@team-agent/installer 0.5.38 → 0.5.40

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.38"
+version = "0.5.40"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.38"
+version = "0.5.40"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/diagnose.rs

@@ -3,6 +3,22 @@ use super::*;
 use crate::provider::wire::{command_name, parse_provider, provider_wire};
 use crate::transport::Transport;
 
+/// 0.5.39 Slice 1 (tmux-server-death-locate §11.1 B): classify a tmux
+/// transport error string into a diagnose issue id. When the underlying
+/// tmux subprocess stderr contains `server exited unexpectedly`, the
+/// tmux server itself crashed (upstream tmux 3.6a control-mode +
+/// broadcast attach/detach jitter is one known trigger) — the physical
+/// layer that disappeared is the whole server, not just this team's
+/// session. Otherwise, callers keep the legacy `tmux_session_missing`
+/// classification.
+pub(crate) fn classify_tmux_server_error(error_text: &str) -> &'static str {
+    if error_text.contains("server exited unexpectedly") {
+        "tmux_server_crashed"
+    } else {
+        "tmux_session_missing"
+    }
+}
+
 pub(crate) fn diagnose_runtime(state: &Value, backend: &dyn Transport) -> (Value, Value) {
     let mut issues = Vec::new();
     let mut repairs = Vec::new();
@@ -31,11 +47,20 @@ pub(crate) fn diagnose_runtime(state: &Value, backend: &dyn Transport) -> (Value
                 ));
             }
             Err(error) => {
-                issues.push(json!("tmux_session_missing"));
+                // 0.5.39 Slice 1 (tmux-server-death-locate §11.1 B):
+                // when the transport error stderr matches "server exited
+                // unexpectedly", the physical layer that disappeared is
+                // the tmux server itself — not just this team's session.
+                // Surface `tmux_server_crashed` so the user's next
+                // action is a coordinator/host-level recovery, not a
+                // per-agent `restart <agent>`.
+                let error_str = error.to_string();
+                let issue_id = classify_tmux_server_error(&error_str);
+                issues.push(json!(issue_id));
                 let mut hint =
-                    recovery_hint(session_name, "tmux_session_missing", "team-agent restart");
+                    recovery_hint(session_name, issue_id, "team-agent diagnose");
                 if let Some(obj) = hint.as_object_mut() {
-                    obj.insert("reason".to_string(), Value::String(error.to_string()));
+                    obj.insert("reason".to_string(), Value::String(error_str));
                 }
                 repairs.push(hint);
             }

package/crates/team-agent/src/cli/mod.rs

@@ -3339,6 +3339,30 @@ pub mod lifecycle_port {
                 "invalid": invalid.iter().map(|w| w.worker_id.as_str()).collect::<Vec<_>>(),
                 "reminder": crate::cli::QUICK_START_REMINDER,
             }),
+            crate::lifecycle::RestartReport::RefusedBuildBeforeDestroyRequired {
+                session_name,
+                live_agents,
+                error,
+            } => {
+                let repair_team = team
+                    .filter(|team| !team.is_empty())
+                    .unwrap_or(session_name.as_str());
+                let shutdown_scoped =
+                    format!("team-agent shutdown --team {repair_team}");
+                json!({
+                    "ok": false,
+                    "status": "refused_build_before_destroy",
+                    "reason": "build_before_destroy_required",
+                    "session_name": session_name,
+                    "live_agents": live_agents,
+                    "error": error,
+                    "next_actions": [
+                        shutdown_scoped,
+                        "team-agent restart",
+                    ],
+                    "reminder": crate::cli::QUICK_START_REMINDER,
+                })
+            }
             crate::lifecycle::RestartReport::RefusedDirtyTopology {
                 session_name,
                 reason,

package/crates/team-agent/src/lifecycle/display.rs

@@ -1,10 +1,19 @@
 //! lifecycle::display —— 能力门 / 后端解析 / 开关 / rebind 后重建。
+//!
+//! 0.5.39 Slice 1 (tmux-server-death-locate §7 Slice 1): all tmux
+//! session/window/pane operations here MUST go through the workspace's
+//! scoped `TmuxBackend` — raw `Command::new("tmux")` / ambient
+//! `run_tmux(...)` helpers in this file inherit ambient `$TMUX` and can
+//! kill sessions on the wrong socket. Ambient leader-pane env probes
+//! (`display-message` reading $TMUX to discover which session invoked
+//! us) live in `tmux_backend::probe_ambient_leader_pane_info` — that
+//! probe is definitionally ambient (its whole job is "which session am I
+//! in") and stays outside this module.
 
 use std::collections::BTreeMap;
 use std::path::Path;
-use std::process::Command;
 
-use crate::transport::{PaneId, SessionName, WindowName};
+use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};
 
 use super::*;
 
