@team-agent/installer 0.5.31 → 0.5.33

package/crates/team-agent/src/coordinator/tick.rs

@@ -764,9 +764,31 @@ impl Coordinator {
             // refreshed BEFORE classification (the classifier sees the updated value).
             // A non-empty but UNCHANGED capture must not dirty the state every tick
             // (P3 umbrella: steady second tick is a zero state write).
+            //
+            // 0.5.32 follow-up (`.team/artifacts/0532-r1-real-fail-triage.md` §6):
+            // fresh-cohort startup-output guard. After the restart clear helper wipes
+            // `activity`/`worker_state`/`last_output_at`/`last_output_hash`, the first
+            // non-empty pane capture (fake worker's READY line, provider startup
+            // banner) is trivially different from the missing digest. If we let it
+            // set `last_output_at=now`, classify_agent_activity falls through to
+            // `recent_provider_output => Working` even though no structural signal
+            // exists — that's the R1 real-machine false busy.
+            //
+            // Narrow gate: fresh cohort (no activity/worker_state/last_output_at
+            // /last_output_hash/current turn/task fields), no work obligation
+            // arming a real send, and no structural prompt/working signal in the
+            // capture → still update `last_output_hash` (dedup) but do NOT write
+            // `last_output_at`. The classifier then returns Uncertain=UNKNOWN,
+            // which is the honest post-clear observation. Preserves recent_provider_output
+            // for non-startup normal output (later capture has prior last_output_at
+            // or last_output_hash, so `fresh_cohort` false → gate skipped).
+            let fresh_cohort = agent_is_fresh_cohort(agent);
+            let has_structural_signal = latest_pane_signal_is_structural(&captured.text);
             let output_advanced =
                 !captured.text.is_empty() && scrollback_digest_advanced(agent, &captured.text);
-            if output_advanced {
+            let suppress_last_output_at =
+                output_advanced && fresh_cohort && !has_work_obligation && !has_structural_signal;
+            if output_advanced && !suppress_last_output_at {
                 if let Some(agent_obj) = agent.as_object_mut() {
                     agent_obj.insert(
                         "last_output_at".to_string(),
@@ -1319,7 +1341,7 @@ impl Coordinator {
     }
 
     /// `message_store_schema_health`(`lifecycle.py:197`)。DB 列兼容门:区分 pre-init 必需列缺失
-    /// (拒启)vs migratable 列缺失(可迁移)。`advanced repair-state --schema` 用其 action hint。
+    /// (拒启)vs migratable 列缺失(可迁移)。`doctor --fix-schema` 用其 action hint。
     pub fn schema_health(&self) -> SchemaHealth {
         // A-8: the gate must inspect the REAL team.db (Python lifecycle.py:197+
         // message_store_schema_health); a hardcoded ok:true left the card §89
@@ -1807,6 +1829,41 @@ fn parse_rfc3339_utc(raw: &str) -> Option<chrono::DateTime<chrono::Utc>> {
         .map(|value| value.with_timezone(&chrono::Utc))
 }
 
