@team-agent/installer 0.3.26 → 0.3.28

package/crates/team-agent/src/leader/tests/identity.rs

@@ -66,20 +66,23 @@ use super::*;
         let plan = leader_start_plan(Provider::Fake, &[], &ws, false, false, None, false).unwrap();
         assert_eq!(plan.provider, Provider::Fake);
         assert_eq!(plan.mode, LeaderStartMode::ManagedTmuxClient);
+        // 0.3.28 Step 2: managed mode now uses the dedicated leader session
+        // (`team-agent-leader-<provider>-<folder>-<sha1[:8]>`), not the worker
+        // session `team-<team_id>`. Python parity.
+        let session_name = plan.session_name.as_ref().map(SessionName::as_str).unwrap_or("");
+        assert!(
+            session_name.starts_with(crate::layout::sessions::LEADER_SESSION_PREFIX),
+            "managed mode must use dedicated leader session prefix; got `{session_name}`"
+        );
+        // 0.3.28 Step 2: window name = provider wire (`fake`), not `leader`.
         assert_eq!(
-            plan.session_name.as_ref().map(SessionName::as_str),
-            Some("team-current")
+            plan.leader_window.as_ref().map(WindowName::as_str),
+            Some("fake")
         );
-        assert_eq!(plan.leader_window.as_ref().map(WindowName::as_str), Some("leader"));
         assert!(!plan.is_external_leader);
         assert!(
             plan.argv.iter().any(|arg| arg == "attach-session"),
-            "no-tmux managed launch attaches the user client to the team leader window: {:?}",
-            plan.argv
-        );
-        assert!(
-            plan.argv.iter().any(|arg| arg == "team-current:leader"),
-            "managed client target must be the team leader window: {:?}",
+            "no-tmux managed launch attaches the user client to the leader window: {:?}",
             plan.argv
         );
         // plan 边界 detached 恒 false(`-d` 插入在 start_leader 层,非此处)。
@@ -126,7 +129,12 @@ use super::*;
 
     #[test]
     #[serial_test::serial(env)]
-    fn managed_leader_reuses_existing_team_session_name_without_double_prefix() {
+    fn managed_leader_uses_dedicated_leader_session_independent_of_state_session_name() {
+        // 0.3.28 Step 2 amendment: the persisted `session_name` is the WORKER
+        // session, not the leader session. Managed leader now ignores it and
+        // always uses the dedicated `leader_session_name(provider, workspace)`.
+        // This test pins the new behaviour and the regression guard that the
+        // managed argv never gets a `team-team-*` double prefix.
         let _g = ENV_LOCK.lock().unwrap_or_else(|p| p.into_inner());
         let _e = EnvGuard::apply(&[("TMUX", None), ("TMUX_PANE", None)]);
         let ws = std::env::temp_dir().join(format!("ta_rs_lsp_existing_{}", std::process::id()));
@@ -140,9 +148,11 @@ use super::*;
         let plan = leader_start_plan(Provider::Fake, &[], &ws, false, false, None, false).unwrap();
 
         assert_eq!(plan.mode, LeaderStartMode::ManagedTmuxClient);
-        assert_eq!(
-            plan.session_name.as_ref().map(SessionName::as_str),
-            Some("team-alpha")
+        let session_name = plan.session_name.as_ref().map(SessionName::as_str).unwrap_or("");
+        assert!(
+            session_name.starts_with(crate::layout::sessions::LEADER_SESSION_PREFIX),
+            "managed mode uses dedicated leader session prefix regardless of \
+             persisted worker session_name; got `{session_name}`"
         );
         assert!(
             !plan.argv.iter().any(|arg| arg.contains("team-team-alpha")),
@@ -169,9 +179,14 @@ use super::*;
             "same-server managed launch must switch the existing tmux client: {:?}",
             plan.argv
         );
+        // 0.3.28 Step 2: target is `<dedicated_leader_session>:<provider_wire>`,
+        // not `team-current:leader`.
+        let session_name = plan.session_name.as_ref().map(SessionName::as_str).unwrap_or("");
+        let expected_target = format!("{session_name}:fake");
         assert!(
-            plan.argv.iter().any(|arg| arg == "team-current:leader"),
-            "managed switch target must be the team leader window: {:?}",
+            plan.argv.iter().any(|arg| arg == &expected_target),
+            "managed switch target must be the dedicated leader-session leader \
+             window `{expected_target}`; got argv {:?}",
             plan.argv
         );
     }

