@team-agent/installer 0.4.0 → 0.4.2

package/crates/team-agent/src/leader/lease.rs

@@ -1031,6 +1031,17 @@ fn scan_agents_for_pane(agents: Option<&Value>, caller_pane: &PaneId) -> Option<
     None
 }
 
+/// Stage 3a (identity-boundary unified plan, architect direction 2026-06-23)
+/// + Stage 3 owner persist fix (architect direction 2026-06-24): route the
+/// in-memory binding write through the `state::ownership` API. The
+/// canonical team_key is derived from `active_team_key` first (the explicit
+/// scope set by `project_top_level_view` when an explicit team was passed
+/// to claim-leader) and only falls back to `team_state_key(state)` for the
+/// legacy unscoped flow. Without the `active_team_key` preference, an
+/// explicit `claim-leader --team alpha` whose projected state was emptied
+/// of team_dir/session_name would derive "current" and write the owner to
+/// `teams.current`, while `save_claim_team_scoped_state` expected
+/// `teams.alpha` — the S3-OWNER-001 persistence loss shape.
 fn write_binding_to_state(
     state: &mut Value,
     receiver: &LeaderReceiver,
@@ -1039,12 +1050,15 @@ fn write_binding_to_state(
     if !state.is_object() {
         *state = json!({});
     }
-    let Some(root) = state.as_object_mut() else {
+    if !state.is_object() {
         return Err(LeaderError::Validation("state root is not an object".to_string()));
-    };
-    root.insert("leader_receiver".to_string(), serde_json::to_value(receiver)?);
-    root.insert("team_owner".to_string(), serde_json::to_value(owner)?);
-    root.insert("owner_epoch".to_string(), json!(owner.owner_epoch.0));
+    }
+    let team_key = canonical_owner_write_key(state);
+    let record = crate::state::ownership::OwnershipWrite::new()
+        .with_leader_receiver(serde_json::to_value(receiver)?)
+        .with_team_owner(serde_json::to_value(owner)?)
+        .with_owner_epoch(owner.owner_epoch.0);
+    crate::state::ownership::write_owner(state, &team_key, record);
     Ok(())
 }
 
@@ -1055,13 +1069,34 @@ fn write_receiver_to_state(
     if !state.is_object() {
         *state = json!({});
     }
-    let Some(root) = state.as_object_mut() else {
+    if !state.is_object() {
         return Err(LeaderError::Validation("state root is not an object".to_string()));
-    };
-    root.insert("leader_receiver".to_string(), serde_json::to_value(receiver)?);
+    }
+    let team_key = canonical_owner_write_key(state);
+    let record = crate::state::ownership::OwnershipWrite::new()
+        .with_leader_receiver(serde_json::to_value(receiver)?);
+    crate::state::ownership::write_owner(state, &team_key, record);
     Ok(())
 }
 
