paths:
+      - ".github/workflows/zed-cli-380-public-source-fallback.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  ZED_CLI_SHA: a6795384d13fa903dae9d902ba8e207888f437f3
+  DEAD_REGISTRY: https://registry-write-intentionally-unavailable.invalid
+  DEAD_R2: http://127.0.0.1:1
+
+jobs:
+  public-source-fallback:
+    name: Public GitHub source fallback matrix
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - name: Check out exact zed-cli candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: zed-pkg/zed-cli
+          ref: ${{ env.ZED_CLI_SHA }}
+          path: product/zed-cli
+          fetch-depth: 1
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install candidate Rust toolchain
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          toolchain: 1.98.1
+
+      - name: Refresh only the known stale zed-lock entry
+        working-directory: product/zed-cli
+        run: |
+          set -Eeuo pipefail
+          cargo update -p zed-lock
+          test "$(git diff --name-only)" = "Cargo.lock"
+
+      - name: Build exact candidate
+        run: |
+          set -Eeuo pipefail
+          cargo build --locked --release --manifest-path product/zed-cli/Cargo.toml --bin zed
+          test "$(git -C product/zed-cli rev-parse HEAD)" = "$ZED_CLI_SHA"
+
+      - name: Create multi-package consumer
+        run: |
+          set -Eeuo pipefail
+          mkdir -p consumer
+          cat > consumer/.zpkg.toml <<'EOF'
+          [package]
+          org = "zed-pkg-test"
+          name = "source-fallback-matrix-consumer"
+          version = "0.0.0"
+          description = "Public source archive fallback matrix"
+
+          [package.repository]
+          vcs = "git"
+          url = "https://github.com/zed-pkg-test/github-api-fallback-canary"
+
+          [install]
+          dir = "zed_modules"
+          adapter = "none"
+
+          [dependencies]
+          "zed-pkg-test/go-lib" = "=1.0.0"
+          "zed-pkg-test/python-lib" = "=1.0.0"
+          "zed-pkg-test/dart-lib" = "=1.0.0"
+          EOF
+
+      - name: Force source fallback and stitch three packages
+        working-directory: consumer
+        env:
+          ZED_PKG_SOURCE_FALLBACK: "true"
+          ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }}
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true
+          "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-source" install \
+            --install-mode copy --adapter none --allow-ecosystem-mismatch \
+            2>&1 | tee "$RUNNER_TEMP/source.log"
+          grep -F "using GitHub" "$RUNNER_TEMP/source.log"
+          test -s .zpkg.lock
+          python3 - <<'PY'
+          from pathlib import Path
+          manifests = list(Path("zed_modules").rglob(".zpkg.toml"))
+          text = "\n".join(p.read_text(encoding="utf-8") for p in manifests)
+          expected = ("go-lib", "python-lib", "dart-lib")
+          missing = [name for name in expected if f'name = "{name}"' not in text]
+          if missing:
+              raise SystemExit(f"missing installed packages {missing}; manifests={manifests}")
+          print(f"installed manifests: {[str(p) for p in manifests]}")
+          PY
+          cp .zpkg.lock "$RUNNER_TEMP/lock-first"
+
+      - name: Frozen reinstall from clean store remains stable
+        working-directory: consumer
+        env:
+          ZED_PKG_SOURCE_FALLBACK: "true"
+          ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }}
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true
+          rm -rf zed_modules "$RUNNER_TEMP/zed-home-frozen"
+          "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-frozen" install --frozen \
+            --install-mode copy --adapter none --allow-ecosystem-mismatch \
+            2>&1 | tee "$RUNNER_TEMP/frozen.log"
+          cmp "$RUNNER_TEMP/lock-first" .zpkg.lock
+          test "$(find zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3
+
+      - name: Probe and exercise zpkg.net first hop
+        working-directory: consumer
+        env:
+          ZED_PKG_SOURCE_FALLBACK: "true"
+          ZED_PKG_R2_PUBLIC_BASE: ${{ env.DEAD_R2 }}
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true
+          python3 - <<'PY'
+          import urllib.error, urllib.request
+          url = "https://zpkg.net/v1/packages/zed-pkg-test/go-lib/versions/1.0.0"
