@team-agent/installer 0.5.17 → 0.5.19

package/crates/team-agent/src/coordinator/health.rs

@@ -13,7 +13,8 @@ use thiserror::Error;
 use crate::message_store::MessageStore;
 
 use super::types::{
-    CoordinatorHealthStatus, CoordinatorMetadata, HealthReport, MetadataSource, Pid, SchemaError,
+    CoordinatorBinaryIdentity, CoordinatorHealthStatus, CoordinatorMetadata,
+    CoordinatorMetadataMismatchReason, HealthReport, MetadataSource, Pid, SchemaError,
     SchemaHealth, StartError, StartOutcome, StartReport, StopError, StopOutcome, StopReport,
     WatchCursor, WorkspacePath, PROTOCOL_VERSION, ROTATION_MARKER,
 };
@@ -27,6 +28,7 @@ use super::types::{
 /// `coordinator_health`(`lifecycle.py:38-46`):`running ∧ metadata_ok ∧ schema_ok` → typed report.
 pub fn coordinator_health(workspace: &WorkspacePath) -> HealthReport {
     let schema = message_store_schema_health(workspace);
+    let current_binary_identity = current_coordinator_binary_identity();
     let pid_path = coordinator_pid_path(workspace);
     let pid = read_pid_file(&pid_path);
     let status = match pid {
@@ -38,7 +40,14 @@ pub fn coordinator_health(workspace: &WorkspacePath) -> HealthReport {
         None => CoordinatorHealthStatus::Missing,
     };
     let metadata = read_coordinator_metadata(workspace);
-    let metadata_ok = pid.is_some_and(|p| coordinator_metadata_ok(metadata.as_ref(), p));
+    let metadata_mismatch = pid
+        .map(|p| coordinator_metadata_mismatch_reason_with_identity(
+            metadata.as_ref(),
+            p,
+            &current_binary_identity,
+        ))
+        .unwrap_or(Some(CoordinatorMetadataMismatchReason::MetadataMissing));
+    let metadata_ok = metadata_mismatch.is_none();
     let running = matches!(status, CoordinatorHealthStatus::Running);
     HealthReport {
         ok: running && metadata_ok && schema.ok,
@@ -46,6 +55,8 @@ pub fn coordinator_health(workspace: &WorkspacePath) -> HealthReport {
         pid,
         metadata,
         metadata_ok,
+        metadata_mismatch_reason: metadata_mismatch.map(|reason| reason.as_str().to_string()),
+        current_binary_identity,
         schema,
     }
 }
@@ -69,11 +80,16 @@ pub fn start_coordinator_with_team(
     team_key: Option<&str>,
 ) -> Result<StartReport, StartError> {
     let health = coordinator_health(workspace);
+    let identity = health.current_binary_identity.clone();
     if health.ok {
         return Ok(StartReport {
             ok: true,
             pid: health.pid,
             status: StartOutcome::AlreadyRunning,
+            previous_pid: None,
+            binary_path: Some(identity.binary_path),
+            binary_version: Some(identity.binary_version),
+            rotation_reason: None,
             log: Some(coordinator_log_path(workspace)),
             schema_error: None,
             action: None,
@@ -84,12 +100,54 @@ pub fn start_coordinator_with_team(
             ok: false,
             pid: health.pid,
             status: StartOutcome::SchemaIncompatible,
+            previous_pid: None,
+            binary_path: Some(identity.binary_path),
+            binary_version: Some(identity.binary_version),
+            rotation_reason: health.metadata_mismatch_reason,
             log: None,
             schema_error: health.schema.error,
             action: health.schema.action,
         });
     }
-    if health.pid.is_some() && !health.metadata_ok && health.metadata.is_some() {
+    let rotation_reason = if matches!(health.status, CoordinatorHealthStatus::Running)
+        && !health.metadata_ok
+    {
+        health.metadata_mismatch_reason.clone()
+    } else {
