feat: add fenced managed lease admission

[thymikee]

Summary

Adds neutral admission for one managed lease incarnation. It verifies returned TTL, reconciles ambiguous renewal against the exact durable request attempt, coalesces renewal work, and preserves each caller's deadline and cancellation. Fencing permanently rejects further execution, including after late renewal completion.

Command horizons use the canonical core timeout policy and reserve the existing 5-second teardown plus 11-second recording cleanup budgets. Ordinary teardown still requires a real session.

A separate contract correction replaces provisional readiness with task-taking managedDevice.admit, allowing downstream dispatch inside confirmation. run remains transport/cleanup-only. It also removes the unused ResolvedNativeAsset and NativeAssetResolver types. #2312 owns the reviewed consumer adaptation; this PR has no runtime activation. ADR 0021 documents that boundary and distinguishes fencing from teardown quiescence. Skills are unchanged.

Validation

Head 1df42d51f50e7dfb3162f113f74a76829c9b8272 is based on published #2307 97f4e7057f3c4d6dead9df39a6a7645063c877e4, rooted in requested main snapshot 80997b6bf1dda30ca57d74dc42036f6b447e16ad. All three commits are unchanged by range-diff; no conflicts.

• Independent adversarial review of the final restack: READY.
• Fresh exact-head pnpm check:affected --run passed: 3,258 tests / 431 files. The focused suite passed 462 tests, including all 418 exact-parent eager-closure cases, under the host-wide gate lock.
• Preserved planted-red horizon proof: removing recording reservation yields 5,000 ms instead of 16,000 ms; restoration passes.

Coverage and Integration pass. The iOS retry fails at a depth-1 snapshot after AX target resolution falls back to XCTest. This is not live managed-device acceptance.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	4.48 MB	4.48 MB	0 B
Package (unpacked)	4.48 MB	4.48 MB	0 B
Package (download)	1.33 MB	1.33 MB	-3 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	28.4 ms	28.9 ms	+0.5 ms
CLI --help	80.7 ms	83.1 ms	+2.4 ms

[thymikee]

Sentinel review at 6ec6471, independently reviewed. No additional code finding in this neutral prerequisite: it reuses allocator contracts, exact-attempt reconciliation, deadline/teardown owners and immutable lease identity checks; the cancellation, coalescing and late-fence tests exercise the service contract. It intentionally has no production admission caller yet, so this is not live managed-device acceptance. Merge remains blocked by dependency #2307 (new parent head needs validation), exact-head Coverage and Android smoke failures. Coverage inherits the eager-closure regression from the timing prerequisite; Android fails the automation-alert-result selector and is not proven related to this unconnected service. Fix/sync the parent and investigate the failing lane, then obtain green exact-head checks. Size: 0 B unpacked growth, 243 net production lines. No readiness label applied.

[thymikee]

Sentinel delta review at f543128: independently confirmed code clean. The parent timeout resolver is now dynamically imported, fixing the eager-closure gate without changing admission behavior. This remains a neutral lease-admission prerequisite, not enabled runtime integration; canonical budgets and existing allocator/fence owners are reused. All completed exact-head checks pass; iOS is pending. Merge order remains #2307 first, whose Android/iOS smoke checks currently fail. Holding readiness labeling until that prerequisite is cleared; no new source finding.

[thymikee]

Resolved the actionable requests in the Sentinel review at f54312815d6dbd48a3d04607f77b6d7593de940d:

• Parent and Coverage: refactor: share daemon command and teardown budgets #2307 now uses the request-scoped dynamic timeout import at 327c2e86439674ac680bc2c0aea1ff50712d5f05. The eager-closure regression was reproduced red at 382 modules against the 381 budget, then restored to 381; all 418 guard cases pass. Parent Coverage is green.
• Sync and validation: this neutral patch is unchanged after rebasing onto that exact parent. Its final affected gate passed 836 tests across 123 files. Independent adversarial review found no actionable issue. Final-head Coverage and Integration Tests both pass.
• Native failures: reviewed the old logs, available artifacts, unchanged runtime paths, and a parent run that reproduced the Android post-dismiss selector miss. The old iOS absence assertion had zero matches on a truncated capture, so it could not prove absence. Final-head Android and iOS smoke now pass without native source changes. Missing failure diagnostics prevent a root-cause claim.

