ubicloud: pull destinations are rechecked at pull time, verify parses options by arity, a finished command keeps its status, the remote sid outlives the wrapper; docs audit

Pass-2 (Codex adversarial on the delta): an earlier pull could plant a symlink
where a later config pull lands, so under verify every destination is resolved
again (symlinks followed) right before its pull and a refused pull exits 1;
'--dest --trust-config' made an option value act as the trust flag, so verify
parses by arity; a command that finished in the instant before the watchdog's
kill exited 0 and was still reported as 124; the wrapper removed the sid file
while a background child kept the channel open, so the file now stays until
remote_cancel reads it. Docs audit (document-release, edit mode): TTL suffix and
owner rule in TESTING_INTERNALS, the reaper as the exception to 'no sweep', the
docs/skills.md transcript uses a neutral owner; CHANGELOG and the runner header
corrected on the two points it deferred.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

docs/TESTING_INTERNALS.md

@@ -962,16 +962,18 @@ the CSO private-state checks), AppArmor blocks the unprivileged user
 namespaces Chromium's sandbox needs, and `clang` and `python3-venv` are absent
 (required by the Dia readiness and Python runner tests).
 
-VMs are named `ubirun-<owner>-<epoch>-<hex>`; `<owner>` is `UBI_OWNER` (set it
-to the thread id on a Capy machine), else a stable per-machine id. Every exit
+VMs are named `ubirun-<owner>-<epoch>-<hex>`, plus a `-t<hours>` TTL suffix
+(below); `<owner>` is `UBI_OWNER` (set it to the thread id on a Capy machine;
+lowercase letters and digits, at most 12), else a stable per-machine id. Every exit
 path destroys the client's own VM (`trap` on EXIT, INT, TERM, HUP and QUIT), and
 `down` fails loudly (`FAILED to destroy <location>/<name> (HTTP <code>)`) unless
 the VM is confirmed gone. `list --mine` shows this owner's VMs, `usage` the
 project's, and `records` the VM-id scratch file (`UBI_VM_RECORD`, default
 `~/.capy/work/ubi-runner/vms.tsv`, else `<state root>/vms.tsv`): every VM is
 recorded there before the create call and forgotten only after a confirmed
-destroy, so a killed runner leaves a name to clean up. Nothing sweeps stale VMs
-by default, because the project quota is shared with other agents' runners; set
+destroy, so a killed runner leaves a name to clean up. No age-based sweep runs
+by default, because the project quota is shared with other agents' runners (the
+TTL reaper below destroys only a VM whose own `-t<hours>` TTL has ended); set
 `UBI_GC_HOURS` to a positive number (or run `gc HOURS`; `gc 0` is a no-op) to
 sweep only this owner's VMs older than that. For other commands, use the runner
 directly: `scripts/ubicloud/ubi-runner.sh run --setup <script> -- '<command>'`,
@@ -1017,9 +1019,10 @@ machine swap, in this order:
    on the base and on the candidate from the same VM size and location, never
    one side local and the other remote.
 4. Profiling very large imports (a whole-repo ingest, the full free suite under
-   a profiler) is warned about before it starts: it holds the VM past
-   `UBI_GC_HOURS` and the sentinel arrives hours later; name the expected
-   duration in the thread before launching.
+   a profiler) is warned about before it starts: it holds the VM for hours, and
+   any other lane's `up` reaps it once its TTL (`UBI_TTL_HOURS`, default 4)
+   plus ten minutes has passed, so set `UBI_TTL_HOURS` above the expected
+   duration and name that duration in the thread before launching.
 
 ## Cloud sandboxes (Vercel / Conductor cloud workspaces)
 

docs/skills.md

@@ -894,14 +894,14 @@ runner destroys its VM on every exit path only while it is alive.
 ```
 You:   /ubicloud run the full verify
 
-Claude: UBICLOUD_API_KEY: set; UBI_OWNER=gsta114
+Claude: UBICLOUD_API_KEY: set; UBI_OWNER=lane7
         gstack-ubi verify  (.gstack/ubicloud.json: bootstrap.sh, "bash scripts/verify.sh", standard-16)
         ubi-runner: reap: no expired VMs
-        ubi-runner: creating eu-central-h1/ubirun-gsta114-1761500000-9f3a2c10-t4 (standard-16)
-        ubi-runner: ubirun-gsta114-1761500000-9f3a2c10-t4 carries a 4h TTL (any later run of this script reaps it); if this process dies first: gstack-ubi down ubirun-gsta114-1761500000-9f3a2c10-t4
+        ubi-runner: creating eu-central-h1/ubirun-lane7-1761500000-9f3a2c10-t4 (standard-16)
+        ubi-runner: ubirun-lane7-1761500000-9f3a2c10-t4 carries a 4h TTL (any later run of this script reaps it); if this process dies first: gstack-ubi down ubirun-lane7-1761500000-9f3a2c10-t4
         ubi-runner: heartbeat: command 300s elapsed, last output 2s ago
         ubi-runner: command exited 0 after 1140s
-        ubi-runner: destroyed eu-central-h1/ubirun-gsta114-1761500000-9f3a2c10-t4
+        ubi-runner: destroyed eu-central-h1/ubirun-lane7-1761500000-9f3a2c10-t4
 ```
 
 ---