docs: record reviewed loader continuity fix and current acceptance boundary

doc/plans/2026-10-10-boat-validation.md

@@ -2,12 +2,12 @@
 
 **Experimental and unmerged. Local journeys and partial staging qualification passed on the sources below; final-source staging acceptance remains incomplete.** A successful build, probe, or earlier-source journey does not establish the remaining product conditions.
 
-## Current source boundary (2026-10-11 09:28 UTC)
+## Current source boundary (2026-10-11 09:34 UTC)
 
 | Surface | Source and evidence |
 | --- | --- |
-| Combined implementation | `4278c25e3a3677072a4d95d1841c08dc471a132d`, including reviewed shared-readiness and fatal-import corrections. At 09:27 UTC, combined PR head 35de9f0bae had 53 successful checks, no pending or failed checks, fresh review 5/5 and zero unresolved threads. The preceding code head `06906ab358c752dd263abfd56f102c00745cd23d` had green CI: at 08:54 UTC all 54 checks passed on the active PR workflow; fresh review scored 5/5 with zero unresolved threads. Ten cancelled entries belong to a superseded duplicate workflow and remain in the receipt. |
-| Core branch | `1ab3cb94e036f5de43e4bad9fd4d345054e8763c`, including shared-readiness and fatal-import corrections. At 09:27 UTC, 54 checks passed and four were skipped, with no pending or failed checks, fresh review 5/5 and zero unresolved threads. The preceding head `e3b12138c6c15460d2e372b0dce1d1cbba491fa9` had green CI: at 08:54 UTC, 54 checks passed and four were skipped; fresh review scored 5/5 with zero unresolved threads. Includes optional closed upload-phase diagnostics and two test-fixture corrections. |
+| Combined implementation | `17b0910b804ad356cf884f4c7bb1509c6808d5ec`, adding the reviewed dependency-loader correction; new-head CI is pending. At 09:27 UTC, combined PR head 35de9f0bae had 53 successful checks, no pending or failed checks, fresh review 5/5 and zero unresolved threads. The preceding code head `06906ab358c752dd263abfd56f102c00745cd23d` had green CI: at 08:54 UTC all 54 checks passed on the active PR workflow; fresh review scored 5/5 with zero unresolved threads. Ten cancelled entries belong to a superseded duplicate workflow and remain in the receipt. |
+| Core branch | `8e8999d681b42a19bfee2540c4345193f29f31ca`, adding the reviewed dependency-loader correction; new-head CI is pending. For preceding head `1ab3cb94e0` at 09:27 UTC, 54 checks passed and four were skipped, with no pending or failed checks, fresh review 5/5 and zero unresolved threads. The preceding head `e3b12138c6c15460d2e372b0dce1d1cbba491fa9` had green CI: at 08:54 UTC, 54 checks passed and four were skipped; fresh review scored 5/5 with zero unresolved threads. Includes optional closed upload-phase diagnostics and two test-fixture corrections. |
 | Verified staging source | Deployment25 verified `ca07557247533531b85045a1dc20c231dc9cd1de` at 08:36:19.883 UTC through the official workflow. Includes shared upload scheduling, warm-owner orphan-sweep correction and the public-module import fix. Native Claude cold and warm turns passed. Actual Codex child cancellation and continued survival of its exact Claude sibling were observed; the sibling subsequently completed successfully. Native post-idle return failed after same-run recovery. |
 | Local retry | Local48 uses compatible controller `9808eae33768f4a8beb31f3955737713a5f737ae` and unchanged qualified immutable diagnostics pack `sha256:4ef25756f766016da224f37f68c138c0c4a9ef9d128e6c2fc415f5c57ce38573`. Full upload, cold and warm Claude turns, warm retention and natural archive passed. The same-session post-idle attempt failed its first `turn.start` at provider initialization; the primary attempt failed at 08:53:45.338, then same-run recovery ended at 08:55:27.617 with `runner_state_identity_mismatch: authority_indeterminate`. Local49 is now qualifying the corrected package through a new ordinary task. |
 
@@ -52,6 +52,13 @@ Local49 health verified compatible source `97f9ace67e7e199c2712522ab84095a2ceafa
 After the previous native lifecycle had fully settled, normal Computer Connect rendered the shared Boat desktop in the task panel. Its clock advanced, but native dock clicks and keyboard attempts produced no visible remote application response; the frame-scoped key attempt timed out. This remains **inconclusive for embedded input**, not a pass or an established product defect. No second stream or guest probe was used. Normal Close Computer completed before 09:26:18 UTC. The native host-app fallback was unavailable because the computer-use tool explicitly disallows controlling the Codex app; no workaround was attempted. [Input receipt](assets/2026-10-10-boat/evidence/staging25-embedded-input.json), [visible embedded desktop](assets/2026-10-10-boat/staging25-embedded-input-inconclusive.png). A subsequent read-only provider check at 09:29:27.922 found Boat archived and healthy, with normal stop completed at 09:26:11.064. [Post-viewer provider state](assets/2026-10-10-boat/evidence/staging25-after-viewer-archive.json).
 