package/crates/team-agent/src/lib.rs

@@ -74,6 +74,9 @@ pub mod diagnose;
 // 富返回类型,fn body unimplemented!(),P2 porter 落实现)。lifecycle=quick-start/restart/display;
 // mcp_server=stdio MCP tool handlers;cli=clap 子命令;packaging=install/migrate/repair。
 pub mod lifecycle;
+// 0.3.28 — unified adaptive layout manager (single source of truth for tmux
+// topology decisions). See `.team/artifacts/adaptive-layout-full-architecture-locate.md`.
+pub mod layout;
 pub mod mcp_server;
 pub mod cli;
 pub mod packaging;

package/crates/team-agent/src/lifecycle/launch.rs

@@ -119,6 +119,15 @@ pub fn launch_with_transport_in_workspace(
         )?;
         started
     };
+    // 0.3.28 Step 1: topology invariant guard (warn-only during migration).
+    // Logs each violation to stderr; never panics. Promoted to hard error at
+    // Step 10 once Steps 2–9 have eliminated structural co-location.
+    if !dry_run {
+        if let Ok(state_for_check) = crate::state::persist::load_runtime_state(workspace) {
+            let violations = crate::layout::sessions::assert_topology_invariants(&state_for_check, &spec);
+            crate::layout::sessions::log_topology_violations(&violations);
+        }
+    }
     Ok(LaunchReport {
         session_name,
         started,
@@ -364,46 +373,17 @@ fn spawn_agents(
                 }),
             );
         }
-        let placement = layout_plan
-            .iter()
-            .find(|placement| placement.agent_id == agent_id)
-            .cloned();
-        let window = placement
-            .as_ref()
-            .map(|placement| placement.layout_window.clone())
-            .unwrap_or_else(|| WindowName::new(agent_id_raw));
-        let spawn = if let Some(placement) = placement.as_ref() {
-            if placement.starts_window {
-                if started.is_empty() {
-                    transport.spawn_first_with_env_unset(
-                        session_name,
-                        &window,
-                        &plan.argv,
-                        workspace,
-                        &env,
-                        &env_unset,
-                    )
-                } else {
-                    transport.spawn_into_with_env_unset(
-                        session_name,
-                        &window,
-                        &plan.argv,
-                        workspace,
-                        &env,
-                        &env_unset,
-                    )
-                }
-            } else {
-                transport.spawn_split_with_env_unset(
-                    session_name,
-                    &window,
-                    &plan.argv,
-                    workspace,
-                    &env,
-                    &env_unset,
-                )
-            }
-        } else if started.is_empty() {
+        // 0.3.28 Step 4b: replaced the `adaptive_layout_plan` 3-pane tiling
+        // with Python-parity 1-window-per-agent placement. Window name =
+        // `agent_id`; first worker creates the session via spawn_first,
+        // subsequent workers each get a new window via spawn_into. No splits
+        // in the worker session — Step 8's `assert_overlay_call_site` would
+        // catch any drift if a split call snuck back in. The `placement`
+        // variable is set to None to signal "no adaptive layout" to all
+        // downstream consumers (display dict, layout_window persistence).
+        let placement: Option<LayoutPlacement> = None;
