[WRONG BRANCH] fix(codex): run owned startup after ownership retry

[luvs01]

Motivation

• Close a race where a successful ownership-unknown reprobe could delete the admission fence without starting the owned startup lifecycle, allowing admitted native-main traffic to read physical auth.json before recovery finished.
• Ensure that when a host becomes visibly owned after boot, the server initializes the same owner/ recovery path it would have taken at boot so credential, recovery, and stage-sweep invariants hold.

Description

• Added an optional activate/onOwned hook to the service-ownership reprobe entry so a successful reprobe can arm the standard owned lifecycle before the fence is spent (src/codex/native-profile-startup.ts).
• On a successful reprobe that returns owned, call the lifecycle activator and then spend the fence while preserving the transitioned lifecycle until the server that installed it releases it (src/codex/native-profile-startup.ts).
• Wired server startup to provide onOwned: () => startNativeMainStartupLifecycle(...) when inspectStartupOwnership initially returned ownership-unknown, so a later reprobe starts the owned startup flow rather than merely removing the fence (src/server/index.ts).
• Added a focused regression test that asserts a successful reprobe starts owned recovery (keeps gate at recovery-pending until recovery settles) and only reopens admission after the owned lifecycle settles (tests/native-profile-startup.test.ts).

Testing

• Ran the focused suites with ./node_modules/.bin/bun test tests/native-profile-startup.test.ts tests/core-lab-boundary.test.ts and observed all tests in those files passed after the change.
• Ran typecheck with bun run typecheck and bun run privacy:scan, both succeeded in this environment.
• Ran the full test runner with bun run test; the run completed but reported unrelated, environment/timing-sensitive failures elsewhere in the repo (CLI/service detection, process shutdown, and some stream/timeouts). The native-profile focused tests and the core lab-boundary checks passed, validating the fix for the affected subsystem.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 17c5221c-7292-4da1-99a5-bd396822e83c

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.