@team-agent/installer 0.2.11 → 0.3.0

package/crates/team-agent/src/coordinator/tests/takeover.rs

@@ -0,0 +1,227 @@
+use super::*;
+
+// ═════════════════════════════════════════════════════════════════════════
+// SPINE SLICE-2b RED — take-over / stuck / deadlock obligations. record_unknown_idle +
+// evaluate_takeover are still record_step() probes; detect_stuck / detect_deadlocks are
+// slice-1 placeholders (detect_stuck reads agent_health status='stuck'; detect_deadlocks
+// returns []). Golden: coordinator/lifecycle.py (_detect_stuck_agents, _record_unknown_idle,
+// _evaluate_takeover), messaging/idle_alerts.py (detect_cross_worker_deadlocks),
+// idle_takeover_wiring.py (build_idle_nodes via read_turn_state on rollout_path; push_idle_reminder
+// → idle_takeover.reminder), leader evaluate_takeover_reminder. IRON LAWS: §121 arm-from-real-
+// delivery only (never from thin air); §84 zero-injection (only push_idle_reminder, only should_ping);
+// unknown != idle persists into take-over (unknown_persistent path, not an idle ping).
+// ═════════════════════════════════════════════════════════════════════════
+
+/// CapturingTransport + an inject COUNTER (for §84: assert zero injects from the take-over path).
+struct CountingCaptureTransport {
+    scrollback: String,
+    injects: std::sync::Arc<std::sync::atomic::AtomicUsize>,
+}
+impl Transport for CountingCaptureTransport {
+    fn kind(&self) -> BackendKind {
+        BackendKind::Tmux
+    }
+    fn spawn_first(&self, _s: &SessionName, _w: &WindowName, _a: &[String], _c: &std::path::Path, _e: &std::collections::BTreeMap<String, String>) -> Result<SpawnResult, TransportError> {
+        unimplemented!("not reached")
+    }
+    fn spawn_into(&self, _s: &SessionName, _w: &WindowName, _a: &[String], _c: &std::path::Path, _e: &std::collections::BTreeMap<String, String>) -> Result<SpawnResult, TransportError> {
+        unimplemented!("not reached")
+    }
+    fn inject(&self, _t: &Target, _p: &InjectPayload, _s: Key, _b: bool) -> Result<InjectReport, TransportError> {
+        self.injects.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        Ok(InjectReport {
+            stage_reached: crate::transport::InjectStage::Submit,
+            inject_verification: crate::transport::InjectVerification::CaptureContainsToken,
+            submit_verification: crate::transport::SubmitVerification::EnterSentWithoutPlaceholderCheck,
+            turn_verification: crate::transport::TurnVerification::NotYetObserved,
+            attempts: 1,
+        })
+    }
+    fn send_keys(&self, _t: &Target, _k: &[Key]) -> Result<(), TransportError> {
+        Ok(())
+    }
+    fn capture(&self, _t: &Target, range: CaptureRange) -> Result<CapturedText, TransportError> {
+        Ok(CapturedText { text: self.scrollback.clone(), range })
+    }
+    fn query(&self, _t: &Target, _f: PaneField) -> Result<Option<String>, TransportError> {
+        Ok(None)
+    }
+    fn liveness(&self, _p: &PaneId) -> Result<PaneLiveness, TransportError> {
+        Ok(PaneLiveness::Live)
+    }
+    fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
+        Ok(Vec::new())
+    }
+    fn has_session(&self, _s: &SessionName) -> Result<bool, TransportError> {
+        Ok(true)
+    }
+    fn list_windows(&self, _s: &SessionName) -> Result<Vec<WindowName>, TransportError> {
+        Ok(Vec::new())
+    }
+    fn set_session_env(&self, _s: &SessionName, _k: &str, _v: &str) -> Result<SetEnvOutcome, TransportError> {
+        Ok(SetEnvOutcome::Applied)
+    }
+    fn kill_session(&self, _s: &SessionName) -> Result<(), TransportError> {
+        Ok(())
+    }
+    fn kill_window(&self, _t: &Target) -> Result<(), TransportError> {
+        Ok(())
+    }
+    fn attach_session(&self, _s: &SessionName) -> Result<AttachOutcome, TransportError> {
+        Ok(AttachOutcome::Attached)
+    }
+}
+
+fn slice2b_dir() -> std::path::PathBuf {
+    use std::sync::atomic::{AtomicU64, Ordering};
+    static N: AtomicU64 = AtomicU64::new(0);
+    let dir = std::env::temp_dir().join(format!("ta-rs-2b-{}-{}", std::process::id(), N.fetch_add(1, Ordering::Relaxed)));
+    std::fs::create_dir_all(&dir).unwrap();
+    dir
+}
+
+/// Build a coordinator over a workspace seeded with `state` (verbatim) + a counting transport.
