fix(workspace): reconcile ambiguous remote ownership

Author: vincentkoc

CHANGELOG.md

@@ -14,6 +14,7 @@
 - Streamed artifact-collection scripts through SSH stdin so multiple artifact globs no longer overflow macOS OpenSSH multiplexed session requests.
 - Allowed Windows and WSL2 SSH readiness checks enough time for delayed native OpenSSH handshakes without slowing Linux or macOS readiness.
 - Kept WSL2 workspace-owner commands below the Windows command-line limit by streaming their POSIX scripts over SSH stdin.
+- Reconciled lost workspace-owner acquire and renew responses within bounded ownership deadlines, and fenced native Windows child trees with an identity-checked Job Object supervisor.
 - Fenced Linode heartbeats and Tailscale metadata updates with exact account-, scope-, and instance-bound claims, preserving legacy instance claims, idle-timeout intent, and safe release continuity.
 - Made two timing-sensitive tests robust on loaded CI runners.
 - Required exact, locked resource ownership claims before Tencent Cloud, Nebius, Vast, Orgo, Upstash Box, Coder, and EC2 Mac host lifecycle mutations, preventing name-matched, stale, cross-namespace, or concurrently renewed resources from being destroyed.

docs/commands/run.md

@@ -221,9 +221,16 @@ exclusive and bypass this owner.
 Ownership is fenced with a random token and renewed while the lifecycle is
 active. If the local client disappears, Crabbox recovers an expired owner only
 after verifying that its witnessed remote child is no longer alive. Ambiguous
-renewal, release, token, or child state fails closed instead of risking a
-concurrent checkout. POSIX, WSL2, and native Windows targets implement the same
-protocol; the small sync-finalization lock remains nested inside it.
+acquire responses are reconciled within the configured wait, and ambiguous
+renewals are retried only through the last confirmed ownership TTL. Release,
+token, or child-state uncertainty still fails closed instead of risking a
+concurrent checkout.
+
+Native Windows runs additionally place the remote process tree in a Job Object
+owned by an identity-checked supervisor. Removing or changing its published
+child record closes the job before the workspace can be reused. Linux, macOS,
+and WSL2 retain the two-line PID/start-identity witness for the direct remote
+child; they do not claim kernel-backed descendant containment.
 
 Use `--full-resync` (alias `--fresh-sync`) when a warm lease smells stale:
 Crabbox deletes the remote workdir, skips the fingerprint fast path, reseeds Git

internal/cli/run_workspace_owner_cleanup_test.go

@@ -110,6 +110,7 @@ func (r *runCleanupWorkspaceOwnerTransport) acquire(ctx context.Context, target
 		stop:      make(chan struct{}),
 		done:      make(chan struct{}),
 	}
+	owner.confirmedAt(time.Now())
 	ticks := make(chan time.Time, 1)
 	go owner.renewLoopWithTicks(ticks, time.Minute)
 	ticks <- time.Now()
@@ -232,7 +233,7 @@ func TestRunCommandDestructiveCleanupQuiescesWorkspaceOwner(t *testing.T) {
 		wantOwnerRelease bool
 	}{
 		{name: "successful evidence-backed run", command: "renewal-cleanup-success", download: true, wantStop: true},
-		{name: "renewal fails before stop", command: "renewal-cleanup-success", renewErr: errors.New("renew response lost"), wantExit: 7, wantOwnerRelease: true},
+		{name: "ambiguous renewal resolves through confirmed stop", command: "renewal-cleanup-success", renewErr: errors.New("renew response lost"), wantStop: true},
 		{name: "stop is not confirmed", command: "renewal-cleanup-success", stopErr: errors.New("stop not confirmed"), wantExit: 7, wantStop: true, wantOwnerRelease: true},
 		{name: "remote command remains nonzero", command: "renewal-cleanup-exit-23", wantExit: 23, wantStop: true},
 	}
@@ -341,7 +342,7 @@ func TestRunCommandDestructiveCleanupQuiescesWorkspaceOwner(t *testing.T) {
 	}
 }
 
-func TestRunCommandRetainedLeaseRetainsFailClosedRenewal(t *testing.T) {
+func TestRunCommandRetainedLeaseResolvesAmbiguousRenewalOnRelease(t *testing.T) {
 	tests := []struct {
 		name string
 		args []string
@@ -375,7 +376,7 @@ func TestRunCommandRetainedLeaseRetainsFailClosedRenewal(t *testing.T) {
 			remote.unblockInspect()
 			remote.unblockRenewal()
 			runErr := result.wait(t)
-			assertRunCleanupExitCode(t, runErr, 7, stdout.String(), stderr.String())
+			assertRunCleanupExitCode(t, runErr, 0, stdout.String(), stderr.String())
 			select {
 			case <-releaseStarted:
 				t.Fatal("retained lease was destructively stopped")