diff --git a/doc/plans/2026-10-10-boat-validation.md b/doc/plans/2026-10-10-boat-validation.md
index 3c261282d85..13e193ce77d 100644
--- a/doc/plans/2026-10-10-boat-validation.md
+++ b/doc/plans/2026-10-10-boat-validation.md
@@ -2,18 +2,18 @@
**Experimental and unmerged. Local journeys and partial staging qualification passed on the sources below; final-source staging acceptance remains incomplete.** A successful build, probe, or earlier-source journey does not establish the remaining product conditions.
-## Current source boundary (2026-10-11 09:34 UTC)
+## Current source boundary (2026-10-11 09:55 UTC)
| Surface | Source and evidence |
| --- | --- |
-| Combined implementation | `17b0910b804ad356cf884f4c7bb1509c6808d5ec`, adding the reviewed dependency-loader correction; new-head CI is pending. At 09:27 UTC, combined PR head 35de9f0bae had 53 successful checks, no pending or failed checks, fresh review 5/5 and zero unresolved threads. The preceding code head `06906ab358c752dd263abfd56f102c00745cd23d` had green CI: at 08:54 UTC all 54 checks passed on the active PR workflow; fresh review scored 5/5 with zero unresolved threads. Ten cancelled entries belong to a superseded duplicate workflow and remain in the receipt. |
+| Combined implementation | `4809c1b724944db3ee427e0909cb178885ba63bf`, adding the reviewed dependency-loader correction and disconnect warning after panel closure; new-head CI is pending. At 09:27 UTC, combined PR head 35de9f0bae had 53 successful checks, no pending or failed checks, fresh review 5/5 and zero unresolved threads. The preceding code head `06906ab358c752dd263abfd56f102c00745cd23d` had green CI: at 08:54 UTC all 54 checks passed on the active PR workflow; fresh review scored 5/5 with zero unresolved threads. Ten cancelled entries belong to a superseded duplicate workflow and remain in the receipt. |
| Core branch | `8e8999d681b42a19bfee2540c4345193f29f31ca`, adding the reviewed dependency-loader correction; new-head CI is pending. For preceding head `1ab3cb94e0` at 09:27 UTC, 54 checks passed and four were skipped, with no pending or failed checks, fresh review 5/5 and zero unresolved threads. The preceding head `e3b12138c6c15460d2e372b0dce1d1cbba491fa9` had green CI: at 08:54 UTC, 54 checks passed and four were skipped; fresh review scored 5/5 with zero unresolved threads. Includes optional closed upload-phase diagnostics and two test-fixture corrections. |
-| Verified staging source | Deployment25 verified `ca07557247533531b85045a1dc20c231dc9cd1de` at 08:36:19.883 UTC through the official workflow. Includes shared upload scheduling, warm-owner orphan-sweep correction and the public-module import fix. Native Claude cold and warm turns passed. Actual Codex child cancellation and continued survival of its exact Claude sibling were observed; the sibling subsequently completed successfully. Native post-idle return failed after same-run recovery. |
-| Local retry | Local48 uses compatible controller `9808eae33768f4a8beb31f3955737713a5f737ae` and unchanged qualified immutable diagnostics pack `sha256:4ef25756f766016da224f37f68c138c0c4a9ef9d128e6c2fc415f5c57ce38573`. Full upload, cold and warm Claude turns, warm retention and natural archive passed. The same-session post-idle attempt failed its first `turn.start` at provider initialization; the primary attempt failed at 08:53:45.338, then same-run recovery ended at 08:55:27.617 with `runner_state_identity_mismatch: authority_indeterminate`. Local49 is now qualifying the corrected package through a new ordinary task. |
+| Verified staging source | Deployment26 verified d5bce13cca01732105df15487000a260ae3c973c at 09:41:21.624 UTC. Both simultaneous legacy runs succeeded and released their leases. Deployment27 is building candidate2605a03f00 with the dependency-loader correction and disconnect-warning fix; it is not yet serving. Earlier deployment25 verified `ca07557247533531b85045a1dc20c231dc9cd1de` at 08:36:19.883 UTC through the official workflow. Includes shared upload scheduling, warm-owner orphan-sweep correction and the public-module import fix. Native Claude cold and warm turns passed. Actual Codex child cancellation and continued survival of its exact Claude sibling were observed; the sibling subsequently completed successfully. Native post-idle return failed after same-run recovery. |