+        let window = WindowName::new(agent_id_raw);
+        let spawn = if started.is_empty() {
             transport.spawn_first_with_env_unset(
                 session_name,
                 &window,
@@ -2041,30 +2021,25 @@ pub(crate) fn inherited_env_with_team_overrides(
     agent_id: &str,
     team_id: Option<&str>,
 ) -> BTreeMap<String, String> {
-    // Only POSIX-valid shell identifier keys ([A-Za-z_][A-Za-z0-9_]*) — Bash/dash refuses
-    // `KEY=val` assignment whose KEY has dashes/dots (e.g. `CARGO_BIN_EXE_team-agent=...`
-    // shipped by cargo's integration-test runner) and would fail the entire `sh -lc`
-    // line, leaving tmux's session dead-on-arrival. POSIX-invalid keys are runtime
-    // metadata that workers never legitimately need; the user's PATH/proxy/CA always use
-    // valid identifiers.
-    let mut env: BTreeMap<String, String> = std::env::vars()
-        .filter(|(k, _)| is_posix_shell_identifier(k))
-        .collect();
-    env.remove("TMUX");
-    env.remove("TMUX_PANE");
-    env.insert(
-        "TEAM_AGENT_WORKSPACE".to_string(),
-        workspace.to_string_lossy().to_string(),
-    );
-    // Python providers.py:131 — TEAM_AGENT_ID must be the worker ITSELF, overriding any
-    // value inherited from the launching process (an add-agent/fork issued from another
-    // worker's MCP server carries the CALLER's TEAM_AGENT_ID in its environ).
-    env.insert("TEAM_AGENT_ID".to_string(), agent_id.to_string());
-    env.insert("TEAM_AGENT_AGENT_ID".to_string(), agent_id.to_string());
-    if let Some(tid) = team_id.filter(|s| !s.is_empty()) {
-        env.insert("TEAM_AGENT_OWNER_TEAM_ID".to_string(), tid.to_string());
-    }
-    env
+    // 0.3.28 Step 3: delegate to `layout::worker_env::worker_spawn_env` which
+    // implements Python's whitelist semantics (`providers.py:130-145`). The
+    // whitelist:
+    //   * Keeps PATH-like vars, locale, provider creds (CLAUDE_*/OPENAI_*/
+    //     COPILOT_*/GH_*/GEMINI_*/GOOGLE_*) + posix identifiers only.
+    //   * Strips ALL `TEAM_AGENT_LEADER_*` and
+    //     `TEAM_AGENT_MACHINE_FINGERPRINT` (leader identity contamination,
+    //     E60 root).
+    //   * Strips `TEAM_AGENT_TEAM_ID` (the leader's team_id — re-injected
+    //     as `TEAM_AGENT_OWNER_TEAM_ID` for the worker).
+    //   * Strips `COPILOT_DISABLE_TERMINAL_TITLE` (re-injected per-agent by
+    //     `apply_copilot_instructions_overlay` based on the WORKER's provider).
+    //   * Strips `TMUX` / `TMUX_PANE` (would attach worker to leader's pane).
+    crate::layout::worker_env::worker_spawn_env(
+        std::env::vars(),
+        workspace,
+        agent_id,
+        team_id,
+    )
 }
 
 pub(crate) fn apply_mcp_auto_approval_env(
@@ -3292,6 +3267,13 @@ fn dangerous_leader_flags() -> &'static [(&'static str, &'static str)] {
         ("claude", "--dangerously-skip-permissions"),
         ("claude", "--dangerously-skip-permission"),
         ("codex", "--dangerously-bypass-approvals-and-sandbox"),
+        // 0.3.27 P1 (E54 symptom 2): copilot's full-permission flags. Without
+        // these entries, a copilot leader running with --allow-all / --yolo would
+        // NOT propagate bypass to claude/codex workers because
+        // detect_dangerous_approval scans the coordinator's ancestor argv and
+        // only matches entries in THIS table.
+        ("copilot", "--allow-all"),
+        ("copilot", "--yolo"),
     ]
 }
 
