fix(native): verify warm ownership before configuration rotation

Track the exact prior warm-owner run ID separately from mutable configuration. Keep configuration retirement, terminal-state checks and failed-close fences. Add current-v5 handoff regressions and document the recovery boundary.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/DEVELOPING.md

@@ -1892,6 +1892,14 @@ Only successful turns retain a live warm provider session. A structured failed
 or cancelled result must retire that session and collect its managed files before
 heartbeat stops the reusable sandbox. A later retry can resume the same sandbox
 without inheriting the stopped provider transport.
+
+An idle warm owner proves only the exact prior run in the same company, session,
+workspace and environment. Mutable configuration compatibility is checked
+separately: changed settings retire the owned provider before a replacement can
+execute. A copied older owner record, an active or missing owner, and a different
+environment cannot use this in-memory proof. Database terminal status alone is
+not proof that an unsuspended remote runner can be adopted.
+
 The shared lease-release boundary rechecks the durable run status for recovery
 and ordinary teardown. Successful workspace copy-back alone must not keep a
 failed turn's sandbox running.

doc/plans/2026-10-15-native-warm-owner-proof.md

@@ -0,0 +1,38 @@
+# Exact warm-owner proof across native configuration changes
+
+A follow-up can fail with `prior_owner_terminal_state_indeterminate` before
+provider execution even when its prior heartbeat succeeded. The old predicate
+required the next configuration digest to match before recognizing the idle
+owner; this prevented the existing compatibility step from retiring a process
+whose configuration changed.
+
+Keep the session cache, durable-root admission and compatibility retirement in
+their current coordinator. They share process and instruction-copy ownership;
+this fix does not move their lifetime or weaken their gates. Cache each actual
+owner's heartbeat run ID and require it to match the durable prior-run identity.
+Keep company/session/workspace/environment checks and the terminal database
+check. Let the later compatibility step decide reuse versus retirement, and
+continue to reject unconfirmed retirement before another provider executes.
+
+Verification is through the production session entry point with scripted native
+backends and durable local owner files. The six existing selected controls pass.
+The initial three-case reproduction has one pass and two failures at the same
+prior-owner guard; after the fix all three pass. Eight focused controls now cover
+unchanged reuse through three turns, changed settings, changed runtime context,
+failed retirement, stale recorded identity, active owner, missing owner and a
+different environment. The runtime-context case uses the current v5 input and
+fails on the baseline at the same prior-owner guard before passing the repair. Replacing the exact
+run-ID comparison with an any-owner check makes the stale-owner control fail;
+the source is restored afterward.
+
+The first complete affected executor and resume suites passed 764 cases before
+the additional v5 runtime-context case. Full typecheck initially found an
+optional-argument error in the test database wrapper; after that correction,
+full typecheck and build passed. The v5 fixture expansion then exposed a legacy
+v1-only type on the shared database fixture. Its implementation only uses the
+common binding, so it now accepts the full native input union. After integrating the separate idle-expiry admission repair from #16432, the
+complete executor and resume suites passed 767 cases with zero selected skips.
+Full repository typecheck and build passed on the same frozen code and tests. Scripted-provider results do not establish real Daytona recovery,
+managed subscription behavior or hosted latency. Recheck the failed hosted
+continuation after normal deployment, preserving its existing recovery evidence.
+The broader response-latency target remains open independently of this repair.