@team-agent/installer 0.5.39 → 0.5.41

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.39"
+version = "0.5.41"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.39"
+version = "0.5.41"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/diagnose.rs

@@ -198,9 +198,86 @@ pub(crate) fn diagnose_runtime_for_workspace(
     let (mut issues, mut repairs) = diagnose_runtime(state, backend);
     append_legacy_snapshot_issue(workspace, state, &mut issues);
     append_coordinator_health_issue(workspace, state, &mut issues, &mut repairs);
+    append_runtime_bindings_stale_after_boot_issue(workspace, state, &mut issues, &mut repairs);
     (issues, repairs)
 }
 
+/// 0.5.41 Slice 1 (fault-invisibility-locate.md §5/§6.2): read the
+/// coordinator heartbeat sidecar for the last-observed host boot
+/// identity and compare it against the current host boot. If they
+/// differ, the pane/pid/session bindings in state predate the current
+/// boot — surface `runtime_bindings_stale_after_boot` with a reused
+/// `team-agent restart` hint. Read-only: no mutation. When the
+/// heartbeat is missing OR the current host boot cannot be probed,
+/// stay silent (per §8 risk note — do not guess).
+fn append_runtime_bindings_stale_after_boot_issue(
+    workspace: &std::path::Path,
+    state: &Value,
+    issues: &mut Value,
+    repairs: &mut Value,
+) {
+    let workspace_path = crate::coordinator::WorkspacePath::new(workspace.to_path_buf());
+    let Some(heartbeat) = crate::coordinator::read_coordinator_heartbeat(&workspace_path) else {
+        return;
+    };
+    let Some(recorded_host_boot) = heartbeat
+        .get("host_boot_id")
+        .and_then(Value::as_str)
+        .filter(|s| !s.is_empty() && *s != "unknown")
+    else {
+        return;
+    };
+    let Some(current_host_boot) = crate::coordinator::probe_host_boot_id() else {
+        return;
+    };
+    if current_host_boot == recorded_host_boot {
+        return;
+    }
+    // Only surface when state actually has pane/session bindings that
+    // matter — otherwise there's nothing to be stale about.
+    let has_bindings = state
+        .get("agents")
+        .and_then(Value::as_object)
+        .is_some_and(|agents| {
+            agents.values().any(|agent| {
+                agent
+                    .get("pane_id")
+                    .and_then(Value::as_str)
+                    .is_some_and(|s| !s.is_empty())
+            })
+        });
+    if !has_bindings {
+        return;
+    }
+    let session_name = state
+        .get("session_name")
+        .and_then(Value::as_str)
+        .unwrap_or("unknown");
+    if let Some(items) = issues.as_array_mut() {
+        items.push(json!({
+            "id": "runtime_bindings_stale_after_boot",
+            "session_name": session_name,
+            "recorded_host_boot_id": recorded_host_boot,
+            "current_host_boot_id": current_host_boot,
+            "details": "cached pane/pid/session bindings predate the current host boot; runtime facts are stale",
+        }));
+    }
+    if let Some(items) = repairs.as_array_mut() {
+        items.push(json!({
+            "issue": "runtime_bindings_stale_after_boot",
+            "action_required": true,
+            "advisory": false,
+            "hint_action": "team-agent restart",
+            "action": format!(
+                "runtime bindings for `{session_name}` predate the current host boot \
+                 (recorded {recorded_host_boot}, current {current_host_boot}); rerun \
+                 `team-agent restart` to rebuild the pane/pid/session tuple"
+            ),
+            "dedupe_key": "runtime_bindings_stale_after_boot",
+        }));
+    }
+}
+
 fn append_legacy_snapshot_issue(workspace: &std::path::Path, state: &Value, issues: &mut Value) {
     let Ok(Some(details)) = crate::leader::detect_dual_state_divergence(workspace, state) else {
         return;

package/crates/team-agent/src/cli/mod.rs

@@ -3339,6 +3339,30 @@ pub mod lifecycle_port {
                 "invalid": invalid.iter().map(|w| w.worker_id.as_str()).collect::<Vec<_>>(),
                 "reminder": crate::cli::QUICK_START_REMINDER,
             }),
+            crate::lifecycle::RestartReport::RefusedBuildBeforeDestroyRequired {
+                session_name,
+                live_agents,
+                error,
+            } => {
+                let repair_team = team
+                    .filter(|team| !team.is_empty())
+                    .unwrap_or(session_name.as_str());
+                let shutdown_scoped =
+                    format!("team-agent shutdown --team {repair_team}");
+                json!({
+                    "ok": false,
+                    "status": "refused_build_before_destroy",
+                    "reason": "build_before_destroy_required",
+                    "session_name": session_name,
+                    "live_agents": live_agents,
+                    "error": error,
+                    "next_actions": [
+                        shutdown_scoped,
+                        "team-agent restart",
+                    ],
+                    "reminder": crate::cli::QUICK_START_REMINDER,
+                })
+            }
             crate::lifecycle::RestartReport::RefusedDirtyTopology {
                 session_name,
                 reason,

package/crates/team-agent/src/cli/status_port.rs

@@ -36,12 +36,19 @@ use rusqlite::params;
         let undelivered_backlog = count_undelivered_backlog(&conn, owner_team_id)?;
         let session_name = state.get("session_name").cloned().unwrap_or(Value::Null);
         let tmux_present = tmux_session_present(workspace, state, session_name.as_str());
+        // 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§6.3): resolve
+        // RuntimeFreshness once and thread it through the runtime block
+        // and per-agent enrichment. This is the single-source read that
+        // makes host-boot / coordinator / provider-exit staleness win
+        // over cached state.agents and DB agent_health.
+        let freshness = compute_runtime_freshness(workspace, state, &health);
         let runtime_block = build_runtime_status_block(
             coordinator_running,
             undelivered_backlog,
             !tmux_present,
+            &freshness,
         );
-        let agents = enrich_agents(state.get("agents"), tmux_present);
+        let agents = enrich_agents(state.get("agents"), tmux_present, &freshness);
         let tasks = state
             .get("tasks")
             .cloned()
@@ -438,7 +445,88 @@ use rusqlite::params;
             .to_string()
     }
 