+        None
+    };
+    if matches!(health.status, CoordinatorHealthStatus::Running) && !health.metadata_ok {
+        crate::event_log::EventLog::new(workspace.as_path()).write(
+            "coordinator.rotation_required",
+            serde_json::json!({
+                "old_pid": health.pid.map(|pid| pid.get()),
+                "reason": rotation_reason.clone(),
+                "old_binary_path": health
+                    .metadata
+                    .as_ref()
+                    .and_then(|metadata| metadata.binary_path.clone()),
+                "old_binary_version": health
+                    .metadata
+                    .as_ref()
+                    .and_then(|metadata| metadata.binary_version.clone()),
+                "current_binary_path": identity.binary_path.clone(),
+                "current_binary_version": identity.binary_version.clone(),
+            }),
+        )?;
+        if health.pid.map(|pid| pid.get()) == Some(std::process::id()) {
+            return Ok(StartReport {
+                ok: false,
+                pid: health.pid,
+                status: StartOutcome::RestartIncompatibleStopFailed,
+                previous_pid: health.pid,
+                binary_path: Some(identity.binary_path),
+                binary_version: Some(identity.binary_version),
+                rotation_reason,
+                log: None,
+                schema_error: None,
+                action: Some("refusing to rotate coordinator metadata that points at the caller process".to_string()),
+            });
+        }
         match stop_coordinator(workspace) {
             Ok(stop) if stop.ok => {}
             Ok(_) | Err(_) => {
@@ -97,6 +155,10 @@ pub fn start_coordinator_with_team(
                     ok: false,
                     pid: health.pid,
                     status: StartOutcome::RestartIncompatibleStopFailed,
+                    previous_pid: health.pid,
+                    binary_path: Some(identity.binary_path),
+                    binary_version: Some(identity.binary_version),
+                    rotation_reason,
                     log: None,
                     schema_error: None,
                     action: None,
@@ -131,10 +193,19 @@ pub fn start_coordinator_with_team(
     let pid = Pid::new(child.id());
     std::fs::write(coordinator_pid_path(workspace), pid.to_string())?;
     write_coordinator_metadata(workspace, pid, MetadataSource::Start)?;
+    let status = if rotation_reason.is_some() {
+        StartOutcome::StartedAfterRotation
+    } else {
+        StartOutcome::Started
+    };
     Ok(StartReport {
         ok: true,
         pid: Some(pid),
-        status: StartOutcome::Started,
+        status,
+        previous_pid: health.pid,
+        binary_path: Some(identity.binary_path),
+        binary_version: Some(identity.binary_version),
+        rotation_reason,
         log: Some(log_path),
         schema_error: None,
         action: None,
@@ -206,6 +277,15 @@ pub fn stop_coordinator(workspace: &WorkspacePath) -> Result<StopReport, StopErr
             pid: Some(pid),
         });
     }
+    if pid.get() == std::process::id() {
+        remove_file_if_exists(&pid_path)?;
+        remove_file_if_exists(&coordinator_meta_path(workspace))?;
+        return Ok(StopReport {
+            ok: true,
+            status: StopOutcome::Stopped,
+            pid: Some(pid),
+        });
+    }
     if !terminate_pid(pid) {
         return Ok(StopReport {
             ok: false,
@@ -499,15 +579,63 @@ pub fn read_coordinator_metadata(workspace: &WorkspacePath) -> Option<Coordinato
     serde_json::from_str(&text).ok()
 }
 
