@team-agent/installer 0.4.7 → 0.4.8

package/Cargo.lock

@@ -566,7 +566,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.4.7"
+version = "0.4.8"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent"]
 
 [workspace.package]
 edition = "2021"
-version = "0.4.7"
+version = "0.4.8"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/adapters.rs

@@ -226,6 +226,33 @@ pub fn cmd_status_for_team(args: &StatusArgs, team: Option<&str>) -> Result<CmdR
             "status --summary does not accept an agent argument".to_string(),
         ));
     }
+    // S4QR-001 (0.4.8): selected-team ambiguity gate. status is a selected-team
+    // command: when the workspace has 2+ alive teams and no --team was passed,
+    // refuse instead of silently defaulting to the active team. Uses the same
+    // CommandScope::resolve helper as refuse_if_multi_alive_team_missing_scope
+    // (cli/emit.rs:964-979) so the destructive-command ambiguity gate and the
+    // selected-team-read ambiguity gate share a single source of truth.
+    if team.is_none() {
+        let scope = crate::state::paths::CommandScope::resolve(&args.workspace, None);
+        if scope.is_ambiguous() {
+            let candidates: Vec<String> = scope.candidates().to_vec();
+            let message = format!(
+                "status: workspace has multiple alive teams ({}); pass `--team <key>` to choose one",
+                candidates.join(", ")
+            );
+            if args.json {
+                let payload = serde_json::json!({
+                    "ok": false,
+                    "status": "refused",
+                    "reason": "team_target_ambiguous",
+                    "candidates": candidates,
+                    "message": message,
+                });
+                return Ok(CmdResult::from_json(payload, args.json));
+            }
+            return Err(CliError::Usage(message));
+        }
+    }
     let selected = match crate::state::selector::resolve_active_team(
         &args.workspace,
         team,

package/crates/team-agent/src/lifecycle/profile_launch.rs

@@ -419,6 +419,30 @@ fn provider_env_unsets(provider: Provider, auth_mode: AuthMode) -> BTreeSet<Stri
     let mut unsets = BTreeSet::new();
     match provider {
         Provider::Claude | Provider::ClaudeCode => {
+            // E57 (0.3.27 P0): unset CLAUDE_CODE_SESSION_ID inherited from the
+            // leader's environment. When a Claude leader spawns a Claude worker,
+            // the worker inherits the leader's CLAUDE_CODE_SESSION_ID; Claude
+            // Code then routes the worker's transcript to the leader's session
+            // file (~/.claude/projects/<hash>/<leader-session-uuid>.jsonl),
+            // corrupting attribution and transcripts. Always unset so Claude
+            // Code generates a fresh session id per worker.
+            //
+            // S1-CAPTURE (0.4.x P0): also unset the rest of the Claude Code
+            // child/team env block. These variables make the spawned process
+            // believe it is a CHILD of the parent Claude (CLAUDE_CODE_CHILD_SESSION),
+            // a TEAM member (CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS), or otherwise
+            // inherit the parent's invocation identity (ENTRYPOINT / EXECPATH /
+            // CLAUDECODE marker). Without unsetting these, a Claude worker
+            // spawned from a Claude leader is not an INDEPENDENT process — it
+            // joins the leader's session tree and its transcript / state /
+            // billing are attributed to the leader. CLAUDE_EFFORT is preserved
+            // (effort preference does not affect session attribution).
+            unsets.insert("CLAUDE_CODE_SESSION_ID".to_string());
+            unsets.insert("CLAUDE_CODE_CHILD_SESSION".to_string());
+            unsets.insert("CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS".to_string());
+            unsets.insert("CLAUDE_CODE_ENTRYPOINT".to_string());
+            unsets.insert("CLAUDE_CODE_EXECPATH".to_string());
+            unsets.insert("CLAUDECODE".to_string());
             if auth_mode == AuthMode::CompatibleApi {
                 unsets.insert("ANTHROPIC_API_KEY".to_string());
             }

