@team-agent/installer 0.5.116 → 0.5.118

package/Cargo.lock

@@ -727,7 +727,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.116"
+version = "0.5.118"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -11,7 +11,7 @@ exclude = ["crates/team-agent-contract"]
 
 [workspace.package]
 edition = "2021"
-version = "0.5.116"
+version = "0.5.118"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/mod.rs

@@ -424,6 +424,26 @@ pub mod lifecycle_port {
         });
         if let Some(object) = value.as_object_mut() {
             object.extend(facts);
+            // Only a plain Pi entry can be retried verbatim with this command.
+            // Never drop explicit attach/external intent or provider arguments,
+            // clear the caller's environment, or adopt the unverified pane.
+            if cfg!(unix)
+                && provider == Provider::Pi
+                && attach == &LeaderLauncherArgs::default()
+            {
+                let command = "env -u TMUX -u TMUX_PANE team-agent pi";
+                object.insert("recovery_command".to_string(), json!(command));
+                object.insert(
+                    ACTION_FIELD.to_string(),
+                    json!(format!(
+                        "The inherited TMUX/TMUX_PANE could not be authorized for \
+                         requested_workspace; this is not an empty-directory error. \
+                         To explicitly retry from requested_workspace, run `{command}`. \
+                         This removes the inherited variables only for the new process \
+                         and does not detach or modify your current tmux pane. {action}"
+                    )),
+                );
+            }
         }
         value
     }

package/crates/team-agent/src/leader/lease.rs

@@ -4,8 +4,6 @@
 
 use std::collections::BTreeSet;
 use std::path::{Path, PathBuf};
-use std::sync::atomic::{AtomicU64, Ordering};
-use std::time::{SystemTime, UNIX_EPOCH};
 
 use serde_json::{json, Value};
 use sha2::{Digest, Sha256};
@@ -1837,22 +1835,7 @@ fn canonical_workspace(workspace: &Path) -> PathBuf {
 }
 
 fn next_pane_binding_nonce(workspace: &Path, endpoint: &str, pane: &PaneId) -> String {
-    static COUNTER: AtomicU64 = AtomicU64::new(0);
-    let nanos = SystemTime::now()
-        .duration_since(UNIX_EPOCH)
-        .map_or(0, |duration| duration.as_nanos());
-    let counter = COUNTER.fetch_add(1, Ordering::Relaxed);
-    let material = format!(
-        "{}\0{endpoint}\0{}\0{}\0{nanos}\0{counter}",
-        canonical_workspace(workspace).display(),
-        pane.as_str(),
-        std::process::id(),
-    );
-    let digest = Sha256::digest(material.as_bytes());
-    digest[..16]
-        .iter()
-        .map(|byte| format!("{byte:02x}"))
-        .collect()
+    crate::tmux_backend::next_pane_binding_nonce(workspace, endpoint, pane)
 }
 
