feat(leasing): let requesters choose the lease ID

[V3RON]

Closes #410

Status

Implement: done (spec tests green) Review: round 2, 0 open Mutate: 13 alive, all equivalent Hardware: n/a Gate: merged

• A lease request with leaseId: "ad-7f3a" is granted a lease with ID ad-7f3a, on a single host and through a gateway. Checked by e2e/http-api.test.ts and the gateway fleet-coordinator tests.
• Renew and release by that ID work, on a single host and through a gateway. Checked by e2e/http-api.test.ts and a two-worker gateway test that goes red when routing breaks.
• A second request for an ID held by an active lease or a waiting request fails with LEASE_ID_TAKEN. Checked by HTTP e2e (waits for the grant first) and coordinator tests for both cases.
• Every rejected input in Examples answers BAD_REQUEST. Checked by contract and HTTP route tests; the route test goes red when the route schema is loosened.
• A LEASE_ID_TAKEN refusal emits lease.rejected with reason lease-id-taken. Checked by single-host and gateway tests.
• A request without leaseId gets an ID exactly as today. Checked by tests for lse_ and <worker>.lse_ IDs.

Surviving mutants (equivalent)

• src/daemon/dispatcher.ts:404, src/gateway/dispatcher.ts:460, src/http/app.ts:181-182, src/leasing/lease-request-book.ts:251: x === undefined ? {} : { k: x } forced to the second arm only adds k: undefined, which nothing observes.
• src/gateway/fleet-coordinator.ts:1119,1151,1160, src/gateway/lease-index.ts:238,281: log-message or reason-text string literals.
• src/http/test-fakes.ts:132, src/mcp/test-support.ts:225: fixture flag in test support.
• src/contract/errors.ts:197: the value in a set-of-keys table; only the key is read.

Assumptions

none

Review

Spec review: 1 blocking, 1 fixed, 3 notes. Code review: 7 blocking, 5 fixed, 4 notes. Claims review: 6 blocking, 6 fixed, 4 notes.
Mutate: 217 mutants, 13 alive.

Rejected:

• code: a noWait request whose worker granted a different lease ID is queued instead of answering NO_CAPACITY — the spec says it goes back to the queue as after an unreachable worker, which already queues noWait requests.
• code: replacing the isObject(grant.lease) guard in src/core/registry.ts with true leaves registry.test.ts green — that change does not compile, so hooks and CI reject it.
• claims: a noWait request is queued on a gateway after a worker grants a different lease ID — matches the existing unreachable-worker path, and the #staleView doc states it.

Written by an agent.

[V3RON]

Review notes

Not blocking, not verified. Each is one reviewer's claim.

• spec: src/gateway/lease-index.ts rebuildFromWorker logs the duplicate bare-ID warning on every snapshot from the second worker, while the invalid-ID warning is logged once (code review said the same).
• spec: src/daemon/error-code.ts:98 classifyError maps LeaseIdTakenError without details.leaseId, so a path that skips the dispatcher's conversion would answer 409 without the ID.
• spec: docs/internal/EVENTS.md:49 the pointer "(except a gateway's lease-id-taken after a grant, below)" could name :58 more clearly.
• code: src/daemon/error-code.ts:98 the LeaseIdTakenError mapping is written twice; the classifyError copy is never reached by a real request, yet it is the one error-code.test.ts and http/errors.test.ts test.
• code: docs/EVENTS.md:18,26 and docs/internal/EVENTS.md:58 disagree on whether a gateway can emit lease-id-taken after lease.requested.
• code: src/core/registry.ts:1301 parseStoredGrant passing through a stored grant whose lease is not an object has no test.
• claims: src/contract/operations.ts:160-178 the leaseRequestBaseSchema doc comment now sits above LEASE_ID_PATTERN.
• claims: docs/internal/adr/0020-a-requester-may-choose-its-lease-id.md:3 and docs/internal/adr/README.md:61 still say "Accepted — not yet implemented".
• claims: docs/internal/ARCHITECTURE.md:773 "loses bare routes until each worker has reported" implies generated routes survive a gateway restart; they do not.
• claims: docs/CLI.md:222 and docs/internal/ARCHITECTURE.md:777 do not say a gateway --no-wait request whose worker grants a different lease ID is queued again.

Written by an agent.