@@ -6,3 +6,7 @@ tools/busybox-w32-patches/*.patch whitespace=-space-before-tab,-blank-at-eol
 
 # Qualification logs preserve exact emitted bytes for recorded SHA-256 digests.
 reports/*.log whitespace=-blank-at-eol,-blank-at-eof
+
+# Preserve original Windows qualification receipt bytes and their recorded hashes.
+docs/qa/windows-candidate-bf62e84/*.json -text whitespace=cr-at-eol
+docs/qa/onboarding-navigation-2.4.1/*.txt whitespace=-blank-at-eof
@@ -1,11 +1,12 @@
 # Changelog
 
-## 2.4.1: Short-window workspace controls
+## 2.4.1: Short-window controls and reliable startup
 
 - Prevent the composer from painting over terminal dock controls at larger zoom levels in short windows.
 - Keep conversation/composer scrolling, menus and Latest activity reachable while preserving editor and composer drafts and the terminal session.
 - Include a fallback for webviews without size container queries and regression coverage for the measured Windows geometry and CSS zoom.
 - Display Windows folder names correctly in terminal notices, reserve complete terminal rows, and keep long notices, errors and terminal controls accessible by scrolling.
+- Keep delayed startup restoration and workspace results from overriding newer conversation or project navigation.
 - Check AppStream release metadata against the application version before native packaging.
 - Retain 2.4.0 publication evidence and the native Windows failure that prompted this patch; qualify new installer bytes separately.
 
 
@@ -6,9 +6,9 @@
 
 **Version 2.4.0** brings a simpler first run, a workspace with files and a docked terminal, and local-runtime reliability improvements. See [what’s new in 2.4](#whats-new-in-24), the [release notes](docs/RELEASE_NOTES.md#shadowcode-240), and [platform qualification](docs/PLATFORM_QUALIFICATION.md) for the checks and their limits.
 
-**2.4.1 source candidate:** physical Windows testing found that the composer can
-overlap the terminal’s Hide control at 175% zoom in a short window. The patch is
-being qualified; 2.4.0 remains the published version. See the
+**2.4.1 source candidate:** physical Windows testing found short-window
+composer/dock overlap, terminal-row clipping and a delayed startup navigation
+race. The patch is being qualified; 2.4.0 remains the published version. See the
 [platform qualification record](docs/PLATFORM_QUALIFICATION.md) for exact scope.
 
 ### An open-source project by Shadowfetch
@@ -859,7 +859,8 @@ Release packaging is described in [docs/RELEASING.md](docs/RELEASING.md).
 
 ## Tests
 
-Recorded validation for the frozen **2.4 source implementation**:
+Historical validation for the frozen **2.4.0 source baseline**
+(the 2.4.1 patch has separate results in its release notes and qualification record):
 
 | Check | Result |
 | --- | --- |
 
@@ -1,5 +1,26 @@
 # Physical-machine platform qualification
 
+## 2.4.1 replacement candidate bf62 — held, not published
+
+Candidate `bf62e846f57d91df06aca3ab40158c0c7e5aee63`, Windows run
+`43176133588` attempt 1, artifact `13924953752`, installed successfully. The
+installed executable matched the payload independently extracted from the exact
+installer. See the [identity and receipt hashes](qa/windows-candidate-bf62e84/summary.json).
+
+The first native UI attempt failed conversation selection after creation. Source
+review found that a delayed post-onboarding boot can override newer navigation;
+the retained database is consistent with that race but does not establish its
+exact asynchronous ordering. An unchanged second attempt passed all nine window
+and zoom cases, all 45 Hide-control hit points, editor/draft checks and terminal
+continuity. Its final Settings check failed because a broad test locator matched
+two buttons. Both attempts remain failed overall. A sidebar-scoped locator was
+reviewed separately; no startup wait is being added to hide the product race.
+
+This candidate was not tagged or published. Navigation ownership must be fixed
+and a fresh installer must pass the complete native check. No endurance or
+real-model test was run for this candidate. Native WebView automation does not
+establish physical-keyboard or OS-shortcut arbitration.
+
 ## 2.4.1 initial candidate — failed, not published
 
 Candidate `3984b7f5dfe39976c1eb3c1aec2a71de5b2c9666` installed successfully on
 
@@ -18,8 +18,18 @@ past the conversation area and cover the terminal dock’s Hide control.
   terminal rows, including their padding and borders. Long notices, errors,
   tabs and restart controls remain accessible in a separate scrollable area.
 
