Record current profile qualification and controller settlement fix

doc/architecture/runner-copilot-capabilities.md

@@ -1,8 +1,8 @@
 # Copilot 1.0.88 rich ACP capability audit
 
-Current checkpoint (2026-09-30): **Copilot profile v6 remains unqualified**. The latest paid controller and Product harness source is `81c20ad22723a2d35d7bd693cc6a47002fb46125`; native runtime source remains `e822b614fc368043f4b3d5e34a8d9bbda644e055`. Current local restrictive-denial evidence passed all ten Product checks and an additive screenshot-reader reconciliation, including denial delivery, no file mutation, explicit cancellation and owned process cleanup. The first attached-command attempt failed supervision. The new controller81 attempt reached task Done but failed exact native-command digest correlation; its cleanup and full end audit passed. The command differs by one leading ASCII space; the bounded fixture-only correction preserves raw digests and exact command content. That original case remains failed because independent settlement observations were not retained before the assertion. Two provider text bursts also produced a doubled final marker, and their native message boundaries remain under investigation. A visible Done status does not prove command settlement. This does not qualify the provider. See the [comparative capability report](runner-rich-acp-capabilities.md) for current evidence and remaining cases. The dated observations below retain their original source/profile identities.
+Current checkpoint (2026-09-30): **Copilot profile v7 remains unqualified**. Paid controller/Product harness source is `40064d28522de25fea85c1297f35b41bb8a8897a`; runtime source is `5b8e4454ef0bf12d0bb068c2e41d8c9df9356a1c`. All three target runtime builds are complete. Local attached-async attempt `40064-copilot-async-01` passed all eight matchers on `gpt-5.6-luna`, including exact one-command identity, trusted child exit and independent completion observations before terminal settlement, one run and one exact final marker. Done was visible, and full end integrity, owned process/semaphore retirement and temporary-root cleanup passed. The exact local native-permission-deny-write case `40064-copilot-deny-01` also passed all ten checks, with no target side effect through process retirement, correlated cancellation and successful cleanup/end integrity. These two local cases pass; the provider remains unqualified. Native per-run USD is unknown; included credits stayed 16→16 after async and reached 17 after denial, with possible dashboard lag, and extra usage remained disabled at $0. Result SHA-256: `d1d074bc9df4644794dfa8b020fdeba8a9b0de4618e1f55d1845f7726a2ece33`; reconciliation SHA-256: `8e9b9233ed987e9e522b17a271922fd409d311e04ee5c3422a4b5bd1fa2fce68`. The prior exact head passed CI and Greptile for [draft #14676](https://github.com/paperclipai/paperclip/pull/14676). The earlier v6 denial pass and attached-command failures remain historical, including the doubled final marker and missing settlement observations; they do not qualify v7. See the [comparative capability report](runner-rich-acp-capabilities.md) for exact source identities and remaining local/Daytona, billing and cleanup gates.
 
-Message identity candidate (2026-09-30, **offline only**): the pinned 1.0.88
+Message identity implementation (2026-09-30, **deterministic evidence and one paid async case; full qualification pending**): the pinned 1.0.88
 ACP mapper discards `assistant.message_start` and removes native `messageId`
 from text deltas. The separate candidate keeps the original executable and
 every embedded distribution asset, patches the hash-pinned JavaScript mapper,
@@ -28,9 +28,8 @@ materialized; this is not native x64/Linux execution proof or paid qualification
 The [complete candidate inventories](../../packages/paperclip-runner/test/fixtures/copilot-message-identity-distributions-1.0.88.json)
 retain platform closure hashes. Private bounded probe receipts are under
 `runtime-6-6-9-eof-preparation/copilot-message-identity-candidate/` in the existing
-qualification artifact collection. The candidate requires a new Copilot profile
-and warm identity; v6 paid failures and missing settlement observations remain
-unchanged. The 1.0.89 comparison moves ACP transport into its native runtime and
+qualification artifact collection. Copilot v7 binds this candidate to a new profile and warm identity; v6 paid
+failures and missing settlement observations remain unchanged. The 1.0.89 comparison moves ACP transport into its native runtime and
 does not establish that upgrading alone fixes message identity.
 
