Dirty same-claimant rebind cannot continue its owning open PR because no sanctioned path mints continuation evidence (#864 AC5 unmet) #947

New Issue

2026-07-27T02:38:19-05:00

jcwalker3 commented

2026-07-27 02:38:19 -05:00

Summary

gitea_rebind_dirty_same_claimant_author_session (#864) succeeds on a dirty registered worktree whose owning PR is already open, and then the very next ordinary author commit preflight refuses the commit with duplicate_commit_prevented.

The rebind is the only sanctioned capability that operates on a dirty worktree, and it is the only one that does not write owning-PR continuation evidence in a form any enforcement path reads. The two capabilities that do write that evidence — exact-owner lock renewal and dead-session recovery — both require a clean worktree, which a rebind subject by definition does not have.

The result is a closed set with no exit: the state that makes a rebind necessary is exactly the state in which no sanctioned path can mint the evidence the next preflight demands. #864 AC5 is therefore unmet at the system level even though the rebind operation itself behaves to spec.

Supported owning-PR continuation workflow

Continuing an already-open owning PR through the sanctioned author path requires the duplicate-work gate to receive an owning-PR exemption token. There are exactly two writers of the durable evidence that token is rebuilt from:

Exact-owner lock renewal — gitea_lock_issue on a lock the caller already owns. issue_lock_renewal refuses unless the registered worktree exists, is on the branch, and is clean (issue_lock_renewal.py:311-322, "AC4"). On success gitea_mcp_server.py:4344 persists data["lease_renewal"].
Dead-session recovery — issue_lock_recovery refuses unless the worktree is clean (issue_lock_recovery.py:467-473: "worktree has tracked local edits; recovery requires a clean worktree"). On success gitea_mcp_server.py:4336 persists data["dead_session_recovery"].

Every later author mutation re-derives the exemption from the durable lock, because the live assessment ended when the lock call returned. On master at aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218 that rebuild is issue_lock_recovery.recovered_owning_pr_from_lock, wired at three sites:

Site	Path
`gitea_mcp_server.py:2859`	`_enforce_locked_issue_duplicate_recheck` -> `gitea_commit_files`, `gitea_create_pr`
`gitea_mcp_server.py:5143`	`gitea_assess_work_issue_duplicate` (read-only assessor)
`gitea_mcp_server.py:19427`	push / PR-update ownership prover

That rebuild reads exactly one key (issue_lock_recovery.py:848):

record = lock_record.get("dead_session_recovery")
if not isinstance(record, Mapping) or not record.get("recovered"):
    return None

Chronological reproduction

An author holds a durable lock on an issue with an open owning PR; the registered worktree under the branches root carries legitimate uncommitted repair bytes.
The owning session ends without clean release. The recorded owner PID is dead. The lock still names the same claimant identity and profile.
Ordinary author relocking correctly refuses the dirty worktree.
Dead-session recovery correctly refuses: it requires a clean worktree.
Exact-owner lock renewal correctly refuses: its AC4 requires a clean worktree.
The author invokes the sanctioned gitea_rebind_dirty_same_claimant_author_session. It succeeds: every dirty byte and fingerprint is preserved, the stale session pointer is atomically replaced, heads are unmoved, and structured read-after-write evidence is returned.
The author performs the next ordinary step of the supported workflow — normal author commit preflight against the same issue, branch, worktree, and owning PR.
The commit is refused.

First divergence

Step 6 succeeds and step 7 fails. That is the defect boundary: a successful sanctioned rebind immediately followed by a failed normal author commit preflight, with no intervening state change, no head movement, and no foreign actor.

The refusal shape is:

outcome: duplicate_commit_prevented
owning_pr_recovery_exempted: false
owning_pr_recovery_notes: []

owning_pr_recovery_notes: [] is the diagnostic signature — the gate did not evaluate and reject continuation evidence, it never found any evidence to evaluate.

Violated #864 AC5 contract

Closed issue #864, acceptance criterion 5, verbatim:

Normal author commit preflight succeeds after rebind; ordinary dirty-worktree locking remains fail-closed.

The second clause holds. The first clause does not hold whenever the rebound issue has an owning open PR. #864 was accepted on the strength of the rebind operation's own read-after-write evidence; the AC5 clause about the next preflight was never exercised against an owning open PR, so the gap shipped.

