Update lab proof at cc2bdcfe6d33f7f2f7f60bc11c301505838494a1
Headless Linux, October 19 2026. Disposable homes/state in this worktree only.

Focused tests: contributor head45passed/3files -> minimum new tests48passed/3files -> integrated main65passed/3files (17existing main cases). Three production-seam reversion checks failed before restoring implementation. Final tests prove dedicated T3 registry/index overrides, default sources, and unchanged legacy download-only/ambient npm behavior. Scoped lint/format, scripts/server/shared/provider-core typechecks and Knip passed.

Final-head live observations:
- Three isolated servers, last under the actual service launcher.
- Codex installed0.162.0 through the explicit local registry; injected Grok installer failure reportedfailed and retained installed1.0.21.
- Six concurrent Grok/Pi RPC updates all succeeded. Every environment persisted Grok1.0.21 and Pi1.0.1.
- Mock ACP turn completed; persisted assistant text: env1 finished its busy turn.
- Launcher committed fresh source runtime999.0.4 containing the built web client.
- Candidate999.0.5 passed real preflight, wrote a trial database marker, then exited42. Launcher update.status=rolled-back, reason=candidate-exited:42, activeVersion=999.0.4. A read-only query confirmed the probe value restored to before-trial, while trial-proof recorded trial-write.
- Fresh browser pairing reached /welcome and displayed the connected isolated launcher environment. JavaScript assets and auth/session were served by its packaged client. This is pairing proof, not proof that UI update discovery uses the local feed.
- Explicit changes to env count, launcher count, sourceversion and busy duration while live all exited1 and preserved statebytes.
- Stopping the lab during a slow provider update immediately rejected the RPC with socket closed before response; no ten-minute hang. Owned lab servers/feed stopped afterward.

Earlier integrated-head live proof (script code for these paths retained): dead feed restarted on samefreeportwithoutserverrestart; collision listener survived while lab chose newfeedportandrestartedonlyownedservers; livehostchange rejectedwithoutstatechange. Both concurrent same-provider calls returned success, so duplicate rejection is NOTclaimed.

No UI source changed; screenshot shows fresh pairing against the packaged final runtime. Before/after screenshots are not applicable. Default-source compatibility has test before/after evidence.

Limits: Linux maintainer simulator only. No macOS, Windows, iOS, Android, Electron desktop, real provider installs, production feeds, relay/tunnel or production deployment verified. Web/mobile update discovery still uses its normal source; use lab self-update ENV VERSION to exercise the local launcher feed. Explicit production lookup knobs and the draft lab still need maintainer approval. Nothing merged.

Original work by maria-rcks. Implementation GPT-6.1 Sol/Codex; fresh tests GPT-6 Astra/Codex; independent reviews Claude Opus5.5/Claude Code and GPT-6 Sol/Codex, all through T3 Code.