@team-agent/installer 0.5.115 → 0.5.116

package/crates/team-agent/src/contract_runtime/registry.rs

@@ -4,21 +4,33 @@ use std::collections::BTreeMap;
 use std::path::PathBuf;
 use team_agent_contract::contract::{
     descriptor::{PromptCarrier, ProviderDescriptor, ToolNaming},
+    types::InstanceIdentity,
     hooks::{PlanHook, ProviderHooks},
     plan::{LaunchPlan, ResolvedLaunch},
     types::{ContractError, Support},
 };
 use team_agent_contract::kiro::{self, KiroAdapter, KIRO_DESCRIPTOR};
 use team_agent_contract::providers::cursor::{self, CursorAdapter, CURSOR_DESCRIPTOR};
-use team_agent_contract::runtime::{delivery::ControlDefinition, native_panel::NativePanelPolicy};
+use team_agent_contract::providers::grok_build::{self, GrokAdapter, GROK_BUILD_DESCRIPTOR};
+use team_agent_contract::runtime::{
+    delivery::{ControlDefinition, StartupDefinition},
+    native_panel::{NativePanelPolicy, SessionPanelPolicy},
+};
+
+const DESCRIPTORS: &[&ProviderDescriptor] = &[&KIRO_DESCRIPTOR, &CURSOR_DESCRIPTOR, &GROK_BUILD_DESCRIPTOR];
 
-const DESCRIPTORS: &[&ProviderDescriptor] = &[&KIRO_DESCRIPTOR, &CURSOR_DESCRIPTOR];
+#[derive(Clone)]
+pub enum NativeRuntime {
+    Cursor(cursor::native::RuntimeInstallation),
+    GrokBuild(grok_build::native::RuntimeInstallation),
+}
 
 /// Leaf selection stays here; the framework, lifecycle and outbox remain shared.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(super) enum NativeProvider {
     Kiro,
     Cursor,
+    GrokBuild,
 }
 
 impl NativeProvider {
@@ -26,19 +38,21 @@ impl NativeProvider {
         match self {
             Self::Kiro => &KIRO_DESCRIPTOR,
             Self::Cursor => &CURSOR_DESCRIPTOR,
+            Self::GrokBuild => &GROK_BUILD_DESCRIPTOR,
         }
     }
 
     pub fn action_budget(self) -> std::time::Duration {
         // Kiro's existing budget is unchanged; Cursor's measured cold-ready
         // path needs a larger finite bound, not an unbounded readiness wait.
-        std::time::Duration::from_secs(match self { Self::Kiro => 30, Self::Cursor => 90 })
+        std::time::Duration::from_secs(match self { Self::Kiro => 30, Self::Cursor | Self::GrokBuild => 90 })
     }
 
     pub fn controls(self) -> &'static [ControlDefinition] {
         match self {
             Self::Kiro => kiro::interaction::CONTROLS,
             Self::Cursor => cursor::interaction::CONTROLS,
+            Self::GrokBuild => grok_build::interaction::CONTROLS,
         }
     }
 
@@ -48,10 +62,24 @@ impl NativeProvider {
         matches!(self.descriptor().prompt.carrier, Support::Supported(PromptCarrier::RuntimeBridge))
     }
 
-    /// Cursor has no measured neutral TUI tools panel. Its protocol binding
-    /// must come from the separately fenced native tool-roundtrip ledger.
+    /// These providers use the separately fenced native tool-roundtrip ledger,
+    /// never a guessed neutral tools panel or another provider's inspector.
     pub fn uses_tool_roundtrips(self) -> bool {
-        matches!(self, Self::Cursor)
+        matches!(self, Self::Cursor | Self::GrokBuild)
+    }
+
+    pub fn startup(self) -> Option<&'static StartupDefinition> {
+        match self {
+            Self::GrokBuild => Some(&grok_build::interaction::STARTUP),
+            Self::Kiro | Self::Cursor => None,
+        }
+    }
+
+    pub fn session_panel(self) -> Option<&'static SessionPanelPolicy> {
+        match self {
+            Self::GrokBuild => Some(&grok_build::interaction::SESSION_PANEL),
+            Self::Kiro | Self::Cursor => None,
+        }
     }
 
