# Every difference: round-2 release captures plus retained harnesses

Unified diffs preserve every changed line. checkpoint-differences.json enumerates every changed round-2 checkpoint field with full Before/After values; the original round-1 classification remains authoritative for retained harness-only operations. This list classifies the differences, including instrumentation and observed limits.

- **Darwin executable path and unit bytes (K1/K2/K3R/K7/O1/O3):** Before selects runtime/versions/<release>/t3; After selects runtime/launcher/t3. `__service-launcher`, escaped custom T3 home (spaces, ampersand, angle brackets), logs, environment and other manager configuration retain their meaning. D03 changes A→B program paths Before and keeps the identical program path After. The full old open-file-descriptor SHA256 still equals complete release A on both revisions after updating.
- **Real copy commands and filesystem operations:** Head Darwin installs add `cp -c -pR source unique-stage/launcher`, timeout 600000 ms. GNU cp 9.4 really exits 1 with invalid-option `-c`; destination removal precedes real NodeFileSystem.copy. Complete assets, file counts, bytes, SHA256 hashes, modes, types and sentinels match each source manifest. Replacement adds old→previous rename, next→launcher promotion and staging deletion. Before does none of this publishing. The extra tree, total bytes, manifest hash, source/copied asset entries and operation logs all reflect those actual files and operations.
- **Symlinks:** Neither native Linux release fixture contains any symlink, and neither copied launcher acquires any. This differs from the retained synthetic harness fixture, whose relative manifest-link becomes an absolute symlink back to the versioned source asset through NodeFileSystem.copy. The synthetic successful-clone simulation uses the same primitive. These observations do not prove native macOS cp/APFS behavior.
- **D02 migration asymmetry:** Before generates the genuine legacy A plist/state; After first reads exactly that preserved directory (no re-rendered driver plist), then installs B at the fixed launcher. After necessarily has an extra final checkpoint, B tree, manager/copy/swap operations and successful B status. The initial head view of the old unit is not current; the migrated final view is current.
- **D04 reconciliation:** Both skip healthy A without prompting or publishing. Base ignores absent/stale extraneous launcher damage; head status becomes false, executes the actual onboarding prompt and repairs on synthetic Enter/default-yes. Captured terminal output and prompt counts therefore differ. Separately labelled direct layer reinstall always runs; head republishes A while base leaves the extraneous stale launcher unchanged. Equivalent base-only launcher seeds use the real filesystem copy. The `.saved` sibling remains on both sides and is not treated as a managed launcher.
- **D07–D10 predicates:** Missing launcher t3, absent/unreadable sentinel and other/malformed version text make head current false, while base ignores that extraneous directory. D08's narrowly redirected sentinel-read failure is reached only by head, so the corresponding injected-read event is head-only. Whitespace around exact A remains accepted. Source t3/sentinel absence or mismatch keeps both false despite a healthy copied launcher. installedVersion remains A. D09 direct reinstall repairs only the managed head sentinel. Tree/sentinel hashes reflect the deliberately damaged fixture state.
- **Stage/restart (D05/D06):** Both publish target state plus restart marker, preserve service.env byte-for-byte, avoid stop/bootstrap during start:false, and become current after restart clears the marker. Head additionally stages/swaps the copied launcher; base keeps the versioned program path. D06 was recaptured with complete releases as an optional ordinary row.
- **D20 uninstall:** Both deactivate before deleting the unit, return true, then return false on a second call. Head additionally deletes exact launcher and every launcher.next-* leftover; base retains them. Both retain version directories and launcher-other/launcher.nextish/launcher.next siblings. Tree/file-count/byte/manifest/status differences follow that cleanup. D21 with no unit is observably equal: false and orphan launcher/staging retained.
- **C01 Linux control:** No observable Before/After difference after declared path/provenance/manifest-filename normalization. ExecStart remains versioned, no cp publishes a launcher, the sibling launcher sentinel is ignored/retained, and install/update/stage/restart/status/uninstall behavior matches. To use only the two available real releases, staging is B→A with explicit allowDowngrade:true; both sides use the identical options. This is a capture recipe detail rather than a product behavior change. Retained C02 separately proves the synthetic inside-service systemd-run handoff before state/unit mutation; its older C01 checkpoints are superseded.
- **C03–C05 recapture:** Selector results are equal. C04 is only state-seeded remote-update characterization: both are false until repair, which adds the fixed tree/path only on head. C05 pending/downgrade/concurrent-state guards run before any publish; old launcher hash remains intact, and operation/error/state/marker outputs match apart from the existing Darwin path/tree. PATH-only normalization remains current; mismatched unit/invalid state are false. **The seeded dbPath is now the identical relative synthetic-not-created.sqlite on both sides; service-state.json hashes and byte counts match at every paired C05 checkpoint. No state hash delta is dismissed as normalization noise.**
- **Retained D11–D19, D22–D23 harness behavior:** Successful cp simulation performs a full copy and skips fallback; partial/nonzero/runner-error branches discard partial files. Copy/rename failures print raw causes, target state and marker; D13/D15/D16 retain or restore old A. Deferred copy interruption preserves A; interrupted swap completes before Fiber exit; controlled overlap yields one complete final C with restart pending. Bootstrap failure leaves complete files, retry clears pending. Cleanup-failure cases explicitly retain leftovers when errors are ignored; double promotion/rollback failure can lose the prior launcher through final staging cleanup. These are original accepted synthetic/fault captures, not new release or macOS proofs.
- **Capture metadata:** Round 2 uses the exact git-archive source snapshots, Node v24.22.1 and real release versions; retained round 1 used Node v26.12.1 and synthetic 0.1.3/0.1.4/0.1.5 fixtures. Every round-2 primary checkpoint retains its revision and fixture provenance. Diffs omit sourceRevision/side/driverSHA256 and manifest filenames, normalize run/legacy/source roots, random stage/durable-temp identities, Fiber IDs and stack positions. Full manifest contents/hashes, command exits, errors and raw logs remain preserved. Full manifest equality is additionally asserted for copied release trees; normalized checkpoints expand executable/asset hashes from SHA256-verified driver manifests. Manifest filenames may differ by checkpoint ordinal, so only their filenames are omitted from diff inputs.
- **A install metadata exception:** The authorized live release A directory lacks its sentinel; only the scratch copy gets a sentinel reconstructed from the real `t3 --version`. B metadata is copied unchanged. All native runtime bytes/assets are original. No file in the live install, live database, lead worktree or another machine was changed.

No actual launchctl/TCC/signed Mach-O/APFS behavior is verified, no interactive full uninstall is executed, and no remote-update subprocess is run. M01–M03 remain cannot-verify macos. No product implementation difference beyond those recorded above is asserted.