@team-agent/installer 0.4.0 → 0.4.2

package/crates/team-agent/src/leader/tests/lease_claim.rs

@@ -35,18 +35,45 @@ use super::*;
         let receiver = r.receiver.as_ref().expect("claimed → receiver");
         assert_eq!(receiver.pane_id, caller);
         assert_eq!(receiver.discovery, Some(Discovery::ClaimLeader));
-        // dual-state: BOTH workspace state.json + team/<session> snapshot carry %5/epoch 1.
+        // Stage 3d (identity-boundary unified plan, architect direction
+        // 2026-06-23): canonical owner now lives at teams.<team_key>; the
+        // top-level dual-write was dropped. Read through the ownership
+        // repository which preserves the legacy precedence for callers
+        // that still consult top-level on migration states.
         let ws_path = crate::state::persist::runtime_state_path(&ws);
         let ws_state: serde_json::Value =
             serde_json::from_str(&std::fs::read_to_string(&ws_path).unwrap()).unwrap();
-        assert_eq!(ws_state["team_owner"]["pane_id"], serde_json::json!("%5"));
-        assert_eq!(ws_state["team_owner"]["owner_epoch"], serde_json::json!(1));
+        // The canonical team_key is what `team_state_key(state)` derives
+        // (here: state's session_name "team-agent-x" since no explicit
+        // team_key/team_dir/spec_path was seeded). The test's `team_id`
+        // parameter is the LOOKUP key but `claim_lease_no_incident` uses
+        // the state-derived key for canonical writes. Stage 5 will unify
+        // these via TeamRuntimePaths.
+        let canonical_key = crate::state::projection::team_state_key(&ws_state);
+        let ws_owner =
+            crate::state::ownership::read_owner_value(&ws_state, &canonical_key)
+                .expect("Stage 3d: vacant acquire writes canonical owner");
+        assert_eq!(ws_owner["pane_id"], serde_json::json!("%5"));
+        assert_eq!(ws_owner["owner_epoch"], serde_json::json!(1));
+        // team_id parameter is currently unused by the canonical write
+        // (architect Stage 5 will close this gap); silence the warning.
+        let _ = &team_id;
         let snap_path = crate::model::paths::runtime_dir(&ws)
             .join("teams").join("team-agent-x").join("state.json");
         let snap: serde_json::Value =
             serde_json::from_str(&std::fs::read_to_string(&snap_path).unwrap()).unwrap();
-        assert_eq!(snap["team_owner"]["pane_id"], serde_json::json!("%5"), "dual-state snapshot owner");
-        assert_eq!(snap["team_owner"]["owner_epoch"], serde_json::json!(1));
+        // Snapshot is per-session; team_state_key on the snapshot derives
+        // from its session_name. Read top-level first (legacy snapshot
+        // layout), fall back to derived team key.
+        let snap_owner = snap
+            .get("team_owner")
+            .or_else(|| {
+                let key = crate::state::projection::team_state_key(&snap);
+                snap.get("teams").and_then(|t| t.get(key)).and_then(|e| e.get("team_owner"))
+            })
+            .expect("dual-state snapshot owner");
+        assert_eq!(snap_owner["pane_id"], serde_json::json!("%5"), "dual-state snapshot owner");
+        assert_eq!(snap_owner["owner_epoch"], serde_json::json!(1));
     }
 
     // RED — DEAD-OWNER RECOVER: bound pane %1 absent from live set, caller %5
@@ -173,8 +200,11 @@ use super::*;
             &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
         )
         .unwrap();
+        // Stage 3d: canonical receiver at teams.<team_key>.leader_receiver.
+        let team_key = crate::state::projection::team_state_key(&persisted);
+        let receiver = &persisted["teams"][&team_key]["leader_receiver"];
         assert_eq!(
-            persisted["leader_receiver"]["tmux_socket"],
+            receiver["tmux_socket"],
             serde_json::json!(leader_socket),
             "state.json must carry enough endpoint information for later delivery to use tmux -S"
         );
@@ -290,8 +320,11 @@ use super::*;
             &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
         )
         .unwrap();
+        // Stage 3d: canonical receiver at teams.<team_key>.leader_receiver.
+        let team_key = crate::state::projection::team_state_key(&persisted);
+        let receiver = &persisted["teams"][&team_key]["leader_receiver"];
         assert_eq!(
-            persisted["leader_receiver"]["tmux_socket"],
+            receiver["tmux_socket"],
             serde_json::json!(current_socket),
             "state must not preserve a short endpoint after explicit claim; state={persisted}"
         );
@@ -408,3 +441,211 @@ use super::*;
     // _lease_epoch:400, _emit_lease_refusal:469, audit :712-729). These REDs lock the EXACT
     // golden shape per divergence; driven via claim_lease_no_incident(+seeded_liveness), OS-safe.