     pub fn tool_panel(self) -> Result<&'static NativePanelPolicy, ContractError> {
@@ -61,9 +89,20 @@ impl NativeProvider {
                 field: "Cursor native Team-tool inspector",
                 reason: cursor::UNVERIFIED,
             }),
+            Self::GrokBuild => Err(ContractError::Unverified {
+                field: "Grok Build native Team-tool inspector",
+                reason: grok_build::UNVERIFIED,
+            }),
         }
     }
 
+    pub fn server_key_for(self, identity: &InstanceIdentity) -> Result<String, ContractError> {
+        if self == Self::GrokBuild {
+            return Ok(grok_build::server_key(identity));
+        }
+        Ok(self.server_key()?.into())
+    }
+
     pub fn server_key(self) -> Result<&'static str, ContractError> {
         match self.descriptor().tool_names.naming.require("tool naming")? {
             ToolNaming::StaticServer { key } => Ok(key),
@@ -84,6 +123,9 @@ impl NativeProvider {
             Self::Cursor => CursorAdapter::new(cursor::McpStdio {
                 executable, arguments, environment,
             }).map(NativeAdapter::Cursor),
+            Self::GrokBuild => GrokAdapter::new(grok_build::McpStdio {
+                executable, arguments, environment,
+            }).map(NativeAdapter::GrokBuild),
         }
     }
 }
@@ -91,13 +133,14 @@ impl NativeProvider {
 pub(super) enum NativeAdapter {
     Kiro(KiroAdapter),
     Cursor(CursorAdapter),
+    GrokBuild(GrokAdapter),
 }
 
 impl NativeAdapter {
     pub fn with_launch_context(
         self,
         project: PathBuf,
-        runtime: Option<cursor::native::RuntimeInstallation>,
+        runtime: Option<NativeRuntime>,
     ) -> Result<Self, ContractError> {
         match self {
             Self::Kiro(adapter) if runtime.is_none() => Ok(Self::Kiro(adapter)),
@@ -105,7 +148,16 @@ impl NativeAdapter {
             Self::Cursor(adapter) => {
                 let adapter = adapter.with_project(project)?;
                 Ok(Self::Cursor(match runtime {
-                    Some(runtime) => adapter.with_runtime(runtime),
+                    Some(NativeRuntime::Cursor(runtime)) => adapter.with_runtime(runtime),
+                    Some(_) => return Err(ContractError::Mismatch("native runtime provider")),
+                    None => adapter,
+                }))
+            }
+            Self::GrokBuild(adapter) => {
+                let adapter = adapter.with_project(project)?;
+                Ok(Self::GrokBuild(match runtime {
+                    Some(NativeRuntime::GrokBuild(runtime)) => adapter.with_runtime(runtime),
+                    Some(_) => return Err(ContractError::Mismatch("native runtime provider")),
                     None => adapter,
                 }))
             }
@@ -116,6 +168,7 @@ impl NativeAdapter {
         match self {
             Self::Kiro(adapter) => adapter.hooks(),
             Self::Cursor(adapter) => adapter.hooks(),
+            Self::GrokBuild(adapter) => adapter.hooks(),
         }
     }
 
