@team-agent/installer 0.4.1 → 0.4.2

package/crates/team-agent/src/leader/rediscover/tests.rs

@@ -127,10 +127,14 @@ fn try_readopt_writes_owner_receiver_dual_state_and_events() {
     assert_eq!(got.1["pane"]["pane_id"], json!("%new"));
     assert_eq!(got.1["readopted"], json!(true));
     assert!(got.1.get("warning").is_some_and(Value::is_null));
-    assert_eq!(state["team_owner"]["pane_id"], json!("%new"));
-    assert_eq!(state["team_owner"]["claimed_via"], json!("attach-leader"));
-    assert_eq!(state["team_owner"]["owner_epoch"], json!(4));
-    assert_eq!(state["leader_receiver"]["discovery"], json!("attach_readopt"));
+    // Stage 3d: owner + receiver live at canonical teams.<team_key>.
+    let team_key = crate::state::projection::team_state_key(&state);
+    let owner_view = &state["teams"][&team_key]["team_owner"];
+    let receiver_view = &state["teams"][&team_key]["leader_receiver"];
+    assert_eq!(owner_view["pane_id"], json!("%new"));
+    assert_eq!(owner_view["claimed_via"], json!("attach-leader"));
+    assert_eq!(owner_view["owner_epoch"], json!(4));
+    assert_eq!(receiver_view["discovery"], json!("attach_readopt"));
     assert!(crate::model::paths::runtime_dir(&ws)
         .join("teams")
         .join("sess")
@@ -185,6 +189,10 @@ fn try_readopt_refuses_when_different_live_owner_uuid_mismatches() {
     .unwrap();
 
     assert!(got.is_none());
+    // Stage 3d: no owner anywhere — check both legacy top-level and the
+    // canonical teams.<key> location via the ownership repository.
+    let team_key = crate::state::projection::team_state_key(&state);
+    assert!(crate::state::ownership::read_owner_value(&state, &team_key).is_none());
     assert!(state.get("team_owner").is_none());
 }
 
@@ -227,7 +235,10 @@ fn rediscover_updates_unique_env_triple_match() {
     assert_eq!(out["status"], json!("updated"));
     assert!(out.get("ok").is_none(), "golden rediscover result has no ok wrapper");
     assert_eq!(out["owner_identity"]["pane_id"], json!("%r"));
-    assert_eq!(state["leader_receiver"]["pane_id"], json!("%r"));
+    // Stage 3d: receiver lives at canonical teams.<team_key>.leader_receiver.
+    let team_key = crate::state::projection::team_state_key(&state);
+    let receiver = &state["teams"][&team_key]["leader_receiver"];
+    assert_eq!(receiver["pane_id"], json!("%r"));
     let events = event_log.tail(10).unwrap();
     let rediscovered = event_named(&events, "leader_receiver.rediscovered");
     assert_eq!(rediscovered["provider"], json!("codex"));
@@ -241,7 +252,7 @@ fn rediscover_updates_unique_env_triple_match() {
     assert_eq!(rebound["new_pane_id"], json!("%r"));
     assert_eq!(rebound["owner_identity"]["machine_fingerprint"], json!("fp"));
     assert_eq!(rebound["uuid_prefix"], json!("OWNERUUI"));
-    assert_eq!(state["leader_receiver"]["discovery"], json!("stale_rediscovery_unique_candidate"));
+    assert_eq!(receiver["discovery"], json!("stale_rediscovery_unique_candidate"));
 }
 
