@team-agent/installer 0.4.5 → 0.4.7

package/crates/team-agent/src/lifecycle/launch.rs

@@ -2455,17 +2455,7 @@ fn spec_display_backend(spec: &Value) -> DisplayBackend {
     crate::lifecycle::display::resolve_display_backend(requested, None).backend
 }
 
-fn parse_provider(raw: &str) -> Option<Provider> {
-    match raw {
-        "claude" => Some(Provider::Claude),
-        "claude_code" => Some(Provider::ClaudeCode),
-        "codex" => Some(Provider::Codex),
-        "copilot" => Some(Provider::Copilot),
-        "gemini_cli" => Some(Provider::GeminiCli),
-        "fake" => Some(Provider::Fake),
-        _ => None,
-    }
-}
+use crate::provider::wire::parse_provider;
 
 fn parse_auth_mode(raw: &str) -> Option<AuthMode> {
     match raw {
@@ -3956,18 +3946,45 @@ pub fn fork_agent_with_transport(
     let source_agent = find_spec_agent(&spec, source_agent_id).ok_or_else(|| {
         LifecycleError::RequirementUnmet(format!("unknown worker agent id: {source_agent_id}"))
     })?;
-    let session_id = state
+    // 0.4.6 tuple-atomic contract (audit §Fork 修改清单, line 201): fork
+    // must require the COMPLETE source tuple (session_id + rollout_path +
+    // captured_at + captured_via) before treating the scalar session_id
+    // as resumable truth. A row carrying only `session_id` is a partial
+    // tuple (pre-0.4.6 bug source), and the native fork would attach to
+    // a session that has no confirmed backing.
+    let source_agent_state = state
         .get("agents")
         .and_then(|v| v.get(source_agent_id.as_str()))
-        .and_then(|v| v.get("session_id"))
-        .and_then(|v| v.as_str())
-        .filter(|s| !s.is_empty())
-        .map(crate::provider::SessionId::new)
         .ok_or_else(|| {
             LifecycleError::Provider(format!(
-                "cannot fork {source_agent_id}: source session_id is missing"
+                "cannot fork {source_agent_id}: source agent row not in state"
             ))
         })?;
+    let tuple_field_ok = |field: &str| -> bool {
+        source_agent_state
+            .get(field)
+            .and_then(|v| v.as_str())
+            .is_some_and(|s| !s.is_empty())
+    };
+    let session_id_str = source_agent_state
+        .get("session_id")
+        .and_then(|v| v.as_str())
+        .filter(|s| !s.is_empty());
+    let rollout_path_str = source_agent_state
+        .get("rollout_path")
+        .and_then(|v| v.as_str())
+        .filter(|s| !s.is_empty());
+    if session_id_str.is_none()
+        || rollout_path_str.is_none()
+        || !tuple_field_ok("captured_at")
+        || !tuple_field_ok("captured_via")
+    {
+        return Err(LifecycleError::Provider(format!(
+            "cannot fork {source_agent_id}: source session backing is missing or incomplete \
+             (session_id+rollout_path+captured_at+captured_via required)"
+        )));
+    }
+    let session_id = crate::provider::SessionId::new(session_id_str.unwrap().to_string());
     let session_name = state
         .get("session_name")
         .and_then(|v| v.as_str())

package/crates/team-agent/src/lifecycle/profile_launch.rs

@@ -894,17 +894,7 @@ fn effective_profile_or_agent_model<'a>(
     agent.model.as_deref().or_else(|| profile_model(values))
 }
 
-pub(crate) fn parse_provider(raw: &str) -> Option<Provider> {
-    match raw {
-        "claude" => Some(Provider::Claude),
-        "claude_code" => Some(Provider::ClaudeCode),
-        "codex" => Some(Provider::Codex),
-        "copilot" => Some(Provider::Copilot),
-        "gemini_cli" => Some(Provider::GeminiCli),
-        "fake" => Some(Provider::Fake),
-        _ => None,
-    }
-}
+pub(crate) use crate::provider::wire::parse_provider;
 
 pub(crate) fn parse_auth_mode(raw: &str) -> Option<AuthMode> {
     match raw {

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -441,6 +441,99 @@ fn tmux_start_mode_for_spawn(
     }
 }
 