-The correction covers layout, terminal path labels and regression coverage. It does not change
-model backends, command permissions, signing keys or sandbox policy. The source
+## Startup and project navigation
+
+- Prevent delayed post-onboarding startup from restoring an older conversation
+  after the user has created or selected a newer one.
+- Keep late workspace, configuration, Git and trust results from overwriting a
+  newer navigation choice. Project opening and conversation activation share
+  the same ordered queue.
+- Preserve normal saved-session restoration and existing appearance callbacks.
+
+The correction covers layout, terminal path labels, startup navigation and
+regression coverage. It does not change model backends, command permissions,
+signing keys or sandbox policy. The source
 release trust ceiling is extended to 2.4.1 using the existing Linux signing key.
 AppStream metadata is checked against application versions before packaging.
 
@@ -32,10 +42,12 @@ and limitations.
 
 ## Validation
 
-The corrected patch passed 913 interface unit tests and all 170 Chromium browser
+The corrected patch passed 928 interface unit tests and all 170 Chromium browser
 tests. Focused WebKit coverage passed 32 existing workspace checks and the four
 new terminal-layout checks; the latter use the browser's supported Option-Tab
-navigation. Type checking, the production build and bundle checks passed.
+navigation. After the startup correction, eight focused WebKit first-run and
+conversation-navigation cases passed as well. Type checking, the production
+build and bundle checks passed.
 
 The terminal regressions fail against the earlier candidate in both Chromium
 and WebKit. They cover long Windows paths, long folder names, errors, multiple
@@ -44,6 +56,12 @@ original 12 composer regressions also failed against the 2.4.0 stylesheet.
 Linux release-authentication tests passed 115 checks, and the updated Debian
 packaging/metadata suites passed 19, including an early AppStream version check.
 
+Controlled startup tests delay refresh, session lookup and project opening,
+then verify that newer choices remain selected in the UI and active at the
+backend API boundary. The app-level regression fails against the previous
+candidate. See the [source validation record](https://github.com/ShadowfetchStudio/ShadowCode/blob/main/docs/qa/onboarding-navigation-2.4.1/verification.json). Additional tests preserve normal startup, trust prompts and existing
+theme/text-size callbacks. These tests use a simulated backend.
+
 A separate review-before-commit test timing race was corrected without changing
 the application's commit guard. Browser checks use a simulated backend; exact
 native installer qualification is recorded separately in the platform record.
 
@@ -5,7 +5,9 @@ installation, clean-PATH probes and installation on the Windows 11 laptop.
 Physical qualification found composer overlap with the terminal Hide control at
 175% zoom in a short window, so **native UI acceptance failed**. A 2.4.1 source
 candidate addresses that defect; its initial installer exposed a separate
-terminal-row clipping issue in a narrow window. A corrected candidate remains
+terminal-row clipping issue in a narrow window. The next candidate passed the
+nine-case layout matrix but exposed a post-onboarding navigation race and a
+separate ambiguous Settings test selector. A further corrected candidate remains
 pending complete qualification and publication.
 The 2.4.0 engine endurance test passed 100 sequential and 80 concurrent tasks,
 five cancellations and persistence after forced termination. Its real-model
 