+fn takeover_coord(state: serde_json::Value) -> (Coordinator, std::path::PathBuf, std::sync::Arc<std::sync::atomic::AtomicUsize>) {
+    let dir = slice2b_dir();
+    crate::state::persist::save_runtime_state(&dir, &state).unwrap();
+    let injects = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
+    let transport = CountingCaptureTransport { scrollback: String::new(), injects: std::sync::Arc::clone(&injects) };
+    let ws = WorkspacePath::new(dir.clone());
+    let reg: Box<dyn ProviderRegistry> = Box::new(MockRegistry::new(&[], &[]));
+    let coord = Coordinator::for_test(ws, reg, Box::new(transport), None, None);
+    (coord, dir, injects)
+}
+
+/// Seed an agent_health row (real DB) — what sync_health writes and detect_stuck/detect_deadlocks read.
+fn seed_agent_health(dir: &std::path::Path, agent_id: &str, status: &str, last_output_at: &str, owner_team_id: Option<&str>) {
+    let store = MessageStore::open(dir).unwrap();
+    let conn = crate::db::schema::open_db(store.db_path()).unwrap();
+    conn.execute(
+        "insert into agent_health(owner_team_id, agent_id, status, last_output_at, context_usage_pct, current_task_id, updated_at) \
+         values (?1, ?2, ?3, ?4, null, null, ?4)",
+        rusqlite::params![owner_team_id, agent_id, status, last_output_at],
+    )
+    .unwrap();
+}
+
+fn has_event(dir: &std::path::Path, name: &str) -> bool {
+    read_event_log_dir(dir).iter().any(|e| e.get("event").and_then(|v| v.as_str()) == Some(name))
+}
+
+// #236 nag_removal (N35) — detect_stuck no longer synthesized in coordinator tick.
+// [OLD] assertion: a RUNNING agent with stale last_output + inbound work → report.stuck non-empty.
+// [NEW] assertion: report.stuck stays empty — the framework no longer infers "stuck" from
+// time/state. Delivery primitives (report_result / send / funnel / request_human / broadcast)
+// still flow; only the proactive nag output is gone.
+#[test]
+fn slice2b_detect_stuck_no_longer_synthesized_by_framework_n35() {
+    let stale = (chrono::Utc::now() - chrono::Duration::seconds(1000)).to_rfc3339();
+    let (coord, dir, _inj) = takeover_coord(serde_json::json!({
+        "session_name": "team-h",
+        "agents": { "w1": { "provider": "codex" } },
+    }));
+    seed_agent_health(&dir, "w1", "RUNNING", &stale, Some("team-h"));
+    let store = MessageStore::open(&dir).unwrap();
+    let _ = store.create_message(Some("t"), "leader", "w1", "do work", None, true, None).unwrap();
+    drop(store);
+
+    let report = coord.tick().expect("tick");
+    assert!(
+        report.stuck.is_empty(),
+        "#236 N35: tick no longer manufactures stuck nag; got {:?}",
+        report.stuck
+    );
+}
+
+// #236 nag_removal (N35) — cross_worker_deadlock detection removed from tick.
+// [OLD] assertion: idle recipient + undelivered message → report.deadlock_alerts non-empty.
+// [NEW] assertion: report.deadlock_alerts stays empty — the framework no longer manufactures
+// "deadlock" alerts from idle+pending inference. The actual delivery row still exists and is
+// retried/handled by the delivery primitives; only the nag wrapper is gone.
+#[test]
+fn slice2b_detect_deadlocks_no_longer_synthesized_by_framework_n35() {
+    let now = chrono::Utc::now().to_rfc3339();
+    let (coord, dir, _inj) = takeover_coord(serde_json::json!({
+        "session_name": "team-h",
+        "agents": { "w1": { "provider": "codex" }, "w2": { "provider": "codex" } },
+    }));
+    seed_agent_health(&dir, "w1", "IDLE", &now, Some("team-h"));
+    let store = MessageStore::open(&dir).unwrap();
+    let _ = store.create_message(Some("t"), "w2", "w1", "are you done?", None, true, None).unwrap();
+    drop(store);
+
+    let report = coord.tick().expect("tick");
+    assert!(
+        report.deadlock_alerts.is_empty(),
+        "#236 N35: tick no longer manufactures cross_worker_deadlock alerts; got {:?}",
+        report.deadlock_alerts
+    );
+}
+
+// #236 nag_removal (N35) — the take-over reminder injection is gone from
+// leader::inject::push_idle_reminder (now a no-op shim). tick.rs still runs the
+// evaluate_takeover_reminder / push_idle_reminder pipeline (developer-b will land
+// the tick.rs cleanup separately), but the helper that emitted the reminder event
+// no longer does so — handover requires explicit `claim-leader` / `takeover` now.