@@ -123,6 +176,7 @@ impl NativeAdapter {
         match self {
             Self::Kiro(adapter) => adapter.plan(request),
             Self::Cursor(adapter) => adapter.plan(request),
+            Self::GrokBuild(adapter) => adapter.plan(request),
         }
     }
 }
@@ -132,6 +186,7 @@ pub(super) fn provider(key: &str) -> Result<NativeProvider, ContractError> {
     match descriptor.identity.id {
         "kiro" => Ok(NativeProvider::Kiro),
         "cursor" => Ok(NativeProvider::Cursor),
+        "grok_build" => Ok(NativeProvider::GrokBuild),
         _ => Err(ContractError::Invalid("contract provider dispatcher")),
     }
 }
@@ -168,11 +223,15 @@ mod tests {
     fn canonical_cursor_does_not_reclassify_legacy_names() {
         assert_eq!(provider("cursor").unwrap(), NativeProvider::Cursor);
         assert_eq!(provider("kiro").unwrap(), NativeProvider::Kiro);
-        for legacy in ["cursor_agent", "agent", "pi", "codex"] {
+        for legacy in ["cursor_agent", "agent", "pi", "codex", "grok"] {
             assert!(descriptor(legacy).is_none());
             assert!(!recognizes(legacy));
             assert!(provider(legacy).is_err());
         }
+        assert_eq!(provider("grok_build").unwrap(), NativeProvider::GrokBuild);
+        assert!(recognizes(" Grok_Build "));
+        assert!(descriptor("Grok_Build").is_none());
+        assert!(GROK_BUILD_DESCRIPTOR.identity.aliases.is_empty());
         assert!(recognizes(" Cursor "));
         assert!(descriptor("Cursor").is_none());
         for descriptor in descriptors() {
@@ -180,6 +239,24 @@ mod tests {
         }
     }
 
+    #[test]
+    fn grok_server_key_is_generation_bound_and_has_no_inspector_fallback() {
+        use team_agent_contract::contract::types::{Generation, InstanceId, ScopeId, SeatId};
+        let mut identity = InstanceIdentity {
+            scope: ScopeId::new("scope").unwrap(), seat: SeatId::new("worker").unwrap(),
+            instance: InstanceId::new("instance").unwrap(), generation: Generation(1),
+        };
+        let first = NativeProvider::GrokBuild.server_key_for(&identity).unwrap();
+        assert_eq!(first, grok_build::server_key(&identity));
+        identity.generation = Generation(2);
+        assert_ne!(first, NativeProvider::GrokBuild.server_key_for(&identity).unwrap());
+        assert!(NativeProvider::GrokBuild.server_key().is_err());
+        assert!(NativeProvider::GrokBuild.tool_panel().is_err());
+        assert!(NativeProvider::GrokBuild.startup().is_some());
+        assert!(NativeProvider::GrokBuild.session_panel().is_some());
+        assert!(NativeProvider::GrokBuild.uses_tool_roundtrips());
+    }
+
     #[test]
     fn cursor_has_no_kiro_control_or_tool_inspector_fallback() {
         assert!(NativeProvider::Cursor.controls().is_empty());