 #[test]
@@ -286,7 +297,10 @@ fn rediscover_owner_identity_passthrough_sets_discovery_and_reason() {
 
     assert_eq!(out["status"], json!("updated"));
     assert_eq!(out["owner_identity"], raw_identity);
-    assert_eq!(state["leader_receiver"]["discovery"], json!("stale_rediscovery_owner_identity"));
+    // Stage 3d: receiver lives at canonical teams.<team_key>.leader_receiver.
+    let team_key = crate::state::projection::team_state_key(&state);
+    let receiver = &state["teams"][&team_key]["leader_receiver"];
+    assert_eq!(receiver["discovery"], json!("stale_rediscovery_owner_identity"));
     let rebound = event_named(&event_log.tail(10).unwrap(), "leader_receiver.rebind_applied");
     assert_eq!(rebound["reason"], json!("stale_receiver"));
     assert_eq!(rebound["owner_identity"], raw_identity);

package/crates/team-agent/src/leader/rediscover.rs

@@ -1064,6 +1064,9 @@ fn state_receiver(state: &Value) -> Option<LeaderReceiver> {
         .and_then(|value| serde_json::from_value(value).ok())
 }
 
+/// Stage 3a (identity-boundary unified plan, architect direction 2026-06-23):
+/// route the readopt binding write through the ownership repository.
+/// Behaviour byte-identical to the pre-3a hand-rolled inserts.
 fn write_readopt_state(
     workspace: &Path,
     state: &mut Value,
@@ -1073,11 +1076,14 @@ fn write_readopt_state(
     if !state.is_object() {
         *state = json!({});
     }
-    let Some(root) = state.as_object_mut() else {
+    if !state.is_object() {
         return Err(LeaderError::Validation("state root is not an object".to_string()));
-    };
-    root.insert("leader_receiver".to_string(), serde_json::to_value(receiver)?);
-    root.insert("team_owner".to_string(), serde_json::to_value(owner)?);
+    }
+    let team_key = crate::state::projection::team_state_key(state);
+    let record = crate::state::ownership::OwnershipWrite::new()
+        .with_leader_receiver(serde_json::to_value(receiver)?)
+        .with_team_owner(serde_json::to_value(owner)?);
+    crate::state::ownership::write_owner(state, &team_key, record);
     crate::leader::write_lease_dual_state(workspace, state)
 }
 
@@ -1089,10 +1095,13 @@ fn write_receiver_state(
     if !state.is_object() {
         *state = json!({});
     }
-    let Some(root) = state.as_object_mut() else {
+    if !state.is_object() {
         return Err(LeaderError::Validation("state root is not an object".to_string()));
-    };
-    root.insert("leader_receiver".to_string(), serde_json::to_value(receiver)?);
+    }
+    let team_key = crate::state::projection::team_state_key(state);
+    let record = crate::state::ownership::OwnershipWrite::new()
+        .with_leader_receiver(serde_json::to_value(receiver)?);
+    crate::state::ownership::write_owner(state, &team_key, record);
     crate::leader::write_lease_dual_state(workspace, state)
 }
 

