@team-agent/installer 0.4.0 → 0.4.2

package/crates/team-agent/src/cli/tests/lane_c.rs

@@ -196,7 +196,7 @@ use super::*;
     #[test]
     fn inbox_golden_shape_is_agent_id_and_since_not_agent_limit() {
         let ws = tmp_workspace();
-        let v = status_port::inbox(&ws, "alpha", 20, None, true).expect("inbox");
+        let v = status_port::inbox(&ws, "alpha", 20, None, true, None).expect("inbox");
         let obj = v.as_object().expect("inbox dict");
         let order: Vec<&str> = obj.keys().map(String::as_str).collect();
         assert_eq!(

package/crates/team-agent/src/cli/tests/leader_watch.rs

@@ -167,9 +167,11 @@ use super::*;
         assert_eq!(r.status, crate::leader::LeaseStatus::Claimed);
         assert_eq!(r.owner_epoch, Some(crate::model::ids::OwnerEpoch(3)));
         assert_eq!(r.bound_pane_id, Some(caller.clone()));
-        assert_eq!(state["leader_receiver"]["pane_id"], json!("%5"));
-        assert_eq!(state["team_owner"]["pane_id"], json!("%5"));
-        assert_eq!(state["team_owner"]["owner_epoch"], json!(3));
+        // Stage 3d: canonical owner/receiver at teams.<team_key>.
+        let team_key = crate::state::projection::team_state_key(&state);
+        assert_eq!(state["teams"][&team_key]["leader_receiver"]["pane_id"], json!("%5"));
+        assert_eq!(state["teams"][&team_key]["team_owner"]["pane_id"], json!("%5"));
+        assert_eq!(state["teams"][&team_key]["team_owner"]["owner_epoch"], json!(3));
     }
 
     struct LeaderPortSeededLiveness {

package/crates/team-agent/src/cli/tests/main_preserved.rs

@@ -186,7 +186,7 @@ fn seed_team_spec(ws: &std::path::Path) {
         let mid = store
             .create_message(None, "leader", "w1", "hello w1", None, true, None)
             .unwrap();
-        let v = status_port::inbox(&ws, "w1", 20, None, true).expect("inbox");
+        let v = status_port::inbox(&ws, "w1", 20, None, true, None).expect("inbox");
         let messages = v["messages"].as_array().expect("messages array");
         assert_eq!(
             messages.len(),
@@ -217,7 +217,7 @@ fn seed_team_spec(ws: &std::path::Path) {
         store.create_message(None, "leader", "w1", "to w1", None, true, None).unwrap();
         store.create_message(None, "w1", "leader", "from w1", None, true, None).unwrap();
         store.create_message(None, "leader", "w2", "unrelated to w2", None, true, None).unwrap();
-        let v = status_port::inbox(&ws, "w1", 20, None, true).expect("inbox");
+        let v = status_port::inbox(&ws, "w1", 20, None, true, None).expect("inbox");
         let messages = v["messages"].as_array().expect("messages array");
         let mut contents: Vec<String> =
             messages.iter().map(|m| m["content"].as_str().unwrap().to_string()).collect();
@@ -343,6 +343,7 @@ fn seed_team_spec(ws: &std::path::Path) {
             workspace: ws.clone(),
             timeout: 0.0,
             json: true,
+            team: None,
         }).expect("wait-ready"));
         assert_eq!(value["ok"], json!(false), "wait-ready must not fake success before workers are ready");
         assert_eq!(value.pointer("/readiness/ready"), Some(&json!(false)));
@@ -386,6 +387,7 @@ fn seed_team_spec(ws: &std::path::Path) {
             workspace: ws.clone(),
             timeout: 0.0,
             json: true,
+            team: None,
         }).expect("wait-ready"));
         assert_eq!(
             value.pointer("/readiness/mcp_ready"),
@@ -571,6 +573,7 @@ fn seed_team_spec(ws: &std::path::Path) {
                 workspace: ws.clone(),
                 result_file: None,
                 json: true,
+                team: None,
             })
             .unwrap(),
         );
@@ -611,6 +614,7 @@ fn seed_team_spec(ws: &std::path::Path) {
                 workspace: ws.clone(),
                 alert_type: None,
                 json: true,
+                team: None,
             })
             .unwrap(),
         );
@@ -637,6 +641,7 @@ fn seed_team_spec(ws: &std::path::Path) {
             cmd_stuck_list(&StuckListArgs {
                 workspace: ws.clone(),
                 json: true,
+                team: None,
             })
             .unwrap(),
         );
@@ -646,6 +651,26 @@ fn seed_team_spec(ws: &std::path::Path) {
             "stuck-list must read the persisted state mirror, not return a hard-coded empty list"
         );
     }
+
+    #[test]
+    fn stuck_cancel_explicit_team_is_rejected_until_backend_is_scoped() {
+        let ws = tmp_workspace();
+        seed_collect_state(&ws);
+        let err = cmd_stuck_cancel(&StuckCancelArgs {
+            agent: "fake_impl".to_string(),
+            workspace: ws.clone(),
+            alert_type: None,
+            json: true,
+            team: Some("current".to_string()),
+        })
+        .expect_err("explicit --team must not silently write global stuck suppression");
+        assert!(
+            err.to_string().contains("not supported yet"),
+            "stuck-cancel --team must be an explicit refusal until backend supports scoped writes; got {err}"
+        );
+        let _ = std::fs::remove_dir_all(&ws);
+    }
+
     #[test]
     fn stuck_cancel_invalid_alert_type_is_rejected() {
         let ws = tmp_workspace();
@@ -717,6 +742,7 @@ fn seed_team_spec(ws: &std::path::Path) {
                 status: "done".to_string(),
                 summary: Some("manual repair accepted".to_string()),
                 json: true,
+                team: None,
             })
             .expect("repair-state should not fail on a valid runtime state"),
         );