package/crates/team-agent/src/contract_runtime/workspace.rs

@@ -1,5 +1,6 @@
-//! Stable per-seat primary cwd. The project stays an additional directory;
-//! private MCP files never overwrite a shared project or another seat's config.
+//! Stable per-seat primary cwd outside project Git ancestry. Provider-specific
+//! project access remains explicit; private MCP files never overwrite a shared
+//! project or another seat's config, and old cwd incarnations are not migrated.
 use std::io::{Read, Write};
 use std::os::unix::fs::{DirBuilderExt, MetadataExt, OpenOptionsExt};
 use std::path::Path;
@@ -23,7 +24,7 @@ struct CwdRecord {
 pub(super) fn prepare(binding: &Binding, seat: &SeatId) -> Result<CwdIdentity, BackendError> {
     let root = root_for(&binding.workspace.path, &binding.scope);
     validate_directory(&root)?;
-    let parent = root.join("workspaces");
+    let parent = binding.transport_root.join("workspaces");
     let path = parent.join(seat.as_str());
     let record_path = root.join(format!("cwd-{}.json", seat.as_str()));
     match std::fs::symlink_metadata(&record_path) {
@@ -43,12 +44,23 @@ pub(super) fn prepare(binding: &Binding, seat: &SeatId) -> Result<CwdIdentity, B
                 return Err(BackendError::Metadata);
             }
             let record: CwdRecord = serde_json::from_slice(&bytes).map_err(|_| BackendError::Metadata)?;
-            if record.version != 1 || record.seat != *seat || record.cwd.path != path {
+            // Old sessions stay pinned to their original project-local cwd.
+            // Only new allocations move outside Git; never relocate a resume.
+            let expected = match record.version {
+                1 => root.join("workspaces").join(seat.as_str()),
+                2 => {
+                    validate_directory(&binding.transport_root)?;
+                    reject_git_ancestors(&binding.transport_root)?;
+                    path.clone()
+                }
+                _ => return Err(BackendError::Metadata),
+            };
+            if record.seat != *seat || record.cwd.path != expected {
                 return Err(BackendError::Metadata);
             }
-            validate_directory(&parent)?;
-            validate_directory(&path)?;
-            if resolve_cwd(&path)? != record.cwd {
+            validate_directory(expected.parent().ok_or(BackendError::Metadata)?)?;
+            validate_directory(&expected)?;
+            if resolve_cwd(&expected)? != record.cwd {
                 return Err(BackendError::Metadata);
             }
             return Ok(record.cwd);
@@ -56,6 +68,8 @@ pub(super) fn prepare(binding: &Binding, seat: &SeatId) -> Result<CwdIdentity, B
         Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
         Err(error) => return Err(error.into()),
     }
+    validate_directory(&binding.transport_root)?;
+    reject_git_ancestors(&binding.transport_root)?;
     match std::fs::symlink_metadata(&parent) {
         Ok(_) => validate_directory(&parent)?,
         Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
@@ -68,7 +82,7 @@ pub(super) fn prepare(binding: &Binding, seat: &SeatId) -> Result<CwdIdentity, B
     std::fs::DirBuilder::new().mode(0o700).create(&path)?;
     validate_directory(&path)?;
     let cwd = resolve_cwd(&path)?;
-    let record = CwdRecord { version: 1, seat: seat.clone(), cwd: cwd.clone() };
+    let record = CwdRecord { version: 2, seat: seat.clone(), cwd: cwd.clone() };
     let bytes = serde_json::to_vec(&record).map_err(|_| BackendError::Metadata)?;
     let mut file = std::fs::OpenOptions::new().write(true).create_new(true)
         .mode(0o600).custom_flags(libc::O_NOFOLLOW | libc::O_CLOEXEC).open(record_path)?;
@@ -77,6 +91,19 @@ pub(super) fn prepare(binding: &Binding, seat: &SeatId) -> Result<CwdIdentity, B
     Ok(cwd)
 }
 
+// Metadata only: handle both ordinary .git directories and worktree .git files;
+// never read Git config, credentials, execute hooks, or assume /tmp is non-Git.
+fn reject_git_ancestors(path: &Path) -> Result<(), BackendError> {
+    for ancestor in path.ancestors() {
+        match std::fs::symlink_metadata(ancestor.join(".git")) {
+            Ok(_) => return Err(BackendError::Metadata),
+            Err(error) if error.kind() == std::io::ErrorKind::NotFound => {}
+            Err(error) => return Err(error.into()),
+        }
+    }
+    Ok(())
+}
+
 fn validate_directory(path: &Path) -> Result<(), BackendError> {
     let metadata = std::fs::symlink_metadata(path)?;
     if !metadata.is_dir() || metadata.file_type().is_symlink() || path.canonicalize()? != path
@@ -108,8 +135,9 @@ mod tests {
                 version: 1, workspace: resolve_cwd(&path).unwrap(), team: "test".into(),
                 scope: ScopeId::new("cwd-test").unwrap(), endpoint: "framework:cwd-test".into(),
                 candidate: "/controlled/candidate".into(), candidate_sha256: Digest([1; 32]),
-                tmux: "/controlled/tmux".into(), transport_root: path.join("transport"),
+                tmux: "/controlled/tmux".into(), transport_root: path.with_extension("transport"),
             };
+            std::fs::DirBuilder::new().mode(0o700).create(&binding.transport_root).unwrap();
             let root = root_for(&path, &binding.scope);
             std::fs::create_dir_all(root.parent().unwrap()).unwrap();
             std::fs::DirBuilder::new().mode(0o700).create(&root).unwrap();
@@ -117,7 +145,10 @@ mod tests {
         }
     }
     impl Drop for Fixture {
-        fn drop(&mut self) { let _ = std::fs::remove_dir_all(&self.path); }
+        fn drop(&mut self) {
+            let _ = std::fs::remove_dir_all(&self.path);
+            let _ = std::fs::remove_dir_all(&self.binding.transport_root);
+        }
     }
 
