@team-agent/installer 0.5.114 → 0.5.116

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -371,7 +371,15 @@ fn restart_with_selected_team_and_transport(
         team: Some(selected.team_key.as_str()),
         agent_id: None,
     })?;
-    let mut state = selected.state;
+    // Selection happened before the lifecycle lock. A stop-agent that won the
+    // lock must not be undone by the old running snapshot used by restart.
+    let mut state = crate::state::selector::resolve_active_team(
+        &selected.run_workspace,
+        Some(selected.team_key.as_str()),
+        crate::state::selector::SelectorMode::RequireSpec,
+    )
+    .map_err(|error| LifecycleError::TeamSelect(error.to_string()))?
+    .state;
     crate::lifecycle::launch::ensure_owner_allowed_for_state(&state, None)?;
     let topology_issue_ids = crate::topology::restart_dirty_topology_issue_ids(&state);
     if !topology_issue_ids.is_empty() {
@@ -405,6 +413,14 @@ fn restart_with_selected_team_and_transport(
     let spec =
         rebuild_runtime_spec_from_roles(&selected.run_workspace, &selected.team_key, &state)?;
     phase_timer.emit(&selected.run_workspace, "restart.phase", LifecyclePhase::CompileSpec);
+    // All native H2/model/session/cwd gates run before any legacy teardown.
+    // Their private sockets and Node images must not enter legacy selection.
+    #[cfg(unix)]
+    let native_restart = if crate::contract_runtime::framework::has_contract(&state) {
+        crate::contract_runtime::backend::prepare_restart(
+            &selected.run_workspace, &selected.team_key, &selected.team_dir, &state,
+        ).map_err(|error| LifecycleError::Provider(error.to_string()))?
+    } else { Vec::new() };
     // 重建后 spec_workspace 恒为 runtime spec 的父目录(.team/runtime/<team_key>/)。
     let runtime_spec =
         crate::model::paths::runtime_spec_path(&selected.run_workspace, &selected.team_key);
@@ -1084,50 +1100,23 @@ fn restart_with_selected_team_and_transport(
     )?;
     phase_timer.emit(&selected.run_workspace, "restart.phase", LifecyclePhase::SaveState);
     if fatal_resume_failure {
-        let attach_commands = Vec::new();
-        let next_actions = restart_failure_next_actions(&failed_agents);
-        write_restart_completed_event(
-            &selected.run_workspace,
-            &successful_agents,
-            &failed_agents,
-            "fail",
-            None,
-        )?;
-        return Ok(RestartReport::Failed {
-            session_name,
-            failed_agents,
-            next_actions,
-            attach_commands,
-        });
-    }
-    if successful_agents.is_empty() && !failed_agents.is_empty() {
-        let attach_commands = Vec::new();
-        let next_actions = restart_failure_next_actions(&failed_agents);
-        write_restart_completed_event(
-            &selected.run_workspace,
-            &successful_agents,
-            &failed_agents,
-            "fail",
-            None,
-        )?;
-        return Ok(RestartReport::Failed {
-            session_name,
-            failed_agents,
-            next_actions,
-            attach_commands,
-        });
+        // The legacy cohort did not commit; its snapshot was restored above.
+        // Do not promote tentative survivors, but still attempt the separately
+        // admitted contract cohort before reporting the combined outcome.
+        successful_agents.clear();
     }
-    // Stamp the physical session birth after durable state. Replacing workers
-    // in a retained session does not create a new session generation.
-    if let Some(generation) = crate::state::projection::session_generation(&state) {
