@team-agent/installer 0.5.113 → 0.5.114

package/crates/team-agent/src/lifecycle/launch/spawn.rs

@@ -45,7 +45,7 @@ use super::*;
 /// params:
 ///   spec_path: spec 路径，team 目录优先取 state 里的 team_dir
 ///   session_name: 目标 tmux session
-/// returns: 已起席位清单，含目标 pane、启动模式、布局与显示信息；spawn 后 pane 已死的席位被跳过
+/// returns: legacy 启动收据与独立 contract 已提交席位 ID；不为私有 socket 伪造 legacy pane
 /// errors: 命令拼装或 transport spawn 失败时返回 LifecycleError
 /// ---
 pub(super) fn spawn_agents(
@@ -54,7 +54,7 @@ pub(super) fn spawn_agents(
     spec: &Value,
     session_name: &SessionName,
     transport: &dyn Transport,
-) -> Result<Vec<StartedAgent>, LifecycleError> {
+) -> Result<(Vec<StartedAgent>, Vec<AgentId>), LifecycleError> {
     // E5 解耦:team_dir(角色定义 + profiles 所在)≠ spec_path.parent()(spec 已迁出到 .team/runtime)。
     // 优先取 state.team_dir(角色目录),回落 spec_path.parent()(legacy 同目录布局)。
     let team_dir_buf = crate::state::persist::load_runtime_state(workspace)
@@ -74,6 +74,10 @@ pub(super) fn spawn_agents(
         Some(Value::Bool(true))
     );
     let mut started = Vec::new();
+    #[cfg(unix)]
+    let mut contract_started = Vec::new();
+    #[cfg(not(unix))]
+    let contract_started = Vec::new();
     for agent in spec_agent_values(spec) {
         let Some(agent_id_raw) = agent.get("id").and_then(Value::as_str) else {
             continue;
@@ -81,6 +85,26 @@ pub(super) fn spawn_agents(
         if agent_is_paused(agent) {
             continue;
         }
+        #[cfg(unix)]
+        if agent
+            .get("provider")
+            .and_then(Value::as_str)
+            .is_some_and(|provider| {
+                crate::contract_runtime::registry::descriptor(provider).is_some()
+            })
+        {
+            let team = runtime_team_key_for_spec(spec_path, spec, session_name);
+            crate::contract_runtime::framework::start_role(
+                workspace,
+                team_dir,
+                &team,
+                agent_id_raw,
+            )?;
+            contract_started.push(AgentId::new(agent_id_raw));
+            // No legacy target is manufactured for the private native socket.
+            // persist_spawn_agent_state projects the actual K3 seat separately.
+            continue;
+        }
         let agent_id = AgentId::new(agent_id_raw);
         let provider = agent
             .get("provider")
@@ -99,11 +123,12 @@ pub(super) fn spawn_agents(
         // has both the role instruction AND the callable Team Agent MCP capability.
         // probe5 RED proved that `build_command(.., None, None, ..)` left the worker
         // without `report_result`; placeholders are substituted at spawn time.
-        let command_agent = crate::lifecycle::worker_command_context::WorkerCommandAgent::from_yaml(
-            agent,
-            Some(agent_id_raw),
-            provider,
-        )?;
+        let command_agent =
+            crate::lifecycle::worker_command_context::WorkerCommandAgent::from_yaml(
+                agent,
+                Some(agent_id_raw),
+                provider,
+            )?;
         let system_prompt =
             crate::lifecycle::worker_command_context::compile_worker_system_prompt(&command_agent)?;
         // 0.5.66 bypass 单源:per-agent safety 只服务 env 注入与审计,不参与 argv 决策。
@@ -431,7 +456,7 @@ pub(super) fn spawn_agents(
             managed_mcp_config: plan.managed_mcp_config || profile_launch.managed_mcp_config,
         });
     }
-    Ok(started)
+    Ok((started, contract_started))
 }
 
