@team-agent/installer 0.4.5 → 0.4.6

package/crates/team-agent/src/provider/session/capture.rs

@@ -21,6 +21,11 @@ pub struct CapturePassReport {
     pub ambiguous: Vec<AmbiguousSessionCapture>,
     pub capture_failures: Vec<SessionCaptureFailure>,
     pub candidate_count_by_agent: BTreeMap<String, usize>,
+    /// 0.4.6 Stage 3: agents that transitioned into the
+    /// `transcript_missing` capture_state during this pass. The caller
+    /// (coordinator tick) emits a throttled
+    /// `provider.session.transcript_missing` event for each entry.
+    pub transcript_missing: Vec<TranscriptMissing>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -35,6 +40,19 @@ pub struct AmbiguousSessionCapture {
     pub spawn_cwd: String,
 }
 
+/// 0.4.6 Stage 3: information emitted when a pending agent transitions
+/// into the `transcript_missing` capture_state. Carries the diagnostic
+/// fields the caller uses to write the
+/// `provider.session.transcript_missing` event.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct TranscriptMissing {
+    pub agent_id: String,
+    pub spawn_cwd: String,
+    pub spawn_epoch: u64,
+    pub expected_session_id: Option<String>,
+    pub candidate_count: usize,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct SessionConvergence {
     pub converged: bool,
@@ -173,7 +191,7 @@ where
         .iter()
         .map(|item| item.agent_id.clone())
         .collect::<BTreeSet<_>>();
-    let mut claimed = claimed_provider_session_keys(agent_map, &pending_ids);
+    let mut claimed = claimed_provider_session_keys(state, agent_map, &pending_ids);
     let (assignments, ambiguous_ids) =
         allocate_session_candidates(&pending, &candidates_by_agent, &mut claimed);
 
@@ -220,17 +238,27 @@ where
                         "attribution_ambiguous".to_string(),
                         serde_json::json!(true),
                     );
-                    agent_obj.insert(
-                        "captured_at".to_string(),
-                        serde_json::json!(chrono::Utc::now().to_rfc3339()),
-                    );
+                    // 0.4.6 tuple-atomic contract (audit:93): do NOT write
+                    // `captured_at` for ambiguity diagnostics. `captured_at`
+                    // is part of the authoritative tuple and may only be
+                    // set together with `session_id + rollout_path +
+                    // captured_via`. Overloading it as both capture
+                    // timestamp and ambiguity timestamp created false
+                    // "looks captured" rows. Ambiguity diagnostics live in
+                    // the `attribution_ambiguous` flag + events; persist
+                    // event log for the timestamp.
                     report.changed = true;
                 }
                 continue;
             }
-            apply_captured_session(agent_obj, &candidate.captured);
-            report.changed = true;
-            report.assigned.push(item.agent_id);
+            // 0.4.6 tuple-atomic contract: apply_captured_session refuses
+            // partial candidates (no session_id or no rollout_path). When
+            // it returns false, the row stays unchanged; capture re-runs
+            // on the next coordinator tick.
+            if apply_captured_session(agent_obj, &candidate.captured) {
+                report.changed = true;
+                report.assigned.push(item.agent_id);
+            }
             continue;
         }
         if ambiguous_ids.contains(&item.agent_id) {
@@ -241,16 +269,151 @@ where
             if finalize_ambiguous {
                 agent_obj.insert("attribution_ambiguous".to_string(), serde_json::json!(true));
                 agent_obj.insert(
-                    "captured_at".to_string(),
-                    serde_json::json!(chrono::Utc::now().to_rfc3339()),
+                    "capture_state".to_string(),
+                    serde_json::json!("attribution_ambiguous"),
                 );
+                // 0.4.6 tuple-atomic contract: see comment above. Removed
+                // `captured_at` ambiguity write.
                 report.changed = true;
             }
+            continue;
+        }
+        // 0.4.6 Stage 3: transcript-ready handshake. For pending agents that
+        // are NOT ambiguous and were NOT captured this pass, classify into:
+        //   * `captured` — session_id + rollout_path already on row
+        //   * `transcript_missing` — trigger event has fired (report_result /
+        //     first_send_at / pane_output_advanced) AND elapsed > threshold
+        //     AND zero candidates / no backing
+        //   * `waiting_for_transcript` — still in grace period
+        // The state field surfaces in status/diagnose without changing the
+        // authoritative tuple contract (we never write session_id without
+        // backing). Throttled event emission is done by the caller (tick).
+        let has_session = agent_obj
+            .get("session_id")
+            .and_then(Value::as_str)
+            .is_some_and(|s| !s.is_empty())
+            && agent_obj
+                .get("rollout_path")
+                .and_then(Value::as_str)
+                .is_some_and(|s| !s.is_empty());
+        if has_session {
+            // Captured already — fix state field if drifted.
