@team-agent/installer 0.5.115 → 0.5.117

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -371,7 +371,15 @@ fn restart_with_selected_team_and_transport(
         team: Some(selected.team_key.as_str()),
         agent_id: None,
     })?;
-    let mut state = selected.state;
+    // Selection happened before the lifecycle lock. A stop-agent that won the
+    // lock must not be undone by the old running snapshot used by restart.
+    let mut state = crate::state::selector::resolve_active_team(
+        &selected.run_workspace,
+        Some(selected.team_key.as_str()),
+        crate::state::selector::SelectorMode::RequireSpec,
+    )
+    .map_err(|error| LifecycleError::TeamSelect(error.to_string()))?
+    .state;
     crate::lifecycle::launch::ensure_owner_allowed_for_state(&state, None)?;
     let topology_issue_ids = crate::topology::restart_dirty_topology_issue_ids(&state);
     if !topology_issue_ids.is_empty() {
@@ -1092,50 +1100,23 @@ fn restart_with_selected_team_and_transport(
     )?;
     phase_timer.emit(&selected.run_workspace, "restart.phase", LifecyclePhase::SaveState);
     if fatal_resume_failure {
-        let attach_commands = Vec::new();
-        let next_actions = restart_failure_next_actions(&failed_agents);
-        write_restart_completed_event(
-            &selected.run_workspace,
-            &successful_agents,
-            &failed_agents,
-            "fail",
-            None,
-        )?;
-        return Ok(RestartReport::Failed {
-            session_name,
-            failed_agents,
-            next_actions,
-            attach_commands,
-        });
+        // The legacy cohort did not commit; its snapshot was restored above.
+        // Do not promote tentative survivors, but still attempt the separately
+        // admitted contract cohort before reporting the combined outcome.
+        successful_agents.clear();
     }
-    if successful_agents.is_empty() && !failed_agents.is_empty() {
-        let attach_commands = Vec::new();
-        let next_actions = restart_failure_next_actions(&failed_agents);
-        write_restart_completed_event(
-            &selected.run_workspace,
-            &successful_agents,
-            &failed_agents,
-            "fail",
-            None,
-        )?;
-        return Ok(RestartReport::Failed {
-            session_name,
-            failed_agents,
-            next_actions,
-            attach_commands,
-        });
-    }
-    // Stamp the physical session birth after durable state. Replacing workers
-    // in a retained session does not create a new session generation.
-    if let Some(generation) = crate::state::projection::session_generation(&state) {
-        transport
-            .set_session_owner_with_generation(
-                &session_name,
-                &selected.run_workspace,
-                &selected.team_key,
-                generation,
-            )
-            .map_err(|error| LifecycleError::Transport(error.to_string()))?;
+    // A native-only active cohort has no legacy replacement session to stamp.
+    if !successful_agents.is_empty() {
+        if let Some(generation) = crate::state::projection::session_generation(&state) {
+            transport
+                .set_session_owner_with_generation(
+                    &session_name,
+                    &selected.run_workspace,
+                    &selected.team_key,
+                    generation,
+                )
+                .map_err(|error| LifecycleError::Transport(error.to_string()))?;
+        }
     }
     // RM-039-SESS-001 step 2 (architect verdict 2026-06-22): post-respawn
     // resume backing validation.
@@ -1344,8 +1325,16 @@ fn restart_with_selected_team_and_transport(
             )?;
         }
     }
+    // Only legacy survivors enter legacy readiness; contract results are
+    // aggregated afterwards and must never enter backing scans/Codex fallback.
