docs(boat): record live retry evidence and remaining failures

This commit is contained in:
Dotta committed 2026-10-10 20:46:10 -05:00
1 parent 21deac0abf
commit 8a45ed84c9
4 files changed
+778 -48

No files matched your search

+57 -31
View File
@@ -6,68 +6,94 @@
| Surface | Source and evidence |
| --- | --- |
| Canonical combined branch | `2ef177271ad703cef598b19b0d2219297c57ca6c`, including the later scoped viewer-disconnect correction. Local controller32 qualification remains attributed to `8b2a71c1e4a9029d5a8e96ce22c760fccaab4d9f`, identical to earlier `3673939bed4cb85f20d142f950547e3a60502bca`. |
| Core branch | `754a4e792e077999989b088a910ce9d846280fda`. |
| Serving staging at this cutoff | `2df40da4587725571f94b20806b0da154418d774`, deployment11 verified at 21:20:11 UTC on 2026-10-10; official receipt checked at 21:20:39.509. Earlier product observations below remain attributed to 73b2. |
| Next staging candidate | `1830beb0c26a7ba9d5e21460426936936ffc8db4` matches current 2ef1772 runtime with only compatible migration metadata changes. Build 38087300389 is in progress; deployment12 has not occurred. Serving 2df40da lacks the later isolated viewer fix, but corrected legacy product follow-ups now passed there. |
| Canonical combined branch | `21deac0abfd2919525114f8cdc4a0d49f139665a`: exact Boat cleanup scope, verified retained ACPX provider packages, and fixed-field cancellation diagnostics. All identity and settlement gates remain. |
| Core branch | `66ac692e446bd2ce0175613787f82eeb048f2749`; optional cancellation diagnostics are in the acceptance PR. |
| Serving staging | `610c78a5ad97534380c61fa376c96c1b7a73a86a`, deployment 13 verified 2026-10-11 at 01:05:49 UTC; official receipt checked at 01:05:58.740. Runtime-equivalent to d50268c932 with compatible migration metadata. |
| Deployment / retry boundary | Deployment 12 had verified 1830beb serving on 2026-10-10 at 22:14:02.236; its failed retries remain recorded below. One ordinary Retry on deployment 13 started run `5957cc86` at 01:06:33, requesting a fresh session; fresh run succeeded at 01:09:46. It cannot diagnose the old saved-session failure. Its ordinary warm follow-up `1b882646` passed. Later `2ac97bd2` was unexpectedly cancelled, and two repair attempts failed before provider work; idle resume remains unverified. Earlier deployment 11 legacy passes remain attributed to 2df40da. |
[Candidate provenance](assets/2026-10-10-boat/evidence/final-candidate-provenance.json) records the exact comparison; [deployment11](assets/2026-10-10-boat/evidence/staging-deploy-11-verified.json) verifies the new serving commit. This is deployment proof, not a product-journey pass. The experimental staging database retains its previously applied migration prefix; future staging deployments must preserve it. The main PR retains canonical history. Deployment9 stopped at strict preflight before provider deployment mutation. Subsequent checks proved a real old-database upgrade, matching schemas, and a valid forward manifest without rewriting history, resetting the database, or bypassing a guard.
The [consolidated retry receipt](assets/2026-10-10-boat/evidence/retry-qualification-summary.json) records deployment 12 and 13 verification, exact retry outcomes, checks and original-receipt hashes. Deployment proof does not establish a product journey. Historical [candidate provenance](assets/2026-10-10-boat/evidence/final-candidate-provenance.json) and [deployment 11](assets/2026-10-10-boat/evidence/staging-deploy-11-verified.json) retain their original cutoff. The experimental staging database retains its previously applied migration prefix; future staging deployments must preserve it. The main PR retains canonical history. Deployment 9 stopped before provider deployment mutation; subsequent old-database upgrade, schema and forward-manifest checks passed without reset, history rewrite or guard bypass.
## Product outcomes
All times below are UTC on 2026-10-10. “Passed” applies only to the named observation; gaps remain explicit.
Historical product observations in this table are UTC on 2026-10-10; the retry table gives its later dates. “Passed” applies only to the named observation; gaps remain explicit.
| Journey | Confirmed outcome | Limit / remaining condition |
| --- | --- | --- |
| Attach and onboard four runtime combinations | Staging73b2: fresh native Codex/Claude and legacy CLI Codex/Claude agents completed browser setup using selected API accounts. All four first jobs produced files in distinct persistent personal homes. | Corrected legacy follow-ups subsequently passed on 2df40da; latest isolated viewer fix still requires staging qualification. Two earlier partial setup records were paused and excluded. |
| Corrected legacy instructions and completion | Local32/canonical3673939 passed both follow-ups. Staging 2df40da: Claude `8efa7432` succeeded 21:21:53→21:23:29 and Codex `29b92e02` succeeded 21:21:37→21:23:29. Both actually read persistent personal `AGENTS.md`, retained their prior proof hash, and completed through the helper without a recovery run. Claude actually invoked `Skill(paperclip)`. | Claude task activity mislabeled its final helper “stopped”; the run audit showed successful helper JSON, done at 21:23:15.588, and run success. Codex first used wrong helper arguments, then corrected them and exited 0. These are recorded imperfections, not hidden failures. Older 73b2 recovery-dependent follow-ups remain historical failures. |
| Legacy CLI UI guard | Staging2df40da: existing Boat Codex and Claude runtime pages each showed only the corresponding CLI engine, selected. | Read-only UI inspection; no configuration saved and no probe invoked. |
| Native Claude cold → warm → idle → resume | Local26/8f11a70b: cold 3m46, warm 1m39 with the same runnerPID33242. Checkpoints suspended, PID disappeared, owner retired, and archive completed before ordinary follow-up resumed the same durable session with a replacement runner/new boot and unchanged hashes. Staging73b2 also passed cold 8m56, warm 1m50, physical idle disappearance, and ordinary post-idle return 6m21 with unchanged proof. | Claude provider subprocesses restart between warm turns; stable runner/session is the claim. Staging did not export the full suspended-checkpoint/ledger timeline. Earlier preparation ownership is not treated as runner identity. |
| Native Codex post-idle and computer use | Local25/c9c0a47b: second-idle continuation succeeded after exact retirement/archive, with launch/focus/keyboard/window tool receipts. Staging73b2: Cua and visible desktop passed. | Final-candidate staging rerun remains pending. |
| Vite, browser preview, and warm HMR | Local23/85746677, UI76a499cc: detached Vite retained runner/provider/server identity across warm turns; a heading hot-reloaded while an unsaved draft and page-session value stayed unchanged. Natural idle later removed the owned processes/listener. Staging73b2 launched Vite and generated a preview link. | **Staging HMR is unverified:** browser navigation returned `ERR_BLOCKED_BY_CLIENT`; no blocked-URL workaround was used. Staging first-job→development-turn runner reuse is not claimed. A later lease-selection fix also needs staging requalification. |
| Desktop viewing and human control | Local31/19d827a1 and staging73b2: normal embedded viewer keyboard events opened a terminal and entered a command with visible expected output. Native Cua, desktop rendering, and bounded viewer expiry passed. | Independent human mouse input remains unverified. IBus separation was sampled outside the runner cgroup; that sample alone is not an additional expiry test. |
| Durable file editor | Local30/ac09d6ec: normal Instructions save survived full browser reload, then original content was restored and reread. Local28/3081b748 onboarding initialized readable remote instructions. | Source-specific editor/onboarding evidence; not a new runtime-execution claim. |
| Attach and onboard four runtime combinations | Staging 73b2: fresh native Codex/Claude and legacy CLI Codex/Claude agents completed browser setup using selected API accounts. All four first jobs produced files in distinct persistent personal homes. | Corrected legacy follow-ups subsequently passed on 2df40da; deployment 12 verified the isolated viewer fix; the later close/archive retry is recorded below. Two earlier partial setup records were paused and excluded. |
| Corrected legacy instructions and completion | Local 32/canonical 3673939 passed both follow-ups. Staging 2df40da: Claude `8efa7432` succeeded 21:21:53→21:23:29 and Codex `29b92e02` succeeded 21:21:37→21:23:29. Both actually read persistent personal `AGENTS.md`, retained their prior proof hash, and completed through the helper without a recovery run. Claude actually invoked `Skill(paperclip)`. | Claude task activity mislabeled its final helper “stopped”; the run audit showed successful helper JSON, done at 21:23:15.588, and run success. Codex first used wrong helper arguments, then corrected them and exited 0. These are recorded imperfections, not hidden failures. Older 73b2 recovery-dependent follow-ups remain historical failures. |
| Legacy CLI UI guard | Staging 2df40da: existing Boat Codex and Claude runtime pages each showed only the corresponding CLI engine, selected. | Read-only UI inspection; no configuration saved and no probe invoked. |
| Native Claude cold → warm → idle → resume | Local 26/8f11a70b: cold 3m46, warm 1m39 with the same runnerPID33242. Checkpoints suspended, PID disappeared, owner retired, and archive completed before ordinary follow-up resumed the same durable session with a replacement runner/new boot and unchanged hashes. Staging 73b2 also passed cold 8m56, warm 1m50, physical idle disappearance, and ordinary post-idle return 6m21 with unchanged proof. | Claude provider subprocesses restart between warm turns; stable runner/session is the claim. Staging did not export the full suspended-checkpoint/ledger timeline. Earlier preparation ownership is not treated as runner identity. |
| Native Codex post-idle and computer use | Local 25/c9c0a47b: second-idle continuation succeeded after exact retirement/archive, with launch/focus/keyboard/window tool receipts. Staging 73b2: Cua and visible desktop passed. | The subsequent 1830 retry failed before a new runner launched; see the retry table. |