Authoritative evidence

Observed on the live control plane at master aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218:

Dimension	Value
Repository	`Scaled-Tech-Consulting/Gitea-Tools` on remote `prgs`
Issue	#943
Owning open PR	#944
PR head	`f49e781102b9f363834c28c055f69639d16290c9`
Base	`master` at `aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218`
Branch	`fix/issue-943-runtime-context-helpers`
Registered worktree	`branches/issue-943-runtime-context-helpers`
Claimant identity	`jcwalker3`
Claimant profile	`prgs-author`
Lock state	durable, exact-owner, recorded owner PID dead
Worktree state	dirty, three uncommitted files, fingerprints pinned
Head relation	local head, remote head, recorded head, and PR head all equal
Rebind outcome	success, dirty bytes preserved, session pointer replaced
Next commit preflight	`duplicate_commit_prevented`, `owning_pr_recovery_exempted: false`

Every ownership, branch, head, identity, profile, repository, and session binding matched. The refusal was not caused by any mismatch.

Clean-worktree-only continuation-evidence writers

Both writers gate on cleanliness before producing evidence, using the shared reviewer_worktree.parse_dirty_tracked_files helper:

issue_lock_renewal.py:311-322 — renewal AC4, refuses on any dirty tracked file.
issue_lock_recovery.py:444-479 — recovery, refuses on any dirty tracked file, and its module docstring at issue_lock_recovery.py:28 states outright that "recovery needs a clean worktree".

Neither restriction is wrong. Both exist so that evidence cannot be minted over unknown local bytes. The consequence, however, is that the dirty case has no writer at all.

The unconsumed `rebind_record` boundary

The rebind does persist a durable artifact. dirty_same_claimant_session_rebind.py:1392 writes:

new_lock["rebind_record"] = { ... }

and dirty_same_claimant_session_rebind.py:1508 echoes it back in the returned evidence.

A repository-wide search for rebind_record outside the branches root returns exactly three hits: the writer, the echo, and one assertion in tests/test_dirty_same_claimant_session_rebind.py:261. No enforcement path consumes it. It is written, returned to the caller, and then read by nothing.

So the missing element is not a decision — the rebind already established, verified, and durably recorded that this claimant owns this issue, branch, worktree, and heads. The missing element is the bridge: rebind_record is not in a shape, or in a key, that the shared duplicate-gate rebuild will read.

Implementation and test locations

Implementation:

dirty_same_claimant_session_rebind.py — rebind assessment and apply; :1392 writer, :1508 echo.
gitea_mcp_server.py:4876 — gitea_rebind_dirty_same_claimant_author_session tool entry.
gitea_mcp_server.py:2821 — _enforce_locked_issue_duplicate_recheck, called from :5344 and :9860.
gitea_mcp_server.py:2859, :5143, :19427 — the three exemption-rebuild call sites.
issue_lock_recovery.py:829-848 — recovered_owning_pr_from_lock, the recovery-only rebuild.
issue_lock_renewal.py:311-322, :383 — renewal cleanliness gate and grant-time evidence builder.
issue_work_duplicate_gate.py:16, :296 — duplicate_commit_prevented outcome and the live-PR-state exemption policy.
task_capability_map.py:53, issue_lock_provenance.py:20 — #864 capability and provenance registration.

Tests:

tests/test_dirty_same_claimant_session_rebind.py — the only #864 rebind suite. A search across tests/ shows no rebind test references duplicate_commit_prevented, _enforce_locked_issue_duplicate_recheck, or commit_files. Post-rebind commit preflight with an owning open PR is uncovered.
tests/test_issue_755_owning_pr_recovery.py, tests/test_issue_772_unpublished_claim_recovery.py — owning-PR evidence coverage, clean-worktree paths only.

Correctly fail-closed duplicate protection compared with the missing evidence bridge

The duplicate gate is not malfunctioning and must not be loosened. Given no continuation evidence, refusing the commit is the correct, safe answer — an open PR alone must never grant an exemption, and issue_work_duplicate_gate._assess_owning_pr_exemption must remain the sole authority on what makes a token acceptable.

The defect is one layer earlier. A sanctioned capability verified ownership to a higher standard than either clean-worktree writer applies — including dirty-path fingerprint pinning and dead-PID proof — and then failed to express that verification in the one form the next gate can read. The fix is to mint narrowly scoped evidence at rebind time, not to teach the gate to accept less.

