diff --git a/.dockerignore b/.dockerignore
index 2386941de44..8ae5f323da0 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -55,6 +55,7 @@ packages/paperclip-runner/test-fixtures/pi-acp/**
 !packages/paperclip-runner/test-fixtures/pi-acp/profile-v21-identity.json
 !packages/paperclip-runner/test-fixtures/pi-acp/profile-v22-identity.json
 !packages/paperclip-runner/test-fixtures/pi-acp/profile-v23-identity.json
+!packages/paperclip-runner/test-fixtures/pi-acp/profile-v24-identity.json
 !packages/paperclip-runner/docs/capability-contract.md
 # check:runner-workflow-traceability access()es every regression test the
 # stress-traceability spec names — those are src/**/*.test.ts files, so
diff --git a/doc/plans/2026-10-12-claude-runner-default.md b/doc/plans/2026-10-12-claude-runner-default.md
index bc6a0cfcb6e..2aeb78a6e7d 100644
--- a/doc/plans/2026-10-12-claude-runner-default.md
+++ b/doc/plans/2026-10-12-claude-runner-default.md
@@ -578,3 +578,10 @@ candidate source through the existing provider-free cloud workflow, with tooling
 and product identities recorded separately. No publication, deployment or paid
 retry is part of that campaign. The actual foundation code-owner approval and
 master reconciliation remain external prerequisites for normal merge sequencing.
+
+The first corrected candidate's cloud Docker-context check independently found
+profile 24 excluded by the existing explicit attestation allowlist. The new
+fixture now has its own exception alongside immutable prior identities; other
+fixtures remain excluded. Cloud job 115053600515 retained the exact ENOENT
+failure. No local Docker invocation was used. The next composed heads must pass
+this check before candidate package qualification.