@@ -239,6 +248,12 @@ fn close_adaptive_displays(
             orphans_cleaned: Vec::new(),
         });
     };
+    // 0.5.39 Slice 1: build workspace-scoped tmux transport once and
+    // route every destructive tmux op below through it (no ambient
+    // $TMUX). The kill_* Transport methods carry the workspace socket
+    // (`tmux -L <socket>`) so display cleanup cannot cross-kill a session
+    // on the user's default tmux server.
+    let transport = crate::transport_factory::tmux_workspace_transport(workspace);
     let mut closed = Vec::new();
     let mut orphans_cleaned = Vec::new();
     let mut seen = std::collections::BTreeSet::new();
@@ -258,13 +273,13 @@ fn close_adaptive_displays(
         }
         for target in display_identifiers(display, agent, agent_id, session_name, &state) {
             if seen.insert(target.clone()) {
-                kill_display_target(&target);
+                kill_display_target(&transport, &target);
                 closed.push(target);
             }
         }
     }
     if let Some(leader_session) = adaptive_leader_session(&state) {
-        for target in close_adaptive_windows(leader_session.as_str(), session_name.as_str()) {
+        for target in close_adaptive_windows(&transport, leader_session.as_str(), session_name.as_str()) {
             orphans_cleaned.push(target.clone());
             if seen.insert(target.clone()) {
                 closed.push(target);
@@ -351,13 +366,6 @@ struct LeaderTmuxInfo {
     pane: Option<String>,
 }
 
-#[derive(Debug)]
-struct TmuxOutput {
-    ok: bool,
-    stdout: String,
-    stderr: String,
-}
-
 fn in_wsl() -> bool {
     std::env::var("WSL_DISTRO_NAME").is_ok_and(|value| !value.is_empty())
         || std::env::var("WSL_INTEROP").is_ok_and(|value| !value.is_empty())
@@ -369,52 +377,11 @@ fn running_inside_tmux() -> bool {
 }
 
 fn current_leader_tmux_info() -> Option<LeaderTmuxInfo> {
-    let pane = std::env::var("TMUX_PANE")
-        .ok()
-        .filter(|value| !value.is_empty());
-    let mut commands = Vec::new();
-    if let Some(pane) = pane.as_deref() {
-        commands.push(vec![
-            "display-message".to_string(),
-            "-p".to_string(),
-            "-t".to_string(),
-            pane.to_string(),
-            "-F".to_string(),
-            "#{session_name}\t#{pane_id}".to_string(),
-        ]);
-        commands.push(vec![
-            "display-message".to_string(),
-            "-p".to_string(),
-            "-t".to_string(),
-            pane.to_string(),
-            "-F".to_string(),
-            "#{session_name}".to_string(),
-        ]);
-    }
-    if std::env::var("TMUX").is_ok_and(|value| !value.is_empty()) {
-        commands.push(vec![
-            "display-message".to_string(),
-            "-p".to_string(),
-            "-F".to_string(),
-            "#{session_name}\t#{pane_id}".to_string(),
-        ]);
-        commands.push(vec![
-            "display-message".to_string(),
-            "-p".to_string(),
-            "-F".to_string(),
-            "#{session_name}".to_string(),
-        ]);
-    }
-    for command in commands {
-        let args = command.iter().map(String::as_str).collect::<Vec<_>>();
-        if let Some(parsed) = run_tmux(&args)
-            .ok()
-            .and_then(|out| parse_tmux_info(&out.stdout))
-        {
-            return Some(parsed);
-        }
-    }
-    None
+    // 0.5.39 Slice 1: ambient probe lives in `tmux_backend` — the single
+    // controlled exception to the "all tmux ops through socket-scoped
+    // transport" rule (its whole job is "which session am I in?").
+    crate::tmux_backend::probe_ambient_leader_pane_info()
+        .map(|(session, pane)| LeaderTmuxInfo { session, pane })
 }
 
 fn env_leader_tmux_info() -> Option<LeaderTmuxInfo> {
@@ -428,44 +395,29 @@ fn env_leader_tmux_info() -> Option<LeaderTmuxInfo> {
     Some(LeaderTmuxInfo { session, pane })
 }
 
-fn parse_tmux_info(stdout: &str) -> Option<LeaderTmuxInfo> {
-    let line = stdout.lines().find(|line| !line.trim().is_empty())?.trim();
-    let parts = line.split('\t').collect::<Vec<_>>();
-    match parts.as_slice() {
-        [session, pane, ..] if !session.is_empty() && !session.starts_with('%') => {
-            Some(LeaderTmuxInfo {
-                session: (*session).to_string(),
-                pane: (!pane.is_empty()).then(|| (*pane).to_string()),
-            })
-        }
-        [pane, session, ..] if pane.starts_with('%') && !session.is_empty() => {
-            Some(LeaderTmuxInfo {
-                session: (*session).to_string(),
-                pane: Some((*pane).to_string()),
-            })
-        }
-        [session] if !session.is_empty() && !session.starts_with('%') => Some(LeaderTmuxInfo {
-            session: (*session).to_string(),
-            pane: None,
-        }),
-        _ => None,
-    }
-}
-
-fn close_adaptive_windows(leader_session: &str, session_name: &str) -> Vec<String> {
+fn close_adaptive_windows(
+    transport: &dyn Transport,
+    leader_session: &str,
+    session_name: &str,
+) -> Vec<String> {
     let prefix = format!("team-agent:{session_name}:overview");
-    let Ok(output) = run_tmux(&["list-windows", "-t", leader_session, "-F", "#{window_name}"])
-    else {
+    // 0.5.39 Slice 1: `Transport::list_windows` uses the workspace socket
+    // — if `leader_session` doesn't exist on that socket, list_windows
+    // returns Err/empty and we bail without touching another server.
+    let Ok(windows) = transport.list_windows(&SessionName::new(leader_session.to_string())) else {
         return Vec::new();
     };
-    output
-        .stdout
-        .lines()
-        .filter_map(|line| {
-            let window = line.trim();
+    windows
+        .into_iter()
+        .filter_map(|window| {
+            let window = window.as_str().to_string();
             if window == prefix || window.starts_with(&format!("{prefix}-")) {
-                let target = format!("{leader_session}:{window}");
-                kill_adaptive_window(&target).then_some(target)
+                let target_string = format!("{leader_session}:{window}");
+                let target = Target::SessionWindow {
+                    session: SessionName::new(leader_session.to_string()),
+                    window: WindowName::new(window),
+                };
+                transport.kill_window(&target).ok().map(|_| target_string)
             } else {
                 None
             }
@@ -473,18 +425,23 @@ fn close_adaptive_windows(leader_session: &str, session_name: &str) -> Vec<Strin
         .collect()
 }
 