-    fn enrich_agents(agents: Option<&Value>, tmux_session_present: bool) -> Value {
+    /// 0.5.41 Slice 3 (fault-invisibility-locate.md §5): single-source
+    /// runtime freshness projection consumed by status/diagnose. Read-
+    /// only over existing sources (`coordinator_health`, heartbeat
+    /// sidecar, watch state); computes NO transport calls of its own.
+    #[derive(Default, Clone)]
+    pub(crate) struct RuntimeFreshness {
+        pub coordinator_service_available: bool,
+        pub host_boot_stale: bool,
+        pub host_boot_recorded: Option<String>,
+        pub host_boot_current: Option<String>,
+        pub provider_exited_agents: std::collections::BTreeSet<String>,
+    }
+
+    impl RuntimeFreshness {
+        fn host_boot_stale_reason(&self) -> Option<&'static str> {
+            self.host_boot_stale.then_some("host_boot_mismatch")
+        }
+    }
+
+    pub(crate) fn compute_runtime_freshness(
+        workspace: &Path,
+        state: &Value,
+        health: &crate::coordinator::HealthReport,
+    ) -> RuntimeFreshness {
+        let workspace_path = crate::coordinator::WorkspacePath::new(workspace.to_path_buf());
+        let heartbeat = crate::coordinator::read_coordinator_heartbeat(&workspace_path);
+        let host_boot_recorded = heartbeat
+            .as_ref()
+            .and_then(|hb| hb.get("host_boot_id"))
+            .and_then(Value::as_str)
+            .filter(|s| !s.is_empty() && *s != "unknown")
+            .map(str::to_string);
+        let host_boot_current = crate::coordinator::probe_host_boot_id();
+        let host_boot_stale = match (host_boot_recorded.as_deref(), host_boot_current.as_deref()) {
+            (Some(recorded), Some(current)) => recorded != current,
+            _ => false,
+        };
+        // Collect worker-provider-exited agents from the coordinator
+        // abnormal_exit_watch payload (0.5.41 Slice 4 writes
+        // `worker_provider_exited` / `provider_process_dead=true`
+        // there). Read from top-level `coordinator.abnormal_exit_watch`
+        // OR the team-scoped mirror `teams.<key>.coordinator...`.
+        let mut provider_exited_agents = std::collections::BTreeSet::new();
+        for path in [
+            "/coordinator/abnormal_exit_watch",
+            &format!(
+                "/teams/{}/coordinator/abnormal_exit_watch",
+                state
+                    .get("active_team_key")
+                    .and_then(Value::as_str)
+                    .unwrap_or("")
+            ),
+        ] {
+            if let Some(watch) = state.pointer(path).and_then(Value::as_object) {
+                for (agent_id, entry) in watch {
+                    let exited = entry
+                        .get("worker_provider_exited")
+                        .and_then(Value::as_bool)
+                        == Some(true)
+                        || entry.get("provider_process_dead").and_then(Value::as_bool)
+                            == Some(true)
+                        || entry.get("provider_exit_marker").is_some();
+                    if exited {
+                        provider_exited_agents.insert(agent_id.clone());
+                    }
+                }
+            }
+        }
+        RuntimeFreshness {
+            coordinator_service_available: health.service_available,
+            host_boot_stale,
+            host_boot_recorded,
+            host_boot_current,
+            provider_exited_agents,
+        }
+    }
+
+    fn enrich_agents(
+        agents: Option<&Value>,
+        tmux_session_present: bool,
+        freshness: &RuntimeFreshness,
+    ) -> Value {
         let Some(Value::Object(input)) = agents else {
             return json!({});
         };
@@ -451,15 +539,74 @@ use rusqlite::params;
                         "interacted".to_string(),
                         Value::String(interacted_marker(obj.get("first_send_at"))),
                     );
-                    if let Some(reason) =
-                        stale_reason_for_agent(&Value::Object(obj.clone()), tmux_session_present)
+                    // 0.5.41 Slice 3: order stale sources most-authoritative-first.
+                    // Host boot mismatch wins because it invalidates all cached
+                    // pane/pid/session facts. Provider-exit marker wins over
+                    // pane liveness because the wrapper leaves an interactive
+                    // shell live. Coordinator unavailability without stronger
+                    // live provider proof means DB agent_health rows are stale.
+                    // Tmux session missing keeps its existing legacy path so
+                    // pre-0.5.41 tests remain byte-identical when no new
+                    // signal fires.
+                    let has_pane_binding = agent_has_pane_fact(&Value::Object(obj.clone()));
+                    // 0.5.41 Slice 3 (fault-invisibility-locate.md §5 point 3
+                    // + §9 RED4 live-provider guard): the wrapper-era pane
+                    // liveness cannot prove provider liveness — but a state
+                    // `pane_current_command` that MATCHES the agent's provider
+                    // IS positive proof (the abnormal.rs classifier writes it
+                    // when the pane's foreground command is the provider CLI).
+                    // When that positive proof is present, no stale downgrade
+                    // fires here so the agent renders as working.
+                    let provider_command_positive_proof = provider_current_command_matches(obj);
+                    // 0.5.41 Slice 3 (0.5.35 R4 regression guard): when the
+                    // runtime classifier has already written canonical
+                    // `worker_state=UNKNOWN` / `activity.status=uncertain`,
+                    // that is the authoritative honest observation — do NOT
+                    // reclassify it as `coordinator_unavailable` stale (which
+                    // would land it in the Stopped bucket instead of Unknown).
+                    // Host-boot mismatch and provider-exited marker are
+                    // stronger, more specific signals and still win.
+                    let canonical_unknown = agent_canonical_worker_state_is_unknown(obj);
+                    let new_reason = if freshness.host_boot_stale && has_pane_binding {
+                        freshness.host_boot_stale_reason()
+                    } else if freshness.provider_exited_agents.contains(agent_id) {
+                        Some("worker_provider_exited")
+                    } else if !freshness.coordinator_service_available
+                        && has_pane_binding
+                        && !provider_command_positive_proof
+                        && !canonical_unknown
                     {
+                        Some("coordinator_unavailable")
+                    } else {
+                        None
+                    };
+                    let legacy_reason = if provider_command_positive_proof {
+                        None
+                    } else {
+                        stale_reason_for_agent(
+                            &Value::Object(obj.clone()),
+                            tmux_session_present,
+                        )
+                    };
+                    let reason = new_reason.or(legacy_reason);
+                    if let Some(reason) = reason {
                         enriched.insert("stale".to_string(), Value::Bool(true));
                         enriched.insert(
                             "stale_reason".to_string(),
                             Value::String(reason.to_string()),
                         );
-                        if !tmux_session_present {
+                        // Downgrade cached BUSY/working when the stale source is
+                        // one of the new authoritative signals OR the pre-existing
+                        // session-missing signal. Legacy code only downgraded on
+                        // !tmux_session_present; that let host_boot / provider-
+                        // exit / coord-unavailable stale rows keep raw=running.
+                        let is_new_signal = matches!(
+                            reason,
+                            "host_boot_mismatch"
+                                | "worker_provider_exited"
+                                | "coordinator_unavailable"
+                        );
+                        if !tmux_session_present || is_new_signal {
                             downgrade_stale_agent(&mut enriched);
                         }
                     }
@@ -504,6 +651,49 @@ use rusqlite::params;
         }
     }
 