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -208,7 +208,7 @@ pub(crate) fn start_agent_at_paths(
         None,
         Some(resolved_team_key.as_str()),
     )?;
-    mark_agent_started(&mut state, agent_id, &spawn_window, &spawn, transport, &safety)?;
+    mark_agent_started(&mut state, agent_id, &spawn_window, &spawn, transport, &safety, start_mode)?;
     // **0.3.24 add-agent socket drift fix**: keep `state.tmux_endpoint` /
     // `state.tmux_socket` synchronized with the transport actually used for the
     // spawn. Without this, add-agent / fork-agent could spawn to a socket that
@@ -700,6 +700,7 @@ fn mark_agent_started(
     spawn: &SpawnedAgentWindow,
     transport: &dyn crate::transport::Transport,
     safety: &DangerousApproval,
+    start_mode: StartMode,
 ) -> Result<(), LifecycleError> {
     let Some(agent) = state
         .get_mut("agents")
@@ -712,6 +713,31 @@ fn mark_agent_started(
             agent_id
         )));
     };
+    // S1-CAPTURE-001 (0.4.8, CR M3 provider-agnostic): on a Fresh /
+    // FreshAfterMissingRollout start, the prior session's authoritative
+    // capture tuple MUST be cleared before persist_command_plan_state
+    // writes the new _pending_session_id. Otherwise old session_id +
+    // rollout_path coexist with new _pending_session_id and
+    // agent_session_complete returns true on the stale tuple — capture
+    // never re-binds to the new process, and any delivered token lands
+    // in the old transcript (the leader/unassigned mis-attribution seen
+    // in the gate evidence). This applies to all providers that resume:
+    // codex, claude, copilot. Reset_agent --discard-session already does
+    // this at common.rs:1144-1188; here we mirror it for start-agent /
+    // restart-agent fresh paths so the fresh-tuple invariant is global.
+    if matches!(start_mode, StartMode::Fresh | StartMode::FreshAfterMissingRollout) {
+        for field in [
+            "session_id",
+            "rollout_path",
+            "captured_at",
+            "captured_via",
+            "attribution_confidence",
+            "capture_state",
+            "attribution_ambiguous",
+        ] {
+            agent.remove(field);
+        }
+    }
     agent.insert("status".to_string(), serde_json::json!("running"));
     agent.insert("agent_id".to_string(), serde_json::json!(agent_id.as_str()));
     agent.insert("window".to_string(), serde_json::json!(window));

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -895,10 +895,25 @@ pub(crate) fn restart_required_missing_session_agent_ids(state: &serde_json::Val
                 .get("status")
                 .and_then(|value| value.as_str())
                 .is_some_and(|status| status == "running");
-            // E6 层2 (C2): required-missing 谓词只看 session_id 有无 + 是否在跑。
-            // pane 绑定 / first_send_at 在 gate 时刻天然可空(自启动 worker leader 从未发消息),
-            // 不能作判据 —— 否则真丢上下文的 null-session worker 被漏判,走静默 fresh。
-            missing_session_id && is_running
+            // E6 层2 (C2) + RESTART-RESUME-001 (0.4.8): required-missing
+            // predicate gates on session_id absence + running, but ALSO
+            // skips never-captured workers (no session_id AND no context
+            // signals at all). A never-captured worker has nothing to
+            // lose by fresh-start, so it must not block convergence and
+            // burn the capture deadline. This matches the selection-stage
+            // partial-resume semantic in
+            // selection.rs::classify_resume_decision (never_captured →
+            // FreshStart without --allow-fresh).
+            //
+            // The "has context to preserve" signal is the shared
+            // restart_agent_has_context_to_preserve helper: first_send_at
+            // (leader→worker delivery), last_result_at (MCP report path
+            // that may skip first_send_at), or task_prompt_delivered.
+            // Only context-bearing null-session workers continue to
+            // require convergence (so we never silently drop context).
+            missing_session_id
+                && is_running
+                && !super::selection::restart_agent_never_captured(agent, None)
         })
         .collect::<Vec<_>>();
     missing.sort();