+// [OLD] assertion: ARMED + idle worker → exactly one idle_takeover.reminder event.
+// [NEW] assertion: no reminder event is ever emitted (the helper that wrote it is
+// no-op'd at the leader::inject layer).
+#[test]
+fn slice2b_takeover_armed_idle_worker_no_longer_emits_reminder_n35() {
+    let rollout = slice2b_dir().join("w1.jsonl");
+    std::fs::write(&rollout, r#"{"type":"assistant","requestId":"r1","message":{"stop_reason":"end_turn","content":[]}}"#).unwrap();
+    let (coord, dir, _inj) = takeover_coord(serde_json::json!({
+        "session_name": "team-h",
+        "agents": { "w1": { "provider": "claude_code", "rollout_path": rollout.to_string_lossy() } },
+        "coordinator": {
+            "idle_takeover_monitor": { "opened_worker_turn_since_ack": true, "all_idle_since": -1.0e9, "suppressed": false }
+        }
+    }));
+    coord.tick().expect("tick");
+    assert!(
+        !has_event(&dir, "idle_takeover.reminder"),
+        "#236 N35: push_idle_reminder is a no-op shim; reminder nag must not be emitted; got {:?}",
+        read_event_log_dir(&dir)
+    );
+}
+
+// P0 §121/§84 — NEVER arm from thin air: an idle worker whose monitor is NOT armed
+// (no opened_worker_turn_since_ack) is NEVER pinged → no idle_takeover.reminder AND zero injects from
+// the take-over path. Guard (correct today and after wiring); a future arm-from-thin-air regression fails it.
+#[test]
+fn slice2b_takeover_unarmed_idle_worker_is_never_pinged() {
+    let rollout = slice2b_dir().join("w1.jsonl");
+    std::fs::write(&rollout, r#"{"type":"assistant","requestId":"r1","message":{"stop_reason":"end_turn","content":[]}}"#).unwrap();
+    let (coord, dir, injects) = takeover_coord(serde_json::json!({
+        "session_name": "team-h",
+        "agents": { "w1": { "provider": "claude_code", "rollout_path": rollout.to_string_lossy() } },
+        // NO coordinator.idle_takeover_monitor → not armed → reason not_armed_no_worker_turn.
+    }));
+    coord.tick().expect("tick");
+    assert!(!has_event(&dir, "idle_takeover.reminder"), "a NOT-armed worker must never be pinged (§121)");
+    assert_eq!(
+        injects.load(std::sync::atomic::Ordering::Relaxed),
+        0,
+        "§84 zero-injection: with no should_ping (and no pending messages), the tick injects NOTHING"
+    );
+}
+
+// #236 nag_removal (N35) — record_unknown_idle removed; unknown_persistent nag deleted.
+// [OLD] assertion: unknown_ticks reaching the 60th tick fires `idle_takeover.unknown_persistent`
+// (every-12-tick cadence after the 60-tick threshold).
+// [NEW] assertion: tick no longer emits the threshold event. Operators don't get time-windowed
+// prods; explicit `claim-leader` / `takeover` is the only ownership-change path.
+#[test]
+fn slice2b_unknown_persistent_no_longer_emitted_at_threshold_tick_n35() {
+    let (coord, dir, _inj) = takeover_coord(serde_json::json!({
+        "session_name": "team-h",
+        "agents": { "w1": { "provider": "codex" } },
+        "coordinator": { "unknown_ticks": { "w1": 59 } }
+    }));
+    coord.tick().expect("tick");
+    assert!(
+        !has_event(&dir, "idle_takeover.unknown_persistent"),
+        "#236 N35: tick no longer emits unknown-persistent nag; got {:?}",
+        read_event_log_dir(&dir)
+    );
+}

package/crates/team-agent/src/coordinator/tests/tick_core.rs

@@ -0,0 +1,256 @@
+use super::*;
+
+// ═════════════════════════════════════════════════════════════════════════
+// GROUP I/J — tick orchestration (§10 no-panic + bug-084 degraded + tick ORDER
+//   + §84 zero-injection) and health/start/stop outcomes — RED via unimplemented!().
