tryMistGET still dials its own conn — that part is load-bearing (the raw fd gets passed to the detached worker, which http.Client can't provide) — but the request itself is now a real *http.Request written with req.Write instead of a concatenated header string, and http.ReadResponse gets the request for context. Same wire bytes, stdlib framing. The %2B-escaped wildcard path survives req.Write via URL.RawPath (covered by TestMistPullConnect's EscapedPath assertion). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>