 /// ---
@@ -451,7 +476,11 @@ pub(crate) fn agent_id_spec_source_path(workspace: &Path, agent_id: &str) -> Str
         });
     team_dir
         .map(|dir| dir.join("agents").join(format!("{agent_id}.md")))
-        .unwrap_or_else(|| workspace.join(".team/current/agents").join(format!("{agent_id}.md")))
+        .unwrap_or_else(|| {
+            workspace
+                .join(".team/current/agents")
+                .join(format!("{agent_id}.md"))
+        })
         .display()
         .to_string()
 }

package/crates/team-agent/src/lifecycle/launch/state_projection.rs

@@ -119,6 +119,23 @@ pub(super) fn persist_spawn_agent_state(
         let Some(id) = agent.get("id").and_then(Value::as_str) else {
             continue;
         };
+        #[cfg(unix)]
+        if agent
+            .get("provider")
+            .and_then(Value::as_str)
+            .is_some_and(|provider| {
+                crate::contract_runtime::registry::descriptor(provider).is_some()
+            })
+        {
+            let projected = if agent_is_paused(agent) {
+                serde_json::json!({"agent_id":id,"provider":"kiro","runtime_family":"contract","status":"paused","pane_id":null})
+            } else {
+                crate::contract_runtime::framework::project_seat(workspace, &team_id, id)
+                    .map_err(|error| LifecycleError::StatePersist(error.to_string()))?
+            };
+            agents.insert(id.to_string(), projected);
+            continue;
+        }
         let provider = agent
             .get("provider")
             .and_then(Value::as_str)

package/crates/team-agent/src/lifecycle/launch.rs

@@ -133,7 +133,11 @@ pub fn launch_with_transport_in_workspace(
     // 所有角色都未声明 dangerously_skip_permissions=true → 写 warning 事件不阻塞。
     // TODO(0.6.0): remove(0.6.0 彻底删源头 A 后此警示无意义)。
     emit_dangerous_flag_no_role_declared_warning(workspace, &spec);
-    phase_timer.emit(workspace, "launch.phase", super::restart::LifecyclePhase::CompileSpec);
+    phase_timer.emit(
+        workspace,
+        "launch.phase",
+        super::restart::LifecyclePhase::CompileSpec,
+    );
     let session_name = spec_session_name(&spec);
     if !dry_run && transport_has_session(transport, &session_name) {
         return Err(LifecycleError::SessionConflict(format!(
@@ -142,11 +146,16 @@ pub fn launch_with_transport_in_workspace(
         )));
     }
     let routes = spec_routes(&spec);
-    let started = if dry_run {
-        Vec::new()
+    let (started, contract_started) = if dry_run {
+        (Vec::new(), Vec::new())
     } else {
-        phase_timer.emit(workspace, "launch.phase", super::restart::LifecyclePhase::SpawnAll);
-        let started = spawn_agents(workspace, spec_path, &spec, &session_name, transport)?;
+        phase_timer.emit(
+            workspace,
+            "launch.phase",
+            super::restart::LifecyclePhase::SpawnAll,
+        );
+        let (started, contract_started) =
+            spawn_agents(workspace, spec_path, &spec, &session_name, transport)?;
         persist_spawn_agent_state(
             workspace,
             spec_path,
@@ -164,14 +173,16 @@ pub fn launch_with_transport_in_workspace(
             .first()
             .map(|agent| agent.spawned_at.as_str())
             .unwrap_or(session_name.as_str());
-        transport
-            .set_session_owner_with_generation(
-                &session_name,
-                workspace,
-                &owner_team,
-                generation,
-            )
-            .map_err(|error| LifecycleError::Transport(error.to_string()))?;
+        if !started.is_empty() {
+            transport
+                .set_session_owner_with_generation(
+                    &session_name,
+                    workspace,
+                    &owner_team,
+                    generation,
+                )
+                .map_err(|error| LifecycleError::Transport(error.to_string()))?;
+        }
         // 0.5.38: per-worker timing tags (source="launch") so operators can
         // trace which worker's spawn dominates wall time. Zeros for now on
         // the sub-timings — Step 1 first enables shape assertion; a later
@@ -208,7 +219,7 @@ pub fn launch_with_transport_in_workspace(
                 "launch",
             );
         }
-        started
+        (started, contract_started)
     };
     // 0.3.28 Step 1: topology invariant guard (warn-only during migration).
     // Logs each violation to stderr; never panics. Promoted to hard error at
@@ -223,6 +234,7 @@ pub fn launch_with_transport_in_workspace(
     Ok(LaunchReport {
         session_name,
         started,
+        contract_started,
         dry_run,
         tmux_endpoint: transport.tmux_endpoint(),
         routes,
@@ -348,13 +360,13 @@ pub use cursor_mcp_iso::{
     materialize_cursor_mcp_project,
 };
 mod cursor_mcp;
+pub(crate) use cursor_mcp::apply_cursor_mcp_enable_profile_env;
 pub use cursor_mcp::{
     apply_cursor_mcp_overlay, apply_cursor_spawn_workspace_pointers,
     apply_cursor_workspace_physical_path, cursor_mcp_enable_argv, cursor_mcp_enable_working_dir,
     enable_cursor_workspace_mcp, enable_cursor_workspace_mcp_with_profile, physical_workspace_path,
     prepare_cursor_seat_mcp, refuse_second_cursor_occupant,
 };
-pub(crate) use cursor_mcp::apply_cursor_mcp_enable_profile_env;
 
