@team-agent/installer 0.5.3 → 0.5.5

package/crates/team-agent/src/lifecycle/tests/restart.rs

@@ -101,11 +101,8 @@ fn layer2_backing_missing_refusal_carries_checked_paths_and_recovery_hint() {
     use std::sync::atomic::{AtomicU32, Ordering};
     static N: AtomicU32 = AtomicU32::new(0);
     let n = N.fetch_add(1, Ordering::Relaxed);
-    let ws = std::env::temp_dir().join(format!(
-        "ta_rs_l2_backingmiss_{}_{}",
-        std::process::id(),
-        n
-    ));
+    let ws =
+        std::env::temp_dir().join(format!("ta_rs_l2_backingmiss_{}_{}", std::process::id(), n));
     std::fs::create_dir_all(&ws).unwrap();
 
     let missing_rollout = ws.join(".missing-rollout.jsonl");
@@ -168,6 +165,148 @@ fn layer2_backing_missing_refusal_carries_checked_paths_and_recovery_hint() {
     }
 }
 
+fn write_codex_identity_rollout(
+    workspace: &std::path::Path,
+    file_name: &str,
+    session_id: &str,
+    embedded_agent_id: &str,
+) -> std::path::PathBuf {
+    let path = workspace.join(file_name);
+    let text = format!(
+        "{{\"session_meta\":{{\"payload\":{{\"id\":\"{session_id}\",\"cwd\":\"{}\"}}}}}}\n\
+         {{\"type\":\"turn_context\",\"payload\":{{}}}}\n\
+         {{\"type\":\"response_item\",\"payload\":{{\"content\":[{{\"type\":\"input_text\",\"text\":\"You are Team Agent worker `{embedded_agent_id}` with role `fixture`.\"}}]}}}}\n",
+        workspace.to_string_lossy()
+    );
+    std::fs::write(&path, text).unwrap();
+    path
+}
+
+#[test]
+fn restart_refuses_codex_session_identity_mismatch_without_allow_fresh() {
+    let ws = temp_ws();
+    let rollout = write_codex_identity_rollout(
+        &ws,
+        "rollout-frontend-poison.jsonl",
+        "019f3327-c35a-7023-b3cd-1bea93a7a157",
+        "ios-dev",
+    );
+    let state = json!({
+        "agents": {
+            "frontend": {
+                "provider": "codex",
+                "status": "running",
+                "session_id": "019f3327-c35a-7023-b3cd-1bea93a7a157",
+                "rollout_path": rollout.to_string_lossy(),
+                "captured_at": "2026-07-05T17:04:04Z",
+                "captured_via": "fs_watch",
+                "spawn_cwd": ws.to_string_lossy(),
+                "first_send_at": "2026-07-05T17:10:00Z"
+            }
+        }
+    });
+
+    let plan = crate::lifecycle::restart::classify_restart_plan_with_resume_validation(
+        Some(&ws),
+        &state,
+        false,
+    )
+    .unwrap();
+
+    assert_eq!(plan.decisions.len(), 1);
+    assert_eq!(plan.decisions[0].decision, ResumeDecision::Refuse);
+    assert_eq!(plan.unresumable.len(), 1);
+    let entry = &plan.unresumable[0];
+    assert_eq!(entry.agent_id.as_str(), "frontend");
+    assert_eq!(entry.reason, "session_identity_mismatch");
+    assert_eq!(
+        entry
+            .refusal_reason
+            .as_ref()
+            .map(crate::provider::session::ResumeRefusalReason::wire),
+        Some("session_identity_mismatch")