+| Local retry | Local48 uses compatible controller `9808eae33768f4a8beb31f3955737713a5f737ae` and unchanged qualified immutable diagnostics pack `sha256:4ef25756f766016da224f37f68c138c0c4a9ef9d128e6c2fc415f5c57ce38573`. Full upload, cold and warm Claude turns, warm retention and natural archive passed. The same-session post-idle attempt failed its first `turn.start` at provider initialization; the primary attempt failed at 08:53:45.338, then same-run recovery ended at 08:55:27.617 with `runner_state_identity_mismatch: authority_indeterminate`. Local49 cold and warm passed on immutable pack640c; its post-idle run exposed agent_startup_unverified_module and ended failed after same-run recovery at09:51:04.712. Local50 will qualify the dependency-loader correction using a new ordinary task; old saved authority remains intact. |
-Final-source live acceptance remains incomplete. Open conditions include reliable Claude post-idle continuation, simultaneous admission from archived state, embedded human input, and completion of the staging lifecycle. The full local suite remains **34,914 passed, 24 failed, 338 skipped**; no full-suite green result is claimed. Earlier-source computer-use and HMR passes remain recorded below.
+Final-source live acceptance remains incomplete. Open conditions include reliable Claude post-idle continuation and completion of the latest-package staging lifecycle. Simultaneous archived admission passed on deployment26. Embedded human mouse and keyboard input subsequently passed in Chrome on deployment25. The full local suite remains **34,914 passed, 24 failed, 338 skipped**; no full-suite green result is claimed. Earlier-source computer-use and HMR passes remain recorded below.
-Current [CI and review receipt](assets/2026-10-10-boat/evidence/ci-1ab3cb-35de9-passed.json), [verified deployment](assets/2026-10-10-boat/evidence/staging25-deployment.json). The [consolidated earlier retry receipt](assets/2026-10-10-boat/evidence/retry-qualification-summary.json) preserves earlier sources, failures and receipt hashes. A deployment proves serving source, not product acceptance. No provider stop was forced or cancelled, no quarantine was cleared, and no database history was reset or rewritten.
+Latest [CI and review snapshot](assets/2026-10-10-boat/evidence/ci-8e8999-9eb142-0949.json), [preceding green heads](assets/2026-10-10-boat/evidence/ci-1ab3cb-35de9-passed.json), [verified deployment26](assets/2026-10-10-boat/evidence/staging26-deployment.json). The [consolidated earlier retry receipt](assets/2026-10-10-boat/evidence/retry-qualification-summary.json) preserves earlier sources, failures and receipt hashes. A deployment proves serving source, not product acceptance. No provider stop was forced or cancelled, no quarantine was cleared, and no database history was reset or rewritten.
## Local48 and deployment25 follow-up (2026-10-11 08:57 UTC)
@@ -59,6 +59,25 @@ Core 8e8999d681 / combined 17b0910b80 corrects an offline-reproduced dependency-
This proves the offline defect, not the cause of historical live initialization failures. Local49 remains frozen on its preceding immutable package for its current lifecycle. Staging cherry-pick 683696352d is prepared but not deployed; the ongoing deployment26 still targets d5bce13cca.
+## Embedded human control passed in Chrome (2026-10-11 09:37 UTC)
+
+A normal Computer Connect in Chrome rendered one embedded stream. A native click on the observed remote dock icon visibly launched Chromium. Actual key events selected the address bar contents, entered example.net and pressed Return; the final screenshot shows that exact address and Example Domain content inside Paperclip's Computer panel. **Embedded mouse and keyboard control passed.** Text insertion through the automation typeText method had no effect and is not counted as keyboard proof. The in-app-browser attempt remains inconclusive. No direct viewer, second stream, guest input injection or product permission change was used. The viewer closed normally before 09:37:10 UTC. [Action receipt](assets/2026-10-10-boat/evidence/staging25-chrome-embedded-control.json), [visible successful result](assets/2026-10-10-boat/staging25-chrome-embedded-control.png).