-        transport
-            .set_session_owner_with_generation(
-                &session_name,
-                &selected.run_workspace,
-                &selected.team_key,
-                generation,
-            )
-            .map_err(|error| LifecycleError::Transport(error.to_string()))?;
+    // A native-only active cohort has no legacy replacement session to stamp.
+    if !successful_agents.is_empty() {
+        if let Some(generation) = crate::state::projection::session_generation(&state) {
+            transport
+                .set_session_owner_with_generation(
+                    &session_name,
+                    &selected.run_workspace,
+                    &selected.team_key,
+                    generation,
+                )
+                .map_err(|error| LifecycleError::Transport(error.to_string()))?;
+        }
     }
     // RM-039-SESS-001 step 2 (architect verdict 2026-06-22): post-respawn
     // resume backing validation.
@@ -1336,8 +1325,16 @@ fn restart_with_selected_team_and_transport(
             )?;
         }
     }
+    // Only legacy survivors enter legacy readiness; contract results are
+    // aggregated afterwards and must never enter backing scans/Codex fallback.
+    let legacy_successful_agents = successful_agents.clone();
+    #[cfg(unix)]
+    append_native_restart_results(&mut successful_agents, &mut failed_agents, || {
+        crate::contract_runtime::commands::restart_prepared(
+            &selected.run_workspace, &selected.team_key, &mut state, native_restart,
+        )
+    });
     if successful_agents.is_empty() && !failed_agents.is_empty() {
-        // Postflight demoted every survivor — emit Failed before coordinator start.
         let attach_commands = Vec::new();
         let next_actions = restart_failure_next_actions(&failed_agents);
         write_restart_completed_event(
@@ -1364,15 +1361,17 @@ fn restart_with_selected_team_and_transport(
     );
     let coordinator_started = coordinator.ok;
     phase_timer.emit(&selected.run_workspace, "restart.phase", LifecyclePhase::ReadinessWait);
-    wait_restart_readiness_or_timeout(
-        &selected.run_workspace,
-        &state,
-        &session_name,
-        &successful_agents,
-        transport,
-        restart_readiness_deadline(readiness_deadline_ms),
-        restart_readiness_poll_interval(),
-    )?;
+    if !legacy_successful_agents.is_empty() {
+        wait_restart_readiness_or_timeout(
+            &selected.run_workspace,
+            &state,
+            &session_name,
+            &legacy_successful_agents,
+            transport,
+            restart_readiness_deadline(readiness_deadline_ms),
+            restart_readiness_poll_interval(),
+        )?;
+    }
     let attach_commands =
         crate::tmux_backend::attach_command_for_transport_session(transport, &session_name)
             .or_else(|| {
@@ -1469,10 +1468,9 @@ fn repair_resume_sessions_from_event_log(
             .and_then(|agents| agents.get(&agent_id))
             .cloned()
             .unwrap_or(serde_json::Value::Null);
-        if previous
-            .get("session_id")
-            .and_then(serde_json::Value::as_str)
-            .is_some_and(|session| !session.is_empty())
+        if crate::state::projection::agent_stopped_for_restart(&previous)
+            || previous.get("session_id").and_then(serde_json::Value::as_str)
+                .is_some_and(|session| !session.is_empty())
         {
             continue;
         }
@@ -1702,12 +1700,65 @@ fn parse_duration_value_seconds_ms(value: &str) -> Option<u64> {
     }
 }
 