 fn pane_binding_nonce_for_claim(

package/crates/team-agent/src/leader/start.rs

@@ -48,9 +48,6 @@ enum ManagedClientAttachMode {
     SwitchClient,
 }
 
-const DIFFERENT_TMUX_SERVER_PREFIX: &str =
-    "managed launcher refuses a different ambient tmux server";
-
 impl PreparedLeaderStart {
     pub(crate) fn plan(&self) -> &LeaderStartPlan {
         &self.plan
@@ -141,8 +138,6 @@ pub(crate) fn prepare_leader_start_with_nested_attach(
     let (ambient_authority, managed_client_attach_mode, managed_exec_provider) =
         if explicit_external_path || state_external_path {
             (ambient_pane_authority_preflight(workspace)?, None, false)
-        } else if workspace_state_is_managed_provider_reentry(workspace) {
-            (ambient_pane_authority_preflight(workspace)?, None, true)
         } else {
             managed_launcher_ambient_route(
                 provider,
@@ -159,7 +154,7 @@ pub(crate) fn prepare_leader_start_with_nested_attach(
         confirm_attach,
         attach_session,
         external_leader,
-        std::env::var_os("TMUX").is_some(),
+        ambient_authority.is_some(),
         managed_client_attach_mode,
         managed_exec_provider,
         allow_nested_attach,
@@ -613,64 +608,49 @@ fn managed_launcher_ambient_route(
     ),
     PrepareLeaderStartError,
 > {
-    let Some(tmux) = std::env::var_os("TMUX") else {
-        return Ok((
-            None,
-            Some(ManagedClientAttachMode::AttachSession),
-            false,
-        ));
+    let isolated = || (None, Some(ManagedClientAttachMode::AttachSession), false);
+    let authority = match ambient_pane_authority_preflight(workspace) {
+        Ok(Some(authority)) => authority,
+        Ok(None) => return Ok(isolated()),
+        Err(PrepareLeaderStartError::PaneAuthorityRefused(_)) if !allow_nested_attach => {
+            // An inherited tuple cannot authorize adoption, but an ordinary
+            // managed launch can still create its own workspace pane. Keep
+            // explicit external/attach and nested-attach intent fail-closed.
+            return Ok(isolated());
+        }
+        Err(error) => return Err(error),
     };
-    let tmux = tmux.into_string().map_err(|_| {
-        PrepareLeaderStartError::PaneAuthorityRefused(ambient_tmux_endpoint_refusal(
-            workspace,
-            pane_refusal::AmbientTmuxEndpointUnavailableCause::TmuxValueNotUnicode,
-        ))
-    })?;
-    let observed_endpoint = validated_ambient_tmux_endpoint(workspace, &tmux)
-        .map_err(PrepareLeaderStartError::PaneAuthorityRefused)?;
-    if provider == Provider::Pi && provider_args.is_empty() && !allow_nested_attach {
-        // Pi's zero-argument managed entry already owns this verified pane as its
-        // user-facing terminal. Replacing the current process is safe on either
-        // the workspace server or another server; switching/attaching would move
-        // the user away from the positively verified workspace pane.
-        let authority = verified_ambient_pane_authority(workspace, &tmux)
-            .map_err(PrepareLeaderStartError::PaneAuthorityRefused)?;
+    if workspace_state_is_managed_provider_reentry(workspace)
+        || (provider == Provider::Pi && provider_args.is_empty() && !allow_nested_attach)
+    {
+        // Only verified current-pane authority permits replacing the caller.
         return Ok((Some(authority), None, true));
     }
-    let target_socket_name = TmuxBackend::for_workspace(workspace)
-        .tmux_endpoint()
-        .ok_or_else(|| LeaderError::Start("workspace tmux endpoint missing".to_string()))?;
     let target_endpoint = crate::tmux_backend::socket_path_for_workspace(workspace);
     let same_server = target_endpoint.as_ref().is_some_and(|target| {
-        let observed = Path::new(&observed_endpoint)
+        let observed = Path::new(&authority.endpoint)
             .canonicalize()
-            .unwrap_or_else(|_| PathBuf::from(&observed_endpoint));
+            .unwrap_or_else(|_| PathBuf::from(&authority.endpoint));
         let target = target.canonicalize().unwrap_or_else(|_| target.clone());
         observed == target
     });
     if same_server {
-        let authority = verified_ambient_pane_authority(workspace, &tmux)
-            .map_err(PrepareLeaderStartError::PaneAuthorityRefused)?;
         return Ok((
             Some(authority),
             Some(ManagedClientAttachMode::SwitchClient),
             false,
         ));
     }
-    if !allow_nested_attach {
-        return Err(LeaderError::Validation(format!(
-            "{DIFFERENT_TMUX_SERVER_PREFIX}: observed_endpoint={observed_endpoint}; \
-             requested_workspace_socket={target_socket_name}"
-        ))
-        .into());
+    if allow_nested_attach {
+        return Ok((
+            Some(authority),
+            Some(ManagedClientAttachMode::AttachSession),
+            false,
+        ));
     }
-    let authority = verified_ambient_pane_authority(workspace, &tmux)
-        .map_err(PrepareLeaderStartError::PaneAuthorityRefused)?;
-    Ok((
-        Some(authority),
-        Some(ManagedClientAttachMode::AttachSession),
-        false,
-    ))
+    // Do not switch/adopt the unrelated server. The existing managed attach
+    // child clears TMUX/TMUX_PANE without changing the caller's environment.
+    Ok(isolated())
 }
 
 fn validated_ambient_tmux_endpoint(

package/crates/team-agent/src/lifecycle/pane_input_lock.rs

@@ -36,6 +36,7 @@ pub(crate) struct PaneInputLockRequest<'a> {
 
 pub(crate) struct PaneInputLockGuard {
     file: Option<std::fs::File>,
+    guard_gate: Option<std::fs::File>,
 }
 