+    let legacy_successful_agents = successful_agents.clone();
+    #[cfg(unix)]
+    append_native_restart_results(&mut successful_agents, &mut failed_agents, || {
+        crate::contract_runtime::commands::restart_prepared(
+            &selected.run_workspace, &selected.team_key, &mut state, native_restart,
+        )
+    });
     if successful_agents.is_empty() && !failed_agents.is_empty() {
-        // Postflight demoted every survivor — emit Failed before coordinator start.
         let attach_commands = Vec::new();
         let next_actions = restart_failure_next_actions(&failed_agents);
         write_restart_completed_event(
@@ -1362,20 +1351,6 @@ fn restart_with_selected_team_and_transport(
             attach_commands,
         });
     }
-    let legacy_successful_agents = successful_agents.clone();
-    #[cfg(unix)]
-    for result in crate::contract_runtime::commands::restart_prepared(
-        &selected.run_workspace, &selected.team_key, &mut state, native_restart,
-    ) {
-        let decision = RestartedAgent {
-            agent_id: AgentId::new(result.agent_id), restart_mode: StartMode::Resumed,
-            decision: ResumeDecision::Resume, session_id: result.session_id.map(SessionId::new),
-        };
-        match result.outcome {
-            Ok(()) => successful_agents.push(decision),
-            Err(error) => failed_agents.push(restart_failed_agent(&decision, "native_resume", error)),
-        }
-    }
     drop(lifecycle_lock);
     let coordinator =
         start_coordinator_for_workspace(&selected.run_workspace, Some(&selected.team_key))?;
@@ -1386,15 +1361,17 @@ fn restart_with_selected_team_and_transport(
     );
     let coordinator_started = coordinator.ok;
     phase_timer.emit(&selected.run_workspace, "restart.phase", LifecyclePhase::ReadinessWait);
-    wait_restart_readiness_or_timeout(
-        &selected.run_workspace,
-        &state,
-        &session_name,
-        &legacy_successful_agents,
-        transport,
-        restart_readiness_deadline(readiness_deadline_ms),
-        restart_readiness_poll_interval(),
-    )?;
+    if !legacy_successful_agents.is_empty() {
+        wait_restart_readiness_or_timeout(
+            &selected.run_workspace,
+            &state,
+            &session_name,
+            &legacy_successful_agents,
+            transport,
+            restart_readiness_deadline(readiness_deadline_ms),
+            restart_readiness_poll_interval(),
+        )?;
+    }
     let attach_commands =
         crate::tmux_backend::attach_command_for_transport_session(transport, &session_name)
             .or_else(|| {
@@ -1491,10 +1468,9 @@ fn repair_resume_sessions_from_event_log(
             .and_then(|agents| agents.get(&agent_id))
             .cloned()
             .unwrap_or(serde_json::Value::Null);
-        if previous
-            .get("session_id")
-            .and_then(serde_json::Value::as_str)
-            .is_some_and(|session| !session.is_empty())
+        if crate::state::projection::agent_stopped_for_restart(&previous)
+            || previous.get("session_id").and_then(serde_json::Value::as_str)
+                .is_some_and(|session| !session.is_empty())
         {
             continue;
         }
@@ -1724,12 +1700,65 @@ fn parse_duration_value_seconds_ms(value: &str) -> Option<u64> {
     }
 }
 
+/// Run the admitted native cohort before classifying any legacy failure. Keeping
+/// the execution inside this seam makes the mixed-failure ordering testable.
