fix(boat): resolve prior workspace authority to recorded lease

Preserve historical PRP workspace coordinates and require the recorded lease run plus exact retired owner before rotating authority.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/services/native-runtime/native-session-executor.test.ts

@@ -13445,6 +13445,8 @@ describe("runnerd provider runtime wiring", () => {
 
   it.each([
     { condition: "retired", expected: "verified" },
+    { condition: "workspace-coordinate", expected: "verified" },
+    { condition: "wrong-workspace-run", expected: "scope_mismatch" },
     { condition: "uncertain", expected: "terminal_state_indeterminate" },
     { condition: "stale-generation", expected: "terminal_state_indeterminate" },
     { condition: "wrong-placement", expected: "scope_mismatch" },
@@ -13460,20 +13462,23 @@ describe("runnerd provider runtime wiring", () => {
     const descriptor = { kind: "remote-persistent", leaseId: "prior-lease", providerLeaseId: owner.ownerId,
       remoteCwd: "/remote/agent", computerId: owner.computerId, ownerGeneration: owner.generation,
       listenerPort: owner.listenerPort, placementId: "placement" };
-    const db = { select: () => ({ from: (table: unknown) => ({ where: () => ({ limit: async () =>
+    let leaseQuery: SQL | undefined;
+    const workspaceCoordinate = ["workspace-coordinate", "wrong-workspace-run"].includes(condition);
+    const db = { select: () => ({ from: (table: unknown) => ({ where: (query: SQL) => { if (table === environmentLeases) leaseQuery = query; return ({ limit: async () =>
       table === environmentLeases ? condition === "wrong-lease" ? [] : [{
         providerLeaseId: owner.ownerId,
+        heartbeatRunId: condition === "wrong-workspace-run" ? "unrelated-run" : prior.binding.runId,
         metadata: { agentId: prior.binding.agentId, computerOwner: { ...owner, generation: 1 } },
       }] : [{ status: condition === "active-run" ? "running" : "succeeded",
         runnerProfileJson: { nativeExecutionInput: prior, nativeComputerWorkspace: descriptor } }],
-    }) }) }) } as unknown as Db;
+    }); } }) }) } as unknown as Db;
     computerRetirement.isRetired.mockReset().mockImplementation(async ({ owner: requested }) => {
       if (condition === "unavailable") throw new Error("ledger unavailable");
       return condition !== "uncertain" && requested.generation === (condition === "stale-generation" ? 3 : 2);
     });
     const input = { db, root, execution: current, identity: { runId: prior.binding.runId,
       normalizedSessionId: prior.session.normalizedSessionId!, runnerInstanceId: "prior-runner",
-      environmentLeaseId: condition === "wrong-lease" ? "other-lease" : "initial-physical-lease" },
+      environmentLeaseId: workspaceCoordinate ? prior.binding.executionWorkspaceId : condition === "wrong-lease" ? "other-lease" : "initial-physical-lease" },
       allowVerifiedBackup: false, remoteRunnerState: true,
       runnerExecutionTarget: { kind: "remote", transport: "computer", environmentId: "environment",
         remoteCwd: "/remote/agent", resourceAuthority: { ...owner, ownerId: "successor-owner", generation: 1 },
@@ -13493,12 +13498,17 @@ describe("runnerd provider runtime wiring", () => {
         expect(computerRetirement.isRetired).not.toHaveBeenCalled();
       }
       expect(await verifyPriorRunnerdStateForSessionScope({ ...input, allowRetainedWarmRunner: false })).toBe(expected);
-      if (["retired", "uncertain", "stale-generation", "unavailable"].includes(condition)) {
+      if (["retired", "workspace-coordinate", "uncertain", "stale-generation", "unavailable"].includes(condition)) {
         expect(computerRetirement.isRetired).toHaveBeenCalledExactlyOnceWith({
           companyId: current.binding.companyId, environmentId: "environment", agentId: current.binding.agentId,
           runId: prior.binding.runId, owner,
         });
       } else expect(computerRetirement.isRetired).not.toHaveBeenCalled();
+      if (workspaceCoordinate) {
+        const query = new PgDialect().sqlToQuery(leaseQuery!);
+        expect(query.params).toContain(descriptor.leaseId);
+        expect(query.params).not.toContain(prior.binding.executionWorkspaceId);
+      }
     } finally { await rm(root, { recursive: true, force: true }); }
   });
 

server/src/services/native-runtime/native-session-executor.ts

@@ -4368,20 +4368,28 @@ export async function verifyPriorRunnerdStateForSessionScope(input: {
       // are authoritative even though no local runner-state.json exists.
       // This read cannot retire a live owner or accept a newer generation.
       try {
-        // Warm turns advance the attempt lease while the physical runner keeps
-        // its initial PRP lease identity. Verify that original lease belongs to
-        // this exact owner lineage instead of requiring the latest attempt id.
+        // PRP historically calls the immutable execution-workspace coordinate
+        // environmentLeaseId. Computer placement records the actual lease. Only
+        // this exact prior workspace coordinate may resolve through that record.
+        // Explicit physical lease identities still preserve their warm lineage.
+        const workspaceCoordinate = input.identity.environmentLeaseId ===
+          priorExecution.binding.executionWorkspaceId;
+        const physicalLeaseId = workspaceCoordinate
+          ? priorWorkspace.leaseId
+          : input.identity.environmentLeaseId;
         const [physicalLease] = await input.db.select({
           providerLeaseId: environmentLeases.providerLeaseId,
+          heartbeatRunId: environmentLeases.heartbeatRunId,
           metadata: environmentLeases.metadata,
         }).from(environmentLeases).where(and(
-          eq(environmentLeases.id, input.identity.environmentLeaseId),
+          eq(environmentLeases.id, physicalLeaseId),
           eq(environmentLeases.companyId, input.execution.binding.companyId),
           eq(environmentLeases.environmentId, target.environmentId),
         )).limit(1);
         const leaseMetadata = record(physicalLease?.metadata);
         const leaseOwner = record(leaseMetadata.computerOwner);
-        if (physicalLease?.providerLeaseId !== priorWorkspace.computerOwner.ownerId ||
+        if ((workspaceCoordinate && physicalLease?.heartbeatRunId !== input.identity.runId) ||
+            physicalLease?.providerLeaseId !== priorWorkspace.computerOwner.ownerId ||
             leaseMetadata.agentId !== input.execution.binding.agentId ||
             leaseOwner.computerId !== priorWorkspace.computerOwner.computerId ||
             leaseOwner.ownerId !== priorWorkspace.computerOwner.ownerId ||