 /// ---
@@ -54,18 +55,58 @@ pub(crate) fn acquire_or_proceed(request: PaneInputLockRequest<'_>) -> Option<Pa
         // No workspace (some unit backends): nothing to lock against. Not an alarm.
         return None;
     };
-    acquire_file_lock(workspace, &request, timeout)
+    acquire_file_lock(workspace, &request, timeout, "proceed")
+}
+
+/// Every legacy writer holds shared admission through its whole operation,
+/// even when its ordinary 200ms lock times out. Required guards hold exclusive
+/// admission, so neither can enter while the other is already writing.
+pub(crate) fn acquire_for_write(request: PaneInputLockRequest<'_>) -> Result<Option<PaneInputLockGuard>, ()> {
+    if request.workspace.is_none() { return Ok(None); }
+    let gate = acquire_guard_gate(&request, false)?;
+    let mut guard = acquire_or_proceed(request).unwrap_or(PaneInputLockGuard { file: None, guard_gate: None });
+    guard.guard_gate = Some(gate);
+    Ok(Some(guard))
+}
+
+fn acquire_guard_gate(request: &PaneInputLockRequest<'_>, exclusive: bool) -> Result<std::fs::File, ()> {
+    let opened = (|| -> std::io::Result<std::fs::File> {
+        let workspace = request.workspace.ok_or_else(|| std::io::Error::other("workspace missing"))?;
+        let path = pane_input_lock_path(workspace, request.target_key).with_extension("guard");
+        if let Some(parent) = path.parent() { std::fs::create_dir_all(parent)?; }
+        let file = std::fs::OpenOptions::new().create(true).read(true).write(true).truncate(false).open(path)?;
+        let result = if exclusive { file.try_lock() } else { file.try_lock_shared() };
+        result.map_err(|error| match error {
+            std::fs::TryLockError::WouldBlock => std::io::Error::from(std::io::ErrorKind::WouldBlock),
+            std::fs::TryLockError::Error(error) => error,
+        })?;
+        Ok(file)
+    })();
+    opened.map_err(|_| emit_timeout_alarm(request, PANE_INPUT_LOCK_TIMEOUT, Duration::ZERO, "guard_gate", "refuse"))
+}
+
+/// Guarded native input must never treat a missing/contended lock as permission.
+pub(crate) fn acquire_required(request: PaneInputLockRequest<'_>) -> Option<PaneInputLockGuard> {
+    let Some(workspace) = request.workspace else {
+        emit_timeout_alarm(&request, PANE_INPUT_LOCK_TIMEOUT, Duration::ZERO, "workspace_missing", "refuse");
+        return None;
+    };
+    let gate = acquire_guard_gate(&request, true).ok()?;
+    let mut guard = acquire_file_lock(workspace, &request, PANE_INPUT_LOCK_TIMEOUT, "refuse")?;
+    guard.guard_gate = Some(gate);
+    Some(guard)
 }
 
