@team-agent/installer 0.3.27 → 0.3.29

package/crates/team-agent/src/leader/tests/identity.rs

@@ -66,20 +66,23 @@ use super::*;
         let plan = leader_start_plan(Provider::Fake, &[], &ws, false, false, None, false).unwrap();
         assert_eq!(plan.provider, Provider::Fake);
         assert_eq!(plan.mode, LeaderStartMode::ManagedTmuxClient);
+        // 0.3.28 Step 2: managed mode now uses the dedicated leader session
+        // (`team-agent-leader-<provider>-<folder>-<sha1[:8]>`), not the worker
+        // session `team-<team_id>`. Python parity.
+        let session_name = plan.session_name.as_ref().map(SessionName::as_str).unwrap_or("");
+        assert!(
+            session_name.starts_with(crate::layout::sessions::LEADER_SESSION_PREFIX),
+            "managed mode must use dedicated leader session prefix; got `{session_name}`"
+        );
+        // 0.3.28 Step 2: window name = provider wire (`fake`), not `leader`.
         assert_eq!(
-            plan.session_name.as_ref().map(SessionName::as_str),
-            Some("team-current")
+            plan.leader_window.as_ref().map(WindowName::as_str),
+            Some("fake")
         );
-        assert_eq!(plan.leader_window.as_ref().map(WindowName::as_str), Some("leader"));
         assert!(!plan.is_external_leader);
         assert!(
             plan.argv.iter().any(|arg| arg == "attach-session"),
-            "no-tmux managed launch attaches the user client to the team leader window: {:?}",
-            plan.argv
-        );
-        assert!(
-            plan.argv.iter().any(|arg| arg == "team-current:leader"),
-            "managed client target must be the team leader window: {:?}",
+            "no-tmux managed launch attaches the user client to the leader window: {:?}",
             plan.argv
         );
         // plan 边界 detached 恒 false(`-d` 插入在 start_leader 层,非此处)。
@@ -126,7 +129,12 @@ use super::*;
 
     #[test]
     #[serial_test::serial(env)]
-    fn managed_leader_reuses_existing_team_session_name_without_double_prefix() {
+    fn managed_leader_uses_dedicated_leader_session_independent_of_state_session_name() {
+        // 0.3.28 Step 2 amendment: the persisted `session_name` is the WORKER
+        // session, not the leader session. Managed leader now ignores it and
+        // always uses the dedicated `leader_session_name(provider, workspace)`.
+        // This test pins the new behaviour and the regression guard that the
+        // managed argv never gets a `team-team-*` double prefix.
         let _g = ENV_LOCK.lock().unwrap_or_else(|p| p.into_inner());
         let _e = EnvGuard::apply(&[("TMUX", None), ("TMUX_PANE", None)]);
         let ws = std::env::temp_dir().join(format!("ta_rs_lsp_existing_{}", std::process::id()));
@@ -140,9 +148,11 @@ use super::*;
         let plan = leader_start_plan(Provider::Fake, &[], &ws, false, false, None, false).unwrap();
 
         assert_eq!(plan.mode, LeaderStartMode::ManagedTmuxClient);
-        assert_eq!(
-            plan.session_name.as_ref().map(SessionName::as_str),
-            Some("team-alpha")
+        let session_name = plan.session_name.as_ref().map(SessionName::as_str).unwrap_or("");
+        assert!(
+            session_name.starts_with(crate::layout::sessions::LEADER_SESSION_PREFIX),
+            "managed mode uses dedicated leader session prefix regardless of \
+             persisted worker session_name; got `{session_name}`"
         );
         assert!(
             !plan.argv.iter().any(|arg| arg.contains("team-team-alpha")),
@@ -169,9 +179,14 @@ use super::*;
             "same-server managed launch must switch the existing tmux client: {:?}",
             plan.argv
         );
+        // 0.3.28 Step 2: target is `<dedicated_leader_session>:<provider_wire>`,
+        // not `team-current:leader`.
+        let session_name = plan.session_name.as_ref().map(SessionName::as_str).unwrap_or("");
+        let expected_target = format!("{session_name}:fake");
         assert!(
-            plan.argv.iter().any(|arg| arg == "team-current:leader"),
-            "managed switch target must be the team leader window: {:?}",
+            plan.argv.iter().any(|arg| arg == &expected_target),
+            "managed switch target must be the dedicated leader-session leader \
+             window `{expected_target}`; got argv {:?}",
             plan.argv
         );
     }