+/// 0.5.32 (`.team/artifacts/restart-resumed-stale-activity-locate.md` §5):
+/// return true when the rollout file's modification time is strictly older
+/// than the agent's current `spawned_at`. Used by `jsonl_activity_for_agent`
+/// to refuse classifying a pre-spawn transcript tail into fresh-cohort
+/// activity. Missing `spawned_at`, missing mtime, or unparseable timestamp
+/// → false (do not block classification; the caller keeps the pre-0.5.32
+/// behavior).
+///
+/// 0.5.33 boundary tightening (leader 派单 msg_42dbad7f2938 / earlier cr
+/// batch older-or-equal 预警): use strict `<` not `<=`. Fast machines can
+/// produce a fresh post-spawn rollout whose mtime shares the second-resolution
+/// `spawned_at`; treating "equal" as pre-spawn would wrongly reject the
+/// first post-spawn transcript record. Genuinely pre-spawn transcripts have
+/// mtime strictly before `spawned_at` and remain rejected. The equal case
+/// falls back to the classifier + pane fallback, which is the ambiguous-
+/// but-safe path.
+fn jsonl_older_than_spawn_boundary(agent: &Value, metadata: &std::fs::Metadata) -> bool {
+    let Some(spawned_at) = agent
+        .get("spawned_at")
+        .and_then(Value::as_str)
+        .and_then(parse_rfc3339_utc)
+    else {
+        return false;
+    };
+    let Ok(mtime) = metadata.modified() else {
+        return false;
+    };
+    let Ok(mtime_since_epoch) = mtime.duration_since(std::time::UNIX_EPOCH) else {
+        return false;
+    };
+    let mtime_utc =
+        chrono::DateTime::<chrono::Utc>::from(std::time::UNIX_EPOCH + mtime_since_epoch);
+    mtime_utc < spawned_at
+}
+
 fn matching_capture_pane_info(
     agent: &Value,
     session: &crate::transport::SessionName,
@@ -1902,6 +1959,16 @@ fn jsonl_activity_for_agent(agent: &Value) -> Option<crate::messaging::AgentActi
     let metadata = std::fs::metadata(&rollout_path).ok()?;
     let size = metadata.len();
     let mtime_ns = crate::coordinator::steps::abnormal::metadata_mtime_ns(&metadata)?;
+    // 0.5.32 (`.team/artifacts/restart-resumed-stale-activity-locate.md` §5):
+    // freshness gate — a rollout file whose last modification is older than
+    // the agent's current `spawned_at` cannot describe post-spawn behavior.
+    // Refusing to classify (return None) here keeps stale pre-restart
+    // Working tails from re-poisoning a fresh cohort's activity/worker_state;
+    // pane fallback in the caller is still free to produce a fresh
+    // classification when a live pane observation exists.
+    if jsonl_older_than_spawn_boundary(agent, &metadata) {
+        return None;
+    }
     if let Ok(cache) = jsonl_activity_cache().lock() {
         if let Some(entry) = cache.get(&rollout_path) {
             if entry.size == size && entry.mtime_ns == mtime_ns {
@@ -2211,6 +2278,48 @@ fn clear_awaiting_human_confirm(agent: &mut Value) {
     }
 }
 
+/// 0.5.32 follow-up (`.team/artifacts/0532-r1-real-fail-triage.md` §6/§7):
+/// "fresh cohort" = the state a restart / start-agent clear helper leaves
+/// behind, before any post-spawn tick has repopulated observations.
+/// Requires `spawned_at` present so the gate fires only for real
+/// restart/start cohorts; coordinator-only fixtures without a spawn
+/// boundary keep pre-0.5.32 pane fallback behavior (spine2 sync_health
+/// tests seed bare provider/window/pane_id and expect `last_output_at`
+/// to be recorded on the first delta).
+fn agent_is_fresh_cohort(agent: &Value) -> bool {
+    let spawned_at_present = agent
+        .get("spawned_at")
+        .and_then(Value::as_str)
+        .is_some_and(|s| !s.is_empty());
+    if !spawned_at_present {
+        return false;
+    }
+    const CLEARED_FIELDS: &[&str] = &[
+        "activity",
+        "worker_state",
+        "last_output_at",
+        "last_output_hash",
+        "current_turn_message_id",
+        "current_task_id",
+        "task_id",
+    ];
+    CLEARED_FIELDS.iter().all(|field| {
+        agent
+            .get(*field)
+            .map(|value| value.is_null())
+            .unwrap_or(true)
+    })
+}
+
+/// 0.5.32 follow-up: is there a structural pane signal in `text`?
+/// True when `latest_prompt_signal` recognizes anything (idle prompt char,
+/// working spinner/keyword, or fake READY/WORKING marker). When true, the
+/// classifier will produce a definite non-`recent_provider_output` activity
+/// on its own, so the freshness gate must not suppress `last_output_at`.
+fn latest_pane_signal_is_structural(text: &str) -> bool {
+    crate::messaging::helpers::latest_prompt_signal(text).is_some()
+}
+
 /// Python approvals/status.py:68-72 — sha256 the scrollback, compare to the stored
 /// `last_output_hash`; only a CHANGED digest counts as advanced output (and stores
 /// the new digest).

package/crates/team-agent/src/db/agent_health_capture.rs

@@ -94,3 +94,27 @@ fn delete_agent_health(workspace: &Path, agent_id: &AgentId) -> Result<(), crate
     )?;
     Ok(())
 }
+
+/// 0.5.32 (`.team/artifacts/restart-resumed-stale-activity-locate.md` §5):
+/// clear the `(owner_team_id, agent_id)` health observation row on a new
+/// worker process cohort boundary. Distinct from `delete_agent_health` (used
+/// by remove-agent rollback): this narrow helper keyed on both owner_team_id
+/// and agent_id so a sibling team with the same agent_id keeps its own row.
+/// Silently no-ops when the row is absent.
+pub fn clear_agent_health_observation(
+    workspace: &Path,
+    owner_team_id: &str,
+    agent_id: &AgentId,
+) -> Result<(), crate::db::DbError> {
+    if owner_team_id.is_empty() {
+        return Ok(());
+    }
+    let store = crate::message_store::MessageStore::open(workspace)
+        .map_err(|e| crate::db::DbError::Schema(e.to_string()))?;
+    let conn = crate::db::schema::open_db(store.db_path())?;
+    conn.execute(
+        "delete from agent_health where owner_team_id = ?1 and agent_id = ?2",
+        rusqlite::params![owner_team_id, agent_id.as_str()],
+    )?;
+    Ok(())
+}