package/crates/team-agent/src/cli/tests/peer_allow.rs

@@ -43,6 +43,7 @@ fn app_call(ws: &std::path::Path, a: &str, b: &str) -> CmdResult {
         b: b.to_string(),
         workspace: ws.to_path_buf(),
         json: false,
+        team: None,
     })
     .expect("allow-peer-talk is a compat-noop and must not error")
 }
@@ -135,3 +136,21 @@ fn allow_peer_talk_unknown_agents_succeed_no_validation() {
     );
     let _ = std::fs::remove_dir_all(&ws);
 }
+
+#[test]
+fn allow_peer_talk_explicit_team_is_rejected_until_backend_is_scoped() {
+    let ws = tmp_workspace();
+    let err = cmd_allow_peer_talk(&AllowPeerTalkArgs {
+        a: "alpha".to_string(),
+        b: "bravo".to_string(),
+        workspace: ws.clone(),
+        json: true,
+        team: Some("current".to_string()),
+    })
+    .expect_err("explicit --team must not silently write the global peer allowlist");
+    assert!(
+        err.to_string().contains("not supported yet"),
+        "allow-peer-talk --team must be an explicit refusal until backend supports scoped writes; got {err}"
+    );
+    let _ = std::fs::remove_dir_all(&ws);
+}

package/crates/team-agent/src/cli/tests/repair_state_byte_lock.rs

@@ -130,9 +130,54 @@ fn repair_args(
         status: status.to_string(),
         summary: summary.map(str::to_string),
         json,
+        team: None,
     }
 }
 
+fn team_repair_state(ws: &std::path::Path, team: &str) -> serde_json::Value {
+    json!({
+        "active_team_key": team,
+        "status": "alive",
+        "spec_path": ws.join(".team").join("runtime").join(team).join("team.spec.yaml").to_string_lossy(),
+        "session_name": format!("team-agent-{team}"),
+        "leader": {"id": "leader"},
+        "agents": {"fake_impl": {"status": "stopped", "provider": "fake"}},
+        "tasks": [{
+            "id": "task_impl",
+            "title": format!("{team} implementation"),
+            "type": "implementation",
+            "assignee": null,
+            "deps": [],
+            "acceptance": ["fake result collected"],
+            "status": "pending"
+        }]
+    })
+}
+
+fn seed_two_team_repair_workspace(ws: &std::path::Path) {
+    std::fs::create_dir_all(ws.join(".team").join("logs")).unwrap();
+    for team in ["alpha", "beta"] {
+        let spec_dir = ws.join(".team").join("runtime").join(team);
+        std::fs::create_dir_all(&spec_dir).unwrap();
+        std::fs::write(
+            spec_dir.join("team.spec.yaml"),
+            REPAIR_SPEC_TEMPLATE.replace("__WS__", &ws.to_string_lossy()),
+        )
+        .unwrap();
+    }
+    crate::state::persist::save_runtime_state(
+        ws,
+        &json!({
+            "active_team_key": "alpha",
+            "teams": {
+                "alpha": team_repair_state(ws, "alpha"),
+                "beta": team_repair_state(ws, "beta"),
+            }
+        }),
+    )
+    .unwrap();
+}
+
 // Golden source:
 // - cli/parser.py:303-310 registers `repair-state --workspace --task --assignee --status --summary --json`.
 // - cli/commands.py:196-203 delegates all five args to `runtime.repair_state`.
@@ -248,6 +293,33 @@ fn repair_state_rejects_status_outside_task_statuses() {
     let _ = std::fs::remove_dir_all(&ws);
 }
 