 Initially audited 2026-09-28 against repository base `c65fc9e3c81c41aafe421aa90a00514b84343285`;

doc/architecture/runner-cursor-capabilities.md

@@ -1,6 +1,6 @@
 # Cursor ACP capability inventory
 
-Current checkpoint (2026-09-30): **Cursor profile v6 remains unqualified**. Controller and Product harness source is `41503eb38f03c436b1569f9f0204625bb4d58782`; native runtime source remains `e822b614fc368043f4b3d5e34a8d9bbda644e055`. The current local native-plan case delivered reject, revision and accept, then failed when the normal planning turn ended without semantic task completion. Its 21 bridge checks passed; the overall case remains failed. [Draft #14669](https://github.com/paperclipai/paperclip/pull/14669) implements a passive in-progress wait for explicit user continuation; its deterministic checks pass and paid requalification is pending. Native AskQuestion availability remains unverified. See the [comparative capability report](runner-rich-acp-capabilities.md) for current qualification and platform evidence. The dated observations below retain their original source/profile identities.
+Current checkpoint (2026-09-30): **Cursor profile v7 remains unqualified**. Paid controller/Product harness source is `40064d28522de25fea85c1297f35b41bb8a8897a`; runtime source is `5b8e4454ef0bf12d0bb068c2e41d8c9df9356a1c`. All three target runtime builds are complete. Local native-plan attempt `40064-cursor-plan-01` passed all 21 bridge checks and retained empty workspace snapshots (`{}`), but failed passive accepted-plan settlement. Owned cleanup and the full end integrity audit passed; the overall case remains failed. Controller fix `c58a8881f` repairs a body-only hash comparison to use the production schema/policy/contract envelope; 67 focused tests, ten production-contract database tests and server typecheck pass. The native runtime/profile stays unchanged; corrected-controller paid proof remains pending. Native AskQuestion availability remains unverified. The prior exact head passed CI and Greptile for [draft #14669](https://github.com/paperclipai/paperclip/pull/14669); they do not qualify paid behavior. See the [comparative capability report](runner-rich-acp-capabilities.md) for current source identities and remaining gates. The dated observations below retain their original source/profile identities.
 
 Evidence updated: 2026-09-29. Candidate: `2026.09.26-dd393fe`. This profile is **not live-qualified**. One authorized task-context prompt on the initial free account returned an upgrade requirement, invoked no semantic tools, and supplied no usage receipt. Its cost is unknown; the account dashboard remained unchanged at coarse precision. The user then selected another account, whose exact-model local Runner Eval passed task-context and history tools with clean terminal settlement. Its dashboard attributed 56K rounded tokens to included usage and no incremental charge; ACP still supplied no token or dollar receipt. The local Product hello subsequently passed through the real browser, server, database, native runner, and authenticated completion tool. A second local Product case passed file creation, editing, command validation, an independent exact-byte matcher, and visible workspace artifact presentation. The merged-source local Product question and revision-bound Plan approval also passed browser response and semantic-tool continuation. A serialized follow-up passed pending semantic-question recovery across a server restart. A verified native ACP probe also denied a shell write before any observed side effect. Native Cursor questions/plans and their recovery, durable permission presentation, interruption, and Daytona execution remain required qualification gates.
 
@@ -413,7 +413,7 @@ Cursor6 cannot create a new wait or reopen under Cursor7 admission.
 
 Focused deterministic checks cover the actual observed event order, identity
 normalization boundaries, cancellation/expiry reconstruction, unrelated tools,
-and persisted historical waits and proof tampering. Cursor7 paid qualification
-and newly built runtime/sidecar/pack evidence remain pending. This changes the
+and persisted historical waits and proof tampering. Current runtime/sidecar/pack builds are complete; Cursor7 paid qualification
+remains blocked by the failed settlement case in the checkpoint above. This changes the
 runtime projection and profile contract, while the pinned Cursor native
 executable and distribution patch stay unchanged.