+            if agent_obj
+                .get("capture_state")
+                .and_then(Value::as_str)
+                != Some("captured")
+            {
+                agent_obj.insert("capture_state".to_string(), serde_json::json!("captured"));
+                report.changed = true;
+            }
+            continue;
+        }
+        let candidate_count = report
+            .candidate_count_by_agent
+            .get(&item.agent_id)
+            .copied()
+            .unwrap_or(0);
+        let next_state = classify_pending_capture_state(agent_obj, candidate_count);
+        let prev_state = agent_obj
+            .get("capture_state")
+            .and_then(Value::as_str)
+            .map(str::to_string);
+        if prev_state.as_deref() != Some(next_state) {
+            agent_obj.insert(
+                "capture_state".to_string(),
+                serde_json::json!(next_state),
+            );
+            report.changed = true;
+            if next_state == "transcript_missing" {
+                report.transcript_missing.push(TranscriptMissing {
+                    agent_id: item.agent_id.clone(),
+                    spawn_cwd: item.context.spawn_cwd.to_string_lossy().to_string(),
+                    spawn_epoch: agent_obj
+                        .get("spawn_epoch")
+                        .and_then(Value::as_u64)
+                        .unwrap_or(0),
+                    expected_session_id: item
+                        .context
+                        .expected_session_id
+                        .as_ref()
+                        .map(|s| s.as_str().to_string()),
+                    candidate_count,
+                });
+            }
         }
     }
     Ok(report)
 }
 
+/// 0.4.6 Stage 3: classify a pending agent's capture state into one of:
+///   * `transcript_missing` — has had a strong trigger event AND elapsed
+///     beyond grace threshold AND still no backing
+///   * `waiting_for_transcript` — still in grace period or no trigger yet
+///
+/// Trigger events (CR M2): any of `first_send_at`, `last_result_at`, or a
+/// recent `last_pane_output_at` indicates the worker has been interactively
+/// used / done something. Without ANY trigger, we stay in waiting state
+/// even past the grace window (silent worker is not a failure to capture).
+///
+/// Threshold: 30 seconds from spawned_at OR 15 seconds from the first
+/// trigger event, whichever is later. This avoids spurious
+/// transcript_missing on slow first-paint while catching the
+/// release-engineer scenario (report_result fired but no jsonl).
+fn classify_pending_capture_state(
+    agent_obj: &serde_json::Map<String, Value>,
+    candidate_count: usize,
+) -> &'static str {
+    // Already-captured agents don't reach here (caller skips). We only
+    // classify pending agents.
+    let now = chrono::Utc::now();
+    let spawned_at = agent_obj
+        .get("spawned_at")
+        .and_then(Value::as_str)
+        .and_then(|s| chrono::DateTime::parse_from_rfc3339(s).ok())
+        .map(|dt| dt.with_timezone(&chrono::Utc));
+    let elapsed_since_spawn = spawned_at
+        .map(|t| now.signed_duration_since(t).num_seconds())
+        .unwrap_or(0);
+    // Trigger event detection — any strong signal that the worker has
+    // actually been used. Pre-conditions (CR M2 in architect doc).
+    let has_trigger = ["first_send_at", "last_result_at", "last_pane_output_at"]
+        .iter()
+        .any(|key| {
+            agent_obj
+                .get(*key)
+                .and_then(Value::as_str)
+                .is_some_and(|s| !s.is_empty())
+        });
+    // Earliest trigger timestamp for the secondary threshold.
+    let earliest_trigger = ["first_send_at", "last_result_at", "last_pane_output_at"]
+        .iter()
+        .filter_map(|key| {
+            agent_obj
+                .get(*key)
+                .and_then(Value::as_str)
+                .and_then(|s| chrono::DateTime::parse_from_rfc3339(s).ok())
+                .map(|dt| dt.with_timezone(&chrono::Utc))
+        })
+        .min();
+    let elapsed_since_trigger = earliest_trigger
+        .map(|t| now.signed_duration_since(t).num_seconds())
+        .unwrap_or(0);
+    const SPAWN_GRACE_SECS: i64 = 30;
+    const TRIGGER_GRACE_SECS: i64 = 15;
+    let past_spawn_grace = elapsed_since_spawn >= SPAWN_GRACE_SECS;
+    let past_trigger_grace = has_trigger && elapsed_since_trigger >= TRIGGER_GRACE_SECS;
+    // transcript_missing requires BOTH: a trigger occurred AND we've
+    // waited past the spawn grace (so we're not blamed for slow startup).
+    // candidate_count == 0 is the "no backing" signal; non-zero
+    // candidates that didn't satisfy assignment go through the ambiguous
+    // path above and don't reach here.