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -284,6 +284,14 @@ pub(crate) fn start_agent_at_paths(
     // after spawn" race with coordinator and no double source of truth.
     crate::lifecycle::launch::annotate_runtime_tmux_endpoint(&mut state, transport, workspace);
     let team_key = restart_projection_team_key(&state, team);
+    // 0.5.32 (`.team/artifacts/restart-resumed-stale-activity-locate.md` §5):
+    // clear the matching `agent_health` observation on the new spawn cohort
+    // so five-line status summary and status --json do not surface a stale
+    // WORKING row from the pre-shutdown process. Best-effort: DB failure
+    // must not fail the start-agent path.
+    let _ = crate::db::agent_health_capture::clear_agent_health_observation(
+        workspace, &team_key, agent_id,
+    );
     let skip_capture_backfill = if matches!(
         start_mode,
         StartMode::Fresh | StartMode::FreshAfterMissingRollout
@@ -977,6 +985,12 @@ fn mark_agent_started(
             agent_id
         )));
     };
+    // 0.5.32 (`.team/artifacts/restart-resumed-stale-activity-locate.md` §5):
+    // a successful new process cohort invalidates the per-agent
+    // turn/activity observation set. Do this before overwriting the
+    // lifecycle/topology fields so absence == UNKNOWN until the next
+    // coordinator tick or pane fallback produces a post-spawn observation.
+    clear_agent_runtime_activity_observation(agent);
     // S1-CAPTURE-001 (0.4.8, CR M3 provider-agnostic): on a Fresh /
     // FreshAfterMissingRollout start, the prior session's authoritative
     // capture tuple MUST be cleared before persist_command_plan_state

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -1601,6 +1601,33 @@ pub(super) fn state_spawn_epoch_for_agent(workspace: &Path, agent_id: &AgentId)
         .unwrap_or(0)
 }
 
+/// 0.5.32 (`.team/artifacts/restart-resumed-stale-activity-locate.md` §5):
+/// clear the per-agent turn/activity observation set on a successful new
+/// worker process cohort. Called from `mark_agent_started` /
+/// `mark_agent_respawned` / `mark_fake_harness_agent_respawned`; NOT from
+/// `mark_agent_running_noop` (no new process was created there).
+///
+/// Removes only observation fields — never lifecycle/topology fields. After
+/// clearing, absence is UNKNOWN, not synthesized idle (T7 unknown-never-idle
+/// discipline); the next post-spawn tick may repopulate from JSONL freshness
+/// gate + pane fallback.
+pub(super) fn clear_agent_runtime_activity_observation(
+    agent: &mut serde_json::Map<String, serde_json::Value>,
+) {
+    for field in [
+        "activity",
+        "worker_state",
+        "last_output_at",
+        "last_output_hash",
+        "current_turn_message_id",
+        "current_task_id", // ALLOWED-LEGACY-READ (Phase-DX E2): cleanup removal of legacy display-only key on new spawn cohort; helper does not read the value.
+        "task_id",
+        "coordinator_idle_capture_next_at",
+    ] {
+        agent.remove(field);
+    }
+}
+
 #[cfg(test)]
 mod e36_transcript_backing_tests {
     use super::*;