doc/architecture/runner-pi-capabilities.md

@@ -1,6 +1,6 @@
 # Pi rich ACP runtime
 
-Current checkpoint (2026-09-30): **Pi profile v9 remains unqualified**. Native runtime source is `e822b614fc368043f4b3d5e34a8d9bbda644e055`, with verified macOS ARM64/x64 and Linux x64 packaging. No paid profile-v9 pass is claimed. A credential with a verifiable spend limit is still needed for the remaining paid qualification. The optional transport-budget candidate is frozen on a separate branch and is not integrated or a live spending guarantee. See the [comparative capability report](runner-rich-acp-capabilities.md) for the current source identities, qualification requirements and field audit. The dated observations below retain their original profile identities.
+Current checkpoint (2026-09-30): **Pi profile v9 remains unqualified**. Current runtime source is `5b8e4454ef0bf12d0bb068c2e41d8c9df9356a1c`; controller/Product harness source is `40064d28522de25fea85c1297f35b41bb8a8897a`. Runtime builds for macOS ARM64/x64 and Linux x64 are complete. No paid profile-v9 pass is claimed. A credential with a verifiable spend limit is still needed for the remaining paid qualification. The optional transport-budget candidate is frozen on a separate branch and is not integrated or a live spending guarantee. See the [comparative capability report](runner-rich-acp-capabilities.md) for current qualification gates and the field audit. The dated observations below retain their original profile identities.
 
 Historical implementation candidate, 2026-09-29: profile version 8 repairs
 native assistant-message attribution. Real SDK `message_start` and `message_end`

doc/architecture/runner-rich-acp-capabilities.md

@@ -1,15 +1,28 @@
 # Rich ACP integration and qualification report
 
-Updated: 2026-09-30 UTC. **Cursor v7, Copilot v7 and Pi v9 remain unqualified. The latest paid runtime still used Cursor v6 and Copilot v6.** Foundation [#14430](https://github.com/paperclipai/paperclip/pull/14430) and extended Runner Eval definitions [#33](https://github.com/paperclipai/paperclip-evals/pull/33) are merged. The remaining provider and qualification PRs are drafts.
+Updated: 2026-09-30 UTC. **Cursor v7, Copilot v7 and Pi v9 remain unqualified.** Current paid controller and Product harness source is `40064d28522de25fea85c1297f35b41bb8a8897a`; runtime source is `5b8e4454ef0bf12d0bb068c2e41d8c9df9356a1c`. Runtime builds for macOS ARM64, macOS x64 and Linux x64 are complete. Builds and credential-free admission do not qualify authenticated behavior. Reviewed PR head `3f1933db551103e6b9e3e5fa1b3bc905becb6e71` differs from controller40064 only by the OpenCode test fixture's explicit Node-copy dereference option; it does not relabel the frozen execution source.
 