 mod cursor_create_chat;
 
@@ -363,9 +375,9 @@ pub(super) use worker_env::*;
 pub(crate) use worker_env::{
     apply_copilot_instructions_overlay, apply_cursor_agent_rules_overlay,
     apply_cursor_subscription_proxy_env_with_profile, apply_mcp_auto_approval_env,
-    apply_profile_launch_env, auth_mode_env_value,
-    fill_spawn_placeholders, fill_spawn_placeholders_full, inherited_env_with_team_overrides,
-    persist_command_plan_state, spawn_timestamp,
+    apply_profile_launch_env, auth_mode_env_value, fill_spawn_placeholders,
+    fill_spawn_placeholders_full, inherited_env_with_team_overrides, persist_command_plan_state,
+    spawn_timestamp,
 };
 pub use worker_env::{apply_cursor_subscription_proxy_env, CursorProxyPresence};
 
@@ -393,18 +405,18 @@ pub(crate) use quick_start_transport::{
 };
 
 pub mod readiness;
+pub(super) use readiness::*;
 pub use readiness::{
     classify_leader_binding, launched_team_receiver_is_attached, selected_team_leader_receiver,
     LeaderBindingClass,
 };
-pub(super) use readiness::*;
 
 mod add_agent;
 pub(super) use add_agent::*;
 pub use add_agent::{add_agent, add_agent_force};
 pub(crate) use add_agent::{
-    add_agent_with_transport, add_agent_with_transport_force,
-    add_agent_with_transport_at_paths_locked, force_recreate_with_transport_locked,
+    add_agent_with_transport, add_agent_with_transport_at_paths_locked,
+    add_agent_with_transport_force, force_recreate_with_transport_locked,
 };
 
 pub(crate) mod add_agent_state;
@@ -428,21 +440,20 @@ pub(super) use ownership::*;
 pub(crate) use ownership::{ensure_owner_allowed, ensure_owner_allowed_for_state, state_path};
 
 pub mod spec_state;
-pub use spec_state::{
-    seed_launched_owner_from_caller_with_provider_lookup, worker_session_name_pub,
-};
 pub(crate) use spec_state::{
     effective_runtime_config_for_worker_spawn, effective_runtime_config_for_worker_spawn_json,
 };
 use spec_state::{
-    env_nonempty, has_positive_caller_leader_env, initial_runtime_state,
-    override_spec_runtime_str, seed_launched_owner_from_env,
-    spec_agent_values, spec_agents, spec_default_assignee, spec_routes, spec_session_name,
-    spec_tasks_json, team_workspace, yaml_value_to_json,
+    env_nonempty, has_positive_caller_leader_env, initial_runtime_state, override_spec_runtime_str,
+    seed_launched_owner_from_env, spec_agent_values, spec_agents, spec_default_assignee,
+    spec_routes, spec_session_name, spec_tasks_json, team_workspace, yaml_value_to_json,
 };
 pub(crate) use spec_state::{
     override_spec_session_name, override_spec_workspace, spec_agent_id_set, write_spec_atomic,
 };
+pub use spec_state::{
+    seed_launched_owner_from_caller_with_provider_lookup, worker_session_name_pub,
+};
 