| Vite, browser preview, and warm HMR | Local 23/85746677, UI 76a499cc: detached Vite retained runner/provider/server identity across warm turns; a heading hot-reloaded while an unsaved draft and page-session value stayed unchanged. Natural idle later removed the owned processes/listener. Staging 73b2 launched Vite and generated a preview link. | Earlier staging preview navigation returned `ERR_BLOCKED_BY_CLIENT`; no workaround was used. On deployment 13 the normal generated link rendered, and warm runner/provider/Vite identity was preserved. **Staging HMR remains unverified:** the reported edit had not appeared in the browser at this cutoff. |
| Desktop viewing and human control | Local 31/19d827a1 and staging73b2: normal embedded viewer keyboard events opened a terminal and entered a command with visible expected output. Native Cua, desktop rendering, and bounded viewer expiry passed. | Deployment 13 direct browser desktop mouse and keyboard subsequently passed; current embedded input remains unverified because automation targeted the outer page. IBus separation was sampled outside the runner cgroup; that sample alone is not an additional expiry test. |
| Durable file editor | Local 30/ac09d6ec: normal Instructions save survived full browser reload, then original content was restored and reread. Local 28/3081b748 onboarding initialized readable remote instructions. | Earlier source-specific pass; the later save/read retry is inconclusive because the fresh read returned 502 provider_error. |
| Shared Boat and separate personal folders | Distinct durable roots, concurrent listener ports, and file persistence across later resumes were observed for native and legacy agents. | One-agent cancellation while a sibling continues remains explicitly unverified. Shared Unix UID and desktop provide no per-agent OS security boundary. |
| Restore failure cleanup | A provider snapshot restore timeout caused the expected probe failure; the Boat naturally archived and the controller retired its owner, leaving zero live owners/pending actions. No manual reset or retirement was used. | A handled failure, not a successful restore. Later onboarding used a separate clean fixture. |
| Database upgrade | Local28 retained the existing computer and original migration receipt while applying upstream schema changes. Compatible staging schema/manifest checks passed and73b2 deployed. | The next candidate must pass normal deployment checks; compatibility evidence is not product acceptance. |
| Database upgrade | Local 28 retained the existing computer and original migration receipt while applying upstream schema changes. Compatible staging schema/manifest checks passed and 73b2 deployed. | Deployment 12 subsequently verified 1830 serving; compatibility and deployment evidence are not product acceptance. |
Receipts: [staging corrected legacy runs](assets/2026-10-10-boat/evidence/staging-11-legacy-regression.json), [local corrected legacy runs](assets/2026-10-10-boat/evidence/local-32-legacy-acceptance.json), [Claude lifecycle](assets/2026-10-10-boat/evidence/claude-cold-warm.json), [Codex second idle](assets/2026-10-10-boat/evidence/codex-second-idle.json), [local HMR](assets/2026-10-10-boat/evidence/vite-warm-hmr.json), [partial staging](assets/2026-10-10-boat/evidence/staging-73b2-acceptance.json), and [editor save](assets/2026-10-10-boat/evidence/local-30-persistent-save-proof.json).
## Latest retries
These outcomes do not erase earlier source-specific passes. The [retry receipt](assets/2026-10-10-boat/evidence/retry-qualification-summary.json) preserves the failures and the narrower boundary checks.
| Retry | Result and boundary |
| --- | --- |
| Staging 1830 native Codex | Run `20c69872` failed after three same-run attempts with `runner_remote_retirement_checkpoint_unsettled`, before a new runner launched. Remote checkpoint lifecycle was `ready`, runner outbox was empty, and pending terminal delivery was null; the controller proof rejection is not yet identified. Diagnostics now serve on deployment 13; UI retry `5957cc86` requested a fresh session and skipped saved-session resume. It succeeded, but cannot diagnose this old recovery failure. |
| Staging 610 fresh → warm | Fresh `5957cc86` succeeded at 01:09:46 (3m13). Ordinary follow-up `1b882646` completed around 01:12:14. Independent receipts preserved normalized session, provider thread, runner PID 30466/start ticks 30188, Codex PID 30570 and Vite PID 31093, with unchanged proof hash. Later configuration turn `2ac97bd2` was cancelled; it is excluded from the successful warm claim. Saved-session continuation after natural idle remains unverified. |
| Staging 610 preview / HMR | The normal generated link rendered, with an unsaved draft and page-session baseline. The reported edit never appeared despite Vite reporting connected. Published and Vite-cwd files had identical bytes but different device/inode identities in the same mount namespace; this does not establish the cause. Polling configuration existed on disk, but loading by the running server was not proved. The fixture lacked a React HMR plugin; proposed repair never executed. Preview later became upstream-unavailable after owner retirement. **HMR has not passed.** |
| Staging 610 unexpected cancellation / quarantine | `2ac97bd2` ended **cancelled**, exit 0, at 01:19:01.499, with reason “Execution stopped without a recorded cancellation request”, source unknown and expected false. It is not a successful run. Follow-ups `139092c0` and `d33c8290` failed with `native_session_cleanup_quarantined` before provider work; no fixture repair ran and quarantine was preserved. |
| Staging 610 retirement / persistent proof | Exact owner `f298be2e` retirement marker dates to 01:19:05.647, generation 3. At 01:28:20–01:28:58, no owned processes or listeners remained and the original proof hash was intact. The saved `2ac97bd2` checkpoint remained ready with empty outbox/no pending terminal and authoritative inactive provider turn; that does not override the controller cancellation. Boat was healthy and hydrated at 01:27:43 with no newer provider stop. This is post-cancellation cleanup evidence, not a natural idle-resume pass. |
| Staging 610 native Claude | `a38070b3` failed `setup_failed` after 12m42 (01:18:44→01:31:25). The expanded log identifies a durable ACPX launch-profile digest mismatch after approximately 990MiB provider-pack upload. A later lease-acquisition attempt reported “Computer is connecting or settling a previous stop”; a lease-deadline cause is not proved. Recovery remained bootstrap with provider work not started. Stage sync took 473,763ms; transport connected at 01:27:47. An independent 01:29:48 checkpoint read found suspended state, empty outbox and pending terminal delivery. The reviewed correction on 21deac0abf reuses the package pinned by bound controller state. It passed 33 focused tests and server TypeScript; deployment 14 is pending, with no live recovery pass yet. Earlier Claude passes remain source-specific. |
| Staging 610 provider observation before desktop retry | Read-only provider status at 01:33:52 showed archived and healthy, with stop completed at 01:32:48.421 and no error. No manual stop/wake or post-archive guest read was performed at that point. Normal Computer Connect later resumed the fixture around 01:35; this receipt does not describe its later state. |
| Staging 610 desktop comparison | Normal task Computer Connect from archived state around 01:35 reached the stream around 01:38. The same provider viewer opened directly in a browser tab accepted a native mouse click that opened Chrome and keyboard events that visibly entered `boatlive0141` around 01:41: **direct browser desktop mouse and keyboard passed**. Opening a second stream froze the original embedded frame; after close/reconnect it showed the updated desktop. Embedded Ctrl+A selected the outer Paperclip page, an automation-targeting limitation rather than a validated product input failure. Both viewers closed normally around 01:43; archive after this close is not yet verified. |
| Staging 610 sibling Stop | Normal Stop around 01:14:44 cancelled an active automatic continuation; UI showed Stopped and the task was blocked. Independent inspection before Stop found no foreground sleeper, so live child-process cancellation and sibling isolation remain unverified. |
| Staging 1830 native Claude / sibling test | Run `3a34` failed during setup before the planned idle/sibling experiment. No sibling isolation pass or root cause is claimed. The fixture later naturally archived. |
| Staging 1830 desktop / close | Stream visible at 00:43 and 00:50 on 2026-10-11. Input attempts produced no observable result, and one timed out before sending input: controls remain unverified on this retry. Normal Close Computer preceded natural archive; stop completed 00:50:43.150 and archived/snapshots-preserved state was observed 00:51:49. No manual provider stop. |
| Local 817 controller restart | First run `3681473c` succeeded. Orderly shutdown retired the old owner; the remote checkpoint was suspended, old descendants absent, and the one-line marker retained. Continuation `f5f361a7` failed with cleanup quarantine after host sleep spanning 22:31–22:48 on 2026-10-10. **Inconclusive** for successful restart continuation or active-crash recovery; quarantine was preserved. |
| Local 817 fresh task | Initial setup attempt `de63e6ba` was also confounded by host sleep. Ordinary retry `e8c52459` succeeded 00:42:00.094→00:45:27.883 on 2026-10-11; independent read found exactly one marker line and its matching hash. Its exact owner later retired and physical archive completed at 00:52:14.179; no post-archive checkpoint read was attempted. No restart/continuation has yet been attempted for this task. |
| Local instruction save / detach | Two saves returned HTTP 200, but the subsequent fresh read returned 502 `provider_error` during the host-wake failure. Durable bytes were not independently verified; this is not evidence of a missing file. No detach was performed. |
| Local authorization boundary | Authenticated foreign-company issue read and board foreign-task computer connect returned 404; no owner ledger change or foreign computer row was observed. Temporary credentials were revoked. This is a live local boundary pass, not a staging journey. |
Deployment 14 candidate `5cf388845902c88d0406116ed9b2c44f335d8bb2` was dispatched through the official workflow at 01:45 UTC with request `f4e5af86-8ad0-4ebd-ad97-f2a9173015af`. Build and rollout are pending; deployment 13 is the last verified serving source.