 fn acquire_file_lock(
     workspace: &Path,
     request: &PaneInputLockRequest<'_>,
     timeout: Duration,
+    disposition: &str,
 ) -> Option<PaneInputLockGuard> {
     let path = pane_input_lock_path(workspace, request.target_key);
     if let Some(parent) = path.parent() {
         if std::fs::create_dir_all(parent).is_err() {
-            emit_timeout_alarm(request, timeout, Duration::ZERO, "lock_dir");
+            emit_timeout_alarm(request, timeout, Duration::ZERO, "lock_dir", disposition);
             return None;
         }
     }
@@ -78,7 +119,7 @@ fn acquire_file_lock(
     {
         Ok(file) => file,
         Err(_) => {
-            emit_timeout_alarm(request, timeout, Duration::ZERO, "lock_open");
+            emit_timeout_alarm(request, timeout, Duration::ZERO, "lock_open", disposition);
             return None;
         }
     };
@@ -86,17 +127,17 @@ fn acquire_file_lock(
     loop {
         match crate::platform::file_lock::try_lock_once_nonblocking(&file) {
             Ok(true) => {
-                return Some(PaneInputLockGuard { file: Some(file) });
+                return Some(PaneInputLockGuard { file: Some(file), guard_gate: None });
             }
             Ok(false) => {}
             Err(_) => {
-                emit_timeout_alarm(request, timeout, started.elapsed(), "lock_io");
+                emit_timeout_alarm(request, timeout, started.elapsed(), "lock_io", disposition);
                 return None;
             }
         }
         let elapsed = started.elapsed();
         if elapsed >= timeout {
-            emit_timeout_alarm(request, timeout, elapsed, "timeout");
+            emit_timeout_alarm(request, timeout, elapsed, "timeout", disposition);
             return None;
         }
         std::thread::sleep(std::cmp::min(
@@ -127,10 +168,11 @@ fn emit_timeout_alarm(
     timeout: Duration,
     waited: Duration,
     reason: &str,
+    disposition: &str,
 ) {
     // A5 watches this exact token on stderr. Commenting this line must turn A5 red.
     eprintln!(
-        "{PANE_INPUT_LOCK_TIMEOUT_EVENT} target={} operation={} waited_ms={} timeout_ms={} reason={reason} proceeding",
+        "{PANE_INPUT_LOCK_TIMEOUT_EVENT} target={} operation={} waited_ms={} timeout_ms={} reason={reason} disposition={disposition}",
         request.target_key,
         request.operation,
         waited.as_millis(),
@@ -146,7 +188,7 @@ fn emit_timeout_alarm(
                 "waited_ms": waited.as_millis() as u64,
                 "timeout_ms": timeout.as_millis() as u64,
                 "reason": reason,
-                "disposition": "proceed",
+                "disposition": disposition,
             }),
         );
     }
@@ -157,5 +199,41 @@ impl Drop for PaneInputLockGuard {
         if let Some(file) = self.file.take() {
             let _ = crate::platform::file_lock::unlock(&file);
         }
+        if let Some(gate) = self.guard_gate.take() { let _ = gate.unlock(); }
+    }
+}
+
+#[cfg(test)]
+mod required_tests {
+    #![allow(clippy::unwrap_used)]
+    use super::*;
+
+    #[test]
+    fn required_pane_input_lock_missing_workspace_refuses() {
+        assert!(acquire_required(PaneInputLockRequest { workspace: None, target_key: "%1", operation: "fixture" }).is_none());
+    }
+
+    #[test]
+    fn required_pane_input_lock_contention_refuses_and_drop_releases_same_key() {
+        let workspace = std::env::temp_dir().join(format!("ta-required-pane-lock-{}", std::process::id()));
+        std::fs::create_dir(&workspace).unwrap();
+        let request = || PaneInputLockRequest { workspace: Some(workspace.as_path()), target_key: "%1", operation: "fixture" };
+        let held = acquire_required(request()).unwrap();
+        assert!(acquire_required(request()).is_none());
+        let events = std::fs::read_to_string(workspace.join(".team/logs/events.jsonl")).unwrap();
+        assert!(events.lines().filter_map(|line| serde_json::from_str::<serde_json::Value>(line).ok())
+            .any(|row| row.to_string().contains("\"disposition\":\"refuse\"")));
+        drop(held);
+        drop(acquire_required(request()).unwrap());
+        // Preserve the old timeout/proceed policy, but hold reader admission
+        // through that unheld-main-lock writer so no required guard crosses it.
+        let first_writer = acquire_for_write(request()).unwrap().unwrap();
+        let timed_out_writer = acquire_for_write(request()).unwrap().unwrap();
+        assert!(timed_out_writer.file.is_none());
+        drop(first_writer);
+        assert!(acquire_required(request()).is_none());
+        drop(timed_out_writer);
+        drop(acquire_required(request()).unwrap());
+        std::fs::remove_dir_all(workspace).unwrap();
     }
 }

