[alcpereira]

Summary

When a lease ends while a remote recording runs, teardown finishes the recording but drops the result. The export stays in the daemon's temp directory with no artifact id, so the client's later record stop fails (UNAUTHORIZED) and the files leak. This is the lease-end half of #2281 (ADR 0024 rule 1).

• A leased session's teardown (lease expiry, release, or close) registers a committed remote-temp export and its telemetry as downloadable artifacts of the lease's tenant: delete after download, 15-minute expiry. If registration fails, it deletes the files. A failed finish keeps its forced cleanup.
• GET /artifacts entries gain an optional sessionName (additive).
• trackDownloadableArtifact returns the existing entry for a file the same tenant already has, so a record stop replay serves the same ids.
• Local mode is unchanged.

14 files. Possible follow-up: an artifacts download <id> CLI command (HTTP clients can already GET /artifacts/<id>).

Validation

• Head 3f2fddcf8: pnpm check:affected --run --head 3f2fddcf8 passed (exactCommit: true): format, lint, typecheck, layering, fallow, build, vitest-related, daemon-wire-compat, command-docs, docs-links, docs-prose.
• New tests fail without the fix: 4 fail with the retention call disabled, and the replay test fails without the duplicate-id fix.
• Coverage failed at c1a44778c on eager-closure-budgets (teardown statically imported the retention module). 3f2fddcf8 loads it on demand; the budget test passes locally.
• CI still owes: Integration Tests, Coverage, Apple/Linux smoke at 3f2fddcf8.
• No device run; the change is daemon artifact registration, not device behaviour.

[cubic-dev-ai]

All reported issues were addressed across 14 files

<sub>Reply to a comment to ask cubic a question or push back. It learns from your replies.

View guided diff | Re-trigger cubic</sub>

[thymikee]

At c1a4477 one code fix is needed before merge, and the Coverage failure needs a look. The Coverage job (pnpm gate unit-ci) failed, but its log ends mid-run at "building macOS helper" with no failing test or threshold line, so I cannot tell whether it is a timeout or a test in this PR. Before merge, please re-run that job or share the full log, and fix the best-effort deletion in the rollback at https://github.com/callstack/agent-device/blob/c1a4477/packages/daemon/src/sessions/leased-recording-retention.ts#L44 (or drop the rollback, since trackDownloadableArtifact has no throwing path). A failed rmSync there aborts the loop and escapes into the teardown aggregate.

Not blocking, and fine to take or leave: sessionName on the wire (https://github.com/callstack/agent-device/blob/c1a4477/packages/contracts/src/cloud-artifacts.ts#L56), tenantPublicSessionName and their doc sentences are not needed, because the inventory is already tenant-filtered and the retained video keeps the client's file name; a dedupe hit at artifact-tracking.ts:102 returns the first entry unchanged, so a record stop replay near minute 14 gets an id that expires about a minute later (the rule could be one live entry per path and tenant, expiring 15 minutes after its latest hand-out, or the replay could document that it inherits the original expiry); and the unleased test at leased-recording-retention.test.ts:301 asserts that a remote-temp export stays on disk, which pins the old leak as expected, so it could assert only that nothing is registered.

On the open inline threads: the one on rmSync still stands (#3955 (comment)), and three lower-priority threads still apply (the sessionName wording in remote-proxy.md, the "inverse" comment overclaim, and the ADR 0007 retention wording). These do not apply, so please resolve them: #3955 (comment) (an unleased teardown has no tenant to register under), #3955 (comment) (the new ADR paragraph is scoped to teardown disposal), #3955 (comment) (teardown holds a live handle, so no earlier entry can exist), and #3955 (comment) (retention runs on every close of a leased session).

I read the code only and did not run the new tests or check:affected. No test drives the lease sweeper or the close command end to end, and I did not verify whether a record stop replay of a torn-down session is reachable after the lease ends.

[thymikee]

The PR is ready at 3f2fddc. The rollback concern from the earlier review (#3955 (comment)) and the Coverage failure are both fixed: the delta removes the static import of leased-recording-retention.ts that tripped the daemon eager-closure budget, and all 14 checks pass at this commit. There are no conflicts.

Not blocking: the new private removeBestEffort in packages/daemon/src/sessions/leased-recording-retention.ts:61 repeats the one in artifact-tracking.ts:357, and its rollback cannot run because trackDownloadableArtifact has no throwing path (artifact-tracking.ts:99-122), so you could drop the try/catch or export the shared helper. The caller in session-teardown.ts:208 also checks ref.session.lease before the dynamic import, and retainLeasedSessionRecording checks it again at leased-recording-retention.ts:26, so one of the two could go. Take or leave both.

The cubic-dev-ai threads no longer apply and can be resolved. Fixed at this commit: the tenant inventory assertion (#3955 (comment)), the ADR 0024 cleanup scope (#3955 (comment)), the per-rmSync try/catch (#3955 (comment)), the remote-proxy.md wording (#3955 (comment)), the session-tenant-scope.ts comment (#3955 (comment)) and the ADR 0007 wording (#3955 (comment)). Benign: teardown holds the live recording handle and the rollback is unreachable (#3955 (comment)), and retention runs on every teardown of a leased session, so "close" in the changeset is accurate (#3955 (comment)).

I read the code only and did not run the tests locally. No test drives the lease sweeper or the close command end to end.