+    if has_trigger && past_spawn_grace && past_trigger_grace && candidate_count == 0 {
+        "transcript_missing"
+    } else {
+        "waiting_for_transcript"
+    }
+}
+
 pub fn incomplete_resumable_agent_ids(state: &Value) -> Vec<String> {
     let Some(agents) = state.get("agents").and_then(Value::as_object) else {
         return Vec::new();
@@ -281,6 +444,13 @@ pub fn recover_resume_session_from_events(
     auth_mode: crate::provider::AuthMode,
     exclude_session_ids: &BTreeSet<String>,
 ) -> Result<Option<Value>, ProviderError> {
+    // E57 postflight: read the agent's provider once; needed for the Claude
+    // leader-marker filter below. Falls back to None on non-string / missing,
+    // in which case the marker filter is skipped (only meaningful for Claude).
+    let provider = previous
+        .get("provider")
+        .and_then(Value::as_str)
+        .and_then(parse_provider);
     let events = crate::event_log::EventLog::new(workspace)
         .tail(0)
         .map_err(|e| ProviderError::Io(e.to_string()))?;
@@ -310,6 +480,20 @@ pub fn recover_resume_session_from_events(
         let Some(rollout_path) = event_rollout_path(event).filter(|path| path.exists()) else {
             continue;
         };
+        // E57 postflight (lane-046-capture-gap): the capture allocator already
+        // refuses Claude leader transcripts (P0 d39b5104,
+        // claude_records_have_leader_marker in provider/adapter.rs). Event-log
+        // repair must apply the SAME filter — otherwise a stale `session.captured`
+        // event from a pre-fix run (or from a window where the allocator was
+        // bypassed) still pulls the 590MB leader transcript onto a worker on the
+        // next restart (Mac mini repro: session_id=ea059b82 reassigned to
+        // release-engineer via captured_via=event_log_repair). The check is
+        // a no-op for non-Claude providers.
+        if let Some(p) = provider {
+            if crate::provider::adapter::rollout_path_has_claude_leader_marker(p, &rollout_path) {
+                continue;
+            }
+        }
         let session = SessionId::new(session_id.to_string());
         if !adapter.session_is_resumable(Some(&session), auth_mode)? {
             continue;
@@ -321,14 +505,22 @@ pub fn recover_resume_session_from_events(
         let Some(obj) = repaired.as_object_mut() else {
             continue;
         };
+        // 0.4.6 tuple-atomic contract (audit §Capture 修改清单, line 113):
+        // repair must yield a COMPLETE tuple. session_id + rollout_path are
+        // already validated above; ensure captured_at + captured_via are
+        // also always written (fall back to now() if the event has no ts).
         obj.insert("session_id".to_string(), serde_json::json!(session_id));
         obj.insert(
             "rollout_path".to_string(),
             serde_json::json!(rollout_path.to_string_lossy().to_string()),
         );
-        if let Some(ts) = event.get("ts").and_then(Value::as_str).filter(|ts| !ts.is_empty()) {
-            obj.insert("captured_at".to_string(), serde_json::json!(ts));
-        }
+        let captured_at = event
+            .get("ts")
+            .and_then(Value::as_str)
+            .filter(|ts| !ts.is_empty())
+            .map(str::to_string)
+            .unwrap_or_else(|| chrono::Utc::now().to_rfc3339());
+        obj.insert("captured_at".to_string(), serde_json::json!(captured_at));
         obj.insert(
             "captured_via".to_string(),
             serde_json::json!("event_log_repair"),
@@ -435,6 +627,13 @@ where
             // — that would trigger the Stage 1 mismatch guard against Codex's
             // real session_meta.payload.id and permanently reject the correct
             // transcript. Codex capture anchors purely on (cwd, spawned_at).
+            // 0.4.7 (B1 verified, partial-resume revert of 9feafc31):
+            // Claude --session-id was restored in adapter.rs build_command_plan
+            // because Claude ≥ 2.1.185 DOES honour framework-supplied session
+            // id and DOES create a transcript at that id. So `_pending_session_id`
+            // is once again valid for Claude — re-enable the Stage 1 pre-pass
+            // for Claude/ClaudeCode. Codex remains excluded (Codex CLI ignores
+            // --session-id, capture must anchor purely on cwd+spawned_at).
             expected_session_id: if matches!(provider, Provider::Codex) {
                 None
             } else {
@@ -493,6 +692,21 @@ fn agent_session_complete(agent: &Value) -> bool {
         Some(path) => path,
         None => return false,
     };
+    // 0.4.6 tuple-atomic contract (audit §Capture 修改清单, line 110):
+    // a "complete" agent session requires the FULL authoritative tuple —
+    // session_id + rollout_path + captured_at + captured_via. Without these
+    // last two, a row is a partial tuple and capture must re-run.
