session adopt: read the source store without reaping it

Commit

Stefan Haubold3d ago

adoptSourceIsOwned documented itself as side-effect free, and it was not: ListWithSkipped reaps stale records like List does, so the ownership guard garbage-collected the store named by --from โ€” on the first decision and again on the re-check under the lock โ€” including on the calls where it then refused.

Reaping is housekeeping a store does to itself, and every command does it to its own; this guard is the one caller that lists a store belonging to another repository, so it now takes ListReadOnlyWithSkipped there, which pairs the completeness report with ListReadOnly's restraint. This repository's own store is still listed by the resolver, where reaping is the same cleanup every other command performs on it, and the comment now says which half is which instead of claiming neither writes.

Retaining stale records cannot widen what the guard authorizes. A stale candidate can only outrank the session being adopted, never become it, and the adopted session is never stale in the first place because Load reaped it during selection โ€” which is also why no refusal could ever have deleted the session under adoption.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com Entire-Checkpoint: 01M6E8NTRAVPEDKTRQWWEC3T1G