Model-agnostic impact

The defect is entirely server-side, in the durable lock record and the shared enforcement rebuild. It does not depend on prompt wording, client identity, model family, or session transcript. Any conforming client — any LLM, any IDE, any scripted caller — that performs a sanctioned dirty same-claimant rebind on an issue with an owning open PR and then attempts the next ordinary author commit will be refused identically. No prompt-level instruction can produce evidence the server never wrote.

Operational consequence: a dirty worktree holding completed, reviewed repair work becomes undeliverable through the sanctioned path. Committing is refused by the duplicate gate, while other author mutations are refused by dirty-workspace binding enforcement. Clearing the dirty state to escape would destroy, relocate, or bypass the very work the rebind existed to preserve.

Scope

Mint narrowly scoped, durable owning-PR continuation evidence at the point a dirty same-claimant rebind succeeds against an issue with an owning open PR.
Make that evidence consumable by the shared duplicate-gate rebuild used by ordinary author commit, push, and PR-update preflight, through the same authoritative resolver those paths already share.
Add end-to-end regression coverage for post-rebind commit preflight, plus negative coverage.

Non-goals

Do not weaken, bypass, or special-case the duplicate-work gate.
Do not grant an exemption because an open PR exists.
Do not add an automatic dirty-worktree exception to gitea_lock_issue or bind_session_lock.
Do not alter the clean-worktree requirements of lock renewal or dead-session recovery.
Do not change what issue_work_duplicate_gate._assess_owning_pr_exemption accepts as a valid token.
Do not re-open, re-scope, or re-implement #864.
Do not modify issue #943, PR #944, issue #945, PR #946, their branches, worktrees, locks, or preserved bytes.

Safety invariants

The exemption stays bound to the exact repository, issue, open PR, source branch, registered worktree, claimant identity, claimant profile, owning workflow session, and applicable recorded, accepted, local, remote, and live PR heads.
Missing, malformed, stale, ambiguous, expired, released, replaced, foreign, or non-owning evidence fails closed.
A rebind never authorizes creation of a second PR, a commit on an unrelated branch, or work on a different issue.
Structured refusals preserve reason codes, retryability, transport survival, and audit evidence.
Operator-granted mutation boundaries, role gating, parity gating, anti-stomp, and scope enforcement stay in force.
Dirty bytes remain preserved byte-for-byte; the fix adds evidence, it never touches working-tree content.

Acceptance criteria

A successful dirty same-claimant rebind involving an owning open PR establishes narrowly scoped, durable continuation evidence that ordinary author preflight can consume.
The next preflight succeeds only when repository, claimant, issue, PR, branch, worktree, and applicable head evidence all match.
Foreign, stale, ambiguous, unrelated, and mismatched work remains fail-closed.
Existing clean-worktree lock, renewal, and dead-session recovery behavior is unchanged.
Every blocked result reports the failed gate, the authoritative conflicting or missing evidence, whether the condition is recoverable, and the exact sanctioned next capability.
End-to-end regression coverage reproduces the post-rebind commit preflight failure on the pre-fix tree and verifies the corrected consumption path on the fixed tree.
Negative tests cover claimant, issue, PR, branch, worktree, and head mismatches.
Operator-granted mutation boundaries remain enforced.
Prohibited: prompt-only fixes, client-specific exceptions, special cases for #945 or PR #946, broad bypasses, raw Git or API fallbacks, and any weakening of duplicate protection.

Prior work consulted

#864 — the closed issue whose AC5 this defect leaves unmet.
#943 / PR #944 — the live instance of the trapped state; preserve exactly as-is.
#945 / PR #946 — propagation of exact-owner renewal evidence that already exists. That work does not mint evidence where none can be minted, so it does not cover the dirty case; both defects can hold at once.
#860 / PR #861 — the dirty-orphan recovery class #864 was separated from.
#753 / #755 / #768 / #772 — the dead-session recovery family, all clean-worktree paths.
#510 — dirty namespace and workspace mutation binding.