package/crates/team-agent/src/leader/start.rs

@@ -587,10 +587,13 @@ fn persist_managed_leader_binding(
                 "tmux": std::env::var("TMUX").ok(),
             }),
         );
-        obj.insert("leader_receiver".to_string(), receiver);
-        obj.insert("team_owner".to_string(), owner);
-        obj.insert("owner_epoch".to_string(), serde_json::json!(owner_epoch));
     }
+    // Stage 3a/d (identity-boundary unified plan, architect direction
+    // 2026-06-23): build the teams.<key> entry from the non-owner fields
+    // of state (compact_team_state strips the `teams` key), then publish
+    // the canonical owner record AFTER teams.insert so write_owner's
+    // teams.<key>.{team_owner,leader_receiver,owner_epoch} is the final
+    // word and doesn't get overwritten by the compacted entry.
     let entry = crate::state::projection::compact_team_state(&state);
     if let Some(obj) = state.as_object_mut() {
         let teams = obj
@@ -600,6 +603,11 @@ fn persist_managed_leader_binding(
             teams.insert(identity.team_id.as_str().to_string(), entry);
         }
     }
+    let record = crate::state::ownership::OwnershipWrite::new()
+        .with_leader_receiver(receiver)
+        .with_team_owner(owner)
+        .with_owner_epoch(owner_epoch);
+    crate::state::ownership::write_owner(&mut state, identity.team_id.as_str(), record);
     crate::state::persist::save_runtime_state(workspace, &state)?;
     Ok(())
 }
@@ -689,10 +697,11 @@ fn persist_exec_provider_leader_binding(
                 "tmux": std::env::var("TMUX").ok(),
             }),
         );
-        obj.insert("leader_receiver".to_string(), receiver);
-        obj.insert("team_owner".to_string(), owner);
-        obj.insert("owner_epoch".to_string(), serde_json::json!(owner_epoch));
     }
+    // Stage 3a/d (identity-boundary unified plan, architect direction
+    // 2026-06-23): compact-then-write-owner ordering as in
+    // persist_managed_leader_binding above. write_owner must be the final
+    // write so the canonical teams.<key> owner record survives.
     let entry = crate::state::projection::compact_team_state(&state);
     if let Some(obj) = state.as_object_mut() {
         let teams = obj
@@ -702,6 +711,11 @@ fn persist_exec_provider_leader_binding(
             teams.insert(identity.team_id.as_str().to_string(), entry);
         }
     }
+    let record = crate::state::ownership::OwnershipWrite::new()
+        .with_leader_receiver(receiver)
+        .with_team_owner(owner)
+        .with_owner_epoch(owner_epoch);
+    crate::state::ownership::write_owner(&mut state, identity.team_id.as_str(), record);
     crate::state::persist::save_runtime_state(workspace, &state)?;
     Ok(())
 }
@@ -1351,16 +1365,15 @@ mod tests {
         assert_eq!(outcome.status, crate::leader::LeaderLaunchStatus::Exited);
         let state = crate::state::persist::load_runtime_state(&workspace).unwrap();
         assert_eq!(state["is_external_leader"], serde_json::json!(false));
-        assert_eq!(state["leader_receiver"]["pane_id"], serde_json::json!("%77"));
-        assert_eq!(
-            state["leader_receiver"]["tmux_socket"],
-            serde_json::json!("/private/tmp/tmux-501/default")
-        );
-        assert_eq!(state["team_owner"]["pane_id"], serde_json::json!("%77"));
+        // Stage 3d: canonical owner/receiver at teams.<team_key>.
         assert_eq!(
             state["teams"]["current"]["leader_receiver"]["pane_id"],
             serde_json::json!("%77")
         );
+        assert_eq!(
+            state["teams"]["current"]["leader_receiver"]["tmux_socket"],
+            serde_json::json!("/private/tmp/tmux-501/default")
+        );
         assert_eq!(
             state["teams"]["current"]["team_owner"]["pane_id"],
             serde_json::json!("%77")

package/crates/team-agent/src/leader/tests/byte_findings.rs

@@ -10,7 +10,12 @@ use super::*;
         let r = claim_lease_no_incident(&ws, &mut state, None, &TeamKey::new("current"),
             &PaneId::new("%5"), false, &crate::event_log::EventLog::new(&ws), &seeded_liveness(&["%5"])).unwrap();
         assert!(r.ok && r.status == LeaseStatus::Claimed, "precondition: vacant acquire");
-        let owner = state["team_owner"].as_object().expect("team_owner object");
+        // Stage 3d (identity-boundary unified plan, architect direction
+        // 2026-06-23): canonical owner now at teams.<team_key>.team_owner.
+        let team_key = crate::state::projection::team_state_key(&state);
+        let owner = state["teams"][&team_key]["team_owner"]
+            .as_object()
+            .expect("Stage 3d: team_owner at canonical teams.<team_key>");
         assert!(owner.contains_key("os_user"),
             "golden claim-path team_owner carries os_user even when empty; keys={:?}", owner.keys().collect::<Vec<_>>());
         let keys: Vec<&str> = owner.keys().map(String::as_str).collect();
@@ -37,7 +42,11 @@ use super::*;
         let r = claim_lease_no_incident(&ws, &mut state, None, &TeamKey::new("current"),
             &PaneId::new("%5"), false, &crate::event_log::EventLog::new(&ws), &seeded_liveness(&["%5"])).unwrap();
         assert!(r.ok && r.status == LeaseStatus::Claimed, "precondition: vacant acquire");
-        let recv = state["leader_receiver"].as_object().expect("leader_receiver object");
+        // Stage 3d: canonical receiver at teams.<team_key>.leader_receiver.
+        let team_key = crate::state::projection::team_state_key(&state);
+        let recv = state["teams"][&team_key]["leader_receiver"]
+            .as_object()
+            .expect("Stage 3d: leader_receiver at canonical teams.<team_key>");
         for extra in ["fingerprint", "requested_provider", "warning"] {
             assert!(!recv.contains_key(extra),
                 "golden leader_receiver has NO '{extra}' key (Rust must add skip_serializing_if); keys={:?}", recv.keys().collect::<Vec<_>>());