+/// Stage 3 owner persist fix (architect direction 2026-06-24): determine
+/// the canonical team_key for an in-memory ownership write. When the state
+/// carries an `active_team_key` (set by `project_top_level_view` whenever
+/// an explicit team was scoped into the claim path), trust it — that's the
+/// requested team that `save_claim_team_scoped_state` will read back. Only
+/// fall back to `team_state_key(state)` for the legacy unscoped flow where
+/// the writer must derive team identity from session/dir/spec_path fields.
+fn canonical_owner_write_key(state: &Value) -> String {
+    if let Some(active) = state
+        .get("active_team_key")
+        .and_then(Value::as_str)
+        .filter(|key| !key.is_empty())
+    {
+        return active.to_string();
+    }
+    crate::state::projection::team_state_key(state)
+}
+
 fn state_receiver(state: &Value) -> Option<LeaderReceiver> {
     state
         .get("leader_receiver")
@@ -1139,9 +1174,16 @@ fn save_claim_team_scoped_state(workspace: &Path, state: &Value, target_key: &st
             .entry(existing_key)
             .or_insert_with(|| crate::state::projection::compact_team_state(&existing));
     }
+    // Stage 3 owner persist fix (architect direction 2026-06-24,
+    // .team/artifacts/stage3-owner-persist-fix.md): after Stage 3d removed
+    // top-level dual-write, the canonical ownership record lives ONLY at
+    // `state.teams[target_key].{team_owner, leader_receiver, owner_epoch}`.
+    // `compact_team_state(state)` strips the `teams` key entirely — that
+    // dropped the just-written nested ownership record on disk. Use the
+    // preserving helper so the canonical fields survive the compaction.
     teams.insert(
         target_key.to_string(),
-        crate::state::projection::compact_team_state(state),
+        compact_team_state_preserving_ownership(state, target_key),
     );
     let existing_primary_key = existing
         .get("session_name")
@@ -1154,16 +1196,18 @@ fn save_claim_team_scoped_state(workspace: &Path, state: &Value, target_key: &st
     } else {
         value_object(&existing)
     };
-    if !had_existing_teams
-        || existing_primary_key.as_deref().is_none_or(|key| key == target_key)
-        || existing_active_key == Some(target_key)
-    {
-        for key in ["leader_receiver", "team_owner", "owner_epoch"] {
-            if let Some(value) = state.get(key) {
-                merged.insert(key.to_string(), value.clone());
-            }
-        }
-    }
+    // Stage 3 top-level cleanup (architect direction 2026-06-24,
+    // .team/artifacts/stage3-toplevel-cleanup-fix.md + stage3-save-strip-fix.md):
+    // the legacy top-level owner copy loop is gone; the canonical-aware
+    // strip is now performed at the persistence boundary
+    // (`state::persist::save_runtime_state_with_merge_exceptions`), which
+    // every save_runtime_state* path funnels through. This per-call-site
+    // strip call has been removed — the save output handles cleanup
+    // uniformly for claim / restart / shutdown / start-agent / stop-agent
+    // / coordinator tick / promote sibling. `had_existing_teams` /
+    // primary/active key computations are retained as dead writes only
+    // via _ binding — they no longer gate any owner promote.
+    let _ = (had_existing_teams, existing_primary_key, existing_active_key);
     merged.insert("teams".to_string(), Value::Object(teams));
     crate::state::persist::save_runtime_state(workspace, &Value::Object(merged))?;
     Ok(())
@@ -1173,6 +1217,41 @@ fn value_object(value: &Value) -> serde_json::Map<String, Value> {
     value.as_object().cloned().unwrap_or_default()
 }
 
+/// Stage 3 owner persist fix (architect direction 2026-06-24,
+/// .team/artifacts/stage3-owner-persist-fix.md): build the per-team
+/// snapshot used by `save_claim_team_scoped_state` so the canonical
+/// `teams.<target_key>.{team_owner, leader_receiver, owner_epoch}` record
+/// survives the `compact_team_state` strip. Without this helper the
+/// claim-leader save loses the just-written nested ownership record (the
+/// S3-OWNER-001 evidence shape: `persisted_owner_locations=[]`).
+///
+/// Behaviour:
+/// - Start from the existing `compact_team_state(state)` (strips `teams`).
+/// - Look up `state.teams[target_key].{team_owner, leader_receiver, owner_epoch}`
+///   and copy each present field into the compacted entry.
+/// - Top-level owner fields stay UNTOUCHED — Stage 3d's canonical-only
+///   shape is preserved on disk.
+fn compact_team_state_preserving_ownership(state: &Value, target_key: &str) -> Value {
+    let mut entry = crate::state::projection::compact_team_state(state);
+    let Some(entry_obj) = entry.as_object_mut() else {
+        return entry;
+    };
+    let Some(owner_obj) = state
+        .get("teams")
+        .and_then(Value::as_object)
+        .and_then(|teams| teams.get(target_key))
+        .and_then(Value::as_object)
+    else {
+        return entry;
+    };
+    for key in ["team_owner", "leader_receiver", "owner_epoch"] {
+        if let Some(value) = owner_obj.get(key) {
+            entry_obj.insert(key.to_string(), value.clone());
+        }
+    }
+    entry
+}
+
 /// `_detect_dual_state_divergence`(card §85 C18;`__init__.py:556`)。workspace-level 与
 /// team-level snapshot 在 owner_uuid/receiver_pane_id/owner_epoch 上是否分叉 → `Some(详情)`。
 /// **CROSS-LANE**:snapshot 读经 step 13 restart。