+    let captured_at_ok = agent
+        .get("captured_at")
+        .and_then(Value::as_str)
+        .is_some_and(|ts| !ts.is_empty());
+    let captured_via_ok = agent
+        .get("captured_via")
+        .and_then(Value::as_str)
+        .is_some_and(|via| !via.is_empty());
+    if !captured_at_ok || !captured_via_ok {
+        return false;
+    }
     let path = std::path::Path::new(rollout_path);
     if !path.exists() {
         return false;
@@ -619,6 +833,27 @@ fn allocate_session_candidates(
         if assignments.contains_key(&item.agent_id) {
             continue;
         }
+        // P0 (lane-046-capture-gap): Claude/ClaudeCode with no
+        // expected_session_id (natural fresh — Stage 1 expected-id miss
+        // guard cannot fire) must NOT accept the weak `Any` fallback.
+        // Without this guard, a same-cwd leader transcript (no positive
+        // agent-id match, no path match) becomes the sole candidate via
+        // the time window and gets attributed to a worker. Only
+        // positive-agent-id / path-agent-id can authoritatively bind a
+        // Claude no-expected worker session.
+        let claude_no_expected = matches!(
+            item.provider,
+            Provider::Claude | Provider::ClaudeCode
+        ) && item.context.expected_session_id.is_none();
+        if claude_no_expected {
+            if candidates_by_agent
+                .get(&item.agent_id)
+                .is_some_and(|candidates| !candidates.is_empty())
+            {
+                ambiguous.insert(item.agent_id.clone());
+            }
+            continue;
+        }
         match unique_available_candidate(
             candidates_by_agent.get(&item.agent_id),
             claimed,
@@ -647,9 +882,16 @@ fn allocate_global_one_to_one(
     claimed: &mut BTreeSet<String>,
     assignments: &mut BTreeMap<String, CapturedSessionCandidate>,
 ) {
+    // P0 (lane-046-capture-gap): exclude Claude no-expected agents from the
+    // global one-to-one weak allocator. They must use PositiveAgentId or
+    // PathAgentId only — see allocate_session_candidates Any-block.
     let remaining_agents = pending
         .iter()
         .filter(|item| !assignments.contains_key(&item.agent_id))
+        .filter(|item| {
+            !(matches!(item.provider, Provider::Claude | Provider::ClaudeCode)
+                && item.context.expected_session_id.is_none())
+        })
         .map(|item| item.agent_id.clone())
         .collect::<Vec<_>>();
     if remaining_agents.is_empty() {
@@ -722,16 +964,31 @@ fn candidate_key(candidate: &CapturedSessionCandidate) -> String {
         .join("|")
 }
 
-fn apply_captured_session(agent_obj: &mut serde_json::Map<String, Value>, captured: &CapturedSession) {
-    if let Some(session_id) = &captured.session_id {
-        agent_obj.insert("session_id".to_string(), serde_json::json!(session_id.as_str()));
-    }
-    if let Some(rollout_path) = &captured.rollout_path {
-        agent_obj.insert(
-            "rollout_path".to_string(),
-            serde_json::json!(rollout_path.as_path().to_string_lossy()),
-        );
-    }
+/// 0.4.6 tuple-atomic contract (audit §Capture 修改清单, line 111): writes
+/// the authoritative session tuple if and only if the candidate carries
+/// BOTH `session_id` and `rollout_path`. A partial candidate (e.g.
+/// scanner returned ambiguous attribution with no session_id) MUST NOT
+/// stamp `captured_at` / `captured_via` onto the row, because that
+/// produces a partial tuple that downstream readers treat as authority.
+/// Returns true iff the full tuple was written.
+fn apply_captured_session(
+    agent_obj: &mut serde_json::Map<String, Value>,
+    captured: &CapturedSession,
+) -> bool {
+    let Some(session_id) = captured.session_id.as_ref() else {
+        return false;
+    };
+    let Some(rollout_path) = captured.rollout_path.as_ref() else {
+        return false;
+    };
+    agent_obj.insert(
+        "session_id".to_string(),
+        serde_json::json!(session_id.as_str()),
+    );
+    agent_obj.insert(
+        "rollout_path".to_string(),
+        serde_json::json!(rollout_path.as_path().to_string_lossy()),
+    );
     agent_obj.insert(
         "captured_at".to_string(),
         serde_json::json!(chrono::Utc::now().to_rfc3339()),
@@ -745,33 +1002,64 @@ fn apply_captured_session(agent_obj: &mut serde_json::Map<String, Value>, captur
         serde_json::to_value(captured.attribution_confidence).unwrap_or(Value::Null),
     );
     agent_obj.remove("attribution_ambiguous");
+    true
 }
 
 fn claimed_provider_session_keys(
+    state: &Value,
     agents: &serde_json::Map<String, Value>,
     pending_ids: &BTreeSet<String>,
 ) -> BTreeSet<String> {
     let mut keys = BTreeSet::new();
+    // 1. Non-pending worker sessions (existing behaviour).