 #[cfg(test)]
 mod tests {

package/crates/team-agent/src/lifecycle/types.rs

@@ -433,8 +433,11 @@ pub enum LifecycleError {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct LaunchReport {
     pub session_name: SessionName,
-    /// 实际起的 worker(冷启;dry-run 时空)。
+    /// Legacy transport starts; their targets belong to the team transport.
     pub started: Vec<StartedAgent>,
+    /// Committed contract starts, without fabricating legacy pane/window targets.
+    /// Empty on dry-run; populated only after the contract startup returns success.
+    pub contract_started: Vec<AgentId>,
     /// 是否 dry-run(只解析路由/权限,不起进程)。
     pub dry_run: bool,
     /// Selected tmux endpoint for the team transport when known.

package/crates/team-agent/src/lifecycle/worker_command_context.rs

@@ -63,16 +63,16 @@ pub(crate) struct WorkerCommandAgent {
 }
 
 impl WorkerCommandAgent {
-/// ---
-/// purpose: 从 spec 的 YAML agent 节点读出命令上下文
-/// params:
-///   agent: 单个 agent 的 YAML 节点
-///   fallback_id: agent 节点没写 id 时的兜底 id
-///   provider: 已解析的 provider
-/// returns: 填好的 WorkerCommandAgent
-/// errors: communication_mode 取值非法时返回 LifecycleError
-/// contract_id: lifecycle.worker_command_agent.from_source
-/// ---
+    /// ---
+    /// purpose: 从 spec 的 YAML agent 节点读出命令上下文
+    /// params:
+    ///   agent: 单个 agent 的 YAML 节点
+    ///   fallback_id: agent 节点没写 id 时的兜底 id
+    ///   provider: 已解析的 provider
+    /// returns: 填好的 WorkerCommandAgent
+    /// errors: communication_mode 取值非法时返回 LifecycleError
+    /// contract_id: lifecycle.worker_command_agent.from_source
+    /// ---
     pub(crate) fn from_yaml(
         agent: &crate::model::yaml::Value,
         fallback_id: Option<&str>,
@@ -117,16 +117,16 @@ impl WorkerCommandAgent {
         })
     }
 
-/// ---
-/// purpose: 从 runtime state 的 JSON agent 节点读出命令上下文
-/// params:
-///   agent: 单个 agent 的 JSON 节点
-///   fallback_id: agent 节点没写 id 时的兜底 id
-///   provider: 已解析的 provider
-/// returns: 填好的 WorkerCommandAgent
-/// errors: communication_mode 取值非法时返回 LifecycleError
-/// contract_id: lifecycle.worker_command_agent.from_source
-/// ---
+    /// ---
+    /// purpose: 从 runtime state 的 JSON agent 节点读出命令上下文
+    /// params:
+    ///   agent: 单个 agent 的 JSON 节点
+    ///   fallback_id: agent 节点没写 id 时的兜底 id
+    ///   provider: 已解析的 provider
+    /// returns: 填好的 WorkerCommandAgent
+    /// errors: communication_mode 取值非法时返回 LifecycleError
+    /// contract_id: lifecycle.worker_command_agent.from_source
+    /// ---
     pub(crate) fn from_json(
         agent: &serde_json::Value,
         fallback_id: Option<&str>,
@@ -190,7 +190,8 @@ pub(crate) fn compile_worker_system_prompt(
         mcp_tool_name(agent.provider, "team_orchestrator", "get_team_status")
     );
     let report_result = mcp_tool_name(agent.provider, "team_orchestrator", "report_result");
-    let runtime_contract = runtime_contract_section(&send_message, &report_result, &get_team_status);
+    let runtime_contract =
+        runtime_contract_section(&send_message, &report_result, &get_team_status);
     let communication_contract = agent.communication_mode.runtime_contract(&send_message);
     let mut chunks = vec![
         identity_section(agent),
@@ -235,7 +236,7 @@ fn mcp_tool_name(provider: Provider, server: &str, tool: &str) -> String {
     }
 }
 
-fn runtime_contract_section(
+pub(crate) fn runtime_contract_section(
     send_message: &str,
     report_result: &str,
     get_team_status: &str,
@@ -255,10 +256,15 @@ fn communication_mode(value: Option<&str>) -> Result<CommunicationMode, Lifecycl
 }
 
 fn identity_section(agent: &WorkerCommandAgent) -> String {
-    format!(
-        "You are Team Agent worker `{}` with role `{}`. When asked about your role or identity, answer with this Team Agent worker identity first, not only the generic provider product identity.",
+    worker_identity_section(
         agent.id.as_deref().unwrap_or("unknown"),
-        agent.role.as_deref().unwrap_or("developer")
+        agent.role.as_deref().unwrap_or("developer"),
+    )
+}
+
+pub(crate) fn worker_identity_section(id: &str, role: &str) -> String {
+    format!(
+        "You are Team Agent worker `{id}` with role `{role}`. When asked about your role or identity, answer with this Team Agent worker identity first, not only the generic provider product identity."
     )
 }
 