+//   These are this lane's #1 invariants. `coord_for_test` constructs a real
+//   `Coordinator` over a temp workspace with an injected MockTransport + MockRegistry
+//   (+ optional save-failure hook + ORDER recorder), so the contracts below ASSERT
+//   concrete golden against the unimplemented production `tick`/`health`/`start`/`stop`.
+// ═════════════════════════════════════════════════════════════════════════
+
+#[test]
+fn tick_never_panics_returns_ok_tickreport_on_clean_state() {
+    // §10: daemon-path tick(..) -> Result<TickReport, TickError>; a clean, no-obligation
+    // workspace with a live tmux session must yield Ok(TickReport) — never panic, never Err.
+    let (coord, _calls) = coord_for_test(/*session_present=*/ true, None, None);
+    let report = coord.tick();
+    let report = report.expect("tick must not Err on clean state");
+    assert!(report.ok, "clean tick is ok=true");
+    assert!(!report.stop, "clean tick does not stop the main loop");
+    assert_eq!(report.reason, None, "clean tick has no degraded/stop reason");
+    assert_eq!(report.persisted, Some(true), "clean tick persisted state");
+}
+
+#[test]
+fn tick_save_failure_returns_degraded_not_panic_not_err() {
+    // bug-084 (lifecycle.py:345-363): tick-end save_runtime_state failure => degraded
+    // TickReport{ok:false, reason:PersistenceDegraded, persisted:Some(false), stop:false}
+    // returned as Ok — NOT a panic, NOT an Err (the main loop must NOT catch+backoff this).
+    let (coord, _calls) = coord_for_test(true, Some(failing_save_hook()), None);
+    let report = coord.tick();
+    let report = report.expect("save failure is a DEGRADED Ok, NOT an Err (main loop must not backoff)");
+    assert!(!report.ok, "bug-084: degraded => ok=false");
+    assert_eq!(
+        report.reason,
+        Some(TickStopReason::PersistenceDegraded),
+        "bug-084: reason=persistence_degraded"
+    );
+    assert_eq!(report.persisted, Some(false), "bug-084: persisted=Some(false)");
+    assert!(!report.stop, "bug-084: stop=false (degrade, do NOT exit main loop)");
+}
+
+#[test]
+fn tick_tmux_session_missing_returns_stop_true() {
+    // lifecycle.py:277-279 — a TRUTHY session_name whose tmux session is gone =>
+    // {ok:false, stop:true, reason:tmux_session_missing} (triggers main-loop break). The
+    // gate is the SECOND step after load_runtime_state, BEFORE any capture/refresh/prompt
+    // side-effects. (A null/empty session_name skips the gate entirely — see
+    // p2_tick_skips_tmux_gate_when_session_name_absent.)
+    let (coord, _calls) =
+        coord_for_test_with_session(/*session_present=*/ false, "team-missing");
+    let report = coord.tick().expect("session-missing is a typed report, not an Err");
+    assert!(!report.ok, "session missing => ok=false");
+    assert!(report.stop, "session missing => stop=true (break main loop)");
+    assert_eq!(
+        report.reason,
+        Some(TickStopReason::TmuxSessionMissing),
+        "reason=tmux_session_missing"
+    );
+}
+
+#[test]
+fn tick_side_effect_order_is_the_fixed_sequence() {
+    // lifecycle.py:273-372 — the tick chained side-effect ORDER is fixed:
+    //   load_state -> tmux_session_gate -> capture_missing -> refresh_statuses ->
+    //   startup_prompts -> runtime_prompts -> sync_health -> deliver_pending ->
+    //   fire_scheduled -> detect_stuck -> record_unknown_idle -> evaluate_takeover ->
+    //   detect_deadlocks -> detect_compaction -> detect_drift -> detect_api_errors ->
+    //   ATOMIC_save (bug-084 wrap) -> collect_results -> prune_dedupe_log.
+    // The porter must push each step name into the injected recorder at its call site.