+// ═══════════════════════════════════════════════════════════════════════
+// 0.4.6 Stage 1: reset/start clean-boundary helpers
+// ═══════════════════════════════════════════════════════════════════════
+
+/// Bounded polling: wait for the old pane to become unreachable AND, when
+/// possible, for the old pane_pid to exit. Returns a JSON evidence blob
+/// recording the observed transition for events.
+pub(super) fn drain_old_pane_and_pid(
+    transport: &dyn crate::transport::Transport,
+    old_pane: Option<&crate::transport::PaneId>,
+    old_pid: Option<u32>,
+) -> serde_json::Value {
+    const DRAIN_MAX_MS: u64 = 1500;
+    const DRAIN_POLL_MS: u64 = 50;
+    let start = std::time::Instant::now();
+    let mut pane_dead = old_pane.is_none();
+    let mut pid_dead = old_pid.is_none();
+    while start.elapsed().as_millis() < DRAIN_MAX_MS as u128 {
+        if !pane_dead {
+            if let Some(pane) = old_pane {
+                if !agent_pane_live_by_id(transport, pane) {
+                    pane_dead = true;
+                }
+            }
+        }
+        if !pid_dead {
+            if let Some(pid) = old_pid {
+                if !pid_is_alive(pid) {
+                    pid_dead = true;
+                }
+            }
+        }
+        if pane_dead && pid_dead {
+            break;
+        }
+        std::thread::sleep(std::time::Duration::from_millis(DRAIN_POLL_MS));
+    }
+    serde_json::json!({
+        "old_pane_id": old_pane.map(|p| p.as_str()),
+        "old_pane_pid": old_pid,
+        "old_pane_dead": pane_dead,
+        "old_pid_dead": pid_dead,
+        "drain_elapsed_ms": start.elapsed().as_millis() as u64,
+    })
+}
+
+/// Best-effort liveness probe for a pid. Returns true if the pid exists
+/// on Unix (signal 0). On other platforms, returns true conservatively.
+pub(super) fn pid_is_alive(pid: u32) -> bool {
+    #[cfg(unix)]
+    {
+        // SAFETY: kill(pid, 0) checks if pid exists without sending a signal.
+        let ret = unsafe { libc::kill(pid as i32, 0) };
+        if ret == 0 {
+            return true;
+        }
+        // EPERM also means the process exists (we just can't signal it).
+        let err = std::io::Error::last_os_error();
+        matches!(err.raw_os_error(), Some(libc::EPERM))
+    }
+    #[cfg(not(unix))]
+    {
+        let _ = pid;
+        true
+    }
+}
+
+/// Read state.agents[agent_id].pane_pid (u32) from the runtime state.
+pub(super) fn state_pane_pid(state: &serde_json::Value, agent_id: &AgentId) -> Option<u32> {
+    state
+        .get("agents")
+        .and_then(|v| v.get(agent_id.as_str()))
+        .and_then(|v| v.get("pane_pid"))
+        .and_then(serde_json::Value::as_u64)
+        .map(|p| p as u32)
+}
+
+/// Read + increment state.agents[agent_id].spawn_epoch. The epoch is a
+/// monotonic counter persisted with the agent row that uniquely tags each
+/// fresh-start / reset / restart cycle. Subsequent capture / event /
+/// status logic dispatches on `(team_key, agent_id, spawn_epoch,
+/// pane_pid, expected_session_id)` to avoid attributing a stale prior
+/// fresh attempt to the current process.
+pub(super) fn next_spawn_epoch(state: &serde_json::Value, agent_id: &AgentId) -> u64 {
+    let current = state
+        .get("agents")
+        .and_then(|v| v.get(agent_id.as_str()))
+        .and_then(|v| v.get("spawn_epoch"))
+        .and_then(serde_json::Value::as_u64)
+        .unwrap_or(0);
+    current.saturating_add(1)
+}
+