@@ -344,7 +350,9 @@ mod tests {
                     "Do not reply to pure ACKs, greetings, or unchanged status notices (such as \"paused\" or \"waiting\"); after reporting a blocker once or completing a task, remain silent until a new actionable instruction arrives."
                 ));
                 assert!(!prompt.contains("Silence and resumption (mandatory)"));
-                assert!(!prompt.contains("When you receive a message from the leader or a teammate, you MUST respond"));
+                assert!(!prompt.contains(
+                    "When you receive a message from the leader or a teammate, you MUST respond"
+                ));
                 match mode {
                     CommunicationMode::LeaderCentric => {
                         assert!(prompt.contains(
@@ -352,7 +360,9 @@ mod tests {
                         ));
                     }
                     CommunicationMode::Orchestrated => {
-                        assert!(prompt.contains("Respond to task-related messages through Team Agent MCP tools."));
+                        assert!(prompt.contains(
+                            "Respond to task-related messages through Team Agent MCP tools."
+                        ));
                         assert!(prompt.contains("A pure ACK, unrelated status, or non-task message does not require a response."));
                     }
                 }

package/crates/team-agent/src/main.rs

@@ -5,6 +5,12 @@ fn main() -> anyhow::Result<()> {
         .skip(1)
         .map(|arg| arg.to_string_lossy().into_owned());
     let command = args.next();
+    #[cfg(unix)]
+    if matches!(command.as_deref(), Some("contract-mcp")) {
+        team_agent::contract_runtime::mcp::run(&args.collect::<Vec<_>>())
+            .map_err(|error| anyhow::anyhow!(error.to_string()))?;
+        return Ok(());
+    }
     if matches!(command.as_deref(), Some("fake-worker")) {
         let mut workspace = None;
         let mut agent_id = None;

package/crates/team-agent/src/messaging/delivery.rs

@@ -1926,7 +1926,11 @@ fn delivery_transport_for_recipient<'a>(
         }
         return DeliveryTransport::Borrowed(product_transport);
     };
-    if socket == crate::tmux_backend::socket_name_for_workspace(workspace) {
+    // An exact endpoint match can reuse the supplied channel; do not select
+    // another server merely because it has a pane with the same numeric id.
+    if product_transport.tmux_endpoint().as_deref() == Some(socket)
+        || socket == crate::tmux_backend::socket_name_for_workspace(workspace)
+    {
         DeliveryTransport::Borrowed(product_transport)
     } else {
         // 0.5.4 gate054 cross-team leak fix: when `leader_receiver.tmux_socket`
@@ -2523,6 +2527,51 @@ pub(crate) fn recipient_is_busy(state: &serde_json::Value, recipient: &str) -> b
 }
 
 fn leader_rollout_path(state: &serde_json::Value) -> Option<std::path::PathBuf> {
+    if let Some(receiver) = leader_receiver_value(state).filter(|receiver| {
+        receiver.get("provider").and_then(serde_json::Value::as_str) == Some("pi")
+            && receiver.get("native_session").is_some()
+    }) {
+        let native = receiver.get("native_session")?;
+        for key in ["pane_id", "tmux_socket", "leader_session_uuid", "owner_epoch"] {
+            let bound = native.get(key)?;
+            if bound.is_null() || receiver.get(key) != Some(bound) {
+                return None;
+            }
+        }
+        // Managed Pi's native ID is distinct from leader_session_uuid.
+        // The JSONL appears asynchronously. Resolve only inside the recorded
+        // root, by exact id/cwd/spawn time; ambiguity or an unknown
+        // NativeDefault root stays unavailable (no HOME scan).
+        let context = crate::provider::CaptureSessionContext {
+            agent_id: "leader".into(),
+            spawn_cwd: native.get("spawn_cwd")?.as_str()?.into(),
+            pane_id: None,
+            pane_pid: None,
+            spawned_at: Some(native.get("spawned_at")?.as_str()?.into()),
+            expected_session_id: Some(crate::provider::SessionId::new(
+                native.get("expected_session_id")?.as_str()?,
+            )),
+            provider_projects_root: Some(native.get("provider_projects_root")?.as_str()?.into()),
+        };
+        if !context.spawn_cwd.is_absolute()
+            || !context.provider_projects_root.as_ref()?.is_absolute()
+        {
+            return None;
+        }
+        let candidates = crate::provider::session_scan::scan_session_candidates_once(
+            Provider::Pi,
+            &context,
+        )
+        .ok()?;
+        return match candidates.as_slice() {
+            [candidate] => candidate
+                .captured
+                .rollout_path
+                .as_ref()
+                .map(|path| path.as_path().to_path_buf()),
+            _ => None,
+        };
+    }
     state
         .get("leader")
         .and_then(|leader| leader.get("rollout_path"))