+    let recorder: OrderRecorder =
+        std::sync::Arc::new(std::sync::Mutex::new(Vec::new()));
+    let (coord, _calls) = coord_for_test(true, None, Some(std::sync::Arc::clone(&recorder)));
+    let _ = coord.tick().expect("tick ok");
+    let order = recorder.lock().unwrap().clone();
+    let expected = vec![
+        "load_state",
+        "tmux_session_gate",
+        "capture_missing",
+        "refresh_statuses",
+        "startup_prompts",
+        "runtime_prompts",
+        "sync_health",
+        "deliver_pending",
+        "fire_scheduled",
+        "detect_stuck",
+        "record_unknown_idle",
+        "evaluate_takeover",
+        "detect_deadlocks",
+        "detect_compaction",
+        "detect_drift",
+        "detect_api_errors",
+        "atomic_save",
+        "collect_results",
+        "prune_dedupe_log",
+    ];
+    assert_eq!(order, expected, "tick side-effect ORDER must match the fixed sequence");
+    // ATOMIC save is the LAST mutation before read-only collect/prune (bug-084 wrap point).
+    let save_idx = order.iter().position(|s| *s == "atomic_save").unwrap();
+    let collect_idx = order.iter().position(|s| *s == "collect_results").unwrap();
+    assert!(save_idx < collect_idx, "save precedes collect (bug-084 wrap is the last mutation)");
+}
+
+#[test]
+fn tick_zero_provider_sdk_across_full_tick() {
+    // §84 / MUST-NOT-13: a full no-obligation tick injects ZERO exploratory prompts and
+    // touches NO provider client. MockTransport::inject is unimplemented!() (would panic if
+    // reached); a clean tick must therefore NEVER call inject. (The MockRegistry adapter
+    // count is asserted via the GROUP E abnormal path; here the no-inject Transport guards
+    // the tick-level §84 obligation.)
+    let (coord, calls) = coord_for_test(true, None, None);
+    let _ = coord.tick().expect("clean tick ok");
+    let names = calls.lock().unwrap().clone();
+    assert!(
+        !names.contains(&"inject"),
+        "§84: no exploratory prompt injected across a no-obligation tick"
+    );
+}
+
+#[test]
+fn health_ok_is_conjunction_of_running_metadata_ok_and_schema_ok() {
+    // lifecycle.py:38 — ok = running ∧ metadata_ok ∧ schema_ok. A fresh temp workspace has
+    // NO coordinator.pid => status Missing, ok=false (not running). health() must return a
+    // typed HealthReport, never panic.
+    let (coord, _calls) = coord_for_test(true, None, None);
+    let h = coord.health().expect("health is a typed report");
+    assert!(!h.ok, "no pid file => not running => ok=false");
+    assert_eq!(h.status, CoordinatorHealthStatus::Missing, "no pid => status=missing");
+    assert!(!h.metadata_ok, "no metadata => metadata_ok=false");
+}
+
+#[test]
+fn stop_of_missing_coordinator_returns_missing_outcome() {
+    // lifecycle.py:230-232 — no coordinator.pid => StopOutcome::Missing, ok=true (nothing to do).
+    let (coord, _calls) = coord_for_test(true, None, None);
+    let r = coord.stop().expect("stop is a typed report");
+    assert_eq!(r.status, StopOutcome::Missing, "no pid => missing");
+    assert_eq!(r.pid, None);
+}
+
+// ═════════════════════════════════════════════════════════════════════════
+// GROUP K — pid_is_running (metadata.py:16) — zombie detection — RED
+// ═════════════════════════════════════════════════════════════════════════
+
+#[test]
+fn pid_is_running_false_for_impossible_pid() {
+    // metadata.py:19-21 — os.kill(pid, 0) raises → False. pid 0/巨大 pid 不存在。
+    let alive = pid_is_running(Pid(2_000_000_000)).expect("probe returns Result");
+    assert!(!alive, "non-existent pid → not running");
+}
+
+#[test]
+fn pid_is_running_true_for_self() {
+    // current process is alive & not zombie → true.
+    let me = std::process::id();
+    let alive = pid_is_running(Pid(me)).expect("probe self");
+    assert!(alive, "self pid is running");
+}
+
+// ═════════════════════════════════════════════════════════════════════════
+// GROUP L — resolve_tick_interval fallback (__main__.py:104) — RED
+// ═════════════════════════════════════════════════════════════════════════
+
+#[test]
+fn resolve_tick_interval_defaults_to_five() {
+    // __main__.py:110-115 — missing/erroring spec → DEFAULT_TICK_INTERVAL_SEC (5.0).
+    let w = ws();
+    let interval = resolve_tick_interval(&w).expect("returns Result");
+    assert_eq!(interval, DEFAULT_TICK_INTERVAL_SEC);
+}
+
+#[test]
+fn read_coordinator_metadata_missing_file_is_none() {
+    // metadata.py:30-34 — OSError/JSONDecodeError/非 dict → None.
