Summary

• reject brokered/managed Hetzner Windows and macOS with provider-specific guidance instead of the old generic unsupported-target error
• keep AWS managed Windows limited to native windowsMode=normal, with explicit WSL2/static-host guidance
• make coordinator-backed status / inspect display the lease target from the broker so AWS Windows leases do not render as local default Linux
• document the managed target split: Hetzner Linux only, AWS managed Windows/EC2 Mac, and provider=ssh for existing non-Linux hosts

cc @steipete

Live AWS proof

• crabbox run --provider aws --target windows --market on-demand --idle-timeout 15m --timing-json --shell 'Write-Output ("OS=" + (Get-CimInstance Win32_OperatingSystem).Caption); git --version; (tar --version | Select-Object -First 1); Write-Output "CRABBOX_WINDOWS_OK=1"'
• leased cbx_56052950ae48 / blue-crab; requested c7a.48xlarge, fell back after quota to m7i.4xlarge
• output: OS=Microsoft Windows Server 2022 Datacenter, git version 2.52.0.windows.1, bsdtar 3.8.4, CRABBOX_WINDOWS_OK=1
• timing: sync 12.737s, command 4.361s, total 20.546s, exit 0
• release verified: cbx_56052950ae48 ... state=released
• no Cloudflare broker deploy needed for this proof; the current broker already provisions AWS Windows

Validation

• go test ./internal/cli -run 'TestValidateProviderTarget|TestLeaseStatusRequiresSSHReadiness|TestVersion'
• go test ./...
• go vet ./...
• npm run format:check --prefix worker
• npm run lint --prefix worker
• npm run check --prefix worker
• npm test --prefix worker
• npm run build --prefix worker
• git diff --check
• CLI rejection smoke:
  • CRABBOX_COORDINATOR= CRABBOX_PROVIDER=hetzner CRABBOX_TARGET=windows CRABBOX_WINDOWS_MODE=normal go run ./cmd/crabbox warmup
  • CRABBOX_COORDINATOR= CRABBOX_PROVIDER=aws CRABBOX_TARGET=windows CRABBOX_WINDOWS_MODE=wsl2 go run ./cmd/crabbox warmup