+    );
+}
+
+#[test]
+fn restart_identity_probe_reports_real_frontend_ios_dev_mismatch_shape() {
+    let ws = temp_ws();
+    let rollout = write_codex_identity_rollout(
+        &ws,
+        "rollout-frontend-poison.jsonl",
+        "019f3327-c35a-7023-b3cd-1bea93a7a157",
+        "ios-dev",
+    );
+    let rollout_path = crate::provider::RolloutPath::new(rollout.clone());
+    let probe = crate::lifecycle::restart::session_identity_probe_for_agent(
+        &aid("frontend"),
+        crate::provider::Provider::Codex,
+        Some(&rollout_path),
+    );
+    assert_eq!(probe.identity_ok, Some(false));
+    assert_eq!(probe.embedded_agent_id.as_deref(), Some("ios-dev"));
+    assert_eq!(probe.rollout_path.as_deref(), Some(rollout.as_path()));
+}
+
+#[test]
+fn restart_allow_fresh_only_fresh_starts_mismatched_codex_worker() {
+    let ws = temp_ws();
+    let frontend_rollout = write_codex_identity_rollout(
+        &ws,
+        "rollout-frontend-poison.jsonl",
+        "019f3327-c35a-7023-b3cd-1bea93a7a157",
+        "ios-dev",
+    );
+    let backend_rollout = write_codex_identity_rollout(
+        &ws,
+        "rollout-backend-valid.jsonl",
+        "019f3327-backend-valid",
+        "backend",
+    );
+    let state = json!({
+        "agents": {
+            "frontend": {
+                "provider": "codex",
+                "status": "running",
+                "session_id": "019f3327-c35a-7023-b3cd-1bea93a7a157",
+                "rollout_path": frontend_rollout.to_string_lossy(),
+                "captured_at": "2026-07-05T17:04:04Z",
+                "captured_via": "fs_watch",
+                "spawn_cwd": ws.to_string_lossy()
+            },
+            "backend": {
+                "provider": "codex",
+                "status": "running",
+                "session_id": "019f3327-backend-valid",
+                "rollout_path": backend_rollout.to_string_lossy(),
+                "captured_at": "2026-07-05T17:04:05Z",
+                "captured_via": "fs_watch",
+                "spawn_cwd": ws.to_string_lossy()
+            }
+        }
+    });
+
+    let plan = crate::lifecycle::restart::classify_restart_plan_with_resume_validation(
+        Some(&ws),
+        &state,
+        true,
+    )
+    .unwrap();
+
+    assert!(
+        plan.unresumable.is_empty(),
+        "allow_fresh should convert the poisoned worker to fresh without refusing; got {:?}",
+        plan.unresumable
+    );
+    let decisions = plan
+        .decisions
+        .iter()
+        .map(|decision| (decision.agent_id.as_str(), decision.decision))
+        .collect::<std::collections::BTreeMap<_, _>>();
+    assert_eq!(decisions.get("frontend"), Some(&ResumeDecision::FreshStart));
+    assert_eq!(decisions.get("backend"), Some(&ResumeDecision::Resume));
+}
+
 #[test]
 fn unit0_restart_corrupt_first_send_at_blocks_before_resume_classification() {
     // The corrupt-first_send_at branch is the hard-refuse gate that fires