 
+## Dependency read continuity correction (2026-10-11 09:34 UTC)
+
+Core 8e8999d681 / combined 17b0910b80 corrects an offline-reproduced dependency-loader rejection when ctime changes but the verified descriptor's contents and other metadata remain unchanged. A single bounded reread requires the same descriptor, identical complete bytes, unchanged device/inode/mode/owner/link-count/size/mtime, stable final metadata, and a final canonical-path/ancestry check. Existing Darwin expected digests are checked each pass; Linux retains its existing read-continuity authority, with no new per-module digest provenance claim. **123 focused tests passed, six existing platform skips**, with compile/build and independent review passing. Actual Linux ctime-only import changed from failure to success; a renamed descriptor still failed before execution. [Verification receipt](assets/2026-10-10-boat/evidence/loader-continuity-verification.json).
+
+This proves the offline defect, not the cause of historical live initialization failures. Local49 remains frozen on its preceding immutable package for its current lifecycle. Staging cherry-pick 683696352d is prepared but not deployed; the ongoing deployment26 still targets d5bce13cca.
+
+
 ## Product outcomes
 
 Historical product observations in this table are UTC on 2026-10-10; the retry table gives its later dates. “Passed” applies only to the named observation; gaps remain explicit.
@@ -66,7 +73,7 @@ Historical product observations in this table are UTC on 2026-10-10; the retry t
 | Vite, browser preview, and warm HMR | Local 23/85746677, UI 76a499cc: detached Vite retained runner/provider/server identity across warm turns; a heading hot-reloaded while an unsaved draft and page-session value stayed unchanged. Natural idle later removed the owned processes/listener. Staging 73b2 launched Vite and generated a preview link. | Earlier staging preview navigation returned `ERR_BLOCKED_BY_CLIENT`; no workaround was used. On deployment 13 the normal generated link rendered, and warm runner/provider/Vite identity was preserved. Deployment 14 subsequently passed state-preserving HMR; see the dated follow-up below. |
 | Desktop viewing and human control | Local 31/19d827a1 and staging73b2: normal embedded viewer keyboard events opened a terminal and entered a command with visible expected output. Native Cua, desktop rendering, and bounded viewer expiry passed. | Deployment 13 direct browser desktop mouse and keyboard subsequently passed; current embedded input remains unverified because automation targeted the outer page. IBus separation was sampled outside the runner cgroup; that sample alone is not an additional expiry test. |
 | Durable file editor | Local 30/ac09d6ec: normal Instructions save survived full browser reload, then original content was restored and reread. Local 28/3081b748 onboarding initialized readable remote instructions. | Earlier source-specific pass; the later save/read retry is inconclusive because the fresh read returned 502 provider_error. |
-| Shared Boat and separate personal folders | Distinct durable roots, concurrent listener ports, and file persistence across later resumes were observed for native and legacy agents. | One-agent cancellation while a sibling continues remains explicitly unverified. Shared Unix UID and desktop provide no per-agent OS security boundary. |
+| Shared Boat and separate personal folders | Distinct durable roots, concurrent listener ports, and file persistence across later resumes were observed for native and legacy agents. | Deployment25 later passed exact child cancellation while the Claude sibling remained alive and completed; see the settled sibling evidence above. Shared Unix UID and desktop provide no per-agent OS security boundary. |
 | Restore failure cleanup | A provider snapshot restore timeout caused the expected probe failure; the Boat naturally archived and the controller retired its owner, leaving zero live owners/pending actions. No manual reset or retirement was used. | A handled failure, not a successful restore. Later onboarding used a separate clean fixture. |
 | Database upgrade | Local 28 retained the existing computer and original migration receipt while applying upstream schema changes. Compatible staging schema/manifest checks passed and 73b2 deployed. | Deployment 12 subsequently verified 1830 serving; compatibility and deployment evidence are not product acceptance. |
 
@@ -186,11 +193,11 @@ Automated semantics already have meaningful coverage: the [latest 60-case route/
 | Company/owner denial | Route tests: “hides cross-company tasks exactly like missing tasks”; service tests: “rejects cross company scopes before provider access” and “disconnects only the exact company-scoped viewer owned by the current user without provider access”. | Also a live local foreign-issue/task denial with unchanged ledger is recorded in the retry receipt; staging remains unverified. |
 | Crash/restart fencing | Service tests: “reconciles a crashed controller reservation only after its durable deadline” and “reuses warm process identity and port while fencing stale callbacks”. | Automated fences passed. A real orderly local restart reached a suspended checkpoint, but continuation was confounded by host sleep; no successful restart journey claimed. |
 