     for (agent_id, agent) in agents {
         if pending_ids.contains(agent_id) {
             continue;
         }
-        if let Some(session_id) = agent
-            .get("session_id")
+        push_provider_session_keys(&mut keys, agent);
+    }
+    // 2. P0 (lane-046-capture-gap): leader anchor sessions. The leader's
+    //    own provider transcript must never be attributed to a worker. Scan
+    //    state.leader_receiver, state.team_owner, and the same fields under
+    //    state.teams.<key>. Cover all known provider session field names so
+    //    a present transcript path/id excludes that session from worker
+    //    allocation.
+    push_leader_provider_session_keys(&mut keys, state);
+    if let Some(teams) = state.get("teams").and_then(Value::as_object) {
+        for team_state in teams.values() {
+            push_leader_provider_session_keys(&mut keys, team_state);
+        }
+    }
+    keys
+}
+
+fn push_provider_session_keys(keys: &mut BTreeSet<String>, value: &Value) {
+    for field in ["session_id", "provider_session_id"] {
+        if let Some(session_id) = value
+            .get(field)
             .and_then(Value::as_str)
             .filter(|s| !s.is_empty())
         {
             keys.insert(format!("session:{session_id}"));
         }
-        if let Some(rollout_path) = agent
-            .get("rollout_path")
+    }
+    for field in ["rollout_path", "transcript_path"] {
+        if let Some(path) = value
+            .get(field)
             .and_then(Value::as_str)
             .filter(|s| !s.is_empty())
         {
-            keys.insert(format!("rollout:{rollout_path}"));
+            keys.insert(format!("rollout:{path}"));
+        }
+    }
+}
+
+fn push_leader_provider_session_keys(keys: &mut BTreeSet<String>, scope: &Value) {
+    for anchor in ["leader_receiver", "team_owner"] {
+        if let Some(node) = scope.get(anchor) {
+            push_provider_session_keys(keys, node);
         }
     }
-    keys
 }
 
 fn captured_provider_session_keys(captured: &CapturedSession) -> BTreeSet<String> {
@@ -1018,6 +1306,171 @@ pub(crate) mod test_support {
 mod u1_tests {
     use super::*;
 
+    use crate::provider::{CaptureVia, CapturedSession, Confidence, RolloutPath, SessionId};
+    use std::path::PathBuf;
+
+    fn leader_like_candidate(session_id: &str, path: &str) -> CapturedSessionCandidate {
+        CapturedSessionCandidate {
+            captured: CapturedSession {
+                session_id: Some(SessionId::new(session_id)),
+                rollout_path: Some(RolloutPath::new(PathBuf::from(path))),
+                captured_via: CaptureVia::FsWatch,
+                attribution_confidence: Confidence::High,
+                spawn_cwd: PathBuf::from("/tmp/u1-cwd"),
+            },
+            positive_agent_id_match: false,
+            agent_path_match: false,
+        }
+    }
+
+    fn worker_owned_candidate(session_id: &str, path: &str) -> CapturedSessionCandidate {
+        CapturedSessionCandidate {
+            captured: CapturedSession {
+                session_id: Some(SessionId::new(session_id)),
+                rollout_path: Some(RolloutPath::new(PathBuf::from(path))),
+                captured_via: CaptureVia::FsWatch,
+                attribution_confidence: Confidence::High,
+                spawn_cwd: PathBuf::from("/tmp/u1-cwd"),
+            },
+            positive_agent_id_match: true,
+            agent_path_match: false,
+        }
+    }
+
+    /// P0 RED-1 (lane-046-capture-gap): a Claude worker with
+    /// expected_session_id=None must NOT capture a candidate that has neither
+    /// positive_agent_id_match nor agent_path_match — even when it is the
+    /// only candidate (the leader-transcript-as-only-candidate failure mode
+    /// from the macmini repro). Must end up ambiguous, not assigned.
