diff --git a/.kiro/specs/xce-test-cli-ux/tasks.md b/.kiro/specs/xce-test-cli-ux/tasks.md
index 49d1281f..2a139873 100644
--- a/.kiro/specs/xce-test-cli-ux/tasks.md
+++ b/.kiro/specs/xce-test-cli-ux/tasks.md
@@ -149,12 +149,13 @@
   - _Depends: 3.1, 3.2, 3.3, 3.4, 3.5_
 
 - [ ] 4. Validation: end-to-end verification
-- [ ] 4.1 Verify Ctrl-C cancellation end-to-end
+- [x] 4.1 Verify Ctrl-C cancellation end-to-end
   - Confirm interrupting a command blocked on a real request abandons the wait well before its own timeout, reports the command as failed, and leaves the session's context and connection usable
   - Confirm that issuing a second command on the same connection immediately after an interrupt does not race the abandoned request, and that a command on a different connection is unaffected
   - Observable completion: a live end-to-end run demonstrates both the immediate-cancellation behavior and the no-overlap behavior on the same connection
   - _Requirements: 1.1, 1.2, 1.3, 1.4, 1.5_
   - _Depends: 3.2, 1.7_
+  - _Done (requirements 1.1-1.5 MET): run twice independently (implementer + reviewer), each against a separately-deployed single-node live controller (`/xce-deploy-ha`-style, `deploy-ha.sh`), freezing the controller mid-RPC with `SIGSTOP` to create a genuine blocked-request condition and sending real `SIGINT` to the real `xce_test` process. AC 1.1: a `hello` blocked against the frozen controller (confirmed hung, no reply) was abandoned in ~0.00026-0.00028s of wall-clock time after SIGINT (both runs closely agreed), vs. the ~10s `cbuf_deadline_10s` RPC timeout. AC 1.2: a partial, un-submitted input line was discarded cleanly on SIGINT, prompt redisplayed, session immediately usable. AC 1.3: the interrupted command reported `hello: Interrupted system call` on stderr and `$?` == -4 (-EINTR), the same failure signaling as any other failing command. AC 1.4: the process survived 3 separate SIGINTs across the run, exiting only on an explicit `quit`. AC 1.5: a second `hello` issued immediately after the first abandonment, on the same connection, with the controller still frozen, itself blocked (queuing on the per-connection lock) rather than racing or returning stale data; after `SIGCONT`, a third `hello` on that same connection completed normally, proving full reuse after two abandonments. The different-connection-independence sub-clause was validated via existing white-box coverage (`test_different_connection_keys_run_independently`, `test_interruptcall.c`) rather than a second live controller node — both implementer and reviewer independently read that test and confirmed it exercises the same connection-key abstraction production uses (`active_ctx->ctx`) with a real abandonment on one key and asserted concurrency on a distinct key, and design.md confirms the mechanism is entirely client-side, so a second live node would add no further assurance. No source files were changed; both deploys were fully cleaned up (processes killed, deploy dirs removed, confirmed via `pgrep`)._
 
 - [ ] 4.2 Verify the confirmation gate end-to-end
   - Confirm each of the five destructive commands prompts by default, respects its bypass flag and the session toggle, and auto-skips under non-interactive input