-Still unverified or incomplete after the deployment 14 follow-up:
+Historical gaps at the deployment14 cutoff (superseded where the later dated results above provide evidence):
 
 - Exercise a legitimate saved-session continuation on diagnostic source; UI Retry `5957cc86` requested a fresh session and cannot diagnose the old recovery gate. Fresh and warm turns now passed; ordinary post-idle continuation is still needed for the new session. The old failure remains unresolved. The prior cancelled Codex turn and quarantined repairs remain historical failures; deployment 14 resumed the saved Codex session and passed warm HMR. Latest native Claude retry still failed before provider work and its correction awaits live deployment.
 - Embedded desktop input on latest source remains unverified; direct browser desktop input passed earlier. Deployment 14 HMR passed after actual React fixture repair. Native Codex computer-use navigation and persisted artifact inspection subsequently passed after correction, as recorded above.
-- Explicit cancellation of one agent while a sibling continues on the same Boat.
+- Explicit cancellation of one agent while a sibling continues on the same Boat was pending at this cutoff; deployment25 subsequently passed it.
 - Live feature-off cleanup, staging company denial, and active controller-crash recovery. The orderly local restart continuation subsequently passed without duplicating the marker, as recorded above. Local product detach/reconnect with retained-file verification passed; slow settling UX is recorded above. The local boundary pass and automated fences remain narrower evidence.
 - Checks on subsequent commits and paid-resource state after any further qualification. Diagnostic-head CI is green on the exact sources above; deployment 12 and earlier corrected legacy passes do not imply complete acceptance.
 

doc/plans/assets/2026-10-10-boat/evidence/loader-continuity-verification.json

@@ -0,0 +1,63 @@
+{
+  "schema": "boat-loader-continuity-verification/v1",
+  "capturedAt": "2026-10-11T09:33:30.188527+00:00",
+  "sourceRevision": "8e8999d681b42a19bfee2540c4345193f29f31ca",
+  "scope": [
+    "installation-integrity.ts",
+    "installation-integrity.test.ts"
+  ],
+  "red": {
+    "actualChildDependencyImportExit": 1,
+    "expectedExit": 0,
+    "linuxFixture": {
+      "baselineExit": 0,
+      "ctimeOnlyExit": 1,
+      "identicalBytes": true,
+      "unchangedDevInodeModeSizeMtime": true,
+      "dependencyExecutedAfterDrift": false
+    }
+  },
+  "green": {
+    "actualChildDependencyImportExit": 0,
+    "linuxFixture": {
+      "baselineExit": 0,
+      "ctimeOnlyExit": 0,
+      "identicalBytes": true,
+      "movedDescriptorExit": 1,
+      "movedDescriptorExecuted": false
+    },
+    "testsPassed": 123,
+    "existingPlatformSkips": 6,
+    "testFiles": 2,
+    "typecheck": "passed",
+    "typescriptAndVerifiedEntrypointBuild": "passed",
+    "diffCheck": "passed",
+    "independentReview": "approved"
+  },
+  "contract": {
+    "sameDescriptor": true,
+    "maximumCompleteReads": 2,
+    "completeByteEqualityRequired": true,
+    "stableFinalMetadataRequired": true,
+    "unchangedFields": [
+      "device",
+      "inode",
+      "mode",
+      "uid",
+      "gid",
+      "linkCount",
+      "size",
+      "mtime"
+    ],
+    "retainedCanonicalPathAndNamedRegularInodeRechecked": true,
+    "existingNoFollowAncestryAndFormatChecksPreserved": true,
+    "darwinExpectedDigestCheckedEveryPass": true,
+    "linuxAuthority": "Read continuity under existing descriptor-pinned ancestry; no new per-module expected-digest provenance is claimed."
+  },
+  "movedDescriptorCategory": "Fail-closed path rejection; no assertion that this filesystem failure uses the UNVERIFIED_MODULE marker.",
+  "liveCause": "UNPROVED: offline ctime reproduction establishes the loader defect, not that it caused the historical live initialize timeout.",
+  "liveFixtureChanged": false,
+  "oldImmutablePacksChanged": false,
+  "currentLocal49SelectedPack": "sha256:640c6c5405003f7d07603694413be14dc6c9601bc71f40b285f6cb247b5d412b",
+  "currentLocal49HasLoaderCorrection": false
+}