+/// Run the admitted native cohort before classifying any legacy failure. Keeping
+/// the execution inside this seam makes the mixed-failure ordering testable.
+#[cfg(unix)]
+fn append_native_restart_results(
+    successful: &mut Vec<RestartedAgent>,
+    failed: &mut Vec<RestartFailedAgent>,
+    restart: impl FnOnce() -> Vec<crate::contract_runtime::commands::NativeRestartResult>,
+) {
+    for result in restart() {
+        let decision = RestartedAgent {
+            agent_id: AgentId::new(result.agent_id), restart_mode: StartMode::Resumed,
+            decision: ResumeDecision::Resume, session_id: result.session_id.map(SessionId::new),
+        };
+        match result.outcome {
+            Ok(()) => successful.push(decision),
+            Err(error) => failed.push(restart_failed_agent(&decision, "native_resume", error)),
+        }
+    }
+}
+
 fn restart_readiness_deadline(requested_ms: Option<u64>) -> std::time::Duration {
     requested_ms
         .map(std::time::Duration::from_millis)
         .unwrap_or_else(|| env_duration_ms(&["TEAM_AGENT_RESTART_READINESS_DEADLINE_MS"], 30_000))
 }
 
+#[cfg(all(test, unix))]
+mod mixed_native_restart_tests {
+    use super::*;
+    use crate::contract_runtime::commands::NativeRestartResult;
+
+    #[test]
+    fn failed_legacy_cohort_does_not_skip_native_resume_or_hide_its_result() {
+        for legacy_failed in [false, true] {
+            for native_failed in [false, true] {
+                let mut successful = Vec::new();
+                let legacy = RestartedAgent { agent_id: AgentId::new("legacy"),
+                    restart_mode: StartMode::Fresh, decision: ResumeDecision::FreshStart, session_id: None };
+                let mut failed = if legacy_failed { vec![restart_failed_agent(&legacy, "spawn", "failed".into())] } else { vec![] };
+                let mut attempts = 0;
+                append_native_restart_results(&mut successful, &mut failed, || {
+                    attempts += 1;
+                    vec![NativeRestartResult { agent_id: "native".into(), session_id: Some("same-session".into()),
+                        outcome: if native_failed { Err("native failed".into()) } else { Ok(()) } }]
+                });
+                assert_eq!(attempts, 1, "no legacy survivor must not short-circuit native execution");
+                assert_eq!(successful.len(), usize::from(!native_failed));
+                assert_eq!(failed.len(), usize::from(legacy_failed) + usize::from(native_failed));
+                if !native_failed {
+                    assert_eq!(successful[0].agent_id.as_str(), "native");
+                    assert_eq!(successful[0].session_id.as_ref().unwrap().as_str(), "same-session");
+                } else {
+                    assert_eq!(failed.last().unwrap().phase, "native_resume");
+                }
+            }
+        }
+    }
+}
+
 fn restart_readiness_poll_interval() -> std::time::Duration {
     env_duration_ms(&["TEAM_AGENT_RESTART_READINESS_POLL_MS"], 200)
 }

package/crates/team-agent/src/lifecycle/restart/selection.rs

@@ -24,6 +24,61 @@ use super::common::*;
 use super::*;
 use crate::provider::wire::{parse_canonical_provider, requires_resume_backing};
 