     #[test]
@@ -151,10 +182,47 @@ mod tests {
     fn unrecorded_existing_directory_is_not_claimed() {
         let f = Fixture::new();
         let root = root_for(&f.path, &f.binding.scope);
-        let parent = root.join("workspaces");
+        let parent = f.binding.transport_root.join("workspaces");
         std::fs::DirBuilder::new().mode(0o700).create(&parent).unwrap();
         std::fs::DirBuilder::new().mode(0o700).create(parent.join("worker")).unwrap();
         assert!(prepare(&f.binding, &SeatId::new("worker").unwrap()).is_err());
         assert!(!root.join("cwd-worker.json").exists());
     }
+
+    #[test]
+    fn new_primary_is_outside_project_git_ancestors() {
+        let f = Fixture::new();
+        std::fs::create_dir(f.path.join(".git")).unwrap();
+        let cwd = prepare(&f.binding, &SeatId::new("worker").unwrap()).unwrap();
+        assert!(cwd.path.starts_with(&f.binding.transport_root));
+        assert!(!cwd.path.starts_with(&f.path));
+        reject_git_ancestors(&cwd.path).unwrap();
+    }
+
+    #[test]
+    fn existing_version_one_cwd_is_not_migrated() {
+        let f = Fixture::new();
+        let seat = SeatId::new("worker").unwrap();
+        let root = root_for(&f.path, &f.binding.scope);
+        let parent = root.join("workspaces");
+        let path = parent.join(seat.as_str());
+        std::fs::DirBuilder::new().mode(0o700).create(&parent).unwrap();
+        std::fs::DirBuilder::new().mode(0o700).create(&path).unwrap();
+        let cwd = resolve_cwd(&path).unwrap();
+        let record = CwdRecord { version: 1, seat: seat.clone(), cwd: cwd.clone() };
+        std::fs::write(root.join("cwd-worker.json"), serde_json::to_vec(&record).unwrap()).unwrap();
+        assert_eq!(prepare(&f.binding, &seat).unwrap(), cwd);
+        assert!(!f.binding.transport_root.join("workspaces").exists());
+    }
+
+    #[test]
+    fn git_directory_or_worktree_file_on_transport_ancestor_is_refused() {
+        let f = Fixture::new();
+        let marker = f.binding.transport_root.join(".git");
+        std::fs::write(&marker, b"gitdir: controlled-marker").unwrap();
+        assert!(prepare(&f.binding, &SeatId::new("worker").unwrap()).is_err());
+        std::fs::remove_file(&marker).unwrap();
+        std::fs::create_dir(&marker).unwrap();
+        assert!(prepare(&f.binding, &SeatId::new("worker").unwrap()).is_err());
+    }
 }