-/// `coordinator_metadata_ok`(`metadata.py:37-43`):三元全等
-/// `meta.pid == pid ∧ meta.protocol_version == PROTOCOL_VERSION ∧
-/// meta.message_store_schema_version == SCHEMA_VERSION`。任一不符 → false(不静默继续旧 schema)。
+pub fn current_coordinator_binary_identity() -> CoordinatorBinaryIdentity {
+    let binary_path = std::env::current_exe()
+        .map(|path| path.canonicalize().unwrap_or(path))
+        .map(|path| path.to_string_lossy().into_owned())
+        .unwrap_or_else(|_| "<unknown>".to_string());
+    CoordinatorBinaryIdentity {
+        binary_path,
+        binary_version: crate::packaging::Version::current().as_str().to_string(),
+    }
+}
+
+/// `coordinator_metadata_ok` now includes daemon binary identity in addition
+/// to the original pid/protocol/schema tuple.
 pub fn coordinator_metadata_ok(metadata: Option<&CoordinatorMetadata>, pid: Pid) -> bool {
-    metadata.is_some_and(|m| {
-        m.pid == pid
-            && m.protocol_version == PROTOCOL_VERSION
-            && m.message_store_schema_version == crate::db::schema::SCHEMA_VERSION
-    })
+    coordinator_metadata_mismatch_reason(metadata, pid).is_none()
+}
+
+pub fn coordinator_metadata_mismatch_reason(
+    metadata: Option<&CoordinatorMetadata>,
+    pid: Pid,
+) -> Option<CoordinatorMetadataMismatchReason> {
+    let identity = current_coordinator_binary_identity();
+    coordinator_metadata_mismatch_reason_with_identity(metadata, pid, &identity)
+}
+
+fn coordinator_metadata_mismatch_reason_with_identity(
+    metadata: Option<&CoordinatorMetadata>,
+    pid: Pid,
+    identity: &CoordinatorBinaryIdentity,
+) -> Option<CoordinatorMetadataMismatchReason> {
+    let Some(metadata) = metadata else {
+        return Some(CoordinatorMetadataMismatchReason::MetadataMissing);
+    };
+    if metadata.pid != pid {
+        return Some(CoordinatorMetadataMismatchReason::PidMismatch);
+    }
+    if metadata.protocol_version != PROTOCOL_VERSION {
+        return Some(CoordinatorMetadataMismatchReason::ProtocolVersionMismatch);
+    }
+    if metadata.message_store_schema_version != crate::db::schema::SCHEMA_VERSION {
+        return Some(CoordinatorMetadataMismatchReason::MessageStoreSchemaVersionMismatch);
+    }
+    let Some(binary_version) = metadata.binary_version.as_deref().filter(|value| !value.is_empty())
+    else {
+        return Some(CoordinatorMetadataMismatchReason::BinaryIdentityMissing);
+    };
+    let Some(binary_path) = metadata.binary_path.as_deref().filter(|value| !value.is_empty())
+    else {
+        return Some(CoordinatorMetadataMismatchReason::BinaryIdentityMissing);
+    };
+    if binary_version != identity.binary_version {
+        return Some(CoordinatorMetadataMismatchReason::BinaryVersionMismatch);
+    }
+    if binary_path != identity.binary_path {
+        return Some(CoordinatorMetadataMismatchReason::BinaryPathMismatch);
+    }
+    None
 }
 
