diff --git a/docs/plans/hands-on-build-1.md b/docs/plans/hands-on-build-1.md
index fbe4d5c4a..5dcaff5b3 100644
--- a/docs/plans/hands-on-build-1.md
+++ b/docs/plans/hands-on-build-1.md
@@ -90,4 +90,16 @@ The table below is the reasoning that led to them.
 
 ## 6. Run log (filled as it happens)
 
-RUNLOG
+Run on 6 Oct 2026 (UTC; box clock is UTC+2). Inputs: the shipper's "0.3.15 live" became 0.3.16 (same tree, f1ea7a38); publish 2 live with the sixteen-field object, digest eada4bda8aa8368c2b2c3d17744bc7a70a0ff0e996dad681884d3ac5de1207eb; main's gate: port 26611 on the box was held by the fleet agent's Devnet 2 seed, moved to 26621 at 23:06:57 ("26611 free on the box").
+
+| Time | Step | Result |
+|---|---|---|
+| 23:06 to 23:14 | `binary` (tree from the Mac's node1 agent: igneum-wt-ship0315/vendor/igneum-node-0315, f1ea7a38) | /srv/hands/bin/igneumd-2.1.0-f1ea7a38, sha256 7f0bde70cf2e72a3a9479ba6421f2b37162c3dd4391bf413717c99e6f168668d, commit string f1ea7a3 present; the sixteen-field override from the live manifest's consensus.override; recovery snapshot ac101f13... as the fallback flag. First attempt died silently after the version print: `igneumd --version` exits 1 (fixed) |
+| 23:06 to 23:10 | hot pre-sync | observer-v4 920 MB in 97 s, node1 937 MB in 98 s, hands running |
+| 23:15:11 to 23:15:32 | `observer-node --go` | first executing line 01:15:28 box time: "[igneum-exec] exec state loaded from a snapshot: tip 149781 e98b33f2..., state root 0x55a5892f..."; digest eada4bda... MATCH; "Program class v4 from the override file: active from epoch 231"; listeners 26640, 28640, 26641, 26840 loopback; the hand was down about 10 s |
+| 23:15:52 to 23:16:00 | `observer --go` | /srv/observer/env written (600, build); the Mac's autosync, run.sh, observer.mjs stopped first; started 23:15:56, "subscribed on igneum-devnet, node 2.1.0", 2871 checkpoint states seeded. Two minutes of getBlockDagInfo timeouts while its node settled (/api/live stale 41 s at 23:16:12), none after; rpc load 150 wRPC/min, 1366 EVM/min |
+| 23:18:36 to 23:18:58 | `node1 --go` | first executing line 01:18:53: "exec state loaded from a snapshot: tip 149806 f54ef53d..., state root 0xe1cd365e..." and "exec sync: resumed from /srv/hands/node1/.../exec-snapshot.bin (tip 149806, 142713733 bytes)"; digest MATCH; p2p 0.0.0.0:26611, RPC loopback; IBD of 419 headers from 213.173.107.74 01:19:12 to 01:21:42, then PoW blocks accepted from DAA 227716 (420 in the next 2 min, 6 established peers) |
+| 23:22:15 | `unload --go` | both plists moved aside (.moved-to-build-1-20261006); no hand igneumd on the Mac |
+| 23:22 | steady state | igneum-node1, igneum-observer-node, igneum-observer active; /api/live age 1.4 s, height 149878; box load 27 to 34 (capacity layer and CI runner share it) |
+
+Open after the move: the Mac's Igneum Miner app (0.3.16, running since 23:12) did NOT start its own igneumd once 26610/26611 were free (nothing bound them five minutes later; the only Mac igneumd is the Wallet's on 26620/26621/26800). A job never restarts the installed app, so the app lane or main decides how its node starts. The observer's proving feed now comes from the observer node's own EVM listener 26840.
diff --git a/infra/build-server/hands/move-hand.sh b/infra/build-server/hands/move-hand.sh
index 81316861f..b9abfe668 100755
--- a/infra/build-server/hands/move-hand.sh
+++ b/infra/build-server/hands/move-hand.sh
@@ -57,7 +57,7 @@ sync_dir() {   # <mac dir> <box dir>: rsync a data dir (hot or final), keeping R
 }
 mac_stop_agent() {   # <label>: bootout the launchd agent (KeepAlive would restart a killed process), wait for the pid to end
   local label="$1" pid
-  pid=$(launchctl print "gui/$(id -u)/$label" 2>/dev/null | awk '/^\s*pid = /{ print $3 }' | head -1 || true)
+  pid=$(launchctl print "gui/$(id -u)/$label" 2>/dev/null | grep -oE 'pid = [0-9]+' | head -1 | grep -oE '[0-9]+' || true)   # macOS awk has no \s: the first run printed "pid none" though the bootout worked
   launchctl bootout "gui/$(id -u)/$label" 2>/dev/null || true
   if [ -n "$pid" ]; then while kill -0 "$pid" 2>/dev/null; do sleep 1; done; fi
   say "launchd $label unloaded (igneumd pid ${pid:-none} ended)"
@@ -80,7 +80,7 @@ case "$MODE" in
     bin_sha=$(bs_sha256 "$out/release/igneumd"); rm -rf "$out"
     # the binary is already on the box; copy it there, never back and forth
