[M4n5ter]

Summary

Explicit browser takeover disconnected the owner IPC because its request field was missing from broker parsing/forwarding. Retained cleanup errors then blocked later Computer calls and could keep Host resident after the last Desktop window closed.

This PR consumes the CUA transport fix, separates receipt identity for each IPC connection while preserving physical tab ownership across live connections, and lets a new Computer evaluation proceed while ended-turn cleanup remains owned.

Idle retirement now distinguishes active work from completed work retained after an error. Host waits for original close attempts and remaining VMs, then attempts transport, access-store and SQL shutdown before returning errors. Computer, JEV, Web, Agent, Workhub, ACP and process idle checks follow the same distinction. Running tasks and other connected clients still keep Host alive. Removed the unrelated fixed 32-process ACP admission cap from this path.

Verification

Linux, Rust 1.99.1, debug information and incremental compilation disabled; no live user browser, Desktop process or database was changed:

• CUA core: 1,553 passed, one ignored. The public-provider/private-socket/native-broker test failed on the original protocol omission and passes with the fix.
• Computer native-desktop library: 264 passed, three ignored, including disconnect/reconnect to the same native host, inventory and actual takeover, retained old-receipt isolation, and competing live bindings.
• Host runtime: 60 passed serially. Host JS application services: 44 passed serially.
• Computer native: 17 passed, one ignored. ACP native: two passed.
• CLI process keeper: passed successful and failing native-close scenarios; before release the original Root stayed locked, and after release the process exited and Root could reopen. The failure scenario intentionally exits unsuccessfully.
• Agent panic plus terminal SQL failure: idle retirement regression passed.
• Restoring the original permanent-busy cleanup gate makes the native-close keeper fail immediately; restoring this candidate passes both close scenarios.
• Strict Clippy passed for Host runtime, Computer native, Agent native, ACP native, JEV native, Web and process native crates (all targets). Changed Rust files pass rustfmt; git diff --check passes.

Initial concurrent Host tests hit fixture deadlines and were rerun serially. Three stale Host JS assertions about caller failure, forced provider retirement and parent capacity were corrected to check the current custody/continued-work behavior. No production settlement contract was weakened to satisfy them.

Desktop acceptance

• Complete real-extension desktop acceptance across macOS, Windows, Linux and WSL. Socket tests are transport evidence, not real Chrome effects. This and the CUA PR remain draft until that evidence is available.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and tested the changes; a separate GPT-6 Astra advisor reviewed failure isolation and shutdown/reconnection correctness. Material commits include Generated-by trailers.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No