+
+
+## Local49 warm pass and deployment26 admission (2026-10-11 09:45 UTC)
+
+Local49 cold run 6fcda24f succeeded at 09:39:01.367 after all 301 artifact chunks transferred without a recorded timeout/error. The 1166MiB provider package transfer was slow; this is a successful first-use transfer, not an acceptable-latency claim. Ordinary warm follow-up 6a07f42f succeeded at 09:41:00.398 with the same native session, logical runner, provider thread and physical owner/boot/launch identity. Both original file hashes matched. The configured warm deadline is 09:46:00.347; natural archive and post-idle continuation are still pending. [Lifecycle receipt](assets/2026-10-10-boat/evidence/local49-lifecycle.json), [cold result](assets/2026-10-10-boat/local49-claude-cold.png), [warm command result](assets/2026-10-10-boat/local49-claude-warm.png).
+
+Deployment26 verified d5bce13cca01732105df15487000a260ae3c973c serving at 09:41:21.624. A read-only provider check at 09:42:25.595 confirmed archived/healthy state and completed stop, without guest reads. Legacy Codex run 73bc6d17 and Claude run e3daa441 started 65ms apart at 09:43:05. Both acquired active leases and entered active ownership, with no admission error at 09:44:53.764. Actual task completion remains pending. [Deployment](assets/2026-10-10-boat/evidence/staging26-deployment.json), [archived baseline](assets/2026-10-10-boat/evidence/staging26-archived-baseline.json), [initial concurrent admission](assets/2026-10-10-boat/evidence/staging26-legacy-admission-initial.json), [both active leases](assets/2026-10-10-boat/evidence/staging26-legacy-admission-active.json).
+
+
+## Concurrent archived admission passed (2026-10-11 09:48 UTC)
+
+Both deployment26 legacy runs **succeeded**: Codex 73bc6d17 at 09:45:16.749 and Claude e3daa441 at 09:45:21.193. Each released its lease with successful cleanup and retired its owner; the scoped query found no replacement runs. Starting 65ms apart from completed archive no longer produced the observed HTTP409 admission failure. [Final run/lease receipt](assets/2026-10-10-boat/evidence/staging26-legacy-admission-final.json).
+
+Claude reported its unchanged original proof hash and personal home. Codex corrected helper argument/heredoc mistakes within its run and reached Done, but its final four fields were empty; its last activity was shown as interrupted before provider completion. Therefore this pair proves concurrent admission, successful run disposition and cleanup; it is **not** a fresh independent Codex proof-hash verification. Earlier successful proof reads remain source-specific evidence. [Claude result](assets/2026-10-10-boat/staging26-legacy-claude-result.png), [Codex reporting defect](assets/2026-10-10-boat/staging26-legacy-codex-result.png).
+
+
## Product outcomes
Historical product observations in this table are UTC on 2026-10-10; the retry table gives its later dates. “Passed” applies only to the named observation; gaps remain explicit.
@@ -79,6 +98,18 @@ Historical product observations in this table are UTC on 2026-10-10; the retry t
Receipts: [staging corrected legacy runs](assets/2026-10-10-boat/evidence/staging-11-legacy-regression.json), [local corrected legacy runs](assets/2026-10-10-boat/evidence/local-32-legacy-acceptance.json), [Claude lifecycle](assets/2026-10-10-boat/evidence/claude-cold-warm.json), [Codex second idle](assets/2026-10-10-boat/evidence/codex-second-idle.json), [local HMR](assets/2026-10-10-boat/evidence/vite-warm-hmr.json), [partial staging](assets/2026-10-10-boat/evidence/staging-73b2-acceptance.json), and [editor save](assets/2026-10-10-boat/evidence/local-30-persistent-save-proof.json).