-The [current evidence checkpoint](runner-rich-acp-validation-2026-09-30-current.json) separates the latest completed paid controller/harness source `ca7026182c2b861e3badbcb7e5b733445a6ee403` from unchanged native runtime source `e822b614fc368043f4b3d5e34a8d9bbda644e055`. It retains earlier receipts, original failures and unknown costs. The [earlier September 30 checkpoint](runner-rich-acp-validation-2026-09-30.json) remains historical evidence; no receipt is relabeled for new bytes.
+Before the controller hash fix, exact-head CI passed for Cursor `b74ca5eb976a48e35027be6eb8ea1fb09d181b82` (53 successes, two skips) and Copilot `3f1933db551103e6b9e3e5fa1b3bc905becb6e71` (54 successes, four skips; two superseded duplicate checks cancelled). Those two reviewed heads had no failed or pending checks; Greptile reported 5/5 for both. The subsequent controller fix needs its own CI review. Foundation [#14430](https://github.com/paperclipai/paperclip/pull/14430) and Runner Eval definitions [#33](https://github.com/paperclipai/paperclip-evals/pull/33) are merged. The v7/v7/v9 definition update [#34](https://github.com/paperclipai/paperclip-evals/pull/34) merged as `52f6e897c08d236776a21723257e12c909d71137`, with 136 deterministic tests and 21 validated cells. These definitions are not paid proof. Provider PRs remain drafts.
+
+Current Cursor v7 local attempt `40064-cursor-plan-01` failed passive accepted-plan settlement. All 21 native bridge checks passed; the retained workspace snapshots were `{}`. Owned cleanup and the full end integrity audit passed. The failed case remains failed. Controller fix `c58a8881f2cb771b35e19e1bf56e08cb89397e83` uses the same schema/policy/contract hash envelope as production contract creation; the previous predicate incorrectly hashed the body alone. The production creation/reuse database regression failed before the fix; 67 focused tests, ten database tests and server typecheck pass after it. Runtime bytes and profile identities are unchanged; paid requalification is pending. Copilot v7 local attempt `40064-copilot-async-01` passed all eight matchers: exact one-command correlation, trusted child exit, native-client and independent-marker observations before terminal settlement, attached settlement, one run and one exact final marker. The screenshot shows Done; full end integrity, owned-process/semaphore cleanup and temporary-root cleanup passed. This qualifies this exact local case only. Local `40064-copilot-deny-01` also passed all ten checks, including exact browser denial, absence of the target through process retirement, no alternative native operation and correlated cancellation. Its final screenshot shows the cancelled run and unfinished task as required. Cleanup and the full end integrity audit passed. Denial result SHA-256: `c1fd910ecc4bf9d6df7645f3eb90b45d9cc895cfea9e2f93b4cfdf8a2caf8625`; reconciliation SHA-256: `796954baee57f6ff1f6f05fcfcd8216455e317d462bd68d7b272eabaa640b41b`. Result SHA-256: `d1d074bc9df4644794dfa8b020fdeba8a9b0de4618e1f55d1845f7726a2ece33`; root reconciliation SHA-256: `8e9b9233ed987e9e522b17a271922fd409d311e04ee5c3422a4b5bd1fa2fce68`. Native per-run USD is unknown; the included-credit counter stayed 16→16 after async and reached 17 after denial. Dashboard lag prevents exact per-run attribution. Extra usage remained disabled with a $0 budget; unchanged counters do not prove free inference. Pi v9 has no paid pass and still requires a verifiable OpenRouter spending cap. The optional transport-budget candidate remains frozen and unintegrated.
+
+The [prior evidence checkpoint](runner-rich-acp-validation-2026-09-30-current.json) retains controller/harness `ca7026182c2b861e3badbcb7e5b733445a6ee403` and runtime `e822b614fc368043f4b3d5e34a8d9bbda644e055`; despite its filename, it is historical for the current source. The [earlier September 30 checkpoint](runner-rich-acp-validation-2026-09-30.json) is also historical. Original failures, unknown costs and exact source/profile identities remain unchanged.
+
+| Current production gate | Required evidence or decision |
+| --- | --- |
+| Cursor v7 | Resolve the failed accepted-plan settlement and qualify the exact corrected bytes. Native AskQuestion availability remains unverified; semantic questions cannot substitute for its callback. Complete the required local/Daytona native input, permission, recovery, isolation and warm-continuity cases. |
+| Copilot v7 | The exact local attached-async and native-denial cases passed; broader provider qualification remains pending. Complete the remaining local/Daytona denial, recovery, isolation and warm-continuity cases. Explicit detached work remains unsupported. Native external-tool/sampling/limits callbacks require proof that admitted tools cannot leave an unresolved request, or a qualified responder. |
+| Pi v9 | Obtain an enforced provider spending bound, then run the unchanged required local/Daytona cases against the exact model and final runtime. Historical controls, question and hello passes do not qualify v9. |
+| All providers | Bind every required case to exact controller/runtime/profile and platform evidence, retain failures, complete source/dependency/pack end audits and owned cleanup, and reconcile actual spend within the $100 ceiling. CI and packaging do not substitute for this paid evidence; native Cursor/Copilot per-run USD remains unknown. |
+
+The field inventories and [prioritized follow-ups](#explicit-gaps-and-follow-ups) distinguish native SDK/RPC capability, ACP exposure and Paperclip projection. Image inputs, structured tool diffs/media/raw arguments, secondary locations and typed exit codes remain partial or unused in the common path. Cursor's richer child details and discovery/configuration fields, Copilot's session-scoped files/assets and uncorrelated native notices, and Pi's queue-delivery/configuration fields remain explicit follow-ups. These optional surfaces are not silently claimed as supported or treated as new blockers for unrelated declared cases. Copilot native steering/fork/ask-user APIs do not imply ACP responders; Pi native fork/clone/export likewise have no mapped runner controls. Pi confirm reports `negative_or_cancelled` because No and dismissal are indistinguishable; accepted empty or whitespace-only input/editor responses are not representable by the current canonical form.
 