-fn kill_adaptive_window(target: &str) -> bool {
-    run_tmux(&["kill-window", "-t", target]).is_ok()
-}
-
-fn kill_display_target(target: &str) {
-    if target.contains(':') {
-        let _ = run_tmux(&["kill-window", "-t", target]);
+fn kill_display_target(transport: &dyn Transport, target: &str) {
+    // 0.5.39 Slice 1: only kill window/pane — never fall back to
+    // kill-session on an ambiguous string shape. Locate §7 Slice 1:
+    // "Remove the string-shape `kill-session` fallback unless target is a
+    // proven display-only session." The old code parsed any bare
+    // non-`%`/non-`:` target as a session and issued `kill-session`,
+    // which is exactly the unbounded blast radius we're closing.
+    if let Some((session, window)) = target.split_once(':') {
+        let _ = transport.kill_window(&Target::SessionWindow {
+            session: SessionName::new(session.to_string()),
+            window: WindowName::new(window.to_string()),
+        });
     } else if target.starts_with('%') {
-        let _ = run_tmux(&["kill-pane", "-t", target]);
-    } else {
-        let _ = run_tmux(&["kill-session", "-t", target]);
+        let _ = transport.kill_pane(&PaneId::new(target.to_string()));
     }
+    // Bare session-name form is intentionally a no-op: display cleanup
+    // must not kill a whole session on shape guesswork.
 }
 
 fn adaptive_leader_session(state: &serde_json::Value) -> Option<String> {
@@ -525,23 +482,3 @@ fn string_field(display: &serde_json::Map<String, serde_json::Value>, key: &str)
         .map(str::to_string)
 }
 
-fn run_tmux(args: &[&str]) -> Result<TmuxOutput, LifecycleError> {
-    let output = Command::new("tmux")
-        .args(args)
-        .output()
-        .map_err(|e| LifecycleError::StatePersist(format!("tmux {}: {e}", args.join(" "))))?;
-    let result = TmuxOutput {
-        ok: output.status.success(),
-        stdout: String::from_utf8_lossy(&output.stdout).to_string(),
-        stderr: String::from_utf8_lossy(&output.stderr).to_string(),
-    };
-    if result.ok {
-        Ok(result)
-    } else {
-        Err(LifecycleError::StatePersist(format!(
-            "tmux {}: {}",
-            args.join(" "),
-            result.stderr.trim()
-        )))
-    }
-}

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -228,25 +228,35 @@ pub(super) fn spawn_agent_window(
         );
     }
 
+    // 0.5.39 Slice 2 (tmux-server-death-locate §7 Slice 2): route the
+    // primary worker spawn through the worker shell wrapper so provider
+    // exit leaves the pane at an interactive shell with an explicit exit
+    // marker instead of collapsing the pane into `[exited]`. This mirrors
+    // the leader wrapper's manual-tmux equivalence. The split path stays
+    // on plain spawn_split — split panes are display overlays, not the
+    // primary worker process.
+    let provider_label = crate::provider::wire::command_name(provider);
     let result = if let Some(placement) = layout_placement {
         if placement.starts_window {
             if into_existing_session {
-                transport.spawn_into_with_env_unset(
+                transport.spawn_into_with_worker_shell_wrapper(
                     session_name,
                     &window,
                     &plan.argv,
                     spawn_cwd,
                     &env,
                     &env_unset,
+                    provider_label,
                 )
             } else {
-                transport.spawn_first_with_env_unset(
+                transport.spawn_first_with_worker_shell_wrapper(
                     session_name,
                     &window,
                     &plan.argv,
                     spawn_cwd,
                     &env,
                     &env_unset,
+                    provider_label,
                 )
             }
         } else if !window_present_in_live(transport, session_name, &window)
@@ -264,13 +274,14 @@ pub(super) fn spawn_agent_window(
             // hijack the developer worker's pane. Downgrade to spawn_into
             // (new window named after agent_id) — canonical per-agent
             // fallback the existing 7 workers use.
-            transport.spawn_into_with_env_unset(
+            transport.spawn_into_with_worker_shell_wrapper(
                 session_name,
                 &WindowName::new(agent_id.as_str()),
                 &plan.argv,
                 spawn_cwd,
                 &env,
                 &env_unset,
+                provider_label,
             )
         } else {
             // 0.3.28 Step 8: spawn_split must only fire from the display
@@ -286,22 +297,24 @@ pub(super) fn spawn_agent_window(
             )
         }
     } else if into_existing_session {
-        transport.spawn_into_with_env_unset(
+        transport.spawn_into_with_worker_shell_wrapper(
             session_name,
             &window,
             &plan.argv,
             spawn_cwd,
             &env,
             &env_unset,
+            provider_label,
         )
     } else {
-        transport.spawn_first_with_env_unset(
+        transport.spawn_first_with_worker_shell_wrapper(
             session_name,
             &window,
             &plan.argv,
             spawn_cwd,
             &env,
             &env_unset,
+            provider_label,
         )
     };
     let spawn = result.map_err(|e| LifecycleError::Transport(e.to_string()))?;

