test(gateway,daemon,http): cover §27a's admin owner gate; make HTTP reject rather than drop it (H7)

The gate itself was already correct (daemon/dispatcher.ts, gateway/
dispatcher.ts both FORBIDDEN a non-admin naming owner) but untested: no
test proved a non-admin naming owner was refused, nor that an admin's
owner is what the resulting lease ends up owned by. Added both to
daemon/dispatcher.test.ts and gateway/dispatcher.test.ts; each verified to
fail when the corresponding gate is temporarily removed (the non-admin
test fails outright / times out, since the request proceeds instead of
being refused).

Separately: src/http/app.ts's leaseRequestBodySchema had no owner field at
all and wasn't .strict(), so a non-admin caller naming owner over HTTP got
silence where every other transport answers FORBIDDEN -- the exact
anti-pattern this PR's own operations.ts comment condemns for device.exec's
requesterId (round 4, F4: read-then-silently-ignore is answering as if an
identity was never named). Threaded owner through the schema,
LeaseRequestInput, and the tracker's dispatch call instead, so the shared
dispatcher's own gate decides -- the same fix that precedent already
applied to requesterId. New test proves the field now reaches the
dispatched lease.request rather than being dropped in transit (the gate
itself is exercised at the dispatcher level, once, not per transport);
verified to fail against the pre-fix schema/tracker.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MA98m7ua7qvDFZjxFaww6Z

Author: claude

src/daemon/dispatcher.test.ts

@@ -367,6 +367,45 @@ describe("Dispatcher: ownership", () => {
     return (grant as { lease: { id: string } }).lease.id;
   }
 
+  it("lease.request: rejects a non-admin session naming owner with FORBIDDEN, never silently ignoring it (ADR §27a, H7)", async () => {
+    const { dispatcher } = await buildDispatcher();
+
+    await expect(
+      dispatcher.dispatch(
+        "lease.request",
+        { model: "iPhone 17 Pro", osVersion: "26.5", owner: "someone-else", platform: "ios" },
+        session({ principal: "tok_agent", role: "agent" }),
+      ),
+    ).rejects.toMatchObject({ code: "FORBIDDEN" });
+  });
+
+  it("lease.request: an admin session's owner is who the granted lease ends up owned by, not the admin's own principal (ADR §27a, H7)", async () => {
+    const { dispatcher } = await buildDispatcher();
+
+    const grant = await dispatcher.dispatch(
+      "lease.request",
+      { model: "iPhone 17 Pro", osVersion: "26.5", owner: "agent-7", platform: "ios" },
+      session({ principal: "tok_gateway", role: "admin" }),
+    );
+
+    expect((grant as { lease: { ownerId: string } }).lease.ownerId).toBe("agent-7");
+    // The lease is now gated on the named owner, not the admin session that requested it.
+    await expect(
+      dispatcher.dispatch(
+        "lease.renew",
+        { leaseId: (grant as { lease: { id: string } }).lease.id },
+        session({ principal: "tok_gateway", role: "agent" }),
+      ),
+    ).rejects.toMatchObject({ code: "FORBIDDEN" });
+    await expect(
+      dispatcher.dispatch(
+        "lease.renew",
+        { leaseId: (grant as { lease: { id: string } }).lease.id },
+        session({ principal: "agent-7", role: "agent" }),
+      ),
+    ).resolves.toMatchObject({ id: (grant as { lease: { id: string } }).lease.id });
+  });
+
   it("lease.renew: rejects a non-owner with FORBIDDEN, admits the owner, admin bypasses", async () => {
     const { dispatcher } = await buildDispatcher();
     const leaseId = await grantLease(dispatcher);

src/gateway/dispatcher.test.ts

@@ -492,6 +492,49 @@ describe("GatewayDispatcher", () => {
         ),
       ).rejects.toMatchObject({ code: "FORBIDDEN" });
     });
+
+    it("lease.request: rejects a non-admin session naming owner with FORBIDDEN, never silently ignoring it (ADR §27a, H7)", async () => {
+      const { dispatcher, workers } = harness();
+      workers.connected("wrk_1", undefined, "0.3.0");
+      workers.refresh("wrk_1", {
+        capacity: statusFixture().capacity,
+        catalog: catalogFixture([{ models: ["iPhone 17"], platform: "ios", runtimes: ["26.0"] }])
+          .platforms,
+        downloads: { policy: "on-request" },
+      });
+
+      await expect(
+        dispatcher.dispatch(
+          "lease.request",
+          { model: "iPhone 17", owner: "someone-else", platform: "ios" },
+          session({ principal: "agent-1", role: "agent" }),
+        ),
+      ).rejects.toMatchObject({ code: "FORBIDDEN" });
+    });
+
+    it("lease.request: an admin session's owner is who the granted lease ends up owned by (ADR §27a, H7)", async () => {
+      const { directory, dispatcher, leaseIndex, workers } = harness();
+      const client = new ScriptedWorkerClient();
+      directory.add("wrk_1", client);
+      workers.connected("wrk_1", undefined, "0.3.0");
+      workers.refresh("wrk_1", {
+        capacity: statusFixture().capacity,
+        catalog: catalogFixture([{ models: ["iPhone 17"], platform: "ios", runtimes: ["26.0"] }])
+          .platforms,
+        downloads: { policy: "on-request" },
+      });
+      client.requestLeaseQueue.push({ grant: grantFixture(), kind: "grant" });
+
+      const grant = await dispatcher.dispatch(
+        "lease.request",
+        { model: "iPhone 17", noWait: true, owner: "agent-7", platform: "ios" },
+        session({ principal: "gw:instance-1", role: "admin" }),
+      );
+
+      const gatewayLeaseId = (grant as { lease: { id: string } }).lease.id;
+      expect((grant as { lease: { ownerId: string } }).lease.ownerId).toBe("agent-7");
+      expect(leaseIndex.ownerId(gatewayLeaseId)).toBe("agent-7");
+    });
   });
 