+    /// 0.5.41 Slice 3 (0.5.35 R4 regression guard): true when the agent
+    /// row carries the canonical `worker_state=UNKNOWN` OR
+    /// `activity.status=uncertain` observation the runtime classifier
+    /// writes. Used to skip the coordinator-unavailable stale mark
+    /// (see `enrich_agents`) so the pre-existing R4 rendering (UNKNOWN
+    /// beats WORKING) is preserved.
+    fn agent_canonical_worker_state_is_unknown(agent: &serde_json::Map<String, Value>) -> bool {
+        let worker_state_unknown = agent
+            .get("worker_state")
+            .and_then(Value::as_str)
+            .is_some_and(|value| value.eq_ignore_ascii_case("UNKNOWN"));
+        let activity_uncertain = agent
+            .get("activity")
+            .and_then(|v| v.get("status"))
+            .and_then(Value::as_str)
+            .is_some_and(|value| value.eq_ignore_ascii_case("uncertain"));
+        worker_state_unknown || activity_uncertain
+    }
+
+    /// 0.5.41 Slice 3 (fault-invisibility-locate.md §9 RED4 live-provider
+    /// guard): true when the agent row carries a `pane_current_command`
+    /// that matches the agent's provider CLI. This is positive proof
+    /// the provider is the pane's foreground process — the abnormal.rs
+    /// classifier writes this field after the marker/current-command
+    /// check clears. When true, stale-downgrade paths in
+    /// `enrich_agents` skip so the row keeps its BUSY/working state.
+    fn provider_current_command_matches(agent: &serde_json::Map<String, Value>) -> bool {
+        let Some(command) = agent
+            .get("pane_current_command")
+            .and_then(Value::as_str)
+            .filter(|s| !s.is_empty())
+        else {
+            return false;
+        };
+        let Some(provider_wire) = agent.get("provider").and_then(Value::as_str) else {
+            return false;
+        };
+        let Some(provider) = crate::provider::wire::parse_provider(provider_wire) else {
+            return false;
+        };
+        crate::leader::command_matches_provider(provider, command)
+    }
+
     fn agent_has_pane_fact(agent: &Value) -> bool {
         ["pane_id", "window", "window_name"].iter().any(|key| {
             agent
@@ -1120,6 +1310,7 @@ use rusqlite::params;
         coordinator_running: bool,
         undelivered: i64,
         tmux_session_missing: bool,
+        freshness: &RuntimeFreshness,
     ) -> Value {
         let mut runtime = serde_json::Map::new();
         runtime.insert(
@@ -1127,11 +1318,33 @@ use rusqlite::params;
             json!({"ok": coordinator_running}),
         );
         runtime.insert("undelivered".to_string(), json!(undelivered));
+        // 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§6.3): expose
+        // typed issues on the runtime block so `status --json --detail`
+        // can be scanned for `runtime_bindings_stale_after_boot` the
+        // same way `diagnose` surfaces it. Hint precedence: session-
+        // missing > host-boot-stale > coordinator-not-running-with-
+        // backlog — most-actionable-first.
+        let mut issues: Vec<Value> = Vec::new();
+        if freshness.host_boot_stale {
+            issues.push(json!({
+                "id": "runtime_bindings_stale_after_boot",
+                "recorded_host_boot_id": freshness.host_boot_recorded,
+                "current_host_boot_id": freshness.host_boot_current,
+            }));
+        }
+        if !issues.is_empty() {
+            runtime.insert("issues".to_string(), Value::Array(issues));
+        }
         if tmux_session_missing {
             runtime.insert(
                 "hint".to_string(),
                 json!("tmux session missing — run team-agent restart"),
             );
+        } else if freshness.host_boot_stale {
+            runtime.insert(
+                "hint".to_string(),
+                json!("runtime_bindings_stale_after_boot — run team-agent restart"),
+            );
         } else if !coordinator_running && undelivered > 0 {
             runtime.insert(
                 "hint".to_string(),
@@ -1146,7 +1359,13 @@ use rusqlite::params;
     /// Whether the coordinator HealthReport reflects a running tick loop. Used by the
     /// runtime block + the hint gate.
     fn coordinator_status_running(health: &crate::coordinator::HealthReport) -> bool {
-        matches!(health.status, crate::coordinator::CoordinatorHealthStatus::Running)
+        // 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§6.3): runtime
+        // service predicate is `service_available`, not any-`Running` pid.
+        // A stale-pid daemon is CoordinatorHealthStatus::Stale (or Running
+        // with metadata_ok=false); a service-compatible newer daemon is
+        // Running + service_available=true — send/diagnose already use
+        // this same truth source, and status must agree.
+        health.service_available
     }
 
     /// Count of messages currently sitting in delivery-able backlog
@@ -1199,16 +1418,21 @@ use rusqlite::params;
             "schema": {
                 "message_store_schema_version": health.schema.schema_version,
             },
+            // 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§6.3):
+            // `service_available` is now always exposed alongside `ok`
+            // and `status` so status/diagnose consumers can share one
+            // service-availability truth without keying on the legacy
+            // `expose_binary_drift` conditional (that path only fired
+            // for the newer-daemon-preserved shape). `binary_identity_
+            // relation` moves to always-on for the same reason — RED3
+            // scans the summary for `daemon_newer_than_caller`.
+            "service_available": health.service_available,
+            "binary_identity_relation": binary_identity_relation,
         });
         if expose_binary_drift {
             if let Some(obj) = value.as_object_mut() {
                 obj.insert("wire_metadata_ok".to_string(), Value::Bool(true));
                 obj.insert("binary_identity_ok".to_string(), Value::Bool(false));
-                obj.insert(
-                    "binary_identity_relation".to_string(),
-                    Value::String(binary_identity_relation.to_string()),
-                );
-                obj.insert("service_available".to_string(), Value::Bool(true));
             }
         }
         value