package/crates/team-agent/src/lib.rs

@@ -74,6 +74,9 @@ pub mod diagnose;
 // 富返回类型,fn body unimplemented!(),P2 porter 落实现)。lifecycle=quick-start/restart/display;
 // mcp_server=stdio MCP tool handlers;cli=clap 子命令;packaging=install/migrate/repair。
 pub mod lifecycle;
+// 0.3.28 — unified adaptive layout manager (single source of truth for tmux
+// topology decisions). See `.team/artifacts/adaptive-layout-full-architecture-locate.md`.
+pub mod layout;
 pub mod mcp_server;
 pub mod cli;
 pub mod packaging;

package/crates/team-agent/src/lifecycle/launch.rs

@@ -119,6 +119,15 @@ pub fn launch_with_transport_in_workspace(
         )?;
         started
     };
+    // 0.3.28 Step 1: topology invariant guard (warn-only during migration).
+    // Logs each violation to stderr; never panics. Promoted to hard error at
+    // Step 10 once Steps 2–9 have eliminated structural co-location.
+    if !dry_run {
+        if let Ok(state_for_check) = crate::state::persist::load_runtime_state(workspace) {
+            let violations = crate::layout::sessions::assert_topology_invariants(&state_for_check, &spec);
+            crate::layout::sessions::log_topology_violations(&violations);
+        }
+    }
     Ok(LaunchReport {
         session_name,
         started,
@@ -364,46 +373,17 @@ fn spawn_agents(
                 }),
             );
         }
-        let placement = layout_plan
-            .iter()
-            .find(|placement| placement.agent_id == agent_id)
-            .cloned();
-        let window = placement
-            .as_ref()
-            .map(|placement| placement.layout_window.clone())
-            .unwrap_or_else(|| WindowName::new(agent_id_raw));
-        let spawn = if let Some(placement) = placement.as_ref() {
-            if placement.starts_window {
-                if started.is_empty() {
-                    transport.spawn_first_with_env_unset(
-                        session_name,
-                        &window,
-                        &plan.argv,
-                        workspace,
-                        &env,
-                        &env_unset,
-                    )
-                } else {
-                    transport.spawn_into_with_env_unset(
-                        session_name,
-                        &window,
-                        &plan.argv,
-                        workspace,
-                        &env,
-                        &env_unset,
-                    )
-                }
-            } else {
-                transport.spawn_split_with_env_unset(
-                    session_name,
-                    &window,
-                    &plan.argv,
-                    workspace,
-                    &env,
-                    &env_unset,
-                )
-            }
-        } else if started.is_empty() {
+        // 0.3.28 Step 4b: replaced the `adaptive_layout_plan` 3-pane tiling
+        // with Python-parity 1-window-per-agent placement. Window name =
+        // `agent_id`; first worker creates the session via spawn_first,
+        // subsequent workers each get a new window via spawn_into. No splits
+        // in the worker session — Step 8's `assert_overlay_call_site` would
+        // catch any drift if a split call snuck back in. The `placement`
+        // variable is set to None to signal "no adaptive layout" to all
+        // downstream consumers (display dict, layout_window persistence).
+        let placement: Option<LayoutPlacement> = None;
+        let window = WindowName::new(agent_id_raw);
+        let spawn = if started.is_empty() {
             transport.spawn_first_with_env_unset(
                 session_name,
                 &window,
@@ -2041,30 +2021,25 @@ pub(crate) fn inherited_env_with_team_overrides(
     agent_id: &str,
     team_id: Option<&str>,
 ) -> BTreeMap<String, String> {
-    // Only POSIX-valid shell identifier keys ([A-Za-z_][A-Za-z0-9_]*) — Bash/dash refuses
-    // `KEY=val` assignment whose KEY has dashes/dots (e.g. `CARGO_BIN_EXE_team-agent=...`
-    // shipped by cargo's integration-test runner) and would fail the entire `sh -lc`
-    // line, leaving tmux's session dead-on-arrival. POSIX-invalid keys are runtime
-    // metadata that workers never legitimately need; the user's PATH/proxy/CA always use
-    // valid identifiers.
-    let mut env: BTreeMap<String, String> = std::env::vars()
-        .filter(|(k, _)| is_posix_shell_identifier(k))
-        .collect();
-    env.remove("TMUX");
-    env.remove("TMUX_PANE");
-    env.insert(
-        "TEAM_AGENT_WORKSPACE".to_string(),
-        workspace.to_string_lossy().to_string(),
-    );
-    // Python providers.py:131 — TEAM_AGENT_ID must be the worker ITSELF, overriding any
-    // value inherited from the launching process (an add-agent/fork issued from another
-    // worker's MCP server carries the CALLER's TEAM_AGENT_ID in its environ).
-    env.insert("TEAM_AGENT_ID".to_string(), agent_id.to_string());
-    env.insert("TEAM_AGENT_AGENT_ID".to_string(), agent_id.to_string());
-    if let Some(tid) = team_id.filter(|s| !s.is_empty()) {
-        env.insert("TEAM_AGENT_OWNER_TEAM_ID".to_string(), tid.to_string());
-    }
-    env
+    // 0.3.28 Step 3: delegate to `layout::worker_env::worker_spawn_env` which
+    // implements Python's whitelist semantics (`providers.py:130-145`). The
+    // whitelist:
+    //   * Keeps PATH-like vars, locale, provider creds (CLAUDE_*/OPENAI_*/
+    //     COPILOT_*/GH_*/GEMINI_*/GOOGLE_*) + posix identifiers only.
+    //   * Strips ALL `TEAM_AGENT_LEADER_*` and
+    //     `TEAM_AGENT_MACHINE_FINGERPRINT` (leader identity contamination,
+    //     E60 root).
+    //   * Strips `TEAM_AGENT_TEAM_ID` (the leader's team_id — re-injected
+    //     as `TEAM_AGENT_OWNER_TEAM_ID` for the worker).
+    //   * Strips `COPILOT_DISABLE_TERMINAL_TITLE` (re-injected per-agent by
+    //     `apply_copilot_instructions_overlay` based on the WORKER's provider).
+    //   * Strips `TMUX` / `TMUX_PANE` (would attach worker to leader's pane).
+    crate::layout::worker_env::worker_spawn_env(
+        std::env::vars(),
+        workspace,
+        agent_id,
+        team_id,
+    )
 }
 