   it("has an answer for every operation the contract declares", async () => {

src/http/app.test.ts

@@ -277,6 +277,21 @@ describe("POST /v1/lease-requests", () => {
     expect(dispatcher.calls).toHaveLength(0);
   });
 
+  it("forwards a body's owner field to the dispatched lease.request rather than silently dropping it (ADR §27a, H7)", async () => {
+    // Before this, `leaseRequestBodySchema` had no `owner` field at all, so a caller naming one
+    // was answered as though it had named none -- the same anti-pattern this codebase's own
+    // `device.exec`'s `requesterId` precedent already rejected: an identity named and answered
+    // as if it had not is the kind of silence that reads like authorization. The gate itself
+    // (FORBIDDEN for a non-admin token) lives in the shared dispatcher, exercised once for every
+    // transport in `daemon/dispatcher.test.ts`/`gateway/dispatcher.test.ts` -- this only proves
+    // the field actually reaches that dispatcher from HTTP instead of being dropped in transit.
+    const { app, dispatcher } = buildHarness();
+    void postLeaseRequest(app, { ...defaultBody, owner: "someone-else" });
+    const call = await waitForDispatch(dispatcher, "lease.request");
+
+    expect((call.input as { owner?: string }).owner).toBe("someone-else");
+  });
+
   it("maps a fast RequesterAlreadyLeasedError to 409, naming the existing lease", async () => {
     const { app, dispatcher } = buildHarness();
     const responsePromise = postLeaseRequest(app, defaultBody);

src/http/app.ts

@@ -66,6 +66,10 @@ const leaseRequestBodySchema = z.object({
   device: z.string().min(1),
   full: z.boolean().optional(),
   noWait: z.boolean().optional(),
+  // ADR §27a (H7, round 2 review): declared and forwarded, not silently dropped -- the shared
+  // dispatcher's own `lease.request` handler is the one place that decides whether this token
+  // may set it (`FORBIDDEN` for non-admin), the same gate every other transport is held to.
+  owner: z.string().min(1).optional(),
   os: z.string().min(1).optional(),
   platform: z.enum(["ios", "android"]),
   timeoutMs: z.number().int().positive().optional(),
@@ -111,6 +115,7 @@ function toLeaseRequestInput(body: z.infer<typeof leaseRequestBodySchema>): Leas
     ...(body.noWait === undefined ? {} : { noWait: body.noWait }),
     ...(body.allowDownload === undefined ? {} : { allowDownload: body.allowDownload }),
     ...(body.full === undefined ? {} : { full: body.full }),
+    ...(body.owner === undefined ? {} : { owner: body.owner }),
   };
 }
 

src/http/tracker.ts

@@ -14,6 +14,14 @@ export interface LeaseRequestInput {
   readonly noWait?: boolean;
   readonly allowDownload?: boolean;
   readonly full?: boolean;
+  /** ADR §27a. Threaded straight through to the shared dispatcher's own `lease.request` input --
+   * the same gate every other transport is held to (`FORBIDDEN` for a non-admin token) decides
+   * this, not this route (H7, round 2 review: before this, `leaseRequestBodySchema` had no
+   * `owner` field at all and quietly discarded one a caller sent, the anti-pattern this
+   * codebase's own `device.exec`'s `requesterId` precedent already rejected for the same reason
+   * -- an identity named and answered as though it had not been is the kind of silence that
+   * reads like authorization). */
+  readonly owner?: string;
 }
 
 /** Matches the issue's lease object exactly; `dataPlane` is reserved and always `null` in v1. */
@@ -215,6 +223,9 @@ export class LeaseRequestTracker {
             // old grant-then-immediately-renew hack. Under ADR 0004 the daemon then stores
             // that width on the lease, so nothing here has to remember it either.
             ...(body.ttlMs === undefined ? {} : { ttlMs: body.ttlMs }),
+            // ADR §27a (H7, round 2 review): forwarded as-is -- the shared dispatcher's own
+            // `lease.request` handler is what rejects a non-admin token naming this.
+            ...(body.owner === undefined ? {} : { owner: body.owner }),
           },
           session,
         )