package/crates/team-agent/src/lifecycle/types.rs

@@ -440,6 +440,7 @@ pub struct StartedAgent {
     pub agent_id: AgentId,
     pub start_mode: StartMode,
     pub target: String,
+    pub spawned_at: String,
     pub session_id: Option<SessionId>,
     pub rollout_path: Option<RolloutPath>,
     pub pending_session_id: Option<SessionId>,

package/crates/team-agent/src/messaging/delivery.rs

@@ -165,7 +165,7 @@ pub fn deliver_pending_message(
     };
     let attempt = if store.claim_for_delivery(message_id)? {
         message.delivery_attempts.saturating_add(1)
-    } else if message.status == "target_resolved" {
+    } else if message.status == "target_resolved" && message.error.is_some() {
         bump_delivery_attempts(store, message_id)?
     } else {
         return Ok(DeliveryOutcome {
@@ -190,6 +190,42 @@ pub fn deliver_pending_message(
             )? {
                 return Ok(outcome);
             }
+            // 0.5.4 gate054 cross-team leak fix: a `leader_receiver.status`
+            // other than `"attached"` (restart demotes killed-session receivers
+            // to `"rebind_required"` — lifecycle/restart/rebuild.rs:1311) MUST
+            // refuse delivery before any pane injection or cross-server pane-id
+            // probing. Without this gate, a stale receiver on team A's socket
+            // could otherwise fall back to the same pane id on the main tmux
+            // server (delivery.rs:1150-1201) and inject A's leader traffic into
+            // team B's leader pane. See .team/artifacts/0.5.4-gate-crossteam-notify-triage.md.
+            if let Some(status) = leader_receiver_status(state) {
+                if status != "attached" {
+                    store.mark(message_id, "failed", Some("leader_not_attached"))?;
+                    event_log.write(
+                        "leader_receiver.delivery_blocked",
+                        serde_json::json!({
+                            "message_id": message_id,
+                            "sender": message.sender,
+                            "reason": "leader_receiver_not_attached",
+                            "channel": "rebind_required",
+                            "action": "run team-agent attach-leader or team-agent takeover",
+                            "status": status,
+                        }),
+                    )?;
+                    return Ok(DeliveryOutcome {
+                        ok: false,
+                        status: DeliveryStatus::Refused,
+                        message_status: MessageStatusShadow("failed".to_string()),
+                        message_id: Some(message_id.to_string()),
+                        verification: Some(
+                            "run team-agent attach-leader or team-agent takeover".to_string(),
+                        ),
+                        stage: None,
+                        reason: Some(DeliveryRefusal::LeaderNotAttached),
+                        channel: Some("rebind_required".to_string()),
+                    });
+                }
+            }
             if crate::codex_app_server::receiver_is_app_server(receiver) {
                 return deliver_leader_via_app_server(
                     store,
@@ -288,6 +324,16 @@ pub fn deliver_pending_message(
         });
     }
     let target = resolve_inject_target(state, &message.recipient, transport, &live_targets);
+    if let Some(outcome) = block_missing_worker_target(
+        store,
+        event_log,
+        message_id,
+        &message.recipient,
+        &target,
+        &live_targets,
+    )? {
+        return Ok(outcome);
+    }
     // Contract B / MUST-10 / N31/N32: physical paste+Enter into a startup trust/update
     // menu is NOT provider delivery — the menu consumes the Enter and the task text
     // is lost (PROBE-2 root-cause). Before injection, peek at the recipient's pane for
@@ -358,6 +404,15 @@ pub fn deliver_pending_message(
                     channel: Some("rebind_required".to_string()),
                 });
             }
+            if transport_error_is_target_missing(&error) {
+                return mark_worker_target_missing(
+                    store,
+                    event_log,
+                    message_id,
+                    &message.recipient,
+                    Some(reason),
+                );
+            }
             event_log.write(
                 "send.inject_failed",
                 serde_json::json!({
@@ -574,6 +629,136 @@ pub fn deliver_pending_message(
     Ok(outcome)
 }
 