## Checks and their limits
| Check | Recorded result |
| --- | --- |
| Current runtime CI, observed 21:32:06 | Combined `2ef177271a`: 52 successful checks, fresh 5/5 review, zero unresolved threads. |
| Current core CI, same observation | Core `754a4e792e`: 52 successful checks, two policy skips, fresh 5/5 review, zero unresolved threads. |
| Latest scoped-disconnect checks | Proof246c28c03a:16 route +44 module cases passed (60 total), and server TypeScript passed; production integrated into combined2ef1772/core754a4e. Runtime CI is recorded above; later documentation commits require separate checks. |
| Legacy correction |57 execute cases and 6 config cases passed; both adapter TypeScript checks passed. Actual local32 runs subsequently verified skill invocation and completion. |
| Clean file-resource CI | Core 5e5fe7a7: 44 passed, 0 skipped, including 7 fallback/search regressions.48 focused adapter cases and server TypeScript also passed on that source. |
| Earlier broad checks | Local29/b375f465 full build and recursive typecheck passed. Earlier native framing/cache/lifecycle checks retain their individual provenance. No combined final-head full local suite pass is claimed. |
| Frozen full local baseline | Source 2cbe65e9: all 21 projects and 158 serialized suites attempted; **34,914 passed,24 failed,338 skipped**. Original failure/skip provenance remains intact. |
| Earlier runtime CI, observed 2026-10-10 21:32:06 | Combined `2ef177271a`: 52 successful checks, fresh 5/5 review, zero unresolved threads. |
| Earlier core CI, same observation | Core `754a4e792e`: 52 successful checks, two policy skips, fresh 5/5 review, zero unresolved threads. |
| Diagnostic-only recovery reasons | d50268c932: 54 focused cases and server TypeScript passed. On 2026-10-11, combined d502 had 52 successful checks, fresh 5/5 review and zero unresolved threads at 00:58:18; core ee2 had 52 successes, 2 skips and fresh review at 00:52:12. These exact-head CI passes do not establish staging acceptance or a full local suite pass. |
| Latest fixes | Cleanup scope: 8 focused and 2 quarantine-fence tests passed. Retained ACPX package recovery: 26 cache/package and 7 manifest/bootstrap tests passed. Cancellation diagnostics: 7 focused tests passed. Server TypeScript and independent package-authority review passed. Latest-head CI is pending. |
| Scoped-disconnect checks | Proof 246c28c03a: 16 route + 44 module cases passed (60 total), and server TypeScript passed; production integrated into combined 2ef1772/core 754a4e. Runtime CI is recorded above; later documentation commits require separate checks. |
| Legacy correction | 57 execute cases and 6 config cases passed; both adapter TypeScript checks passed. Actual local 32 runs subsequently verified skill invocation and completion. |
| Clean file-resource CI | Core 5e5fe7a7: 44 passed, 0 skipped, including 7 fallback/search regressions. 48 focused adapter cases and server TypeScript also passed on that source. |
| Earlier broad checks | Local 29/b375f465 full build and recursive typecheck passed. Earlier native framing/cache/lifecycle checks retain their individual provenance. No combined final-head full local suite pass is claimed. |
| Frozen full local baseline | Source 2cbe65e9: all 21 projects and 158 serialized suites attempted; **34,914 passed, 24 failed, 338 skipped**. Original failure/skip provenance remains intact. |
[Current CI receipt](assets/2026-10-10-boat/evidence/current-head-ci-review.json) is a timestamped observation, not a guarantee of later status. [Full-suite limits](assets/2026-10-10-boat/evidence/full-suite-limits.json) preserve original failures and separately attributed retries: identified adapter-utils/migration/server cases passed focused retries;8 native failures were addressed on later revisions. Three CLI worktree cases and the persona suite remained blocked by native PostgreSQL bootstrap/shared-memory exhaustion. The isolated Git streaming retry exceeded its unchanged 300-second timeout. No unrelated IPC or kernel settings were changed. Earlier local file-resource tests skipped 41 cases; later clean CI executed 44 successfully without retroactively converting the local run into a pass.
[Earlier runtime CI receipt](assets/2026-10-10-boat/evidence/current-head-ci-review.json) is a timestamped observation, not a guarantee of later status. [Full-suite limits](assets/2026-10-10-boat/evidence/full-suite-limits.json) preserve original failures and separately attributed retries: identified adapter-utils/migration/server cases passed focused retries; 8 native failures were addressed on later revisions. Three CLI worktree cases and the persona suite remained blocked by native PostgreSQL bootstrap/shared-memory exhaustion. The isolated Git streaming retry exceeded its unchanged 300-second timeout. No unrelated IPC or kernel settings were changed. Earlier local file-resource tests skipped 41 cases; later clean CI executed 44 successfully without retroactively converting the local run into a pass.
## Resource state and remaining conditions
The [latest inventory](assets/2026-10-10-boat/evidence/local-final-resource-inventory.json) records both local computer ledgers at 21:14:08 with zero live owners and no pending actions. Provider observations at 20:38 and20:53 recorded both local fixtures, the builder, and staging archived with snapshots preserved and completed stops. These are point-in-time receipts; subsequent staging deployment/qualification may resume its fixture. They do not assert a final state after future work. After the staging11 legacy jobs, the provider naturally archived with snapshots preserved; stop `stop_23f9f3d30edcffdb` completed at 21:23:43.156 and read-only observation confirmed archived at 21:30:07.746. No manual stop was required. This newer staging receipt is included with the [legacy regression evidence](assets/2026-10-10-boat/evidence/staging-11-legacy-regression.json).
The [historical inventory](assets/2026-10-10-boat/evidence/local-final-resource-inventory.json) records both local computer ledgers at 21:14:08 with zero live owners and no pending actions. Provider observations at 20:38 and 20:53 recorded both local fixtures, the builder, and staging archived with snapshots preserved and completed stops. These are point-in-time receipts; subsequent staging deployment/qualification may resume its fixture. They do not assert a final state after future work. After the staging11 legacy jobs, the provider naturally archived with snapshots preserved; stop `stop_23f9f3d30edcffdb` completed at 21:23:43.156 and read-only observation confirmed archived at 21:30:07.746. No manual stop was required. The later viewer-close archive is recorded in the retry table. This staging11 receipt is included with the [legacy regression evidence](assets/2026-10-10-boat/evidence/staging-11-legacy-regression.json).
Automated semantics already have meaningful coverage: the [latest 60-case route/module receipt](assets/2026-10-10-boat/evidence/latest-core-test-provenance.json) records a pass on proof246c28c03a with exact tested-file blob hashes. It also preserves the earlier48-case Boat adapter pass on unchanged files. These checks do not replace the live journeys below.