+    #[test]
+    fn claude_no_expected_single_leader_candidate_is_not_assigned() {
+        let mut state = serde_json::json!({
+            "agents": {
+                "release_engineer": {
+                    "provider": "claude",
+                    "status": "running",
+                    "spawn_cwd": "/tmp/u1-cwd"
+                }
+            }
+        });
+        let mut canned = BTreeMap::new();
+        canned.insert(
+            "release_engineer".to_string(),
+            vec![leader_like_candidate(
+                "ea059b82-c53e-4654-9590-9f3e6d46f0ca",
+                "/Users/alauda/.claude/projects/-Users-alauda-team/ea059b82.jsonl",
+            )],
+        );
+        let canned_for_adapter = canned.clone();
+        let mut adapter_for = move |provider| {
+            Box::new(
+                test_support::CaptureCandidatesAdapter::new(provider, None, "")
+                    .with_candidates(canned_for_adapter.clone()),
+            ) as Box<dyn ProviderAdapter>
+        };
+        let report = capture_missing_provider_sessions_once(&mut state, &mut adapter_for, true, 0)
+            .expect("capture pass succeeds");
+        assert!(
+            report.assigned.is_empty(),
+            "Claude no-expected + weak (no positive/path) candidate must NOT be assigned; got {:?}",
+            report.assigned
+        );
+        let agent = state
+            .get("agents")
+            .and_then(|a| a.get("release_engineer"))
+            .expect("agent present");
+        assert!(
+            agent.get("session_id").is_none(),
+            "agent.session_id must remain empty when capture is refused; got {agent:?}"
+        );
+    }
+
+    /// P0 RED-2: same shape but with a positive_agent_id_match candidate →
+    /// must capture (positive agent id is authoritative for Claude
+    /// no-expected).
+    #[test]
+    fn claude_no_expected_positive_worker_candidate_still_captures() {
+        let mut state = serde_json::json!({
+            "agents": {
+                "release_engineer": {
+                    "provider": "claude",
+                    "status": "running",
+                    "spawn_cwd": "/tmp/u1-cwd"
+                }
+            }
+        });
+        let mut canned = BTreeMap::new();
+        canned.insert(
+            "release_engineer".to_string(),
+            vec![worker_owned_candidate(
+                "abc12345-worker-owned",
+                "/Users/alauda/.claude/projects/-Users-alauda-team/abc12345.jsonl",
+            )],
+        );
+        let canned_for_adapter = canned.clone();
+        let mut adapter_for = move |provider| {
+            Box::new(
+                test_support::CaptureCandidatesAdapter::new(provider, None, "")
+                    .with_candidates(canned_for_adapter.clone()),
+            ) as Box<dyn ProviderAdapter>
+        };
+        let report = capture_missing_provider_sessions_once(&mut state, &mut adapter_for, true, 0)
+            .expect("capture pass succeeds");
+        assert_eq!(
+            report.assigned,
+            vec!["release_engineer".to_string()],
+            "Claude no-expected + positive_agent_id candidate MUST capture; got {:?}",
+            report.assigned
+        );
+    }
+
+    /// P0 RED-3: leader_receiver under teams.<key> with provider session
+    /// fields must exclude that session from worker capture even if the
+    /// candidate would otherwise match.
+    #[test]
+    fn claimed_session_keys_include_team_scoped_leader_receiver() {
+        let mut state = serde_json::json!({
+            "agents": {
+                "release_engineer": {
+                    "provider": "claude",
+                    "status": "running",
+                    "spawn_cwd": "/tmp/u1-cwd"
+                }
+            },
+            "teams": {
+                "teamA": {
+                    "leader_receiver": {
+                        "session_id": "leader-session-id-zzz",
+                        "rollout_path": "/Users/alauda/.claude/projects/-Users-alauda-team/zzz.jsonl"
+                    }
+                }
+            }
+        });
+        let mut canned = BTreeMap::new();
+        canned.insert(
+            "release_engineer".to_string(),
+            vec![worker_owned_candidate(
+                "leader-session-id-zzz",
+                "/Users/alauda/.claude/projects/-Users-alauda-team/zzz.jsonl",
+            )],
+        );
+        let canned_for_adapter = canned.clone();
+        let mut adapter_for = move |provider| {
+            Box::new(
+                test_support::CaptureCandidatesAdapter::new(provider, None, "")
+                    .with_candidates(canned_for_adapter.clone()),
+            ) as Box<dyn ProviderAdapter>
+        };
+        let report = capture_missing_provider_sessions_once(&mut state, &mut adapter_for, true, 0)
+            .expect("capture pass succeeds");
+        assert!(
+            report.assigned.is_empty(),
+            "worker candidate that collides with team-scoped leader_receiver \
+             session MUST be excluded by claimed_provider_session_keys; got {:?}",
+            report.assigned
+        );
+    }
+
     #[test]
     fn capture_pass_keeps_pending_agent_when_one_adapter_capture_fails() {
         let mut state = serde_json::json!({
@@ -1096,13 +1549,19 @@ mod u1_tests {
             n
         ));
         std::fs::write(&existing, b"{}\n").expect("write fixture rollout file");
+        // 0.4.6 tuple-atomic contract: `agent_session_complete` now requires
+        // the full authoritative tuple (session_id + rollout_path +
+        // captured_at + captured_via), not just session_id + rollout_path.