package/crates/team-agent/src/leader/tests/lease_claim.rs

@@ -35,18 +35,45 @@ use super::*;
         let receiver = r.receiver.as_ref().expect("claimed → receiver");
         assert_eq!(receiver.pane_id, caller);
         assert_eq!(receiver.discovery, Some(Discovery::ClaimLeader));
-        // dual-state: BOTH workspace state.json + team/<session> snapshot carry %5/epoch 1.
+        // Stage 3d (identity-boundary unified plan, architect direction
+        // 2026-06-23): canonical owner now lives at teams.<team_key>; the
+        // top-level dual-write was dropped. Read through the ownership
+        // repository which preserves the legacy precedence for callers
+        // that still consult top-level on migration states.
         let ws_path = crate::state::persist::runtime_state_path(&ws);
         let ws_state: serde_json::Value =
             serde_json::from_str(&std::fs::read_to_string(&ws_path).unwrap()).unwrap();
-        assert_eq!(ws_state["team_owner"]["pane_id"], serde_json::json!("%5"));
-        assert_eq!(ws_state["team_owner"]["owner_epoch"], serde_json::json!(1));
+        // The canonical team_key is what `team_state_key(state)` derives
+        // (here: state's session_name "team-agent-x" since no explicit
+        // team_key/team_dir/spec_path was seeded). The test's `team_id`
+        // parameter is the LOOKUP key but `claim_lease_no_incident` uses
+        // the state-derived key for canonical writes. Stage 5 will unify
+        // these via TeamRuntimePaths.
+        let canonical_key = crate::state::projection::team_state_key(&ws_state);
+        let ws_owner =
+            crate::state::ownership::read_owner_value(&ws_state, &canonical_key)
+                .expect("Stage 3d: vacant acquire writes canonical owner");
+        assert_eq!(ws_owner["pane_id"], serde_json::json!("%5"));
+        assert_eq!(ws_owner["owner_epoch"], serde_json::json!(1));
+        // team_id parameter is currently unused by the canonical write
+        // (architect Stage 5 will close this gap); silence the warning.
+        let _ = &team_id;
         let snap_path = crate::model::paths::runtime_dir(&ws)
             .join("teams").join("team-agent-x").join("state.json");
         let snap: serde_json::Value =
             serde_json::from_str(&std::fs::read_to_string(&snap_path).unwrap()).unwrap();
-        assert_eq!(snap["team_owner"]["pane_id"], serde_json::json!("%5"), "dual-state snapshot owner");
-        assert_eq!(snap["team_owner"]["owner_epoch"], serde_json::json!(1));
+        // Snapshot is per-session; team_state_key on the snapshot derives
+        // from its session_name. Read top-level first (legacy snapshot
+        // layout), fall back to derived team key.
+        let snap_owner = snap
+            .get("team_owner")
+            .or_else(|| {
+                let key = crate::state::projection::team_state_key(&snap);
+                snap.get("teams").and_then(|t| t.get(key)).and_then(|e| e.get("team_owner"))
+            })
+            .expect("dual-state snapshot owner");
+        assert_eq!(snap_owner["pane_id"], serde_json::json!("%5"), "dual-state snapshot owner");
+        assert_eq!(snap_owner["owner_epoch"], serde_json::json!(1));
     }
 