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -1361,11 +1361,29 @@ fn mark_agent_respawned(
     // Claude family clear path uniformly. The Copilot scanner
     // (provider/adapter.rs:1217-1228) already gates expected-id with a
     // sqlite point-check, so no truth is lost.
+    // S1-CAPTURE-001 (0.4.8): on Fresh / FreshAfterMissingRollout, clear the
+    // FULL prior-session authoritative capture tuple — not just session_id.
+    // Mirrors mark_agent_started (restart/agent.rs:728-740) so the rebuild path
+    // (multi-agent restart) and the single-agent start path enforce the same
+    // fresh-tuple invariant. Without this, save_restart_state's persist
+    // backfill can revive the stale rollout_path/captured_at/capture_state
+    // tuple from latest, defeating the fresh-tuple guarantee and leaving
+    // delivered tokens in the old transcript (leader/unassigned mis-attrib).
     if matches!(
         restart_mode,
         StartMode::Fresh | StartMode::FreshAfterMissingRollout
     ) {
-        agent.insert("session_id".to_string(), serde_json::Value::Null);
+        for field in [
+            "session_id",
+            "rollout_path",
+            "captured_at",
+            "captured_via",
+            "attribution_confidence",
+            "capture_state",
+            "attribution_ambiguous",
+        ] {
+            agent.remove(field);
+        }
     }
     crate::lifecycle::launch::persist_command_plan_state(agent, &spawn.plan, &spawn.profile_launch);
     persist_effective_approval_policy_for_restart(agent, safety);

package/crates/team-agent/src/lifecycle/restart/selection.rs

@@ -53,6 +53,57 @@ pub fn classify_first_send_at(raw: &serde_json::Value) -> FirstSendAtState {
     }
 }
 
+/// RESTART-RESUME-001 (0.4.8): true if the agent has any signal of prior
+/// interaction whose context would be lost by silent fresh-start. Checks
+/// `first_send_at` (leader→worker delivery), `last_result_at` (worker
+/// report_result), and `task_prompt_delivered` (MCP-only worker first task).
+/// Used by both the selection-stage never-captured decision and the
+/// pre-selection convergence missing-set predicate so the two layers share
+/// a single "needs context preservation" semantic.
+///
+/// CR M2 callers (must stay in sync):
+///   * lifecycle/restart/selection.rs (never_captured branch, classify_resume_decision)
+///   * lifecycle/restart/common.rs::restart_required_missing_session_agent_ids
+pub(crate) fn restart_agent_has_context_to_preserve(agent: &serde_json::Value) -> bool {
+    let has_valid_first_send_at = matches!(
+        classify_first_send_at(agent.get("first_send_at").unwrap_or(&serde_json::Value::Null)),
+        FirstSendAtState::Valid
+    );
+    if has_valid_first_send_at {
+        return true;
+    }
+    let has_last_result_at = agent
+        .get("last_result_at")
+        .and_then(serde_json::Value::as_str)
+        .is_some_and(|s| !s.is_empty());
+    if has_last_result_at {
+        return true;
+    }
+    agent
+        .get("task_prompt_delivered")
+        .and_then(serde_json::Value::as_bool)
+        .unwrap_or(false)
+}
+
+/// RESTART-RESUME-001: an agent is "never-captured" when its session_id is
+/// absent AND there is no context to preserve. Such an agent is safe to
+/// auto-fresh without `--allow-fresh` and should NOT be required to capture
+/// a transcript before restart proceeds.
+pub(crate) fn restart_agent_never_captured(
+    agent: &serde_json::Value,
+    session_id: Option<&str>,
+) -> bool {
+    let session_present = session_id.is_some_and(|s| !s.is_empty())
+        || agent
+            .get("session_id")
+            .and_then(serde_json::Value::as_str)
+            .is_some_and(|s| !s.is_empty());
+    if session_present {
+        return false;
+    }
+    !restart_agent_has_context_to_preserve(agent)
+}
+
 fn is_python_fromisoformat_like(raw: &str) -> bool {
     if raw.is_empty() {
         return false;
@@ -221,25 +272,25 @@ pub(crate) fn classify_restart_plan_with_resume_validation(
                 }
                 _ => (true, Vec::new()),
             };
-        // 0.4.7 partial-resume: when a worker has NEVER been captured (no
-        // session_id AND first_send_at is Absent), it is structurally
-        // non-resumable — there is no context to lose, so auto-fresh is
-        // safe even without --allow-fresh. This prevents a single
-        // never-captured role (e.g. MCP-only worker that the leader never
-        // messaged) from blocking restart of the other 6 roles that DO
-        // have complete resume tuples.
+        // 0.4.7 partial-resume + RESTART-RESUME-001 (0.4.8): when a worker
+        // has NEVER been captured (no session_id AND no context-bearing
+        // signal at all), it is structurally non-resumable — there is no
+        // context to lose, so auto-fresh is safe even without --allow-fresh.
         //
-        // The "never_captured" predicate is the conjunction:
-        //   * session_id is None (no provider session bound), AND
-        //   * first_send_at is Absent (leader has never injected a
-        //     message — so we never armed the capture path either).
+        // The "never_captured" predicate is now the shared
+        // restart_agent_never_captured(): session_id absent AND none of
+        // first_send_at(Valid) / last_result_at / task_prompt_delivered.
+        // This matches the pre-selection convergence semantic in
+        // common.rs::restart_required_missing_session_agent_ids so both
+        // layers refuse / auto-fresh in unison.
         //
-        // If session_id is None but first_send_at is Valid, that's the
-        // "received message but session not captured" bug state — keep
-        // the Refuse so we never silently drop context (architect rule:
-        // "绝不静默 fresh").
+        // If session_id is None but ANY context signal exists, that's the
+        // "received message/result but session not captured" bug state —
+        // keep the Refuse so we never silently drop context (architect
+        // rule: "绝不静默 fresh").
+        let _ = first_send_at_state; // retained for the Corrupt branch above
         let never_captured =
-            session_id.is_none() && matches!(first_send_at_state, FirstSendAtState::Absent);
+            restart_agent_never_captured(agent, session_id.as_ref().map(|s| s.as_str()));
         let decision = if session_id.is_some() && provider_can_resume && resume_backing_exists {
             ResumeDecision::Resume
         } else if session_id.is_some() && allow_fresh {