+fn block_missing_worker_target(
+    store: &MessageStore,
+    event_log: &EventLog,
+    message_id: &str,
+    recipient: &str,
+    target: &Target,
+    live_targets: &[PaneInfo],
+) -> Result<Option<DeliveryOutcome>, MessagingError> {
+    let Target::SessionWindow { session, window } = target else {
+        return Ok(None);
+    };
+    if live_targets.is_empty() {
+        return Ok(None);
+    }
+    if window.as_str().ends_with("_pane_conflicts_with_leader") {
+        return Ok(None);
+    }
+    if live_targets.iter().any(|pane| {
+        pane.session.as_str() == session.as_str()
+            && pane
+                .window_name
+                .as_ref()
+                .is_some_and(|name| name.as_str() == window.as_str())
+    }) {
+        return Ok(None);
+    }
+    mark_worker_target_missing(store, event_log, message_id, recipient, None).map(Some)
+}
+
+fn mark_worker_target_missing(
+    store: &MessageStore,
+    event_log: &EventLog,
+    message_id: &str,
+    recipient: &str,
+    verification: Option<String>,
+) -> Result<DeliveryOutcome, MessagingError> {
+    let action = format!("run team-agent start-agent {recipient} --allow-fresh");
+    store.mark(
+        message_id,
+        "queued_pane_missing",
+        Some("tmux_target_missing"),
+    )?;
+    event_log.write(
+        "send.inject_blocked",
+        serde_json::json!({
+            "message_id": message_id,
+            "recipient": recipient,
+            "reason": "tmux_target_missing",
+            "channel": "delivery_blocked",
+            "action": action,
+            "verification": verification,
+        }),
+    )?;
+    Ok(DeliveryOutcome {
+        ok: false,
+        status: DeliveryStatus::Blocked,
+        message_status: MessageStatusShadow("queued_pane_missing".to_string()),
+        message_id: Some(message_id.to_string()),
+        verification: verification.or(Some(action)),
+        stage: Some(DeliveryStage::Inject),
+        reason: Some(DeliveryRefusal::TmuxTargetMissing),
+        channel: Some("delivery_blocked".to_string()),
+    })
+}
+
+fn transport_error_is_target_missing(error: &crate::transport::TransportError) -> bool {
+    match error {
+        crate::transport::TransportError::TargetNotFound { .. } => true,
+        crate::transport::TransportError::Subprocess { stderr, .. } => {
+            let stderr = stderr.to_ascii_lowercase();
+            (stderr.contains("can't find") || stderr.contains("no such"))
+                && (stderr.contains("pane")
+                    || stderr.contains("window")
+                    || stderr.contains("session"))
+        }
+        _ => false,
+    }
+}
+
+pub fn requeue_worker_target_missing_messages(
+    workspace: &Path,
+    store: &MessageStore,
+    event_log: &EventLog,
+    recipient: &str,
+    owner_team_id: Option<&str>,
+) -> Result<Vec<String>, MessagingError> {
+    let conn = crate::db::schema::open_db(store.db_path())?;
+    let now = chrono::Utc::now().to_rfc3339();
+    let mut stmt = conn.prepare(
+        "select message_id from messages
+         where recipient = ?1
+           and status = 'queued_pane_missing'
+           and error = 'tmux_target_missing'
+           and (
+               (?2 is null and owner_team_id is null)
+               or owner_team_id = ?2
+           )
+         order by created_at, message_id",
+    )?;
+    let ids = stmt
+        .query_map(params![recipient, owner_team_id], |row| {
+            row.get::<_, String>(0)
+        })?
+        .collect::<Result<Vec<_>, _>>()?;
+    drop(stmt);
+    for message_id in &ids {
+        conn.execute(
+            "update messages
+             set status = 'accepted',
+                 error = null,
+                 updated_at = ?2
+             where message_id = ?1",
+            params![message_id, now.as_str()],
+        )?;
+    }
+    if !ids.is_empty() {
+        event_log.write(
+            "worker_receiver.blocked_messages_requeued",
+            serde_json::json!({
+                "recipient": recipient,
+                "owner_team_id": owner_team_id,
+                "count": ids.len(),
+                "message_ids": ids,
+            }),
+        )?;
+    }
+    let _ = workspace;
+    Ok(ids)
+}
+
 /// 0.3.27: promoted to pub(crate) for leader_receiver.rs verification gate.
 pub(crate) fn inject_submit_verified(report: &InjectReport) -> bool {
     match report.submit_verification {
@@ -1170,34 +1355,17 @@ fn delivery_transport_for_recipient<'a>(
     if socket == crate::tmux_backend::socket_name_for_workspace(workspace) {
         DeliveryTransport::Borrowed(product_transport)
     } else {
+        // 0.5.4 gate054 cross-team leak fix: when `leader_receiver.tmux_socket`
+        // is present and non-canonical, it is a hard channel boundary — the
+        // caller (team A on socket X) explicitly recorded which tmux server
+        // hosts its leader pane. Pane ids (`%N`) are only unique per tmux
+        // server, so probing product/default servers for the same pane id and
+        // switching transports on a match can cross the team/tmux boundary and
+        // inject A's leader traffic into team B's leader pane. If the pane is
+        // absent on the recorded endpoint, let the downstream
+        // `leader_receiver_pane_is_usable` guard produce `rebind_required`
+        // instead of falling back to another server.
         let endpoint_backend = crate::transport_factory::tmux_endpoint_transport(socket);
-        if let Some(pane_id) = pane_id {
-            if endpoint_backend
-                .list_targets()
-                .unwrap_or_default()
-                .iter()
-                .any(|target| target.pane_id.as_str() == pane_id)
-            {
-                return DeliveryTransport::Owned(Box::new(endpoint_backend));
-            }
-            if product_transport
-                .list_targets()
-                .unwrap_or_default()
-                .iter()
-                .any(|target| target.pane_id.as_str() == pane_id)
-            {
-                return DeliveryTransport::Borrowed(product_transport);
-            }
-            let default_backend = crate::transport_factory::tmux_default_transport();
-            if default_backend
-                .list_targets()
-                .unwrap_or_default()
-                .iter()
-                .any(|target| target.pane_id.as_str() == pane_id)
-            {
-                return DeliveryTransport::Owned(Box::new(default_backend));
-            }
-        }
         DeliveryTransport::Owned(Box::new(endpoint_backend))
     }
 }
@@ -1237,6 +1405,15 @@ fn leader_receiver_tmux_socket(state: &serde_json::Value) -> Option<&str> {
     leader_receiver_field(state, "tmux_socket")
 }
 