     // RED — DEAD-OWNER RECOVER: bound pane %1 absent from live set, caller %5
@@ -173,8 +200,11 @@ use super::*;
             &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
         )
         .unwrap();
+        // Stage 3d: canonical receiver at teams.<team_key>.leader_receiver.
+        let team_key = crate::state::projection::team_state_key(&persisted);
+        let receiver = &persisted["teams"][&team_key]["leader_receiver"];
         assert_eq!(
-            persisted["leader_receiver"]["tmux_socket"],
+            receiver["tmux_socket"],
             serde_json::json!(leader_socket),
             "state.json must carry enough endpoint information for later delivery to use tmux -S"
         );
@@ -290,8 +320,11 @@ use super::*;
             &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
         )
         .unwrap();
+        // Stage 3d: canonical receiver at teams.<team_key>.leader_receiver.
+        let team_key = crate::state::projection::team_state_key(&persisted);
+        let receiver = &persisted["teams"][&team_key]["leader_receiver"];
         assert_eq!(
-            persisted["leader_receiver"]["tmux_socket"],
+            receiver["tmux_socket"],
             serde_json::json!(current_socket),
             "state must not preserve a short endpoint after explicit claim; state={persisted}"
         );
@@ -408,3 +441,211 @@ use super::*;
     // _lease_epoch:400, _emit_lease_refusal:469, audit :712-729). These REDs lock the EXACT
     // golden shape per divergence; driven via claim_lease_no_incident(+seeded_liveness), OS-safe.
     // ═════════════════════════════════════════════════════════════════════════
+
+    /// **S3-OWNER-001 regression** (architect Stage 3 owner persist fix,
+    /// .team/artifacts/stage3-owner-persist-fix.md). Pre-fix on commit
+    /// `5d980c7`:
+    /// 1. `claim-leader --team alpha` returns `ok=true/status=claimed`.
+    /// 2. In-memory state has `state.teams.alpha.team_owner` set by
+    ///    `write_binding_to_state` → `state::ownership::write_owner`.
+    /// 3. `save_claim_team_scoped_state` calls `compact_team_state(state)` to
+    ///    build the per-team snapshot. `compact_team_state` strips the
+    ///    `teams` key entirely — the just-written nested ownership record
+    ///    is DROPPED on the way to disk.
+    /// 4. After Stage 3d removed the top-level dual-write, no copy survives.
+    /// 5. Reloading the workspace state.json shows `persisted_owner_locations=[]`.
+    ///
+    /// Fix: `save_claim_team_scoped_state` now uses
+    /// `compact_team_state_preserving_ownership(state, target_key)` which
+    /// re-injects `team_owner / leader_receiver / owner_epoch` from
+    /// `state.teams[target_key]` into the compacted entry. Top-level fields
+    /// remain absent (Stage 3d canonical shape preserved).
+    #[test]
+    #[serial_test::serial(env)]
+    fn claim_team_scoped_persists_canonical_owner_under_teams_target_key() {
+        let _g = ENV_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let _e = EnvGuard::apply(&[("TEAM_AGENT_LEADER_SESSION_UUID_OVERRIDE", None)]);
+        let ws = p2_temp_ws("claim_team_persist");
+        let target = "alpha";
+        let team_id = TeamKey::new(target);
+        let caller = PaneId::new("%5");
+        // Seed runtime state with a teams entry but no owner fields anywhere
+        // (the S3-OWNER-001 starting condition). team_dir is set so
+        // team_state_key resolves to the target team_key, matching the
+        // claim path's projected-state shape.
+        let mut state = serde_json::json!({
+            "session_name": "team-agent-x",
+            "team_dir": format!("/tmp/{}", target),
+            "teams": {target: {}},
+        });
+        let event_log = crate::event_log::EventLog::new(&ws);