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -307,6 +307,7 @@ pub(crate) fn start_agent_at_paths(
             &window,
             noop_pane.as_ref(),
         )?;
+        state["agents"][agent_id.as_str()]["explicit_stop"] = serde_json::Value::Bool(false);
         let team_key = restart_projection_team_key(&state, team);
         save_restart_projected_state(workspace, &mut state, &team_key, &[agent_id.as_str()])?;
         if let Ok(spec) = load_team_spec(spec_workspace) {
@@ -1258,6 +1259,7 @@ pub(super) fn stop_agent_at_paths(
         let _ = write_stop_drain_event(workspace, agent_id, &target_str, &drain_evidence);
     }
     mark_agent_stopped(&mut state, agent_id, agent, &window)?;
+    state["agents"][agent_id.as_str()]["explicit_stop"] = serde_json::Value::Bool(true);
     let team_key = restart_projection_team_key(&state, team);
     // golden operations.py:95: save_team_scoped_state (team projection) — NOT a raw save, so a
     // multi-team workspace keeps the other teams' persisted runtime state instead of being clobbered.
@@ -1380,6 +1382,7 @@ pub(super) fn mark_agent_started(
         }
     }
     agent.insert("status".to_string(), serde_json::json!("running"));
+    agent.insert("explicit_stop".to_string(), serde_json::Value::Bool(false));
     agent.insert("agent_id".to_string(), serde_json::json!(agent_id.as_str()));
     agent.insert("window".to_string(), serde_json::json!(window));
     agent.insert(
@@ -1741,6 +1744,7 @@ fn reset_agent_at_paths(
         .and_then(serde_json::Value::as_object_mut)
     {
         obj.insert("spawn_epoch".to_string(), serde_json::json!(new_epoch));
+        obj.insert("explicit_stop".to_string(), serde_json::Value::Bool(false));
     }
     let team_key = restart_projection_team_key(&state, team);
     sync_restart_team_projections(&mut state, &team_key);