+/// 0.5.4 gate054 cross-team leak fix: read the bound `leader_receiver.status`
+/// through the same team-scope resolution as [`leader_receiver_tmux_socket`].
+/// Restart marks demoted receivers as `"rebind_required"`
+/// (lifecycle/restart/rebuild.rs:1311); delivery must refuse before injecting
+/// or cross-server pane-id probing (delivery.rs:1150-1201).
+fn leader_receiver_status(state: &serde_json::Value) -> Option<&str> {
+    leader_receiver_field(state, "status")
+}
+
 fn leader_receiver_has_noncanonical_tmux_socket(state: &serde_json::Value) -> bool {
     leader_receiver_tmux_socket(state)
         .is_some_and(|socket| socket != "default" && !std::path::Path::new(socket).is_absolute())
@@ -1494,6 +1671,7 @@ struct PendingMessage {
     task_id: Option<String>,
     owner_team_id: Option<String>,
     status: String,
+    error: Option<String>,
     delivery_attempts: u32,
 }
 
@@ -1504,7 +1682,7 @@ fn message_for_delivery(
     let conn = crate::db::schema::open_db(store.db_path())?;
     let message = conn
         .query_row(
-            "select sender, recipient, content, task_id, owner_team_id, status, delivery_attempts from messages where message_id = ?1",
+            "select sender, recipient, content, task_id, owner_team_id, status, error, delivery_attempts from messages where message_id = ?1",
             params![message_id],
             |row| {
                 Ok(PendingMessage {
@@ -1514,7 +1692,8 @@ fn message_for_delivery(
                     task_id: row.get::<_, Option<String>>(3)?,
                     owner_team_id: row.get::<_, Option<String>>(4)?,
                     status: row.get::<_, String>(5)?,
-                    delivery_attempts: row.get::<_, i64>(6)?.max(0) as u32,
+                    error: row.get::<_, Option<String>>(6)?,
+                    delivery_attempts: row.get::<_, i64>(7)?.max(0) as u32,
                 })
             },
         )

package/crates/team-agent/src/messaging/leader_receiver.rs

@@ -8,7 +8,7 @@ use serde_json::Value;
 use crate::event_log::EventLog;
 use crate::message_store::{MessageStore, NotificationClaimParams};
 use crate::model::ids::TaskId;
-use crate::transport::{InjectPayload, Key, PaneId, Target, Transport};
+use crate::transport::{InjectPayload, InjectReport, Key, PaneId, Target, Transport, TransportError};
 
 use super::helpers::MessageStatusShadow;
 use super::{DeliveryOutcome, DeliveryRefusal, DeliveryStage, DeliveryStatus, MessagingError};
@@ -286,27 +286,41 @@ pub fn deliver_to_leader_fallback_pane(
     let rendered = render_fallback_pane_message(content, message_id, primary_error);
     let target = Target::Pane(PaneId::new(&pane_id));
     let payload = InjectPayload::Text(rendered);
-    // 0.5.x Phase 1d Batch 4: leader-fallback pane inject uses the
-    // factory tmux channel helpers so `grep transport_factory::tmux_`
-    // enumerates every tmux-only leader-channel site. Semantics are
-    // identical to the previous direct `TmuxBackend::*` calls
-    // (helpers are thin wrappers). `transport_kind`-based dispatch
-    // is the parallel `feat/appserver-leader-host` work; this batch
-    // stays helper-swap only.
-    let inject_result = leader_tmux_socket(state)
-        .and_then(|socket| {
+    // 0.5.5 gate054 cross-team notify boundary: when the leader receiver
+    // has a recorded `tmux_socket` (canonical), that socket is a HARD
+    // channel boundary. Pane ids (`%N`) are only unique per tmux server,
+    // so falling back from a missing/dead pane on the recorded endpoint
+    // to the workspace-canonical or default tmux server can inject team
+    // A's leader traffic into team B's leader pane on a different socket
+    // (real-machine gate054 acceptance B-arm: private socket %1 absent
+    // after leader kill, default server's %1 was the main leader — the
+    // prior chain silently landed A's `report_result` there).
+    //
+    // Loud-not-silent (user tie-break E23 / N32): if the recorded endpoint
+    // rejects the inject we return `Blocked` with `channel=rebind_required`
+    // and audit `leader_receiver.fallback_pane_failed` — the message row
+    // stays pending in the store, coordinator surfaces the pending
+    // notification via status/monitor, and no cross-server injection is
+    // attempted.
+    let inject_result: Result<InjectReport, TransportError> = match leader_tmux_socket(state) {
+        Some(socket) => {
             let backend = crate::transport_factory::tmux_endpoint_transport(socket);
-            backend.inject(&target, &payload, Key::Enter, true).ok()
-        })
-        .map(Ok)
-        .unwrap_or_else(|| {
-            let backend = crate::transport_factory::tmux_workspace_transport(workspace);
-            backend.inject(&target, &payload, Key::Enter, true)
-        })
-        .or_else(|_| {
-            let backend = crate::transport_factory::tmux_default_transport();
             backend.inject(&target, &payload, Key::Enter, true)
-        });
+        }
+        None => {
+            // No socket recorded → legacy (pre-0.5) shape where the receiver
+            // was implicitly bound to the workspace-canonical tmux server.
+            // Keep the workspace→default chain here (single team assumption)
+            // but never mix it with a recorded-socket team.
+            let backend = crate::transport_factory::tmux_workspace_transport(workspace);
+            backend
+                .inject(&target, &payload, Key::Enter, true)
+                .or_else(|_| {
+                    let backend = crate::transport_factory::tmux_default_transport();
+                    backend.inject(&target, &payload, Key::Enter, true)
+                })
+        }
+    };
 