 | Retained paid observation | Outcome and limit |
 | --- | --- |
 | Cursor v6 Daytona hello, runtime/controller e822 | Six Product matchers passed. Root reconciled the original supervisor cleanup-tail failure using the retained absent sandbox, retired processes and passing integrity audit. Infrastructure upper bound: $0.086931; analytics are provisional. This proves one cell. |
-| Copilot v6 local native denial, controller415/runtimee822 | Ten Product checks passed: delivered denial, correlated native failure, zero target mutations, explicit Stop, cancellation and owned cleanup. An additive screenshot-reader correction used the original evidence without a model retry. Only this case is qualified. |
+| Copilot v6 local native denial, controller415/runtimee822 | Ten Product checks passed: delivered denial, correlated native failure, zero target mutations, explicit Stop, cancellation and owned cleanup. An additive screenshot-reader correction used the original evidence without a model retry. This historical v6 case passed; it does not qualify v7. |
 | Cursor v6 local native plan, controller415/runtimee822 | All 21 native bridge checks passed, including reject, feedback, revision, exact acceptance and reconnect. The case failed because a normal planning stop had no semantic task-completion result. [Draft #14669](https://github.com/paperclipai/paperclip/pull/14669) adds a passive in-progress wait for the next user message. Its later paid attempt is recorded below. |
-| Cursor v6 local native plan, controllerca702/runtimee822 | All 21 native bridge checks passed again. The case failed because the plan's own tool started after its input callback, while the runner had dropped the tool identity needed to distinguish it from unrelated work. Workspace snapshots stayed empty; no second run was observed. Native completion succeeded, but controller settlement failed. All owned processes retired and the full integrity audit passed. Cursor v7 now binds the exact tool lifecycle; fresh paid proof is pending. This failed case is not regraded. |
+| Cursor v6 local native plan, controllerca702/runtimee822 | All 21 native bridge checks passed again. The case failed because the plan's own tool started after its input callback, while the runner had dropped the tool identity needed to distinguish it from unrelated work. Workspace snapshots stayed empty; no second run was observed. Native completion succeeded, but controller settlement failed. All owned processes retired and the full integrity audit passed. Cursor v7 binds the exact tool lifecycle; its later paid settlement failure is recorded above. This failed case is not regraded. |
 | Copilot v6 attached-command settlement, controller415/runtimee822 | Failed supervision: incomplete IPC observation stopped an accepted turn. A later scanner match was a static UI demo string. The owned processes retired; an exact temporary executable copy was separately removed and the full pack audit passed. The original failed observation remains failed. |
 | Copilot v6 attached-command settlement, controller81/runtimee822 | A new authenticated attempt reached task Done, but one leading ASCII space changed the native command digest. A fixture-only correction now permits a bounded leading SPACE/TAB prefix and retains both digests. The original case remains failed: independent settlement observations were not captured before that assertion, and two provider text bursts produced a doubled final marker. The source investigation confirmed that the pinned ACP mapper drops native message IDs. [Draft #14676](https://github.com/paperclipai/paperclip/pull/14676) preserves them in a separately versioned Copilot v7 candidate; no equal-text deduplication is applied. Cleanup, complete IPC observation and the full end integrity audit passed. Included-credit observations changed 15→16; extra usage stayed disabled at $0. A visible Done status alone does not qualify command settlement. |
 
@@ -19,11 +32,11 @@ Exact source415 CI completed with 53 successful checks/statuses and two skips; G
 
 At parent source `6b1e96af0`, CI reported 49 successes, two skips and four failures, including the E2E aggregate. Commit `f401b831f` moves cold route imports into fixture setup and dismisses the actual announcement UI in the attachment browser test. All 26 route tests passed. The attachment test also passed with a forced real announcement and a successful dismissal response. Parent source `aec34c693` then completed CI with 53 successes and two skips. The separate preview-runtime CI stall passed unchanged under local instrumentation; its cause is unconfirmed, and no speculative runtime fix is included.
 
