fix(#303): refuse a second client before minting, so we don't orphan one

[saadqbal]

Closes #303.

On the browser path, client create mints a fresh client whenever the backend can't match this cluster to a client in the signed-in account (pre-anchor null cluster_id, or a different account owns it). The one-client guard only ran later in the Helm step, so it refused after a new client was already registered on the dashboard — an orphan that never installs.

Adds a pre-flight in provision_client, after sign-in and before the mint: if a client is already installed here (shared detect_installed_client probe, now also backing the Helm guard) and the signed-in account demonstrably does not own its namespace (via client list), refuse before calling create.

Namespace is the only stable join key (local Helm stores the UUID clientId; client list shows the numeric id). Fires only on a positive "not yours" — a fresh machine, an owned local client (create adopts), or an inconclusive list read all fall through to create's own idempotent adopt/conflict handling, so the same-account re-run/upgrade path is unchanged.

Tests: 3 new provision.bats cases (refuse foreign / adopt same-account / fall-through on unreadable list); guard refactor keeps install-client-helm.bats green.

Note: the proper root-cause fix is the deferred R7 "existing-fleet reconcile" (backfill the null cluster_id and adopt the live in-cluster client instead of minting) — this PR stops the orphan without that larger CLI+backend change.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes browser provisioning order and ownership heuristics (namespace vs legacy tracebloc); wrong refusal or fall-through could block valid reinstalls or still allow orphans, though bats cover the main paths.

Overview
Stops orphan dashboard clients when someone signs into a different account on a machine that already has a tracebloc Helm client. The browser path used to call client create before the Helm one-client guard, so a new client could be registered even though install would later refuse.

Shared local probe: detect_installed_client in install-client-helm.sh centralizes jq-free Helm enumeration; both the new pre-flight and the existing Helm guard use it so they agree on what is installed.

Pre-provision check in provision_client (after login, before mint): _account_owns_namespace matches the local release namespace against tracebloc client list. It refuses only when the list read succeeds and the namespace is missing—except for the legacy fixed tracebloc namespace, where list skew defers to client create and the Helm clientId guard. Fresh machines, owned clients, and failed list reads still fall through to create as before.

Tests: provision.bats stubs the probe and adds cases for foreign-client refusal, same-account adopt, inconclusive list, and legacy namespace deferral. Manifest checksums updated.

^{Reviewed by Cursor Bugbot for commit f490c4b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 33 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#143 — chore(release): promote develop → staging (week of 2026-07-06) · author: @aptracebloc · no reviewer assigned
• averaging-service#156 — feat(strategies): FedMedian Byzantine-robust aggregation (ci: add kanban closure-routing caller workflow #75) · author: @shujaatTracebloc · no reviewer assigned
• averaging-service#157 — feat(strategies): FedTrimmedAvg Byzantine-robust aggregation (ci: add kanban closure-routing caller workflow #75) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#158 — feat(strategies): Krum / MultiKrum Byzantine-robust selection (ci: add kanban closure-routing caller workflow #75) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#159 — feat(strategies): FedProx aggregation strategy (docs(migration-tools): tenant migration runbook for eks-1.0.x → client-1.x #74) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#160 — feat(strategies): FedOpt family — FedAdam / FedYogi / FedAdagrad (docs(migration-tools): tenant migration runbook for eks-1.0.x → client-1.x #74) · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#161 — feat(strategies): resolve per-experiment aggregation hyperparameters (docs(migration-tools): tenant migration runbook for eks-1.0.x → client-1.x #74) · author: @shujaatTracebloc · no reviewer assigned
• backend#926 — chore(release): promote develop → staging (week of 2026-07-06) · author: @aptracebloc · reviewer: @saadqbal
• backend#927 — feat(validators): schema check for tabular/text/token classification (#924 G2) · author: @divyasinghds · no reviewer assigned
• backend#931 — feat(validators): generic all-category checks + validation matrix (#924 Phase 0/G12) · author: @divyasinghds · reviewer: @saqlainsyed007

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[saadqbal]

This is the interim band-aid; the real fix is R7 in tracebloc/cli#132, now merged to CLI develop but not yet released. The installer pulls the latest CLI release (still v0.5.1, pre-R7), so orphans are still possible until an R7 release ships — keep this merged as protection until then. Follow-up: drop this pre-flight once the R7 CLI is released and dev/prod run backend #893. The install-client-helm one-client guard stays as the backstop regardless.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit ef1560a. Configure here.}