package/crates/team-agent/src/lifecycle/tests/pi_session_delivery_red.rs

@@ -4,7 +4,7 @@ use std::time::Duration;
 
 use crate::lifecycle::launch::pi_mcp::pi_seat_paths;
 use crate::messaging::delivery::{
-    paste_to_submit_floor_for_recipient, recipient_allows_explicit_queue_flush, recipient_is_busy,
+    paste_to_submit_floor_for_recipient, recipient_allows_explicit_queue_flush,
     recipient_requires_single_enter,
 };
 use crate::model::enums::{Provider, ProviderEffort};
@@ -186,17 +186,12 @@ fn pi_delivery_submits_one_enter_and_never_flushes_or_retries() {
         paste_to_submit_floor_for_recipient(&idle, "worker-a"),
         Duration::ZERO
     );
-    assert!(!recipient_is_busy(&idle, "worker-a"));
-
     let busy = serde_json::json!({
         "agents": {
             "worker-a": {"provider": "pi", "status": "busy"}
         }
     });
-    assert!(
-        recipient_is_busy(&busy, "worker-a"),
-        "known busy must take the existing send.deferred_busy path before paste"
-    );
+    // Working native CLIs queue the same single-Enter input; no idle admission.
     assert!(recipient_requires_single_enter(&busy, "worker-a"));
     assert!(!recipient_allows_explicit_queue_flush(&busy, "worker-a"));
 }

package/crates/team-agent/src/messaging/delivery.rs

@@ -299,34 +299,6 @@ fn prepare_message_state(
             }
         }
     }
-    if batch
-        && recipient_is_busy(
-            prepared.scoped.as_ref().unwrap_or(state),
-            &message.recipient,
-        )
-    {
-        event_log.write(
-            "send.deferred_busy",
-            serde_json::json!({
-                "message_id": message_id,
-                "sender": message.sender,
-                "recipient": message.recipient,
-                "reason": "recipient_busy",
-            }),
-        )?;
-        return Ok(Err(DeliveryOutcome {
-            ok: false,
-            status: DeliveryStatus::Queued,
-            message_status: MessageStatusShadow(message.status.clone()),
-            message_id: Some(message_id.to_string()),
-            verification: None,
-            stage: None,
-            reason: None,
-            channel: None,
-            ack_forced_off: false,
-            turn_verification: None,
-        }));
-    }
     Ok(Ok(prepared))
 }
 
@@ -682,19 +654,23 @@ fn deliver_prepared_message(
         canonical_owner_team_id.as_deref(),
         resolved.metadata.as_ref(),
     );
-    let recipient_cursor = recipient_is_cursor_agent(state, &message.recipient);
+    // v0.5.113 delivery: address/owner and pane serialization are authoritative;
+    // composer appearance is not admission. Native CLIs buffer/queue input.
     let inject_attempt = crate::tmux_backend::with_paste_to_submit_floor(
         paste_to_submit_floor_for_recipient(state, &message.recipient),
         || {
-            crate::tmux_backend::with_cursor_single_enter(recipient_cursor, || {
-                transport.inject_with_submit_observer(
-                    &target,
-                    &payload,
-                    Key::Enter,
-                    true,
-                    Some(&submit_observer),
-                )
-            })
+            crate::tmux_backend::with_cursor_single_enter(
+                recipient_requires_single_enter(state, &message.recipient),
+                || {
+                    transport.inject_with_submit_observer(
+                        &target,
+                        &payload,
+                        Key::Enter,
+                        true,
+                        Some(&submit_observer),
+                    )
+                },
+            )
         },
     );
     let inject_report = match inject_attempt {
@@ -702,7 +678,9 @@ fn deliver_prepared_message(
             // grok 忙时第一次回车只入显式队列。默认 send-now：只重按回车顶出去。
             // 无 `Enter:send now` 时零次额外按键，claude/codex 行为不变。
             // cursor：第二下 Enter 打断进行中回合，不走 flush。
-            if !crate::provider::submit_now::keep_provider_queue_requested() && !recipient_cursor {
+            if !crate::provider::submit_now::keep_provider_queue_requested()
+                && recipient_allows_explicit_queue_flush(state, &message.recipient)
+            {
                 match crate::provider::submit_now::flush_explicit_queue(transport, &target) {
                     Ok(flush) if flush.extra_enters > 0 => {
                         let _ = event_log.write(
@@ -2272,8 +2250,8 @@ fn only_team_entry(state: &serde_json::Value) -> Option<&serde_json::Value> {
     }
 }
 
