docs(daemon): correct the claim-gate and managed-owner comments

- The claim-gate docstring claimed there is no other way to obtain device operations. That is
  true of command handlers, but two daemon-owned recovery paths bind outside the seam:
  application-lifecycle-recovery.ts (ordinary intent, daemon shutdown) and
  durable-capture-runtime-recovery.ts (exact-owner intent read back from a durable envelope,
  which this unit makes able to carry a managed local owner). Name them instead of claiming
  coverage the seam does not have.
- The open path's comment described a session executing under an allocator-held claim, a state
  this route cannot produce. Say what the `{ kind: 'ordinary' }` literal actually is: the truth
  of a route that binds ordinarily, which the Host open route replaces with the request's exact
  intent when it lands.
- Name U3 as the unit that fills the exact-owner selection arm, rather than the whole ADR.

Author: thymikee

src/daemon/device-claim-admission.ts

@@ -21,12 +21,16 @@ import {
  * happens here, under every policy: an ordinary owner takes a transient claim
  * only when the executing command's declared {@link DeviceClaimPolicy} is
  * `transient-exclusive`; a managed local owner is verified against its
- * allocator-held claim; a provider owner takes nothing. There is no other way
- * to obtain device operations, so none of it can be forgotten by a handler.
+ * allocator-held claim; a provider owner takes nothing.
  *
  * `admit` is called once per device binding by the request runtime bindings,
  * which is where per-device deduplication already lives, with the binding
- * intent the gateway bound.
+ * intent the gateway bound. A command handler has no other way to obtain
+ * device operations, so a handler cannot forget any of this. Two daemon-owned
+ * recovery paths do bind outside the seam and are the known gap:
+ * application-lifecycle-recovery.ts (ordinary intent, daemon shutdown) and
+ * durable-capture-runtime-recovery.ts (exact-owner intent read back from a
+ * durable envelope).
  */
 export type DeviceClaimAdmission = AsyncDisposable &
   Readonly<{

src/daemon/session-lifecycle/internal/session-open-execution.ts

@@ -378,8 +378,9 @@ async function acquireDeviceClaimForOwner(params: {
     case 'none':
       return { status: 'not-required' };
     case 'allocator-held': {
-      // Session open binds ordinarily and carries no fence; a session admitted under the
-      // allocator-held claim executes under it and records no claim of its own.
+      // Session open binds ordinarily, so this literal is the truth of the route and not a
+      // placeholder: the Host open route replaces it with the request's exact intent when it
+      // lands. Until then a managed owner reaches here without a fence and is always refused.
       const response = buildAllocatorHeldRefusal(
         device,
         owner,

src/platform-runtime-gateway.ts

@@ -296,7 +296,7 @@ async function selectExactOwner(
       throw ownerUnavailable(ref);
     }
     case 'managed-local':
-      // No managed owner is registered yet; the exact-only managed registry lands with ADR 0021.
+      // No managed owner is registered yet; U3 fills this arm with the exact-only registry.
       throw ownerUnavailable(ref);
     case 'provider-runtime': {
       const registration = providersByOwner.get(runtimeOwnerKey(ref));