@@ -0,0 +1,18 @@
+# Startup navigation source validation
+
+The two product and three test files in `source-hashes.json` passed 928 unit
+tests, 170 Chromium cases and eight focused WebKit cases, with zero failures
+or skips. Type checking, production build and fixture-isolation checks passed.
+`verification.json` records counts, browser statistics and original report hashes.
+
+The identical navigation regressions against isolated baseline bf62 fail nine
+checks while three controls pass. See `baseline-final.json`, `baseline-final.txt`
+and `baseline-provenance.json`; `baseline-app.txt` is the initial UI reproduction.
+The independent final review found no actionable issues after preserving public
+refresh callback compatibility. `REVIEW-STATUS.md` is an earlier checkpoint;
+its then-pending browser checks are resolved by `verification.json`.
+
+These source and simulated-backend checks do not qualify any native installer.
+Previous bf62 Windows failures remain separately recorded. Original logs, full
+reports, rejected intermediate callback code and baseline archive are retained
+in external `publication-2.4.1/onboarding-navigation-fix`.
@@ -0,0 +1,17 @@
+# Onboarding navigation ownership fix — review checkpoint
+
+Baseline: bf62e846f57d91df06aca3ab40158c0c7e5aee63. No commit or release mutation.
+
+Boot now captures one selection generation before its first await, checks ownership at each asynchronous boundary and passes its original generation into restoration. A user session/project choice supersedes boot; restoration cannot mint a newer ticket. Project opening shares the existing native activation queue because the native project endpoint activates a session itself.
+
+Workspace exposes explicit refreshIfCurrent/reloadConfigIfCurrent helpers for navigation. Existing no-argument refresh/reloadConfig callbacks wrap these helpers and ignore Promise result/event arguments, preserving useAppearance's existing contract. Guarded helpers reject stale config, sessions/status/jobs/projects, and git writes. Catalog reload and asynchronous comparison-list writes are gated by boot ownership.
+
+Evidence:
+- baseline-final.json: identical final navigation tests against an isolated git archive of bf62: 9 expected failures, 3 controls passing (12 total).
+- focused-final.log: 23 passing tests (15 new regressions and 8 existing appearance tests).
+- intermediate-optional-callback/: preserves the rejected intermediate implementation and its three deterministically failing callback-contract regressions; prior unit/build results there do not qualify the final source.
+- full-unit.json: 928 passing, zero failures/skips, 160 files on revised source.
+- typecheck.log, production-build.log, check-bundle.log: passed. validation-commands.json records final command exits.
+- source-hashes.json: exact two product and three test files under review.
+
+Full Chromium and scoped WebKit await final independent review. All controlled regressions use Happy DOM and the fixture API; they are not native Windows qualification. Physical native evidence must come from a newly built candidate with a new source SHA. Old bf62 CI snapshots/endurance remain in sibling source-ci-bf62e84; monitoring was explicitly transferred away.
@@ -0,0 +1,30 @@
+
+> shadow-agent-ui@2.4.1 test
+> vitest run src/App.navigation.test.tsx
+
+
+ RUN  v5.0.1 /Users/shadowfetch/Projects/ShadowCode/ui
+
+ ❯ src/App.navigation.test.tsx (1 test | 1 failed) 95ms
+   × keeps the user's new conversation when post-onboarding boot refresh finishes late 95ms
+
+⎯⎯⎯⎯⎯⎯⎯ Failed Tests 1 ⎯⎯⎯⎯⎯⎯⎯
+
+ FAIL  src/App.navigation.test.tsx > keeps the user's new conversation when post-onboarding boot refresh finishes late
+AssertionError: expected null not to be null
+ ❯ src/App.navigation.test.tsx:38:26
+     36|   fireEvent.change(screen.getByRole("textbox", { name: "Message Shadow…
+     37|   await act(async () => { release(projects); await held; });
+     38|   expect(selected()).not.toBeNull();
+       |                          ^
+     39|   expect(fake.state.activeSession).toBe("s2");
+     40|   expect(localStorage.getItem("shadow:selected")).toBe("s2");
+
+⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯⎯[1/1]⎯
+
+
+ Test Files  1 failed (1)
+      Tests  1 failed (1)
+   Start at  03:17:00
+   Duration  901ms (transform 50%, import 25%, environment 14%, tests 11%)
+