-/// `_deliver_pending_messages` (`delivery.py:484`):扫 pending 队列逐条投递;busy 收件人写
-/// `send.deferred_busy` 跳过 (**不丢**,card §131)。返回投递的 message_id 列表。
+/// Deliver pending rows without activity/composer admission; native CLIs queue input.
+/// Returns the message IDs whose post-submit evidence verified delivery.
 pub fn deliver_pending_messages(
     workspace: &Path,
     state: &serde_json::Value,
@@ -2467,13 +2445,6 @@ fn recipient_provider(state: &serde_json::Value, recipient: &str) -> Option<Prov
         .and_then(parse_canonical_provider)
 }
 
-fn recipient_is_cursor_agent(state: &serde_json::Value, recipient: &str) -> bool {
-    matches!(
-        recipient_provider(state, recipient),
-        Some(Provider::CursorAgent)
-    )
-}
-
 /// ---
 /// purpose: paste→Enter 地板按收件人 provider 选择
 /// contract: CursorAgent 与 Grok 为 1s；其余（含 claude）为 ZERO
@@ -2516,16 +2487,6 @@ pub(crate) fn recipient_allows_explicit_queue_flush(
     )
 }
 
-pub(crate) fn recipient_is_busy(state: &serde_json::Value, recipient: &str) -> bool {
-    state
-        .get("agents")
-        .and_then(serde_json::Value::as_object)
-        .and_then(|agents| agents.get(recipient))
-        .and_then(|agent| agent.get("status"))
-        .and_then(serde_json::Value::as_str)
-        == Some("busy")
-}
-
 fn leader_rollout_path(state: &serde_json::Value) -> Option<std::path::PathBuf> {
     if let Some(receiver) = leader_receiver_value(state).filter(|receiver| {
         receiver.get("provider").and_then(serde_json::Value::as_str) == Some("pi")
@@ -2800,6 +2761,40 @@ pub(crate) fn record_turn_open_if_leader_to_worker(
     )
 }
 