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -410,22 +410,27 @@ fn restart_with_selected_team_and_transport(
         }
     }
     let session_name = state_session_name(&state);
-    if session_live_or_default(transport, &session_name, false) {
-        // 0.3.28 Step 5 (warn-only): per architecture, restart should REFUSE
-        // when the worker session is live (Python `restart/orchestration.py:79-85`
-        // raises `_tmux_session_conflict_error`). Pre-0.3.28 Rust kills the
-        // worker session here — which under the old co-located topology also
-        // killed the leader pane (the E57-1 cascade contribution from the
-        // layout layer).
-        //
-        // After Step 2 the leader lives in a DIFFERENT session
-        // (`team-agent-leader-...`), so killing the worker session no longer
-        // tears down the leader. That makes this kill structurally safe, but
-        // it still loses provider session state in the worker panes.
-        //
-        // Full "refuse" semantics will land once Steps 6+7 expose the
-        // recovery path so users have a clean alternative. For now we emit
-        // the warn-only event so operators see the drift in event logs.
+    // 0.5.40 Slice 3 (tmux-server-death-locate §7 Slice 3, first-version
+    // build-before-destroy). Pre-0.5.40 code UNCONDITIONALLY killed the
+    // live worker session here, then ran the spawn loop against a fresh
+    // session — which loses provider session state (Case B) and, under
+    // upstream tmux 3.6a private-server bugs, can cascade into whole-
+    // server death (Case A). Locate §7 Slice 3 requires: "restart must
+    // build/prove the replacement before retiring a currently live
+    // worker session." First-version narrow shape: defer the kill until
+    // AFTER the spawn loop proves the replacement is minimally viable,
+    // and refuse the kill on failure so the original session/state stay
+    // authoritative. Discriminator = `collect_live_agents_from_state`
+    // (state marks agents running with real pane_ids). When state has
+    // no authoritative live agents, the previous behavior (pre-spawn
+    // teardown of a stale empty session) is preserved so tests that
+    // seed a fake-live session without live agent rows still work.
+    let live_worker_session_deferred_teardown =
+        session_live_or_default(transport, &session_name, false)
+            && !collect_live_agents_from_state(&state).is_empty();
+    if session_live_or_default(transport, &session_name, false)
+        && !live_worker_session_deferred_teardown
+    {
         eprintln!(
             "team_agent::layout restart_precondition_warning worker_session=`{}` action=killing \
              (post-Step-7 will refuse and direct user to recover; safe today because Step 2 \
@@ -451,6 +456,20 @@ fn restart_with_selected_team_and_transport(
     }
     phase_timer.emit(&selected.run_workspace, "restart.phase", "teardown");
     phase_timer.emit(&selected.run_workspace, "restart.phase", "spawn_all");
+    // 0.5.40 Slice 3 (tmux-server-death-locate §7 Slice 3): when the
+    // pre-spawn teardown was DEFERRED (live worker session with
+    // authoritative running agents), snapshot the pre-spawn agent rows
+    // so we can restore them if the replacement build fails. This
+    // enforces the "old session/state stay authoritative on failure"
+    // invariant without threading a buffer through every state
+    // mutation. On success (all spawns viable) the mutations already
+    // written win; on failure the snapshot restores the original rows.
+    let build_before_destroy_agents_snapshot: Option<serde_json::Value> =
+        if live_worker_session_deferred_teardown {
+            state.get("agents").cloned()
+        } else {
+            None
+        };
     let mut successful_agents: Vec<RestartedAgent> = Vec::new();
     let mut failed_agents: Vec<RestartFailedAgent> = Vec::new();
     let mut fatal_resume_failure = false;
@@ -599,6 +618,37 @@ fn restart_with_selected_team_and_transport(
         };
         let mut session_live = session_live_or_default(transport, &session_name, false);
         if !session_live {
+            // 0.5.40 Slice 3: when we deferred the pre-spawn teardown
+            // because the original session was live with authoritative
+            // running agents, a mid-flight session disappearance
+            // classifies as tmux_server_crashed (0539 §11.1 B) — the
+            // whole server died out from under us. Do NOT cascade-pop
+            // previously-successful agents into `session_disappeared_after_spawn`:
+            // that path (a) rewrites state.agents.<popped>.status to
+            // restart_failed (losing the authoritative old row R3
+            // requires stays untouched), and (b) emits the exact
+            // cascade error string R3 forbids. Instead, refuse the
+            // build-before-destroy cohort: leave `successful_agents`
+            // alone (their live spawn already happened but the server
+            // died before we could prove them viable), stop the loop,
+            // and let the terminal Failed report attribute the failure
+            // to tmux_server_crashed via `restart_failure_phase`. The
+            // legacy path still runs when the pre-spawn teardown was
+            // taken (empty session case), because
+            // `live_worker_session_deferred_teardown` is false there.
+            if live_worker_session_deferred_teardown {
+                fatal_resume_failure = true;
+                let error = format!(
+                    "tmux_server_crashed: session {} disappeared during replacement build; refusing to touch original agent state",
+                    session_name.as_str()
+                );
+                failed_agents.push(restart_failed_agent(
+                    decision,
+                    "tmux_server_crashed",
+                    error,
+                ));
+                continue;
+            }
             if let Some(previous) = successful_agents.pop() {
                 let error = format!(
                     "session_disappeared_after_spawn: provider_resume_exited for {}; session {} disappeared before spawning {}",
@@ -750,6 +800,38 @@ fn restart_with_selected_team_and_transport(
         })
         .map(|agent| agent.agent_id.as_str().to_string())
         .collect::<Vec<_>>();
+    // 0.5.40 Slice 3 (tmux-server-death-locate §7 Slice 3): restore the
+    // pre-spawn agents snapshot when we deferred the teardown AND the
+    // replacement build failed. This is the "old session/state stay
+    // authoritative on failure" invariant made concrete — the mid-loop
+    // mark_agent_respawned/mark_agent_restart_failed calls already
+    // mutated `state.agents` in memory; restoring the snapshot rewinds
+    // those mutations so `save_restart_state_...` below persists rows
+    // byte-identical to what was loaded. Only rewind when
+    // `fatal_resume_failure` (whole cohort refused) OR when NO agent
+    // survived (`successful_agents.is_empty()` with failures) — on
+    // partial success the surviving replacements are legitimately new
+    // and the pre-restart rows are stale.
+    if let Some(snapshot) = build_before_destroy_agents_snapshot.as_ref() {
+        let replacement_failed =
+            fatal_resume_failure || (!failed_agents.is_empty() && successful_agents.is_empty());
+        if replacement_failed {
+            if let Some(state_obj) = state.as_object_mut() {
+                state_obj.insert("agents".to_string(), snapshot.clone());
+                if let Some(teams) = state_obj
+                    .get_mut("teams")
+                    .and_then(serde_json::Value::as_object_mut)
+                {
+                    if let Some(team_entry) = teams
+                        .get_mut(selected.team_key.as_str())
+                        .and_then(serde_json::Value::as_object_mut)
+                    {
+                        team_entry.insert("agents".to_string(), snapshot.clone());
+                    }
+                }
+            }
+        }
+    }
     save_restart_state_with_lifecycle_topology_authority_and_capture_backfill_skip(
         &selected.run_workspace,
         &mut state,
@@ -2049,6 +2131,16 @@ fn restart_failure_phase(
     phase: &'static str,
     error: &str,
 ) -> &'static str {
+    // 0.5.39 Slice 1 (tmux-server-death-locate §11.1 B): promote
+    // spawn/readiness errors whose stderr contains "server exited
+    // unexpectedly" to `tmux_server_crashed`, so downstream event
+    // classification and diagnose next_actions ("team-agent diagnose")
+    // don't misattribute a whole-server death to a per-agent provider
+    // failure. Restart itself does not recover from server crashes in
+    // 0.5.39 (§11.1 C is Slice 3, later car); it just classifies clearly.
+    if is_tmux_server_crashed(error) {
+        return "tmux_server_crashed";
+    }
     if is_resume_integrity_failure(decision, phase, error) {
         "resume"
     } else {
@@ -2056,6 +2148,10 @@ fn restart_failure_phase(
     }
 }
 