     // ═════════════════════════════════════════════════════════════════════════
+
+    /// **S3-OWNER-001 regression** (architect Stage 3 owner persist fix,
+    /// .team/artifacts/stage3-owner-persist-fix.md). Pre-fix on commit
+    /// `5d980c7`:
+    /// 1. `claim-leader --team alpha` returns `ok=true/status=claimed`.
+    /// 2. In-memory state has `state.teams.alpha.team_owner` set by
+    ///    `write_binding_to_state` → `state::ownership::write_owner`.
+    /// 3. `save_claim_team_scoped_state` calls `compact_team_state(state)` to
+    ///    build the per-team snapshot. `compact_team_state` strips the
+    ///    `teams` key entirely — the just-written nested ownership record
+    ///    is DROPPED on the way to disk.
+    /// 4. After Stage 3d removed the top-level dual-write, no copy survives.
+    /// 5. Reloading the workspace state.json shows `persisted_owner_locations=[]`.
+    ///
+    /// Fix: `save_claim_team_scoped_state` now uses
+    /// `compact_team_state_preserving_ownership(state, target_key)` which
+    /// re-injects `team_owner / leader_receiver / owner_epoch` from
+    /// `state.teams[target_key]` into the compacted entry. Top-level fields
+    /// remain absent (Stage 3d canonical shape preserved).
+    #[test]
+    #[serial_test::serial(env)]
+    fn claim_team_scoped_persists_canonical_owner_under_teams_target_key() {
+        let _g = ENV_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let _e = EnvGuard::apply(&[("TEAM_AGENT_LEADER_SESSION_UUID_OVERRIDE", None)]);
+        let ws = p2_temp_ws("claim_team_persist");
+        let target = "alpha";
+        let team_id = TeamKey::new(target);
+        let caller = PaneId::new("%5");
+        // Seed runtime state with a teams entry but no owner fields anywhere
+        // (the S3-OWNER-001 starting condition). team_dir is set so
+        // team_state_key resolves to the target team_key, matching the
+        // claim path's projected-state shape.
+        let mut state = serde_json::json!({
+            "session_name": "team-agent-x",
+            "team_dir": format!("/tmp/{}", target),
+            "teams": {target: {}},
+        });
+        let event_log = crate::event_log::EventLog::new(&ws);
+        let live = seeded_liveness(&["%5"]);
+        let r = claim_lease_no_incident(
+            &ws, &mut state, Some(target), &team_id, &caller, false, &event_log, &live,
+        )
+        .unwrap();
+        assert!(r.ok, "S3-OWNER-001: claim must succeed; got {r:?}");
+        assert_eq!(r.status, LeaseStatus::Claimed);
+
+        // Reload state from disk — this is where the pre-fix loss surfaced.
+        let persisted_path = crate::state::persist::runtime_state_path(&ws);
+        let persisted: serde_json::Value = serde_json::from_str(
+            &std::fs::read_to_string(&persisted_path).unwrap(),
+        )
+        .unwrap();
+
+        // Canonical: teams.<target_key>.{team_owner, leader_receiver, owner_epoch}.
+        let entry = &persisted["teams"][target];
+        assert_eq!(
+            entry["team_owner"]["pane_id"],
+            serde_json::json!("%5"),
+            "S3-OWNER-001 fix: teams.{target}.team_owner.pane_id persisted; \
+             persisted={persisted}"
+        );
+        assert_eq!(
+            entry["leader_receiver"]["pane_id"],
+            serde_json::json!("%5"),
+            "S3-OWNER-001 fix: teams.{target}.leader_receiver.pane_id persisted; \
+             persisted={persisted}"
+        );
+        assert_eq!(
+            entry["owner_epoch"], serde_json::json!(1),
+            "S3-OWNER-001 fix: teams.{target}.owner_epoch=1 persisted; \
+             persisted={persisted}"
+        );
+
+        // Stage 3d invariant: top-level owner fields stay ABSENT (no
+        // recurrence of the legacy dual-write).
+        assert!(
+            persisted.get("team_owner").is_none(),
+            "Stage 3d: top-level team_owner must remain absent; persisted={persisted}"
+        );
+        assert!(
+            persisted.get("leader_receiver").is_none(),
+            "Stage 3d: top-level leader_receiver must remain absent; persisted={persisted}"
+        );
+        assert!(
+            persisted.get("owner_epoch").is_none(),
+            "Stage 3d: top-level owner_epoch must remain absent; persisted={persisted}"
+        );
+    }
+
+    /// **S3-OWNER-002 regression** (architect Stage 3 top-level cleanup,
+    /// .team/artifacts/stage3-toplevel-cleanup-fix.md). Even with the
+    /// nested-ownership-preserving compact (aae818f), a SECOND claim on a
+    /// state whose root still carries legacy top-level `team_owner` /
+    /// `leader_receiver` / `owner_epoch` would leave the stale root copy
+    /// on disk while the canonical `teams.<key>` advanced. Evidence:
+    /// `state-after-claim.json` showed `team_owner=%2/epoch=1` at root and
+    /// `teams.<key>.team_owner=%3/epoch=2` — exact dual-source recurrence.