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -433,8 +433,7 @@ fn restart_with_selected_team_and_transport(
             &decision.agent_id,
             &raw_agent,
         );
-        if endpoint_convergence_fake_harness_enabled(&state)
-            && is_fake_model_harness_agent(&agent)
+        if endpoint_convergence_fake_harness_enabled(&state) && is_fake_model_harness_agent(&agent)
         {
             write_fake_harness_spawn_argv_event(
                 &selected.run_workspace,
@@ -449,6 +448,13 @@ fn restart_with_selected_team_and_transport(
                 &session_name,
                 &selected.team_key,
             );
+            // 0.5.32: fake harness respawn shares the same spawn cohort
+            // boundary — clear the matching `agent_health` observation.
+            let _ = crate::db::agent_health_capture::clear_agent_health_observation(
+                &selected.run_workspace,
+                &selected.team_key,
+                &decision.agent_id,
+            );
             successful_agents.push(decision.clone());
             continue;
         }
@@ -556,6 +562,15 @@ fn restart_with_selected_team_and_transport(
         {
             persist_effective_approval_policy_for_restart(agent, &safety);
         }
+        // 0.5.32 (`.team/artifacts/restart-resumed-stale-activity-locate.md` §5):
+        // pair the state-side activity clear with a DB `agent_health` clear so
+        // status --json's health projection does not surface the pre-restart
+        // WORKING row. Best-effort: DB failure must not fail the restart loop.
+        let _ = crate::db::agent_health_capture::clear_agent_health_observation(
+            &selected.run_workspace,
+            &selected.team_key,
+            &decision.agent_id,
+        );
     }
     // END_B5_RESTART_ISOLATION_LOOP
     let mut topology_authority_agent_ids = successful_agents
@@ -1630,6 +1645,12 @@ fn mark_agent_respawned(
             agent_id
         )));
     };
+    // 0.5.32 (`.team/artifacts/restart-resumed-stale-activity-locate.md` §5):
+    // multi-worker restart respawn is a new process cohort; clear the
+    // per-agent turn/activity observation set before overwriting lifecycle
+    // fields so stale `activity=working` / `worker_state=BUSY` do not
+    // survive into the fresh cohort.
+    clear_agent_runtime_activity_observation(agent);
     agent.insert("status".to_string(), serde_json::json!("running"));
     agent.insert(
         "window".to_string(),
@@ -1785,6 +1806,10 @@ fn mark_fake_harness_agent_respawned(
     else {
         return;
     };
+    // 0.5.32 (`.team/artifacts/restart-resumed-stale-activity-locate.md` §5):
+    // fake harness respawn is also a new process cohort — RED fixtures must
+    // not preserve stale activity observations across restart.
+    clear_agent_runtime_activity_observation(agent);
     agent.insert("status".to_string(), serde_json::json!("running"));
     agent.insert("window".to_string(), serde_json::json!(agent_id.as_str()));
     agent.insert(

package/crates/team-agent/src/messaging/helpers.rs

@@ -168,6 +168,19 @@ pub(crate) fn latest_prompt_signal(scrollback: &str) -> Option<AgentActivity> {
         if line.contains('❯') || line.contains('›') {
             has_idle_prompt = true;
         }
+        // 0.5.32 follow-up (`0532-r1-real-fail-triage.md` §6/§7):
+        // fake provider owns explicit READY/WORKING markers (fake_worker.rs:47/59).
+        // Recognize them here as STRUCTURAL bottom-region signals so restart's
+        // first-capture READY does not fall through to `recent_provider_output`
+        // false busy. Scope: literal `TEAM_AGENT_FAKE_READY`/`TEAM_AGENT_FAKE_WORKING`
+        // tokens only — do NOT infer that arbitrary "ready" prose from real
+        // providers means idle.
+        if line.contains("TEAM_AGENT_FAKE_READY") {
+            has_idle_prompt = true;
+        }
+        if line.contains("TEAM_AGENT_FAKE_WORKING") {
+            has_live_working_indicator = true;
+        }
         // codex live spinner shapes (provider/adapter.rs:875-876 markers):
         // braille spinner, `• Working (`, `Thinking`; claude `✶`/`✢`/`✻`
         // and Claude Code tool-progress verbs. We look for STRUCTURAL

package/crates/team-agent/src/messaging/tests/main_preserved.rs

@@ -57,7 +57,7 @@ fn stuck_cancel_snapshot_delivered_message_ids_uses_golden_status_set() {
 // is `store.add_result(envelope)`'d (results.py:73) regardless of any in-flight delivery, then the
 // collection loop collects it when its task_id is a known task (state.tasks) OR message-scoped (msg_+
 // matching message). NO live in-flight task is required at ingest time. rt-host-b @ c262bf7 saw a
-// VALID envelope (validate-result accepts the same) collect to exit-1 / empty output / NOT in the
+// VALID envelope collect to exit-1 / empty output / NOT in the
 // results table — i.e. the --result-file ingest path was a no-op (results.rs once did
 // `let _ = (result_file, …)`). This pins the happy path: a valid envelope for a KNOWN task must be
 // ingested into the results table AND collected, with ok=true. (Completes the previously-deferred

package/crates/team-agent/src/packaging/mod.rs

@@ -75,7 +75,7 @@ use crate::model::enums::Provider;
 // ── REUSE — step 4 event_log(install/upgrade/repair 审计事件;原子替换的 rebuild/rollback 标记)──
 use crate::event_log::EventLog;
 