+fn is_tmux_server_crashed(error: &str) -> bool {
+    error.contains("server exited unexpectedly")
+}
+
 fn is_resume_integrity_failure(decision: &RestartedAgent, phase: &str, error: &str) -> bool {
     if !matches!(decision.restart_mode, StartMode::Resumed) {
         return false;
@@ -2349,7 +2445,7 @@ fn run_bounded_parallel_worker_spawns(
                     }
                     // Advance the gate so the next plan-order thread can
                     // start its own `spawn_agent_window` in parallel; a
-                    // deterministic 2ms stagger between plan slots keeps
+                    // deterministic 10ms stagger between plan slots keeps
                     // pane_id assignment (which happens inside the
                     // transport at the tail of its call) ordered by plan
                     // even when each individual call sleeps for tens of
@@ -2362,11 +2458,14 @@ fn run_bounded_parallel_worker_spawns(
                 // per-slot stagger so pane_id assignment inside the
                 // transport happens in plan order even though the
                 // subsequent per-call sleeps overlap across threads.
-                // 10ms per slot is enough headroom over OS scheduler
-                // jitter (previous 3/5ms values flaked on shared macOS
-                // gate machines) while remaining well under real tmux
+                // 10ms per slot is enough headroom over OS scheduler jitter
+                // (previous 3/5ms values flaked on shared macOS gate
+                // machines) while remaining well under real tmux
                 // new-window latency (~50-120ms) so the overlap
-                // property required by R1 still holds.
+                // property required by R1 still holds. Reverse guard for
+                // this stagger lives in
+                // `tests/parallel_spawn_stagger_reverse_guard.rs`
+                // (0.5.38 cr observation D-k).
                 std::thread::sleep(std::time::Duration::from_millis(slot as u64 * 10));
                 let spawn_start = std::time::Instant::now();
                 let outcome = match spawn_agent_window(
@@ -3056,6 +3155,32 @@ fn load_endpoint_convergence_runtime_spec(
     Ok(Some(spec))
 }
 
