Merge branch 'codex/claude-runner-default' into codex/claude-runner-platforms

* codex/claude-runner-default:
  docs: record fresh review fixes and guarded Claude UI evidence
  fix(runner): retain cancelled Claude setup writes without blocking abort

doc/plans/2026-10-12-claude-runner-default.md

@@ -1315,3 +1315,39 @@ stopped on its404 target check before creating an attachment or work product.
 That foreign instance is left untouched. Claude preview recovery must select
 a separate port and the existing Claude data directory; the historical3105
 link is no longer a usable Claude preview.
+
+
+### Fresh review and cancellation correction — 2026-10-14
+
+Fresh reviews passed behavior 7069077274 and platforms 6b0cb979d4 at 5/5.
+Protocol 519e8369a1 received two valid findings: stale profile 23 catalog
+expectations and an owned Claude settings write that blocked startup abort.
+Correction dd82936c1d updates the Pi 25 expectations/fingerprint and uses the
+existing abort-aware admission helper, transferring the unfinished write and
+lifetime lease to retained cleanup. Both successful and failing late writes
+return cancellation promptly while rejecting a competing provider. All 55
+runtime-host tests, 72 Pi evidence controls, runner noemit and profile/manifest
+checks pass. These are fake-provider controls, not paid execution evidence.
+
+Hosted jobs 38606914671 and 38606913944 received simultaneous runner shutdown
+signals at 17:35:06 UTC. One failed-job prerequisite rerun was requested before
+the new review findings. Credential-free package campaign 38607132186 was
+canceled once the runtime fix invalidated its source 6b0cb979d4. Completed
+producer outputs remain historical; no new package qualification is claimed.
+A replacement package campaign waits for fresh review of the corrected runtime.
+
+The existing Product E2E browser helper exercised UI source 7069077274 against
+the retained older backend at 3115 through New Agent, Claude Code and Advanced.
+The runner shows Paperclip Runner (default); keyboard Legacy/native selection
+passes. Stable light/dark screenshots at 1440 and 390 px show no horizontal page
+overflow. The inherited Custom Gateway subtitle clips on 390 px; Claude API-key
+controls remain visible. Every API mutation was blocked by the browser guard;
+one local connection-attempt request was intercepted, no agent was created and
+no setup probe or provider turn was submitted. This establishes UI rendering
+and controls only, not saved-default persistence or final runtime execution.
+UI receipt: /private/tmp/claude-current-ui-review-20261014.json.
+Retained Claude preview: http://127.0.0.1:3115 (historical runtime treatment).
+The prior reconciliation report was uploaded to its original completed QA task
+and independently byte-checked: attachment aabe2e7e-a8a0-4408-bc7e-a013e0f7485b,
+5916 bytes, SHA256 3bd9bcfa64db6a3a7968952122b1a5c2ae27e24f0e4ff336fd47ae374bae8ff1.
+Paid acceptance and budget/hold changes remain stopped pending human approval.

packages/paperclip-runner/src/drivers/acpx/runtime-host.test.ts

@@ -264,7 +264,7 @@ describe("ACPX runtime host", () => {
     } finally { await nextOwner.close({ reason: "next owner complete" }); }
   });
 
-  it("keeps the Claude lifetime lease until an owned settings write settles after cancellation", async () => {
+  it.each([false, true])("cancels Claude startup promptly while retaining its settings write and lease (late failure: %s)", async failWrite => {
     const fixture = await hostFixture();
     const controller = new AbortController();
     let announceWrite!: () => void;
@@ -280,6 +280,7 @@ describe("ACPX runtime host", () => {
       return { ...sandbox, initializeOwnedConfiguration: async () => {
         announceWrite();
         await writePending;
+        if (failWrite) throw new Error("settings write failed after cancellation");
         await initialize?.();
       } };
     };
@@ -289,6 +290,8 @@ describe("ACPX runtime host", () => {
     try {
       await writeStarted;
       controller.abort(new Error("settings admission cancelled"));
+      await runAcpxOperationAttempt(() => rejected, Date.now() + 1_000);
+      expect(openRuntime).not.toHaveBeenCalled();
       await expect(AcpxRuntimeHost.open(options, fixture.dependencies({ openRuntime }))).rejects.toThrow("already has an active lease");
     } finally { finishWrite(); }
     await rejected;