 /// `write_coordinator_metadata`(`metadata.py:46-61`)。写 `coordinator.json`(pretty indent=2),
@@ -525,6 +653,8 @@ pub fn write_coordinator_metadata(
         pid,
         protocol_version: PROTOCOL_VERSION,
         message_store_schema_version: crate::db::schema::SCHEMA_VERSION,
+        binary_path: Some(current_coordinator_binary_identity().binary_path),
+        binary_version: Some(crate::packaging::Version::current().as_str().to_string()),
         source,
         updated_at: chrono::Utc::now().to_rfc3339(),
     };

package/crates/team-agent/src/coordinator/tests/basics.rs

@@ -38,6 +38,7 @@ fn status_enums_serialize_to_exact_python_strings() {
         (serde_json::to_string(&StartOutcome::RestartIncompatibleStopFailed).unwrap(), "\"restart_incompatible_stop_failed\""),
         (serde_json::to_string(&StartOutcome::SchemaIncompatible).unwrap(), "\"schema_incompatible\""),
         (serde_json::to_string(&StartOutcome::Started).unwrap(), "\"started\""),
+        (serde_json::to_string(&StartOutcome::StartedAfterRotation).unwrap(), "\"started_after_rotation\""),
         (serde_json::to_string(&StopOutcome::Missing).unwrap(), "\"missing\""),
         (serde_json::to_string(&StopOutcome::InvalidPidRemoved).unwrap(), "\"invalid_pid_removed\""),
         (serde_json::to_string(&StopOutcome::KillFailed).unwrap(), "\"kill_failed\""),
@@ -173,6 +174,9 @@ fn coordinator_metadata_json_field_names_are_stable() {
     assert_eq!(json["pid"], 123);
     assert_eq!(json["protocol_version"], 2);
     assert_eq!(json["message_store_schema_version"], 3);
+    let identity = current_coordinator_binary_identity();
+    assert_eq!(json["binary_path"], identity.binary_path);
+    assert_eq!(json["binary_version"], identity.binary_version);
     assert_eq!(json["source"], "boot");
     assert_eq!(json["updated_at"], "2026-06-02T00:00:00+00:00");
 }

package/crates/team-agent/src/coordinator/tests/mod.rs

@@ -13,10 +13,13 @@ fn ws() -> WorkspacePath {
 }
 
 fn meta(pid: u32, proto: u32, schema: i64) -> CoordinatorMetadata {
+    let identity = current_coordinator_binary_identity();
     CoordinatorMetadata {
         pid: Pid(pid),
         protocol_version: proto,
         message_store_schema_version: schema,
+        binary_path: Some(identity.binary_path),
+        binary_version: Some(identity.binary_version),
         source: MetadataSource::Boot,
         updated_at: "2026-06-02T00:00:00+00:00".to_string(),
     }

package/crates/team-agent/src/coordinator/tick.rs

@@ -107,20 +107,20 @@ pub enum TickError {
 /// returns `None` and the tick falls back to the raw state — preserving
 /// behavior for legacy single-team workspaces and tests that don't seed
 /// `teams.<key>`. Sibling teams under `state.teams.*` are NOT touched.
-fn coordinator_team_scoped_state(workspace: &std::path::Path, raw_state: &Value) -> Option<Value> {
+fn coordinator_team_scoped_state(
+    workspace: &std::path::Path,
+    raw_state: &Value,
+    daemon_team_key: Option<&str>,
+) -> Option<Value> {
+    let teams = raw_state.get("teams").and_then(Value::as_object)?;
     let active = raw_state
         .get("active_team_key")
         .and_then(Value::as_str)
-        .filter(|s| !s.is_empty())?;
-    let has_team_entry = raw_state
-        .get("teams")
-        .and_then(Value::as_object)
-        .map(|teams| teams.contains_key(active))
-        .unwrap_or(false);
-    if !has_team_entry {
-        return None;
-    }
-    crate::state::projection::select_runtime_state(workspace, Some(active)).ok()
+        .filter(|s| !s.is_empty());
+    let selected = daemon_team_key
+        .filter(|key| !key.is_empty() && teams.contains_key(*key))
+        .or_else(|| active.filter(|key| teams.contains_key(*key)))?;
+    crate::state::projection::select_runtime_state(workspace, Some(selected)).ok()
 }
 
 // ===========================================================================
@@ -149,6 +149,10 @@ pub struct Coordinator {
     /// transport 控制面(tmux session 存活探测等;经 trait 注入,可 mock)。
     #[allow(dead_code)]
     transport: Box<dyn crate::transport::Transport>,
+    /// Daemon CLI-selected team key. When present, tick projection uses this
+    /// instead of a stale root active_team_key.
+    #[allow(dead_code)]
+    daemon_team_key: Option<String>,
     /// bug-084 save 注入钩。`None` ⇔ 真实 `state::save_runtime_state`。
     #[allow(dead_code)]
     save_hook: Option<SaveHook>,
@@ -168,11 +172,17 @@ impl Coordinator {
             workspace,
             provider_registry,
             transport,
+            daemon_team_key: None,
             save_hook: None,
             order_recorder: None,
         }
     }
 