+    let w = WorkspacePath::new("/tmp/team-agent-NONEXISTENT-meta-read-xyz");
+    assert_eq!(read_coordinator_metadata(&w), None);
+}
+
+// ═══════════════ P2 FIX-LOOP RED (复绿即对抗 cross-model findings) ═══════════════
+// Golden re-probed vs team-agent-public @ 439bef8 (lifecycle/metadata/watch/abnormal_track).
+
+// P0 — a fresh state has session_name:null. Python truthiness skips the tmux gate entirely
+// (only probes when session_name is a non-empty string); the daemon proceeds. Current
+// defaults to "team-agent" and, with the session absent, stops the daemon (stop:true).
+#[test]
+fn p2_tick_skips_tmux_gate_when_session_name_absent() {
+    let (coord, _calls) = coord_for_test(false, None, None);
+    let report = coord.tick().unwrap();
+    assert!(!report.stop, "missing/null session_name must skip the gate, not stop the daemon");
+    assert_ne!(report.reason, Some(TickStopReason::TmuxSessionMissing));
+}
+
+// P1 — pid_is_running must use os.kill(pid,0) first: a pid owned by another user (pid 1 /
+// launchd, root) is EPERM → not signalable → False. Current only `ps -p` (rc=0) → True.
+#[test]
+fn p2_pid_is_running_false_for_cross_user_pid() {
+    // The cross-user semantics only hold for a non-root caller (root CAN signal pid 1).
+    if unsafe { libc::geteuid() } != 0 {
+        assert!(
+            !pid_is_running(Pid(1)).expect("probe pid 1"),
+            "pid 1 (root-owned) must read as not-running for a non-root caller (kill EPERM)"
+        );
+    }
+}
+
+// P1 — render_event_line(result_received) truncates the summary to 80 chars
+// (watch.py:115-116 `_clean(summary)[:80]`).
+#[test]
+fn p2_render_result_received_truncates_summary_to_80_chars() {
+    let long = "x".repeat(200);
+    let e = serde_json::json!({"event":"result_received","agent_id":"w1","summary": long});
+    let line = render_event_line(&e).expect("renders");
+    assert!(line.contains(&"x".repeat(80)), "first 80 summary chars are kept");
+    assert!(!line.contains(&"x".repeat(81)), "summary must be truncated to 80 chars");
+}
+
+// P1 — idle_takeover.unknown_persistent must carry the auth_mode field (null when absent)
+// (lifecycle.py:401-408). NOTE: the variant currently lacks the field; the porter adds
+// `auth_mode` between provider and consecutive_ticks and updates this construction.
+#[test]
+fn p2_unknown_persistent_event_serializes_auth_mode_key() {
+    let evt = CoordinatorEvent::IdleTakeoverUnknownPersistent {
+        node_id: "w7".into(),
+        provider: None,
+        auth_mode: None,
+        consecutive_ticks: 72,
+        rollout_path: None,
+    };
+    let json = serde_json::to_value(&evt).unwrap();
+    assert!(
+        json.get("auth_mode").is_some(),
+        "idle_takeover.unknown_persistent must serialize an auth_mode key (null when absent)"
+    );
+}
+
+// P1 — process_abnormal_records matches a LOWERCASED signature too (abnormal_track.py:49,198):
+// raw has no needle but signature 'TimeoutError' matches blacklist 'timeout'. Current is
+// case-sensitive on `raw` only and ignores the signature → NotifyDefault.
+#[test]
+fn p2_abnormal_matches_lowercased_signature_too() {
+    let reg = MockRegistry::new(&[], &["timeout"]);
+    let records = vec![serde_json::json!({"raw":"nothing here","signature":"TimeoutError","kind":"error"})];
+    let out = process_abnormal_records(
+        &records,
+        &reg,
+        Provider::Codex,
+        &AbnormalNotificationState::default(),
+    )
+    .unwrap();
+    assert_eq!(out.notifications.len(), 1);
+    assert_eq!(
+        out.notifications[0].decision,
+        AbnormalDecision::NotifyBlacklist,
+        "blacklist 'timeout' must match the lowercased signature 'TimeoutError'"
+    );
+}

package/crates/team-agent/src/coordinator/tests/watch.rs

@@ -0,0 +1,167 @@
+use super::*;
+
+// ═════════════════════════════════════════════════════════════════════════
+// GROUP G — watch render_event_line (watch.py:46) — golden text — RED
+//   exact strings captured via PYTHONPATH probe against v0.2.11.