Automated semantics already have meaningful coverage: the [latest 60-case route/module receipt](assets/2026-10-10-boat/evidence/latest-core-test-provenance.json) records a pass on proof246c28c03a with exact tested-file blob hashes. It also preserves the earlier 48-case Boat adapter pass on unchanged files. These checks do not replace the live journeys below.
| Condition | Existing automated evidence | Scope limit |
| --- | --- | --- |
| Sibling retirement | [Computer service tests](../../server/src/modules/computers/application/service.test.ts): “does not suspend another agent and fences admission until provider stop completes”. | Mock backend/ledger: retiring one owner must not stop the machine while another holds it; no live sibling process cancellation. |
| Detach retention | Same file: “keeps snapshot and attachment proof when detached”. | Asserts detach/stop/ledger state and rejected readmission; does not write and reread a retained file. |
| Feature off / stale viewer cleanup | [Computer route tests](../../server/src/__tests__/computer-routes.test.ts): “disables new connections and previews while preserving authenticated disconnect” and “disconnects the previous viewer when the task computer has %s”. | HTTP gate and authenticated cleanup remain usable; not a live feature-toggle sweep. |
| Company/owner denial | Route tests: “hides cross-company tasks exactly like missing tasks”; service tests: “rejects cross company scopes before provider access” and “disconnects only the exact company-scoped viewer owned by the current user without provider access”. | Express/mocked repository boundary tests; no live cross-company request claimed. |
| Crash/restart fencing | Service tests: “reconciles a crashed controller reservation only after its durable deadline” and “reuses warm process identity and port while fencing stale callbacks”. | Simulated durable state, clock and generation fences; not an actual controller crash/restart. |
| Company/owner denial | Route tests: “hides cross-company tasks exactly like missing tasks”; service tests: “rejects cross company scopes before provider access” and “disconnects only the exact company-scoped viewer owned by the current user without provider access”. | Also a live local foreign-issue/task denial with unchanged ledger is recorded in the retry receipt; staging remains unverified. |
| Crash/restart fencing | Service tests: “reconciles a crashed controller reservation only after its durable deadline” and “reuses warm process identity and port while fencing stale callbacks”. | Automated fences passed. A real orderly local restart reached a suspended checkpoint, but continuation was confounded by host sleep; no successful restart journey claimed. |
Still unverified or incomplete at this cutoff:
- Deployment12/serving-source confirmation for the later isolated viewer fix, its targeted qualification, and the remaining final-source acceptance matrix. Corrected legacy follow-ups passed on deployment11.
- Staging browser preview/HMR; independent human mouse input.
- Exercise a legitimate saved-session continuation on diagnostic source; UI Retry `5957cc86` requested a fresh session and cannot diagnose the old recovery gate. Fresh and warm turns now passed; ordinary post-idle continuation is still needed for the new session. The old failure remains unresolved. Latest Codex configuration turn was unexpectedly cancelled and both repair attempts were quarantined before work; latest native Claude retry failed during setup. These current-source failures remain unresolved.
- Staging HMR and embedded desktop input. Preview rendering passed before unexpected runner retirement. The on-disk polling change was not proved loaded; React fixture repair did not execute. Direct browser desktop mouse and keyboard passed; embedded input remains unverified because automation targeted the outer page, and the second viewer interfered with the original stream.
- Explicit cancellation of one agent while a sibling continues on the same Boat.
- Product-level detach with retained files, feature-off cleanup, cross-company denial, and controller restart without duplicate execution. Existing confinement/conflict/lifecycle tests are useful but are not substituted for these journeys.
- CI on any subsequent documentation commit and paid-resource state after remaining qualification. Core and combined runtime checks are green on the exact sources above.
- Product detach with retained-file verification, live feature-off cleanup, staging company denial, and successful controller restart continuation without duplicate execution. The local boundary pass and automated fences remain narrower evidence.
- Checks on subsequent commits and paid-resource state after any further qualification. Diagnostic-head CI is green on the exact sources above; deployment 12 and earlier corrected legacy passes do not imply complete acceptance.
Known v1 limits: cold startup can be expensive; immutable pack reuse avoids repeat large uploads but verification/staging still costs time. Managed snapshots and never-retried private cache uploads can retain disk pending operator cleanup. Arbitrary shell writers can race editor writes; no universal filesystem CAS guarantee is claimed. Dev servers survive warm turns when detached from the provider shell’s process group and still terminate with their owning runner at timeout.
@@ -1,43 +1,45 @@
# Boat acceptance evidence
These allowlisted summaries support the [validation matrix](../../../2026-10-10-boat-validation.md). They record observed results on named sources, not a blanket final-revision pass. Originals remain separately preserved; `provenance.json` records their filenames and SHA-256 hashes.
These allowlisted summaries support the [validation matrix](../../../2026-10-10-boat-validation.md). They record observed results on named sources, not a blanket final-revision pass. Originals remain separately preserved; `provenance.json` records earlier originals; the consolidated retry summary carries its own original filenames and SHA-256 hashes.
## Current boundary
Canonical combined source is `2ef177271ad703cef598b19b0d2219297c57ca6c`; core is `754a4e792e077999989b088a910ce9d846280fda`. Local controller32 qualification remains attributed to earlier `3673939bed` (identical tracked tree at `8b2a71c1e4`). Deployment11 verified serving `2df40da458` at 21:20:11 UTC, matching the earlier3673939 runtime. Both corrected legacy journeys subsequently passed on 2df40da without recovery, with persistent AGENTS reads, unchanged proof hashes, and helper disposition. Current canonical2ef1772/core754a4e contain a later scoped viewer-disconnect correction; compatible candidate1830beb/build38087300389 is in progress; no deployment12 is claimed. Earlier staging product receipts remain attributed to 73b2. The CI receipt records the exact current runtime heads; subsequent documentation commits need their own checks.
Canonical candidate is `21deac0abfd2919525114f8cdc4a0d49f139665a`; core is `66ac692e446bd2ce0175613787f82eeb048f2749`. The reviewed fixes scope cleanup to its Boat owner and retain verified ACPX packages across deployment. Fixed-field cancellation diagnostics preserve outcome precedence. Deployment 14 candidate `5cf388845902c88d0406116ed9b2c44f335d8bb2` is pending; the serving evidence below remains deployment 13. Deployment 12 verified serving `1830beb0c26a7ba9d5e21460426936936ffc8db4` at 2026-10-10 22:14:02.236 UTC, runtime-equivalent to earlier 2ef1772. Deployment 13 verified 610c78a5 serving at 2026-10-11 01:05:49 UTC, runtime-equivalent to d502; UI Retry 5957cc86 started a fresh session and succeeded; the ordinary warm follow-up preserved runner/provider/Vite identity. Preview rendered, but HMR and saved-session idle recovery remain unverified. Later `2ac97bd2` was unexpectedly cancelled (not succeeded), its owner retired, and both repair attempts were quarantined before work. Native Claude `a38070b3` failed during setup; the first observed failure was an ACPX durable launch-profile digest mismatch after the pack upload, not a proved lease-deadline failure. The provider naturally archived at 01:32:48.421, confirmed at 01:33:52. A later normal Computer Connect resumed it for a desktop comparison: direct browser mouse and keyboard passed around 01:41; embedded input remains unverified because automation targeted the outer page. Both viewers closed normally around 01:43; no subsequent archive claim is made. The new retry summary records staging failures, local host-sleep limitations, a local authorization boundary pass, and natural viewer-close archive. Earlier receipts retain their exact sources and original cutoffs; the candidate/CI files below are historical, not current-status assertions.