+    pub(crate) fn with_team_key(mut self, team_key: Option<String>) -> Self {
+        self.daemon_team_key = team_key.filter(|key| !key.is_empty());
+        self
+    }
+
     /// 测试装配:直接构出 `Coordinator`(不经 `new` 的 `unimplemented!()`),注入 mock
     /// transport + mock provider registry + 可选 save 注入钩 + ORDER 探针。**纯 test-support
     /// 脚手架**(真实 impl,非 `unimplemented!()`):它只装配字段,不执行任何 daemon 逻辑;
@@ -189,6 +199,7 @@ impl Coordinator {
             workspace,
             provider_registry,
             transport,
+            daemon_team_key: None,
             save_hook,
             order_recorder,
         }
@@ -224,8 +235,12 @@ impl Coordinator {
         // `team-prerelease-040-round3b`) and emit `coordinator.session_missing`
         // even though the right session is alive. Fall back to raw state when
         // no team scope can be derived (legacy single-team workspaces).
-        let mut state = coordinator_team_scoped_state(self.workspace.as_path(), &raw_state)
-            .unwrap_or(raw_state);
+        let mut state = coordinator_team_scoped_state(
+            self.workspace.as_path(),
+            &raw_state,
+            self.daemon_team_key.as_deref(),
+        )
+        .unwrap_or(raw_state);
         let store = crate::message_store::MessageStore::open(self.workspace.as_path())?;
         let event_log = EventLog::new(self.workspace.as_path());
         increment_coordinator_tick_iteration_count(&self.workspace);
@@ -1264,27 +1279,7 @@ impl Coordinator {
     /// `coordinator_health`(`lifecycle.py:26`)。pid + meta + schema 三合一健康。
     /// doctor / start 前置调它。`ok = running ∧ metadata_ok ∧ schema_ok`。
     pub fn health(&self) -> Result<HealthReport, TickError> {
-        let schema = self.schema_health();
-        let pid_path = coordinator_pid_path(&self.workspace);
-        let pid = read_pid_file(&pid_path);
-        let (status, running) = match pid {
-            Some(pid) if pid_is_running(pid).unwrap_or(false) => {
-                (CoordinatorHealthStatus::Running, true)
-            }
-            Some(_) => (CoordinatorHealthStatus::Stale, false),
-            None if pid_path.exists() => (CoordinatorHealthStatus::InvalidPid, false),
-            None => (CoordinatorHealthStatus::Missing, false),
-        };
-        let metadata = read_coordinator_metadata(&self.workspace);
-        let metadata_ok = pid.is_some_and(|p| coordinator_metadata_ok(metadata.as_ref(), p));
-        Ok(HealthReport {
-            ok: running && metadata_ok && schema.ok,
-            status,
-            pid,
-            metadata,
-            metadata_ok,
-            schema,
-        })
+        Ok(super::health::coordinator_health(&self.workspace))
     }
 