@@ -3299,6 +3281,8 @@ fn binary_matches_provider(provider: &str, binary: Option<&str>) -> bool {
     match (provider, binary) {
         ("codex", Some("codex")) => true,
         ("claude", Some("claude" | "claude-code" | "claude_code")) => true,
+        // 0.3.27 P1 (E54): copilot binary detection for dangerous-approval scan.
+        ("copilot", Some("copilot" | "github-copilot" | "gh-copilot")) => true,
         _ => false,
     }
 }
@@ -4778,6 +4762,13 @@ fn spec_session_name(spec: &Value) -> SessionName {
     SessionName::new(format!("team-{team_name}"))
 }
 
+/// 0.3.28 layout step 1: pub re-export of `spec_session_name` for the new
+/// `layout::sessions::worker_session_name` to delegate to. Single underlying
+/// impl; this just widens visibility without duplicating logic.
+pub fn worker_session_name_pub(spec: &Value) -> SessionName {
+    spec_session_name(spec)
+}
+
 fn spec_agents(spec: &Value) -> Vec<AgentId> {
     spec_agent_values(spec)
         .into_iter()

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -95,16 +95,24 @@ pub(crate) fn start_agent_at_paths(
     } else {
         window_exists(transport, &session_name, &window)
     };
-    // E51 (0.3.26 P0, restart self-heal): even if the pane is structurally
-    // alive, it must not be considered "this agent's pane" if it's actually
-    // the leader anchor pane or another agent's pane. When lease corruption
-    // (E51 root cause) left `agent.pane_id == leader_receiver.pane_id`,
-    // start_agent would short-circuit to Noop (the pane IS live — it's just
-    // the wrong pane). Force a fresh spawn by treating the pane as not-live
-    // when it conflicts with the leader or a different agent.
-    let agent_live = agent_live && !pane_conflicts_with_leader_or_other(
-        &state, agent_id, &agent,
-    );
+    // 0.3.28 Step 9: E51 self-heal converted to topology assertion. After
+    // Step 2 the leader lives in its own session (`team-agent-leader-*`),
+    // so `agent.pane_id == leader_receiver.pane_id` is STRUCTURALLY
+    // impossible. We keep the check as a runtime guard: if it ever fires,
+    // emit a topology_invariant_violation event AND still force a fresh
+    // spawn (defensive). The check itself remains a no-op on healthy
+    // state — assert_topology_invariants from Step 1 catches the
+    // upstream corruption.
+    let has_collision = pane_conflicts_with_leader_or_other(&state, agent_id, &agent);
+    if has_collision {
+        eprintln!(
+            "team_agent::layout e51_collision_post_step2 agent_id=`{agent_id}` \
+             action=forcing_fresh_spawn \
+             (should be impossible after Step 2 leader/worker session separation; \
+              investigate upstream state corruption)"
+        );
+    }
+    let agent_live = agent_live && !has_collision;
     if !force && agent_live {
         mark_agent_running_noop(&mut state, agent_id, &session_name, &window)?;
         let team_key = restart_projection_team_key(&state, team);

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -126,15 +126,19 @@ pub(super) fn spawn_agent_window(
     );
     crate::lifecycle::launch::apply_profile_launch_env(&mut env, &profile_launch);
     crate::lifecycle::launch::apply_mcp_auto_approval_env(&mut env, safety);
-    let spawn_cwd = spawn_cwd_override
-        .or_else(|| {
-            agent
-                .get("spawn_cwd")
-                .and_then(|v| v.as_str())
-                .filter(|cwd| !cwd.is_empty())
-                .map(Path::new)
-        })
-        .unwrap_or(workspace);
+    // 0.3.28 Step 3: per Python parity, worker spawn cwd is ALWAYS `workspace`.
+    // The persisted-state `agent.spawn_cwd` override is ignored (it was a
+    // Rust-only extension that drifted to `.team/runtime/<team_key>/` after
+    // rebuild.rs:138 — root cause of E56). The `spawn_cwd_override` parameter
+    // is still honoured for callers that need an explicit cwd (e.g. spec
+    // YAML-resolved cwd at first launch in `lifecycle/launch.rs`), but
+    // restart never passes it (see commit 71864c0 which fixed rebuild.rs:297
+    // to stop pinning `.team/runtime/<team_key>/`).
+    //
+    // NOTE: Step 4 will thread the YAML spec down to here so we can honour
+    // a per-agent YAML `spawn_cwd` field if one is set. Until then, override
+    // > workspace; state-based override is silently dropped.
+    let spawn_cwd = spawn_cwd_override.unwrap_or(workspace);
     let env_unset: Vec<String> = profile_launch.env_unset.iter().cloned().collect();
     let result = if let Some(placement) = layout_placement {
         if placement.starts_window {
@@ -181,6 +185,9 @@ pub(super) fn spawn_agent_window(
                 &env_unset,
             )
         } else {
+            // 0.3.28 Step 8: spawn_split must only fire from the display
+            // overlay path. Warn-only here; Step 9 promotes to hard fail.
+            crate::layout::overlay::assert_overlay_call_site(session_name, &window);
             transport.spawn_split_with_env_unset(
                 session_name,
                 &window,