+#[cfg(all(test, unix))]
+mod contract_route_tests {
+    use super::*;
+
+    #[test]
+    fn contract_seats_never_enter_legacy_resume_or_fresh_classification() {
+        let state = serde_json::json!({"agents": {
+            "cursor": {"provider":"cursor","status":"running","session_id":"native-cursor"},
+            "kiro": {"provider":"kiro","status":"running","session_id":"native-kiro"},
+        }});
+        for allow_fresh in [false, true] {
+            let plan = classify_restart_plan(&state, allow_fresh).unwrap();
+            assert!(plan.decisions.is_empty());
+            assert!(plan.unresumable.is_empty());
+        }
+    }
+
+    #[test]
+    fn mixed_team_retains_legacy_classification_without_native_codex_fallback() {
+        let state = serde_json::json!({"agents": {
+            "native": {"provider":"cursor","status":"running","session_id":"native-id"},
+            "legacy": {"provider":"pi","status":"running"},
+        }});
+        let plan = classify_restart_plan(&state, false).unwrap();
+        assert_eq!(plan.decisions.len(), 1);
+        assert_eq!(plan.decisions[0].agent_id.as_str(), "legacy");
+        assert_eq!(plan.decisions[0].restart_mode, StartMode::Fresh);
+    }
+}
+
+#[cfg(test)]
+mod stopped_restart_tests {
+    use super::*;
+
+    #[test]
+    fn stopped_rows_never_enter_validation_or_fresh_spawn_even_with_allow_fresh() {
+        let state = serde_json::json!({"agents": {
+            "stopped": {"provider":"pi","status":"stopped","explicit_stop":true,
+                "session_id":"preserved","generation":7,"first_send_at":false},
+            "legacy_stopped": {"provider":"pi","status":"stopped"},
+            "marker": {"provider":"pi","status":"running","explicit_stop":true},
+            "active": {"provider":"pi","status":"running"}
+        }});
+        let before = state.clone();
+        for allow_fresh in [false, true] {
+            let plan = classify_restart_plan(&state, allow_fresh).unwrap();
+            assert_eq!(plan.decisions.len(), 1);
+            assert_eq!(plan.decisions[0].agent_id.as_str(), "active");
+            assert!(plan.corrupt_entries.is_empty());
+            assert!(plan.unresumable.is_empty());
+            assert_eq!(state, before);
+        }
+    }
+}
+
 /// ---
 /// purpose: 定出该席位这次的启动模式
 /// params:
@@ -236,13 +291,13 @@ pub(crate) fn python_type_name(value: &serde_json::Value) -> &'static str {
 /// purpose: 纯计算出整队的 restart 计划
 /// params:
 ///   allow_fresh: 允许无会话席位改跑全新会话
-/// returns: 每个非 paused 席位的 resume 决策、损坏的 first_send_at 条目与不可 resume 名单
+/// returns: 每个非 paused/非 stopped 席位的 resume 决策、损坏的 first_send_at 条目与不可 resume 名单
 /// errors: 计算过程中的错误以 LifecycleError 返回
 /// contract_id: lifecycle.selection.classify_restart_plan
 /// ---
 /// Route B 全量验证(纯计算,**无破坏性副作用**;`_emit_resume_decisions` +
 /// `_collect_corrupt_first_send_at`,`orchestration.py:430/467`)。读 fixture state 的
-/// `agents.<id>`,对每非 paused worker:
+/// `agents.<id>`,对每非 paused/非 stopped worker（explicit_stop 也跳过）:
 /// (1) corrupt first_send_at → 收进 `corrupt_entries`(carry python type-name);
 /// (2) 算 resume 决策(`session_id→Resume` / `null session && allow_fresh→FreshStart` /
 ///     否则 `Refuse`;E6 层2:null session 不再因 first_send_at=null 静默 fresh);
@@ -283,11 +338,12 @@ pub(crate) fn classify_restart_plan_with_resume_validation(
     };
 
     for (worker_id, agent) in agents {
-        if agent
-            .get("status")
-            .and_then(|v| v.as_str())
-            .map(|s| s == "paused")
-            .unwrap_or(false)
+        // Contract resumes are admitted against their canonical native store,
+        // not this legacy enum's unknown-provider Codex default.
+        #[cfg(unix)]
+        if crate::contract_runtime::framework::is_contract(agent) { continue; }
+        if crate::state::projection::agent_stopped_for_restart(agent)
+            || agent.get("status").and_then(|v| v.as_str()) == Some("paused")
         {
             continue;
         }

package/crates/team-agent/src/lifecycle/role_config.rs

@@ -486,7 +486,7 @@ fn raw_line_end(text: &str, start: usize) -> (usize, usize) {
     }
 }
 
-fn patched_role(
+pub(crate) fn patched_role(
     text: &str,
     agent_id: &AgentId,
     patch: &RoleConfigPatch,
@@ -775,6 +775,22 @@ impl RoleSnapshot {
     }
 }
 
+/// Compare-and-replace a role only after its complete native plan is admitted.
+/// No rollback of a live/uncertain native generation is implied by this write.
+pub(crate) fn commit_contract_role(
+    path: &Path,
+    expected: &str,
+    replacement: &str,
+) -> Result<(), LifecycleError> {
+    if read_text(path)? != expected {
+        return Err(LifecycleError::RequirementUnmet("role source changed during admission".into()));
+    }
+    if expected != replacement {
+        atomic_write(path, replacement.as_bytes())?;
+    }
+    Ok(())
+}
+
 fn atomic_write(path: &Path, bytes: &[u8]) -> Result<(), LifecycleError> {
     static NEXT: AtomicU64 = AtomicU64::new(0);
     if let Some(parent) = path.parent() {

package/crates/team-agent/src/provider/session/capture.rs

@@ -868,7 +868,8 @@ fn incomplete_resumable_provider<F>(agent: &Value, adapter_for: &mut F) -> Optio
 where
     F: FnMut(Provider) -> Box<dyn ProviderAdapter>,
 {
-    if agent
+    if crate::state::projection::agent_explicit_stop(agent)
+        || agent
         .get("status")
         .and_then(Value::as_str)
         .is_some_and(|status| status != "running")
@@ -892,6 +893,28 @@ where
     Some(provider)
 }
 