 /// `stop_agent(workspace, agent_id, team)`(`lifecycle/operations.py:62`)。
 /// owner-gate → kill window → **同时关显示** → 写 state。
 pub fn stop_agent(
@@ -533,6 +626,22 @@ pub(super) fn stop_agent_at_paths(
             let _ = write_stop_window_failed_event(workspace, agent_id, &target_str, &stderr);
             return Err(LifecycleError::Transport(format!("failed to stop agent {agent_id}: {stderr}")));
         }
+        // 0.4.6 Stage 1: drain-and-prove. The pre-fix path trusted `kill_pane`'s
+        // success return without waiting for the pane / pid to actually exit.
+        // This created a window where reset/start spawned a new worker while
+        // the old Claude process + tty + provider state were still alive,
+        // leading to the macmini "running but not capturable" failure mode.
+        //
+        // Poll bounded time for old pane to become unreachable. If it stays
+        // reachable after the budget, emit an event but do NOT block — the
+        // subsequent spawn boundary check (new pane_id != old pane_id) is
+        // the final safety net.
+        let drain_evidence = drain_old_pane_and_pid(
+            transport,
+            pane_id.as_ref(),
+            state_pane_pid(&state, agent_id),
+        );
+        let _ = write_stop_drain_event(workspace, agent_id, &target_str, &drain_evidence);
     }
     close_agent_display(&mut state, agent_id);
     mark_agent_stopped(&mut state, agent_id, agent, &window)?;
@@ -631,6 +740,18 @@ fn mark_agent_started(
         "spawn_cwd".to_string(),
         serde_json::json!(spawn.spawn_cwd.to_string_lossy().to_string()),
     );
+    // 0.4.6 Stage 1+2: ensure spawn_epoch is present after every start.
+    // reset_agent_at_paths bumps it before start; non-reset starts
+    // initialise to 1 (or preserve existing) so capture/event paths can
+    // always dispatch on (team_key, agent_id, spawn_epoch, ...).
+    let preserved_epoch = agent
+        .get("spawn_epoch")
+        .and_then(serde_json::Value::as_u64)
+        .filter(|n| *n > 0);
+    agent.insert(
+        "spawn_epoch".to_string(),
+        serde_json::json!(preserved_epoch.unwrap_or(1)),
+    );
     // Issue 2 (Round 3b gate review §6): persist the resolved owner_team_id
     // so future restart/start cycles read it directly from the agent row.
     if let Some(ref team_id) = spawn.owner_team_id {
@@ -763,6 +884,19 @@ fn reset_agent_at_paths(
     let mut state = resolve_team_scoped_state_or_refuse(workspace, team)?;
     let spec = load_team_spec(spec_workspace)?;
     discard_agent_session_fields(&mut state, agent_id)?;
+    // 0.4.6 Stage 1: bump spawn_epoch on every reset. The new epoch is
+    // visible to subsequent capture/event/status paths so they can
+    // attribute observations to the current process cohort (not a stale
+    // prior fresh attempt).
+    let new_epoch = next_spawn_epoch(&state, agent_id);
+    if let Some(obj) = state
+        .get_mut("agents")
+        .and_then(serde_json::Value::as_object_mut)
+        .and_then(|agents| agents.get_mut(agent_id.as_str()))
+        .and_then(serde_json::Value::as_object_mut)
+    {
+        obj.insert("spawn_epoch".to_string(), serde_json::json!(new_epoch));
+    }
     let team_key = restart_projection_team_key(&state, team);
     sync_restart_team_projections(&mut state, &team_key);
     // golden operations.py (reset): save_team_scoped_state on the team projection — same multi-team
@@ -966,6 +1100,32 @@ fn write_stop_complete_event(
     Ok(())
 }
 