+// ═════════════════════════════════════════════════════════════════════════
+
+#[test]
+fn render_result_received_collapses_whitespace_and_defaults() {
+    // watch.py:48-49 + _result_line — "result_received: <agent|-> -> <clean summary>".
+    let e = serde_json::json!({"event": "result_received", "agent_id": "w1", "summary": "did   the\nthing"});
+    assert_eq!(render_event_line(&e), Some("result_received: w1 -> did the thing".to_string()));
+    // missing agent + summary → both '-'.
+    let bare = serde_json::json!({"event": "result_received"});
+    assert_eq!(render_event_line(&bare), Some("result_received: - -> -".to_string()));
+}
+
+#[test]
+fn render_injected_and_submitted_share_prefix_and_truncate_message_id() {
+    // watch.py:50-51 — both render as "leader_receiver.injected"; message_id truncated to 12.
+    let inj = serde_json::json!({"event": "leader_receiver.injected", "message_id": "abcdef0123456789", "recipient": "w2"});
+    assert_eq!(render_event_line(&inj), Some("leader_receiver.injected: abcdef012345 -> w2".to_string()));
+    // submitted uses same label, msg_id fallback, `to` recipient fallback.
+    let sub = serde_json::json!({"event": "leader_receiver.submitted", "msg_id": "xy", "to": "w3"});
+    assert_eq!(render_event_line(&sub), Some("leader_receiver.injected: xy -> w3".to_string()));
+}
+
+#[test]
+fn render_send_failed_uses_reason_then_error_fallback() {
+    // watch.py:52-53 — reason || error || '-', recipient || to || target || '-', whitespace-cleaned.
+    let with_reason = serde_json::json!({"event": "send.failed", "recipient": "w4", "reason": "  pane   gone  "});
+    assert_eq!(render_event_line(&with_reason), Some("send.failed: w4 reason=pane gone".to_string()));
+    let with_error = serde_json::json!({"event": "send.failed", "target": "w5", "error": "boom"});
+    assert_eq!(render_event_line(&with_error), Some("send.failed: w5 reason=boom".to_string()));
+}
+
+#[test]
+fn render_rebind_required_uses_pane_and_reason_fallbacks() {
+    // watch.py:54-57 — old_pane_id || pane_id || target || '-'; reason || rediscovery_status || '-'.
+    let e = serde_json::json!({"event": "leader_receiver.rebind_required", "old_pane_id": "%9", "reason": "lost"});
+    assert_eq!(render_event_line(&e), Some("leader_receiver.rebind_required: pane=%9 reason=lost".to_string()));
+    let no_reason = serde_json::json!({"event": "leader_receiver.rebind_required", "pane_id": "%7"});
+    assert_eq!(render_event_line(&no_reason), Some("leader_receiver.rebind_required: pane=%7 reason=-".to_string()));
+}
+
+#[test]
+fn render_api_error_defaults_unknown_class_and_dash() {
+    // watch.py:58-62 — error_class || "Unknown"; provider || '-'; snippet || '-' cleaned.
+    let e = serde_json::json!({"event": "leader.api_error", "error_class": "Overloaded", "provider": "claude_code", "matched_pattern_snippet": "529  too  many"});
+    assert_eq!(render_event_line(&e), Some("leader.api_error: Overloaded provider=claude_code snippet=529 too many".to_string()));
+    let bare = serde_json::json!({"event": "leader.api_error"});
+    assert_eq!(render_event_line(&bare), Some("leader.api_error: Unknown provider=- snippet=-".to_string()));
+}
+
+#[test]
+fn render_non_renderable_events_return_none() {
+    // watch.py:63 — coordinator.* / unknown events → None.
+    assert_eq!(render_event_line(&serde_json::json!({"event": "coordinator.boot"})), None);
+    assert_eq!(render_event_line(&serde_json::json!({"event": "unknown.thing"})), None);
+}
+
+// ═════════════════════════════════════════════════════════════════════════
+// GROUP H — WatchCursor rotation invariants (watch.py:66-97) — RED via collect_watch_lines
+// ═════════════════════════════════════════════════════════════════════════
+
+#[test]
+fn watch_cursor_default_is_uninitialized() {
+    let c = WatchCursor::default();
+    assert_eq!(c.event_offset, 0);
+    assert!(!c.initialized);
+    assert!(c.archive_signature.is_none());
+    assert!(c.seen_result_ids.is_empty());
+}
+
+/// seed a workspace with an `events.jsonl` (+ optional archived `events.jsonl.1`).