package/crates/team-agent/src/lifecycle/restart.rs

@@ -35,6 +35,7 @@ mod team_state;
 pub use agent::{reset_agent, reset_agent_with_transport, start_agent, start_agent_with_transport, stop_agent, stop_agent_with_transport};
 pub(crate) use agent::start_agent_at_paths;
 pub(crate) use common::refresh_missing_provider_sessions;
+pub(crate) use common::restart_required_missing_session_agent_ids;
 // 0.3.24 add-agent socket drift fix: state-aware tmux resolver shared with
 // `lifecycle::launch::add_agent` / `fork_agent` so all three (restart / add / fork)
 // route to the SAME tmux socket the live team uses.

package/crates/team-agent/src/lifecycle/tests/core.rs

@@ -636,6 +636,105 @@ fn classify_restart_plan_never_captured_null_session_auto_fresh_partial_resume()
     );
 }
 
+#[test]
+fn restart_required_missing_skips_never_captured_workers() {
+    // RESTART-RESUME-001 (0.4.8): the pre-selection convergence missing-set
+    // predicate must skip never-captured workers (null session_id, no
+    // first_send_at/last_result_at/task_prompt_delivered) so a single
+    // never-captured role doesn't burn the capture deadline and trigger
+    // resume_not_ready when the selection stage would auto-fresh it anyway.
+    use crate::lifecycle::restart::restart_required_missing_session_agent_ids;
+    let state = json!({
+        "agents": {
+            "w1": { "provider": "claude", "session_id": null, "status": "running" }
+        }
+    });
+    let missing = restart_required_missing_session_agent_ids(&state);
+    assert!(
+        missing.is_empty(),
+        "never-captured null-session worker must NOT appear in required-missing; \
+         got {missing:?}"
+    );
+}
+
+#[test]
+fn restart_required_missing_keeps_null_session_with_first_send_at() {
+    // RESTART-RESUME-001: null session_id + valid first_send_at means the
+    // leader DID send a message; that context must be preserved → still
+    // missing → restart refuses without --allow-fresh.
+    use crate::lifecycle::restart::restart_required_missing_session_agent_ids;
+    let state = json!({
+        "agents": {
+            "w1": {
+                "provider": "claude",
+                "session_id": null,
+                "status": "running",
+                "spawn_cwd": "/tmp/ws",
+                "first_send_at": "2026-01-01T00:00:00+00:00",
+            }
+        }
+    });
+    let missing = restart_required_missing_session_agent_ids(&state);
+    assert_eq!(
+        missing,
+        vec!["w1".to_string()],
+        "null-session + valid first_send_at (context bearing) must remain in \
+         required-missing; got {missing:?}"
+    );
+}
+
+#[test]
+fn restart_required_missing_keeps_null_session_with_last_result_at() {
+    // RESTART-RESUME-001: MCP / report_result paths may not have
+    // first_send_at, but a non-empty last_result_at means the worker DID
+    // produce a result; that context must be preserved.
+    use crate::lifecycle::restart::restart_required_missing_session_agent_ids;
+    let state = json!({
+        "agents": {
+            "w1": {
+                "provider": "claude",
+                "session_id": null,
+                "status": "running",
+                "spawn_cwd": "/tmp/ws",
+                "last_result_at": "2026-01-01T00:00:00+00:00",
+            }
+        }
+    });
+    let missing = restart_required_missing_session_agent_ids(&state);
+    assert_eq!(
+        missing,
+        vec!["w1".to_string()],
+        "null-session + last_result_at must remain in required-missing; \
+         got {missing:?}"
+    );
+}
+
+#[test]
+fn classify_restart_plan_null_session_with_last_result_at_refuses_without_allow_fresh() {
+    // RESTART-RESUME-001: selection stage must also refuse null-session +
+    // last_result_at (no first_send_at) without --allow-fresh. Otherwise the
+    // pre-selection convergence and selection-stage refuse semantics drift
+    // and the gate fails for MCP-only report paths.
+    let state = json!({
+        "agents": {
+            "w1": {
+                "provider": "claude",
+                "session_id": null,
+                "last_result_at": "2026-01-01T00:00:00+00:00",
+            }
+        }
+    });
+    let plan = classify_restart_plan(&state, false).expect("纯验证不应 Err");
+    assert_eq!(plan.decisions.len(), 1);
+    assert_eq!(
+        plan.decisions[0].decision,
+        ResumeDecision::Refuse,
+        "null-session + last_result_at must Refuse without --allow-fresh \
+         (context to preserve); got {:?}",
+        plan.decisions[0].decision
+    );
+}
+
 #[test]
 fn classify_restart_plan_never_interacted_null_session_with_allow_fresh_marks_forced_fresh() {
     // E6 层2: 同上自启动 null-session worker,但显式 --allow-fresh → 用户主动认账丢上下文 → FreshStart。

