docs: admit packaged server persistence evidence

harness/STATE.md

@@ -34,7 +34,11 @@ at `715036e` verifies 2,200 passed, eight ignored and zero failed across all
 all 3,709 inputs against immutable Git bytes, strict workspace Clippy and the
 individual Studio/server builds. The supplemental combined build also passes;
 its differing artifacts are not the selected package inputs. Packaged acceptance
-remains separate.
+remains separate. The [downloaded package](reviews/prerelease37-downloaded-package-20260924.md)
+passes exact archive/product/document checks. [Server evidence](reviews/prerelease37-package-server-20260924.md)
+verifies 16 requests and exact model/source/revision/ETag persistence across an
+owned forced restart; the initial legacy-schema fixture expectation failure is
+preserved. Packaged GUI and separate-machine QA remain distinct from these checks.
 
 ## Current integrated candidate and evidence
 

harness/reviews/prerelease37-package-server-20260924.md

@@ -0,0 +1,47 @@
+# Package/server evidence admission review
+
+2026-09-24. Publication `c82eca1eca204dd28994f5c2e8595d8acd2e148e:harness/prerelease37-windows-gates-20260924/package-server`; source `715036e132677dd2bc2fb37ed316d93dc9987aec`.
+
+## Result
+
+No material discrepancy found. Independently reproduced the published independent review's substantive package/HTTP comparisons from raw evidence. Admissible scope is exact package integrity and the recorded restricted-PATH server workflow, including restart after acknowledged writes. It is not GUI, graceful shutdown, crash durability, production deployment or another-machine runtime acceptance.
+
+The evidence ZIP is **2,514,810 bytes**, SHA-256 **`cd303aebf1f87c92132ed5e981cca0aa3ce4c9688d275f6bd35e1e4b75f63996`**. MCP manifest blob `60f54d6743cadce6096a109602f8a3c2922a3692` was read before a bounded2,600,000-byte download. Independently checked all162 names/counts, lengths, SHA-256 and CRC32 pins and duplicate absence.
+
+Read the existing local application ZIP without downloading again: **34,168,661 bytes**, SHA-256 **`5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d`**. All565 member lengths/SHA-256/CRC32 values match the remote evidence manifest exactly. Thus the server/runtime identities in the trial correspond to the same immutable ZIP independently inspected by the parent, and to the preserved individual final-04 outputs:
+
+- Server `6cebacc117e46fdab023c6402a5cebd6929fb55993ae8ff6b89cd1c6c1170237`.
+- Studio `2c03bd6cc3f1110c219e4f57ab94874a121590f83779239a93289b7170664399`.
+- libunwind `aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a`.
+
+## Sixteen-request behavior check
+
+Compared every raw request/response status, bodies and relevant headers. Observed sequence:
+
+1. Ready200; wrong bearer401; authenticated empty catalog200; health200.
+2. Create201 and read200 establish resource `6e34b021-26f9-4486-922f-9eaf5c1045e8`, revision1, expected name and ETag.
+3. Import201 and read200 establish distinct resource `36920b0d-79ee-447d-b87b-fcd1e7ba55e3`, revision1 and matching import/read ETag. Entire returned source bundle equals the predeclared schema7 request.
+4. Update200 accepts exactly the submitted bundle plus the fixed comment; changed:true, revision2, changed ETag. Entire decoded model remains equal. Stale PUT with the original ETag returns412 `revision_conflict`, current_revision2; subsequent read200 retains the accepted update and ETag.
+5. After owned restart: ready200, wrong bearer401, authenticated catalog200 with both resource IDs, then both resource reads200. Complete imported response/model/source/resource/revision and ETag equal the pre-restart accepted state; complete created response and ETag also match. Archived store-record fields agree with those restart responses.
+
+The update response retains a `sequence_gap` warning belonging to this intentionally incomplete REST coverage fixture. It is not a server runtime error, and this smoke does not claim the fixture is warning-free. Server stderr contains only expected listening/store lines.
+
+Launch/stop receipts match owned PIDs2068 and8156. Both use the extracted pinned server from an unrelated working directory and the same isolated store, with PATH restricted to package directory, Windows/System32 and Windows; no compiler PATH is present. Requests map to the two recorded loopback ports55464/55476. Both stops explicitly use Windows TerminateProcess after acknowledged responses, record not-already-exited, then has_exited:true/exit1. Exit1 here is the deliberate termination outcome, not a spontaneous server failure or graceful exit. Preflight/postflight fingerprint maps are identical.
+
+## Preserved failed attempt and corrected expectation
+
+The original38-member attempt remains failed with `Import changed authored bundle`. Its request equals the original schema5 fixture; its returned source equals the independently predeclared schema7 fixture. The migration response explicitly says5→7 and has empty migration delta arrays. This corroborates the expectation mismatch rather than hiding it as a pass.
+
+Independently compared the actual715036e immutable Git fixture and model.rs with the normalization receipt. The fixture's `repaired` source equals fixture-original.json; candidate SCHEMA_VERSION is7. Original→submitted changes exactly one byte at entry offset8 (`5`→`7`); entry/file names/includes and every other source byte remain identical. The schema7 bundle is constructed before requests and update expectations derive from that bundle, not server responses. This legitimately narrows v2 to exact persistence of current-schema authored bytes. It does not claim unchanged bytes through legacy migration or erase v1's failure.
+
+## Supplemental converter and package command
+
+Package-command result is exit0/failure:null/unchanged source. Package and converter before/after source maps are byte-identical to the fully admitted final-04 map; gate reference summary/environment/source/relocation bytes equal the earlier complete archive. This reuses the prior independent3,709-file Git comparison.
+
+Converter context binds source `acbcc955e970e47b4e825f7880af2fa70ca679410ee4d765d28623ea646c4bf6`, wrapper `e79c59f6dbfaef8192cd818d07c569b3371ed48a0451d761eee2b095ce244e33`, and the reviewed v2 runner. Their archived bytes match those bindings. All three command-result/log records agree and exit0. The selected oa_core rlib event exactly matches the unique successful raw Cargo event, original/preserved hashes agree, and library inventories are equal before/after direct rustc compilation. Actual executed wrapper excludes only `.exe`/`.d` within dependency output; other dependency/build/sysroot/linker library inputs remain recorded, consistent with its declared scope.
+
+Recorded converter output is24,503,808 bytes, SHA-256 `c318ea38111688b6ce0d878b3e9e7dfebe0b3732d0c094bb4580fb39dbcc3d26`; linked preserved rlib is102,251,368 bytes, SHA-256 `138329aff89700a8369ca75b41415009eb1807b7f2927fc6902723c755ad3afe`. These helper binaries are excluded from this ZIP and were not freshly hashed or executed in this review. Converter source is separately identified supplemental tooling, not part of the715036e product. Server persistence assertions use raw fixture/HTTP data directly; converter build evidence is preparation, not additional server/GUI acceptance.
+
+## Review limits
+
+Local inspectors `inspect_package_server.py` and `reconcile_server_records.py` only read/hash ZIP data and immutable Git fixture/schema bytes; logs are `package-server-inspection.log` and `server-records-reconciliation.log`. No archived code, live server, compiler, helper or product was executed. Network use was limited to Gitea evidence retrieval; no candidate/Gitea/release mutation occurred. Internal receipt consistency is not authentication or an independent runtime rerun. Parent's package-integrity review is reused for document closure/internal inventory/provenance checks; this review does not expand into license audit, GUI acceptance or independent-machine QA.