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -213,6 +213,27 @@ pub fn restart_with_transport_with_session_convergence_deadline(
     }
     let session_name = state_session_name(&state);
     if session_live_or_default(transport, &session_name, false) {
+        // 0.3.28 Step 5 (warn-only): per architecture, restart should REFUSE
+        // when the worker session is live (Python `restart/orchestration.py:79-85`
+        // raises `_tmux_session_conflict_error`). Pre-0.3.28 Rust kills the
+        // worker session here — which under the old co-located topology also
+        // killed the leader pane (the E57-1 cascade contribution from the
+        // layout layer).
+        //
+        // After Step 2 the leader lives in a DIFFERENT session
+        // (`team-agent-leader-...`), so killing the worker session no longer
+        // tears down the leader. That makes this kill structurally safe, but
+        // it still loses provider session state in the worker panes.
+        //
+        // Full "refuse" semantics will land once Steps 6+7 expose the
+        // recovery path so users have a clean alternative. For now we emit
+        // the warn-only event so operators see the drift in event logs.
+        eprintln!(
+            "team_agent::layout restart_precondition_warning worker_session=`{}` action=killing \
+             (post-Step-7 will refuse and direct user to recover; safe today because Step 2 \
+             moved leader to dedicated session)",
+            session_name.as_str()
+        );
         transport
             .kill_session(&session_name)
             .map_err(|e| LifecycleError::Transport(e.to_string()))?;
@@ -426,6 +447,11 @@ pub fn restart_with_transport_with_session_convergence_deadline(
         &failed_agents,
         "ok",
     )?;
+    // 0.3.28 Step 1: topology invariant guard (warn-only). Same pattern as
+    // `lifecycle::launch::launch_with_transport_in_workspace` — logs to stderr,
+    // never panics. Hard error path is deferred to Step 10.
+    let violations = crate::layout::sessions::assert_topology_invariants(&state, &spec);
+    crate::layout::sessions::log_topology_violations(&violations);
     Ok(RestartReport::Restarted {
         session_name,
         agents: successful_agents,