package/crates/team-agent/src/cli/tests/lane_c.rs

@@ -78,9 +78,16 @@ use super::*;
                 "binary_version",
                 "schema_ok",
                 "schema_error",
-                "schema"
+                "schema",
+                // 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§6.3):
+                // service_available and binary_identity_relation are
+                // now always emitted (not only when expose_binary_drift
+                // fires) so status/diagnose share one service-
+                // availability truth.
+                "service_available",
+                "binary_identity_relation",
             ],
-            "golden coordinator_health insertion order with 0.5.18 identity fields; got {order:?}"
+            "golden coordinator_health insertion order with 0.5.41 fault-invisibility fields; got {order:?}"
         );
         assert!(
             coord.get("schema_version").is_none(),

package/crates/team-agent/src/coordinator/health.rs

@@ -99,6 +99,7 @@ pub fn start_coordinator_with_team(
             binary_path: Some(identity.binary_path),
             binary_version: Some(identity.binary_version),
             rotation_reason: None,
+            binary_identity_relation: health.binary_identity_relation,
             log: Some(coordinator_log_path(workspace)),
             schema_error: None,
             action: None,
@@ -113,6 +114,7 @@ pub fn start_coordinator_with_team(
             binary_path: Some(identity.binary_path),
             binary_version: Some(identity.binary_version),
             rotation_reason: health.metadata_mismatch_reason,
+            binary_identity_relation: health.binary_identity_relation,
             log: None,
             schema_error: health.schema.error,
             action: health.schema.action,
@@ -127,6 +129,7 @@ pub fn start_coordinator_with_team(
             binary_path: Some(identity.binary_path),
             binary_version: Some(identity.binary_version),
             rotation_reason: health.metadata_mismatch_reason,
+            binary_identity_relation: health.binary_identity_relation,
             log: None,
             schema_error: None,
             action: Some(
@@ -169,6 +172,7 @@ pub fn start_coordinator_with_team(
             binary_path: Some(identity.binary_path),
             binary_version: Some(identity.binary_version),
             rotation_reason: Some("daemon_newer_than_caller".to_string()),
+            binary_identity_relation: health.binary_identity_relation,
             log: Some(coordinator_log_path(workspace)),
             schema_error: None,
             action: None,
@@ -208,6 +212,7 @@ pub fn start_coordinator_with_team(
                 binary_path: Some(identity.binary_path),
                 binary_version: Some(identity.binary_version),
                 rotation_reason,
+                binary_identity_relation: health.binary_identity_relation,
                 log: None,
                 schema_error: None,
                 action: Some("refusing to rotate coordinator metadata that points at the caller process".to_string()),
@@ -224,6 +229,7 @@ pub fn start_coordinator_with_team(
                     binary_path: Some(identity.binary_path),
                     binary_version: Some(identity.binary_version),
                     rotation_reason,
+                    binary_identity_relation: health.binary_identity_relation,
                     log: None,
                     schema_error: None,
                     action: None,
@@ -271,6 +277,7 @@ pub fn start_coordinator_with_team(
         binary_path: Some(identity.binary_path),
         binary_version: Some(identity.binary_version),
         rotation_reason,
+        binary_identity_relation: health.binary_identity_relation,
         log: Some(log_path),
         schema_error: None,
         action: None,

package/crates/team-agent/src/coordinator/steps/abnormal.rs

@@ -43,7 +43,10 @@ pub(crate) fn detect_abnormal_exits(
                         &agent,
                         None,
                         None,
-                        ProcessLiveness::Unverifiable,
+                        process_check(
+                            ProcessLiveness::Unverifiable,
+                            "rollout_metadata_unavailable".to_string(),
+                        ),
                         None,
                         ErrorRecency::None,
                         None,
@@ -81,7 +84,10 @@ pub(crate) fn detect_abnormal_exits(
                         &agent,
                         Some(size),
                         mtime_ns,
-                        ProcessLiveness::Unverifiable,
+                        process_check(
+                            ProcessLiveness::Unverifiable,
+                            "rollout_read_failed".to_string(),
+                        ),
                         None,
                         ErrorRecency::None,
                         None,
@@ -119,7 +125,7 @@ pub(crate) fn detect_abnormal_exits(
                 &agent,
                 Some(size),
                 mtime_ns,
-                liveness.state,
+                liveness.clone(),
                 fact.as_ref().map(|f| f.signature.as_str()),
                 error_recency,
                 error_observation_key.as_deref(),
@@ -430,7 +436,16 @@ fn abnormal_watch_agents(state: &Value) -> Vec<AbnormalWatchAgent> {
 }
 