Canonical next step

STATE: ready-for-author
WHO_IS_NEXT: author
NEXT_ACTION: Allocate a clean registered worktree from live master, mint narrowly scoped owning-PR continuation evidence at successful dirty same-claimant rebind, wire it into the shared duplicate-gate resolver, add end-to-end and negative regression coverage, publish one PR, hand off to gitea-reviewer

## Summary `gitea_rebind_dirty_same_claimant_author_session` (#864) succeeds on a dirty registered worktree whose owning PR is already open, and then the very next ordinary author commit preflight refuses the commit with `duplicate_commit_prevented`. The rebind is the only sanctioned capability that operates on a dirty worktree, and it is the only one that does **not** write owning-PR continuation evidence in a form any enforcement path reads. The two capabilities that do write that evidence — exact-owner lock renewal and dead-session recovery — both require a **clean** worktree, which a rebind subject by definition does not have. The result is a closed set with no exit: the state that makes a rebind necessary is exactly the state in which no sanctioned path can mint the evidence the next preflight demands. #864 AC5 is therefore unmet at the system level even though the rebind operation itself behaves to spec. ## Supported owning-PR continuation workflow Continuing an already-open owning PR through the sanctioned author path requires the duplicate-work gate to receive an owning-PR exemption token. There are exactly two writers of the durable evidence that token is rebuilt from: 1. **Exact-owner lock renewal** — `gitea_lock_issue` on a lock the caller already owns. `issue_lock_renewal` refuses unless the registered worktree exists, is on the branch, and is clean (`issue_lock_renewal.py:311-322`, "AC4"). On success `gitea_mcp_server.py:4344` persists `data["lease_renewal"]`. 2. **Dead-session recovery** — `issue_lock_recovery` refuses unless the worktree is clean (`issue_lock_recovery.py:467-473`: "worktree has tracked local edits; recovery requires a clean worktree"). On success `gitea_mcp_server.py:4336` persists `data["dead_session_recovery"]`. Every later author mutation re-derives the exemption from the durable lock, because the live assessment ended when the lock call returned. On `master` at `aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218` that rebuild is `issue_lock_recovery.recovered_owning_pr_from_lock`, wired at three sites: | Site | Path | | --- | --- | | `gitea_mcp_server.py:2859` | `_enforce_locked_issue_duplicate_recheck` -> `gitea_commit_files`, `gitea_create_pr` | | `gitea_mcp_server.py:5143` | `gitea_assess_work_issue_duplicate` (read-only assessor) | | `gitea_mcp_server.py:19427` | push / PR-update ownership prover | That rebuild reads exactly one key (`issue_lock_recovery.py:848`): ```python record = lock_record.get("dead_session_recovery") if not isinstance(record, Mapping) or not record.get("recovered"): return None ``` ## Chronological reproduction 1. An author holds a durable lock on an issue with an open owning PR; the registered worktree under the branches root carries legitimate uncommitted repair bytes. 2. The owning session ends without clean release. The recorded owner PID is dead. The lock still names the same claimant identity and profile. 3. Ordinary author relocking correctly refuses the dirty worktree. 4. Dead-session recovery correctly refuses: it requires a clean worktree. 5. Exact-owner lock renewal correctly refuses: its AC4 requires a clean worktree. 6. The author invokes the sanctioned `gitea_rebind_dirty_same_claimant_author_session`. It **succeeds**: every dirty byte and fingerprint is preserved, the stale session pointer is atomically replaced, heads are unmoved, and structured read-after-write evidence is returned. 7. The author performs the next ordinary step of the supported workflow — normal author commit preflight against the same issue, branch, worktree, and owning PR. 8. The commit is refused. ## First divergence Step 6 succeeds and step 7 fails. That is the defect boundary: a **successful sanctioned rebind immediately followed by a failed normal author commit preflight**, with no intervening state change, no head movement, and no foreign actor. The refusal shape is: ```text outcome: duplicate_commit_prevented owning_pr_recovery_exempted: false owning_pr_recovery_notes: [] ``` `owning_pr_recovery_notes: []` is the diagnostic signature — the gate did not evaluate and reject continuation evidence, it never found any evidence to evaluate. ## Violated #864 AC5 contract Closed issue #864, acceptance criterion 5, verbatim: > Normal author commit preflight succeeds after rebind; ordinary dirty-worktree locking remains fail-closed. The second clause holds. The first clause does not hold whenever the rebound issue has an owning open PR. #864 was accepted on the strength of the rebind operation's own read-after-write