fix(daemon): dispose late durable capture authorities

[jstar0]

Summary

• Dispose a late successful durable-capture authority when the deadline or request cancellation wins the recovery race.
• Dispose an active reattached handle before its control, while disposing the control alone for non-active outcomes.
• Preserve the primary timeout or cancellation error and route cleanup failures through the existing callback.

Closes #2099

Validation

• Focused authority suite: 6 tests passed, including acquisition-winner ownership, active late reattach, non-active late reattach, primary-error preservation, cancellation, and already-canceled recovery.
• pnpm check:affected --run: formatting, lint, typecheck, layering, Fallow, build, and related Vitest checks passed; 936 tests passed across 172 files.
• Reverting the production change makes the three late-success/failure tests fail, while the two pre-existing cancellation tests continue to pass.
• Device and replay lanes remain GitHub-authoritative per repository policy.

[Copilot]

Pull request overview

Fixes a durable-capture recovery resource leak in the daemon by ensuring late-arriving successful recovery authorities are disposed when the deadline/cancellation wins the Promise.race, while preserving the primary timeout/cancellation error and reporting cleanup failures via the existing callback seam.

Changes:

• Track which promise won the recovery race (acquisition vs deadline vs cancellation) and trigger late-success disposal only when the caller already timed out/canceled.
• Dispose late authorities with correct handle/control ordering (dispose active handle before control; dispose control only for non-active outcomes).
• Add/extend Vitest coverage for late-success disposal behavior and primary-error preservation when late cleanup fails.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/daemon/durable-capture-recovery-authority.ts	Adds race-winner tracking and a late-success disposal path for dropped recovery authorities.
src/daemon/tests/durable-capture-recovery-authority.test.ts	Adds tests covering late-success disposal (active + non-active) and ensuring cancellation remains the primary error when late cleanup fails.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/daemon/durable-capture-recovery-authority.ts:120

• The late-cleanup path uses void acquisition.then(...) without handling rejections from the cleanup callback. If disposeLateRecoveryAuthority rejects (e.g., if onLateCleanupFailure throws), this can surface as an unhandled rejection even though it's best-effort cleanup after the primary deadline/cancellation error.

      void acquisition.then(
        (authority) => disposeLateRecoveryAuthority(params, authority, primaryError),
        () => {},
      );

[thymikee]

Code-clean at 948f4e4023: lost-race cleanup attaches only after deadline/cancellation wins, preserves the winning acquisition, disposes an active handle before control, and reports cleanup failure without replacing the primary error. The planted active/non-active/cancellation regressions are meaningful. Not merge-ready yet: exact-head CI was not reported during review, and fixture proof does not replace a practical recovery timeout/cancellation run showing that a late live capture handle actually stops.

[thymikee]

The new acquisition-winner regression is useful and confirms caller ownership, but exact head 49c5aa8889 is not ready. The detached late-cleanup continuation has no terminal rejection handler: if onLateCleanupFailure itself throws, best-effort cleanup becomes an unhandled rejection after the primary timeout/cancellation. Contain that reporting path and add a throwing-reporter regression. Exact-head CI is still absent, and practical evidence that a late live capture handle actually stops is still owed.

[jstar0]

Closing as superseded by #2107, which has merged to main.