update_finish.finish_update (the historical takeover's completion) ran
_restart_gateway_fleet_after_update, the Windows resume merge and
_verify_fleet_after_update unguarded. They run after the commit point,
yet a raise (a systemctl timeout, a service-manager error) reached
update_finish.main's catch-all: record_step failed, receipt `failed`,
.update_exit_code rewritten to 1, exit 1.
The three calls now sit behind the same post-commit boundary as the
current completion: the error is a `gateway_restart` follow-up (amended
onto the terminal receipt when verification already finalized it), the
fleet restart obligation stays armed for the next launch / `hermes
update`, and the run exits 0 with the watcher's 0 intact.
Review P3 (invariant 3).
20ccf65500