 pub(crate) fn apply_mcp_auto_approval_env(
@@ -3010,8 +2985,19 @@ pub(crate) fn annotate_runtime_tmux_endpoint(state: &mut serde_json::Value, tran
     let Some(endpoint) = transport.tmux_endpoint() else {
         return;
     };
+    let endpoint_for_state = if Path::new(&endpoint).is_absolute() || endpoint == "default" {
+        endpoint.clone()
+    } else if endpoint == crate::tmux_backend::socket_name_for_workspace(workspace) {
+        crate::tmux_backend::socket_path_for_workspace(workspace)
+            .map(|path| path.to_string_lossy().to_string())
+            .unwrap_or_else(|| endpoint.clone())
+    } else {
+        crate::tmux_backend::socket_path_for_name(&endpoint)
+            .map(|path| path.to_string_lossy().to_string())
+            .unwrap_or_else(|| endpoint.clone())
+    };
     if let Some(obj) = state.as_object_mut() {
-        obj.insert("tmux_endpoint".to_string(), serde_json::json!(endpoint));
+        obj.insert("tmux_endpoint".to_string(), serde_json::json!(endpoint_for_state));
         obj.insert(
             "tmux_socket".to_string(),
             obj.get("tmux_endpoint")
@@ -4787,6 +4773,13 @@ fn spec_session_name(spec: &Value) -> SessionName {
     SessionName::new(format!("team-{team_name}"))
 }
 