     /// `start_coordinator`(`lifecycle.py:49`)。幂等启动:已健康 no-op;metadata 不兼容先 stop 再起;
@@ -1292,40 +1287,7 @@ impl Coordinator {
     /// Python 是 `python -m team_agent.coordinator`,`lifecycle.py:108`)。
     /// **schema 兼容门**:三元任一不匹配 → restart_incompatible,**不可静默继续**(card §89)。
     pub fn start(&self) -> Result<StartReport, StartError> {
-        let health = self
-            .health()
-            .map_err(|e| std::io::Error::other(e.to_string()))?;
-        if health.ok {
-            return Ok(StartReport {
-                ok: true,
-                pid: health.pid,
-                status: StartOutcome::AlreadyRunning,
-                log: Some(coordinator_log_path(&self.workspace)),
-                schema_error: None,
-                action: None,
-            });
-        }
-        if !health.schema.ok {
-            return Ok(StartReport {
-                ok: false,
-                pid: health.pid,
-                status: StartOutcome::SchemaIncompatible,
-                log: None,
-                schema_error: health.schema.error,
-                action: health.schema.action,
-            });
-        }
-        let pid = Pid::new(std::process::id());
-        write_coordinator_metadata(&self.workspace, pid, MetadataSource::Start)?;
-        std::fs::write(coordinator_pid_path(&self.workspace), pid.to_string())?;
-        Ok(StartReport {
-            ok: true,
-            pid: Some(pid),
-            status: StartOutcome::Started,
-            log: Some(coordinator_log_path(&self.workspace)),
-            schema_error: None,
-            action: None,
-        })
+        super::health::start_coordinator(&self.workspace)
     }
 
     /// `stop_coordinator`(`lifecycle.py:229`)。SIGTERM + 清 pid/meta。pid 非整数 → 清文件返回。
@@ -2544,4 +2506,44 @@ mod u1_tests {
             "capture_missing failure must be visible in events.jsonl; got {events}"
         );
     }
+
+    #[test]
+    fn daemon_team_key_projection_beats_stale_root_active_team_key() {
+        let dir = std::env::temp_dir().join(format!(
+            "team-agent-daemon-team-key-{}-{}",
+            std::process::id(),
+            std::time::SystemTime::now()
+                .duration_since(std::time::UNIX_EPOCH)
+                .unwrap()
+                .as_nanos()
+        ));
+        std::fs::create_dir_all(&dir).unwrap();
+        let raw = serde_json::json!({
+            "active_team_key": "stale-b",
+            "session_name": "team-stale-b",
+            "teams": {
+                "fresh-a": {
+                    "active_team_key": "fresh-a",
+                    "team_key": "fresh-a",
+                    "session_name": "team-fresh-a",
+                    "agents": {}
+                },
+                "stale-b": {
+                    "active_team_key": "stale-b",
+                    "team_key": "stale-b",
+                    "session_name": "team-stale-b",
+                    "agents": {}
+                }
+            }
+        });
+        crate::state::persist::save_runtime_state(&dir, &raw).unwrap();
+
+        let selected =
+            coordinator_team_scoped_state(&dir, &raw, Some("fresh-a")).expect("selected team");
+
+        assert_eq!(
+            selected.get("session_name").and_then(Value::as_str),
+            Some("team-fresh-a")
+        );
+    }
 }

package/crates/team-agent/src/coordinator/types.rs

@@ -112,6 +112,8 @@ pub enum StartOutcome {
     SchemaIncompatible,
     /// 正常 spawn(`lifecycle.py:121`)。
     Started,
+    /// 当前 CLI 发现 live daemon 的 binary identity 过期,stop 后重新 spawn。
+    StartedAfterRotation,
 }
 
 /// `stop_coordinator` 结果 status(`lifecycle.py:232,238,243,247`)。
@@ -170,11 +172,50 @@ pub struct CoordinatorMetadata {
     pub pid: Pid,
     pub protocol_version: u32,
     pub message_store_schema_version: i64,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub binary_path: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub binary_version: Option<String>,
     pub source: MetadataSource,
     /// ISO8601(`datetime.now(timezone.utc).isoformat()`,`metadata.py:56`)。
     pub updated_at: String,
 }
 
