docs(fifa17): finalize capability deployment candidate

Record the overnight launcher-lineage reconciliation (merge ca7ce26 retaining both
feat/launcher-arming 13339c1 and feat/sbc-hook-tracing 958ff24; only src/process.rs
conflict, resolved keep-deleted), the deferred superproject gitlink bump (blocked by
uncommitted openfut-hook WIP overlapping the merged hook content), the validated
deployment-candidate commit tuple + local build artifacts, and the controlled A/B/C
deployment sequence. Production stays P2 active-sentinel until the A/B passes.

docs/plans/FIFA17_PATCHED_CLIENT_CAPABILITY.md

@@ -298,3 +298,61 @@ registered while *both* are Unfrozen/Unbound. That ambiguous case resolves to
 `ignored-late` → **both freeze Sentinel** (safe: an unverified process is never granted
 clean). The normal one-launcher-per-FIFA and sequential-relaunch flows bind correctly
 (proven by matrix K/L/M). This is a UX conservativeness, never a safety hole.
+
+---
+
+## 14. Deployment candidate & controlled A/B (overnight reconciliation 2026-08-13)
+
+**Launcher lineage reconciliation.** The two divergent launcher histories (merge
+base `87241ac`) were reconciled by a real merge — **not** a rebase/squash/rewrite —
+in a clean worktree:
+- `feat/launcher-arming` `13339c1` (client arming + FIFA-17 capability reporting)
+- `feat/sbc-hook-tracing` `958ff24` (openfut-hook SBC request tracing / RE probes)
+
+Merged commit **`ca7ce26`** on branch `integration/fifa17-launcher-capability-sbc`
+retains **both** ancestors (`git merge-base --is-ancestor` true for both `958ff24`
+and `13339c1`). The only conflict was `src/process.rs` (launcher-arming deleted it +
+dropped `mod process`; SBC only incidentally tidied it) — resolved **keep-deleted**
+(orphan module; the SBC feature lives entirely in `openfut-hook/*`). The two features
+are in disjoint crates/processes (launcher-crate Rust host vs `openfut-hook` Windows
+DLL) and share no stdout readers, child handles, or lifecycle — no integration code
+was needed.
+
+**Gitlink status — DEFERRED (morning blocker).** The superproject gitlink still
+records the pre-reconciliation `958ff24`. It was **not** bumped to `ca7ce26` because
+the live submodule checkout carries uncommitted `openfut-hook/*` WIP that overlaps the
+merged hook content; a non-destructive `git checkout ca7ce26` is refused ("local
+changes would be overwritten"), and no `-f`/`reset`/`clean` is permitted. The user
+must first reconcile that WIP against the merged `openfut-hook`, then the gitlink can
+bump. Preservation artifact: `/tmp/openfut-launcher-overnight-tracked.patch`
+(sha256 `8e65de2c…`).
+
+**Validated deployment-candidate tuple** (reproducible from git except the deferred
+gitlink):
+```
+superproject HEAD        a82407c  (backend per-session + docs)
+  backend guard          b0d5e04  fix(fifa17): guard missing store category resolution
+  client proof           fc29c2e  docs(fifa17): record no-sentinel client resolver proof
+  autopatch report       1c396dd  feat(fifa17): report verified client patch capability
+  backend negotiate      b25761e  feat(fifa17): negotiate clean empty My Packs mode
+  session binding        805d754  fix(fifa17): isolate patched-client capability per session
+launcher merged HEAD     ca7ce26  merge: reconcile launcher capability and SBC tracing
+  (ancestors 13339c1 capability + 958ff24 SBC)
+launcher gitlink (super) 958ff24  <-- to become ca7ce26 once WIP reconciled
+```
+Local build artifacts (NOT deployed): launcher `target/release/openfut-launcher`
+(sha256 `a390c61d…`); backend image `openfut-fut-backend:candidate-overnight`
+(`84d280be…`, ships `utas_server.py` `33e0ef3…`). Live `:dev` image and the running
+container were left untouched.
+
+### Controlled A/B sequence (execute only in a later authorized deploy task)
+**A — patched client:** fresh FIFA process → autopatch verifies the JG guard →
+launcher parses the verified line and registers → `/ut/auth` mints a fresh `X-UT-SID`
+→ capability binds to that SID → first `/store/purchasegroup` freezes `clean-v1` →
+backend omits 65534 → Store opens on Browse Packs, no crash.
+**B — unpatched client, same machine/IP, NEW session:** new `X-UT-SID`, no verified
+capability → first store freezes `sentinel` → backend emits active 65534 → no crash.
+Proves same-IP isolation + fail-closed fallback.
+**C — failed patch (optional):** autopatch reports `UNSUPPORTED_BUILD`/`VERIFY_FAILED`
+→ launcher never registers → `sentinel`.
+Production remains the P2 active-sentinel universal default until this A/B passes.