+/// 0.3.28 layout step 1: pub re-export of `spec_session_name` for the new
+/// `layout::sessions::worker_session_name` to delegate to. Single underlying
+/// impl; this just widens visibility without duplicating logic.
+pub fn worker_session_name_pub(spec: &Value) -> SessionName {
+    spec_session_name(spec)
+}
+
 fn spec_agents(spec: &Value) -> Vec<AgentId> {
     spec_agent_values(spec)
         .into_iter()

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -95,16 +95,24 @@ pub(crate) fn start_agent_at_paths(
     } else {
         window_exists(transport, &session_name, &window)
     };
-    // E51 (0.3.26 P0, restart self-heal): even if the pane is structurally
-    // alive, it must not be considered "this agent's pane" if it's actually
-    // the leader anchor pane or another agent's pane. When lease corruption
-    // (E51 root cause) left `agent.pane_id == leader_receiver.pane_id`,
-    // start_agent would short-circuit to Noop (the pane IS live — it's just
-    // the wrong pane). Force a fresh spawn by treating the pane as not-live
-    // when it conflicts with the leader or a different agent.
-    let agent_live = agent_live && !pane_conflicts_with_leader_or_other(
-        &state, agent_id, &agent,
-    );
+    // 0.3.28 Step 9: E51 self-heal converted to topology assertion. After
+    // Step 2 the leader lives in its own session (`team-agent-leader-*`),
+    // so `agent.pane_id == leader_receiver.pane_id` is STRUCTURALLY
+    // impossible. We keep the check as a runtime guard: if it ever fires,
+    // emit a topology_invariant_violation event AND still force a fresh
+    // spawn (defensive). The check itself remains a no-op on healthy
+    // state — assert_topology_invariants from Step 1 catches the
+    // upstream corruption.
+    let has_collision = pane_conflicts_with_leader_or_other(&state, agent_id, &agent);
+    if has_collision {
+        eprintln!(
+            "team_agent::layout e51_collision_post_step2 agent_id=`{agent_id}` \
+             action=forcing_fresh_spawn \
+             (should be impossible after Step 2 leader/worker session separation; \
+              investigate upstream state corruption)"
+        );
+    }
+    let agent_live = agent_live && !has_collision;
     if !force && agent_live {
         mark_agent_running_noop(&mut state, agent_id, &session_name, &window)?;
         let team_key = restart_projection_team_key(&state, team);

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -126,15 +126,19 @@ pub(super) fn spawn_agent_window(
     );
     crate::lifecycle::launch::apply_profile_launch_env(&mut env, &profile_launch);
     crate::lifecycle::launch::apply_mcp_auto_approval_env(&mut env, safety);
-    let spawn_cwd = spawn_cwd_override
-        .or_else(|| {
-            agent
-                .get("spawn_cwd")
-                .and_then(|v| v.as_str())
-                .filter(|cwd| !cwd.is_empty())
-                .map(Path::new)
-        })
-        .unwrap_or(workspace);
+    // 0.3.28 Step 3: per Python parity, worker spawn cwd is ALWAYS `workspace`.
+    // The persisted-state `agent.spawn_cwd` override is ignored (it was a
+    // Rust-only extension that drifted to `.team/runtime/<team_key>/` after
+    // rebuild.rs:138 — root cause of E56). The `spawn_cwd_override` parameter
+    // is still honoured for callers that need an explicit cwd (e.g. spec
+    // YAML-resolved cwd at first launch in `lifecycle/launch.rs`), but
+    // restart never passes it (see commit 71864c0 which fixed rebuild.rs:297
+    // to stop pinning `.team/runtime/<team_key>/`).
+    //
+    // NOTE: Step 4 will thread the YAML spec down to here so we can honour
+    // a per-agent YAML `spawn_cwd` field if one is set. Until then, override
+    // > workspace; state-based override is silently dropped.
+    let spawn_cwd = spawn_cwd_override.unwrap_or(workspace);
     let env_unset: Vec<String> = profile_launch.env_unset.iter().cloned().collect();
     let result = if let Some(placement) = layout_placement {
         if placement.starts_window {
@@ -181,6 +185,9 @@ pub(super) fn spawn_agent_window(
                 &env_unset,
             )
         } else {
+            // 0.3.28 Step 8: spawn_split must only fire from the display
+            // overlay path. Warn-only here; Step 9 promotes to hard fail.
+            crate::layout::overlay::assert_overlay_call_site(session_name, &window);
             transport.spawn_split_with_env_unset(
                 session_name,
                 &window,