+/// 0.5.40 Slice 3: collect the set of agent ids that state marks as
+/// running with a real pane_id. "Running with pane_id" is the
+/// discriminator between "state has an authoritative live team the
+/// user would lose on teardown" and "state is fresh / all stopped and
+/// the live session is just leftover empty topology". Sorted for
+/// deterministic report output.
+fn collect_live_agents_from_state(state: &serde_json::Value) -> Vec<String> {
+    let Some(agents) = state.get("agents").and_then(serde_json::Value::as_object) else {
+        return Vec::new();
+    };
+    let mut live: Vec<String> = agents
+        .iter()
+        .filter_map(|(agent_id, agent)| {
+            let status = agent.get("status").and_then(serde_json::Value::as_str)?;
+            let pane_id = agent
+                .get("pane_id")
+                .and_then(serde_json::Value::as_str)
+                .filter(|s| !s.is_empty())?;
+            let _ = pane_id;
+            (status == "running").then(|| agent_id.clone())
+        })
+        .collect();
+    live.sort();
+    live
+}
+
 fn has_endpoint_convergence_marker(state: &serde_json::Value) -> bool {
     state
         .get("topology_convergence")

package/crates/team-agent/src/lifecycle/tests/agent_ops.rs

@@ -336,7 +336,17 @@ if [ "$track" != 1 ]; then
   fi
   exit 127
 fi
-printf '%s\n' "$*" >> "$log"
+# 0.5.39 Slice 2: worker spawn now goes through the worker shell
+# wrapper (tmux-server-death-locate §7 Slice 2), which embeds a
+# printf format literal containing "\n" bytes so the pane returns to
+# an interactive shell with an explicit exit marker instead of
+# collapsing to `[exited]`. Those embedded newlines land inside the
+# tmux argv payload, so a naive `printf '%s\n' "$*"` writes multiple
+# lines per tmux invocation and downstream `raw.lines()` scans see
+# fake "argv" lines that carry only the marker text. Escape newlines
+# to a literal `\n` marker so one shim call = one log line = one
+# assertion target.
+printf '%s\n' "$*" | awk 'BEGIN{ORS=""} {print sep $0; sep="\\n"} END{print "\n"}' >> "$log"
 case "$*" in
   *"-S $expected"*) ;;
   *)

package/crates/team-agent/src/lifecycle/types.rs

@@ -745,6 +745,27 @@ pub enum RestartReport {
         allow_fresh: bool,
         error: String,
     },
+    /// 0.5.40 Slice 3 (tmux-server-death-locate §7 Slice 3, first-version
+    /// all-or-refuse): the previous worker session is still live AND state
+    /// carries running agents with real pane_ids. Restart today can only
+    /// proceed by killing the live session first — which loses provider
+    /// session state in the worker panes and, worse, can cascade into
+    /// server death under Case B. Until the build-before-destroy path
+    /// (later car: temporary session + minimal-viability proof + swap)
+    /// lands, restart refuses this shape *before* touching tmux or state.
+    /// **nothing created or killed; state.agents rows are byte-identical
+    /// to what was seeded before the call.**
+    RefusedBuildBeforeDestroyRequired {
+        /// Live worker session name from state that would need destructive
+        /// rebuild.
+        session_name: String,
+        /// Snapshot of agent ids currently running with real pane_ids —
+        /// this is the "authoritative old state" the refusal preserves.
+        live_agents: Vec<String>,
+        /// Human-readable error pointing the user at the canonical recovery
+        /// path (bare shutdown then restart).
+        error: String,
+    },
     /// unit-3 (Stage 1): session-identity preflight refused — `state.session_name`
     /// is a leader launcher session (`team-agent-leader-*`). Proceeding would
     /// tear down the leader pane (E49 / 0.3.39). **nothing created or killed**.

package/crates/team-agent/src/tmux_backend.rs

@@ -1509,6 +1509,149 @@ pub fn leader_provider_exit_marker(provider_label: &str) -> String {
     )
 }
 