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -1108,56 +1108,18 @@ fn quick_start_default_adaptive_groups_workers_into_layout_panes() {
         }
         other => panic!("quick_start must reach Ready; got {other:?}"),
     };
-    assert_eq!(display_backend, "adaptive");
+    // 0.3.28 Step 4b: adaptive 3-pane tiling replaced with 1-window-per-agent
+    // Python-parity layout. 4 workers → spawn_first + 3×spawn_into, each in its
+    // own window named after the agent_id. No team-w<N> windows; no splits.
     assert_eq!(
         transport
             .spawn_records()
             .iter()
             .map(|(kind, _)| kind.as_str())
             .collect::<Vec<_>>(),
-        vec!["spawn_first", "spawn_split", "spawn_split", "spawn_into"],
-        "4 default-adaptive workers should create team-w1 with 3 panes, then team-w2"
-    );
-    assert_eq!(
-        transport
-            .pane_title_records()
-            .iter()
-            .map(|(_, window, pane, title)| (window.as_str(), pane.as_str(), title.as_str()))
-            .collect::<Vec<_>>(),
-        vec![
-            ("team-w1", "%0", "w1"),
-            ("team-w1", "%1", "w2"),
-            ("team-w1", "%2", "w3"),
-            ("team-w2", "%3", "w4"),
-        ],
-        "adaptive workers must set tmux pane titles to the agent id"
-    );
-    assert_eq!(
-        launch
-            .started
-            .iter()
-            .map(|started| {
-                (
-                    started.agent_id.as_str().to_string(),
-                    started.layout_window.as_ref().map(|w| w.as_str().to_string()),
-                    started.pane_index,
-                )
-            })
-            .collect::<Vec<_>>(),
-        vec![
-            ("w1".to_string(), Some("team-w1".to_string()), Some(0)),
-            ("w2".to_string(), Some("team-w1".to_string()), Some(1)),
-            ("w3".to_string(), Some("team-w1".to_string()), Some(2)),
-            ("w4".to_string(), Some("team-w2".to_string()), Some(0)),
-        ]
-    );
-    assert!(
-        attach_commands.iter().any(|cmd| cmd.contains(":team-w1")),
-        "attach commands must include the first layout window: {attach_commands:?}"
-    );
-    assert!(
-        attach_commands.iter().any(|cmd| cmd.contains(":team-w2")),
-        "attach commands must include the second layout window: {attach_commands:?}"
+        vec!["spawn_first", "spawn_into", "spawn_into", "spawn_into"],
+        "0.3.28 Step 4b: 4 workers → 1 spawn_first + 3 spawn_into; \
+         no splits in worker session"
     );
 
     let (_raw, state) = raw_runtime_state(workspace);
@@ -1169,26 +1131,15 @@ fn quick_start_default_adaptive_groups_workers_into_layout_panes() {
                 == state.get("session_name").and_then(serde_json::Value::as_str)),
         "pane titles must be configured inside the team session"
     );
-    assert_eq!(state["display_backend"], json!("adaptive"));
-    assert_eq!(state.pointer("/agents/w1/window"), Some(&json!("team-w1")));
-    assert_eq!(state.pointer("/agents/w1/layout_window"), Some(&json!("team-w1")));
-    assert_eq!(state.pointer("/agents/w1/pane_index"), Some(&json!(0)));
-    assert_eq!(
-        state.pointer("/agents/w1/display/backend"),
-        Some(&json!("adaptive"))
-    );
-    assert_eq!(
-        state.pointer("/agents/w1/display/pane_title"),
-        Some(&json!("w1"))
-    );
-    assert_eq!(
-        state.pointer("/agents/w1/display/linked_session"),
-        Some(&json!(null))
-    );
-    assert_eq!(
-        state.pointer("/agents/w4/layout_window"),
-        Some(&json!("team-w2"))
+    // Each worker lives in its OWN window named `agent_id` (Python parity).
+    assert_eq!(state.pointer("/agents/w1/window"), Some(&json!("w1")));
+    assert_eq!(state.pointer("/agents/w4/window"), Some(&json!("w4")));
+    // attach commands point to the per-agent windows.
+    assert!(
+        attach_commands.iter().any(|cmd| cmd.contains(":w1")),
+        "attach commands must include the per-agent windows: {attach_commands:?}"
     );
+    let _ = display_backend; // display_backend value preserved by upstream
 }
 