+#[cfg(test)]
+mod stopped_capture_tests {
+    use super::*;
+
+    #[test]
+    fn explicit_stop_is_checked_before_adapter_or_backing_probes() {
+        for row in [
+            serde_json::json!({"status":"stopped","provider":"pi","spawn_cwd":"/controlled"}),
+            serde_json::json!({"status":"running","explicit_stop":true,"provider":"pi","spawn_cwd":"/controlled"}),
+            serde_json::json!({"status":"running","explicit_stop":"false","provider":"pi","spawn_cwd":"/controlled"}),
+        ] {
+            assert!(incomplete_resumable_provider(&row, &mut |_| panic!("held seat reached adapter lookup")).is_none());
+        }
+        let mut calls = 0;
+        let _ = incomplete_resumable_provider(
+            &serde_json::json!({"status":"running","explicit_stop":false,"provider":"pi","spawn_cwd":"/controlled"}),
+            &mut |provider| { calls += 1; crate::provider::get_adapter(provider) },
+        );
+        assert_eq!(calls, 1, "active control must still be eligible for capture");
+    }
+}
+
 fn agent_session_complete(agent: &Value) -> bool {
     // RM-039-SESS-001 step 1 (architect verdict 2026-06-22): historically
     // this returned true the moment `rollout_path` was non-empty — even when

package/crates/team-agent/src/state/persist.rs

@@ -48,7 +48,7 @@ const SESSION_STATE_FIELDS: [&str; 6] = [
 ];
 const LIVE_TOPOLOGY_FIELDS: [&str; 5] =
     ["pane_id", "pane_pid", "window", "spawned_at", "spawn_epoch"];
-const ROSTER_STUB_ALLOWLIST: [&str; 16] = [
+const ROSTER_STUB_ALLOWLIST: [&str; 17] = [
     "agent_id",
     "provider",
     "auth_mode",
@@ -65,6 +65,7 @@ const ROSTER_STUB_ALLOWLIST: [&str; 16] = [
     "claude_config_dir",
     "claude_projects_root",
     "profile_launch",
+    "explicit_stop",
 ];
 