package/crates/team-agent/src/messaging/send.rs

@@ -265,6 +265,16 @@ pub fn send_message(
             }
         }
     }
+    #[cfg(unix)]
+    if state
+        .get("agents")
+        .and_then(|agents| agents.get(recipient))
+        .is_some_and(crate::contract_runtime::framework::is_contract)
+    {
+        return crate::contract_runtime::framework::enqueue(
+            workspace, &state, recipient, content, opts,
+        );
+    }
     let stale_worker_target_missing =
         stale_worker_target_missing_preflight(workspace, &state, recipient)?;
     let coordinator_unavailable = if stale_worker_target_missing {

package/crates/team-agent/src/messaging/tests/leader_inject_acceptance.rs

@@ -77,6 +77,131 @@ fn tmux_leader_submit_without_provider_receipt_stays_pending_then_accepts_same_r
     assert!(case.delivery_consumed_at(&message_id).is_some());
 }
 
+fn pi_receipt_case(tag: &str) -> (Case, serde_json::Value) {
+    let mut case = Case::new_without_rollout(tag);
+    let root = case.workspace.join("pi-sessions");
+    std::fs::create_dir_all(&root).unwrap();
+    case.rollout = root.join("not-derived-from-the-session-id.jsonl");
+    let receiver = &mut case.state["leader_receiver"];
+    receiver["provider"] = serde_json::json!("pi");
+    receiver["tmux_socket"] = serde_json::json!(case.workspace.join("fixture-tmux.sock"));
+    receiver["leader_session_uuid"] = serde_json::json!("team-owner-not-native-id");
+    receiver["owner_epoch"] = serde_json::json!(1);
+    receiver["native_session"] = serde_json::json!({
+        "expected_session_id": "native-pi-session",
+        "provider_projects_root": root,
+        "spawn_cwd": case.workspace,
+        "spawned_at": "2026-10-10T03:59:07Z",
+        "pane_id": "%leader",
+        "tmux_socket": receiver["tmux_socket"],
+        "leader_session_uuid": "team-owner-not-native-id",
+        "owner_epoch": 1,
+    });
+    crate::state::persist::save_runtime_state(&case.workspace, &case.state).unwrap();
+    let header = serde_json::json!({
+        "type": "session", "version": 3, "id": "native-pi-session",
+        "cwd": case.workspace, "timestamp": "2026-10-10T03:59:08Z",
+    });
+    (case, header)
+}
+
+#[test]
+fn pi_leader_receipt_binds_exact_header_and_consumes_without_reinjection() {
+    let (case, header) = pi_receipt_case("pi-native-receipt");
+    let endpoint = case.state["leader_receiver"]["tmux_socket"].as_str().unwrap();
+    assert!(Path::new(endpoint).is_absolute());
+    let unbound = crate::messaging::resolve_live_leader_channel(
+        &case.workspace,
+        &case.state["leader_receiver"],
+        &RecordingTransport::new(""),
+    );
+    assert!(
+        matches!(
+            unbound,
+            crate::messaging::LeaderChannelResolution::Unbound(
+                crate::messaging::LeaderChannelUnbound::EndpointMismatch
+            )
+        ),
+        "{unbound:?}"
+    );
+    let transport = RecordingTransport {
+        endpoint: Some(endpoint.to_string()),
+        ..RecordingTransport::new("")
+    };
+    let message_id = case.seed_message("Pi receipt canary");
+    std::fs::write(&case.rollout, format!("{header}\n")).unwrap();
+    let first = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .unwrap();
+    assert!(first.ok, "{first:?}");
+    assert_eq!(
+        case.message_status(&message_id),
+        "submitted_pending_acceptance"
+    );
+    assert_eq!(transport.inject_count(), 1);