package/crates/team-agent/src/leader/rediscover/tests.rs

@@ -127,10 +127,14 @@ fn try_readopt_writes_owner_receiver_dual_state_and_events() {
     assert_eq!(got.1["pane"]["pane_id"], json!("%new"));
     assert_eq!(got.1["readopted"], json!(true));
     assert!(got.1.get("warning").is_some_and(Value::is_null));
-    assert_eq!(state["team_owner"]["pane_id"], json!("%new"));
-    assert_eq!(state["team_owner"]["claimed_via"], json!("attach-leader"));
-    assert_eq!(state["team_owner"]["owner_epoch"], json!(4));
-    assert_eq!(state["leader_receiver"]["discovery"], json!("attach_readopt"));
+    // Stage 3d: owner + receiver live at canonical teams.<team_key>.
+    let team_key = crate::state::projection::team_state_key(&state);
+    let owner_view = &state["teams"][&team_key]["team_owner"];
+    let receiver_view = &state["teams"][&team_key]["leader_receiver"];
+    assert_eq!(owner_view["pane_id"], json!("%new"));
+    assert_eq!(owner_view["claimed_via"], json!("attach-leader"));
+    assert_eq!(owner_view["owner_epoch"], json!(4));
+    assert_eq!(receiver_view["discovery"], json!("attach_readopt"));
     assert!(crate::model::paths::runtime_dir(&ws)
         .join("teams")
         .join("sess")
@@ -185,6 +189,10 @@ fn try_readopt_refuses_when_different_live_owner_uuid_mismatches() {
     .unwrap();
 
     assert!(got.is_none());
+    // Stage 3d: no owner anywhere — check both legacy top-level and the
+    // canonical teams.<key> location via the ownership repository.
+    let team_key = crate::state::projection::team_state_key(&state);
+    assert!(crate::state::ownership::read_owner_value(&state, &team_key).is_none());
     assert!(state.get("team_owner").is_none());
 }
 
@@ -227,7 +235,10 @@ fn rediscover_updates_unique_env_triple_match() {
     assert_eq!(out["status"], json!("updated"));
     assert!(out.get("ok").is_none(), "golden rediscover result has no ok wrapper");
     assert_eq!(out["owner_identity"]["pane_id"], json!("%r"));
-    assert_eq!(state["leader_receiver"]["pane_id"], json!("%r"));
+    // Stage 3d: receiver lives at canonical teams.<team_key>.leader_receiver.
+    let team_key = crate::state::projection::team_state_key(&state);
+    let receiver = &state["teams"][&team_key]["leader_receiver"];
+    assert_eq!(receiver["pane_id"], json!("%r"));
     let events = event_log.tail(10).unwrap();
     let rediscovered = event_named(&events, "leader_receiver.rediscovered");
     assert_eq!(rediscovered["provider"], json!("codex"));
@@ -241,7 +252,7 @@ fn rediscover_updates_unique_env_triple_match() {
     assert_eq!(rebound["new_pane_id"], json!("%r"));
     assert_eq!(rebound["owner_identity"]["machine_fingerprint"], json!("fp"));
     assert_eq!(rebound["uuid_prefix"], json!("OWNERUUI"));
-    assert_eq!(state["leader_receiver"]["discovery"], json!("stale_rediscovery_unique_candidate"));
+    assert_eq!(receiver["discovery"], json!("stale_rediscovery_unique_candidate"));
 }
 
 #[test]
@@ -286,7 +297,10 @@ fn rediscover_owner_identity_passthrough_sets_discovery_and_reason() {
 
     assert_eq!(out["status"], json!("updated"));
     assert_eq!(out["owner_identity"], raw_identity);
-    assert_eq!(state["leader_receiver"]["discovery"], json!("stale_rediscovery_owner_identity"));
+    // Stage 3d: receiver lives at canonical teams.<team_key>.leader_receiver.
+    let team_key = crate::state::projection::team_state_key(&state);
+    let receiver = &state["teams"][&team_key]["leader_receiver"];
+    assert_eq!(receiver["discovery"], json!("stale_rediscovery_owner_identity"));
     let rebound = event_named(&event_log.tail(10).unwrap(), "leader_receiver.rebind_applied");
     assert_eq!(rebound["reason"], json!("stale_receiver"));
     assert_eq!(rebound["owner_identity"], raw_identity);

package/crates/team-agent/src/leader/rediscover.rs

@@ -1064,6 +1064,9 @@ fn state_receiver(state: &Value) -> Option<LeaderReceiver> {
         .and_then(|value| serde_json::from_value(value).ok())
 }
 
