[feature] RC: prove the deployed CLI-to-phone viewer journey before release

[AetherAI3]

Gap

Current tests use stubs or an in-process broker. The README explicitly says a fully qualified live Cloud viewer journey is unproven and old draft PR #108 is not release evidence for current main.

Evidence: source-candidate status, stubbed journey, Cloud API/web surfaces.

Acceptance

• At exact Agent, Cloud API, and Aether Code web revisions, run a real signed-in flow: enroll, start RC, scan link/QR on a phone/browser, observe live local coding events, inspect exposure/viewers, and revoke.
• Capture evidence for owner/device binding, no inbound host listener, outbound TLS, redaction canaries, event allowlist, duplicate-safe reconnect, broker outage with local run continuing, and no browser tool authority.
• Exercise Windows and Linux hosts plus a narrow mobile viewer; distinguish feature-disabled, unavailable, and healthy deployments.
• Record revisions, flags, test account setup, results, and rollback steps in a repeatable release artifact. Keep 0.4.0 RC unshipped until this gate passes.

Scope

Integration/release proof, not another unit-test mock or a claim based on PR #108.

Tracked prerequisites

• Broker and viewer contracts: [feature] RC: reconcile opening events with the Cloud broker wire contract #214, [feature] RC: make browser panels render the Agent's structured event shapes #215
• Coding event bridge and delivery: [feature] RC: attach observation to live Aether Agent coding runs #216, [feature] RC: keep the host heartbeat and outbox delivery alive during a run #223
• Subsystem producers: [feature] RC: publish real subagent lifecycle events #217, [feature] RC: publish verified diff summaries from workspace changes #218, [feature] RC: publish test verification outcomes from real runs #219, [feature] RC: publish CI and PR status from Action Rail receipts #220, [feature] RC: publish generated artifact metadata from media history #221, [feature] RC: publish preview lifecycle without exposing local URLs #222
• Browser handoff: [feature] RC: mint an observer grant and print a browser link plus QR code #224, [feature] RC: preserve a QR handoff across Aether Code sign-in #225
• Status and lifecycle: [feature] RC: report authoritative exposure, viewers, and session health #226, [feature] RC: make start and revoke recovery fail closed and truthful #227
• Observer-only Aether Code surface: [feature] RC: ship an observer-only Aether Code viewer profile #228

[AetherAI3]

Closed with the live gate recorded and the remaining gaps tracked as follow-ups (owner decision 2026-10-06).

Evidence: docs/reviews/2026-10-06-rc-live-journey.md (exact revisions, flags, accounts, results, rollback, owner phone screenshots).

Revisions: Agent PR #292 head 2ab15dd for the journey (same packed bytes on a Windows and a Linux host); landed as 90f6810 after a rebase in which 10/12 commits are patch-identical and the other 2 differ only in the #299 integration — RC behaviour unchanged. Cloud API 3543d1d1 → 9bc8bc92; web 3543d1d1:site.

Journey	Windows	Linux
J1 enroll · J2 start · J3 phone scan · J4 live events · J5 viewers · J6 revoke	PASS	PASS

Property	Result
P1 owner/device binding	PASS — flags-on foreign account gets uniform 404
P2 no inbound listener · P3 outbound TLS only	PASS
P4 redaction canary · P5 event allowlist	PASS (21 stored events)
P6 duplicate-safe reconnect	PASS after AETHER-CLOUD#1936 (CORS Last-Event-ID — found by this journey)
P7 broker outage, local run continues	tests only (rc_pump virtual clock)
P8 no browser tool authority	PASS — live scan 0 findings
P9 disabled / unavailable / healthy	partial
P10 QR handoff across sign-in	PASS

Prerequisites closed: #214–#228 (this lane: #218–#223, #226, #227 via #292; #224, #228 with live evidence).

Follow-ups: #300 (rc needs operator-only device enrollment — blocks ordinary accounts), #301 (plan + tool completion events), #302 (delivery edge cases), #303 (release truth after the 0.4.0 publish); AETHER-CLOUD#1938 (viewer UX), #1939 (per-account dev-session flag), #1940 (expiry reaper), #1941 (device-flow account display). Note: aether-agents@0.4.0 was published to npm before this gate ran (from 3cf3f725, owner-intentional); the gated code is on main for the next release.