+#[cfg(unix)]
+fn append_native_restart_results(
+    successful: &mut Vec<RestartedAgent>,
+    failed: &mut Vec<RestartFailedAgent>,
+    restart: impl FnOnce() -> Vec<crate::contract_runtime::commands::NativeRestartResult>,
+) {
+    for result in restart() {
+        let decision = RestartedAgent {
+            agent_id: AgentId::new(result.agent_id), restart_mode: StartMode::Resumed,
+            decision: ResumeDecision::Resume, session_id: result.session_id.map(SessionId::new),
+        };
+        match result.outcome {
+            Ok(()) => successful.push(decision),
+            Err(error) => failed.push(restart_failed_agent(&decision, "native_resume", error)),
+        }
+    }
+}
+
 fn restart_readiness_deadline(requested_ms: Option<u64>) -> std::time::Duration {
     requested_ms
         .map(std::time::Duration::from_millis)
         .unwrap_or_else(|| env_duration_ms(&["TEAM_AGENT_RESTART_READINESS_DEADLINE_MS"], 30_000))
 }
 
+#[cfg(all(test, unix))]
+mod mixed_native_restart_tests {
+    use super::*;
+    use crate::contract_runtime::commands::NativeRestartResult;
+
+    #[test]
+    fn failed_legacy_cohort_does_not_skip_native_resume_or_hide_its_result() {
+        for legacy_failed in [false, true] {
+            for native_failed in [false, true] {
+                let mut successful = Vec::new();
+                let legacy = RestartedAgent { agent_id: AgentId::new("legacy"),
+                    restart_mode: StartMode::Fresh, decision: ResumeDecision::FreshStart, session_id: None };
+                let mut failed = if legacy_failed { vec![restart_failed_agent(&legacy, "spawn", "failed".into())] } else { vec![] };
+                let mut attempts = 0;
+                append_native_restart_results(&mut successful, &mut failed, || {
+                    attempts += 1;
+                    vec![NativeRestartResult { agent_id: "native".into(), session_id: Some("same-session".into()),
+                        outcome: if native_failed { Err("native failed".into()) } else { Ok(()) } }]
+                });
+                assert_eq!(attempts, 1, "no legacy survivor must not short-circuit native execution");
+                assert_eq!(successful.len(), usize::from(!native_failed));
+                assert_eq!(failed.len(), usize::from(legacy_failed) + usize::from(native_failed));
+                if !native_failed {
+                    assert_eq!(successful[0].agent_id.as_str(), "native");
+                    assert_eq!(successful[0].session_id.as_ref().unwrap().as_str(), "same-session");
+                } else {
+                    assert_eq!(failed.last().unwrap().phase, "native_resume");
+                }
+            }
+        }
+    }
+}
+
 fn restart_readiness_poll_interval() -> std::time::Duration {
     env_duration_ms(&["TEAM_AGENT_RESTART_READINESS_POLL_MS"], 200)
 }

package/crates/team-agent/src/lifecycle/restart/selection.rs

@@ -45,7 +45,7 @@ mod contract_route_tests {
     fn mixed_team_retains_legacy_classification_without_native_codex_fallback() {
         let state = serde_json::json!({"agents": {
             "native": {"provider":"cursor","status":"running","session_id":"native-id"},
-            "legacy": {"provider":"pi","status":"stopped"},
+            "legacy": {"provider":"pi","status":"running"},
         }});
         let plan = classify_restart_plan(&state, false).unwrap();
         assert_eq!(plan.decisions.len(), 1);
@@ -54,6 +54,31 @@ mod contract_route_tests {
     }
 }
 
+#[cfg(test)]
+mod stopped_restart_tests {
+    use super::*;
+
+    #[test]
+    fn stopped_rows_never_enter_validation_or_fresh_spawn_even_with_allow_fresh() {
+        let state = serde_json::json!({"agents": {
+            "stopped": {"provider":"pi","status":"stopped","explicit_stop":true,
+                "session_id":"preserved","generation":7,"first_send_at":false},
+            "legacy_stopped": {"provider":"pi","status":"stopped"},
+            "marker": {"provider":"pi","status":"running","explicit_stop":true},
+            "active": {"provider":"pi","status":"running"}
+        }});
+        let before = state.clone();
+        for allow_fresh in [false, true] {
+            let plan = classify_restart_plan(&state, allow_fresh).unwrap();
+            assert_eq!(plan.decisions.len(), 1);
+            assert_eq!(plan.decisions[0].agent_id.as_str(), "active");
+            assert!(plan.corrupt_entries.is_empty());
+            assert!(plan.unresumable.is_empty());
+            assert_eq!(state, before);
+        }
+    }
+}
+
 /// ---
 /// purpose: 定出该席位这次的启动模式
 /// params:
@@ -266,13 +291,13 @@ pub(crate) fn python_type_name(value: &serde_json::Value) -> &'static str {
 /// purpose: 纯计算出整队的 restart 计划
 /// params:
 ///   allow_fresh: 允许无会话席位改跑全新会话
-/// returns: 每个非 paused 席位的 resume 决策、损坏的 first_send_at 条目与不可 resume 名单
+/// returns: 每个非 paused/非 stopped 席位的 resume 决策、损坏的 first_send_at 条目与不可 resume 名单
 /// errors: 计算过程中的错误以 LifecycleError 返回
 /// contract_id: lifecycle.selection.classify_restart_plan
 /// ---
 /// Route B 全量验证(纯计算,**无破坏性副作用**;`_emit_resume_decisions` +
 /// `_collect_corrupt_first_send_at`,`orchestration.py:430/467`)。读 fixture state 的
-/// `agents.<id>`,对每非 paused worker:
+/// `agents.<id>`,对每非 paused/非 stopped worker（explicit_stop 也跳过）:
 /// (1) corrupt first_send_at → 收进 `corrupt_entries`(carry python type-name);
 /// (2) 算 resume 决策(`session_id→Resume` / `null session && allow_fresh→FreshStart` /
 ///     否则 `Refuse`;E6 层2:null session 不再因 first_send_at=null 静默 fresh);
@@ -317,11 +342,8 @@ pub(crate) fn classify_restart_plan_with_resume_validation(
         // not this legacy enum's unknown-provider Codex default.