| Receipt | Source / narrow claim |
| --- | --- |
| [Staging11 corrected legacy runs](staging-11-legacy-regression.json) | Both runs succeeded 21:23:29, real Claude Skill launched, both persistent entries/proofs read, helper disposition passed without recovery. Includes the Claude activity-display inconsistency, Codex corrected arguments, and natural archive at 21:23:43.156. |
| [Deployment11 serving receipt](staging-deploy-11-verified.json) | Official verification of 2df40da serving; no product pass implied. |
| [Candidate provenance](final-candidate-provenance.json) | Exact canonical/candidate comparison. Prior candidate `2df40da` built successfully; current `1830beb` build is pending. Not deployment proof. |
| [Exact runtime-head CI and review](current-head-ci-review.json) | At 21:32:06 UTC, combined `2ef177271a` and core `754a4e792e` each had 52 successful checks, fresh 5/5 review, and zero unresolved threads. Core had two policy skips. |
| [Scoped cleanup tests](latest-core-test-provenance.json) | Proof246c28c03a:16 route +44 module cases passed; server TypeScript passed. Earlier48-case adapter source and unchanged-file blobs are recorded. No live negative journey implied. |
| [Corrected legacy CLI runs](local-32-legacy-acceptance.json) | Local32: both actual runs succeeded and issues became done through helpers; hashes matched prior files. Codex read persistent instructions; Claude actually invoked `Skill(paperclip)`. Claude had no configured personal instructions, so that mapping is not a live claim. |
| [Latest retry qualification](retry-qualification-summary.json) | Deployments 12 and 13 verified; native failures on 1830 are preserved, and fresh and warm turns on 610 passed but cannot diagnose the old failed session. Preview rendered; HMR remains unverified and on-disk polling was not proved loaded. Later Codex cancellation, quarantine, owner retirement with intact proof, and Claude setup failure are preserved. Direct browser desktop mouse and keyboard passed; embedded input has an automation-targeting limit. Local restart/save observations are inconclusive; ordinary fresh-task retry, local authorization denial and viewer-close archive have narrower proof. Includes exact diagnostic-head CI: d502 with 52 successes/fresh 5/5/zero unresolved, and ee2 with 52 successes/2 skips/fresh review, plus original-receipt hashes. |
| [Staging 11 corrected legacy runs](staging-11-legacy-regression.json) | Both runs succeeded 21:23:29, real Claude Skill launched, both persistent entries/proofs read, helper disposition passed without recovery. Includes the Claude activity-display inconsistency, Codex corrected arguments, and natural archive at 21:23:43.156. |
| [Deployment 11 serving receipt](staging-deploy-11-verified.json) | Official verification of 2df40da serving; no product pass implied. |
| [Candidate provenance](final-candidate-provenance.json) | Exact canonical/candidate comparison. Historical cutoff: 2df40da built while 1830beb was pending. Later deployment 12 verification is in the retry summary. |
| [Earlier runtime-head CI and review](current-head-ci-review.json) | At 21:32:06 UTC, combined `2ef177271a` and core `754a4e792e` each had 52 successful checks, fresh 5/5 review, and zero unresolved threads. Core had two policy skips. |
| [Scoped cleanup tests](latest-core-test-provenance.json) | Proof 246c28c03a: 16 route + 44 module cases passed; server TypeScript passed. Earlier 48-case adapter source and unchanged-file blobs are recorded. No live negative journey implied. |
| [Corrected legacy CLI runs](local-32-legacy-acceptance.json) | Local 32: both actual runs succeeded and issues became done through helpers; hashes matched prior files. Codex read persistent instructions; Claude actually invoked `Skill(paperclip)`. Claude had no configured personal instructions, so that mapping is not a live claim. |
| [Staging product receipts](staging-73b2-acceptance.json) | Four fresh onboardings/first jobs, native Claude cold/warm/post-idle, native Codex Cua/desktop/keyboard. Earlier legacy disposition failures remain distinct; staging preview/HMR is unverified. |
| [Claude lifecycle](claude-cold-warm.json) | Local26/8f11a70b: cold/warm exact runner continuity, natural idle checkpoints/retirement/archive, replacement runner retaining durable session and hashes. Provider subprocess PIDs restart. |
| [Codex second idle](codex-second-idle.json) | Local25/c9c0a47b: ordinary continuation after exact retirement/archive, including computer tool receipts. |
| [Warm Vite and HMR](vite-warm-hmr.json) | Local23/85746677, UI76a499cc: same processes across warm turns and hot reload preserving draft/page state. No final-source or staging HMR claim. |
| [Keyboard input](local-31-human-keyboard-proof.json) | Local31/19d827a1 normal viewer keyboard input. Staging keyboard is separately recorded above. Neither proves independent mouse input. |
| [Claude lifecycle](claude-cold-warm.json) | Local 26/8f11a70b: cold/warm exact runner continuity, natural idle checkpoints/retirement/archive, replacement runner retaining durable session and hashes. Provider subprocess PIDs restart. |
| [Codex second idle](codex-second-idle.json) | Local 25/c9c0a47b: ordinary continuation after exact retirement/archive, including computer tool receipts. |
| [Warm Vite and HMR](vite-warm-hmr.json) | Local 23/85746677, UI 76a499cc: same processes across warm turns and hot reload preserving draft/page state. No final-source or staging HMR claim. |
| [Keyboard input](local-31-human-keyboard-proof.json) | Local 31/19d827a1 normal viewer keyboard input. Staging keyboard is separately recorded above. Neither proves independent mouse input. |
| [Desktop input lifetime](desktop-input-lifetime.json) | IBus observed outside the runner slice; cgroup sample, not a separate expiry test. |
| [Persistent editor](local-30-persistent-save-proof.json) | Local30/ac09d6ec save survived full reload; original content restored and reread. |
| [Persistent editor](local-30-persistent-save-proof.json) | Local 30/ac09d6ec save survived full reload; original content restored and reread. |
| [Local read/build checks](local-29-acceptance.json) | Source b375f465: live Instructions read, full build and recursive TypeScript passed. |
| [Legacy CLI selector](local-final-cli-ui-proof.json) | UI ce1a49bb/backend ac09d6ec read-only Codex CLI guard observation; no new task. |
| [Focused checks](focused-checks.json) | Earlier checks retain individual source attribution. |
| [Clean file-resource CI](file-resource-clean-ci-proof.json) | Core 5e5fe7a7: 44 passed, 0 skipped, including 7 regressions. |
| [Earlier core CI](core-5e5-final-ci-review.json) | Historical exact-head receipt; does not describe current core. |
| [Full-suite limits](full-suite-limits.json) | Frozen 2cbe65e9:34,914 passed,24 failed,338 skipped; original failures and separate retries preserved. |
| [Full-suite limits](full-suite-limits.json) | Frozen 2cbe65e9:34,914 passed, 24 failed, 338 skipped; original failures and separate retries preserved. |
| [Compatibility](staging-compat-final-proof.json), [manifest](staging-compat-manifest-proof.json), [schema](staging-compat-schema-proof.json) | Source-specific runtime/schema equality and strict migration-prefix evidence. Future staging deployments must retain the compatible prefix. |
| [Deployment9 preflight](staging-deploy-9-assessment.json) | Stopped before provider deployment mutation; no reset/history rewrite/guard bypass. |
| [Deployment 9 preflight](staging-deploy-9-assessment.json) | Stopped before provider deployment mutation; no reset/history rewrite/guard bypass. |
| [Latest resource inventory](local-final-resource-inventory.json) | Local ledgers at 21:14:08: zero live owners/pending actions. Provider snapshots at 20:38/20:53: both local fixtures, builder and staging archived. Later qualification may resume a fixture. |
The older `local-final-state.json` is a historical snapshot, superseded for cleanup by the timestamped latest inventory. Resource receipts are not claims about state after future work.
## Limits
The feature remains experimental and unmerged. Final isolated viewer-fix staging qualification, staging HMR, independent mouse input, sibling cancellation isolation, detach retention, feature-off cleanup, company denial, and controller restart/no duplicate execution remain unverified product conditions. Shared personal folders use one Unix UID; they are not an OS security boundary. Shell writers can race editor writes. Cold startup can be expensive; retained private staging/snapshot files may need operator cleanup.
The feature remains experimental and unmerged. Unexpected cancellation/quarantine, current-source Claude setup, saved-session continuation, staging HMR, embedded desktop input, sibling cancellation isolation, detach retention, live feature-off cleanup, staging company denial, and successful controller restart continuation remain incomplete. Local authorization denial, earlier viewer-close archive, and direct browser desktop keyboard/mouse passed. The latest two-viewer comparison showed stream interference and did not validate embedded input. Neither establishes the remaining journeys. Shared personal folders use one Unix UID; they are not an OS security boundary. Shell writers can race editor writes. Cold startup can be expensive; retained private staging/snapshot files may need operator cleanup.
The frozen full-suite result is not green. Later fixes/retries do not erase it: the isolated Git streaming retry exceeded its unchanged 300-second timeout, and CLI/persona cases remained blocked by native PostgreSQL bootstrap/shared-memory exhaustion. Earlier local file-resource skips remain recorded despite subsequent clean-CI success.
This bundle excludes credentials, private hosting/viewer URLs, internal home paths, raw logs/DOM, environment/profile values, and private-cloud links. Run IDs and proof hashes are retained only where they make an acceptance claim inspectable.
Direct Boat browser input proof: [Chromium with the typed marker](../staging-13-direct-desktop-input.png). This proves direct viewer input, not embedded input targeting.
@@ -0,0 +1,702 @@
{
"schema": "paperclip.boat.validation-retry-summary.v1",
"recordedAt": "2026-10-11T01:45:57.847565+00:00",
"scope": "Source-specific retry observations; not complete acceptance.",
"source": {
"canonical": "d50268c932da9e03c304f6a48cdaa5ee477331f2",
"core": "ee2a01063e3efdd3ddd75de05ff8e831302045fd",
"servingStaging": "610c78a5ad97534380c61fa376c96c1b7a73a86a",
"diagnosticCandidate": "610c78a5ad97534380c61fa376c96c1b7a73a86a",
"candidateRuntimeEquivalentTo": "d50268c932",
"candidateBuildId": 38099244581,
"candidateBuildState": "succeeded; deployment13 verified"
},
"deployment12": {
"checkedAt": "2026-10-10T22:14:02.236Z",
"requestedSha": "1830beb0c26a7ba9d5e21460426936936ffc8db4",
"servingSha": "1830beb0c26a7ba9d5e21460426936936ffc8db4",
"status": "succeeded",
"verification": "verified"
},
"stagingRetries": {
"codex": {
"runIdPrefix": "20c69872",
"result": "failed",
"errorCode": "native_session_recovery_failed",
"causeCode": "runner_remote_retirement_checkpoint_unsettled",
"sameRunAttempts": 3,
"newRunnerLaunchObserved": false,
"remoteCheckpoint": {
"lifecycle": "ready",
"outboxCount": 0,
"pendingTerminalDeliveryIsNull": true,
"completedTurnAuthoritative": true,
"activeProviderTurnId": null
},
"conclusion": "Remote lifecycle was ready, runner outbox was empty, and pending terminal delivery was null; the exact old controller settlement/authority rejection remains unknown. Deployment 13 UI Retry created a fresh session, so it did not exercise the old recovery path."