 fn agent_pid(agent: &Value) -> Option<Pid> {
-    ["provider_pid", "process_id", "pid", "child_pid", "pane_pid"]
+    // 0.5.41 Slice 4 (fault-invisibility-locate.md §5 point 3 / §6.4,
+    // 0.5.39 CR D-m): after the 0.5.39 worker shell wrapper landed,
+    // `pane_pid` is the long-lived shell — NOT the provider. Treating
+    // it as `provider pid` and probing it via `kill(0)` reports "alive"
+    // for a pane whose provider CLI already exited, which is exactly
+    // the false-BUSY that suppressed `worker_provider_exited`. Only
+    // pids we know are the provider itself (`provider_pid` /
+    // `process_id` / `pid` written by explicit spawn accounting, or
+    // `child_pid` from the transport's SpawnResult) count here.
+    ["provider_pid", "process_id", "pid", "child_pid"]
         .into_iter()
         .find_map(|key| json_u32(agent.get(key)).map(Pid::new))
 }
@@ -512,9 +527,52 @@ fn agent_process_liveness(
     targets: &[crate::transport::PaneInfo],
     transport: &dyn crate::transport::Transport,
 ) -> ProcessCheck {
+    // 0.5.41 Slice 4 (fault-invisibility-locate.md §5 point 3 / §6.4,
+    // 0.5.39 CR D-m): after the worker wrapper landed, `pane_pid` may
+    // be the long-lived shell that survived provider exit. Reordered
+    // to prefer POSITIVE provider evidence in this order:
+    //   1. Explicit provider pid (agent.pid) — set by the transport's
+    //      SpawnResult.child_pid or explicit provider_pid state field.
+    //   2. Explicit liveness field.
+    //   3. Explicit dead-status field.
+    //   4. Explicit provider current-command (state.pane_current_command).
+    //   5. Live-pane current-command matching provider = alive.
+    //   6. Live-pane current-command shell + capture-tail worker exit
+    //      marker = DEAD (positive proof provider exited).
+    //   7. Live pane, no positive evidence = Unverifiable (NOT alive,
+    //      NOT working). Legacy code returned pid_process_check(pane_pid)
+    //      here — that was the D-m false BUSY.
+    //   8. Pane / window liveness falls back on Unverifiable.
     if let Some(pid) = agent.pid {
         return pid_process_check("pid", pid);
     }
+    // 0.5.41 Slice 4 (fault-invisibility-locate.md §5 point 3 / §6.4):
+    // BEFORE consulting the loose `explicit_process_liveness` path
+    // (which happily maps state.status=`running` to Alive), probe the
+    // pane for POSITIVE provider evidence via current-command + worker
+    // exit marker. Under the 0.5.39 wrapper, `state.status=running` is
+    // administrative spawn accounting, not runtime truth — a provider
+    // may have exited into the shell fallback while state still reads
+    // running. The marker probe positively proves that case; when it
+    // fires we return Dead here instead of the false Alive further
+    // down.
+    if let Some(target) = matching_agent_target(agent, session_name, targets) {
+        if let Some(command) = target.current_command.as_deref() {
+            return pane_command_process_check_with_marker(agent, transport, target, command);
+        }
+    }
+    if let Some(command) = agent.current_command.as_deref() {
+        return command_process_check_with_marker(agent, transport, command);
+    }
+    if let Some(pane_id) = agent.pane_id.as_deref() {
+        // Even without pane current_command / matching target, try the
+        // marker probe directly — the wrapper's printf leaves the marker
+        // in the pane's capture tail whether or not the transport
+        // reports pane_current_command.
+        if let Some(check) = worker_provider_exit_marker_check(agent, transport) {
+            return check;
+        }
+    }
     if let Some(liveness) = agent.process_liveness {
         return process_check(
             liveness,
@@ -532,19 +590,15 @@ fn agent_process_liveness(
             format!("status:{}", agent.status.as_deref().unwrap_or("unknown")),
         );
     }
-    if let Some(command) = agent.current_command.as_deref() {
-        return command_process_check(agent.provider, command);
-    }
     if let Some(target) = matching_agent_target(agent, session_name, targets) {
-        if let Some(command) = target.current_command.as_deref() {
-            return pane_command_process_check(agent.provider, target, command);
-        }
-        if let Some(pid) = target.pane_pid.map(Pid::new) {
-            return pid_process_check("pane_pid", pid);
-        }
+        // Reached only when the target has no current_command AND no
+        // marker was found earlier. Legacy code returned
+        // `pid_process_check("pane_pid", pane_pid)` here — that's the
+        // wrapper shell under 0.5.39. Now Unverifiable (not-working).
+        let _ = target;
         return process_check(
             ProcessLiveness::Unverifiable,
-            "pane_present_pid_unknown".to_string(),
+            "pane_present_provider_evidence_unknown".to_string(),
         );
     }
     if let Some(pane_id) = agent.pane_id.as_deref() {
@@ -555,7 +609,7 @@ fn agent_process_liveness(
             }
             Ok(crate::transport::PaneLiveness::Live) => process_check(
                 ProcessLiveness::Unverifiable,
-                format!("pane_live_pid_unknown:{pane_id}"),
+                format!("pane_live_provider_evidence_unknown:{pane_id}"),
             ),
             Ok(crate::transport::PaneLiveness::Unknown) => process_check(
                 ProcessLiveness::Unverifiable,
@@ -577,7 +631,7 @@ fn agent_process_liveness(
     match transport.list_windows(&session) {
         Ok(windows) if windows.iter().any(|known| known.as_str() == window) => process_check(
             ProcessLiveness::Unverifiable,
-            "window_present_pid_unknown".to_string(),
+            "window_present_provider_evidence_unknown".to_string(),
         ),
         Ok(_) => process_check(ProcessLiveness::Dead, format!("window_missing:{window}")),
         Err(error) => process_check(
@@ -651,6 +705,79 @@ fn pane_command_process_check(
     }
 }
 