         #[cfg(unix)]
         if crate::contract_runtime::framework::is_contract(agent) { continue; }
-        if agent
-            .get("status")
-            .and_then(|v| v.as_str())
-            .map(|s| s == "paused")
-            .unwrap_or(false)
+        if crate::state::projection::agent_stopped_for_restart(agent)
+            || agent.get("status").and_then(|v| v.as_str()) == Some("paused")
         {
             continue;
         }

package/crates/team-agent/src/messaging/delivery.rs

@@ -683,26 +683,33 @@ fn deliver_prepared_message(
         resolved.metadata.as_ref(),
     );
     let recipient_cursor = recipient_is_cursor_agent(state, &message.recipient);
-    let inject_attempt = crate::tmux_backend::with_paste_to_submit_floor(
-        paste_to_submit_floor_for_recipient(state, &message.recipient),
-        || {
-            crate::tmux_backend::with_cursor_single_enter(recipient_cursor, || {
-                transport.inject_with_submit_observer(
-                    &target,
-                    &payload,
-                    Key::Enter,
-                    true,
-                    Some(&submit_observer),
-                )
-            })
-        },
-    );
+    let native_request = recipient_provider(state, &message.recipient)
+        .filter(|provider| matches!(provider, Provider::Pi | Provider::CursorAgent))
+        .filter(|_| message.recipient != "leader" && transport.supports_owned_native_input())
+        .map(|provider| crate::transport::native_input::NativeInputRequest {
+            message_id: message_id.to_string(),
+            owner_team_id: canonical_owner_team_id.clone().unwrap_or_default(),
+            recipient: message.recipient.clone(), provider,
+            pane_id: resolved.metadata.as_ref().map(|meta| meta.target_pane_id.clone()).unwrap_or_default(),
+            pane_pid: resolved.metadata.as_ref().and_then(|meta| meta.target_pane_pid).unwrap_or_default(),
+            session: resolved.metadata.as_ref().map(|meta| meta.target_session.clone()).unwrap_or_default(),
+            window: resolved.metadata.as_ref().map(|meta| meta.target_window.clone()).unwrap_or_default(),
+        });
+    let guarded_native = native_request.is_some();
+    let (inject_attempt, native_evidence) = crate::transport::native_input::with_native_input(native_request, || {
+        crate::tmux_backend::with_paste_to_submit_floor(
+            paste_to_submit_floor_for_recipient(state, &message.recipient),
+            || crate::tmux_backend::with_cursor_single_enter(recipient_cursor, || {
+                transport.inject_with_submit_observer(&target, &payload, Key::Enter, true, Some(&submit_observer))
+            }),
+        )
+    });
     let inject_report = match inject_attempt {
         Ok(report) => {
             // grok 忙时第一次回车只入显式队列。默认 send-now：只重按回车顶出去。
             // 无 `Enter:send now` 时零次额外按键，claude/codex 行为不变。
             // cursor：第二下 Enter 打断进行中回合，不走 flush。
-            if !crate::provider::submit_now::keep_provider_queue_requested() && !recipient_cursor {
+            if !guarded_native && !crate::provider::submit_now::keep_provider_queue_requested() && !recipient_cursor {
                 match crate::provider::submit_now::flush_explicit_queue(transport, &target) {
                     Ok(flush) if flush.extra_enters > 0 => {
                         let _ = event_log.write(
@@ -732,6 +739,28 @@ fn deliver_prepared_message(
         }
         Err(error) => {
             let reason = format!("inject_failed:{error}");
+            if guarded_native {
+                let pasted = native_evidence.as_ref().filter(|evidence|
+                    evidence.phase >= crate::transport::native_input::NativeInputPhase::MayHavePasted);
+                let status = if let Some(evidence) = pasted {