evidence; the AC5 clause about the *next* preflight was never exercised against an owning open PR, so the gap shipped. ## Authoritative evidence Observed on the live control plane at `master` `aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218`: | Dimension | Value | | --- | --- | | Repository | `Scaled-Tech-Consulting/Gitea-Tools` on remote `prgs` | | Issue | #943 | | Owning open PR | #944 | | PR head | `f49e781102b9f363834c28c055f69639d16290c9` | | Base | `master` at `aab54d4825270f5a5c6f9c1abc1ab09eb4f3e218` | | Branch | `fix/issue-943-runtime-context-helpers` | | Registered worktree | `branches/issue-943-runtime-context-helpers` | | Claimant identity | `jcwalker3` | | Claimant profile | `prgs-author` | | Lock state | durable, exact-owner, recorded owner PID dead | | Worktree state | dirty, three uncommitted files, fingerprints pinned | | Head relation | local head, remote head, recorded head, and PR head all equal | | Rebind outcome | success, dirty bytes preserved, session pointer replaced | | Next commit preflight | `duplicate_commit_prevented`, `owning_pr_recovery_exempted: false` | Every ownership, branch, head, identity, profile, repository, and session binding matched. The refusal was not caused by any mismatch. ## Clean-worktree-only continuation-evidence writers Both writers gate on cleanliness before producing evidence, using the shared `reviewer_worktree.parse_dirty_tracked_files` helper: * `issue_lock_renewal.py:311-322` — renewal AC4, refuses on any dirty tracked file. * `issue_lock_recovery.py:444-479` — recovery, refuses on any dirty tracked file, and its module docstring at `issue_lock_recovery.py:28` states outright that "recovery needs a clean worktree". Neither restriction is wrong. Both exist so that evidence cannot be minted over unknown local bytes. The consequence, however, is that the dirty case has no writer at all. ## The unconsumed `rebind_record` boundary The rebind does persist a durable artifact. `dirty_same_claimant_session_rebind.py:1392` writes: ```python new_lock["rebind_record"] = { ... } ``` and `dirty_same_claimant_session_rebind.py:1508` echoes it back in the returned evidence. A repository-wide search for `rebind_record` outside the branches root returns exactly three hits: the writer, the echo, and one assertion in `tests/test_dirty_same_claimant_session_rebind.py:261`. **No enforcement path consumes it.** It is written, returned to the caller, and then read by nothing. So the missing element is not a decision — the rebind already established, verified, and durably recorded that this claimant owns this issue, branch, worktree, and heads. The missing element is the bridge: `rebind_record` is not in a shape, or in a key, that the shared duplicate-gate rebuild will read. ## Implementation and test locations Implementation: * `dirty_same_claimant_session_rebind.py` — rebind assessment and apply; `:1392` writer, `:1508` echo. * `gitea_mcp_server.py:4876` — `gitea_rebind_dirty_same_claimant_author_session` tool entry. * `gitea_mcp_server.py:2821` — `_enforce_locked_issue_duplicate_recheck`, called from `:5344` and `:9860`. * `gitea_mcp_server.py:2859`, `:5143`, `:19427` — the three exemption-rebuild call sites. * `issue_lock_recovery.py:829-848` — `recovered_owning_pr_from_lock`, the recovery-only rebuild. * `issue_lock_renewal.py:311-322`, `:383` — renewal cleanliness gate and grant-time evidence builder. * `issue_work_duplicate_gate.py:16`, `:296` — `duplicate_commit_prevented` outcome and the live-PR-state exemption policy. * `task_capability_map.py:53`, `issue_lock_provenance.py:20` — #864 capability and provenance registration. Tests: * `tests/test_dirty_same_claimant_session_rebind.py` — the only #864 rebind suite. A search across `tests/` shows **no** rebind test references `duplicate_commit_prevented`, `_enforce_locked_issue_duplicate_recheck`, or `commit_files`. Post-rebind commit preflight with an owning open PR is uncovered. * `tests/test_issue_755_owning_pr_recovery.py`, `tests/test_issue_772_unpublished_claim_recovery.py` — owning-PR evidence coverage, clean-worktree paths only. ## Correctly fail-closed duplicate protection compared with the missing evidence bridge The duplicate gate is **not** malfunctioning and must not be loosened. Given no continuation evidence, refusing the commit is the correct, safe answer — an open PR alone must never grant an exemption, and `issue_work_duplicate_gate._assess_owning_pr_exemption` must remain the sole authority on what makes a token acceptable. The defect is one layer earlier. A sanctioned capability verified ownership to a higher standard than either clean-worktree writer applies — including dirty-path fingerprint pinning and dead-PID proof — and then failed to express that verification in the one form the next gate can read. The fix is to mint narrowly scoped evidence at rebind time, not to teach the gate to accept