package/crates/team-agent/src/messaging/delivery.rs

@@ -452,6 +452,71 @@ pub fn deliver_pending_message(
             channel: None,
         });
     }
+    // S1-CAPTURE-001 (0.4.8, CR M4 Claude phase-1): for Claude/ClaudeCode
+    // recipients with a known authoritative rollout_path, verify the message
+    // token actually reached the worker's transcript before marking
+    // delivered. This catches the gate's mis-attribution: pane inject
+    // succeeded but the token landed in the leader/unassigned transcript,
+    // not the worker's. Budget per architect plan: 64KB tail / single
+    // per-delivery check / short grace window. Phase-1 Claude only —
+    // codex/copilot keep the pre-fix behaviour (will be addressed in
+    // phase-2 once Claude phase-1 is field-validated).
+    if let Some((rollout_path, provider_wire_str)) = claude_recipient_rollout(state, &message.recipient) {
+        let token_marker = format!("[team-agent-token:{message_id}]");
+        let grace = std::time::Duration::from_millis(200);
+        let deadline = std::time::Instant::now() + std::time::Duration::from_millis(500);
+        let mut transcript_has_token = false;
+        loop {
+            transcript_has_token =
+                rollout_tail_contains(&rollout_path, &token_marker, 64 * 1024);
+            if transcript_has_token || std::time::Instant::now() >= deadline {
+                break;
+            }
+            std::thread::sleep(grace);
+        }
+        if !transcript_has_token {
+            // Loud but non-fatal: emit a mismatch event for diagnose/status
+            // observability. Do NOT mark delivered — degrade to
+            // submitted_unverified so capture is forced to re-attribute.
+            let reason = format!(
+                "transcript_missing:provider={provider_wire_str},rollout={}",
+                rollout_path.display()
+            );
+            event_log.write(
+                "provider.session.transcript_mismatch",
+                serde_json::json!({
+                    "message_id": message_id,
+                    "recipient": message.recipient,
+                    "provider": provider_wire_str,
+                    "rollout_path": rollout_path.to_string_lossy(),
+                    "pane_id": state
+                        .get("agents")
+                        .and_then(|a| a.get(&message.recipient))
+                        .and_then(|a| a.get("pane_id"))
+                        .and_then(serde_json::Value::as_str)
+                        .unwrap_or(""),
+                    "spawn_epoch": state
+                        .get("agents")
+                        .and_then(|a| a.get(&message.recipient))
+                        .and_then(|a| a.get("spawn_epoch"))
+                        .and_then(serde_json::Value::as_u64)
+                        .unwrap_or(0),
+                    "reason": "transcript_missing",
+                }),
+            )?;
+            store.mark(message_id, "submitted_unverified", Some(&reason))?;
+            return Ok(DeliveryOutcome {
+                ok: false,
+                status: DeliveryStatus::Failed,
+                message_status: MessageStatusShadow("submitted_unverified".to_string()),
+                message_id: Some(message_id.to_string()),
+                verification: Some(reason),
+                stage: Some(DeliveryStage::Submit),
+                reason: None,
+                channel: None,
+            });
+        }
+    }
     store.mark(message_id, "delivered", None)?;
     event_log.write(
         "message.delivered",
@@ -1690,3 +1755,51 @@ pub fn retry_injection_after_trust_auto_answer(
         channel: None,
     })
 }
+
+/// S1-CAPTURE-001 (0.4.8 phase-1): returns (rollout_path, provider_wire) when
+/// the recipient agent is Claude/ClaudeCode with a known authoritative
+/// rollout_path; otherwise None (skip transcript verify). Phase-1 Claude only —
+/// codex/copilot return None and keep pre-fix delivery semantics.
+fn claude_recipient_rollout(
+    state: &serde_json::Value,
+    recipient: &str,
+) -> Option<(std::path::PathBuf, &'static str)> {
+    let agent = state.get("agents")?.get(recipient)?;
+    let provider = agent.get("provider").and_then(serde_json::Value::as_str)?;
+    let provider_wire_str = match provider {
+        "claude" => "claude",
+        "claude_code" | "claude-code" => "claude_code",
+        _ => return None,
+    };
+    let rollout = agent
+        .get("rollout_path")
+        .and_then(serde_json::Value::as_str)
+        .filter(|s| !s.is_empty())?;
+    Some((std::path::PathBuf::from(rollout), provider_wire_str))
+}
+
+/// S1-CAPTURE-001 (0.4.8 phase-1): bounded tail read of the rollout file
+/// searching for `needle`. Reads up to `tail_bytes` from the end of the file
+/// (default 64KB budget). Returns true iff the needle appears in the tail.
+/// Silent on read errors — callers treat missing/unreadable as "token not
+/// present" which forces the unverified path.
+fn rollout_tail_contains(path: &std::path::Path, needle: &str, tail_bytes: u64) -> bool {
+    use std::io::{Read, Seek, SeekFrom};
+    let Ok(mut file) = std::fs::File::open(path) else {
+        return false;
+    };
+    let Ok(metadata) = file.metadata() else {
+        return false;
+    };
+    let len = metadata.len();
+    let start = len.saturating_sub(tail_bytes);
+    if file.seek(SeekFrom::Start(start)).is_err() {
+        return false;
+    }
+    let mut buf = Vec::with_capacity(tail_bytes.min(len) as usize);
+    if file.take(tail_bytes).read_to_end(&mut buf).is_err() {
+        return false;
+    }
+    let haystack = String::from_utf8_lossy(&buf);
+    haystack.contains(needle)
+}