},
"claude": {
"runIdPrefix": "3a34",
"result": "setup_failed",
"timing": "Failed before the planned idle/sibling experiment.",
"rootCause": "not established",
"siblingIsolationProved": false
},
"desktop": {
"observedUtc": [
"2026-10-11T00:43Z",
"2026-10-11T00:50Z"
],
"streamVisible": true,
"inputVerified": false,
"inputLimit": "Iframe key/native click attempts produced no observable change; a frame-body input attempt timed out before sending input.",
"closedThroughProductUi": true
},
"viewerCleanup": {
"observedAt": "2026-10-11T00:51:49.916111+00:00",
"state": "archived",
"snapshots": true,
"stop": {
"id": "stop_74ba7b3408c7739e",
"status": "completed",
"endedAt": "2026-10-11T00:50:43.150Z",
"error": null
},
"manualProviderLifecycleActions": false
},
"diagnosticCodex": {
"runId": "5957cc86-4533-49e5-a2af-0edbc79a472f",
"submittedAt": "2026-10-11T01:06:33Z",
"method": "One ordinary Retry through the product UI",
"retriesRunIdPrefix": "20c69872",
"lastObservedStatus": "succeeded",
"outcome": "fresh session passed; old failed session recovery not tested",
"forceFreshSession": true,
"resumeSkipped": true,
"scope": "Normal UI Retry requests a fresh session. This run cannot diagnose saved-session recovery.",
"uiLogObservedAt": "2026-10-11T01:07:39Z",
"plannedQualification": "Fresh and ordinary warm same-task turns passed. Later configuration turn 2ac97bd2 was cancelled unexpectedly; subsequent repair attempts failed before provider work. Saved-session continuation after natural idle remains unverified.",
"finishedAt": "2026-10-11T01:09:46Z",
"reportedDurationSeconds": 193,
"proofSha256": "f9253e57dadaefe9276e99a9cd0cb9fad68d2704dd820b61e026edf6e6527c46"
},
"warmCodex": {
"runId": "1b882646-db75-4009-9915-6175e22c1724",
"status": "succeeded",
"reportedFinishedAtApproximate": "2026-10-11T01:12:14Z",
"freshObservedAt": "2026-10-11T01:10:10.278830+00:00",
"warmObservedAt": "2026-10-11T01:13:28.977661+00:00",
"normalizedSessionId": "06496696-b312-4268-ac40-66770aaa6f1a",
"providerSessionId": "01a12881-5d3b-72a0-b4c3-d993f5b089e1",
"runnerInstanceId": "0005a613-101d-475f-9409-8b8e8b87e9ce",
"sameNormalizedSession": true,
"sameProviderSession": true,
"sameRunnerInstance": true,
"proofSha256": "f9253e57dadaefe9276e99a9cd0cb9fad68d2704dd820b61e026edf6e6527c46",
"proofHashUnchanged": true,
"preservedProcesses": [
{
"role": "runner",
"pid": 30466,
"startTicks": 30188,
"sameIdentity": true
},
{
"role": "codex",
"pid": 30570,
"startTicks": 30308,
"sameIdentity": true
},
{
"role": "vite",
"pid": 31093,
"startTicks": 31238,
"sameIdentity": true
}
]
},
"preview": {
"rendered": true,
"method": "Normal product-generated preview link in the in-app browser; no blocked-URL workaround",
"pageSessionValue": "1791680976579",
"draftValue": "keep-this-unsaved-draft-boat-0110",
"hotReloadVerified": false,
"observation": "The normal generated link rendered. A reported heading edit did not appear in the browser despite Vite reporting connected. The preview later became upstream-unavailable after the runner owner retired.",
"pollingConfig": {
"observedAt": "2026-10-11T01:18:35.720747+00:00",
"presentOnDisk": true,
"pollIntervalMs": 1000,
"loadedByRunningViteProved": false
},
"reactFixture": {
"reactPluginInstalled": false,
"reactPluginImported": false,
"statePreservingHmrContractProved": false,
"repairExecuted": false
},
"fileViews": {
"observedAt": "2026-10-11T01:16:21.230982+00:00",
"sameBytes": true,
"sameMountNamespace": true,
"publishedDeviceAndInodeDifferFromViteCwd": true,
"rootCauseEstablished": false
},
"limitation": "On-disk polling configuration does not prove that the running Vite process loaded it. The proposed React fixture repair never executed because both follow-ups failed before provider work."
},
"siblingCancellation": {
"stopClickedAtApproximate": "2026-10-11T01:14:44Z",
"uiStatus": "Stopped",
"scope": "Active automatic continuation cancelled through normal Stop; task blocked.",
"foregroundSleeperVerifiedBeforeStop": false,
"independentReadAt": "2026-10-11T01:13:58.401450+00:00",
"liveChildSleepCancellationProved": false,
"siblingIsolationProved": false
},
"codexConfigurationTurn": {
"runId": "2ac97bd2-9f7c-4d9b-bca5-78637e354422",
"status": "cancelled",
"exitCode": 0,
"lifecycleEventSequence": 340,
"terminalAt": "2026-10-11T01:19:01.499Z",
"cancellation": {
"reason": "Execution stopped without a recorded cancellation request",
"source": "unknown",
"expected": false
},
"isSuccessfulWarmTurn": false,
"limit": "A ready remote checkpoint and authoritative completed provider turn do not override the controller run outcome of cancelled."
},
"codexRepairAttempts": {
"runs": [
{
"runId": "139092c0-64d2-46e1-8906-9e69c00c081b",
"status": "failed"
},
{
"runId": "d33c8290-8e16-44a6-8bb1-58164ea5c754",
"status": "failed"
}
],
"errorCode": "native_session_cleanup_quarantined",
"providerWorkStarted": false,
"fixtureRepairExecuted": false,
"quarantinePreserved": true
},
"postCancellationSettlement": {
"observedAt": "2026-10-11T01:28:58.739454+00:00",
"ownerId": "f298be2e-3cc1-4e9c-957e-4931aad9a503",
"retired": true,
"retiredAt": "2026-10-11T01:19:05.647102+00:00",
"ownerGeneration": 3,
"ownedProcessCount": 0,
"ownedListenerCount": 0,
"proofSha256": "f9253e57dadaefe9276e99a9cd0cb9fad68d2704dd820b61e026edf6e6527c46",
"proofHashUnchanged": true,
"proofBytes": 24,
"sameBootAsWarmRun": true,
"checkpoint": {
"observedAt": "2026-10-11T01:28:31.217794+00:00",
"schema": "paperclip.runner.durable.state.v1",
"lifecycle": "ready",
"runId": "2ac97bd2-9f7c-4d9b-bca5-78637e354422",
"normalizedSessionId": "06496696-b312-4268-ac40-66770aaa6f1a",
"runnerInstanceId": "0005a613-101d-475f-9409-8b8e8b87e9ce",
"environmentLeaseId": "5957cc86-4533-49e5-a2af-0edbc79a472f",
"turnId": "turn_attachment_dc251dc322254e15b62b1af28d7e9819",
"itemId": "item_attachment_625fc1793a804d6e914dc74f0741d39f",
"outboxCount": 0,
"pendingTerminalDeliveryIsNull": true,
"provider": {
"schema": "paperclip.runner.codex-provider-state.v1",
"lifecycle": "session_open",
"completedTurnAuthoritative": true,
"activeProviderTurnId": null,
"threadId": "01a12881-5d3b-72a0-b4c3-d993f5b089e1"
}
},
"provider": {
"at": "2026-10-11T01:27:43.251027+00:00",
"state": "idle",
"hydrated": true,
"health": "ok",
"error": null,
"snapshots": true,
"stop": {
"id": "stop_74ba7b3408c7739e",
"status": "completed",
"requestedAt": null,
"lastAttemptAt": "2026-10-11T00:50:43.150Z",
"error": null,
"endedAt": "2026-10-11T00:50:43.150Z"
}
},
"systemdLimit": "Unit was collected. Manager messages reported missing paths during collection; these do not establish a process crash.",
"manualLifecycleOrGuestFileMutations": false,
"scope": "Snapshot after an unexpected cancellation, not a successful natural warm-timeout or post-idle continuation test."
},
"diagnosticClaude": {
"runId": "a38070b3-6c87-435c-8d60-f01ac9fac4b7",
"status": "failed",
"errorCode": "setup_failed",
"startedAt": "2026-10-11T01:18:44Z",
"finishedAt": "2026-10-11T01:31:25Z",
"reportedDurationSeconds": 762,
"acquireLeaseError": "Computer is connecting or settling a previous stop",
"executionRecoveryStage": "bootstrap",
"providerWorkStarted": false,
"stageSyncDurationMs": 473763,
"runnerTransportConnectedAt": "2026-10-11T01:27:47Z",
"remoteCheckpoint": {
"observedAt": "2026-10-11T01:29:48.453917+00:00",
"lifecycle": "suspended",
"outboxCount": 0,
"pendingTerminalDeliveryIsNull": false,
"modifiedAt": "2026-10-11T01:28:06.792491+00:00"
},
"scope": "This latest retry failed; earlier source-specific Claude successes remain valid but do not establish success here.",
"firstFailure": {
"kind": "acpx_durable_launch_profile_digest_mismatch",
"observation": "Expanded run log identifies a durable ACPX launch-profile digest mismatch after approximately990MiB provider-pack upload.",
"providerPackUploadApproximateMiB": 990,
"leaseDeadlineCauseProved": false
},
"acquireLeaseErrorScope": "Later recovery-stage error; not the first failure or a proved root cause.",
"candidateCorrection": {
"status": "under review; not a deployed pass",
"behavior": "Reuse the provider pack pinned by bound controller state for durable ACPX resume."