less. ## Model-agnostic impact The defect is entirely server-side, in the durable lock record and the shared enforcement rebuild. It does not depend on prompt wording, client identity, model family, or session transcript. Any conforming client — any LLM, any IDE, any scripted caller — that performs a sanctioned dirty same-claimant rebind on an issue with an owning open PR and then attempts the next ordinary author commit will be refused identically. No prompt-level instruction can produce evidence the server never wrote. Operational consequence: a dirty worktree holding completed, reviewed repair work becomes undeliverable through the sanctioned path. Committing is refused by the duplicate gate, while other author mutations are refused by dirty-workspace binding enforcement. Clearing the dirty state to escape would destroy, relocate, or bypass the very work the rebind existed to preserve. ## Scope * Mint narrowly scoped, durable owning-PR continuation evidence at the point a dirty same-claimant rebind succeeds against an issue with an owning open PR. * Make that evidence consumable by the shared duplicate-gate rebuild used by ordinary author commit, push, and PR-update preflight, through the same authoritative resolver those paths already share. * Add end-to-end regression coverage for post-rebind commit preflight, plus negative coverage. ## Non-goals * Do not weaken, bypass, or special-case the duplicate-work gate. * Do not grant an exemption because an open PR exists. * Do not add an automatic dirty-worktree exception to `gitea_lock_issue` or `bind_session_lock`. * Do not alter the clean-worktree requirements of lock renewal or dead-session recovery. * Do not change what `issue_work_duplicate_gate._assess_owning_pr_exemption` accepts as a valid token. * Do not re-open, re-scope, or re-implement #864. * Do not modify issue #943, PR #944, issue #945, PR #946, their branches, worktrees, locks, or preserved bytes. ## Safety invariants * The exemption stays bound to the exact repository, issue, open PR, source branch, registered worktree, claimant identity, claimant profile, owning workflow session, and applicable recorded, accepted, local, remote, and live PR heads. * Missing, malformed, stale, ambiguous, expired, released, replaced, foreign, or non-owning evidence fails closed. * A rebind never authorizes creation of a second PR, a commit on an unrelated branch, or work on a different issue. * Structured refusals preserve reason codes, retryability, transport survival, and audit evidence. * Operator-granted mutation boundaries, role gating, parity gating, anti-stomp, and scope enforcement stay in force. * Dirty bytes remain preserved byte-for-byte; the fix adds evidence, it never touches working-tree content. ## Acceptance criteria 1. A successful dirty same-claimant rebind involving an owning open PR establishes narrowly scoped, durable continuation evidence that ordinary author preflight can consume. 2. The next preflight succeeds only when repository, claimant, issue, PR, branch, worktree, and applicable head evidence all match. 3. Foreign, stale, ambiguous, unrelated, and mismatched work remains fail-closed. 4. Existing clean-worktree lock, renewal, and dead-session recovery behavior is unchanged. 5. Every blocked result reports the failed gate, the authoritative conflicting or missing evidence, whether the condition is recoverable, and the exact sanctioned next capability. 6. End-to-end regression coverage reproduces the post-rebind commit preflight failure on the pre-fix tree and verifies the corrected consumption path on the fixed tree. 7. Negative tests cover claimant, issue, PR, branch, worktree, and head mismatches. 8. Operator-granted mutation boundaries remain enforced. 9. Prohibited: prompt-only fixes, client-specific exceptions, special cases for #945 or PR #946, broad bypasses, raw Git or API fallbacks, and any weakening of duplicate protection. ## Prior work consulted * #864 — the closed issue whose AC5 this defect leaves unmet. * #943 / PR #944 — the live instance of the trapped state; preserve exactly as-is. * #945 / PR #946 — propagation of exact-owner **renewal** evidence that already exists. That work does not mint evidence where none can be minted, so it does not cover the dirty case; both defects can hold at once. * #860 / PR #861 — the dirty-orphan recovery class #864 was separated from. * #753 / #755 / #768 / #772 — the dead-session recovery family, all clean-worktree paths. * #510 — dirty namespace and workspace mutation binding. ## Canonical next step ```text STATE: ready-for-author WHO_IS_NEXT: author NEXT_ACTION: Allocate a clean registered worktree from live master, mint narrowly scoped owning-PR continuation evidence at successful dirty same-claimant rebind, wire it into the shared duplicate-gate resolver, add end-to-end and negative regression coverage, publish one PR, hand off to gitea-reviewer ```