package/crates/team-agent/src/provider/session/capture.rs

@@ -296,7 +296,24 @@ where
                 .get("rollout_path")
                 .and_then(Value::as_str)
                 .is_some_and(|s| !s.is_empty());
-        if has_session {
+        // S1-CAPTURE-001 (0.4.8): a pending_session_id that differs from the
+        // on-row session_id means a fresh respawn is in flight — the prior
+        // worker's session_id may still be on the row (concurrent capture race,
+        // delayed persist, or persist-backfill replay) but the NEW worker has
+        // not yet been bound. Stamping capture_state=captured here would
+        // falsely declare the OLD session authoritative for the NEW worker
+        // pane — the leader/unassigned mis-attribution surfaced in S1-CAPTURE-001
+        // gate evidence. Only stamp `captured` when session_id agrees with
+        // _pending_session_id (or _pending is absent, meaning no rebind in
+        // flight).
+        let pending_mismatch = match (
+            agent_obj.get("_pending_session_id").and_then(Value::as_str).filter(|s| !s.is_empty()),
+            agent_obj.get("session_id").and_then(Value::as_str).filter(|s| !s.is_empty()),
+        ) {
+            (Some(pending), Some(current)) => pending != current,
+            _ => false,
+        };
+        if has_session && !pending_mismatch {
             // Captured already — fix state field if drifted.
             if agent_obj
                 .get("capture_state")
@@ -684,6 +701,29 @@ fn agent_session_complete(agent: &Value) -> bool {
     if !session_id_ok {
         return false;
     }
+    // S1-CAPTURE-001 (0.4.8, CR M3 provider-agnostic): pending mismatch guard.
+    // When fresh-start has written a new `_pending_session_id` but the old
+    // authoritative `session_id` is still present and differs, the tuple is
+    // STALE — the new process has a different session that has not been
+    // captured yet. Returning true here would let capture skip this agent
+    // and keep treating the old transcript as authoritative (the gate's
+    // observed mis-attribution). Force re-capture by reporting incomplete.
+    // The fresh-tuple clear in mark_agent_started (lifecycle/restart/agent.rs)
+    // is the primary fix; this guard handles historical poison state where
+    // both fields already coexist from a prior version.
+    let pending = agent
+        .get("_pending_session_id")
+        .and_then(Value::as_str)
+        .filter(|s| !s.is_empty());
+    let current = agent
+        .get("session_id")
+        .and_then(Value::as_str)
+        .filter(|s| !s.is_empty());
+    if let (Some(pending), Some(current)) = (pending, current) {
+        if pending != current {
+            return false;
+        }
+    }
     let rollout_path = match agent
         .get("rollout_path")
         .and_then(Value::as_str)
@@ -1002,6 +1042,16 @@ fn apply_captured_session(
         serde_json::to_value(captured.attribution_confidence).unwrap_or(Value::Null),
     );
     agent_obj.remove("attribution_ambiguous");
+    // S1-CAPTURE-001 (0.4.8): after writing the authoritative tuple, the
+    // `_pending_session_id` placeholder is no longer needed — remove it so
+    // future reads don't trip the pending-mismatch guard in
+    // agent_session_complete. Also stamp capture_state="captured" for
+    // diagnose/status observability.
+    agent_obj.remove("_pending_session_id");
+    agent_obj.insert(
+        "capture_state".to_string(),
+        serde_json::json!("captured"),
+    );
     true
 }
 