+#[test]
+fn repair_state_explicit_team_updates_selected_team_not_active_team() {
+    let ws = tmp_workspace();
+    seed_two_team_repair_workspace(&ws);
+    let mut args = repair_args(&ws, "done", Some("patched beta"), true);
+    args.team = Some("beta".to_string());
+
+    let cmd = cmd_repair_state(&args).expect("repair-state --team beta should update beta");
+    assert_eq!(cmd.exit, ExitCode::Ok);
+    let state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    assert_eq!(
+        state["teams"]["alpha"]["tasks"][0]["status"],
+        json!("pending"),
+        "repair-state --team beta must not mutate active/default alpha"
+    );
+    assert_eq!(
+        state["teams"]["beta"]["tasks"][0]["status"],
+        json!("done"),
+        "repair-state must consume args.team and update beta"
+    );
+    assert_eq!(
+        state["teams"]["beta"]["tasks"][0]["last_result_summary"],
+        json!("patched beta")
+    );
+    let _ = std::fs::remove_dir_all(&ws);
+}
+
 // CONTRACT (real-machine repair_state product FAIL): rt-host-d ran `repair-state --task rp1 --status done`
 // in a quick-start workspace whose spec lives in a teamdir (state.spec_path -> <ws>/teamdir/team.spec.yaml),
 // NOT at <ws>/team.spec.yaml. Rust cmd_repair_state calls load_team_spec(workspace) which HARDCODES

package/crates/team-agent/src/cli/tests/run_delegation.rs

@@ -205,7 +205,6 @@ fn current_uid() -> Option<String> {
             name: None,
             team_id: None,
             yes: true,
-            fresh: false,
             no_display: false,
             json: true,
         };
@@ -240,7 +239,6 @@ fn current_uid() -> Option<String> {
             name: None,
             team_id: None,
             yes: false,
-            fresh: false,
             no_display: false,
             json: true,
         };
@@ -339,7 +337,7 @@ fn current_uid() -> Option<String> {
         crate::coordinator::write_coordinator_metadata(&wp, me, crate::coordinator::MetadataSource::Boot).unwrap();
         std::fs::write(crate::coordinator::coordinator_pid_path(&wp), me.to_string()).unwrap();
 
-        let args = StatusArgs { agent: None, workspace: ws, detail: true, summary: false, json: true };
+        let args = StatusArgs { agent: None, workspace: ws, detail: true, summary: false, json: true, team: None };
         let r = cmd_status(&args).expect("cmd_status");
         let value = match r.output {
             CmdOutput::Json(v) => v,

package/crates/team-agent/src/cli/tests/status_send.rs

@@ -268,6 +268,7 @@ use super::*;
             detail: false,
             summary: false,
             json: false,
+            team: None,
         };
 
         let r = cmd_status_for_team(&args, None).expect("status");

package/crates/team-agent/src/cli/types.rs

@@ -86,7 +86,7 @@ impl CliError {
             payload.session_name = Some(session.clone());
             if command == "quick-start" {
                 payload.action = format!(
-                    "tmux session `{session}` already exists. It may be your own existing team. To resume it use `team-agent restart` (NOT --fresh, which discards context). Only if you want a separate team, change `name:` in TEAM.md and run quick-start again. Never terminate existing tmux sessions from quick-start."
+                    "tmux session `{session}` already exists. It may be your own existing team. To resume it use `team-agent restart`. If recovery is impossible, use `team-agent restart --allow-fresh` only after explicit context-loss consent. Only if you want a separate team, change `name:` in TEAM.md and run quick-start again. Never terminate existing tmux sessions from quick-start."
                 );
                 payload.next_actions = Some(vec![
                     "If this is your existing team, resume it with `team-agent restart`.".to_string(),
@@ -270,9 +270,13 @@ pub struct QuickStartArgs {
     pub name: Option<String>,
     pub team_id: Option<String>,
     pub yes: bool,
-    pub fresh: bool,
     pub no_display: bool,
     pub json: bool,
+    // Stage QR (quick-start/restart separation, design doc
+    // .team/artifacts/quickstart-restart-separation-design.md): the
+    // `fresh` field is intentionally REMOVED. Reset semantics now live
+    // exclusively on restart (`restart --allow-fresh`) and must be
+    // user-confirmed. quick-start is now an initial-creation-only verb.
 }
 