-Cursor v7 source `770dc88a1` preserves the native plan's parent tool identity through TypeScript, the sidecar and Rust. The controller requires one successful lifecycle for that exact tool in the same session and turn, and includes its events in the committed proof. It rejects unrelated work and altered proof. Historical Cursor v6 committed waits remain valid. All 228 focused tests, the Runner TypeScript build and server typecheck pass. Native distribution bytes are unchanged; new runtime packs and paid qualification are pending.
+Cursor v7 source `770dc88a1` preserves the native plan's parent tool identity through TypeScript, the sidecar and Rust. The controller requires one successful lifecycle for that exact tool in the same session and turn, and includes its events in the committed proof. It rejects unrelated work and altered proof. Historical Cursor v6 committed waits remain valid. All 228 focused tests, the Runner TypeScript build and server typecheck pass. Native distribution bytes are unchanged; current runtime builds are complete, while the v7 paid attempt above remains failed.
 
-Copilot v7 source `70b186b3c` preserves real native message identity through the pinned mapper and separates intermediate messages from the final answer. The native executable is unchanged; an owned, verified inner distribution carries the patch. Review fixes add owned-output rollback after failed materialization and actual ACPX history replay coverage before fresh warm turns. All 49 focused JavaScript/TypeScript checks, Runner typecheck and the exact Rust admission check pass. The earlier source passed 212 focused tests and verified complete closures for all three platforms; only ARM64 executed its native loopback proof. That asset evidence remains separate from the current source checks. New runtime packs, remote images, full checks and paid qualification remain pending. The earlier v6 async failure stays failed.
+Copilot v7 source `70b186b3c` preserves real native message identity through the pinned mapper and separates intermediate messages from the final answer. The native executable is unchanged; an owned, verified inner distribution carries the patch. Review fixes add owned-output rollback after failed materialization and actual ACPX history replay coverage before fresh warm turns. All 49 focused JavaScript/TypeScript checks, Runner typecheck and the exact Rust admission check pass. The earlier source passed 212 focused tests and verified complete closures for all three platforms; only ARM64 executed its native loopback proof. That asset evidence remains separate from the current source checks. Current runtime builds and exact-head CI are recorded above; fresh remote image/admission evidence and the remaining paid qualification are separate gates. The earlier v6 async failure stays failed.
 
-Cursor native AskQuestion remains unverified for the inspected exact models/modes. Pi v9 needs a verifiable OpenRouter spending bound before further paid runs. Its optional transport-budget candidate remains frozen: production allocation, launch scope, warm rotation, packaging and Daytona transport are incomplete. The provider-capped key remains the immediate path. Native Cursor/Copilot per-run USD remains unknown. Included usage and a disabled overage budget are billing coverage, not a native price receipt. All 46 attempt records are closed. The $100 campaign authorization remains in force, including failed attempts and infrastructure.
+Cursor native AskQuestion remains unverified for the inspected exact models/modes. Pi v9 needs a verifiable OpenRouter spending bound before further paid runs. Its optional transport-budget candidate remains frozen: production allocation, launch scope, warm rotation, packaging and Daytona transport are incomplete. The provider-capped key remains the immediate path. Native Cursor/Copilot per-run USD remains unknown. Included usage and a disabled overage budget are billing coverage, not a native price receipt. The first 49 attempt records are closed, including the failed Cursor plan and passed Copilot async and denial cases. Later attempts remain separate evidence. The $100 campaign authorization remains in force, including failed attempts and infrastructure.
 
 Current profile identities bind shared runtime contract `paperclip.acpx-runtime-contract.v1`. All ACPX warm owners include that revision in their configuration fingerprint; incompatible owners retire without approval replay. Other transports retain their previous configuration digest. Legacy Cursor and Pi adapters remain unchanged.
 
@@ -58,7 +71,7 @@ adapters are outside this change.
 