}
},
"finalProviderObservation": {
"at": "2026-10-11T01:33:52.216884+00:00",
"state": "archived",
"hydrated": true,
"health": "ok",
"error": null,
"stop": {
"id": "stop_18563d80fd0ee488",
"status": "completed",
"requestedAt": null,
"lastAttemptAt": "2026-10-11T01:32:48.421Z",
"error": null,
"endedAt": "2026-10-11T01:32:48.421Z"
},
"manualStopOrWakePerformed": false,
"furtherGuestReadAttempted": false,
"limit": "Latest read-only provider state; no post-archive guest checkpoint read was attempted.",
"scopeAfterLaterWork": "Historical01:33:52 archived observation. Normal task Computer Connect resumed the fixture around01:35; both viewers closed around01:43, with no later archive observation included here."
},
"desktopComparison": {
"servingSource": "610c78a5ad97534380c61fa376c96c1b7a73a86a",
"deployment": 13,
"connectAtApproximate": "2026-10-11T01:35:00Z",
"connectedFromArchived": true,
"method": "Normal task Computer Connect; then the same provider viewer was opened directly in a browser tab for comparison. Private viewer URL omitted.",
"streamVisibleAtApproximate": "2026-10-11T01:38:00Z",
"directBrowserInput": {
"observedAtApproximate": "2026-10-11T01:41:00Z",
"mouse": "passed: native click opened Chrome",
"keyboard": "passed: native key events visibly entered the complete marker",
"visibleMarker": "boatlive0141",
"evidenceFile": "staging-13-direct-desktop-input.png"
},
"embeddedViewer": {
"streamVisible": true,
"secondStreamFrozeOriginalFrame": true,
"updatedDesktopVisibleAfterCloseAndReconnect": true,
"keyboardInputVerified": false,
"mouseInputVerified": false,
"automationTargetingLimit": "The embedded Ctrl+A attempt selected the outer Paperclip page; this does not establish an embedded product input failure."
},
"bothViewersClosedNormallyAtApproximate": "2026-10-11T01:43:00Z",
"archiveAfterThisCloseVerified": false,
"scope": "Direct browser desktop keyboard and mouse passed. Embedded input remains unverified; the comparison revealed one-stream interference."
}
},
"localRestart": {
"source": "817d6a8ebb4a04552639d923ec965a9ab8716d84",
"result": "inconclusive_host_sleep",
"firstRun": {
"id": "3681473c-b5a5-48c3-b96d-0a24e9306a07",
"status": "succeeded",
"started_at": "2026-10-10T22:21:28.283Z",
"finished_at": "2026-10-10T22:25:04.557Z"
},
"continuation": {
"id": "f5f361a7-ea1e-46fe-90d6-46bdd5674f0a",
"status": "failed",
"started_at": "2026-10-10T22:26:50.928Z",
"finished_at": "2026-10-10T22:48:12.932Z",
"error_code": "native_session_cleanup_quarantined"
},
"originalOwnerRetired": true,
"continuationOwnerRetired": true,
"newOwnerProcessClaim": null,
"priorCheckpointLifecycle": "suspended",
"priorOwnerDescendants": 0,
"retainedMarker": {
"exists": true,
"lineCount": 1,
"sha256": "584372be7d247a859749d79e9979f9c775a2cc17e54a4ac6b762f0d48ecfb714"
},
"hostSleepUtc": [
{
"at": "2026-10-10T22:30:26Z",
"event": "Idle Sleep"
},
{
"at": "2026-10-10T22:31:15Z",
"event": "Maintenance Sleep",
"durationSeconds": 1017
},
{
"at": "2026-10-10T22:48:12Z",
"event": "DarkWake; simultaneous run timeout and onboarding provider error"
},
{
"at": "2026-10-10T22:49:16Z",
"event": "Dark Wake Thermal Emergency Sleep"
}
],
"quarantinePreserved": true,
"notProved": [
"successful post-restart provider turn",
"active-crash recovery"
]
},
"localFreshTask": {
"firstAttempt": {
"runId": "de63e6ba-43b6-43d6-ad6e-4167eb2f4712",
"status": "setup_failed",
"confoundedByHostSleep": true
},
"ordinaryRetry": {
"id": "e8c52459-2dc1-428c-b5d7-30d33141ff0b",
"status": "succeeded",
"started_at": "2026-10-11T00:42:00.094Z",
"finished_at": "2026-10-11T00:45:27.883Z",
"marker": {
"exists": true,
"lineCount": 1,
"sha256": "12772b6873ec4e7ffa80c9d0f798f0bb0492aae88b6cb3669c55a812f9bb312c"
},
"markerIndependentlyRead": true
},
"controllerRestartPerformed": false,
"source": "817d6a8ebb4a04552639d923ec965a9ab8716d84",
"cleanup": {
"checkedAt": "2026-10-11T00:53:46.805859+00:00",
"owner": {
"id": "e3426be1-0d0b-4a48-a5f7-21d4d0f3ffa6",
"generation": 1,
"phase": "retired"
},
"provider": {
"checkedAt": "2026-10-11T00:53:24.446Z",
"state": "archived",
"snapshots": true,
"stop": {
"id": "stop_60bcbe837fe4681c",
"status": "completed",
"requestedAt": null,
"lastAttemptAt": "2026-10-11T00:52:14.179Z",
"error": null,
"endedAt": "2026-10-11T00:52:14.179Z"
}
},
"processStopEvidence": "Exact owner retired in controller ledger and physical provider archive completed; no post-archive SSH process inventory attempted",
"postIdleCheckpointRead": "not_observed_archived",
"controllerRestartPerformedForThisTask": false,
"followupSubmitted": false,
"quarantinedBOA15Unchanged": true
}
},
"localInstructionsSave": {
"checkedAt": "2026-10-11T00:12:50.440541+00:00",
"uiReportedSaveError": "Failed to fetch; unsaved edits retained",
"serverSaveHttp200At": [
"2026-10-10T22:28:59Z",
"2026-10-10T22:29:56Z"
],
"subsequentCandidatesReadError": {
"at": "2026-10-10T22:48:12Z",
"status": 502,
"code": "provider_error",
"message": "Computer operation failed"
},
"persistentBytesIndependentlyVerified": false,
"manualProviderLifecycleActions": false,
"controllerRestartedDuringSave": false,
"hostSleepConfoundedObservation": true,
"conclusion": "Save requests returned HTTP200, but a fresh read failed with502 provider_error; durable bytes were not independently verified. This is not evidence of a missing file.",
"detachPerformed": false
},
"localBoundaryChecks": {
"checkedAt": "2026-10-10T22:22:17.844Z",
"agentForeignIssueReadStatus": 404,
"boardForeignTaskComputerConnectStatus": 404,
"computerOwnerLedgerUnchanged": true,
"foreignCompanyComputerRows": 0,
"temporaryCredentialsRevoked": true,
"scope": "Live local authorization denial; no staging company-denial journey claimed."