+/// Stage 3a (identity-boundary unified plan, architect direction 2026-06-23):
+/// route the readopt binding write through the ownership repository.
+/// Behaviour byte-identical to the pre-3a hand-rolled inserts.
 fn write_readopt_state(
     workspace: &Path,
     state: &mut Value,
@@ -1073,11 +1076,14 @@ fn write_readopt_state(
     if !state.is_object() {
         *state = json!({});
     }
-    let Some(root) = state.as_object_mut() else {
+    if !state.is_object() {
         return Err(LeaderError::Validation("state root is not an object".to_string()));
-    };
-    root.insert("leader_receiver".to_string(), serde_json::to_value(receiver)?);
-    root.insert("team_owner".to_string(), serde_json::to_value(owner)?);
+    }
+    let team_key = crate::state::projection::team_state_key(state);
+    let record = crate::state::ownership::OwnershipWrite::new()
+        .with_leader_receiver(serde_json::to_value(receiver)?)
+        .with_team_owner(serde_json::to_value(owner)?);
+    crate::state::ownership::write_owner(state, &team_key, record);
     crate::leader::write_lease_dual_state(workspace, state)
 }
 
@@ -1089,10 +1095,13 @@ fn write_receiver_state(
     if !state.is_object() {
         *state = json!({});
     }
-    let Some(root) = state.as_object_mut() else {
+    if !state.is_object() {
         return Err(LeaderError::Validation("state root is not an object".to_string()));
-    };
-    root.insert("leader_receiver".to_string(), serde_json::to_value(receiver)?);
+    }
+    let team_key = crate::state::projection::team_state_key(state);
+    let record = crate::state::ownership::OwnershipWrite::new()
+        .with_leader_receiver(serde_json::to_value(receiver)?);
+    crate::state::ownership::write_owner(state, &team_key, record);
     crate::leader::write_lease_dual_state(workspace, state)
 }
 