+    ///
+    /// Fix: `save_claim_team_scoped_state` strips legacy root ownership
+    /// fields before save via `state::ownership::strip_top_level_ownership`,
+    /// and the legacy "copy top-level owner from incoming state into
+    /// merged" loop is removed. After every successful named-team owner
+    /// mutation, persisted root is canonical-only.
+    #[test]
+    #[serial_test::serial(env)]
+    fn second_claim_strips_legacy_top_level_ownership_from_persisted_root() {
+        let _g = ENV_LOCK.lock().unwrap_or_else(|p| p.into_inner());
+        let _e = EnvGuard::apply(&[("TEAM_AGENT_LEADER_SESSION_UUID_OVERRIDE", None)]);
+        let ws = p2_temp_ws("claim_team_second_strip");
+        let target = "alpha";
+        let team_id = TeamKey::new(target);
+        let caller = PaneId::new("%3");
+        // Seed a state whose root carries stale legacy top-level owner
+        // (%2/epoch=1) AND a teams.<target_key> entry that already has
+        // canonical ownership at the previous epoch. This is the
+        // post-S3-OWNER-001-fix shape on disk after one prior claim.
+        let mut state = serde_json::json!({
+            "session_name": "team-agent-x",
+            "team_dir": format!("/tmp/{}", target),
+            "active_team_key": target,
+            "team_owner": {
+                "pane_id": "%2",
+                "provider": "codex",
+                "machine_fingerprint": "fp",
+                "leader_session_uuid": "OLDUUID",
+                "owner_epoch": 1,
+                "claimed_at": "t",
+                "claimed_via": "claim-leader",
+            },
+            "leader_receiver": {
+                "pane_id": "%2",
+                "owner_epoch": 1,
+                "leader_session_uuid": "OLDUUID",
+            },
+            "owner_epoch": 1,
+            "teams": {
+                target: {
+                    "team_owner": {
+                        "pane_id": "%2",
+                        "provider": "codex",
+                        "machine_fingerprint": "fp",
+                        "leader_session_uuid": "OLDUUID",
+                        "owner_epoch": 1,
+                        "claimed_at": "t",
+                        "claimed_via": "claim-leader",
+                    },
+                    "leader_receiver": {
+                        "pane_id": "%2",
+                        "owner_epoch": 1,
+                        "leader_session_uuid": "OLDUUID",
+                    },
+                    "owner_epoch": 1,
+                }
+            },
+        });
+        // Persist the seeded shape so `save_claim_team_scoped_state` loads
+        // it back as `existing` on save.
+        crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+        let event_log = crate::event_log::EventLog::new(&ws);
+        // Both panes live so the dead-owner reclaim branch doesn't apply;
+        // explicit takeover via confirm=true forces the claim past the
+        // live-owner gate.
+        let live = seeded_liveness(&["%2", "%3"]);
+        let r = claim_lease_no_incident(
+            &ws, &mut state, Some(target), &team_id, &caller, true, &event_log, &live,
+        )
+        .unwrap();
+        assert!(r.ok, "S3-OWNER-002: explicit takeover must succeed; got {r:?}");
+        assert_eq!(r.status, LeaseStatus::Claimed);
+
+        let persisted_path = crate::state::persist::runtime_state_path(&ws);
+        let persisted: serde_json::Value = serde_json::from_str(
+            &std::fs::read_to_string(&persisted_path).unwrap(),
+        )
+        .unwrap();
+
+        // Canonical advanced.
+        let entry = &persisted["teams"][target];
+        assert_eq!(
+            entry["team_owner"]["pane_id"],
+            serde_json::json!("%3"),
+            "S3-OWNER-002 fix: canonical owner advanced to new pane; persisted={persisted}"
+        );
+        assert_eq!(
+            entry["owner_epoch"],
+            serde_json::json!(2),
+            "S3-OWNER-002 fix: canonical owner_epoch advanced to 2; persisted={persisted}"
+        );
+        assert_eq!(
+            entry["leader_receiver"]["pane_id"],
+            serde_json::json!("%3"),
+            "S3-OWNER-002 fix: canonical receiver advanced; persisted={persisted}"
+        );
+
+        // Top-level stale legacy owner stripped.
+        assert!(
+            persisted.get("team_owner").is_none(),
+            "S3-OWNER-002 fix: stale top-level team_owner must be stripped; persisted={persisted}"
+        );
+        assert!(
+            persisted.get("leader_receiver").is_none(),
+            "S3-OWNER-002 fix: stale top-level leader_receiver must be stripped; persisted={persisted}"
+        );
+        assert!(
+            persisted.get("owner_epoch").is_none(),
+            "S3-OWNER-002 fix: stale top-level owner_epoch must be stripped; persisted={persisted}"
+        );
+    }