packages/paperclip-runner/src/drivers/acpx/runtime-host.ts

@@ -483,7 +483,19 @@ export class AcpxRuntimeHost {
         });
       }
       options.signal?.throwIfAborted();
-      await sandbox.initializeOwnedConfiguration?.();
+      const configurationLifetime = credential;
+      await runAbortableAdmissionStage(
+        options.signal,
+        async () => { await sandbox.initializeOwnedConfiguration?.(); },
+        cleanup => {
+          pendingRuntimeOwnsCredential = true;
+          const retained = cleanup.then(() => cleanupAbortedRuntimeAdmission(
+            null, configurationLifetime, "ACPX owned configuration cancelled",
+          ));
+          retainRuntimeHostCleanup(retained);
+          dependencies.retainAdmissionCleanup?.(retained);
+        },
+      );
       options.signal?.throwIfAborted();
       assertAcpxProfileEnvironment(options.agent, sandbox.launchEnvironment);
       let launchEnvironment = sandbox.launchEnvironment;

tests/runner-e2e/pi-controls-evidence.test.ts

@@ -189,8 +189,8 @@ describe("Pi controls catalog admission", () => {
     // Extended v3 states the strict file oracle's task-wide Bash limit.
     const pi = runnerMatrix.find(c => c.profile.qualificationCandidate === "pi")!.profile;
     expect(pi.modelQualification?.qualificationId).toBe("pi:0.0.33:1.0.0:openrouter");
-    expect(runnerSuites.find(s => s.id === "pi-native")!.definitionMetadata).toMatchObject({ version: 23, remoteProcExit: "separately-confirmed-absence-after-read-failure", taskCreation: "explicit-title-and-creation-response-id", agentMemoryParent: "public-managed-file-seed-before-admission", incompleteTerminalCleanup: "retirement-retained-with-failed-watch", profileVersion: 23, agentMemoryContent: "utf8-nonce-plus-final-lf", agentMemoryPrompt: "single-json-write-and-content-bound-native-read-both-runs", agentMemoryReadAuthority: "local-withheld-or-exact-remote-agent-run-file", taskPromptTransport: "fenced-markdown-paste-and-multiline-literal-escapes", nativeFinish: "current-contract-objective-evidence-refs", providerFaultExecutable: "stable-preinstalled-runner-link-and-snapshot-node-inode-with-held-bootstrap-fd-3-or-7" });
-    expect(runnerSuites.find(s => s.id === "pi-controls")!.definitionMetadata).toMatchObject({ version: 10, remoteProcExit: "separately-confirmed-absence-after-read-failure", taskCreation: "explicit-title-and-creation-response-id", profileVersion: 23,
+    expect(runnerSuites.find(s => s.id === "pi-native")!.definitionMetadata).toMatchObject({ version: 23, remoteProcExit: "separately-confirmed-absence-after-read-failure", taskCreation: "explicit-title-and-creation-response-id", agentMemoryParent: "public-managed-file-seed-before-admission", incompleteTerminalCleanup: "retirement-retained-with-failed-watch", profileVersion: 25, agentMemoryContent: "utf8-nonce-plus-final-lf", agentMemoryPrompt: "single-json-write-and-content-bound-native-read-both-runs", agentMemoryReadAuthority: "local-withheld-or-exact-remote-agent-run-file", taskPromptTransport: "fenced-markdown-paste-and-multiline-literal-escapes", nativeFinish: "current-contract-objective-evidence-refs", providerFaultExecutable: "stable-preinstalled-runner-link-and-snapshot-node-inode-with-held-bootstrap-fd-3-or-7" });
+    expect(runnerSuites.find(s => s.id === "pi-controls")!.definitionMetadata).toMatchObject({ version: 10, remoteProcExit: "separately-confirmed-absence-after-read-failure", taskCreation: "explicit-title-and-creation-response-id", profileVersion: 25,
       remoteProcessIdentity: "observer-pid-startTicks-bootId",
       controlPlaneSettlement: "required-scoped-result-and-terminal-after-runner" });
     expect(runnerSuites.find(s => s.id === "extended-harnesses")!.definitionMetadata).toMatchObject({ version: 5, piFileArtifactTitle: "exact-filename", piFileCommandTransport: "fenced-bash-markdown-paste" });
@@ -200,7 +200,7 @@ describe("Pi controls catalog admission", () => {
     }
     const hashes = Object.fromEntries(runnerSuites.filter(s => ["pi-native", "native-active-stop", "extended-harnesses", "rich-acp-warm-continuity"].includes(s.id)).map(s => [s.id, suiteDefinitionHash(s)]));
     expect(hashes).toEqual({
-      "pi-native": "3c77ced7edfb99aa12052f451398da7580466a54abadcaf287d31ee12c16382d",
+      "pi-native": "fca73103d5791b9babe5b51cdbb38629c7b30732687969f4714f8af133803df9",
       "native-active-stop": "2d4fdeeb75bd531b309bd1b35cfa5680ceefdeee6b7155b068dd011ce9901980",
       "rich-acp-warm-continuity": "331b88d9538a132670789fb7864df7df5f4bf294ae19b62f53d8a02f901774f0",
       "extended-harnesses": "5de4fac78d4d581bc0954f07b5cf2df2862d37f8b0205325eede6d9ef6d9f5e6",