+
+    let received = serde_json::json!({
+        "type": "message", "message": {"role": "user", "content": [
+            {"type": "text", "text": format!("5535 [team-agent-token:{message_id}]")}
+        ]}
+    });
+    std::fs::write(&case.rollout, format!("{header}\n{received}\n")).unwrap();
+    let second = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .unwrap();
+    assert!(second.ok, "{second:?}");
+    assert_eq!(case.message_status(&message_id), "delivered");
+    assert!(case.delivery_consumed_at(&message_id).is_some());
+    assert_eq!(transport.inject_count(), 1);
+}
+
+#[test]
+fn pi_leader_receipt_refuses_missing_ambiguous_stale_and_other_owner_backing() {
+    use crate::messaging::delivery::{observe_leader_receipt, LeaderReceiptObservation::*};
+    let (mut case, header) = pi_receipt_case("pi-native-receipt-fences");
+    let old = case.workspace.join("old-leader.jsonl");
+    std::fs::write(&old, "[team-agent-token:canary]").unwrap();
+    case.state["leader"] = serde_json::json!({"rollout_path": old});
+    // An old root leader receipt cannot substitute for this native session.
+    assert_eq!(observe_leader_receipt(&case.state, "canary"), SourceUnavailable);
+    for (field, value) in [
+        ("id", serde_json::json!("another-session")),
+        ("cwd", serde_json::json!(case.workspace.join("other"))),
+        ("timestamp", serde_json::json!("2026-10-10T03:59:06Z")),
+    ] {
+        let mut wrong = header.clone();
+        wrong[field] = value;
+        std::fs::write(&case.rollout, format!("{wrong}\n[team-agent-token:canary]\n")).unwrap();
+        assert_eq!(observe_leader_receipt(&case.state, "canary"), SourceUnavailable);
+    }
+    std::fs::write(&case.rollout, format!("{header}\n")).unwrap();
+    assert_eq!(observe_leader_receipt(&case.state, "canary"), TokenAbsent);
+    let duplicate = case.rollout.with_file_name("duplicate.jsonl");
+    std::fs::write(&duplicate, format!("{header}\n[team-agent-token:canary]\n")).unwrap();
+    assert_eq!(observe_leader_receipt(&case.state, "canary"), SourceUnavailable);
+    std::fs::remove_file(duplicate).unwrap();
+    for key in ["pane_id", "tmux_socket", "leader_session_uuid", "owner_epoch"] {
+        let mut moved = case.state.clone();
+        moved["leader_receiver"][key] = serde_json::json!("changed");
+        assert_eq!(observe_leader_receipt(&moved, "canary"), SourceUnavailable);
+    }
+    case.state["leader_receiver"]["native_session"]["provider_projects_root"] =
+        serde_json::Value::Null;
+    assert_eq!(observe_leader_receipt(&case.state, "canary"), SourceUnavailable);
+}
+
 #[test]
 fn attached_leader_mailbox_is_rechecked_by_the_normal_delivery_tick() {
     let case = Case::new("mailbox");
@@ -428,6 +553,7 @@ impl Case {
 struct RecordingTransport {
     injects: Arc<AtomicUsize>,
     capture: Arc<Mutex<String>>,
+    endpoint: Option<String>,
 }
 
 impl RecordingTransport {
@@ -435,6 +561,7 @@ impl RecordingTransport {
         Self {
             injects: Arc::new(AtomicUsize::new(0)),
             capture: Arc::new(Mutex::new(capture.to_string())),
+            endpoint: None,
         }
     }
 
@@ -444,6 +571,10 @@ impl RecordingTransport {
 }
 
 impl Transport for RecordingTransport {
+    fn tmux_endpoint(&self) -> Option<String> {
+        self.endpoint.clone()
+    }
+
     fn kind(&self) -> BackendKind {
         BackendKind::Tmux
     }