 /// `init`(`parser.py` bootstrap verb)。
@@ -355,6 +359,9 @@ pub struct AllowPeerTalkArgs {
     pub b: String,
     pub workspace: PathBuf,
     pub json: bool,
+    /// Parsed but rejected until peer allowlist storage grows a team-scoped
+    /// backend column.
+    pub team: Option<String>,
 }
 
 /// `status`(`parser.py:182`)。`--summary`/`--json`/`--detail` 三态(summary xor json,见 `cmd_status`)。
@@ -365,6 +372,9 @@ pub struct StatusArgs {
     pub detail: bool,
     pub summary: bool,
     pub json: bool,
+    /// Stage 4: explicit `--team` scope (read-only command; multi-team
+    /// workspaces use this for filtering, not for refusal).
+    pub team: Option<String>,
 }
 
 /// `watch`(`parser.py:190`)。无 `--json`(纯 stream 到 SystemExit)。
@@ -380,6 +390,8 @@ pub struct ApprovalsArgs {
     pub agent: Option<String>,
     pub workspace: PathBuf,
     pub json: bool,
+    /// Stage 4: explicit `--team` scope.
+    pub team: Option<String>,
 }
 
 /// `inbox`(`parser.py:217`)。`--since` ISO8601(claim-leader inbox_hint 复用)。
@@ -390,6 +402,8 @@ pub struct InboxArgs {
     pub limit: usize,
     pub since: Option<String>,
     pub json: bool,
+    /// Stage 4: explicit `--team` scope.
+    pub team: Option<String>,
 }
 
 /// `takeover`(`parser.py:242`)。`--confirm` 必需(覆写 recorded team_owner)。
@@ -521,6 +535,8 @@ pub struct RemoveAgentArgs {
 pub struct StuckListArgs {
     pub workspace: PathBuf,
     pub json: bool,
+    /// Stage 4: explicit `--team` scope (read-only enumeration).
+    pub team: Option<String>,
 }
 
 /// `stuck-cancel`(`parser.py:429`)。`--alert-type` ∈ {stuck, idle_fallback, all},默认 stuck。
@@ -531,6 +547,9 @@ pub struct StuckCancelArgs {
     /// `None` 表 `all`(展开全集);`Some(AlertType)` 表单类型。
     pub alert_type: Option<AlertType>,
     pub json: bool,
+    /// Parsed but rejected until stuck suppression storage grows a team-scoped
+    /// backend selector.
+    pub team: Option<String>,
 }
 
 /// `acknowledge-idle`(`parser.py:436`)。
@@ -573,6 +592,8 @@ pub enum DoctorGate {
 pub struct SessionsArgs {
     pub workspace: PathBuf,
     pub json: bool,
+    /// Stage 4: explicit `--team` scope (read-only enumeration).
+    pub team: Option<String>,
 }
 
 /// `validate [spec=team.spec.yaml] --json`(`parser.py:120`)。
@@ -608,6 +629,10 @@ pub struct CollectArgs {
     pub workspace: PathBuf,
     pub result_file: Option<PathBuf>,
     pub json: bool,
+    /// Stage 4: explicit `--team` scope. Destructive (consumes result
+    /// envelopes); CLI dispatch refuses bare invocation in a
+    /// multi-alive-team workspace.
+    pub team: Option<String>,
 }
 
 /// `settle`(`parser.py:177`)。
@@ -631,6 +656,10 @@ pub struct RepairStateArgs {
     pub status: String,
     pub summary: Option<String>,
     pub json: bool,
+    /// Stage 4: explicit `--team` scope. Destructive (rewrites task state);
+    /// CLI dispatch refuses bare invocation in a multi-alive-team
+    /// workspace.
+    pub team: Option<String>,
 }
 
 /// `diagnose`(`parser.py:298`) runtime health report, distinct from `doctor`.
@@ -638,6 +667,8 @@ pub struct RepairStateArgs {
 pub struct DiagnoseArgs {
     pub workspace: PathBuf,
     pub json: bool,
+    /// Stage 4: explicit `--team` scope (read-only health report).
+    pub team: Option<String>,
 }
 