All 18 reported checks have completed: 17 successful, one cache-build matrix skipped. No additional code finding required a neutral-layer change. Dependency #2307 remains explicit; managed readiness is still disabled, and this is not live allocator acceptance.

[thymikee]

Sentinel reconciliation at f543128: same reviewed code; all runnable checks green, but GitHub now reports CONFLICTING. The declared #2307 prerequisite has also advanced beyond the recorded 327c2e8 head. Next merge blocker: synchronize the dependent branch with the approved prerequisite and resolve conflicts, then rerun exact-head gates. Prior integration/evidence boundaries remain unchanged: this neutral lease-authority slice does not claim live allocator/publication acceptance. No new code finding and no readiness label; no branch changes made.

[thymikee]

Resolved the synchronization request in the latest Sentinel review at published head 761a7161f44040799c8bb27439e2a2503b7d3836:

• Parent and conflicts: rebased onto refactor: share daemon command and teardown budgets #2307's published 9a83035da4c0829b7181fc05ecd94a482c8bf88a; range-diff confirms the original lease-admission patch was preserved. GitHub now reports UNSTABLE, with no conflict blocker.
• Timing ownership: horizons call the canonical resolver in the already-eager core timeout policy. Managed admission reserves the existing 5,000 ms teardown plus 11,000 ms recording budget; ordinary teardown still requires an existing session. No eager-closure baseline was raised.
• Separate contract correction: provisional ensureReady becomes task-taking admit, allowing the actual operation to execute inside lease confirmation. The feat: delegate reviewed managed automation #2312 owner agreed to adapt its existing dispatch wrapper and prove that handoff order. run remains transport/cleanup-only; this PR still does not activate managed request admission.
• Validation: final-head pnpm check:affected --run passed all runnable checks, including 3,256 tests across 430 files. The prior focused run passed 462 tests, including all 418 exact-parent eager-closure cases. Removing the recording reservation produced the expected red test; restoration passed. Independent adversarial review is READY for the final delta.

Replacement-head Coverage and Integration and native checks are running. #2307's current iOS job remains failed before device smoke, as recorded in its review. The verified prerequisite SHA has been handed downstream without waiting for CI; no merge-readiness or live allocator acceptance claim is made.

[thymikee]

Latest-main synchronization is complete at published head 1df42d51f50e7dfb3162f113f74a76829c9b8272, based on #2307 97f4e7057f3c4d6dead9df39a6a7645063c877e4. The whole chain is rooted in requested main snapshot 80997b6bf1dda30ca57d74dc42036f6b447e16ad.

All three neutral-layer commits are unchanged by range-diff and had no conflicts. The canonical horizon and separate task-taking contract correction are preserved. Independent adversarial review is READY. Fresh exact-head pnpm check:affected --run passed 3,258 tests across 431 files; 462 focused checks passed, including all 418 exact-parent eager-closure cases.

Replacement-head CI, iOS, and Android are running. Prior-head green results are not current evidence. The exact published SHA has been handed to #2311/#2312 for sequential restacking without a CI wait. This remains neutral infrastructure with no production admission activation or live allocator acceptance claim.

[thymikee]

Updated the description to disclose removal of the unused ResolvedNativeAsset and NativeAssetResolver types. The deletion remains in the current diff, and a repository search at 1df42d51f50e7dfb3162f113f74a76829c9b8272 finds no remaining references. The published head is unchanged.

Current-head Coverage and Integration, Android, Linux, and macOS pass. The iOS retry fails in fixture smoke: a regular depth-1 snapshot contains healthy XCTest tree quality metadata after target-resolution-failed causes Simulator AX fallback for an unverified app generation. The first attempt instead failed a direct runner text-commit assertion. These are the observed failures; their underlying causes remain unproven.

All reported checks are complete: 16 succeed, the cache matrix is skipped, and iOS fails. The neutral layer still has no production admission activation. No merge-readiness claim.

[thymikee]

Sentinel: no actionable code findings after coordinator + independent Terra/high review at 1df42d5. Task-taking admission, renewal reconciliation, immutable identity validation, cancellation/deadline handling and late-result fencing are coherent; production activation remains deferred to the consuming layers. NOT merge-ready: exact-head iOS smoke fails in live-snapshot-depth-frontier when Simulator AX falls back and healthy XCTest tree quality metadata appears where the fixture expects none. The diff does not establish the cause, and this is not classified as a proven flake. Diagnose/rerun the exact-head iOS lane and obtain green proof. No readiness label; no fixes or merge performed.