+/// 0.4.6 Stage 1: drain evidence for the old pane+pid after stop. Fires
+/// during reset/stop so operators can see whether the prior worker really
+/// went away or stuck around inside the resp budget.
+pub(super) fn write_stop_drain_event(
+    workspace: &Path,
+    agent_id: &AgentId,
+    target: &str,
+    drain: &serde_json::Value,
+) -> Result<(), LifecycleError> {
+    let mut payload = serde_json::Map::new();
+    payload.insert("agent_id".to_string(), serde_json::json!(agent_id.as_str()));
+    payload.insert("target".to_string(), serde_json::json!(target));
+    if let Some(obj) = drain.as_object() {
+        for (k, v) in obj {
+            payload.insert(k.clone(), v.clone());
+        }
+    }
+    crate::event_log::EventLog::new(workspace)
+        .write(
+            "stop_agent.drain",
+            serde_json::Value::Object(payload),
+        )
+        .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
+    Ok(())
+}
+
 fn write_stop_window_failed_event(
     workspace: &Path,
     agent_id: &AgentId,

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -168,6 +168,46 @@ pub(super) fn spawn_agent_window(
     // > workspace; state-based override is silently dropped.
     let spawn_cwd = spawn_cwd_override.unwrap_or(workspace);
     let env_unset: Vec<String> = profile_launch.env_unset.iter().cloned().collect();
+
+    // 0.4.6 Stage 2: write actual spawn plan event BEFORE invoking the
+    // transport spawn. Mirrors `launch.rs:359-380` (the reference impl)
+    // so reset/start/restart fresh produces the same truth source as
+    // quick-start. Any "argv had --session-id but didn't take effect"
+    // failure can now be diagnosed from events.jsonl — the recorded
+    // expected_session_id == state._pending_session_id (after
+    // mark_agent_started persists the same plan tuple).
+    {
+        let session_id_in_argv = plan
+            .argv
+            .iter()
+            .position(|a| a == "--session-id")
+            .and_then(|i| plan.argv.get(i + 1))
+            .cloned();
+        let env_overlay_keys: Vec<&String> = env.keys().collect();
+        let tmux_start_mode_pre_spawn = predict_tmux_start_mode(
+            layout_placement,
+            into_existing_session,
+        );
+        let spawn_epoch = state_spawn_epoch_for_agent(workspace, agent_id);
+        let event_log = crate::event_log::EventLog::new(workspace);
+        let _ = event_log.write(
+            "provider.worker.spawn_argv",
+            serde_json::json!({
+                "agent_id": agent_id.as_str(),
+                "provider": provider,
+                "argv": plan.argv,
+                "session_id_in_argv": session_id_in_argv,
+                "expected_session_id": plan.expected_session_id.as_ref().map(|s| s.as_str()),
+                "spawn_cwd": spawn_cwd.to_string_lossy(),
+                "env_overlay_keys": env_overlay_keys,
+                "env_unset": env_unset,
+                "tmux_start_mode": tmux_start_mode_pre_spawn,
+                "spawn_epoch": spawn_epoch,
+                "source": "restart",
+            }),
+        );
+    }
+
     let result = if let Some(placement) = layout_placement {
         if placement.starts_window {
             if into_existing_session {
@@ -873,28 +913,7 @@ pub(super) fn agent_window(agent: &serde_json::Value, agent_id: &AgentId) -> Str
         .to_string()
 }
 
-pub(super) fn parse_provider(raw: &str) -> Option<Provider> {
-    match raw {
-        "claude" => Some(Provider::Claude),
-        "claude_code" => Some(Provider::ClaudeCode),
-        "codex" => Some(Provider::Codex),
-        "copilot" => Some(Provider::Copilot),
-        "gemini_cli" => Some(Provider::GeminiCli),
-        "fake" => Some(Provider::Fake),
-        _ => None,
-    }
-}
-
-pub(super) fn provider_wire(provider: Provider) -> &'static str {
-    match provider {
-        Provider::Claude => "claude",
-        Provider::ClaudeCode => "claude_code",
-        Provider::Codex => "codex",
-        Provider::Copilot => "copilot",
-        Provider::GeminiCli => "gemini_cli",
-        Provider::Fake => "fake",
-    }
-}
+pub(super) use crate::provider::wire::{parse_provider, provider_wire};
 
 pub(super) fn parse_auth_mode(raw: &str) -> Option<AuthMode> {
     match raw {
@@ -1218,6 +1237,47 @@ pub(super) fn is_dynamic_agent(
             .is_some_and(|s| !s.is_empty())
 }
 