 /// `state.py:_RUNTIME_STATE_CACHE`:进程级 path→state 缓存(deep-equal 早返回)。
@@ -626,6 +627,16 @@ fn persist_runtime_state_with_merge_options_and_expected(
 pub(super) fn update_runtime_state(
     workspace: &Path,
     update: impl FnOnce(&Value) -> Result<Value, StateError>,
+) -> Result<Value, StateError> {
+    update_runtime_state_with_lifecycle_target(workspace, None, update)
+}
+
+/// Keep bounded StartAgent's exact team/seat authority inside the same state-save
+/// transaction. Ordinary deltas retain every existing stale-writer guard.
+pub(super) fn update_runtime_state_with_lifecycle_target(
+    workspace: &Path,
+    target: Option<(&str, &str)>,
+    update: impl FnOnce(&Value) -> Result<Value, StateError>,
 ) -> Result<Value, StateError> {
     let path = runtime_state_path(workspace);
     let _lock = RuntimeLock::acquire(workspace, "state-save", 2.0)?;
@@ -639,7 +650,12 @@ pub(super) fn update_runtime_state(
     migrate_state_identity(&mut latest, &SystemEnv, workspace)?;
     let _ = migrate_active_team_key(&mut latest);
     let mut committed = update(&latest)?;
-    merge_ordinary_state(&mut committed, &latest)?;
+    let topology_updates = target.into_iter()
+        .map(|(team, agent)| (team.to_owned(), agent.to_owned())).collect();
+    apply_persist_merge_contract(
+        &mut committed, &latest, &BTreeSet::new(), None, &BTreeSet::new(),
+        &topology_updates, &BTreeSet::new(), None, None, None,
+    )?;
     migrate_state_identity(&mut committed, &SystemEnv, workspace)?;
     crate::state::ownership::strip_top_level_ownership_if_canonical_present(&mut committed);
     if committed == latest {
@@ -1264,6 +1280,13 @@ fn merge_agent_projection(
                 .is_some_and(|source| !source.is_empty());
         match incoming_map.entry(agent_id.clone()) {
             serde_json::map::Entry::Vacant(slot) => {
+                // Omission by an ordinary/stale writer cannot retire a stopped
+                // seat or discard its resume metadata. Explicit RemoveAgent
+                // has already been admitted through deleted_agent_ids above.
+                if crate::state::projection::agent_explicit_stop(latest_agent) {
+                    slot.insert(latest_agent.clone());
+                    continue;
+                }
                 if fork_target {
                     slot.insert(latest_agent.clone());
                     continue;
@@ -1295,6 +1318,17 @@ fn merge_agent_projection(
                 }
             }
             serde_json::map::Entry::Occupied(mut existing) => {
+                if !topology_update_agent_ids.contains(agent_id) {
+                    if crate::state::projection::agent_explicit_stop(latest_agent) {
+                        *existing.get_mut() = latest_agent.clone();
+                        continue;
+                    }
+                    if let Some(marker) = latest_agent.get("explicit_stop") {
+                        if let Some(row) = existing.get_mut().as_object_mut() {
+                            row.insert("explicit_stop".into(), marker.clone());
+                        }
+                    }
+                }
                 if !tombstoned_for_projection && !topology_update_agent_ids.contains(agent_id) {
                     let fields = topology_conflict_fields(existing.get(), latest_agent, team_alive);
                     if !fields.is_empty() {
@@ -2453,6 +2487,42 @@ mod tests {
         );
     }
 
+    #[test]
+    fn stopped_intent_and_resume_metadata_survive_stale_writers_until_targeted_start() {
+        let ws = temp_ws();
+        let held = json!({"agent_id":"held","provider":"codex","status":"stopped","explicit_stop":true,
+            "session_id":"same-session","rollout_path":"/controlled/rollout","captured_at":"2026-10-12T00:00:00Z",
+            "captured_via":"native","generation":7});
+        let mut latest = json!({"session_name":"team-a","active_team_key":"team-a","agents":{"held":held},
+            "teams":{"team-a":{"session_name":"team-a","agents":{"held":held}}}});
+        normalize_agent_session_state(&mut latest);
+        for omit in [false, true] {
+            write_state(&ws, &latest);
+            let before = read_state(&ws);
+            let held_root = before.pointer("/agents/held").unwrap().clone();
+            let held_team = before.pointer("/teams/team-a/agents/held").unwrap().clone();
+            let rows = if omit { json!({}) } else { json!({"held":{"agent_id":"held","provider":"codex","status":"running","explicit_stop":false,"session_id":"stale"}}) };
+            let stale = json!({"session_name":"team-a","active_team_key":"team-a","agents":rows,
+                "teams":{"team-a":{"session_name":"team-a","agents":rows}},"delivery":{"message":"observed"}});
+            save_runtime_state(&ws, &stale).unwrap();
+            let saved = read_state(&ws);
+            assert_eq!(saved.pointer("/agents/held"), Some(&held_root));
+            assert_eq!(saved.pointer("/teams/team-a/agents/held"), Some(&held_team));
+            assert_eq!(saved.pointer("/delivery/message"), Some(&json!("observed")));
+        }
+        let mut started = latest;
+        for pointer in ["/agents/held", "/teams/team-a/agents/held"] {
+            let row = started.pointer_mut(pointer).unwrap();
+            row["status"] = json!("running");
+            row["explicit_stop"] = json!(false);
+        }
+        save_runtime_state_with_lifecycle_topology_authority(&ws, &started, "team-a", &["held"]).unwrap();
+        let saved = read_state(&ws);
+        assert_eq!(saved.pointer("/agents/held/explicit_stop"), Some(&json!(false)));
+        assert_eq!(saved.pointer("/agents/held/session_id"), Some(&json!("same-session")));
+        assert_eq!(saved.pointer("/teams/team-a/agents/held/explicit_stop"), Some(&json!(false)));
+    }
+
     #[test]
     fn lifecycle_topology_authority_only_applies_to_target_agent() {
         let ws = temp_ws();