+/// Returns the resolved `WorkspacePath`. The events file holds one renderable
+/// `result_received` line so `collect_watch_lines` has observable non-marker output.
+fn seed_watch_workspace(event_summary: &str, archive_bytes: Option<&[u8]>) -> WorkspacePath {
+    let dir = std::env::temp_dir().join(format!(
+        "team-agent-watch-rotate-{}-{}",
+        std::process::id(),
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .unwrap()
+            .as_nanos()
+    ));
+    let logs = crate::model::paths::logs_dir(&dir);
+    std::fs::create_dir_all(&logs).unwrap();
+    let line = serde_json::json!({"event": "result_received", "agent_id": "w1", "summary": event_summary});
+    std::fs::write(
+        logs.join("events.jsonl"),
+        format!("{}\n", serde_json::to_string(&line).unwrap()),
+    )
+    .unwrap();
+    if let Some(bytes) = archive_bytes {
+        std::fs::write(logs.join("events.jsonl.1"), bytes).unwrap();
+    }
+    // MessageStore::open creates the schema so collect_watch_lines' result tail works.
+    let _ = MessageStore::open(&dir).unwrap();
+    WorkspacePath::new(dir)
+}
+
+#[test]
+fn watch_rotation_emits_marker_once_resets_offset_and_does_not_replay() {
+    // watch/__init__.py:66-97 — archive_signature change OR offset>size => ROTATION_MARKER
+    // (once), event_offset reset to 0, archived segment NOT replayed (only the current
+    // events.jsonl is read from the new offset forward). The doc-comment invariant
+    // (coordinator.rs lines 42-43 / 532-533) is now ASSERTED, not commented.
+    let ws = seed_watch_workspace("first segment", None);
+    let store = MessageStore::open(ws.as_path()).unwrap();
+    let mut cursor = WatchCursor::default();
+
+    // First call: initializes the cursor (no marker even though no archive yet),
+    // renders the seeded result line, advances offset past EOF.
+    let first = collect_watch_lines(&ws, &mut cursor, &store, None).unwrap();
+    assert!(cursor.initialized, "first call initializes the cursor");
+    assert!(
+        !first.iter().any(|l| l == ROTATION_MARKER),
+        "no rotation marker on first/initializing call"
+    );
+    assert!(
+        first.iter().any(|l| l.contains("first segment")),
+        "first segment line is rendered exactly once"
+    );
+    let offset_after_first = cursor.event_offset;
+    assert!(offset_after_first > 0, "offset advanced past the consumed segment");
+
+    // Simulate rotation: an archive segment now appears (archive_signature changes from
+    // None -> Some), and the live events.jsonl is replaced with a fresh, SHORTER file
+    // whose new content must NOT include the archived "first segment".
+    let logs = crate::model::paths::logs_dir(ws.as_path());
+    std::fs::write(logs.join("events.jsonl.1"), b"archived old bytes that must never replay\n")
+        .unwrap();
+    let fresh = serde_json::json!({"event": "result_received", "agent_id": "w1", "summary": "post rotation"});
+    std::fs::write(
+        logs.join("events.jsonl"),
+        format!("{}\n", serde_json::to_string(&fresh).unwrap()),
+    )
+    .unwrap();
+
+    let second = collect_watch_lines(&ws, &mut cursor, &store, None).unwrap();
+    let marker_count = second.iter().filter(|l| **l == ROTATION_MARKER).count();
+    assert_eq!(marker_count, 1, "ROTATION_MARKER emitted exactly once on rotation");
+    assert!(
+        !second.iter().any(|l| l.contains("first segment")),
+        "archived segment is NOT replayed"
+    );
+    assert!(
+        !second.iter().any(|l| l.contains("old bytes that must never replay")),
+        "archive file contents are NEVER read/replayed"
+    );
+    assert!(
+        second.iter().any(|l| l.contains("post rotation")),
+        "post-rotation live segment IS rendered (read from reset offset forward)"
+    );
+    // offset was reset to 0 by the rotation branch, then re-advanced over the fresh
+    // (shorter) file — so it must be < the pre-rotation offset, proving the reset.
+    assert!(
+        cursor.event_offset <= offset_after_first,
+        "event_offset reset on rotation (re-advanced over the shorter fresh file)"
+    );
+    assert_eq!(
+        cursor.archive_signature.map(|(sz, _)| sz),
+        Some(b"archived old bytes that must never replay\n".len() as u64),
+        "archive_signature updated to the new archived segment's (size, mtime_ns)"
+    );
+}