+/// Current coordinator daemon binary identity. Version comes from the compiled
+/// package; path comes from the currently executing CLI binary, not PATH.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct CoordinatorBinaryIdentity {
+    pub binary_path: String,
+    pub binary_version: String,
+}
+
+/// Stable machine-readable reason for coordinator metadata rejection.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum CoordinatorMetadataMismatchReason {
+    MetadataMissing,
+    PidMismatch,
+    ProtocolVersionMismatch,
+    MessageStoreSchemaVersionMismatch,
+    BinaryIdentityMissing,
+    BinaryVersionMismatch,
+    BinaryPathMismatch,
+}
+
+impl CoordinatorMetadataMismatchReason {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::MetadataMissing => "metadata_missing",
+            Self::PidMismatch => "pid_mismatch",
+            Self::ProtocolVersionMismatch => "protocol_version_mismatch",
+            Self::MessageStoreSchemaVersionMismatch => "message_store_schema_version_mismatch",
+            Self::BinaryIdentityMissing => "binary_identity_missing",
+            Self::BinaryVersionMismatch => "binary_version_mismatch",
+            Self::BinaryPathMismatch => "binary_path_mismatch",
+        }
+    }
+}
+
 // ===========================================================================
 // SchemaHealth(lifecycle.py:197-226)
 // ===========================================================================
@@ -244,6 +285,8 @@ pub struct HealthReport {
     pub metadata: Option<CoordinatorMetadata>,
     /// 三元全等(`coordinator_metadata_ok`,`metadata.py:37-43`)。
     pub metadata_ok: bool,
+    pub metadata_mismatch_reason: Option<String>,
+    pub current_binary_identity: CoordinatorBinaryIdentity,
     pub schema: SchemaHealth,
 }
 
@@ -253,6 +296,10 @@ pub struct StartReport {
     pub ok: bool,
     pub pid: Option<Pid>,
     pub status: StartOutcome,
+    pub previous_pid: Option<Pid>,
+    pub binary_path: Option<String>,
+    pub binary_version: Option<String>,
+    pub rotation_reason: Option<String>,
     /// coordinator.log 路径(成功路径,`lifecycle.py:54/121`)。
     pub log: Option<PathBuf>,
     /// schema_incompatible 时的修复 hint / 失败原因。

package/crates/team-agent/src/diagnose/orphans.rs

@@ -9,7 +9,9 @@ use crate::cli::CliError;
 use crate::coordinator::health::{
     coordinator_metadata_ok, pid_is_running, read_coordinator_metadata, terminate_pid_tree,
 };
-use crate::coordinator::types::{OrphanReason, Pid, WorkspacePath};
+use crate::coordinator::types::{
+    CoordinatorMetadata, OrphanReason, Pid, WorkspacePath, PROTOCOL_VERSION,
+};
 // Phase 1d Batch 6: `TmuxBackend` import removed — all sites now use
 // `transport_factory::tmux_socket_name_transport` for grep-visibility.
 use crate::transport::{SessionName, Transport};
@@ -477,8 +479,7 @@ fn ps_command_rows() -> Vec<ProcessRow> {
         Command::new("ps").args(["-axww", "-o", "pid=,command="]),
         "ps_table",
         None,
-    )
-    {
+    ) {
         Ok(output) if output.status.success() => output,
         _ => return Vec::new(),
     };
@@ -490,9 +491,7 @@ fn ps_command_rows() -> Vec<ProcessRow> {
 
 fn parse_ps_command_line(line: &str) -> Option<ProcessRow> {
     let line = line.trim_start();
-    let split = line
-        .find(char::is_whitespace)
-        .unwrap_or(line.len());
+    let split = line.find(char::is_whitespace).unwrap_or(line.len());
     let pid = line.get(..split)?.trim().parse::<u32>().ok()?;
     let command = line.get(split..)?.trim().to_string();
     Some(ProcessRow {
@@ -568,7 +567,7 @@ fn classify_workspace_orphan(workspace: &Path, pid: Pid) -> Option<OrphanReason>
     }
     let workspace_path = WorkspacePath::new(workspace.to_path_buf());
     let metadata = read_coordinator_metadata(&workspace_path);
-    if metadata.is_some() && !coordinator_metadata_ok(metadata.as_ref(), pid) {
+    if coordinator_process_metadata_mismatch(metadata.as_ref(), pid) {
         return Some(OrphanReason::MetadataMismatch);
     }
     if pid_is_running(pid).ok() == Some(false) {
@@ -577,6 +576,15 @@ fn classify_workspace_orphan(workspace: &Path, pid: Pid) -> Option<OrphanReason>
     None
 }
 