+                    super::enter_rescue::park(store, evidence, attempt, &reason, event_log)?;
+                    "submitted_unverified"
+                } else {
+                    super::enter_rescue::release_no_effect(store, message_id, attempt)?;
+                    "target_resolved"
+                };
+                event_log.write("native_input.deferred", serde_json::json!({
+                    "message_id": message_id, "reason": reason, "status": status,
+                    "may_have_pasted": pasted.is_some(),
+                }))?;
+                return Ok(DeliveryOutcome {
+                    ok: false, status: DeliveryStatus::Queued,
+                    message_status: MessageStatusShadow(status.to_string()),
+                    message_id: Some(message_id.to_string()), verification: Some(reason),
+                    stage: Some(DeliveryStage::Inject), reason: None, channel: None,
+                    ack_forced_off: false, turn_verification: None,
+                });
+            }
             if message.recipient == "leader" {
                 store.mark(message_id, "failed", Some("leader_not_attached"))?;
                 event_log.write(
@@ -897,7 +926,11 @@ fn deliver_prepared_message(
                 turn_verification: Some(turn_verification),
             });
         }
-        store.mark(message_id, "submitted_unverified", Some(&reason))?;
+        if let Some(evidence) = native_evidence.as_ref() {
+            super::enter_rescue::park(store, evidence, attempt, &reason, event_log)?;
+        } else {
+            store.mark(message_id, "submitted_unverified", Some(&reason))?;
+        }
         return Ok(DeliveryOutcome {
             ok: false,
             status: DeliveryStatus::Failed,
@@ -2800,6 +2833,40 @@ pub(crate) fn record_turn_open_if_leader_to_worker(
     )
 }
 
+/// A rescue that supplies the first successful Enter must arm the same turn
+/// linkage as normal delivery, immediately after the key (not after UI polling).
+pub(super) fn with_rescue_submit_observer<R>(
+    workspace: &Path,
+    store: &MessageStore,
+    evidence: &crate::transport::native_input::NativeInputEvidence,
+    event_log: &EventLog,
+    execute: impl FnOnce(&dyn SubmitObserver) -> Result<R, MessagingError>,
+) -> Result<R, MessagingError> {
+    let request = &evidence.request;
+    let conn = crate::db::schema::open_db(store.db_path())?;
+    let sender: String = conn.query_row(
+        "select sender from messages where message_id=?1 and owner_team_id=?2 and recipient=?3 and status='submitted_unverified'",
+        params![request.message_id, request.owner_team_id, request.recipient],
+        |row| row.get(0),
+    )?;
+    let metadata = TargetMetadata {
+        tmux_endpoint: Some(evidence.binding.endpoint.clone()),
+        target_session: evidence.binding.session.clone(),
+        target_window: evidence.binding.window.clone(),
+        target_pane_id: evidence.binding.pane_id.clone(),
+        target_pane_pid: Some(evidence.binding.pane_pid),
+        resolved_from: "enter_rescue_owned_binding",
+    };
+    let mut observer = CurrentTurnSubmitObserver::new(
+        workspace, &sender, &request.recipient, &request.message_id, event_log,
+        Some(&request.owner_team_id), Some(&metadata),
+    );
+    observer.rescue_evidence = Some(evidence);
+    let result = execute(&observer)?;
+    if let Some(error) = observer.take_error() { return Err(error); }
+    Ok(result)
+}
+
 struct CurrentTurnSubmitObserver<'a> {
     workspace: &'a Path,
     sender: &'a str,
@@ -2808,6 +2875,7 @@ struct CurrentTurnSubmitObserver<'a> {
     event_log: &'a EventLog,
     owner_team_id: Option<&'a str>,
     metadata: Option<&'a TargetMetadata>,
+    rescue_evidence: Option<&'a crate::transport::native_input::NativeInputEvidence>,