package/crates/team-agent/src/leader/start.rs

@@ -587,10 +587,13 @@ fn persist_managed_leader_binding(
                 "tmux": std::env::var("TMUX").ok(),
             }),
         );
-        obj.insert("leader_receiver".to_string(), receiver);
-        obj.insert("team_owner".to_string(), owner);
-        obj.insert("owner_epoch".to_string(), serde_json::json!(owner_epoch));
     }
+    // Stage 3a/d (identity-boundary unified plan, architect direction
+    // 2026-06-23): build the teams.<key> entry from the non-owner fields
+    // of state (compact_team_state strips the `teams` key), then publish
+    // the canonical owner record AFTER teams.insert so write_owner's
+    // teams.<key>.{team_owner,leader_receiver,owner_epoch} is the final
+    // word and doesn't get overwritten by the compacted entry.
     let entry = crate::state::projection::compact_team_state(&state);
     if let Some(obj) = state.as_object_mut() {
         let teams = obj
@@ -600,6 +603,11 @@ fn persist_managed_leader_binding(
             teams.insert(identity.team_id.as_str().to_string(), entry);
         }
     }
+    let record = crate::state::ownership::OwnershipWrite::new()
+        .with_leader_receiver(receiver)
+        .with_team_owner(owner)
+        .with_owner_epoch(owner_epoch);
+    crate::state::ownership::write_owner(&mut state, identity.team_id.as_str(), record);
     crate::state::persist::save_runtime_state(workspace, &state)?;
     Ok(())
 }
@@ -689,10 +697,11 @@ fn persist_exec_provider_leader_binding(
                 "tmux": std::env::var("TMUX").ok(),
             }),
         );
-        obj.insert("leader_receiver".to_string(), receiver);
-        obj.insert("team_owner".to_string(), owner);
-        obj.insert("owner_epoch".to_string(), serde_json::json!(owner_epoch));
     }
+    // Stage 3a/d (identity-boundary unified plan, architect direction
+    // 2026-06-23): compact-then-write-owner ordering as in
+    // persist_managed_leader_binding above. write_owner must be the final
+    // write so the canonical teams.<key> owner record survives.
     let entry = crate::state::projection::compact_team_state(&state);
     if let Some(obj) = state.as_object_mut() {
         let teams = obj
@@ -702,6 +711,11 @@ fn persist_exec_provider_leader_binding(
             teams.insert(identity.team_id.as_str().to_string(), entry);
         }
     }
+    let record = crate::state::ownership::OwnershipWrite::new()
+        .with_leader_receiver(receiver)
+        .with_team_owner(owner)
+        .with_owner_epoch(owner_epoch);
+    crate::state::ownership::write_owner(&mut state, identity.team_id.as_str(), record);
     crate::state::persist::save_runtime_state(workspace, &state)?;
     Ok(())
 }
@@ -1351,16 +1365,15 @@ mod tests {
         assert_eq!(outcome.status, crate::leader::LeaderLaunchStatus::Exited);
         let state = crate::state::persist::load_runtime_state(&workspace).unwrap();
         assert_eq!(state["is_external_leader"], serde_json::json!(false));
-        assert_eq!(state["leader_receiver"]["pane_id"], serde_json::json!("%77"));
-        assert_eq!(
-            state["leader_receiver"]["tmux_socket"],
-            serde_json::json!("/private/tmp/tmux-501/default")
-        );
-        assert_eq!(state["team_owner"]["pane_id"], serde_json::json!("%77"));
+        // Stage 3d: canonical owner/receiver at teams.<team_key>.
         assert_eq!(
             state["teams"]["current"]["leader_receiver"]["pane_id"],
             serde_json::json!("%77")
         );
+        assert_eq!(
+            state["teams"]["current"]["leader_receiver"]["tmux_socket"],
+            serde_json::json!("/private/tmp/tmux-501/default")
+        );
         assert_eq!(
             state["teams"]["current"]["team_owner"]["pane_id"],
             serde_json::json!("%77")

package/crates/team-agent/src/leader/tests/byte_findings.rs

@@ -10,7 +10,12 @@ use super::*;
         let r = claim_lease_no_incident(&ws, &mut state, None, &TeamKey::new("current"),
             &PaneId::new("%5"), false, &crate::event_log::EventLog::new(&ws), &seeded_liveness(&["%5"])).unwrap();
         assert!(r.ok && r.status == LeaseStatus::Claimed, "precondition: vacant acquire");
-        let owner = state["team_owner"].as_object().expect("team_owner object");
+        // Stage 3d (identity-boundary unified plan, architect direction
+        // 2026-06-23): canonical owner now at teams.<team_key>.team_owner.
+        let team_key = crate::state::projection::team_state_key(&state);
+        let owner = state["teams"][&team_key]["team_owner"]
+            .as_object()
+            .expect("Stage 3d: team_owner at canonical teams.<team_key>");
         assert!(owner.contains_key("os_user"),
             "golden claim-path team_owner carries os_user even when empty; keys={:?}", owner.keys().collect::<Vec<_>>());
         let keys: Vec<&str> = owner.keys().map(String::as_str).collect();
@@ -37,7 +42,11 @@ use super::*;
         let r = claim_lease_no_incident(&ws, &mut state, None, &TeamKey::new("current"),
             &PaneId::new("%5"), false, &crate::event_log::EventLog::new(&ws), &seeded_liveness(&["%5"])).unwrap();
         assert!(r.ok && r.status == LeaseStatus::Claimed, "precondition: vacant acquire");
-        let recv = state["leader_receiver"].as_object().expect("leader_receiver object");
+        // Stage 3d: canonical receiver at teams.<team_key>.leader_receiver.
+        let team_key = crate::state::projection::team_state_key(&state);
+        let recv = state["teams"][&team_key]["leader_receiver"]
+            .as_object()
+            .expect("Stage 3d: leader_receiver at canonical teams.<team_key>");
         for extra in ["fingerprint", "requested_provider", "warning"] {
             assert!(!recv.contains_key(extra),
                 "golden leader_receiver has NO '{extra}' key (Rust must add skip_serializing_if); keys={:?}", recv.keys().collect::<Vec<_>>());