     ctx=$(cd "$NODE_WT" && BS_TOOL=move-hand bash -c '. "$0"; bs_host >/dev/null; bs_context; echo "$BS_REMOTE_CRATE"' "$HERE/../lib.sh")
-    run rssh "install -m 755 -o build -g build '$ctx/target/release/igneumd' '$H/bin/igneumd-$ver-$sha' && ln -sfn '$H/bin/igneumd-$ver-$sha' '$H/bin/igneumd' && sha256sum '$H/bin/igneumd-$ver-$sha' | cut -c1-16 && '$H/bin/igneumd' --version"
+    run rssh "install -m 755 -o build -g build '$ctx/target/release/igneumd' '$H/bin/igneumd-$ver-$sha' && ln -sfn '$H/bin/igneumd-$ver-$sha' '$H/bin/igneumd' && sha256sum '$H/bin/igneumd-$ver-$sha' | cut -c1-16 && { '$H/bin/igneumd' --version || true; }"   # igneumd --version prints and exits 1 (7 Oct 2026: it ended this step under set -e before the override was written)
     say "box binary sha256 $bin_sha; checking its commit string on the box"
     run rssh "[ \$(strings '$H/bin/igneumd' | grep -c '$sha') -gt 0 ] && echo 'commit $sha in the binary' || { echo 'NO commit string in the binary'; exit 1; }"
     if [ -n "$OV_JSON" ]; then
diff --git a/infra/build-server/lib.sh b/infra/build-server/lib.sh
index a2c758876..a5b14cf70 100755
--- a/infra/build-server/lib.sh
+++ b/infra/build-server/lib.sh
@@ -59,6 +59,7 @@ bs_toolchain_check() {
 # BS_CRATE (the crate dir, = $PWD), BS_CRATE_REL (relative to BS_WT_ROOT), BS_MIRROR, BS_BRANCH, BS_SHA, BS_REMOTE_WT,
 # BS_REMOTE_CRATE, and BS_LOCAL_DIRS (every directory of a path dependency, relative to BS_WT_ROOT, from cargo metadata).
 bs_context() {
+  local d
   BS_CRATE="$PWD"
   [ -f "$BS_CRATE/Cargo.toml" ] || bs_die "no Cargo.toml in $BS_CRATE: run from the crate directory (the fork worktree, igneum-pow, app/igneum-app, proving/igneum-prove)"
   BS_TOP=$(git -C "$BS_CRATE" rev-parse --show-toplevel 2>/dev/null) || bs_die "$BS_CRATE is not inside a git worktree"
@@ -115,6 +116,39 @@ print("\n".join(rel(m) for m in sorted(dirs)))
 print("VENDOR_REPOS " + " ".join(rel(t) for t in sorted(repos)))' "$BS_WT_ROOT" "$BS_TOP" "$BS_KIND") || bs_die "cargo metadata failed in $BS_CRATE"
   BS_VENDOR_REPOS=$(printf '%s\n' "$BS_LOCAL_DIRS" | sed -n 's/^VENDOR_REPOS //p')
   BS_LOCAL_DIRS=$(printf '%s\n' "$BS_LOCAL_DIRS" | grep -v '^VENDOR_REPOS ' || true)
+  # Files a crate reaches by include_bytes!/include_str! with a relative path that LEAVES its repository (the shipper, 7 Oct 2026:
+  # the fork's igneum-exec embeds proving/igneum-prove/elf/igneum-prove-program.vk five levels up, and the box build failed with
+  # "couldn't read ...: No such file or directory" because such a file is no path dependency and the overlay never carried it).
+  # Every .rs under the trees that travel is scanned; a path resolving outside BS_TOP but inside the worktree root adds its
+  # directory to the overlay. proving/igneum-prove/elf is added for a fork build whatever the scan finds (the fixed fallback).
+  local extra
+  extra=$(python3 - "$BS_WT_ROOT" "$BS_TOP" $BS_LOCAL_DIRS $BS_VENDOR_REPOS <<'PY2'
+import os, re, sys
+root, top, rels = sys.argv[1], sys.argv[2], sys.argv[3:]
+rx = re.compile(r'include_(?:bytes|str)!\(\s*"((?:\.\./)+[^"]+)"')
+out = set()
+for rel in rels:
+    base = os.path.join(root, rel)
+    for dp, dn, fn in os.walk(base):
+        dn[:] = [d for d in dn if d not in ("target", ".git") and not d.startswith("target-")]
+        for f in fn:
+            if not f.endswith(".rs"): continue
+            p = os.path.join(dp, f)
+            try: text = open(p, encoding="utf-8", errors="ignore").read()
+            except OSError: continue
+            for m in rx.finditer(text):
+                a = os.path.normpath(os.path.join(dp, m.group(1)))
+                if (a == top or a.startswith(top + "/")): continue
+                if not a.startswith(root + "/"): continue
+                out.add(os.path.relpath(os.path.dirname(a), root))
+print("\n".join(sorted(out)))
+PY2
+) || extra=""
+  [ "$BS_KIND" = node ] && [ -d "$BS_WT_ROOT/proving/igneum-prove/elf" ] && extra=$(printf '%s\n%s\n' "$extra" "proving/igneum-prove/elf" | grep . | sort -u)
+  for d in $extra; do
+    case " $BS_LOCAL_DIRS " in *" $d "*) ;; *) BS_LOCAL_DIRS="$BS_LOCAL_DIRS
+$d"; bs_log "included by include_bytes!/include_str! outside the crate's repository: $d" ;; esac
+  done
   [ -n "$BS_LOCAL_DIRS$BS_VENDOR_REPOS" ] || bs_die "cargo metadata listed no local packages in $BS_CRATE"
 }