docs(daemon): state the lease invariant without borrowing #2509's cause

Four comments told the report's story as though it were this mechanism. A cloud
WebDriver connection profile asks for a ten-minute lease, so the reported one-minute
hang cannot have expired anything. The invariant stands on its own; where it came from
and which leases it reaches belong in ADR 0007 and the commit, not in each test.

Author: thymikee

src/daemon/__tests__/lease-registry.test.ts

@@ -565,9 +565,9 @@ test('canceling a superseded activation cannot remove its successor or another h
   assert.equal(registry.listHumanControlHolds(authority)[0]?.reason, 'successor');
 });
 
-// #2509: nothing heartbeats a lease while its request works, so an admitted
-// capture that legitimately outruns the lease TTL expired its own lease and lost
-// the device it was still holding. In-flight work defers expiry and renews on
+// Nothing heartbeats a lease while its request works, so an admitted capture
+// that legitimately outruns the lease TTL expires its own lease and loses the
+// device it was still holding. In-flight work defers expiry and renews on
 // completion, exactly as a human-control hold does.
 test('in-flight request work defers expiry and renews the lease when it finishes', async () => {
   let now = 0;

src/daemon/__tests__/request-execution-scope.test.ts

@@ -509,10 +509,11 @@ test('expired leases remove owned sessions before the next command and free capa
   expect(nextLease.tenantId).toBe('tenant-b');
 });
 
-// #2509: the slowest command in a cloud session killed every command after it.
-// Nothing heartbeats a lease while its request works, so one capture that ran
-// past the lease TTL expired its own lease, which tore the provider session down
-// under the client that was still waiting for it.
+// A lease renewed only at admission lets one command slower than its inactivity TTL
+// expire the lease paying for the device it is using, and expiry then tears the
+// provider session down under the client still waiting for that same command. Found
+// while investigating #2509, whose cloud session ran on a ten-minute lease and so
+// lost its session some other way.
 test('an admitted request that outlives the lease TTL keeps its lease and session', async () => {
   let now = 1_000;
   const sessionStore = makeSessionStore('agent-device-request-scope-');

src/daemon/__tests__/request-lease-work.test.ts

@@ -23,8 +23,8 @@ function admittedRequest(
   };
 }
 
-// #2509: a capture that ran past the lease TTL expired the lease that was paying
-// for the device, so the session died underneath the client still waiting for it.
+// A capture that runs past the lease TTL used to expire the lease paying for the
+// device, so the session died underneath the client still waiting for it.
 test('admitted work that outlives the lease TTL keeps the lease it is working on', async () => {
   let now = 0;
   const leaseRegistry = new LeaseRegistry({ now: () => now, defaultLeaseTtlMs: 5_000 });

src/daemon/request-lease-work.ts

@@ -9,7 +9,7 @@ import type { DaemonRequest } from './daemon-request.ts';
  * A lease renews when a request is admitted and never again while that request
  * works, so the slowest command in a session used to expire the very lease that
  * was paying for the device and tear the session down underneath the client still
- * waiting for its result (#2509). The pass defers expiry only while the work is
+ * waiting for its result. The pass defers expiry only while the work is
  * still wanted, which the request-cancel registry already knows: once the client
  * hangs up the request protects nothing, so a handler that ignores its
  * cancellation cannot hold a rented device open.