diff --git a/doc/grok-native-runner.md b/doc/grok-native-runner.md
index 5fa4282eb13..b31d1686872 100644
--- a/doc/grok-native-runner.md
+++ b/doc/grok-native-runner.md
@@ -43,7 +43,7 @@ not forwarded to Grok.
 ## Evaluation
 
 The private `paperclip-evals` repository maintains `live-acpx-grok-4.7.json` and
-`rosters/live-acpx-grok.json`. The roster covers all 35 protocol cases. Its campaign
+`rosters/live-acpx-grok.json`. The roster covers all 39 protocol cases. Its campaign
 lane remains disabled pending complete live qualification.
 
 Product E2E exposes `runner-acpx-grok` in core local/Daytona compatibility and
diff --git a/packages/paperclip-runner/src/index.ts b/packages/paperclip-runner/src/index.ts
index 7aeec692b85..9f4fdb02757 100644
--- a/packages/paperclip-runner/src/index.ts
+++ b/packages/paperclip-runner/src/index.ts
@@ -42,7 +42,7 @@ export * from "./drivers/codex/codex-app-server-driver.js";
 export * from "./drivers/opencode/opencode-server-driver.js";
 export * from "./drivers/opencode/mcp-bridge.js";
 export * from "./drivers/acpx/qualified-profiles.js";
-export { acpxRuntimeSessionDirectoryName } from "./drivers/acpx/recovery-identity.js";
+export { acpxRuntimeSessionDirectoryName, resolveAcpxRuntimeRoot } from "./drivers/acpx/recovery-identity.js";
 export {
   probeQualifiedAcpxEnvironment,
   type ProbeQualifiedAcpxEnvironmentOptions,
diff --git a/server/src/services/native-runtime/native-session-executor.test.ts b/server/src/services/native-runtime/native-session-executor.test.ts
index fdb5082c886..0fed37007ca 100644
--- a/server/src/services/native-runtime/native-session-executor.test.ts
+++ b/server/src/services/native-runtime/native-session-executor.test.ts
@@ -26,6 +26,7 @@ import {
 } from "@paperclipai/db";
 import {
   acpxRuntimeSessionDirectoryName,
+  resolveAcpxRuntimeRoot,
   createPrpSemanticToolInputEnvelope,
   createPrpSemanticToolResultEnvelope,
   validatePrpStructuredRunResult,
@@ -7788,7 +7789,10 @@ describe("runnerd provider runtime wiring", () => {
         runnerInstanceId: "grok-cleanup", managedAiCredentialHome: managedHome });
       state.createBackend.mock.calls.at(-1)![1].codexTransportFactory!();
       const runtimeDirectory = state.createTransport.mock.calls.at(-1)![0].acpxRuntimeDirectory!;
-      const agentHome = join(runtimeDirectory, acpxRuntimeSessionDirectoryName(execution.session.normalizedSessionId!), "grok-home");
+      await mkdir(runtimeDirectory, { recursive: true });
+      // Use the runtime's real resolver, so this test cannot reproduce a
+      // controller-side guess that omits the nested ACPX namespace.
+      const agentHome = join(await resolveAcpxRuntimeRoot(runtimeDirectory, execution.session.normalizedSessionId!), "grok-home");
       await mkdir(agentHome, { recursive: true, mode: 0o700 });
       for (const name of ["auth.json", "auth-refresh.json", "auth-refresh.json.tmp"]) {
         await writeFile(join(agentHome, name), "fixture-refreshed-login", { mode: 0o600 });
diff --git a/server/src/services/native-runtime/native-session-executor.ts b/server/src/services/native-runtime/native-session-executor.ts
index e15e6ce883c..ed3cc490b39 100644
--- a/server/src/services/native-runtime/native-session-executor.ts
+++ b/server/src/services/native-runtime/native-session-executor.ts
@@ -12658,7 +12658,9 @@ async function createRunnerdBackendWithinSessionClaim(
   const wrapManagedSession = (session: NativeSession): NativeSession => {
     if (isGrok && grokCredential?.home && !boundManagedSessions.has(session)) {
       boundManagedSessions.add(session);
-      const relativeHome = `acpx/${acpxRuntimeSessionDirectoryName(nativeSessionKey(input.execution))}/grok-home`;
+      // The launch runtime directory already ends in "acpx"; ACPX adds its
+      // own namespace beneath it in resolveAcpxRuntimeRoot.
+      const relativeHome = `acpx/acpx/${acpxRuntimeSessionDirectoryName(nativeSessionKey(input.execution))}/grok-home`;
       const localHome = resolve(resolvePaperclipInstanceRoot(), "runtime", "paperclip-runner", relativeHome);
       const remoteHome = remoteRunnerFilesystemRoot ? posix.join(remoteRunnerFilesystemRoot, relativeHome) : null;
       const readAuth = async (name: string): Promise<Buffer> => {