+        // Pre-0.4.6 partial tuples are no longer treated as complete.
         let agent_complete = serde_json::json!({
             "session_id": "sess-real",
             "rollout_path": existing.to_string_lossy(),
+            "captured_at": "2026-06-25T10:00:00+00:00",
+            "captured_via": "session.captured",
         });
         assert!(
             agent_session_complete(&agent_complete),
-            "an agent with session_id + an existing rollout file remains complete"
+            "0.4.6: agent with full tuple (session_id + rollout_path + captured_at + captured_via) + existing rollout file is complete"
         );
         let _ = std::fs::remove_file(&existing);
 
@@ -1134,6 +1593,12 @@ mod u1_tests {
     /// global one-to-one runs.
     #[test]
     fn capture_allocator_expected_session_id_binds_each_worker_to_its_own_transcript() {
+        // 0.4.6 P0 amendment: Claude no longer carries _pending_session_id
+        // (fresh spawn doesn't inject --session-id; capture anchors on
+        // cwd+spawned_at+identity). The ExpectedSessionId pre-pass remains
+        // valid for providers that DO use expected_session_id (Copilot is the
+        // only one left that honors framework-supplied --session-id). Switch
+        // this test to Copilot to preserve the pre-pass invariant coverage.
         use crate::provider::{CaptureVia, Confidence, RolloutPath};
         let dir = std::env::temp_dir().join(format!(
             "ta-stage1-allocator-{}",
@@ -1154,8 +1619,6 @@ mod u1_tests {
                 attribution_confidence: Confidence::High,
                 spawn_cwd: dir.clone(),
             },
-            // Critical: no positive worker identity hint. Pre-fix this is
-            // exactly the shape that fell through to global one-to-one.
             positive_agent_id_match: false,
             agent_path_match: false,
         };
@@ -1174,27 +1637,27 @@ mod u1_tests {
         };
         let mut candidates_by_agent: BTreeMap<String, Vec<CapturedSessionCandidate>> =
             BTreeMap::new();
-        candidates_by_agent.insert("claude-a".to_string(), vec![candidate_a.clone()]);
-        candidates_by_agent.insert("claude-b".to_string(), vec![candidate_b.clone()]);
+        candidates_by_agent.insert("copilot-a".to_string(), vec![candidate_a.clone()]);
+        candidates_by_agent.insert("copilot-b".to_string(), vec![candidate_b.clone()]);
 
         let cwd_str = dir.to_string_lossy().to_string();
         let mut state = serde_json::json!({
             "agents": {
-                "claude-a": {
-                    "provider": "claude",
+                "copilot-a": {
+                    "provider": "copilot",
                     "status": "running",
                     "spawn_cwd": cwd_str,
                     "_pending_session_id": "9a2d1668-8987-4c36-8bde-a5135b10da02"
                 },
-                "claude-b": {
-                    "provider": "claude",
+                "copilot-b": {
+                    "provider": "copilot",
                     "status": "running",
                     "spawn_cwd": cwd_str,
                     "_pending_session_id": "3e824e89-25ac-4b3f-b272-b4f733f6403c"
                 }
             }
         });
-        let adapter = test_support::CaptureCandidatesAdapter::new(Provider::Claude, None, "")
+        let adapter = test_support::CaptureCandidatesAdapter::new(Provider::Copilot, None, "")
             .with_candidates(candidates_by_agent);
         let mut adapter_for = move |_provider| {
             Box::new(adapter.clone()) as Box<dyn ProviderAdapter>
@@ -1207,34 +1670,34 @@ mod u1_tests {
         // expected transcript. No cross-assignment, no ambiguous mark.