+          req = urllib.request.Request(url, headers={"Accept":"application/json", "User-Agent":"zed-source-fallback-matrix/1.0"})
+          try:
+              res = urllib.request.urlopen(req, timeout=20)
+          except urllib.error.HTTPError as exc:
+              res = exc
+          print("zpkg.net", res.status, res.read(512).decode("utf-8", errors="replace"))
+          PY
+          rm -rf zed_modules .zpkg.lock "$RUNNER_TEMP/zed-home-edge"
+          "$ZED" --registry https://zpkg.net --home "$RUNNER_TEMP/zed-home-edge" install \
+            --install-mode copy --adapter none --allow-ecosystem-mismatch \
+            2>&1 | tee "$RUNNER_TEMP/edge.log"
+          test -s .zpkg.lock
+          test "$(find zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3
diff --git a/.github/workflows/zed-cli-380-source-fallback-matrix.yml b/.github/workflows/zed-cli-380-source-fallback-matrix.yml
new file mode 100644
index 0000000..747d329
--- /dev/null
+++ b/.github/workflows/zed-cli-380-source-fallback-matrix.yml
@@ -0,0 +1,217 @@
+name: zed-cli 380 source fallback matrix
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/zed-cli-380-source-fallback-matrix.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: zed-cli-380-source-fallback-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: false
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  ZED_CLI_SHA: a6795384d13fa903dae9d902ba8e207888f437f3
+  DEAD_REGISTRY: https://registry-write-intentionally-unavailable.invalid
+
+jobs:
+  authenticated-source-archive-matrix:
+    name: authenticated GitHub fallback + lock stability
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    env:
+      ZED_PKG_SOURCE_FALLBACK: "true"
+      ZED_PKG_R2_PUBLIC_BASE: http://127.0.0.1:1
+      ZED_PKG_GITHUB_TOKEN: ${{ github.token }}
+    steps:
+      - name: Check out exact zed-cli candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: zed-pkg/zed-cli
+          ref: ${{ env.ZED_CLI_SHA }}
+          path: product/zed-cli
+          fetch-depth: 1
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install candidate Rust toolchain
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          toolchain: 1.98.1
+
+      - name: Refresh known stale zed-lock entry in runner
+        working-directory: product/zed-cli
+        run: |
+          set -Eeuo pipefail
+          cargo update -p zed-lock
+          test "$(git diff --name-only)" = "Cargo.lock"
+
+      - name: Build exact candidate
+        run: |
+          set -Eeuo pipefail
+          cargo build --locked --release --manifest-path product/zed-cli/Cargo.toml --bin zed
+          test "$(git -C product/zed-cli rev-parse HEAD)" = "$ZED_CLI_SHA"
+
+      - name: Create three-package consumer
+        run: |
+          set -Eeuo pipefail
+          mkdir -p consumer
+          cat > consumer/.zpkg.toml <<'EOF'
+          [package]
+          org = "zed-pkg-test"
+          name = "source-fallback-matrix-consumer"
+          version = "0.0.0"
+          description = "Exercises authenticated source archive fallback across test packages"
+
+          [package.repository]
+          vcs = "git"
+          url = "https://github.com/zed-pkg-test/github-api-fallback-canary"
+
+          [install]
+          dir = "zed_modules"
+          adapter = "none"
+
+          [dependencies]
+          "zed-pkg-test/go-lib" = "=1.0.0"
+          "zed-pkg-test/python-lib" = "=1.0.0"
+          "zed-pkg-test/dart-lib" = "=1.0.0"
+          EOF
+
+      - name: Force registry failure and install from GitHub source archives
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          (
+            cd consumer
+            "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-source-a" install \
+              --install-mode copy --adapter none --allow-ecosystem-mismatch
+          ) 2>&1 | tee "$RUNNER_TEMP/source-a.log"
+          grep -F "using GitHub" "$RUNNER_TEMP/source-a.log"
+          test -s consumer/.zpkg.lock
+          test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3
+          sha256sum consumer/.zpkg.lock | tee "$RUNNER_TEMP/lock-a.sha"
+          cp consumer/.zpkg.lock "$RUNNER_TEMP/lock-a"
+
+      - name: Frozen reinstall from a clean home is lock-stable