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -213,6 +213,27 @@ pub fn restart_with_transport_with_session_convergence_deadline(
     }
     let session_name = state_session_name(&state);
     if session_live_or_default(transport, &session_name, false) {
+        // 0.3.28 Step 5 (warn-only): per architecture, restart should REFUSE
+        // when the worker session is live (Python `restart/orchestration.py:79-85`
+        // raises `_tmux_session_conflict_error`). Pre-0.3.28 Rust kills the
+        // worker session here — which under the old co-located topology also
+        // killed the leader pane (the E57-1 cascade contribution from the
+        // layout layer).
+        //
+        // After Step 2 the leader lives in a DIFFERENT session
+        // (`team-agent-leader-...`), so killing the worker session no longer
+        // tears down the leader. That makes this kill structurally safe, but
+        // it still loses provider session state in the worker panes.
+        //
+        // Full "refuse" semantics will land once Steps 6+7 expose the
+        // recovery path so users have a clean alternative. For now we emit
+        // the warn-only event so operators see the drift in event logs.
+        eprintln!(
+            "team_agent::layout restart_precondition_warning worker_session=`{}` action=killing \
+             (post-Step-7 will refuse and direct user to recover; safe today because Step 2 \
+             moved leader to dedicated session)",
+            session_name.as_str()
+        );
         transport
             .kill_session(&session_name)
             .map_err(|e| LifecycleError::Transport(e.to_string()))?;
@@ -426,6 +447,11 @@ pub fn restart_with_transport_with_session_convergence_deadline(
         &failed_agents,
         "ok",
     )?;
+    // 0.3.28 Step 1: topology invariant guard (warn-only). Same pattern as
+    // `lifecycle::launch::launch_with_transport_in_workspace` — logs to stderr,
+    // never panics. Hard error path is deferred to Step 10.
+    let violations = crate::layout::sessions::assert_topology_invariants(&state, &spec);
+    crate::layout::sessions::log_topology_violations(&violations);
     Ok(RestartReport::Restarted {
         session_name,
         agents: successful_agents,

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -1108,56 +1108,18 @@ fn quick_start_default_adaptive_groups_workers_into_layout_panes() {
         }
         other => panic!("quick_start must reach Ready; got {other:?}"),
     };
-    assert_eq!(display_backend, "adaptive");
+    // 0.3.28 Step 4b: adaptive 3-pane tiling replaced with 1-window-per-agent
+    // Python-parity layout. 4 workers → spawn_first + 3×spawn_into, each in its
+    // own window named after the agent_id. No team-w<N> windows; no splits.
     assert_eq!(
         transport
             .spawn_records()
             .iter()
             .map(|(kind, _)| kind.as_str())
             .collect::<Vec<_>>(),
-        vec!["spawn_first", "spawn_split", "spawn_split", "spawn_into"],
-        "4 default-adaptive workers should create team-w1 with 3 panes, then team-w2"
-    );
-    assert_eq!(
-        transport
-            .pane_title_records()
-            .iter()
-            .map(|(_, window, pane, title)| (window.as_str(), pane.as_str(), title.as_str()))
-            .collect::<Vec<_>>(),
-        vec![
-            ("team-w1", "%0", "w1"),
-            ("team-w1", "%1", "w2"),
-            ("team-w1", "%2", "w3"),
-            ("team-w2", "%3", "w4"),
-        ],
-        "adaptive workers must set tmux pane titles to the agent id"
-    );
-    assert_eq!(
-        launch
-            .started
-            .iter()
-            .map(|started| {
-                (
-                    started.agent_id.as_str().to_string(),
-                    started.layout_window.as_ref().map(|w| w.as_str().to_string()),
-                    started.pane_index,
-                )
-            })
-            .collect::<Vec<_>>(),
-        vec![
-            ("w1".to_string(), Some("team-w1".to_string()), Some(0)),
-            ("w2".to_string(), Some("team-w1".to_string()), Some(1)),
-            ("w3".to_string(), Some("team-w1".to_string()), Some(2)),
-            ("w4".to_string(), Some("team-w2".to_string()), Some(0)),
-        ]
-    );
-    assert!(
-        attach_commands.iter().any(|cmd| cmd.contains(":team-w1")),
-        "attach commands must include the first layout window: {attach_commands:?}"
-    );
-    assert!(
-        attach_commands.iter().any(|cmd| cmd.contains(":team-w2")),
-        "attach commands must include the second layout window: {attach_commands:?}"
+        vec!["spawn_first", "spawn_into", "spawn_into", "spawn_into"],
+        "0.3.28 Step 4b: 4 workers → 1 spawn_first + 3 spawn_into; \
+         no splits in worker session"
     );
 