 /// `preflight`(`parser.py:160`)。
@@ -653,6 +684,8 @@ pub struct WaitReadyArgs {
     pub workspace: PathBuf,
     pub timeout: f64,
     pub json: bool,
+    /// Stage 4: explicit `--team` scope (read-only readiness probe).
+    pub team: Option<String>,
 }
 
 /// `e2e`(`parser.py:449`)。

package/crates/team-agent/src/coordinator/runtime_detectors.rs

@@ -216,8 +216,13 @@ fn detect_leader_api_error(
                 .and_then(Value::as_str)
                 .map(ToString::to_string)
         });
-    let leader_session_uuid = state
-        .get("team_owner")
+    // Stage 3a (identity-boundary unified plan, architect direction
+    // 2026-06-23): route owner read through the ownership repository.
+    // The coordinator state here is the workspace runtime state — Stage 5
+    // will swap to per-team state and this read follows automatically.
+    // capture.leader_receiver fallback is kept as evidence, not owner truth
+    // (architect §4 cross-module risk: capture fallback is evidence-only).
+    let leader_session_uuid = crate::state::ownership::read_owner_value(state, "")
         .and_then(|owner| owner.get("leader_session_uuid"))
         .or_else(|| {
             capture

package/crates/team-agent/src/coordinator/tick.rs

@@ -2629,6 +2629,33 @@ fn agent_rollout_path(agent: &Value) -> Option<PathBuf> {
         .map(PathBuf::from)
 }
 