+        let live = seeded_liveness(&["%5"]);
+        let r = claim_lease_no_incident(
+            &ws, &mut state, Some(target), &team_id, &caller, false, &event_log, &live,
+        )
+        .unwrap();
+        assert!(r.ok, "S3-OWNER-001: claim must succeed; got {r:?}");
+        assert_eq!(r.status, LeaseStatus::Claimed);
+
+        // Reload state from disk — this is where the pre-fix loss surfaced.
+        let persisted_path = crate::state::persist::runtime_state_path(&ws);
+        let persisted: serde_json::Value = serde_json::from_str(
+            &std::fs::read_to_string(&persisted_path).unwrap(),
+        )
+        .unwrap();
+
+        // Canonical: teams.<target_key>.{team_owner, leader_receiver, owner_epoch}.
+        let entry = &persisted["teams"][target];
+        assert_eq!(
+            entry["team_owner"]["pane_id"],
+            serde_json::json!("%5"),
+            "S3-OWNER-001 fix: teams.{target}.team_owner.pane_id persisted; \
+             persisted={persisted}"
+        );
+        assert_eq!(
+            entry["leader_receiver"]["pane_id"],
+            serde_json::json!("%5"),
+            "S3-OWNER-001 fix: teams.{target}.leader_receiver.pane_id persisted; \
+             persisted={persisted}"
+        );
+        assert_eq!(
+            entry["owner_epoch"], serde_json::json!(1),
+            "S3-OWNER-001 fix: teams.{target}.owner_epoch=1 persisted; \
+             persisted={persisted}"
+        );
+
+        // Stage 3d invariant: top-level owner fields stay ABSENT (no
+        // recurrence of the legacy dual-write).
+        assert!(
+            persisted.get("team_owner").is_none(),
+            "Stage 3d: top-level team_owner must remain absent; persisted={persisted}"
+        );
+        assert!(
+            persisted.get("leader_receiver").is_none(),
+            "Stage 3d: top-level leader_receiver must remain absent; persisted={persisted}"
+        );
+        assert!(
+            persisted.get("owner_epoch").is_none(),
+            "Stage 3d: top-level owner_epoch must remain absent; persisted={persisted}"
+        );
+    }
+
+    /// **S3-OWNER-002 regression** (architect Stage 3 top-level cleanup,
+    /// .team/artifacts/stage3-toplevel-cleanup-fix.md). Even with the
+    /// nested-ownership-preserving compact (aae818f), a SECOND claim on a
+    /// state whose root still carries legacy top-level `team_owner` /
+    /// `leader_receiver` / `owner_epoch` would leave the stale root copy
+    /// on disk while the canonical `teams.<key>` advanced. Evidence:
+    /// `state-after-claim.json` showed `team_owner=%2/epoch=1` at root and
+    /// `teams.<key>.team_owner=%3/epoch=2` — exact dual-source recurrence.
+    ///
+    /// Fix: `save_claim_team_scoped_state` strips legacy root ownership
+    /// fields before save via `state::ownership::strip_top_level_ownership`,
+    /// and the legacy "copy top-level owner from incoming state into
+    /// merged" loop is removed. After every successful named-team owner
+    /// mutation, persisted root is canonical-only.
+    #[test]
+    #[serial_test::serial(env)]
+    fn second_claim_strips_legacy_top_level_ownership_from_persisted_root() {
+        let _g = ENV_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let _e = EnvGuard::apply(&[("TEAM_AGENT_LEADER_SESSION_UUID_OVERRIDE", None)]);
+        let ws = p2_temp_ws("claim_team_second_strip");
+        let target = "alpha";
+        let team_id = TeamKey::new(target);
+        let caller = PaneId::new("%3");
+        // Seed a state whose root carries stale legacy top-level owner
+        // (%2/epoch=1) AND a teams.<target_key> entry that already has
+        // canonical ownership at the previous epoch. This is the
+        // post-S3-OWNER-001-fix shape on disk after one prior claim.