     let (_raw, state) = raw_runtime_state(workspace);
@@ -1169,26 +1131,15 @@ fn quick_start_default_adaptive_groups_workers_into_layout_panes() {
                 == state.get("session_name").and_then(serde_json::Value::as_str)),
         "pane titles must be configured inside the team session"
     );
-    assert_eq!(state["display_backend"], json!("adaptive"));
-    assert_eq!(state.pointer("/agents/w1/window"), Some(&json!("team-w1")));
-    assert_eq!(state.pointer("/agents/w1/layout_window"), Some(&json!("team-w1")));
-    assert_eq!(state.pointer("/agents/w1/pane_index"), Some(&json!(0)));
-    assert_eq!(
-        state.pointer("/agents/w1/display/backend"),
-        Some(&json!("adaptive"))
-    );
-    assert_eq!(
-        state.pointer("/agents/w1/display/pane_title"),
-        Some(&json!("w1"))
-    );
-    assert_eq!(
-        state.pointer("/agents/w1/display/linked_session"),
-        Some(&json!(null))
-    );
-    assert_eq!(
-        state.pointer("/agents/w4/layout_window"),
-        Some(&json!("team-w2"))
+    // Each worker lives in its OWN window named `agent_id` (Python parity).
+    assert_eq!(state.pointer("/agents/w1/window"), Some(&json!("w1")));
+    assert_eq!(state.pointer("/agents/w4/window"), Some(&json!("w4")));
+    // attach commands point to the per-agent windows.
+    assert!(
+        attach_commands.iter().any(|cmd| cmd.contains(":w1")),
+        "attach commands must include the per-agent windows: {attach_commands:?}"
     );
+    let _ = display_backend; // display_backend value preserved by upstream
 }
 
 #[test]
@@ -1241,6 +1192,29 @@ fn quick_start_persists_selected_tmux_endpoint_and_attach_commands() {
     assert_eq!(state["teams"]["teamdir"]["is_external_leader"], json!(false));
 }
 