+/// A rescue that supplies the first successful Enter must arm the same turn
+/// linkage as normal delivery, immediately after the key (not after UI polling).
+pub(super) fn with_rescue_submit_observer<R>(
+    workspace: &Path,
+    store: &MessageStore,
+    evidence: &crate::transport::native_input::NativeInputEvidence,
+    event_log: &EventLog,
+    execute: impl FnOnce(&dyn SubmitObserver) -> Result<R, MessagingError>,
+) -> Result<R, MessagingError> {
+    let request = &evidence.request;
+    let conn = crate::db::schema::open_db(store.db_path())?;
+    let sender: String = conn.query_row(
+        "select sender from messages where message_id=?1 and owner_team_id=?2 and recipient=?3 and status='submitted_unverified'",
+        params![request.message_id, request.owner_team_id, request.recipient],
+        |row| row.get(0),
+    )?;
+    let metadata = TargetMetadata {
+        tmux_endpoint: Some(evidence.binding.endpoint.clone()),
+        target_session: evidence.binding.session.clone(),
+        target_window: evidence.binding.window.clone(),
+        target_pane_id: evidence.binding.pane_id.clone(),
+        target_pane_pid: Some(evidence.binding.pane_pid),
+        resolved_from: "enter_rescue_owned_binding",
+    };
+    let mut observer = CurrentTurnSubmitObserver::new(
+        workspace, &sender, &request.recipient, &request.message_id, event_log,
+        Some(&request.owner_team_id), Some(&metadata),
+    );
+    observer.rescue_evidence = Some(evidence);
+    let result = execute(&observer)?;
+    if let Some(error) = observer.take_error() { return Err(error); }
+    Ok(result)
+}
+
 struct CurrentTurnSubmitObserver<'a> {
     workspace: &'a Path,
     sender: &'a str,
@@ -2808,6 +2803,7 @@ struct CurrentTurnSubmitObserver<'a> {
     event_log: &'a EventLog,
     owner_team_id: Option<&'a str>,
     metadata: Option<&'a TargetMetadata>,
+    rescue_evidence: Option<&'a crate::transport::native_input::NativeInputEvidence>,
     fired: Cell<bool>,
     error: RefCell<Option<MessagingError>>,
 }
@@ -2830,6 +2826,7 @@ impl<'a> CurrentTurnSubmitObserver<'a> {
             event_log,
             owner_team_id,
             metadata,
+            rescue_evidence: None,
             fired: Cell::new(false),
             error: RefCell::new(None),
         }
@@ -2845,20 +2842,56 @@ impl SubmitObserver for CurrentTurnSubmitObserver<'_> {
         if self.fired.replace(true) {
             return;
         }
-        if let Err(error) = record_current_turn_after_inject_if_leader_to_worker_scoped(
-            self.workspace,
-            self.sender,
-            self.recipient,
-            self.message_id,
-            self.event_log,
-            self.owner_team_id,
-            self.metadata,
-        ) {
-            *self.error.borrow_mut() = Some(error);
-        }
+        let result = if let Some(evidence) = self.rescue_evidence {
+            record_rescue_turn_after_submit(self.workspace, self.sender, evidence, self.event_log, self.metadata)
+        } else {
+            record_current_turn_after_inject_if_leader_to_worker_scoped(
+                self.workspace, self.sender, self.recipient, self.message_id,
+                self.event_log, self.owner_team_id, self.metadata,
+            )
+        };
+        if let Err(error) = result { *self.error.borrow_mut() = Some(error); }
     }
 }
 
+fn record_rescue_turn_after_submit(
+    workspace: &Path,
+    sender: &str,
+    evidence: &crate::transport::native_input::NativeInputEvidence,
+    event_log: &EventLog,
+    metadata: Option<&TargetMetadata>,
+) -> Result<(), MessagingError> {
+    let request = &evidence.request;
+    if !matches!(sender, "leader" | "Leader") { return Ok(()); }
+    crate::state::repository::StateRepository::new(workspace).commit_messaging_checked(
+        crate::state::repository::StateWriteIntent::MessagingDeliveryState {
+            owner_team_id: Some(&request.owner_team_id),
+        },
+        |selected| {
+            let agent = selected.get("agents").and_then(|agents| agents.get(&request.recipient));
+            let matches = agent.is_some_and(|agent| {
+                agent.get("status").and_then(serde_json::Value::as_str) == Some("running")
+                    && agent.get("explicit_stop").and_then(serde_json::Value::as_bool) != Some(true)
+                    && agent.get("pane_id").and_then(serde_json::Value::as_str) == Some(request.pane_id.as_str())
+                    && agent.get("pane_pid").and_then(serde_json::Value::as_u64) == Some(u64::from(request.pane_pid))
+                    && request.pane_pid == evidence.binding.pane_pid
+                    && agent.get("window").and_then(serde_json::Value::as_str).unwrap_or(&request.recipient) == request.window
+                    && agent.get("provider").cloned().and_then(|value| serde_json::from_value::<Provider>(value).ok()) == Some(request.provider)
+                    && selected.get("session_name").and_then(serde_json::Value::as_str) == Some(request.session.as_str())
+            });
+            if !matches {
+                return Err(crate::state::StateError::SaveConflict("rescue receiver changed before turn commit".into()));
+            }
+            arm_turn_open(selected, &request.recipient, &Some(request.message_id.clone()));
+            Ok(())
+        },
+    )?;
+    let mut event = serde_json::json!({"agent_id": request.recipient, "message_id": request.message_id});
+    if let Some(metadata) = metadata { append_target_metadata(&mut event, metadata); }
+    event_log.write("turn_open.armed_after_inject", event)?;
+    Ok(())
+}
+
 fn record_current_turn_after_inject_if_leader_to_worker_scoped(
     workspace: &Path,
     sender: &str,