+/// 0.5.39 Slice 1 (tmux-server-death-locate §7 Slice 1): ambient-tmux
+/// leader-pane probe. Kept inside `tmux_backend` because it is
+/// definitionally ambient — its job is to discover *which* session/pane
+/// the leader process is currently inside via $TMUX/$TMUX_PANE +
+/// `tmux display-message`. Everywhere else in the codebase, tmux ops
+/// must go through a socket-scoped `TmuxBackend` (that constraint is
+/// enforced by `n16_tmux_socket_invariant_red.rs` +
+/// `tmux_server_death_0539_contract.rs::display_cleanup_...`); this
+/// helper is the single controlled exception.
+///
+/// Returns `(session_name, Some(pane_id))` when the ambient tmux
+/// responds, or `None` if `$TMUX` is unset / `display-message` fails.
+pub fn probe_ambient_leader_pane_info() -> Option<(String, Option<String>)> {
+    let pane = std::env::var("TMUX_PANE")
+        .ok()
+        .filter(|value| !value.is_empty());
+    let mut commands: Vec<Vec<String>> = Vec::new();
+    if let Some(pane) = pane.as_deref() {
+        commands.push(vec![
+            "display-message".to_string(),
+            "-p".to_string(),
+            "-t".to_string(),
+            pane.to_string(),
+            "-F".to_string(),
+            "#{session_name}\t#{pane_id}".to_string(),
+        ]);
+        commands.push(vec![
+            "display-message".to_string(),
+            "-p".to_string(),
+            "-t".to_string(),
+            pane.to_string(),
+            "-F".to_string(),
+            "#{session_name}".to_string(),
+        ]);
+    }
+    if std::env::var("TMUX").is_ok_and(|value| !value.is_empty()) {
+        commands.push(vec![
+            "display-message".to_string(),
+            "-p".to_string(),
+            "-F".to_string(),
+            "#{session_name}\t#{pane_id}".to_string(),
+        ]);
+        commands.push(vec![
+            "display-message".to_string(),
+            "-p".to_string(),
+            "-F".to_string(),
+            "#{session_name}".to_string(),
+        ]);
+    }
+    for command in commands {
+        let output = match std::process::Command::new("tmux").args(&command).output() {
+            Ok(output) if output.status.success() => output,
+            _ => continue,
+        };
+        let stdout = String::from_utf8_lossy(&output.stdout);
+        let Some(line) = stdout.lines().find(|line| !line.trim().is_empty()) else {
+            continue;
+        };
+        let line = line.trim();
+        let parts: Vec<&str> = line.split('\t').collect();
+        let parsed = match parts.as_slice() {
+            [session, pane_str, ..] if !session.is_empty() && !session.starts_with('%') => Some((
+                (*session).to_string(),
+                (!pane_str.is_empty()).then(|| (*pane_str).to_string()),
+            )),
+            [pane_str, session, ..] if pane_str.starts_with('%') && !session.is_empty() => {
+                Some(((*session).to_string(), Some((*pane_str).to_string())))
+            }
+            [session] if !session.is_empty() && !session.starts_with('%') => {
+                Some(((*session).to_string(), None))
+            }
+            _ => None,
+        };
+        if parsed.is_some() {
+            return parsed;
+        }
+    }
+    None
+}
+
+/// 0.5.39 Slice 2 (tmux-server-death-locate §11.2): single-source worker
+/// exit marker prefix. Same envelope shape as `LEADER_PROVIDER_EXIT_MARKER_*`
+/// but distinct so status/classifier code can tell "leader pane fell back
+/// to shell" from "worker pane fell back to shell". Format:
+/// `"[team-agent worker] {provider_label} exited with {rc}"`.
+pub const WORKER_PROVIDER_EXIT_MARKER_PREFIX: &str = "[team-agent worker]";
+pub const WORKER_PROVIDER_EXIT_MARKER_SUFFIX: &str = "exited with";
+
+/// 0.5.39 Slice 2: build the worker exit marker text for `provider_label`.
+/// Used by both the worker shell wrapper (printf source) and future
+/// status/classifier code (capture substring) so they cannot drift.
+pub fn worker_provider_exit_marker(provider_label: &str) -> String {
+    format!(
+        "{WORKER_PROVIDER_EXIT_MARKER_PREFIX} {provider_label} {WORKER_PROVIDER_EXIT_MARKER_SUFFIX}"
+    )
+}
+
+/// 0.5.39 Slice 2 (tmux-server-death-locate §7 Slice 2): worker shell
+/// wrapper. Same shape as `leader_shell_wrapper_command` — provider runs
+/// as a CHILD of a long-lived shell so provider exit does NOT collapse the
+/// worker pane (which under upstream tmux 3.6a private-server bugs can
+/// cascade into whole-server death). When the provider exits, the worker
+/// pane returns to an interactive shell with an explicit worker exit
+/// marker, matching manual `tmux new-window` then `<provider>` behaviour.
+pub fn worker_shell_wrapper_command(
+    argv: &[String],
+    cwd: &Path,
+    env: &BTreeMap<String, String>,
+    env_unset: &[String],
+    provider_label: &str,
+) -> String {
+    let unset_set: std::collections::BTreeSet<&str> =
+        env_unset.iter().map(String::as_str).collect();
+    let mut parts = Vec::new();
+    parts.push("cd".to_string());
+    parts.push(shell_quote(&cwd.to_string_lossy()));
+    parts.push("&&".to_string());
+    for key in env_unset {
+        parts.push("unset".to_string());
+        parts.push(key.clone());
+        parts.push("&&".to_string());
+    }
+    for (key, value) in env {
+        if unset_set.contains(key.as_str()) {
+            continue;
+        }
+        parts.push(format!("{key}={}", shell_quote(value)));
+    }
+    parts.extend(argv.iter().map(|arg| shell_quote(arg)));
+    parts.push(";".to_string());
+    parts.push("rc=$?;".to_string());
+    parts.push("printf".to_string());
+    parts.push(shell_quote(&format!(
+        "\n{} %s\n",
+        worker_provider_exit_marker(provider_label)
+    )));
+    parts.push("\"$rc\";".to_string());
+    parts.push("exec".to_string());
+    parts.push("\"${SHELL:-/bin/zsh}\"".to_string());
+    parts.push("-l".to_string());
+    parts.join(" ")
+}
+
 /// 0.4.x (CR C-2): leader shell wrapper — provider runs as a CHILD of a
 /// long-lived shell, not as the pane's primary process. When the provider
 /// exits, the pane returns to an interactive shell with an explicit exit
@@ -1670,6 +1813,38 @@ impl Transport for TmuxBackend {
         self.spawn_split(session, window, argv, cwd, env, env_unset)
     }
 