+## Local49 final post-idle result (2026-10-11 09:53 UTC)
+
+Run `825e1f90` retained the original native session, logical runner, Claude thread and immutable pack640c after natural archive. Attach and snapshots passed, but `turn.start` rejected `agent_startup_unverified_module` at09:49:35.623. The corrected fatal-import settlement exposed a specific guarded dependency failure instead of another opaque initialize timeout. It does **not** identify the rejected module or prove that ctime drift caused this live rejection. Same-run recovery finally failed `runner_state_identity_mismatch: authority_indeterminate` at09:51:04.712. No active or queued runs or owners remained at09:52:03; Boat was archived and healthy, with normal stop completed at09:51:12.415. **Post-idle acceptance still fails on pack640c.** [Complete lifecycle receipt](assets/2026-10-10-boat/evidence/local49-lifecycle.json), [visible failed task](assets/2026-10-10-boat/local49-post-idle-failed.png).
+
+The next ordinary task will select qualified immutable pack `sha256:f6fbd13c71cdaf93060a7c240cbce1c8dfce2aefe5669db27d254b3b95dfb0a0`, which adds core8e8999's bounded dependency read continuity correction. No previous package, saved task authority, quarantine or checkpoint is being rewritten.
+
+## Reviewed viewer warning and staging27 candidate (2026-10-11 09:55 UTC)
+
+Combined `4809c1b724` surfaces a failed exact-owner disconnect after the Computer panel closes through the existing global warning toast. It survives panel unmount for the normal eight-second toast lifetime; a mounted panel displays the fixed safe message inline. Raw errors and credentials are excluded, and cleanup/retry behavior is unchanged. All52 affected UI tests, UI TypeScript, token gates and independent review passed. [Verification receipt](assets/2026-10-10-boat/evidence/computer-disconnect-warning.json).
+
+After the concurrent staging26 tasks and leases fully settled, deployment27 was dispatched through the official pipeline for compatible candidate `2605a03f00bc3d7decc8b8d5549ee06f8d77ae85`. This includes the reviewed loader and viewer-warning fixes. It remains pending; no serving-source or product-acceptance pass is inferred from dispatch.
+
## Latest retries
These outcomes do not erase earlier source-specific passes. The [retry receipt](assets/2026-10-10-boat/evidence/retry-qualification-summary.json) preserves the failures and the narrower boundary checks.
diff --git a/doc/plans/assets/2026-10-10-boat/evidence/ci-8e8999-9eb142-0949.json b/doc/plans/assets/2026-10-10-boat/evidence/ci-8e8999-9eb142-0949.json
new file mode 100644
index 00000000000..a89326cbe48
--- /dev/null
+++ b/doc/plans/assets/2026-10-10-boat/evidence/ci-8e8999-9eb142-0949.json
@@ -0,0 +1,135 @@
+{
+ "checkedAt": "2026-10-11T09:49:44.638945+00:00",
+ "prs": [
+ {
+ "pr": 15813,
+ "head": "8e8999d681b42a19bfee2540c4345193f29f31ca",
+ "reviewHead": "8e8999d681b42a19bfee2540c4345193f29f31ca",
+ "mergeable": "MERGEABLE",
+ "counts": {
+ "SKIPPED": 4,
+ "SUCCESS": 53,
+ "IN_PROGRESS": 1
+ },
+ "failures": [],
+ "focusChecks": [
+ {
+ "__typename": "CheckRun",
+ "completedAt": "2026-10-11T09:36:46Z",
+ "conclusion": "SUCCESS",
+ "detailsUrl": "https://github.com/paperclipai/paperclip/actions/runs/38128707028/job/114441222975",
+ "name": "ci / e2e shard (8/8)",
+ "startedAt": "2026-10-11T09:32:40Z",
+ "status": "COMPLETED",
+ "workflowName": "PR"
+ },
+ {
+ "__typename": "CheckRun",
+ "completedAt": "2026-10-11T09:39:27Z",
+ "conclusion": "SUCCESS",