+/// 0.5.41 Slice 4 (fault-invisibility-locate.md §5 point 3 / §6.4):
+/// after the 0.5.39 worker wrapper landed, a pane whose current command
+/// is a shell + capture-tail contains the worker exit marker is POSITIVE
+/// proof the provider exited. Falls back to plain current-command check
+/// when a pane_id is not available for capture (state-only path).
+fn command_process_check_with_marker(
+    agent: &AbnormalWatchAgent,
+    transport: &dyn crate::transport::Transport,
+    command: &str,
+) -> ProcessCheck {
+    if crate::leader::command_matches_provider(agent.provider, command) {
+        return process_check(ProcessLiveness::Alive, format!("current_command:{command}"));
+    }
+    if let Some(check) = worker_provider_exit_marker_check(agent, transport) {
+        return check;
+    }
+    process_check(
+        ProcessLiveness::Dead,
+        format!("provider_not_foreground:{command}"),
+    )
+}
+
+fn pane_command_process_check_with_marker(
+    agent: &AbnormalWatchAgent,
+    transport: &dyn crate::transport::Transport,
+    pane: &crate::transport::PaneInfo,
+    command: &str,
+) -> ProcessCheck {
+    if crate::leader::attribute_pane_provider(pane)
+        .is_some_and(|candidate| crate::leader::provider_matches(candidate, agent.provider))
+    {
+        return process_check(ProcessLiveness::Alive, format!("current_command:{command}"));
+    }
+    if let Some(check) = worker_provider_exit_marker_check(agent, transport) {
+        return check;
+    }
+    process_check(
+        ProcessLiveness::Dead,
+        format!("provider_not_foreground:{command}"),
+    )
+}
+
+/// 0.5.41 Slice 4: probe the pane's capture-tail for the single-source
+/// worker exit marker (`tmux_backend::worker_provider_exit_marker`).
+/// Returns `Some(Dead)` when the marker is found (positive proof
+/// provider exited), or `None` when we can't run the capture (no
+/// pane_id in agent), so callers keep their default decision. Absence
+/// of marker in a valid capture is intentionally NOT `alive` (locate
+/// §8 risk: capture tail can scroll past the marker) — callers still
+/// return `Dead` for "provider not foreground" because current command
+/// already disproved provider liveness at that call site.
+fn worker_provider_exit_marker_check(
+    agent: &AbnormalWatchAgent,
+    transport: &dyn crate::transport::Transport,
+) -> Option<ProcessCheck> {
+    let pane_id_str = agent.pane_id.as_deref()?;
+    let pane = crate::transport::PaneId::new(pane_id_str);
+    let target = crate::transport::Target::Pane(pane);
+    let provider_label = crate::provider::wire::command_name(agent.provider);
+    let marker = crate::tmux_backend::worker_provider_exit_marker(provider_label);
+    let cap = transport
+        .capture(&target, crate::transport::CaptureRange::Tail(200))
+        .ok()?;
+    if cap.text.contains(&marker) {
+        Some(process_check(
+            ProcessLiveness::Dead,
+            format!("worker_provider_exited:{pane_id_str}"),
+        ))
+    } else {
+        None
+    }
+}
+
 fn process_check(state: ProcessLiveness, detail: String) -> ProcessCheck {
     ProcessCheck { state, detail }
 }
@@ -681,18 +808,26 @@ fn abnormal_watch_payload(
     agent: &AbnormalWatchAgent,
     size: Option<u64>,
     mtime_ns: Option<u64>,
-    liveness: ProcessLiveness,
+    liveness: ProcessCheck,
     signature: Option<&str>,
     error_recency: ErrorRecency,
     error_observation_key: Option<&str>,
     error: Option<String>,
 ) -> Value {
-    let liveness_wire = process_liveness_wire(liveness);
-    let dead_process = liveness == ProcessLiveness::Dead;
+    let liveness_wire = process_liveness_wire(liveness.state);
+    let dead_process = liveness.state == ProcessLiveness::Dead;
     let latest_explicit_error = signature.is_some();
-    let gate = AbnormalExitGate::new(liveness, latest_explicit_error, error_recency);
+    let gate = AbnormalExitGate::new(liveness.state, latest_explicit_error, error_recency);
     let notify = gate.should_notify_worker_abnormal_exit();
     let suppressed_reason = gate.suppressed_reason();
+    // 0.5.41 Slice 4 (fault-invisibility-locate.md §6.4): typed
+    // classification for status/render — `worker_provider_exited` is
+    // true only when Dead was proven via the capture-tail worker exit
+    // marker (detail prefix `worker_provider_exited:`). status_port's
+    // RuntimeFreshness collector reads this field to downgrade the
+    // corresponding agent row.
+    let worker_provider_exited =
+        dead_process && liveness.detail.starts_with("worker_provider_exited:");
     serde_json::json!({
         "path": agent.rollout_path_display.as_str(),
         "provider": provider_wire(agent.provider),
@@ -701,9 +836,11 @@ fn abnormal_watch_payload(
         "last_offset": size,
         "last_signature": signature,
         "last_liveness": liveness_wire,
+        "last_liveness_detail": liveness.detail,
         "dead_process": dead_process,
         "process_dead": dead_process,
         "provider_process_dead": dead_process,
+        "worker_provider_exited": worker_provider_exited,
         "latest_error": latest_explicit_error,
         "latest_explicit_error": latest_explicit_error,
         "error_recency": error_recency.as_str(),

package/crates/team-agent/src/coordinator/tick.rs

@@ -1494,10 +1494,18 @@ pub(crate) fn write_coordinator_heartbeat(
                 .map(ToString::to_string)
         })
         .unwrap_or_else(|| format!("coord_unknown_{}", pid.get()));
+    // 0.5.41 Slice 1 (fault-invisibility-locate.md §5/§6.1): stamp the
+    // host boot identity onto every heartbeat write so downstream
+    // status/diagnose can detect "all pane/pid/session bindings predate
+    // the current host boot" without inventing a new sidecar. Existing
+    // `boot_id` stays as the daemon-generation id.
+    let host_boot_id = probe_host_boot_id().unwrap_or_else(|| "unknown".to_string());
     let mut next = serde_json::json!({
         "coordinator_tick_iteration_count": next_count,
         "pid": pid.get(),
         "boot_id": boot_id,
+        "host_boot_id": host_boot_id,
+        "host_boot_time": now.clone(),
         "binary_path": identity.binary_path,
         "binary_version": identity.binary_version,
         "last_phase": last_phase,
@@ -1523,6 +1531,57 @@ fn coordinator_heartbeat_path(workspace: &WorkspacePath) -> PathBuf {
     crate::model::paths::runtime_dir(workspace.as_path()).join("coordinator_tick.json")
 }
 
+/// 0.5.41 Slice 1 (fault-invisibility-locate.md §6.1): single-helper
+/// probe for the current host boot identity. Test overrides via
+/// `TEAM_AGENT_TEST_HOST_BOOT_ID` (deterministic RED path). On real
+/// hosts, reads platform files: Linux `/proc/sys/kernel/random/boot_id`
+/// (128-bit UUID stable across the boot), macOS `sysctl kern.boottime`
+/// falls back to a formatted timestamp. Returns None when the platform
+/// signal cannot be read — the caller MUST NOT guess; downstream
+/// treats a missing/mismatched host boot separately from a matched one.
+pub(crate) fn probe_host_boot_id() -> Option<String> {
+    if let Ok(override_id) = std::env::var("TEAM_AGENT_TEST_HOST_BOOT_ID") {
+        if !override_id.is_empty() {
+            return Some(override_id);
+        }
+    }
+    // Linux: stable UUID for the current boot.
+    if let Ok(raw) = std::fs::read_to_string("/proc/sys/kernel/random/boot_id") {
+        let trimmed = raw.trim();
+        if !trimmed.is_empty() {
+            return Some(format!("linux-{trimmed}"));
+        }
+    }
+    // macOS/BSD: kern.boottime via sysctl. Cheap and root-free.
+    #[cfg(target_os = "macos")]
+    {
+        if let Ok(output) = std::process::Command::new("sysctl")
+            .args(["-n", "kern.boottime"])
+            .output()
+        {
+            if output.status.success() {
+                let text = String::from_utf8_lossy(&output.stdout);
+                let trimmed = text.trim();
+                if !trimmed.is_empty() {
+                    return Some(format!("macos-{trimmed}"));
+                }
+            }
+        }
+    }
+    None
+}
+
+/// 0.5.41 Slice 1: expose the last-written heartbeat sidecar so
+/// `cli::diagnose` / `cli::status_port` can consume it read-only. Any
+/// error (missing file, malformed JSON) returns None — callers treat
+/// that as "unknown, fall back to existing facts" per locate §8 risk
+/// note, they must never guess a stale/fresh verdict from absence.
+pub fn read_coordinator_heartbeat(workspace: &WorkspacePath) -> Option<Value> {
+    let path = coordinator_heartbeat_path(workspace);
+    let text = std::fs::read_to_string(path).ok()?;
+    serde_json::from_str(&text).ok()
+}
+
 fn read_coordinator_heartbeat_value(path: &Path) -> Value {
     std::fs::read_to_string(path)
         .ok()