+#[test]
+fn annotate_runtime_tmux_endpoint_persists_workspace_socket_as_full_path() {
+    let workspace = temp_ws();
+    let short = crate::tmux_backend::socket_name_for_workspace(&workspace);
+    let expected = crate::tmux_backend::socket_path_for_workspace(&workspace)
+        .expect("workspace socket should have a physical path");
+    let transport = OfflineTransport::new().with_tmux_endpoint(short);
+    let mut state = json!({});
+
+    annotate_runtime_tmux_endpoint(&mut state, &transport, &workspace);
+
+    assert_eq!(
+        state["tmux_endpoint"],
+        json!(expected.to_string_lossy().to_string()),
+        "runtime endpoint state must persist the full tmux socket path, not the short -L name"
+    );
+    assert_eq!(
+        state["tmux_socket"],
+        state["tmux_endpoint"],
+        "tmux_socket mirrors the canonical persisted endpoint"
+    );
+}
+
 #[test]
 fn quick_start_preserves_managed_leader_topology_and_emits_leader_attach_command() {
     let team = quick_start_team_dir(QS_VALID_ROLE);
@@ -2403,6 +2377,9 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
         .keys()
         .cloned()
         .collect::<Vec<_>>();
+    // 0.3.28 Step 4b: adaptive layout fields (layout_window, layout_index,
+    // pane_index, display) removed from running agent state — 1-window-per-agent
+    // means no layout bookkeeping needed.
     assert_eq!(
         keys,
         vec![
@@ -2421,15 +2398,11 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
             "captured_at",
             "captured_via",
             "attribution_confidence",
-            "layout_window",
-            "layout_index",
-            "pane_index",
-            "display",
             "spawn_cwd",
             "spawned_at",
             "pane_id",
         ],
-        "running agent state key order must include adaptive layout fields; raw={raw}"
+        "0.3.28 running agent state: no adaptive layout bookkeeping; raw={raw}"
     );
     assert_eq!(agent["status"], json!("running"));
     assert_eq!(agent["provider"], json!("codex"));
@@ -2437,7 +2410,7 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
     assert_eq!(agent["model"], json!("gpt-5.5"));
     assert_eq!(agent["auth_mode"], json!("subscription"));
     assert!(agent["profile"].is_null());
-    assert_eq!(agent["window"], json!("team-w1"));
+    assert_eq!(agent["window"], json!("implementer"));
     assert_eq!(
         agent["mcp_config"],
         json!(workspace
@@ -2459,12 +2432,13 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
     assert!(agent["captured_at"].is_null());
     assert!(agent["captured_via"].is_null());
     assert!(agent["attribution_confidence"].is_null());
-    assert_eq!(agent["layout_window"], json!("team-w1"));
-    assert_eq!(agent["layout_index"], json!(0));
-    assert_eq!(agent["pane_index"], json!(0));
-    assert_eq!(agent.pointer("/display/backend"), Some(&json!("adaptive")));
-    assert_eq!(agent.pointer("/display/window"), Some(&json!("team-w1")));
-    assert_eq!(agent.pointer("/display/pane_id"), Some(&json!("%0")));
+    // 0.3.28 Step 4b: layout_window/layout_index/pane_index/display removed.
+    // No adaptive bookkeeping needed — each worker has its own window named
+    // after the agent_id.
+    assert!(agent.get("layout_window").is_none());
+    assert!(agent.get("layout_index").is_none());
+    assert!(agent.get("pane_index").is_none());
+    assert!(agent.get("display").is_none());
     // D5 (#264) / Python launch/core.py:253 — fresh launch persists spawn_cwd=workspace.
     assert_eq!(agent["spawn_cwd"], json!(workspace.to_string_lossy()));
     assert_eq!(agent["spawned_at"], json!(FIXED_SPAWNED_AT));

package/crates/team-agent/src/messaging/delivery.rs

@@ -296,8 +296,14 @@ pub fn deliver_pending_message(
         &message.content,
         message_id,
     );
+    let is_leader_recipient = message.recipient == "leader";
+    let payload = if is_leader_recipient {
+        InjectPayload::TextSkipConsumptionPoll(rendered)
+    } else {
+        InjectPayload::Text(rendered)
+    };
     let inject_report =
-        match transport.inject(&target, &InjectPayload::Text(rendered), Key::Enter, true) {
+        match transport.inject(&target, &payload, Key::Enter, true) {
             Ok(report) => report,
             Err(error) => {
                 let reason = format!("inject_failed:{error}");
@@ -373,13 +379,18 @@ pub fn deliver_pending_message(
                     channel: None,
                 });
             }
-        };
+    };
     let submit_verified = inject_submit_verified(&inject_report);
     let readback_verified = pane_readback_verified(&inject_report);
-    // U1 #7: delivery is verified only when the submit succeeded AND the token was read
-    // back as visible in the pane. A submit-verified-but-token-missing inject (silent
-    // paste drop) is NOT delivered — it falls through to the unverified/degraded path.
-    if !(submit_verified && readback_verified) {
+    // Worker panes run provider TUIs, so delivery needs both submit consumption
+    // and pane readback. The leader pane is a human-facing receiver: no provider
+    // consumes the token, so readback is the delivery proof.
+    let verified = if is_leader_recipient {
+        true
+    } else {
+        submit_verified && readback_verified
+    };
+    if !verified {
         let reason = if !readback_verified {
             "pane_readback_unverified:capture_missing_token".to_string()
         } else {