},
"diagnosticChecks": {
"source": "d50268c932",
"focusedTestsPassed": 54,
"serverTypecheck": "passed",
"semantics": "Fixed reason-code diagnostics only; all fail-closed gates retained.",
"earlierCiSnapshot": {
"observedAt": "2026-10-11T00:49:20.473390+00:00",
"heads": [
{
"head": "d50268c932da9e03c304f6a48cdaa5ee477331f2",
"checks": {
"SUCCESS": 26,
"IN_PROGRESS": 25
}
},
{
"head": "ee2a01063e3efdd3ddd75de05ff8e831302045fd",
"checks": {
"SKIPPED": 2,
"SUCCESS": 47,
"IN_PROGRESS": 4
}
}
]
},
"ci": [
{
"observedAt": "2026-10-11T00:52:12.095009+00:00",
"head": "ee2a01063e3efdd3ddd75de05ff8e831302045fd",
"checks": {
"SKIPPED": 2,
"SUCCESS": 52
},
"freshReview": true
},
{
"observedAt": "2026-10-11T00:58:18.658125+00:00",
"head": "d50268c932da9e03c304f6a48cdaa5ee477331f2",
"checks": {
"SUCCESS": 52
},
"reviewScore": 5,
"unresolvedThreads": 0,
"matchesExpected": true,
"mergeable": "MERGEABLE",
"freshReview": true
}
]
},
"remaining": [
"Explain and resolve unexpected Codex cancellation and subsequent cleanup quarantine",
"Successful saved-session continuation on current staging source",
"Successful current-source native Claude retry",
"Staging state-preserving HMR after verifying loaded fixture configuration",
"Embedded desktop input verification; direct browser keyboard and mouse passed",
"Live sibling cancellation isolation",
"Detach with retained file verification",
"Live feature-off cleanup",
"Staging company denial",
"Successful controller restart continuation without duplicate execution"
],
"provenance": [
{
"file": "staging-deploy-12-verified.json",
"sha256": "664d6a46b3259846fae329d38ba572311eb2129b4c6789dda67f9f9b2060ca3a"
},
{
"file": "retry-controller-restart-result.json",
"sha256": "734f73afa4990b26e538de717642ca631127f48e0f777d97b3f078dabfd65a6c"
},
{
"file": "retry-onboarding-save-failure.json",
"sha256": "ac57f59e1ef6cda246dc2ab8d042997e3c29e54674f12871c7692921a186d5a4"
},
{
"file": "retry-cross-company-denial.json",
"sha256": "c4e795bcd1f424202347cc912083d5b52341e3dc3a52ba64857bcbcba68f19b8"
},
{
"file": "retry-staging-viewer-natural-cleanup.json",
"sha256": "f6a5006d95126c726a7f089833e0dff71bb285c5043c3a93fb399997c27a0f12"
},
{
"file": "diagnostic-head-ci-fresh.json",
"sha256": "5b6c28b6d3421450112e22d61cc01b766bf197572e99a9456a04d775bfcfce57"
},
{
"file": "retry-diagnostic-source-proof.json",
"sha256": "91e3264c453a8fed34e9ed058303121903aaa3b91b2926d2e38ac7b17cfe5a67"
},
{
"file": "retry-staging-codex-failed-checkpoint.json",
"sha256": "8baf4299f94e0df9800be3ee04d1be519737713accd810d3fc21554cbccefd3a"
},
{
"file": "retry-staging-codex-failure-dom.txt",
"sha256": "445a8f27444c50ea19227d562b1f50659e4ab40282d247208c94a111681b1829"
},
{
"file": "retry-staging-claude-final-provider.json",
"sha256": "9d9a2b4e44ca91de03132c59bcb81b6025f71c2f3895a28caeaa3adbbd0fec63"
},
{
"file": "retry-awake-normal-retry.json",
"sha256": "9821029e3fd05f405f8157e2249ce98b55dfd1f8c60390fbe04b0d144d86ed89"
},
{
"file": "retry-awake-first-settlement.json",
"sha256": "30f2b722f9015fb3095572f2999aad4f568d8db5a2feaa2fef484174401e3b62"
},
{
"file": "retry-awake-process-baseline.json",
"sha256": "21fb1715ed5591691fa384f24a3a4ae7dadb70b5ae6796f376426b2244395acc"
},
{
"file": "retry-awake-final-cleanup.json",
"sha256": "98f4da9a511a1f920ccad6a0754c98e297eade1f6f00e907a7f140243942471a"
},
{
"file": "core-retry-current-gates.json",
"sha256": "91c8bc99017a1da024c89650a57a7aadb7d6a984b62582b825c5e9104a1cfab4"
},
{
"file": "parent-diagnostics-current-gates.json",
"sha256": "878b86aa6c6a86c4533dfcbd7b44b4de2b219f06e3d7b1ffe4236224a6af21bd"
},
{
"file": "staging-deploy-13-verified.json",
"sha256": "b3cea12a1d93e6e2edf6f45f6b1ba61c2a519bd21117abc48c5d180ea49a3a1c"
},
{
"file": "retry-staging-13-fresh-proof-processes.json",
"sha256": "f6f34afd19c0f38960050412279ae22bbf0742e6b7596b7215b2b2f17b2526a0"
},
{
"file": "retry-staging-13-warm-proof-processes.json",
"sha256": "79f5c5b5a888c43477d1765be28aa8f5b62a96248d6dea29b3ec2ad96986c3ec"
},
{
"file": "retry-staging-13-fresh-checkpoint.json",
"sha256": "4212bef4e1116c533b88bc2706aab832342c7c1c2add0df9ddb1e8f96aa11b0f"
},
{
"file": "retry-staging-13-warm-checkpoint.json",
"sha256": "79117a28838624b5e722e9a57f38bea8426ffad2fdeb4b10eacb5ac44791eed1"
},
{
"file": "retry-staging-13-before-cancel.json",
"sha256": "c6374912eeb93ece8747c90ba0e170a99d2f551acc9e1aa789ba9aa15d4624fb"
},
{
"file": "retry-staging-13-final-provider.json",
"sha256": "00192becac27fb4a7d9b6509da22e9db68e5c4f052b3a01ebaf74eccf8de7d1d"
},
{
"file": "retry-staging-13-final-processes.json",
"sha256": "2d2af6b458b504ee3c4d03a16d7a35422a50895d701f6040b029f0e53a0ee625"
},
{
"file": "retry-staging-13-final-checkpoint.json",
"sha256": "d0aab1946dc34af67e92c839b1b5836662037c2de90e84d694d6cf3ccf4375ef"
},
{
"file": "retry-staging-13-owner-settlement.json",
"sha256": "4fd54c2340706f1d6c6f9da1c28921d2262bfc4bf4ca5eed4b47d841cdc975af"
},
{
"file": "retry-staging-13-systemd-failure-details.json",
"sha256": "ca4370d62068e5a0b7026959658a466e054539d15a03e9d80e0ddd72aab3ca56"
},
{
"file": "retry-staging-13-hmr-file-views.json",
"sha256": "3dcefc238dd72d26019fb4be993f7c5cbaa0c6327bb7bf4c22bfa837b4e850e9"
},
{
"file": "retry-staging-13-hmr-mount-namespaces.json",
"sha256": "2eee6f2f0e4c45d260c6bc5ab3ba1bb494136aa58dd029d50517ce8e126ab14c"
},
{
"file": "retry-staging-13-test-config.json",
"sha256": "cecf3bd5f7b4a280da8adb1fa8fcd1f855e2b61e9734918768a3f9923128b98c"
},
{
"file": "staging-13-cancel-expanded-dom.txt",
"sha256": "4861ab723ded35336f5533d646a8f607110b3eaf5fe6cf8aff5bcd7785b66729"
},
{
"file": "staging-13-claude-retry-dom.txt",
"sha256": "8f4d8d57ba2842e70d5f49667513aa94fce4e6a6037b0ad7c2977fc5a1eb498c"
},
{
"file": "retry-staging-13-claude-terminal-provider-check.json",
"sha256": "8067d6bf0d8bee7da20526ab941ab79e23eb0becbc0e066fd0afea785e81fe09"
},
{
"file": "staging-13-direct-desktop-input.png",
"sha256": "02ab563a51e6597b41c0faca3468be0e925901bd46890e37facdaac51ddc67c7"
}
],
"deployment13": {
"checkedAt": "2026-10-11T01:05:58.740756+00:00",
"requestedSha": "610c78a5ad97534380c61fa376c96c1b7a73a86a",
"servingSha": "610c78a5ad97534380c61fa376c96c1b7a73a86a",
"status": "succeeded",
"verification": "verified",
"runId": 38100487034,
"verifiedAt": "2026-10-11T01:05:49Z"
},
"candidate14": {
"canonicalRuntime": "21deac0abfd2919525114f8cdc4a0d49f139665a",
"core": "66ac692e446bd2ce0175613787f82eeb048f2749",
"staging": "5cf388845902c88d0406116ed9b2c44f335d8bb2",
"deploymentRequestId": "f4e5af86-8ad0-4ebd-ad97-f2a9173015af",
"status": "dispatched; not verified serving",
"fixes": [
"exact remote owner cleanup scope",
"retain controller-pinned verified ACPX provider package",
"fixed-field cancellation source diagnostics"
],
"targetedTests": {
"cleanup": 8,
"quarantineFences": 2,
"providerPack": 26,
"manifestBootstrap": 7,
"cancellationDiagnostics": 7
},
"serverTypecheck": "passed",
"independentProviderPackReview": "no remaining actionable findings",
"liveRecoveryRetest": "pending"
},
"candidate14VerificationFiles": [
{
"file": "boat-cleanup-scope-focused-tests.log",
"sha256": "9058d658e9605762a5a16e40ef2a4c2385a004546db111c337c6795545fd6dcb"
},
{
"file": "boat-cleanup-scope-runtime-tests.log",
"sha256": "89bccf74fe69f8cc6accbaff060a8aa6560d8dc935497e6d239f277acc031933"
},
{
"file": "boat-cleanup-scope-typecheck.log",
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
{
"file": "claude-pack-pin-green.log",
"sha256": "002a36696417b8f6f98546fa13e8d972f3b33b8d61fed0044b19a977cd9c3634"
},
{
"file": "claude-pack-pin-manifest-tests.log",
"sha256": "b21b2315081d5f8c2c1e615b1ed6cc55a4e91db41d10036c63092dfabdfca16c"
},
{
"file": "claude-pack-pin-typecheck.log",
"sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
},
{
"file": "native-cancellation-diagnostic-tests.log",
"sha256": "b86a444e63cbae19ebe709c79919cc405f7cfbef68aeccbf861e7afdd3c3feea"
}
]
}
Binary file not shown.

After

Width:  |  Height:  |  Size: 34 KiB