-// ── REUSE — step 5 state(uninstall「有 team 在跑勿删」判定经 state 投影;repair-state 转调)──
+// ── REUSE — step 5 state(uninstall「有 team 在跑勿删」判定经 state 投影)──
 // `state` 操作 state.json = serde_json::Value;此处仅在 fn 签名内经全限定路径引用,避免未用顶层 import。
 
 #[cfg(test)]

package/crates/team-agent/src/packaging/types.rs

@@ -400,7 +400,7 @@ pub enum PackagingError {
     /// step 3 schema/migration 转调错误。
     #[error("schema: {0}")]
     Db(#[from] DbError),
-    /// step 5 state(repair-state / team-running 判定)转调错误。
+    /// step 5 state(team-running 判定)转调错误。
     #[error("state: {0}")]
     State(String),
     /// model 校验/解析转调(版本解析等)。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.31",
+  "version": "0.5.33",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.31",
-    "@team-agent/cli-darwin-x64": "0.5.31",
-    "@team-agent/cli-linux-x64": "0.5.31"
+    "@team-agent/cli-darwin-arm64": "0.5.33",
+    "@team-agent/cli-darwin-x64": "0.5.33",
+    "@team-agent/cli-linux-x64": "0.5.33"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",

package/skills/team-agent/references/recovery-runbook.md

@@ -44,7 +44,7 @@ Fresh/reset red line:
 | Leader pane exists but messages say `leader_not_attached`, `rebind_required`, `team_owner_mismatch`, or leader 被抢 | Leader ownership or receiver binding drift | §2 L3 Claim Or Rebind Leader |
 | A live team must be recovered without losing worker context | Resume/restart path needed | §3 L2 Restart With Resume First |
 | Shutdown/restart cleanup status is ambiguous | Need residue-based truth, not a single `ok` field | §4 L1/L2 Cleanup Verification |
-| MCP tool call fails with `Transport closed` while the worker still has the payload | Provider-owned MCP stdio child died | §5 Superseded/Pending E23 Fallback Boundary |
+| MCP tool call fails with `Transport closed` while the worker still has the payload | Provider-owned MCP stdio child died | §5 MCP Transport-Dead Payload Handoff |
 
 ## 1. L1 Read-Only Triage
 
@@ -239,30 +239,15 @@ Python 0.2.11 compatibility note:
 
 - Python cleanup notes may mention direct tmux commands. They are not listed here as RS recovery prescriptions.
 
-## 5. Superseded/Pending E23 Fallback Boundary
+## 5. MCP Transport-Dead Payload Handoff
 
-[contextual: preserved] [level: L1] E23 fallback is the only narrow worker-scope exception to the normal tool boundary. It is for a current payload already in hand after a leader-bound MCP delivery failure.
+[contextual: preserved] [level: L1] If the worker already has a leader-bound payload in hand and the MCP transport dies before the normal `send` or `report_result` path can accept it, preserve the payload in a file handoff artifact and ask for leader/user recovery through the visible channel that still works.
 
-Current status:
-
-- Product implementation exists in the E23 branch for `fallback-send-leader` and `fallback-report-result`.
-- Local RS verification has covered CLI help and focused E23 tests.
-- This reference does not yet promote the fallback CLI to a general external prescription because the new documentation gate requires current-release RS validation in the Mac mini environment.
-
-Until that validation is added:
-
-- Workers should write a file handoff artifact for the current payload and ask for leader/user recovery.
-- Leaders should prefer restart/resume of the affected worker after the current payload is preserved.
-
-Do not use E23 fallback as a general message path. It does not permit arbitrary worker execution of L2/L3 recovery operations.
-
-RS verification record:
-
-- Local only at the time of this reference update: E23 focused tests and CLI help on the merged E23 documentation branch. Mac mini current-release validation is still required before adding exact fallback commands here.
+After restart/resume, use the normal MCP tool path again. Do not treat file handoff as a general message path or as permission to run arbitrary L2/L3 recovery operations.
 
 Python 0.2.11 compatibility note:
 
-- Python MCP stdio EOF had no durable reconnect. File handoff was the practical fallback. RS E23 adds product support, but this entry remains gated until real-machine validation is complete.
+- Python MCP stdio EOF had no durable reconnect. File handoff was the practical fallback.
 
 ## Held Out Of This Reference