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -371,7 +371,15 @@ fn restart_with_selected_team_and_transport(
         team: Some(selected.team_key.as_str()),
         agent_id: None,
     })?;
-    let mut state = selected.state;
+    // Selection happened before the lifecycle lock. A stop-agent that won the
+    // lock must not be undone by the old running snapshot used by restart.
+    let mut state = crate::state::selector::resolve_active_team(
+        &selected.run_workspace,
+        Some(selected.team_key.as_str()),
+        crate::state::selector::SelectorMode::RequireSpec,
+    )
+    .map_err(|error| LifecycleError::TeamSelect(error.to_string()))?
+    .state;
     crate::lifecycle::launch::ensure_owner_allowed_for_state(&state, None)?;
     let topology_issue_ids = crate::topology::restart_dirty_topology_issue_ids(&state);
     if !topology_issue_ids.is_empty() {
@@ -1092,50 +1100,23 @@ fn restart_with_selected_team_and_transport(
     )?;
     phase_timer.emit(&selected.run_workspace, "restart.phase", LifecyclePhase::SaveState);
     if fatal_resume_failure {
-        let attach_commands = Vec::new();
-        let next_actions = restart_failure_next_actions(&failed_agents);
-        write_restart_completed_event(
-            &selected.run_workspace,
-            &successful_agents,
-            &failed_agents,
-            "fail",
-            None,
-        )?;
-        return Ok(RestartReport::Failed {
-            session_name,
-            failed_agents,
-            next_actions,
-            attach_commands,
-        });
+        // The legacy cohort did not commit; its snapshot was restored above.
+        // Do not promote tentative survivors, but still attempt the separately
+        // admitted contract cohort before reporting the combined outcome.
+        successful_agents.clear();
     }
-    if successful_agents.is_empty() && !failed_agents.is_empty() {
-        let attach_commands = Vec::new();
-        let next_actions = restart_failure_next_actions(&failed_agents);
-        write_restart_completed_event(
-            &selected.run_workspace,
-            &successful_agents,
-            &failed_agents,
-            "fail",
-            None,
-        )?;
-        return Ok(RestartReport::Failed {
-            session_name,
-            failed_agents,
-            next_actions,
-            attach_commands,
-        });
-    }
-    // Stamp the physical session birth after durable state. Replacing workers
-    // in a retained session does not create a new session generation.
-    if let Some(generation) = crate::state::projection::session_generation(&state) {
-        transport
-            .set_session_owner_with_generation(
-                &session_name,
-                &selected.run_workspace,
-                &selected.team_key,
-                generation,
-            )
-            .map_err(|error| LifecycleError::Transport(error.to_string()))?;
+    // A native-only active cohort has no legacy replacement session to stamp.
+    if !successful_agents.is_empty() {
+        if let Some(generation) = crate::state::projection::session_generation(&state) {
+            transport
+                .set_session_owner_with_generation(
+                    &session_name,
+                    &selected.run_workspace,
+                    &selected.team_key,
+                    generation,
+                )
+                .map_err(|error| LifecycleError::Transport(error.to_string()))?;
+        }
     }
     // RM-039-SESS-001 step 2 (architect verdict 2026-06-22): post-respawn
     // resume backing validation.
@@ -1344,8 +1325,16 @@ fn restart_with_selected_team_and_transport(
             )?;
         }
     }
+    // Only legacy survivors enter legacy readiness; contract results are
+    // aggregated afterwards and must never enter backing scans/Codex fallback.
+    let legacy_successful_agents = successful_agents.clone();
+    #[cfg(unix)]
+    append_native_restart_results(&mut successful_agents, &mut failed_agents, || {
+        crate::contract_runtime::commands::restart_prepared(
+            &selected.run_workspace, &selected.team_key, &mut state, native_restart,
+        )
+    });
     if successful_agents.is_empty() && !failed_agents.is_empty() {
-        // Postflight demoted every survivor — emit Failed before coordinator start.
         let attach_commands = Vec::new();
         let next_actions = restart_failure_next_actions(&failed_agents);
         write_restart_completed_event(
@@ -1362,20 +1351,6 @@ fn restart_with_selected_team_and_transport(
             attach_commands,
         });
     }
-    let legacy_successful_agents = successful_agents.clone();
-    #[cfg(unix)]
-    for result in crate::contract_runtime::commands::restart_prepared(
-        &selected.run_workspace, &selected.team_key, &mut state, native_restart,
-    ) {
-        let decision = RestartedAgent {
-            agent_id: AgentId::new(result.agent_id), restart_mode: StartMode::Resumed,
-            decision: ResumeDecision::Resume, session_id: result.session_id.map(SessionId::new),
-        };
-        match result.outcome {
-            Ok(()) => successful_agents.push(decision),
-            Err(error) => failed_agents.push(restart_failed_agent(&decision, "native_resume", error)),
-        }
-    }
     drop(lifecycle_lock);
     let coordinator =
         start_coordinator_for_workspace(&selected.run_workspace, Some(&selected.team_key))?;
@@ -1386,15 +1361,17 @@ fn restart_with_selected_team_and_transport(
     );
     let coordinator_started = coordinator.ok;
     phase_timer.emit(&selected.run_workspace, "restart.phase", LifecyclePhase::ReadinessWait);
-    wait_restart_readiness_or_timeout(
-        &selected.run_workspace,
-        &state,
-        &session_name,
-        &legacy_successful_agents,
-        transport,
-        restart_readiness_deadline(readiness_deadline_ms),
-        restart_readiness_poll_interval(),
-    )?;
+    if !legacy_successful_agents.is_empty() {
+        wait_restart_readiness_or_timeout(
+            &selected.run_workspace,
+            &state,
+            &session_name,
+            &legacy_successful_agents,
+            transport,
+            restart_readiness_deadline(readiness_deadline_ms),
+            restart_readiness_poll_interval(),
+        )?;
+    }
     let attach_commands =
         crate::tmux_backend::attach_command_for_transport_session(transport, &session_name)
             .or_else(|| {
@@ -1491,10 +1468,9 @@ fn repair_resume_sessions_from_event_log(
             .and_then(|agents| agents.get(&agent_id))
             .cloned()
             .unwrap_or(serde_json::Value::Null);
-        if previous
-            .get("session_id")
-            .and_then(serde_json::Value::as_str)
-            .is_some_and(|session| !session.is_empty())
+        if crate::state::projection::agent_stopped_for_restart(&previous)
+            || previous.get("session_id").and_then(serde_json::Value::as_str)
+                .is_some_and(|session| !session.is_empty())
         {
             continue;
         }
@@ -1724,12 +1700,65 @@ fn parse_duration_value_seconds_ms(value: &str) -> Option<u64> {
     }
 }
 