@@ -1784,4 +1834,84 @@ mod u1_tests {
         let _ = std::fs::remove_dir_all(workspace.join(".team"));
         let _ = std::fs::remove_dir_all(&workspace);
     }
+
+    /// S1-CAPTURE-001 (0.4.8): pending mismatch guard. When fresh-start has
+    /// written a new `_pending_session_id` but the old authoritative
+    /// `session_id` is still present and differs, `agent_session_complete`
+    /// must return false so capture re-runs and re-binds to the new process.
+    /// Without this, the historical poison state (old + new coexist) lets
+    /// the stale rollout look authoritative.
+    #[test]
+    fn agent_session_complete_returns_false_on_pending_mismatch() {
+        let dir = std::env::temp_dir().join(format!(
+            "ta-pending-mismatch-{}",
+            std::process::id()
+        ));
+        let _ = std::fs::create_dir_all(&dir);
+        let rollout = dir.join("old.jsonl");
+        std::fs::write(&rollout, "{\"type\":\"assistant\"}\n").unwrap();
+
+        let agent = serde_json::json!({
+            "provider": "claude",
+            "session_id": "old",
+            "rollout_path": rollout.to_string_lossy(),
+            "captured_at": "2026-01-01T00:00:00+00:00",
+            "captured_via": "fs_watch",
+            "_pending_session_id": "new",
+        });
+
+        assert!(
+            !super::agent_session_complete(&agent),
+            "S1-CAPTURE-001: pending != session_id must force incomplete \
+             (capture must re-attribute to new session)"
+        );
+
+        // Sanity: when they match, complete is true.
+        let agent_match = serde_json::json!({
+            "provider": "claude",
+            "session_id": "new",
+            "rollout_path": rollout.to_string_lossy(),
+            "captured_at": "2026-01-01T00:00:00+00:00",
+            "captured_via": "fs_watch",
+            "_pending_session_id": "new",
+        });
+        assert!(
+            super::agent_session_complete(&agent_match),
+            "pending == session_id (in-progress capture confirmed): must be complete"
+        );
+
+        let _ = std::fs::remove_file(&rollout);
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
+    /// S1-CAPTURE-001 (0.4.8): apply_captured_session clears
+    /// `_pending_session_id` and stamps `capture_state="captured"` so the
+    /// pending-mismatch guard doesn't fire on subsequent reads.
+    #[test]
+    fn apply_captured_session_clears_pending_and_stamps_capture_state() {
+        let mut agent = serde_json::Map::new();
+        agent.insert(
+            "_pending_session_id".to_string(),
+            serde_json::json!("new-sess"),
+        );
+        let captured = CapturedSession {
+            session_id: Some(SessionId::new("new-sess")),
+            rollout_path: Some(RolloutPath::new(PathBuf::from("/tmp/new.jsonl"))),
+            captured_via: CaptureVia::FsWatch,
+            attribution_confidence: Confidence::High,
+            spawn_cwd: PathBuf::from("/tmp/cwd"),
+        };
+        let written = super::apply_captured_session(&mut agent, &captured);
+        assert!(written, "apply must return true for valid captured");
+        assert!(
+            agent.get("_pending_session_id").is_none(),
+            "S1-CAPTURE-001: _pending_session_id must be removed after capture \
+             (agent={agent:?})"
+        );
+        assert_eq!(
+            agent.get("capture_state").and_then(serde_json::Value::as_str),
+            Some("captured"),
+            "S1-CAPTURE-001: capture_state must be stamped 'captured'"
+        );
+    }
 }