+/// 0.4.6 Stage 2: predict the tmux start mode BEFORE the spawn call, so
+/// the `provider.worker.spawn_argv` event can record what the spawn will
+/// actually do. Same logic as `tmux_start_mode_for_spawn` in agent.rs
+/// but driven by `(layout_placement, into_existing_session)` only — no
+/// dependency on SpawnedAgentWindow.
+pub(super) fn predict_tmux_start_mode(
+    layout_placement: Option<&crate::lifecycle::launch::LayoutPlacement>,
+    into_existing_session: bool,
+) -> &'static str {
+    if let Some(placement) = layout_placement {
+        if placement.starts_window {
+            if into_existing_session {
+                "new-window"
+            } else {
+                "new-session"
+            }
+        } else {
+            "split-window"
+        }
+    } else if into_existing_session {
+        "new-window"
+    } else {
+        "new-session"
+    }
+}
+
+/// 0.4.6 Stage 2: read state.agents[agent_id].spawn_epoch from disk to
+/// stamp the spawn_argv event with the current cohort identifier. Returns
+/// 0 if the agent row / field is missing.
+pub(super) fn state_spawn_epoch_for_agent(workspace: &Path, agent_id: &AgentId) -> u64 {
+    let Ok(state) = crate::state::persist::load_runtime_state(workspace) else {
+        return 0;
+    };
+    state
+        .get("agents")
+        .and_then(|v| v.get(agent_id.as_str()))
+        .and_then(|v| v.get("spawn_epoch"))
+        .and_then(serde_json::Value::as_u64)
+        .unwrap_or(0)
+}
+
 #[cfg(test)]
 mod e36_transcript_backing_tests {
     use super::*;

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -538,9 +538,14 @@ pub fn restart_with_transport_with_session_convergence_deadline(
                 survivors.push(decision);
                 continue;
             }
-            // Backing went missing between preflight and post-spawn.
-            // Clear stale capture fields, keep session_id, mark
-            // _pending_session_id, run a bounded convergence pass.
+            // 0.4.6 tuple-atomic contract: backing went missing between
+            // preflight and post-spawn. Clear the FULL authoritative tuple
+            // (including session_id) and persist the old provider id only
+            // in `_pending_session_id` as a capture hint. Pre-0.4.6 kept
+            // session_id alive while removing siblings — that left a
+            // partial tuple that persist-layer backfill could later
+            // resurrect into "looks captured" or that classify_restart
+            // would refuse with `session_backing_store_missing`.
             if let Some(agents) = state
                 .pointer_mut("/agents")
                 .and_then(serde_json::Value::as_object_mut)
@@ -549,10 +554,15 @@ pub fn restart_with_transport_with_session_convergence_deadline(
                     .get_mut(decision.agent_id.as_str())
                     .and_then(serde_json::Value::as_object_mut)
                 {
-                    agent_obj.remove("rollout_path");
-                    agent_obj.remove("captured_at");
-                    agent_obj.remove("captured_via");
-                    agent_obj.remove("attribution_confidence");
+                    for field in [
+                        "session_id",
+                        "rollout_path",
+                        "captured_at",
+                        "captured_via",
+                        "attribution_confidence",
+                    ] {
+                        agent_obj.remove(field);
+                    }
                     agent_obj.insert(
                         "_pending_session_id".to_string(),
                         serde_json::json!(session_id.as_str()),
@@ -764,6 +774,35 @@ fn repair_resume_sessions_from_event_log(
             .and_then(serde_json::Value::as_str)
             .filter(|path| !path.is_empty())
             .map(str::to_string);
+        // 0.4.6 tuple-atomic contract (audit §Restart 修改清单, line 175):
+        // capture-domain repair must yield a COMPLETE authoritative tuple
+        // (session_id + rollout_path + captured_at + captured_via) before
+        // restart writes it back into agent state. A partial repair would
+        // be persist-domain truth synthesis through the restart hook,
+        // exactly what the contract forbids. Reject incomplete repairs;
+        // capture stays Stage-1 pending on next coordinator tick.
+        let captured_at_ok = repaired
+            .get("captured_at")
+            .is_some_and(|v| !v.is_null() && v.as_str().is_some_and(|s| !s.is_empty()));
+        let captured_via_ok = repaired
+            .get("captured_via")
+            .is_some_and(|v| !v.is_null() && v.as_str().is_some_and(|s| !s.is_empty()));
+        if session_id.is_none() || rollout_path.is_none() || !captured_at_ok || !captured_via_ok {
+            crate::event_log::EventLog::new(workspace)
+                .write(
+                    "resume.session_repair_refused_incomplete_tuple",
+                    serde_json::json!({
+                        "agent_id": agent_id,
+                        "provider": provider_wire(provider),
+                        "session_id": session_id,
+                        "rollout_path": rollout_path,
+                        "captured_at_ok": captured_at_ok,
+                        "captured_via_ok": captured_via_ok,
+                    }),
+                )
+                .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
+            continue;
+        }
         if let Some(agent) = state
             .get_mut("agents")
             .and_then(serde_json::Value::as_object_mut)
@@ -794,7 +833,7 @@ fn claimed_session_ids_except(
     state: &serde_json::Value,
     current_agent_id: &str,
 ) -> std::collections::BTreeSet<String> {
-    state
+    let mut keys: std::collections::BTreeSet<String> = state
         .get("agents")
         .and_then(serde_json::Value::as_object)
         .map(|agents| {
@@ -810,7 +849,42 @@ fn claimed_session_ids_except(
                 })
                 .collect()
         })
-        .unwrap_or_default()
+        .unwrap_or_default();
+    // E57 (lane-046-capture-gap): restart's resume_session_repair postflight
+    // path must NOT reassign the leader's own provider session to a worker.
+    // The capture-layer allocator (session_capture::claimed_provider_session_keys)
+    // already excludes leader_receiver/team_owner; mirror that here for the
+    // event-log recovery path, otherwise a fresh restart can pull the leader
+    // session_id out of events.jsonl and write it onto a worker
+    // (release-engineer / any worker with no captured session). Scan
+    // state.leader_receiver, state.team_owner, and the same fields under
+    // state.teams.<key>.
+    push_leader_session_ids(&mut keys, state);
+    if let Some(teams) = state.get("teams").and_then(serde_json::Value::as_object) {
+        for team_state in teams.values() {
+            push_leader_session_ids(&mut keys, team_state);
+        }
+    }
+    keys
+}
+
+fn push_leader_session_ids(
+    keys: &mut std::collections::BTreeSet<String>,
+    scope: &serde_json::Value,
+) {
+    for anchor in ["leader_receiver", "team_owner"] {
+        if let Some(node) = scope.get(anchor) {
+            for field in ["session_id", "provider_session_id"] {
+                if let Some(session_id) = node
+                    .get(field)
+                    .and_then(serde_json::Value::as_str)
+                    .filter(|s| !s.is_empty())
+                {
+                    keys.insert(session_id.to_string());
+                }
+            }
+        }
+    }
 }
 