package/crates/team-agent/src/state/projection.rs

@@ -363,6 +363,20 @@ fn all_present_agents_terminal(team: &Value) -> bool {
     })
 }
 
+/// Team restart never consumes an explicit stop or legacy stopped row.
+/// A malformed persisted marker is held closed, not coerced to false.
+pub(crate) fn agent_stopped_for_restart(agent: &Value) -> bool {
+    agent.get("status").and_then(Value::as_str)
+        .is_some_and(|status| status.eq_ignore_ascii_case("stopped"))
+        || agent_explicit_stop(agent)
+}
+
+/// Only an explicit persisted stop freezes metadata against ordinary writers.
+/// Historical stopped rows still follow existing roster-pruning semantics.
+pub(crate) fn agent_explicit_stop(agent: &Value) -> bool {
+    !matches!(agent.get("explicit_stop"), None | Some(Value::Bool(false)))
+}
+
 pub(crate) fn agent_status_is_terminal(status: &str) -> bool {
     matches!(
         status.to_ascii_lowercase().as_str(),
@@ -1149,6 +1163,21 @@ mod tests {
         ws
     }
 
+    #[test]
+    fn restart_stop_marker_is_conservative_without_blocking_crash_states() {
+        for row in [
+            json!({"status":"stopped"}),
+            json!({"status":"stopped","explicit_stop":false}),
+            json!({"status":"running","explicit_stop":true}),
+            json!({"status":"running","explicit_stop":"false"}),
+        ] {
+            assert!(agent_stopped_for_restart(&row));
+        }
+        for status in ["running", "dead", "restart_failed"] {
+            assert!(!agent_stopped_for_restart(&json!({"status":status,"explicit_stop":false})));
+        }
+    }
+
     #[test]
     fn team_state_key_cases() {
         assert_eq!(