+        let mut state = serde_json::json!({
+            "session_name": "team-agent-x",
+            "team_dir": format!("/tmp/{}", target),
+            "active_team_key": target,
+            "team_owner": {
+                "pane_id": "%2",
+                "provider": "codex",
+                "machine_fingerprint": "fp",
+                "leader_session_uuid": "OLDUUID",
+                "owner_epoch": 1,
+                "claimed_at": "t",
+                "claimed_via": "claim-leader",
+            },
+            "leader_receiver": {
+                "pane_id": "%2",
+                "owner_epoch": 1,
+                "leader_session_uuid": "OLDUUID",
+            },
+            "owner_epoch": 1,
+            "teams": {
+                target: {
+                    "team_owner": {
+                        "pane_id": "%2",
+                        "provider": "codex",
+                        "machine_fingerprint": "fp",
+                        "leader_session_uuid": "OLDUUID",
+                        "owner_epoch": 1,
+                        "claimed_at": "t",
+                        "claimed_via": "claim-leader",
+                    },
+                    "leader_receiver": {
+                        "pane_id": "%2",
+                        "owner_epoch": 1,
+                        "leader_session_uuid": "OLDUUID",
+                    },
+                    "owner_epoch": 1,
+                }
+            },
+        });
+        // Persist the seeded shape so `save_claim_team_scoped_state` loads
+        // it back as `existing` on save.
+        crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+        let event_log = crate::event_log::EventLog::new(&ws);
+        // Both panes live so the dead-owner reclaim branch doesn't apply;
+        // explicit takeover via confirm=true forces the claim past the
+        // live-owner gate.
+        let live = seeded_liveness(&["%2", "%3"]);
+        let r = claim_lease_no_incident(
+            &ws, &mut state, Some(target), &team_id, &caller, true, &event_log, &live,
+        )
+        .unwrap();
+        assert!(r.ok, "S3-OWNER-002: explicit takeover must succeed; got {r:?}");
+        assert_eq!(r.status, LeaseStatus::Claimed);
+
+        let persisted_path = crate::state::persist::runtime_state_path(&ws);
+        let persisted: serde_json::Value = serde_json::from_str(
+            &std::fs::read_to_string(&persisted_path).unwrap(),
+        )
+        .unwrap();
+
+        // Canonical advanced.
+        let entry = &persisted["teams"][target];
+        assert_eq!(
+            entry["team_owner"]["pane_id"],
+            serde_json::json!("%3"),
+            "S3-OWNER-002 fix: canonical owner advanced to new pane; persisted={persisted}"
+        );
+        assert_eq!(
+            entry["owner_epoch"],
+            serde_json::json!(2),
+            "S3-OWNER-002 fix: canonical owner_epoch advanced to 2; persisted={persisted}"
+        );
+        assert_eq!(
+            entry["leader_receiver"]["pane_id"],
+            serde_json::json!("%3"),
+            "S3-OWNER-002 fix: canonical receiver advanced; persisted={persisted}"
+        );
+
+        // Top-level stale legacy owner stripped.
+        assert!(
+            persisted.get("team_owner").is_none(),
+            "S3-OWNER-002 fix: stale top-level team_owner must be stripped; persisted={persisted}"
+        );
+        assert!(
+            persisted.get("leader_receiver").is_none(),
+            "S3-OWNER-002 fix: stale top-level leader_receiver must be stripped; persisted={persisted}"
+        );
+        assert!(
+            persisted.get("owner_epoch").is_none(),
+            "S3-OWNER-002 fix: stale top-level owner_epoch must be stripped; persisted={persisted}"
+        );
+    }