     fired: Cell<bool>,
     error: RefCell<Option<MessagingError>>,
 }
@@ -2830,6 +2898,7 @@ impl<'a> CurrentTurnSubmitObserver<'a> {
             event_log,
             owner_team_id,
             metadata,
+            rescue_evidence: None,
             fired: Cell::new(false),
             error: RefCell::new(None),
         }
@@ -2845,20 +2914,56 @@ impl SubmitObserver for CurrentTurnSubmitObserver<'_> {
         if self.fired.replace(true) {
             return;
         }
-        if let Err(error) = record_current_turn_after_inject_if_leader_to_worker_scoped(
-            self.workspace,
-            self.sender,
-            self.recipient,
-            self.message_id,
-            self.event_log,
-            self.owner_team_id,
-            self.metadata,
-        ) {
-            *self.error.borrow_mut() = Some(error);
-        }
+        let result = if let Some(evidence) = self.rescue_evidence {
+            record_rescue_turn_after_submit(self.workspace, self.sender, evidence, self.event_log, self.metadata)
+        } else {
+            record_current_turn_after_inject_if_leader_to_worker_scoped(
+                self.workspace, self.sender, self.recipient, self.message_id,
+                self.event_log, self.owner_team_id, self.metadata,
+            )
+        };
+        if let Err(error) = result { *self.error.borrow_mut() = Some(error); }
     }
 }
 
+fn record_rescue_turn_after_submit(
+    workspace: &Path,
+    sender: &str,
+    evidence: &crate::transport::native_input::NativeInputEvidence,
+    event_log: &EventLog,
+    metadata: Option<&TargetMetadata>,
+) -> Result<(), MessagingError> {
+    let request = &evidence.request;
+    if !matches!(sender, "leader" | "Leader") { return Ok(()); }
+    crate::state::repository::StateRepository::new(workspace).commit_messaging_checked(
+        crate::state::repository::StateWriteIntent::MessagingDeliveryState {
+            owner_team_id: Some(&request.owner_team_id),
+        },
+        |selected| {
+            let agent = selected.get("agents").and_then(|agents| agents.get(&request.recipient));
+            let matches = agent.is_some_and(|agent| {
+                agent.get("status").and_then(serde_json::Value::as_str) == Some("running")
+                    && agent.get("explicit_stop").and_then(serde_json::Value::as_bool) != Some(true)
+                    && agent.get("pane_id").and_then(serde_json::Value::as_str) == Some(request.pane_id.as_str())
+                    && agent.get("pane_pid").and_then(serde_json::Value::as_u64) == Some(u64::from(request.pane_pid))
+                    && request.pane_pid == evidence.binding.pane_pid
+                    && agent.get("window").and_then(serde_json::Value::as_str).unwrap_or(&request.recipient) == request.window
+                    && agent.get("provider").cloned().and_then(|value| serde_json::from_value::<Provider>(value).ok()) == Some(request.provider)
+                    && selected.get("session_name").and_then(serde_json::Value::as_str) == Some(request.session.as_str())
+            });
+            if !matches {
+                return Err(crate::state::StateError::SaveConflict("rescue receiver changed before turn commit".into()));
+            }
+            arm_turn_open(selected, &request.recipient, &Some(request.message_id.clone()));
+            Ok(())
+        },
+    )?;
+    let mut event = serde_json::json!({"agent_id": request.recipient, "message_id": request.message_id});
+    if let Some(metadata) = metadata { append_target_metadata(&mut event, metadata); }
+    event_log.write("turn_open.armed_after_inject", event)?;
+    Ok(())
+}
+
 fn record_current_turn_after_inject_if_leader_to_worker_scoped(
     workspace: &Path,
     sender: &str,