+/// Memory-growth fix (architect §5): bounded tail cap for JSONL activity reads.
+/// Matches `ABNORMAL_TAIL_BYTES` (131_072 bytes) — the abnormal-exit path
+/// already proved this size is sufficient to capture the latest lifecycle
+/// records across all providers (claude / codex / copilot).
+const JSONL_ACTIVITY_TAIL_BYTES: u64 = 131_072;
+
+/// Memory-growth fix (architect §5): per-process `(path, size, mtime_ns) →
+/// activity` cache. When a rollout file hasn't changed since the previous
+/// tick, we skip the file read AND the classification entirely. This is the
+/// dominant savings: a 538MB Claude transcript that updates every few seconds
+/// is touched only when its size or mtime actually moves. Stored values are
+/// small (Option<AgentActivity> = enum + short rationale string); we never
+/// cache the transcript text or parsed JSON.
+struct JsonlActivityCacheEntry {
+    size: u64,
+    mtime_ns: u64,
+    activity: Option<crate::messaging::AgentActivity>,
+}
+
+fn jsonl_activity_cache(
+) -> &'static std::sync::Mutex<std::collections::HashMap<PathBuf, JsonlActivityCacheEntry>> {
+    static CACHE: std::sync::OnceLock<
+        std::sync::Mutex<std::collections::HashMap<PathBuf, JsonlActivityCacheEntry>>,
+    > = std::sync::OnceLock::new();
+    CACHE.get_or_init(|| std::sync::Mutex::new(std::collections::HashMap::new()))
+}
+
 /// E47 (0.3.24 P0, idle/busy 假阳): consult the authoritative provider JSONL
 /// classifier and map to neutral `AgentActivity`. Returns `None` when the
 /// classifier reports `TurnState::Unknown` (unreadable JSONL / no lifecycle
@@ -2638,29 +2665,72 @@ fn agent_rollout_path(agent: &Value) -> Option<PathBuf> {
 /// so we hand off to the TUI scanner which has its OWN no-signal → Uncertain
 /// path. Copilot/Gemini/Fake providers (which don't have JSONL — classify.rs
 /// returns Unknown for them) thus keep using TUI scanning unchanged.
+///
+/// Memory-growth fix (architect analysis 2026-06-23): bounded tail read +
+/// metadata cache. Pre-fix `std::fs::read_to_string` on a 538MB Claude
+/// transcript every 5s caused 200MB+ coordinator RSS plateaus from allocator
+/// fragmentation. Now bounded to 128KiB tail and skipped entirely when
+/// (size, mtime_ns) is unchanged.
 fn jsonl_activity_for_agent(agent: &Value) -> Option<crate::messaging::AgentActivity> {
     let rollout_path = agent_rollout_path(agent)?;
     let provider = agent
         .get("provider")
         .and_then(Value::as_str)
         .and_then(parse_provider)?;
-    let log_text = std::fs::read_to_string(&rollout_path).ok()?;
+
+    // Metadata check + cache lookup. Cache hit when the rollout file has
+    // not changed since the previous tick: return the cached classification
+    // without re-reading the file. Truncation (size shrink with stable mtime)
+    // still forces re-read because size is part of the cache key.
+    let metadata = std::fs::metadata(&rollout_path).ok()?;
+    let size = metadata.len();
+    let mtime_ns = metadata_mtime_ns(&metadata)?;
+    if let Ok(cache) = jsonl_activity_cache().lock() {
+        if let Some(entry) = cache.get(&rollout_path) {
+            if entry.size == size && entry.mtime_ns == mtime_ns {
+                return entry.activity.clone();
+            }
+        }
+    }
+
+    // Cache miss: bounded tail read + classify. The classifier only needs the
+    // latest lifecycle records to determine idle/working state; the
+    // abnormal-exit path uses the same 128KiB tail and is sufficient for
+    // claude / codex / copilot lifecycle markers.
+    let log_text = read_tail_text(&rollout_path, JSONL_ACTIVITY_TAIL_BYTES).ok()?;
     let process = explicit_process_liveness(agent).unwrap_or(ProcessLiveness::Unverifiable);
-    let result = crate::provider::classify(provider, &log_text, process, 0.0).ok()?;
-    use crate::messaging::{ActivityStatus, AgentActivity};
-    use crate::provider::types::TurnState;
-    let status = match result.state {
-        TurnState::Idle => ActivityStatus::Idle,
-        TurnState::IdleInterrupted => ActivityStatus::Idle,
-        TurnState::Working => ActivityStatus::Working,
-        TurnState::BlockedOnHuman | TurnState::Abnormal => ActivityStatus::Uncertain,
-        TurnState::Unknown => return None,
-    };
-    Some(AgentActivity {
-        status,
-        confidence: 0.95,
-        rationale: format!("provider_jsonl:{}", result.reason),
-    })
+    let activity = crate::provider::classify(provider, &log_text, process, 0.0)
+        .ok()
+        .and_then(|result| {
+            use crate::messaging::{ActivityStatus, AgentActivity};
+            use crate::provider::types::TurnState;
+            let status = match result.state {
+                TurnState::Idle => ActivityStatus::Idle,
+                TurnState::IdleInterrupted => ActivityStatus::Idle,
+                TurnState::Working => ActivityStatus::Working,
+                TurnState::BlockedOnHuman | TurnState::Abnormal => ActivityStatus::Uncertain,
+                TurnState::Unknown => return None,
+            };
+            Some(AgentActivity {
+                status,
+                confidence: 0.95,
+                rationale: format!("provider_jsonl:{}", result.reason),
+            })
+        });
+
+    // Store the classification (including None / Unknown) so the next tick
+    // can short-circuit when the file is unchanged.
+    if let Ok(mut cache) = jsonl_activity_cache().lock() {
+        cache.insert(
+            rollout_path,
+            JsonlActivityCacheEntry {
+                size,
+                mtime_ns,
+                activity: activity.clone(),
+            },
+        );
+    }
+    activity
 }
 
 fn runtime_approval_target(

package/crates/team-agent/src/diagnose/comms.rs

@@ -82,11 +82,19 @@ fn receiver_binding_snapshot(workspace: &Path, team: Option<&TeamKey>) -> Value
     };
     let state = selected.state;
     let receiver = state.get("leader_receiver").and_then(Value::as_object);
+    // Stage 2 (identity-boundary unified plan, architect direction
+    // 2026-06-23): route owner pane lookup through the ownership repository.
+    // `selected.state` is already team-projected by the selector, so the
+    // empty-team-key path returns the same top-level owner the legacy direct
+    // read produced — but Stage 5 will swap the data source under the
+    // repository and this diagnose surface follows automatically. The
+    // `owner` key fallback is retained for callers that pre-date the
+    // `team_owner` rename.
     let owner_pane_id = state
         .get("owner")
-        .or_else(|| state.get("team_owner"))
-        .and_then(|v| v.get("pane_id"))
         .cloned()
+        .or_else(|| crate::state::ownership::read_owner_value(&state, "").cloned())
+        .and_then(|v| v.get("pane_id").cloned())
         .unwrap_or(Value::Null);
     let caller_pane_id = std::env::var("TMUX_PANE").ok().map(Value::String).unwrap_or(Value::Null);
     let pane_id = receiver