 fn session_convergence_deadline(requested_ms: Option<u64>) -> std::time::Duration {
@@ -1109,13 +1183,17 @@ fn try_autobind_leader_after_restart(
                 .pointer("/leader_receiver/provider")
                 .and_then(serde_json::Value::as_str)
         })
-        .and_then(|s| match s {
-            "codex" => Some(crate::model::enums::Provider::Codex),
-            "claude" | "claude_code" | "claude-code" => {
-                Some(crate::model::enums::Provider::ClaudeCode)
-            }
-            "copilot" => Some(crate::model::enums::Provider::Copilot),
-            _ => None,
+        .and_then(|s| {
+            // Legacy auto-attach: collapse any claude variant to ClaudeCode
+            // (this site historically treated `Claude` and `ClaudeCode` as
+            // the same attach target). Wire-format `parse_provider` keeps
+            // them distinct everywhere else.
+            crate::provider::wire::parse_provider(s).map(|p| match p {
+                crate::model::enums::Provider::Claude => {
+                    crate::model::enums::Provider::ClaudeCode
+                }
+                other => other,
+            })
         })
         .unwrap_or(crate::model::enums::Provider::ClaudeCode);
     let team_str = team;
@@ -1270,44 +1348,24 @@ fn mark_agent_respawned(
     // restart probes correctly refuse with `session_backing_store_missing`
     // (macmini bug-044 truth source for Claude/ClaudeCode).
     //
-    // Provider policy (per architect §6 residual risk):
-    //   * Claude / ClaudeCode: do NOT promote. Persist pending only via
-    //     `persist_command_plan_state` below (_pending_session_id field).
-    //     Authoritative `session_id` is written ONLY by session capture when
-    //     a real backing transcript is found on disk. Stale `session_id` from
-    //     a previous session is cleared here (fresh restart means old backing
-    //     is gone or never existed).
-    //   * Copilot: KEEP promotion. Copilot has stronger expected-id semantics
-    //     via its SQLite store, and the test
-    //     `restart_allow_fresh_copilot_persists_expected_session_id` pins the
-    //     existing behaviour. (Future: gate behind a provider-policy backing
-    //     assertion when Copilot store probe is implemented.)
-    //   * Codex: never reaches here with `expected_session_id=Some` — Codex
-    //     command planning returns `None` (provider/adapter.rs:477-495,
-    //     0.3.31 correction).
+    // 0.4.6 tuple-atomic contract (restart-persist-capture-contract-audit.md):
+    // ALL providers — restart never promotes a planned id into authoritative
+    // `session_id`. Capture (provider scanner) is the only authoritative
+    // writer. On Fresh / FreshAfterMissingRollout, clear the full tuple;
+    // `persist_command_plan_state` below writes `_pending_session_id` as a
+    // capture hint, and the provider scanner promotes that hint into the
+    // tuple ONLY after it confirms backing (sqlite/transcript/.codex).
+    //
+    // This deletes the Copilot promotion that previously violated the
+    // capture-only-writer rule (audit §Restart 当前违规 #1) and uses the
+    // Claude family clear path uniformly. The Copilot scanner
+    // (provider/adapter.rs:1217-1228) already gates expected-id with a
+    // sqlite point-check, so no truth is lost.
     if matches!(
         restart_mode,
         StartMode::Fresh | StartMode::FreshAfterMissingRollout
     ) {
-        let provider = agent
-            .get("provider")
-            .and_then(serde_json::Value::as_str)
-            .map(str::to_ascii_lowercase);
-        let is_claude_family = matches!(
-            provider.as_deref(),
-            Some("claude") | Some("claude_code") | Some("claude-code") | Some("claudecode")
-        );
-        if is_claude_family {
-            // Claude family: do not promote. Clear stale session_id.
-            agent.insert("session_id".to_string(), serde_json::Value::Null);
-        } else if let Some(session_id) = spawn.plan.expected_session_id.as_ref() {
-            // Copilot (and any future provider with provider-store backing
-            // semantics): promote as before.
-            agent.insert(
-                "session_id".to_string(),
-                serde_json::json!(session_id.as_str()),
-            );
-        }
+        agent.insert("session_id".to_string(), serde_json::Value::Null);
     }
     crate::lifecycle::launch::persist_command_plan_state(agent, &spawn.plan, &spawn.profile_launch);
     persist_effective_approval_policy_for_restart(agent, safety);

