# ConnectOnion 1.9.3rc16 (release candidate)

Stable remains 1.9.2. This preview requires Python 3.11 or newer and retains
rc15's dependency floors and optional-extra security fixes. No dependency is
upgraded by this candidate.

## A slow pointer no longer accumulates every old approach step

An async click approach now skips intermediate points whose pacing budget has
already elapsed. It still awaits the exact target, preserves overshoot/dwell
behavior and sends one down/up sequence. Generic pointer moves and hover keep
their existing behavior. Driver errors and cancellation still propagate.

In an isolated native headless fixture, a 1-second delay on each dispatched
move changed one click from 51.18 seconds/50 moves to 5.36 seconds/5 moves.
Healthy dispatch remained about 1.15 seconds/50 moves. These are controlled
fixture measurements, not a promise of that speedup on every page. The earlier
production cadence's root cause remains unproven. Fresh headed and headless
native fixtures exercised exact-target clicks; the headed run did not establish
a hidden/background-page control.

A scoped O Chat consumer journey verified invite onboarding, two approvals,
one real model turn, one trusted click, native screenshot delivery and a live
phone-width reconnect without another input or click. The consumer used system
Chrome; the native Linux input fixtures were separate. The full native-provider
release journey and customer reimbursement on this candidate were not part of
that scoped consumer run.

![O Chat after a confirmed phone-width reconnect](https://raw.githubusercontent.com/openonion/connectonion/v1.9.3rc16/docs/releases/assets/v1.9.3rc16/mobile-reconnected.png)

The unchanged capture above contains a generic local fixture. Its image and
consumer evidence are described in the [acceptance record](https://github.com/openonion/connectonion/blob/v1.9.3rc16/docs/acceptance/click-pacing-2026-10-23/README.md).
No O Chat layout change or before/after visual redesign is included.

## Supervised browser jobs can refuse a replacement daemon

Set `CO_BROWSER_DAEMON_PID` to the verified local daemon's positive PID when
the supervisor owns startup. A missing, unavailable or replaced owner then
fails before command dispatch, automatic daemon startup or client installation.
The pin follows engine probes, reconnects and read keepalives. Whole-browser
close does not adopt a replacement owner for force cleanup. Explicit Host
private targets ignore the local pin; unpinned CLI startup stays unchanged.
An explicit `install-onion` is still an installation request.

Use a private endpoint/profile and verify the account and paid session
separately. The PID is a lifecycle constraint, not authentication or a session
identifier. See the [browser documentation](/cli/browser-command).

The new regression cases passed 21 tests; the related browser suite passed 90.
A real CLI trial listed zero tabs, refused navigation after owner loss and
replacement, preserved the new owner and exited both owned daemons. It opened
no page or paid session. It does not establish production namespace acceptance.

## A project Host watches only the handoff store it owns

Host startup now passes its resolved configuration directory to the handoff
watcher boundary. A different project directory does not start the ambient
global watcher. A matching configured directory keeps normal start/shutdown;
the owner's explicit CLI watcher remains unchanged. This does not introduce
project-scoped handoff queues, reset historical records or replay handoffs.
The expanded ownership suite passed 145 tests.

The design stories explain [click pacing](/blog/the-pointer-was-still-on-its-way),
[supervised browser startup](/blog/the-browser-must-not-replace-its-supervisor)
and [Host handoff ownership](/blog/a-project-host-inherited-the-operators-handoffs).

## Install

```bash
python -m pip install --upgrade 'connectonion==1.9.3rc16'
```

Use the exact pin in a Python 3.11+ environment. A preview remains opt-in and
does not change the stable installation recommendation.