fix(leasing): free the waiter's running slot when a failed boot's device is claimed before the destroy

[V3RON]

Requested by Szymon · project thread

Closes #401

Status

Implement: done (green) Review: round 1, 0 open Mutate: 0 alive Hardware: n/a Gate: not run (the gate script needs GraphQL, which this session cannot call)

Done when

• A waiter's running-slot reservation is released whenever destroy does not throw, including when it returns undefined because another boot claimed the device first. Checked by the triage repro test, which fails with expected { global: 1, ios: 1 } to deeply equal { global: +0, ios: +0 } on the old code.
• A destroy that throws still keeps the slot and fences the device. Checked by a new test; it fails if that path is changed.

The existing test for a device deleted mid-boot asserted the old fence. It now asserts the slot is freed and no fence, as the triage fix decided.

Assumptions

none

Review

Spec review: 0 blocking, 0 fixed, 1 notes. Code review: 0 blocking, 0 fixed, 0 notes. Claims review: 0 blocking, 0 fixed, 1 notes.
Mutate: 2 mutants, 0 alive.

Written by an agent.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CA6eBy6noXJbLUzgedJtga

[V3RON]

Review notes

Not blocking, not verified. Each is one reviewer's claim.

• spec: src/leasing/lease-acquisition-coordinator.test.ts:1518 the setup that makes destroy unable to claim the device (the makeReady spy that moves the record to deleted) is outside the diff's hunks, so the diff alone does not show the renamed test reaches the undefined return; the repro test proves the same path.
• claims: src/leasing/lease-acquisition-coordinator.ts:891-892 the comment lists why destroy returns undefined as if complete; it also returns undefined when another operation (cleanup, reclaim, nuke) holds the claim, the record is in another state, its driverDeviceId changed, or the commit recheck fails (src/core/managed-device-lifecycle.ts:296, :318-319, :350-355).

Written by an agent.

---

Generated by Claude Code