package/crates/team-agent/src/lifecycle/restart/selection.rs

@@ -221,6 +221,25 @@ pub(crate) fn classify_restart_plan_with_resume_validation(
                 }
                 _ => (true, Vec::new()),
             };
+        // 0.4.7 partial-resume: when a worker has NEVER been captured (no
+        // session_id AND first_send_at is Absent), it is structurally
+        // non-resumable — there is no context to lose, so auto-fresh is
+        // safe even without --allow-fresh. This prevents a single
+        // never-captured role (e.g. MCP-only worker that the leader never
+        // messaged) from blocking restart of the other 6 roles that DO
+        // have complete resume tuples.
+        //
+        // The "never_captured" predicate is the conjunction:
+        //   * session_id is None (no provider session bound), AND
+        //   * first_send_at is Absent (leader has never injected a
+        //     message — so we never armed the capture path either).
+        //
+        // If session_id is None but first_send_at is Valid, that's the
+        // "received message but session not captured" bug state — keep
+        // the Refuse so we never silently drop context (architect rule:
+        // "绝不静默 fresh").
+        let never_captured =
+            session_id.is_none() && matches!(first_send_at_state, FirstSendAtState::Absent);
         let decision = if session_id.is_some() && provider_can_resume && resume_backing_exists {
             ResumeDecision::Resume
         } else if session_id.is_some() && allow_fresh {
@@ -229,6 +248,10 @@ pub(crate) fn classify_restart_plan_with_resume_validation(
             ResumeDecision::Refuse
         } else if allow_fresh {
             ResumeDecision::FreshStart
+        } else if never_captured {
+            // No session_id + never captured → safe to auto-fresh without
+            // --allow-fresh. No context to lose.
+            ResumeDecision::FreshStart
         } else {
             ResumeDecision::Refuse
         };