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          rm -rf consumer/zed_modules "$RUNNER_TEMP/zed-home-source-frozen"
+          (
+            cd consumer
+            "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-source-frozen" install \
+              --frozen --install-mode copy --adapter none --allow-ecosystem-mismatch
+          ) 2>&1 | tee "$RUNNER_TEMP/source-frozen.log"
+          cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock
+          test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3
+
+      - name: Fresh authenticated fallback resolution is deterministic
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          rm -rf consumer/zed_modules consumer/.zpkg.lock "$RUNNER_TEMP/zed-home-source-b"
+          (
+            cd consumer
+            "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-source-b" install \
+              --install-mode copy --adapter none --allow-ecosystem-mismatch
+          ) 2>&1 | tee "$RUNNER_TEMP/source-b.log"
+          cmp "$RUNNER_TEMP/lock-a" consumer/.zpkg.lock
+          test "$(find consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 3
+
+      - name: Retain authenticated fallback evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: zed-cli-380-authenticated-fallback-${{ github.run_id }}-${{ github.run_attempt }}
+          if-no-files-found: warn
+          path: |
+            ${{ runner.temp }}/lock-a
+            ${{ runner.temp }}/lock-a.sha
+            ${{ runner.temp }}/source-a.log
+            ${{ runner.temp }}/source-b.log
+            ${{ runner.temp }}/source-frozen.log
+            consumer/.zpkg.lock
+
+  anonymous-public-smoke:
+    name: anonymous public GitHub fallback smoke
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    env:
+      ZED_PKG_SOURCE_FALLBACK: "true"
+      ZED_PKG_R2_PUBLIC_BASE: http://127.0.0.1:1
+    steps:
+      - name: Check out exact zed-cli candidate
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: zed-pkg/zed-cli
+          ref: ${{ env.ZED_CLI_SHA }}
+          path: product/zed-cli
+          fetch-depth: 1
+          persist-credentials: false
+          show-progress: false
+
+      - name: Install candidate Rust toolchain
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30
+        with:
+          toolchain: 1.98.1
+
+      - name: Refresh known stale zed-lock entry and build candidate
+        working-directory: product/zed-cli
+        run: |
+          set -Eeuo pipefail
+          cargo update -p zed-lock
+          test "$(git diff --name-only)" = "Cargo.lock"
+          cargo build --locked --release --bin zed
+
+      - name: Create one-package anonymous consumer
+        run: |
+          set -Eeuo pipefail
+          mkdir -p anonymous-consumer
+          cat > anonymous-consumer/.zpkg.toml <<'EOF'
+          [package]
+          org = "zed-pkg-test"
+          name = "anonymous-source-fallback-smoke"
+          version = "0.0.0"
+
+          [package.repository]
+          vcs = "git"
+          url = "https://github.com/zed-pkg-test/github-api-fallback-canary"
+
+          [install]
+          dir = "zed_modules"
+          adapter = "none"
+
+          [dependencies]
+          "zed-pkg-test/go-lib" = "=1.0.0"
+          EOF
+
+      - name: Install one public package with no GitHub token
+        run: |
+          set -Eeuo pipefail
+          ZED="$GITHUB_WORKSPACE/product/zed-cli/target/release/zed"
+          unset GITHUB_TOKEN GH_TOKEN ZED_PKG_GITHUB_TOKEN || true
+          (
+            cd anonymous-consumer
+            "$ZED" --registry "$DEAD_REGISTRY" --home "$RUNNER_TEMP/zed-home-anonymous" install \
+              --install-mode copy --adapter none --allow-ecosystem-mismatch
+          ) 2>&1 | tee "$RUNNER_TEMP/anonymous.log"
+          grep -F "using GitHub" "$RUNNER_TEMP/anonymous.log"
+          test -s anonymous-consumer/.zpkg.lock
+          test "$(find anonymous-consumer/zed_modules -name .zpkg.toml -type f | wc -l)" -ge 1
+
+      - name: Retain anonymous fallback evidence
+        if: ${{ always() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: zed-cli-380-anonymous-fallback-${{ github.run_id }}-${{ github.run_attempt }}
+          if-no-files-found: warn
+          path: |
+            ${{ runner.temp }}/anonymous.log
+            anonymous-consumer/.zpkg.lock