diff --git a/.gitea/workflows/ci-deploy.yml b/.gitea/workflows/ci-deploy.yml
index 9b29234..3ac0a66 100644
--- a/.gitea/workflows/ci-deploy.yml
+++ b/.gitea/workflows/ci-deploy.yml
@@ -48,6 +48,8 @@ jobs:
               && install https://dotnetcli.azureedge.net/dotnet )
           fi
           echo "$DOTNET_ROOT" >> "$GITHUB_PATH"
+          # Native test apphosts need the custom runtime location in later steps too.
+          echo "DOTNET_ROOT=$DOTNET_ROOT" >> "$GITHUB_ENV"
           "$DOTNET_ROOT/dotnet" --info
 
       - name: Setup Node
diff --git a/JobTrackerApi.Tests/JobImportHttpTransportTests.cs b/JobTrackerApi.Tests/JobImportHttpTransportTests.cs
index 5715f18..c97daec 100644
--- a/JobTrackerApi.Tests/JobImportHttpTransportTests.cs
+++ b/JobTrackerApi.Tests/JobImportHttpTransportTests.cs
@@ -335,7 +335,9 @@ public sealed class JobImportHttpTransportTests
         {
             var error = await Assert.ThrowsAsync<HttpRequestException>(request);
             Assert.IsType<AuthenticationException>(error.InnerException);
-            Assert.Null(server.Request); // No HTTP data sent before TLS authenticates the origin.
+            // TLS rejection can surface as EOF after the server handshake on Linux.
+            // Both no read and a zero-byte read mean no HTTP data reached this origin.
+            Assert.True(string.IsNullOrEmpty(server.Request));
         }
         Assert.Equal("jobs.example.test", sni);
         Assert.Null(handler.SslOptions.RemoteCertificateValidationCallback);
diff --git a/docs/audits/2026-09-07/validation/b06-completion.md b/docs/audits/2026-09-07/validation/b06-completion.md
index e2a1238..f7fc697 100644
--- a/docs/audits/2026-09-07/validation/b06-completion.md
+++ b/docs/audits/2026-09-07/validation/b06-completion.md
@@ -326,3 +326,7 @@ Local verification: `C:/Users/Connor/.dotnet/dotnet.exe test JobTrackerApi.Tests
 [Run 739](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/739/jobs/1613), for `23cc250`, failed earlier in the unchanged API compiler: `csc.dll` exited 139 on both the ordinary and existing single-process retry. This is the previously documented runner crash signature, not a compile diagnostic or test assertion. It prevented Linux confirmation of the packaging correction. No retries/gates were weakened. Fresh local broader verification with the explicit SDK passed **915/915** selected backend tests, no selected skips, with only the same documented external-DNS-dependent IMAP exclusion; `.artifacts/redesign-audit/backend.trx` records the run.
 
 Pushing this evidence provides one further complete CI attempt with unchanged application/test logic. If the existing bounded retry is exhausted again, stop release attempts and obtain runner-host diagnostics under the [runner investigation](../../../infrastructure/runner-investigation.md); do not increase retry loops indefinitely or deploy past a red test gate. Phase 1 redesign audit is separately committed on `codex/ui-redesign-audit`, with no redesign implementation. F04 remains open regardless of CI outcome until its runtime/production checklist is proven.
+
+[Run 740](https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/740/jobs/1615) recovered from the compiler issue, confirmed the Linux fixture **build** fix, and executed all 916 backend cases: **903 passed, 13 failed**. These were actionable portability failures rather than another compiler crash: two TLS-rejection cases recorded an empty HTTP read instead of null, and eleven PDF process cases could not start the .NET fixture (exit 131 or ensuing start-marker timeout). The workflow installed .NET in `/root/.dotnet`, but exported `DOTNET_ROOT` only inside the setup step; PATH alone does not supply the runtime location to a native apphost ([Microsoft runtime-location documentation](https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-environment-variables#dotnet_root-dotnet_rootx86-dotnet_root_x86-dotnet_root_x64)).
+
+The correction persists the already-validated runtime path through `GITHUB_ENV`. The TLS assertion accepts null **or an empty string**, while still requiring `HttpRequestException` with `AuthenticationException`, original-host SNI, no custom validation callback and zero HTTP request content. It does not accept whitespace or any HTTP bytes, trust a bad certificate or alter the transport. Fresh explicit-SDK Release verification with `DOTNET_ROOT` set: **98/98** `PdfRenderAdmissionTests|JobImportHttpTransportTests` pass; `.artifacts/redesign-audit/portability.trx`. No application code or test filters changed. The earlier stop rule applies to repeated compiler crashes, not evidence-backed correction of these now-observed test/setup defects.