         let agents = state["agents"].as_object().expect("agents object");
         assert_eq!(
-            agents["claude-a"]["session_id"].as_str(),
+            agents["copilot-a"]["session_id"].as_str(),
             Some("9a2d1668-8987-4c36-8bde-a5135b10da02"),
-            "Stage 1 fix: claude-a must bind to its own expected transcript; \
-             state.claude-a={}",
-            agents["claude-a"]
+            "Stage 1 fix: copilot-a must bind to its own expected transcript; \
+             state.copilot-a={}",
+            agents["copilot-a"]
         );
         assert_eq!(
-            agents["claude-b"]["session_id"].as_str(),
+            agents["copilot-b"]["session_id"].as_str(),
             Some("3e824e89-25ac-4b3f-b272-b4f733f6403c"),
-            "Stage 1 fix: claude-b must bind to its own expected transcript; \
-             state.claude-b={}",
-            agents["claude-b"]
+            "Stage 1 fix: copilot-b must bind to its own expected transcript; \
+             state.copilot-b={}",
+            agents["copilot-b"]
         );
         assert!(
-            agents["claude-a"]
+            agents["copilot-a"]
                 .get("attribution_ambiguous")
                 .is_none_or(|v| v.as_bool() != Some(true)),
-            "Stage 1 fix: claude-a must NOT be flagged ambiguous after the \
-             expected-id pre-pass bound it; state.claude-a={}",
-            agents["claude-a"]
+            "Stage 1 fix: copilot-a must NOT be flagged ambiguous after the \
+             expected-id pre-pass bound it; state.copilot-a={}",
+            agents["copilot-a"]
         );
         assert!(
-            agents["claude-b"]
+            agents["copilot-b"]
                 .get("attribution_ambiguous")
                 .is_none_or(|v| v.as_bool() != Some(true)),
-            "Stage 1 fix: claude-b must NOT be flagged ambiguous; \
-             state.claude-b={}",
-            agents["claude-b"]
+            "Stage 1 fix: copilot-b must NOT be flagged ambiguous; \
+             state.copilot-b={}",
+            agents["copilot-b"]
         );
         assert_eq!(
             report.ambiguous.len(),
@@ -1246,4 +1709,79 @@ mod u1_tests {
         let _ = std::fs::remove_file(&rollout_b);
         let _ = std::fs::remove_dir(&dir);
     }
+
+    /// E57 RED postflight (lane-046-capture-gap): `recover_resume_session_from_events`
+    /// must refuse to repair a worker's session from a stale `session.captured`
+    /// event whose rollout file is a Claude LEADER transcript
+    /// (`customTitle == "claude leader"`). Without this filter, a fresh restart
+    /// after a pre-fix run still pulls the leader transcript onto a worker via
+    /// captured_via=event_log_repair (Mac mini evidence:
+    /// resume.session_repaired session_id=ea059b82 → release-engineer).
+    #[test]
+    fn e57_recover_resume_refuses_claude_leader_marker_rollout() {
+        use std::io::Write;
+        use std::sync::atomic::{AtomicU64, Ordering};
+        static COUNTER: AtomicU64 = AtomicU64::new(0);
+        let uniq = COUNTER.fetch_add(1, Ordering::Relaxed);
+        let workspace = std::env::temp_dir().join(format!("ta-e57-recover-{}-{}", std::process::id(), uniq));
+        let _ = std::fs::remove_dir_all(&workspace);
+        std::fs::create_dir_all(&workspace).expect("workspace");
+
+        // Write a leader-marker rollout file (claude TUI leader transcript).
+        let rollout = workspace.join("ea059b82-leader.jsonl");
+        let mut f = std::fs::File::create(&rollout).expect("rollout");
+        writeln!(
+            f,
+            "{{\"customTitle\":\"claude leader\",\"sessionId\":\"ea059b82-c53e-4654-9590-9f3e6d46f0ca\",\"cwd\":\"/tmp/e57\"}}"
+        )
+        .unwrap();
+        writeln!(f, "{{\"role\":\"user\",\"content\":\"hi\"}}").unwrap();
+        drop(f);
+
+        // Write a `session.captured` event into events.jsonl pointing
+        // release-engineer at the leader rollout — simulates the stale
+        // pre-fix event that triggered the bug.
+        let event_log = crate::event_log::EventLog::new(&workspace);
+        event_log
+            .write(
+                "session.captured",
+                serde_json::json!({
+                    "agent_id": "release-engineer",
+                    "provider": "claude",
+                    "session_id": "ea059b82-c53e-4654-9590-9f3e6d46f0ca",
+                    "rollout_path": rollout.to_string_lossy().to_string(),
+                    "captured_via": "fs_watch",
+                }),
+            )
+            .expect("event write");
+
+        let previous = serde_json::json!({
+            "provider": "claude",
+            "session_id": null,
+            "rollout_path": null,
+        });
+        let adapter = test_support::CaptureCandidatesAdapter::new(Provider::Claude, None, "");
+        let exclude = BTreeSet::new();
+        let result = recover_resume_session_from_events(
+            &workspace,
+            "release-engineer",
+            &previous,
+            &adapter,
+            crate::provider::AuthMode::Subscription,
+            &exclude,
+        )
+        .expect("recover call ok");
+
+        assert!(
+            result.is_none(),
+            "E57 postflight: recover_resume_session_from_events must REFUSE \
+             to repair from a Claude leader-marker rollout (event_log_repair \
+             cannot resurrect a stale leader-to-worker assignment); got {result:?}"
+        );
+
+        let _ = std::fs::remove_file(&rollout);
+        let _ = std::fs::remove_file(workspace.join(".team/logs/events.jsonl"));
+        let _ = std::fs::remove_dir_all(workspace.join(".team"));
+        let _ = std::fs::remove_dir_all(&workspace);
+    }
 }