fix(cli): end a remote lease allocated by a materialization that never persisted

TH
2h ago
+1676-903

Summary

A failed remote materialization releases leases proven created by that command before a durable session record takes ownership. A single slot covers allocation, binding, Metro preparation, and persistence. Every allocate response remains eligible for binding; omitted ownership evidence never authorizes rollback.

Spec refusal retains one rollback retry after a thrown release. Failed cleanup now has one typed shape: details.leaseRollback with reason LEASE_RELEASE_FAILED. A successful retry leaves no stale failure evidence.

26 files overall, including the mechanical split. This round touches 5: 2 production, 2 tests, 1 doc. No scope expansion or linked issue (SM-2).

Validation

Head 8ee729017c8863d052e3771c2a48ac7a956c16f9, parent c36e0f1e21ca5e66eac07ad8e1400fd73cc7178c.

  • Spec suite: parent production 2 failed / 13 passed; fixed production 15 passed. Three focused suites: 33 passed.
  • pnpm format and pnpm check:affected --run --head HEAD passed (41 runnable checks, 25 explicitly skipped), exactCommit=true, checkoutChanged=false; receipt .tmp/validation/run-YCAgiS/receipt.json. Hosted coverage/device smoke and current-head review remain pending.
  • Live Limrun at 4472e078: forced Metro failure followed successful allocation/release; instance android_euna_01m6cfayamfbv8evtry0dze6sm terminated; isolated daemon stopped without pending releases. This round preserves release ordering.
  • Hosted coverage and device smoke remain CI obligations. Coordinator review remains outstanding. The seven thread dispositions and success-path ownership proof are in the review-round comment.