+ "detailsUrl": "https://app.greptile.com/paperclip-org-3/github/paperclipai/paperclip/-/pull/15813",
+ "name": "Greptile Review",
+ "startedAt": "2026-10-11T09:32:05Z",
+ "status": "COMPLETED",
+ "workflowName": ""
+ }
+ ],
+ "pending": [
+ "ci / Verify serialized server suites (7/9)"
+ ],
+ "unresolved": [],
+ "moreThreads": false,
+ "greptileSummary": [
+ {
+ "url": "https://github.com/paperclipai/paperclip/pull/15813#issuecomment-6099291617",
+ "updatedAt": "2026-10-11T09:39:34Z",
+ "reviewedCommits": [
+ "8e8999d681b42a19bfee2540c4345193f29f31ca"
+ ],
+ "score": [
+ "5"
+ ]
+ }
+ ]
+ },
+ {
+ "pr": 15804,
+ "head": "9eb1424f4ecee14c528b33a2a0ed3f1628b05c79",
+ "reviewHead": "9eb1424f4ecee14c528b33a2a0ed3f1628b05c79",
+ "mergeable": "MERGEABLE",
+ "counts": {
+ "SUCCESS": 52,
+ "FAILURE": 1
+ },
+ "failures": [
+ {
+ "__typename": "CheckRun",
+ "completedAt": "2026-10-11T09:40:07Z",
+ "conclusion": "FAILURE",
+ "detailsUrl": "https://app.greptile.com/paperclip-org-3/github/paperclipai/paperclip/-/pull/15804",
+ "name": "Greptile Review",
+ "startedAt": "2026-10-11T09:34:21Z",
+ "status": "COMPLETED",
+ "workflowName": ""
+ }
+ ],
+ "focusChecks": [
+ {
+ "__typename": "CheckRun",
+ "completedAt": "2026-10-11T09:39:21Z",
+ "conclusion": "SUCCESS",
+ "detailsUrl": "https://github.com/paperclipai/paperclip/actions/runs/38128842350/job/114438792716",
+ "name": "ci / e2e shard (8/8)",
+ "startedAt": "2026-10-11T09:34:52Z",
+ "status": "COMPLETED",
+ "workflowName": "PR"
+ },
+ {
+ "__typename": "CheckRun",
+ "completedAt": "2026-10-11T09:40:07Z",
+ "conclusion": "FAILURE",
+ "detailsUrl": "https://app.greptile.com/paperclip-org-3/github/paperclipai/paperclip/-/pull/15804",
+ "name": "Greptile Review",
+ "startedAt": "2026-10-11T09:34:21Z",
+ "status": "COMPLETED",
+ "workflowName": ""
+ }
+ ],
+ "pending": [],
+ "unresolved": [
+ {
+ "id": "PRRT_kwDORclPyM6rMVUV",
+ "isResolved": false,
+ "isOutdated": false,
+ "comments": {
+ "nodes": [
+ {
+ "url": "https://github.com/paperclipai/paperclip/pull/15804#discussion_r4241086370",
+ "body": "![\"P2\"](\"https://greptile-static-assets.s3.amazonaws.com/badges/p2.svg?v=9\")
**Failed cleanup stays hidden**\n\n`release` silently drops every failed `disconnect` request. Closing the Computer tab can leave its viewer hold running until expiry without telling the user. This violates the UI directive: \u201cSurface failures clearly; do not silently ignore API errors.\u201d\n\nShow a cleanup warning through a toast or another surface that survives closing the panel. This repository requirement must be satisfied before merging.\n\n**Context Used:** AGENTS.md ([source](https://github.com/paperclipai/paperclip/blob/master/AGENTS.md))\n\nPrompt To Fix With AI
\n\n`````markdown\nThis is a comment left during a code review.\nPath: ui/src/components/task-side-panel/TaskComputerPanel.tsx\nLine: 47-49\n\nComment:\n**Failed cleanup stays hidden**\n\n`release` silently drops every failed `disconnect` request. Closing the Computer tab can leave its viewer hold running until expiry without telling the user. This violates the UI directive: \u201cSurface failures clearly; do not silently ignore API errors.\u201d\n\nShow a cleanup warning through a toast or another surface that survives closing the panel. This repository requirement must be satisfied before merging.\n\n**Context Used:** AGENTS.md ([source](https://github.com/paperclipai/paperclip/blob/master/AGENTS.md))\n\n---\n\nFor each issue above, determine whether it is valid and should be fixed. If so, fix it directly.\n`````\n