package/crates/team-agent/src/state/paths.rs

@@ -160,10 +160,14 @@ pub enum CommandScope {
     /// Caller passed `--team X` explicitly (or there's only one alive team
     /// and we resolved it). Carries the canonical team_key.
     Resolved(String),
-    /// No `--team` and multiple alive teams. Destructive commands MUST
-    /// refuse with this list of candidates so the operator chooses
-    /// explicitly. Read-only commands may still proceed (their scope is
-    /// "all teams" by default).
+    /// No `--team` and multiple alive teams. Destructive commands AND
+    /// selected-team commands (status, etc.) MUST refuse with this list
+    /// of candidates so the operator chooses explicitly. Only true
+    /// all-team aggregation commands may proceed without --team.
+    /// (S4QR-001 0.4.8: status was previously documented as a read-only
+    /// command that could proceed; in fact it projects a single team's
+    /// view and silently defaulting to the active team caused gate
+    /// failures when multiple alive teams existed.)
     Ambiguous(Vec<String>),
     /// No `--team` and no teams alive yet (fresh workspace) — bare
     /// commands fall through to legacy single-team behaviour.

package/crates/team-agent/src/state/persist.rs

@@ -560,6 +560,23 @@ fn backfill_capture_fields(incoming_agent: &mut Value, latest_agent: &Value) {
     if !latest_complete {
         return;
     }
+    // S1-CAPTURE-001 (0.4.8) Rule 5: a fresh restart marker (`_pending_session_id`
+    // present on incoming) signals the worker just respawned and the prior
+    // tuple was intentionally cleared. The capture scanner is the only path
+    // permitted to promote `_pending_session_id` into the authoritative tuple
+    // after it confirms backing. Persist-side backfill MUST NOT revive the
+    // latest tuple in this state — doing so resurrects the previous worker's
+    // session/rollout pair and delivered tokens land in the OLD transcript
+    // (the leader/unassigned mis-attribution surfaced in S1-CAPTURE-001 gate
+    // evidence). Refuse backfill regardless of whether incoming session_id
+    // is null vs latest's value: the pending marker is authoritative intent.
+    let incoming_pending = incoming_row
+        .get("_pending_session_id")
+        .and_then(Value::as_str)
+        .filter(|s| !s.is_empty());
+    if incoming_pending.is_some() {
+        return;
+    }
     // Rule 2: incoming carries a DIFFERENT non-null session_id → do not mix.
     let incoming_session = incoming_row.get("session_id").and_then(Value::as_str);
     let latest_session = latest_agent.get("session_id").and_then(Value::as_str);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.4.7",
-    "@team-agent/cli-darwin-x64": "0.4.7",
-    "@team-agent/cli-linux-x64": "0.4.7"
+    "@team-agent/cli-darwin-arm64": "0.4.8",
+    "@team-agent/cli-darwin-x64": "0.4.8",
+    "@team-agent/cli-linux-x64": "0.4.8"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",