 ## Retained paid profile evidence (2026-09-29, collected through September 30 UTC)
 
-The latest paid runtime source is `5605c350b2a4dae75be3779f164d7e1a0e4a5a87`.
+This historical paid checkpoint used runtime source `5605c350b2a4dae75be3779f164d7e1a0e4a5a87`.
 It includes the passive native-read evidence fix from `794e90a258`: correlation
 uses a fixture-owned path digest and the runner's actual opaque tool identity,
 without weakening native permission checks. The 155 focused projector/Product
@@ -220,9 +233,9 @@ Neither has failing or pending checks. A prior external-object mock assertion
 and a runner-shutdown cancellation remain recorded; their exact-job reruns
 passed. No provider is exposed as qualified on this evidence.
 
-## Current production checkpoint (2026-09-29)
+## Historical production checkpoint (2026-09-29)
 
-The basic eval definitions and current profile pin follow-up are merged in
+The basic eval definitions and then-current profile pin follow-up merged in
 `paperclip-evals` PRs [#29](https://github.com/paperclipai/paperclip-evals/pull/29)
 and [#30](https://github.com/paperclipai/paperclip-evals/pull/30). The latter passed
 134 unit tests, CI and Greptile 5/5 at `4a15550d16ced37c6edbafa91a11783a64e4e649`;
@@ -580,7 +593,7 @@ qualification gates, not claims that a JavaScript path check confines a shell.
 
 | Priority | Exposed but unused, partial, or unverified | Reason and next proof |
 | --- | --- | --- |
-| P0 | Remaining paid product cases on local and Daytona | Fresh Cursor5/Copilot5/Pi8 builds require authenticated local and Daytona evidence. Historical Cursor4 passed hello/question/plan/restart but its latest file marker failed despite correct bytes. Copilot4 passed all five basic local journeys and Daytona hello. Pi7 passed native questions but continuation exposed the final-message bug repaired in8. The semaphore blocker is resolved and Cursor's approved on-demand cap is $25. Native interaction, denial, settlement, platform and complete cost/cleanup gates remain open; no old profile pass qualifies new bytes. |
+| P0 | Remaining paid product cases on local and Daytona | Current Cursor7/Copilot7/Pi9 require authenticated local and Daytona evidence on the exact current runtime. Historical Cursor4 passed hello/question/plan/restart but its latest file marker failed despite correct bytes. Copilot4 passed all five basic local journeys and Daytona hello. Pi7 passed native questions but continuation exposed the final-message bug repaired in8. The semaphore blocker is resolved and Cursor's approved on-demand cap is $25. Native interaction, denial, settlement, platform and complete cost/cleanup gates remain open; no old profile pass qualifies new bytes. |
 | P0 | Pi fresh-profile Product verification | Historical v4 plan startup failed with unavailable Postgres semaphores. Historical v6 attempts exposed profile admission and verified-runtime startup faults, repaired without raising deadlines. Preserve every failed attempt and run unchanged canonical cases against the final build; do not remove unrelated IPC objects. |
 | P0 | Copilot native ask-user and plan-decision callbacks | Pinned ACP does not install native responders. Prove no blocking request is exposed, or add a qualified responder/wrapper; never swallow the request. |
 | P0 | Broader Copilot denial and background settlement qualification | Pinned 1.0.88 and isolated 1.0.89 settle attached async commands, but deliberately detached work can finish after end_turn. The earlier paid detached success depended on that model waiting and is not general settlement evidence. Profiles v3/v4 reject explicit detached admission before effects; governed long-lived background work remains unsupported. Denial and process-death recovery pass offline; paid local/Daytona proof remains required. |
@@ -651,7 +664,7 @@ tokens across twelve qualification requests and zero on-demand tokens. The resta
 rows showed 23.8K and 41.7K included tokens; denial used 24.4K. Displayed credit precision
 and delayed accounting do not establish
 a per-run zero receipt. These measurements are
-partial, not a final all-provider total. No Daytona leases have been started.
+partial, not a final all-provider total. At that historical ledger checkpoint, no Daytona leases had been started; subsequent Daytona attempts are recorded above.
 Registry downloads, fake-model fixtures and metadata-only authenticated discovery
 are separate from model inference.