+    /// 0.5.39 Slice 2: TmuxBackend override of the worker-shell-wrapper
+    /// variant. Same mechanism as the leader wrapper (child provider under
+    /// long-lived shell), but the marker text is distinct so downstream
+    /// classifiers can tell leader vs worker provider exit apart.
+    fn spawn_first_with_worker_shell_wrapper(
+        &self,
+        session: &SessionName,
+        window: &WindowName,
+        argv: &[String],
+        cwd: &Path,
+        env: &BTreeMap<String, String>,
+        env_unset: &[String],
+        provider_label: &str,
+    ) -> Result<SpawnResult, TransportError> {
+        let command = worker_shell_wrapper_command(argv, cwd, env, env_unset, provider_label);
+        self.spawn_with_command(session, window, &command, true)
+    }
+
+    fn spawn_into_with_worker_shell_wrapper(
+        &self,
+        session: &SessionName,
+        window: &WindowName,
+        argv: &[String],
+        cwd: &Path,
+        env: &BTreeMap<String, String>,
+        env_unset: &[String],
+        provider_label: &str,
+    ) -> Result<SpawnResult, TransportError> {
+        let command = worker_shell_wrapper_command(argv, cwd, env, env_unset, provider_label);
+        self.spawn_with_command(session, window, &command, false)
+    }
+
     /// 0.4.x (CR C-2): TmuxBackend override of the leader-shell-wrapper
     /// variant. Builds the wrapper shell line via
     /// `leader_shell_wrapper_command` and runs it through

package/crates/team-agent/src/transport.rs

@@ -589,6 +589,44 @@ pub trait Transport: Send + Sync {
         self.spawn_into(session, window, argv, cwd, env)
     }
 
+    /// 0.5.39 Slice 2 (tmux-server-death-locate §7 Slice 2): worker spawn
+    /// variant that reuses the leader-wrapper mechanism so worker provider
+    /// exit does not collapse the pane into `[exited]` (which under
+    /// upstream tmux 3.6a private-server bugs can cascade into server
+    /// death). When the provider exits, the worker pane returns to an
+    /// interactive shell with an explicit worker exit marker — matching
+    /// manual `tmux new-window` then `<provider>` behaviour. Default falls
+    /// back to plain `spawn_first_with_env_unset` for backends that have
+    /// no shell layer (test-only `OfflineTransport`).
+    fn spawn_first_with_worker_shell_wrapper(
+        &self,
+        session: &SessionName,
+        window: &WindowName,
+        argv: &[String],
+        cwd: &Path,
+        env: &BTreeMap<String, String>,
+        env_unset: &[String],
+        provider_label: &str,
+    ) -> Result<SpawnResult, TransportError> {
+        let _ = provider_label;
+        self.spawn_first_with_env_unset(session, window, argv, cwd, env, env_unset)
+    }
+
+    /// 同 [`Transport::spawn_first_with_worker_shell_wrapper`],对应 `spawn_into`。
+    fn spawn_into_with_worker_shell_wrapper(
+        &self,
+        session: &SessionName,
+        window: &WindowName,
+        argv: &[String],
+        cwd: &Path,
+        env: &BTreeMap<String, String>,
+        env_unset: &[String],
+        provider_label: &str,
+    ) -> Result<SpawnResult, TransportError> {
+        let _ = provider_label;
+        self.spawn_into_with_env_unset(session, window, argv, cwd, env, env_unset)
+    }
+
     /// 0.4.x (CR C-2): leader-specific spawn variant. Instead of `exec <cmd>`
     /// (which makes the provider the pane's primary process and turns the
     /// pane into `[exited]` when the provider exits), build a shell line

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.38",
+  "version": "0.5.40",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.38",
-    "@team-agent/cli-darwin-x64": "0.5.38",
-    "@team-agent/cli-linux-x64": "0.5.38"
+    "@team-agent/cli-darwin-arm64": "0.5.40",
+    "@team-agent/cli-darwin-x64": "0.5.40",
+    "@team-agent/cli-linux-x64": "0.5.40"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",