refactor(leasing): leasing is its own module, entered through src/leasing/index.ts

[V3RON]

Closes #363

Status

Implement: done (3 fix runs) Review: round 3, 1 open Mutate: 10 alive (equivalent) Hardware: n/a Gate: parked

Done when

• None of the moved files is left in src/core/, and src/core/lease-engine.ts is gone.
• pnpm lint passes. grep -rn "leasing/" src/core finds only the three test imports the spec itself asks for (nuke.test.ts, doctor.test.ts, reaper.test.ts), see Assumptions.
• No moved or rewired test changes an expected value or drops an assertion. Two intended exceptions: startup-converger.test.ts loses its "timers" step (it moved to lease-startup.test.ts), and one lint fixture swaps WaitQueue for LeaseRecord (the gateway may no longer take WaitQueue from core).
• pnpm check passes (CI).

Assumptions

• Assumption: the warm-pool ban on src/leasing/** (importNames) — not added. ADR 0017's module has not landed, and today AcquisitionPlanner (victim selection) and LeaseReleaseCoordinator (WarmPoolCoordinator) import the warm pool's names from core's index, so the ban would fail lint. The spec's matching fixture is conditional on the same landing.
• Assumption: grep -rn "leasing/" src/core — read as production files. The spec also has nuke.test.ts, doctor.test.ts and reaper.test.ts build real leasing through leasing/testing.js, which that grep would find.
• Assumption: a fourth port, leaseExpirer, beside the third: Doctor is built by createCore, and expires a lapsed lease through leasing.
• Assumption: a third port, queueHeadDemand — core.connect takes it beside nuke's maintenance and the availability kick. The warm pool (core) reads the queue head's spec to decide whether a device stays warm, and the queue is leasing's.
• Assumption: DaemonServer and Dispatcher take deviceModes: DeviceModeReader beside capacity: CapacityReader. servesDefaultMode is leasing's, the capacity figures are core's, and no single object implements both any more.
• Assumption: the queue's first depth is announced by leasing.announceQueueDepth(), which the daemon calls after core's converge, so the order of capacity.changed then queue.changed at start is unchanged.
• Assumption: the gateway's allow-list on leasing's index also lists QueueTimeoutError and the request book's three errors: FleetLeaseCoordinator throws or maps them.
• Assumption: LeaseProgress moves to core's domain.ts: DeviceProvisioner (core) reports it and the gateway uses it.
• Assumption: LeaseReleaseReason (all three reasons) stays in lease-release-coordinator.ts, and lease-ports.ts derives ClientReleaseReason from it, so it is defined once.

Mutation testing

pnpm mutate leaves 10 of 247 mutants alive, all equivalent:

• ...(options.logger === undefined ? {} : { logger: options.logger }) at src/core/create-core.ts:187,197,209,234 and src/leasing/create-leasing.ts:182,190. The false mutant passes { logger: undefined } instead of {}, and every callee reads options.logger?.child(...) ?? new NoopLogger(), so nothing observable differs. At :234 (Doctor) the {}, true and !== mutants also survive for the same reason: Doctor treats an absent logger as no logger.
• prerequisiteChecks ?? [] at src/core/create-core.ts:235: src/core/doctor.ts:478 applies the same default, and a junk element matches no platform, so Doctor does nothing with it.

Review

Spec review: 8 blocking, 6 fixed, 5 notes. Code review: 3 blocking, 3 fixed, 6 notes.
Mutate: 247 mutants, 10 alive.

Rejected:

• spec: startup-converger.test.ts drops the timer-restore assertions with nothing in their place — they moved to lease-startup.test.ts, which asserts every run restores timers, and lease-lifecycle.test.ts:215 proves a persisted lease's timer is restored after restart.

Open after round 3 (parked): nothing proves leasing's startup finishes before core.converge() starts — running both with Promise.all in src/daemon/main.ts:376-382 keeps main.test.ts green.

Written by an agent.

[V3RON]

Review notes

Not blocking, not verified. Each is one reviewer's claim.

• spec: src/leasing/testing.ts:122 TestEngine.dispose cancels only leasing's timers; the LeaseEngine.dispose it replaces also disposed quarantine, so a moved test leaves quarantine retry timers armed.
• code: src/leasing/lease-startup.ts:62 lease.rejected (daemon-restarted) still carries module "startup-converger" although LeaseStartup emits it; the spec froze source strings, so a later change should decide.
• code: .oxlintrc.json src/leasing/** has no importNames ban on the warm pool's names from core's index (ADR 0018 §4); waits on ADR 0017's warm-pool module.
• spec: the Lint fails on imports past a module's index into core or gateway #362 lint fixture for an allowed core name now imports LeaseRecord instead of WaitQueue; the claim is still proven.
• code: src/leasing/create-leasing.ts:226 breaking the notifyAvailability wiring is caught only by two 5 s timeouts in create-leasing.test.ts, not a named assertion.
• code: src/leasing/testing.ts:115-119 copies the startup order from src/daemon/main.ts:376-382, so the create-leasing restart tests do not follow a change to main.ts.

Written by an agent.