+fn coordinator_process_metadata_mismatch(metadata: Option<&CoordinatorMetadata>, pid: Pid) -> bool {
+    let Some(metadata) = metadata else {
+        return false;
+    };
+    metadata.pid != pid
+        || metadata.protocol_version != PROTOCOL_VERSION
+        || metadata.message_store_schema_version != crate::db::schema::SCHEMA_VERSION
+}
+
 fn classify_workspace_without_pid(workspace: &Path) -> Option<OrphanReason> {
     if !workspace.is_absolute() {
         return None;
@@ -592,10 +600,7 @@ fn classify_workspace_without_pid(workspace: &Path) -> Option<OrphanReason> {
 
 fn ephemeral_workspace_hint(workspace: &Path) -> Option<String> {
     let text = workspace.to_string_lossy();
-    let patterns = [
-        "ta_doctor_comms_orphans-",
-        "team-agent-watcher-dedupe",
-    ];
+    let patterns = ["ta_doctor_comms_orphans-", "team-agent-watcher-dedupe"];
     patterns
         .iter()
         .find(|pattern| text.contains(**pattern))
@@ -626,8 +631,7 @@ fn ps_parent_map() -> BTreeMap<u32, u32> {
         Command::new("ps").args(["-axo", "pid=,ppid="]),
         "ps_parent",
         None,
-    )
-    {
+    ) {
         Ok(output) if output.status.success() => output,
         _ => return BTreeMap::new(),
     };
@@ -732,4 +736,22 @@ mod tests {
             Some(PathBuf::from("/tmp/My Agent"))
         );
     }
+
+    #[test]
+    fn process_orphan_metadata_ignores_binary_identity_rotation() {
+        let metadata = CoordinatorMetadata {
+            pid: Pid::new(123),
+            protocol_version: PROTOCOL_VERSION,
+            message_store_schema_version: crate::db::schema::SCHEMA_VERSION,
+            binary_path: Some("/old/team-agent".to_string()),
+            binary_version: Some("0.5.17".to_string()),
+            source: crate::coordinator::MetadataSource::Boot,
+            updated_at: "2026-07-09T00:00:00+00:00".to_string(),
+        };
+
+        assert!(
+            !coordinator_process_metadata_mismatch(Some(&metadata), Pid::new(123)),
+            "binary identity drift is a rotation signal, not orphan cleanup proof"
+        );
+    }
 }

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -157,7 +157,8 @@ pub(crate) fn start_agent_at_paths(
             write_team_state(spec_workspace, &spec, &state)?;
         }
         replay_worker_target_missing_messages(workspace, agent_id, &team_key, &state, transport)?;
-        let coordinator_started = start_coordinator_for_workspace(workspace)?;
+        let coordinator = start_coordinator_for_workspace(workspace, Some(&team_key))?;
+        let coordinator_started = coordinator.ok;
         let target = format!("{}:{window}", session_name.as_str());
         if let Some(new_binding) = refreshed_binding.as_ref() {
             if old_binding.as_ref() != Some(new_binding) {
@@ -310,7 +311,8 @@ pub(crate) fn start_agent_at_paths(
         tmux_start_mode_for_spawn(&spawn, into_existing_session),
     )?;
     replay_worker_target_missing_messages(workspace, agent_id, &team_key, &state, transport)?;
-    let coordinator_started = start_coordinator_for_workspace(workspace)?;
+    let coordinator = start_coordinator_for_workspace(workspace, Some(&team_key))?;
+    let coordinator_started = coordinator.ok;
     Ok(StartAgentOutcome::Running {
         env: AgentActionEnvelope {
             agent_id: agent_id.clone(),