package/crates/team-agent/src/state/repository/tests.rs

@@ -112,3 +112,73 @@ fn coordinator_observations_keep_legacy_identity_and_shape()
     std::fs::remove_dir_all(workspace)?;
     Ok(())
 }
+
+#[test]
+fn stopped_start_commit_updates_exact_target_and_both_mirrors()
+    -> Result<(), Box<dyn std::error::Error>> {
+    use serde_json::json;
+    for target in ["team-a", "team-b"] {
+        let nonce = std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH)?.as_nanos();
+        let workspace = std::env::temp_dir().join(format!("state-start-stopped-{target}-{nonce}"));
+        let held = json!({"agent_id":"worker","provider":"grok_build","runtime_family":"contract",
+            "status":"stopped","explicit_stop":true,"generation":1,"contract_instance":"instance-one",
+            "session_id":"same-session","native_endpoint":"old-endpoint"});
+        let peer = json!({"agent_id":"peer","provider":"pi","status":"stopped","explicit_stop":true,
+            "session_id":"peer-session","generation":1});
+        let control = json!({"agent_id":"control","provider":"pi","status":"running","session_id":"control-session"});
+        let agents = json!({"worker":held,"peer":peer,"control":control});
+        let initial = json!({"session_name":"team-a","active_team_key":"team-a","agents":agents,
+            "teams":{"team-a":{"session_name":"team-a","status":"alive","agents":agents},
+                     "team-b":{"session_name":"team-b","status":"alive","agents":agents}}});
+        let path = super::helper_workspace_path(&workspace);
+        std::fs::create_dir_all(path.parent().unwrap())?;
+        std::fs::write(&path, serde_json::to_vec(&initial)?)?;
+        let repository = super::StateRepository::new(&workspace);
+        let before = repository.load_workspace()?;
+        let other = if target == "team-a" { "team-b" } else { "team-a" };
+        let committed = repository.commit(StateWriteIntent::StartAgent { team_key: target, agent_id: "worker" }, |selected| {
+            let row = &mut selected["agents"]["worker"];
+            row["status"] = json!("running");
+            row["explicit_stop"] = json!(false);
+            row["generation"] = json!(2);
+            row["contract_instance"] = json!("instance-two");
+            row["native_endpoint"] = json!("new-endpoint");
+            // Start authority must not leak to an unrelated stopped peer.
+            selected["agents"]["peer"]["status"] = json!("running");
+            selected["agents"]["peer"]["explicit_stop"] = json!(false);
+        })?;
+        let saved = repository.load_workspace()?;
+        let team = &saved["teams"][target];
+        assert_eq!(team["agents"]["worker"]["status"], "running");
+        assert_eq!(team["agents"]["worker"]["generation"], 2);
+        assert_eq!(team["agents"]["worker"]["explicit_stop"], false);
+        assert_eq!(team["agents"]["worker"]["session_id"], "same-session");
+        assert_eq!(committed["agents"]["worker"], team["agents"]["worker"]);
+        assert!(!crate::state::projection::agent_stopped_for_restart(&team["agents"]["worker"]));
+        assert_eq!(team["agents"]["peer"], before["teams"][target]["agents"]["peer"]);
+        assert_eq!(team["agents"]["control"], before["teams"][target]["agents"]["control"]);
+        assert_eq!(saved["teams"][other], before["teams"][other]);
+        // Root normalization retains null session fields that compact team
+        // rows omit. Build an independent root oracle, not the compact schema.
+        let mut expected_root = before["agents"].clone();
+        if target == "team-a" {
+            let row = &mut expected_root["worker"];
+            row["status"] = json!("running");
+            row["explicit_stop"] = json!(false);
+            row["generation"] = json!(2);
+            row["contract_instance"] = json!("instance-two");
+            row["native_endpoint"] = json!("new-endpoint");
+        }
+        assert_eq!(saved["agents"], expected_root);
+        // An ordinary bounded delta still cannot wake a held peer.
+        repository.commit(StateWriteIntent::ResultCollection { owner_team_id: Some(target) }, |selected| {
+            selected["agents"]["peer"]["status"] = json!("running");
+            selected["agents"]["peer"]["explicit_stop"] = json!(false);
+        })?;
+        let ordinary = repository.load_workspace()?;
+        assert_eq!(ordinary["teams"][target]["agents"], team["agents"]);
+        assert_eq!(ordinary["agents"], saved["agents"]);
+        std::fs::remove_dir_all(workspace)?;
+    }
+    Ok(())
+}

package/crates/team-agent/src/state/repository.rs

@@ -160,6 +160,10 @@ impl<'a> StateRepository<'a> {
     {
         #[cfg(test)]
         test_support::before_commit();
+        let lifecycle_target = match &intent {
+            StateWriteIntent::StartAgent { team_key, agent_id } => Some((*team_key, *agent_id)),
+            _ => None,
+        };
         let team_key = match intent {
             StateWriteIntent::ResultCollection { owner_team_id } => owner_team_id,
             StateWriteIntent::ForkAgent { team_key, .. }
@@ -170,7 +174,7 @@ impl<'a> StateRepository<'a> {
                 ))
             }
         };
-        let committed = super::persist::update_runtime_state(self.workspace, |latest| {
+        let committed = super::persist::update_runtime_state_with_lifecycle_target(self.workspace, lifecycle_target, |latest| {
             let mut selected = bounded_team_view(latest, team_key)?;
             update(&mut selected);
             Ok(match team_key {