package/crates/team-agent/src/coordinator/types.rs

@@ -330,6 +330,15 @@ pub struct StartReport {
     pub binary_path: Option<String>,
     pub binary_version: Option<String>,
     pub rotation_reason: Option<String>,
+    /// 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§9 RED3): typed
+    /// binary-identity relation between the caller and the daemon that
+    /// was observed. Populated on every path (unknown when the health
+    /// probe returned no metadata). Downstream `coordinator_start_
+    /// summary_value` exposes this so restart/start summaries no longer
+    /// flatten `daemon_newer_than_caller` into a plain `already_running`
+    /// (RED3: caller-older-than-daemon must remain distinguishable
+    /// from a same-binary fresh daemon).
+    pub binary_identity_relation: CoordinatorBinaryIdentityRelation,
     /// coordinator.log 路径(成功路径,`lifecycle.py:54/121`)。
     pub log: Option<PathBuf>,
     /// schema_incompatible 时的修复 hint / 失败原因。

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -410,22 +410,27 @@ fn restart_with_selected_team_and_transport(
         }
     }
     let session_name = state_session_name(&state);
-    if session_live_or_default(transport, &session_name, false) {
-        // 0.3.28 Step 5 (warn-only): per architecture, restart should REFUSE
-        // when the worker session is live (Python `restart/orchestration.py:79-85`
-        // raises `_tmux_session_conflict_error`). Pre-0.3.28 Rust kills the
-        // worker session here — which under the old co-located topology also
-        // killed the leader pane (the E57-1 cascade contribution from the
-        // layout layer).
-        //
-        // After Step 2 the leader lives in a DIFFERENT session
-        // (`team-agent-leader-...`), so killing the worker session no longer
-        // tears down the leader. That makes this kill structurally safe, but
-        // it still loses provider session state in the worker panes.
-        //
-        // Full "refuse" semantics will land once Steps 6+7 expose the
-        // recovery path so users have a clean alternative. For now we emit
-        // the warn-only event so operators see the drift in event logs.
+    // 0.5.40 Slice 3 (tmux-server-death-locate §7 Slice 3, first-version
+    // build-before-destroy). Pre-0.5.40 code UNCONDITIONALLY killed the
+    // live worker session here, then ran the spawn loop against a fresh
+    // session — which loses provider session state (Case B) and, under
+    // upstream tmux 3.6a private-server bugs, can cascade into whole-
+    // server death (Case A). Locate §7 Slice 3 requires: "restart must
+    // build/prove the replacement before retiring a currently live
+    // worker session." First-version narrow shape: defer the kill until
+    // AFTER the spawn loop proves the replacement is minimally viable,
+    // and refuse the kill on failure so the original session/state stay
+    // authoritative. Discriminator = `collect_live_agents_from_state`
+    // (state marks agents running with real pane_ids). When state has
+    // no authoritative live agents, the previous behavior (pre-spawn
+    // teardown of a stale empty session) is preserved so tests that
+    // seed a fake-live session without live agent rows still work.
+    let live_worker_session_deferred_teardown =
+        session_live_or_default(transport, &session_name, false)
+            && !collect_live_agents_from_state(&state).is_empty();
+    if session_live_or_default(transport, &session_name, false)
+        && !live_worker_session_deferred_teardown
+    {
         eprintln!(
             "team_agent::layout restart_precondition_warning worker_session=`{}` action=killing \
              (post-Step-7 will refuse and direct user to recover; safe today because Step 2 \
@@ -451,6 +456,20 @@ fn restart_with_selected_team_and_transport(
     }
     phase_timer.emit(&selected.run_workspace, "restart.phase", "teardown");
     phase_timer.emit(&selected.run_workspace, "restart.phase", "spawn_all");
+    // 0.5.40 Slice 3 (tmux-server-death-locate §7 Slice 3): when the
+    // pre-spawn teardown was DEFERRED (live worker session with
+    // authoritative running agents), snapshot the pre-spawn agent rows
+    // so we can restore them if the replacement build fails. This
+    // enforces the "old session/state stay authoritative on failure"
+    // invariant without threading a buffer through every state
+    // mutation. On success (all spawns viable) the mutations already
+    // written win; on failure the snapshot restores the original rows.
+    let build_before_destroy_agents_snapshot: Option<serde_json::Value> =
+        if live_worker_session_deferred_teardown {
+            state.get("agents").cloned()
+        } else {
+            None
+        };
     let mut successful_agents: Vec<RestartedAgent> = Vec::new();
     let mut failed_agents: Vec<RestartFailedAgent> = Vec::new();
     let mut fatal_resume_failure = false;
@@ -599,6 +618,37 @@ fn restart_with_selected_team_and_transport(
         };
         let mut session_live = session_live_or_default(transport, &session_name, false);
         if !session_live {
+            // 0.5.40 Slice 3: when we deferred the pre-spawn teardown
+            // because the original session was live with authoritative
+            // running agents, a mid-flight session disappearance
+            // classifies as tmux_server_crashed (0539 §11.1 B) — the
+            // whole server died out from under us. Do NOT cascade-pop
+            // previously-successful agents into `session_disappeared_after_spawn`:
+            // that path (a) rewrites state.agents.<popped>.status to
+            // restart_failed (losing the authoritative old row R3
+            // requires stays untouched), and (b) emits the exact
+            // cascade error string R3 forbids. Instead, refuse the
+            // build-before-destroy cohort: leave `successful_agents`
+            // alone (their live spawn already happened but the server
+            // died before we could prove them viable), stop the loop,
+            // and let the terminal Failed report attribute the failure
+            // to tmux_server_crashed via `restart_failure_phase`. The
+            // legacy path still runs when the pre-spawn teardown was
+            // taken (empty session case), because
+            // `live_worker_session_deferred_teardown` is false there.
+            if live_worker_session_deferred_teardown {
+                fatal_resume_failure = true;
+                let error = format!(
+                    "tmux_server_crashed: session {} disappeared during replacement build; refusing to touch original agent state",
+                    session_name.as_str()
+                );
+                failed_agents.push(restart_failed_agent(
+                    decision,
+                    "tmux_server_crashed",
+                    error,
+                ));
+                continue;
+            }
             if let Some(previous) = successful_agents.pop() {
                 let error = format!(
                     "session_disappeared_after_spawn: provider_resume_exited for {}; session {} disappeared before spawning {}",
@@ -750,6 +800,38 @@ fn restart_with_selected_team_and_transport(
         })
         .map(|agent| agent.agent_id.as_str().to_string())
         .collect::<Vec<_>>();
+    // 0.5.40 Slice 3 (tmux-server-death-locate §7 Slice 3): restore the
+    // pre-spawn agents snapshot when we deferred the teardown AND the
+    // replacement build failed. This is the "old session/state stay
+    // authoritative on failure" invariant made concrete — the mid-loop
+    // mark_agent_respawned/mark_agent_restart_failed calls already
+    // mutated `state.agents` in memory; restoring the snapshot rewinds
+    // those mutations so `save_restart_state_...` below persists rows
+    // byte-identical to what was loaded. Only rewind when
+    // `fatal_resume_failure` (whole cohort refused) OR when NO agent
+    // survived (`successful_agents.is_empty()` with failures) — on
+    // partial success the surviving replacements are legitimately new
+    // and the pre-restart rows are stale.
+    if let Some(snapshot) = build_before_destroy_agents_snapshot.as_ref() {
+        let replacement_failed =
+            fatal_resume_failure || (!failed_agents.is_empty() && successful_agents.is_empty());
+        if replacement_failed {
+            if let Some(state_obj) = state.as_object_mut() {
+                state_obj.insert("agents".to_string(), snapshot.clone());
+                if let Some(teams) = state_obj
+                    .get_mut("teams")
+                    .and_then(serde_json::Value::as_object_mut)
+                {
+                    if let Some(team_entry) = teams
+                        .get_mut(selected.team_key.as_str())
+                        .and_then(serde_json::Value::as_object_mut)
+                    {
+                        team_entry.insert("agents".to_string(), snapshot.clone());
+                    }
+                }
+            }
+        }
+    }
     save_restart_state_with_lifecycle_topology_authority_and_capture_backfill_skip(
         &selected.run_workspace,
         &mut state,
@@ -3073,6 +3155,32 @@ fn load_endpoint_convergence_runtime_spec(
     Ok(Some(spec))
 }
 