     match inject_result {
         Ok(report) => {
@@ -367,6 +381,14 @@ pub fn deliver_to_leader_fallback_pane(
             }
         }
         Err(error) => {
+            // 0.5.5 gate054: when a leader_receiver.tmux_socket is recorded,
+            // a fallback inject error is a HARD team-boundary event — we do
+            // not cross to workspace/default tmux (see the inject_result
+            // branch above). Surface `rebind_required` so callers wire the
+            // notification status accordingly; the row stays pending in the
+            // store and the audit event carries the same forensic fields as
+            // the pre-fix path.
+            let socket_bound = leader_tmux_socket(state).is_some();
             event_log.write(
                 "leader_receiver.fallback_pane_failed",
                 serde_json::json!({
@@ -377,17 +399,28 @@ pub fn deliver_to_leader_fallback_pane(
                     "primary_error": primary_error,
                     "delivered_via": "fallback_pane",
                     "reason": error.to_string(),
+                    "socket_bound": socket_bound,
                 }),
             )?;
+            // Row status is left untouched so status/monitor surfaces the
+            // pending notification until the operator rebinds the leader.
+            let (status, channel) = if socket_bound {
+                (
+                    DeliveryStatus::Blocked,
+                    "rebind_required".to_string(),
+                )
+            } else {
+                (DeliveryStatus::Failed, "fallback_pane".to_string())
+            };
             Ok(DeliveryOutcome {
                 ok: false,
-                status: DeliveryStatus::Failed,
+                status,
                 message_status: MessageStatusShadow("failed".to_string()),
                 message_id: Some(message_id.to_string()),
                 verification: Some(error.to_string()),
                 stage: None,
                 reason: Some(DeliveryRefusal::TmuxTargetMissing),
-                channel: Some("fallback_pane".to_string()),
+                channel: Some(channel),
             })
         }
     }
@@ -445,9 +478,11 @@ pub(crate) fn leader_pane_bound_but_not_live(workspace: &Path, state: &Value) ->
 }
 
 fn leader_pane_is_live(workspace: &Path, state: &Value, pane_id: &str) -> bool {
-    // 0.5.x Phase 1d Batch 4: leader liveness uses factory tmux
-    // channel helpers. Semantics unchanged; `transport_kind`-based
-    // dispatch is the parallel feat/appserver-leader-host work.
+    // 0.5.5 gate054 boundary: when a socket is recorded, liveness is
+    // scoped to that endpoint. Never union with workspace/default targets
+    // (pane ids are only unique per tmux server; a stray same-numbered
+    // pane on another server would falsely report "live" and steer the
+    // fallback path into a cross-team inject).
     if let Some(socket) = leader_tmux_socket(state) {
         return crate::transport_factory::tmux_endpoint_transport(socket)
             .list_targets()