 #[test]
@@ -2403,6 +2354,9 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
         .keys()
         .cloned()
         .collect::<Vec<_>>();
+    // 0.3.28 Step 4b: adaptive layout fields (layout_window, layout_index,
+    // pane_index, display) removed from running agent state — 1-window-per-agent
+    // means no layout bookkeeping needed.
     assert_eq!(
         keys,
         vec![
@@ -2421,15 +2375,11 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
             "captured_at",
             "captured_via",
             "attribution_confidence",
-            "layout_window",
-            "layout_index",
-            "pane_index",
-            "display",
             "spawn_cwd",
             "spawned_at",
             "pane_id",
         ],
-        "running agent state key order must include adaptive layout fields; raw={raw}"
+        "0.3.28 running agent state: no adaptive layout bookkeeping; raw={raw}"
     );
     assert_eq!(agent["status"], json!("running"));
     assert_eq!(agent["provider"], json!("codex"));
@@ -2437,7 +2387,7 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
     assert_eq!(agent["model"], json!("gpt-5.5"));
     assert_eq!(agent["auth_mode"], json!("subscription"));
     assert!(agent["profile"].is_null());
-    assert_eq!(agent["window"], json!("team-w1"));
+    assert_eq!(agent["window"], json!("implementer"));
     assert_eq!(
         agent["mcp_config"],
         json!(workspace
@@ -2459,12 +2409,13 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
     assert!(agent["captured_at"].is_null());
     assert!(agent["captured_via"].is_null());
     assert!(agent["attribution_confidence"].is_null());
-    assert_eq!(agent["layout_window"], json!("team-w1"));
-    assert_eq!(agent["layout_index"], json!(0));
-    assert_eq!(agent["pane_index"], json!(0));
-    assert_eq!(agent.pointer("/display/backend"), Some(&json!("adaptive")));
-    assert_eq!(agent.pointer("/display/window"), Some(&json!("team-w1")));
-    assert_eq!(agent.pointer("/display/pane_id"), Some(&json!("%0")));
+    // 0.3.28 Step 4b: layout_window/layout_index/pane_index/display removed.
+    // No adaptive bookkeeping needed — each worker has its own window named
+    // after the agent_id.
+    assert!(agent.get("layout_window").is_none());
+    assert!(agent.get("layout_index").is_none());
+    assert!(agent.get("pane_index").is_none());
+    assert!(agent.get("display").is_none());
     // D5 (#264) / Python launch/core.py:253 — fresh launch persists spawn_cwd=workspace.
     assert_eq!(agent["spawn_cwd"], json!(workspace.to_string_lossy()));
     assert_eq!(agent["spawned_at"], json!(FIXED_SPAWNED_AT));

package/crates/team-agent/src/messaging/delivery.rs

@@ -473,7 +473,8 @@ pub fn deliver_pending_message(
     Ok(outcome)
 }
 
-fn inject_submit_verified(report: &InjectReport) -> bool {
+/// 0.3.27: promoted to pub(crate) for leader_receiver.rs verification gate.
+pub(crate) fn inject_submit_verified(report: &InjectReport) -> bool {
     match report.submit_verification {
         SubmitVerification::SendKeysFailed => false,
         SubmitVerification::PastedContentPromptStillPresentAfterSubmit => false,
@@ -502,7 +503,8 @@ fn inject_submit_verified(report: &InjectReport) -> bool {
 /// `CaptureMissingToken` → readback failed → not delivered (degraded/unverified). All
 /// other inject_verification variants (incl. token-less payloads, empty sends, new
 /// pasted-content prompt) are not readback-negative and pass this gate.
-fn pane_readback_verified(report: &InjectReport) -> bool {
+/// 0.3.27: promoted to pub(crate) for leader_receiver.rs verification gate.
+pub(crate) fn pane_readback_verified(report: &InjectReport) -> bool {
     !matches!(
         report.inject_verification,
         InjectVerification::CaptureMissingToken

package/crates/team-agent/src/messaging/leader_receiver.rs

@@ -11,7 +11,7 @@ use crate::model::ids::{OwnerEpoch, TaskId};
 use crate::transport::{InjectPayload, Key, PaneId, Target, Transport};
 
 use super::helpers::MessageStatusShadow;
-use super::{DeliveryOutcome, DeliveryRefusal, DeliveryStatus, MessagingError};
+use super::{DeliveryOutcome, DeliveryRefusal, DeliveryStage, DeliveryStatus, MessagingError};
 