+/// Run the admitted native cohort before classifying any legacy failure. Keeping
+/// the execution inside this seam makes the mixed-failure ordering testable.
+#[cfg(unix)]
+fn append_native_restart_results(
+    successful: &mut Vec<RestartedAgent>,
+    failed: &mut Vec<RestartFailedAgent>,
+    restart: impl FnOnce() -> Vec<crate::contract_runtime::commands::NativeRestartResult>,
+) {
+    for result in restart() {
+        let decision = RestartedAgent {
+            agent_id: AgentId::new(result.agent_id), restart_mode: StartMode::Resumed,
+            decision: ResumeDecision::Resume, session_id: result.session_id.map(SessionId::new),
+        };
+        match result.outcome {
+            Ok(()) => successful.push(decision),
+            Err(error) => failed.push(restart_failed_agent(&decision, "native_resume", error)),
+        }
+    }
+}
+
 fn restart_readiness_deadline(requested_ms: Option<u64>) -> std::time::Duration {
     requested_ms
         .map(std::time::Duration::from_millis)
         .unwrap_or_else(|| env_duration_ms(&["TEAM_AGENT_RESTART_READINESS_DEADLINE_MS"], 30_000))
 }
 
+#[cfg(all(test, unix))]
+mod mixed_native_restart_tests {
+    use super::*;
+    use crate::contract_runtime::commands::NativeRestartResult;
+
+    #[test]
+    fn failed_legacy_cohort_does_not_skip_native_resume_or_hide_its_result() {
+        for legacy_failed in [false, true] {
+            for native_failed in [false, true] {
+                let mut successful = Vec::new();
+                let legacy = RestartedAgent { agent_id: AgentId::new("legacy"),
+                    restart_mode: StartMode::Fresh, decision: ResumeDecision::FreshStart, session_id: None };
+                let mut failed = if legacy_failed { vec![restart_failed_agent(&legacy, "spawn", "failed".into())] } else { vec![] };
+                let mut attempts = 0;
+                append_native_restart_results(&mut successful, &mut failed, || {
+                    attempts += 1;
+                    vec![NativeRestartResult { agent_id: "native".into(), session_id: Some("same-session".into()),
+                        outcome: if native_failed { Err("native failed".into()) } else { Ok(()) } }]
+                });
+                assert_eq!(attempts, 1, "no legacy survivor must not short-circuit native execution");
+                assert_eq!(successful.len(), usize::from(!native_failed));
+                assert_eq!(failed.len(), usize::from(legacy_failed) + usize::from(native_failed));
+                if !native_failed {
+                    assert_eq!(successful[0].agent_id.as_str(), "native");
+                    assert_eq!(successful[0].session_id.as_ref().unwrap().as_str(), "same-session");
+                } else {
+                    assert_eq!(failed.last().unwrap().phase, "native_resume");
+                }
+            }
+        }
+    }
+}
+
 fn restart_readiness_poll_interval() -> std::time::Duration {
     env_duration_ms(&["TEAM_AGENT_RESTART_READINESS_POLL_MS"], 200)
 }