Evidence-only runtime capture results, 2026-10-22 UTC
Exact head: 0df1ba9eaefa23c18c535514cbf0ece4a67aae75, requested branch fix/issue-17490; checkout is detached at this exact head, tracked/index/untracked status clean at build and final verification.
All fixture bundles derive from a fresh exact-head production build. Only the generated server package version declaration differs. Provenance JSON supplies SHA256 for original build, every fixture bundle, SEA, and final served archive.

ROW 1 PASS (row1-console.log):
Install A=0.1.1 -> actual authenticated update RPC B=0.1.2 -> C=0.1.3. Unit remains A; initial launcher PID620460, active C/update.from B/launcher A in persisted protocol3 state. Stop leaves MainPID0/inactive. All completion sentinels aged two hours. Production prune keep=[C], references omitted, removes [0.1.0], retains A/B/C. Restart by CLI A -> new launcher PID624884/unit A -> HTTP200 C/protocol2, server.probe Exit Success {}.

ROW 2 PASS (row2-console.log):
Fresh A launcher PID626236. Successful production BootService.install({start:false}) version B writes unit B and state launcher B; PID626236/readlink still A, HTTP200 still A. Real remote updates C then D=.1.4 keep PID626236. Active D, update.from C/target D, launcher B: B is neither active nor update versions. Stop/age two hours; production prune keep=[D], references omitted, removes [control0.1.0,A0.1.1], retains B/C/D. Reload/start unit -> PID630200/readlink B -> HTTP200 D/protocol2 and successful probe.

ROW 3 PASS WITH MANAGER-RATE-LIMIT CAVEAT (row3-console.log + row3-restart-console.log):
Independent A -> B -> C then real accepted RPC E=.1.5. External availability fault renames E executable during the production handoff delay; bytes are never altered. Production launcher persists failed/candidate-start-failed, active/from C, target E, launcher A. Restore E executable. HTTP200 C and probe success. Stop/age two hours; production prune keep=[C], references omitted, removes [control0.1.0,B0.1.2], retains A/C/E. The sixth rapid unit start within 300s is refused by systemd (start-limit-hit), before launching app. Record Result, reset only this unit's start/failure counter, start -> PID638160/readlink A -> HTTP200 C/protocol2/probe success, exact failed record still present. No failed-state rewrite or manual state repair. This proves failed-candidate outcome/reference persistence; no broad deployment rollback/data-integrity claim.

Known concurrency limitation NOT fixed:
#writeState read/merge/write can race a successful concurrent start:false B repoint and overwrite B with stale A. Sequential row2 does not prove this interleaving safe. No fix authorized or claimed. See limitation.txt.

Cleanup:
All owned release transports close in runtime.py finally. Service stopped/disabled/unit removed; linger disabled; owned user manager stopped; account/home/runtime removed. No listeners remain on 17490/17491. Generated build/fixture artifacts and scripts retained in /tmp/pr23250-evidence/capture; worktree retained for lead. No live ~/.t3 accessed.

Caveats/FRICTION:
Release transport only is mocked. Real SEA + installed runtime external dependency closure, production installer/checksums, launcher, RPC, state/prune/restart run on Linux/systemd. No UI/client bundle, macOS/Windows, relay/tunnel, legacy launcher migration, or concurrency-safety proof. Initial external closure/archive-wrapper/setup-path mistakes and manager start-limit continuation are preserved and explained in FRICTION.txt. Historical before proof was not redone. Tests owned by lead, not repeated.