 /// `_send_to_leader_receiver` (`leader.py:69`) — **N31/N32 funnel primitive**:所有 leader-bound
 /// caller(send_message(to=leader) / report_result / request_human / idle reminder /
@@ -393,29 +393,66 @@ pub fn deliver_to_leader_fallback_pane(
 
     match inject_result {
         Ok(report) => {
-            store.mark(message_id, "delivered", None)?;
-            event_log.write(
-                "leader_receiver.fallback_pane_submitted",
-                serde_json::json!({
-                    "message_id": message_id,
-                    "result_id": result_id,
-                    "owner_team_id": owner_team_id,
-                    "pane_id": pane_id,
-                    "primary_error": primary_error,
-                    "delivered_via": "fallback_pane",
-                    "verification": format!("{:?}", report.submit_verification),
-                }),
-            )?;
-            Ok(DeliveryOutcome {
-                ok: true,
-                status: DeliveryStatus::Delivered,
-                message_status: MessageStatusShadow("delivered".to_string()),
-                message_id: Some(message_id.to_string()),
-                verification: Some("delivered_via=fallback_pane".to_string()),
-                stage: None,
-                reason: None,
-                channel: Some("fallback_pane".to_string()),
-            })
+            // 0.3.27 P0: leader_receiver verification gate. The pre-fix path
+            // marked every inject Ok as delivered regardless of whether the
+            // submit was actually verified. Apply the same two-gate check that
+            // deliver_pending_message uses (delivery.rs:376-381):
+            //   (a) inject_submit_verified — Enter was accepted by the TUI
+            //   (b) pane_readback_verified — token was visible in the pane
+            // Both must pass to mark delivered; otherwise degrade to
+            // submitted_unverified (loud, not silent).
+            let submit_ok = super::delivery::inject_submit_verified(&report);
+            let readback_ok = super::delivery::pane_readback_verified(&report);
+            if submit_ok && readback_ok {
+                store.mark(message_id, "delivered", None)?;
+                event_log.write(
+                    "leader_receiver.fallback_pane_submitted",
+                    serde_json::json!({
+                        "message_id": message_id,
+                        "result_id": result_id,
+                        "owner_team_id": owner_team_id,
+                        "pane_id": pane_id,
+                        "primary_error": primary_error,
+                        "delivered_via": "fallback_pane",
+                        "verification": format!("{:?}", report.submit_verification),
+                    }),
+                )?;
+                Ok(DeliveryOutcome {
+                    ok: true,
+                    status: DeliveryStatus::Delivered,
+                    message_status: MessageStatusShadow("delivered".to_string()),
+                    message_id: Some(message_id.to_string()),
+                    verification: Some("delivered_via=fallback_pane".to_string()),
+                    stage: None,
+                    reason: None,
+                    channel: Some("fallback_pane".to_string()),
+                })
+            } else {
+                let reason = format!(
+                    "fallback_pane_unverified:submit={submit_ok},readback={readback_ok},sv={:?}",
+                    report.submit_verification
+                );
+                store.mark(message_id, "submitted_unverified", Some(&reason))?;
+                event_log.write(
+                    "leader_receiver.fallback_pane_unverified",
+                    serde_json::json!({
+                        "message_id": message_id,
+                        "pane_id": pane_id,
+                        "reason": reason,
+                        "primary_error": primary_error,
+                    }),
+                )?;
+                Ok(DeliveryOutcome {
+                    ok: false,
+                    status: DeliveryStatus::Failed,
+                    message_status: MessageStatusShadow("submitted_unverified".to_string()),
+                    message_id: Some(message_id.to_string()),
+                    verification: Some(reason),
+                    stage: Some(DeliveryStage::Submit),
+                    reason: None,
+                    channel: Some("fallback_pane".to_string()),
+                })
+            }
         }
         Err(error) => {
             event_log.write(