+/// 0.5.40 Slice 3: collect the set of agent ids that state marks as
+/// running with a real pane_id. "Running with pane_id" is the
+/// discriminator between "state has an authoritative live team the
+/// user would lose on teardown" and "state is fresh / all stopped and
+/// the live session is just leftover empty topology". Sorted for
+/// deterministic report output.
+fn collect_live_agents_from_state(state: &serde_json::Value) -> Vec<String> {
+    let Some(agents) = state.get("agents").and_then(serde_json::Value::as_object) else {
+        return Vec::new();
+    };
+    let mut live: Vec<String> = agents
+        .iter()
+        .filter_map(|(agent_id, agent)| {
+            let status = agent.get("status").and_then(serde_json::Value::as_str)?;
+            let pane_id = agent
+                .get("pane_id")
+                .and_then(serde_json::Value::as_str)
+                .filter(|s| !s.is_empty())?;
+            let _ = pane_id;
+            (status == "running").then(|| agent_id.clone())
+        })
+        .collect();
+    live.sort();
+    live
+}
+
 fn has_endpoint_convergence_marker(state: &serde_json::Value) -> bool {
     state
         .get("topology_convergence")

package/crates/team-agent/src/lifecycle/types.rs

@@ -91,6 +91,12 @@ pub struct CoordinatorStartSummary {
     pub binary_path: Option<String>,
     pub binary_version: Option<String>,
     pub rotation_reason: Option<String>,
+    /// 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§9 RED3): typed
+    /// binary-identity relation between caller and daemon that was
+    /// observed. Carried through from `StartReport` so restart/start
+    /// summaries keep `daemon_newer_than_caller` distinguishable from
+    /// a same-binary fresh daemon (both surface as `already_running`).
+    pub binary_identity_relation: String,
 }
 
 impl CoordinatorStartSummary {
@@ -102,6 +108,7 @@ impl CoordinatorStartSummary {
             binary_path: report.binary_path.clone(),
             binary_version: report.binary_version.clone(),
             rotation_reason: report.rotation_reason.clone(),
+            binary_identity_relation: report.binary_identity_relation.as_str().to_string(),
         }
     }
 }
@@ -126,6 +133,7 @@ pub fn coordinator_start_summary_value(summary: &CoordinatorStartSummary) -> ser
         "binary_path": summary.binary_path,
         "binary_version": summary.binary_version,
         "rotation_reason": summary.rotation_reason,
+        "binary_identity_relation": summary.binary_identity_relation,
     })
 }
 
@@ -745,6 +753,27 @@ pub enum RestartReport {
         allow_fresh: bool,
         error: String,
     },
+    /// 0.5.40 Slice 3 (tmux-server-death-locate §7 Slice 3, first-version
+    /// all-or-refuse): the previous worker session is still live AND state
+    /// carries running agents with real pane_ids. Restart today can only
+    /// proceed by killing the live session first — which loses provider
+    /// session state in the worker panes and, worse, can cascade into
+    /// server death under Case B. Until the build-before-destroy path
+    /// (later car: temporary session + minimal-viability proof + swap)
+    /// lands, restart refuses this shape *before* touching tmux or state.
+    /// **nothing created or killed; state.agents rows are byte-identical
+    /// to what was seeded before the call.**
+    RefusedBuildBeforeDestroyRequired {
+        /// Live worker session name from state that would need destructive
+        /// rebuild.
+        session_name: String,
+        /// Snapshot of agent ids currently running with real pane_ids —
+        /// this is the "authoritative old state" the refusal preserves.
+        live_agents: Vec<String>,
+        /// Human-readable error pointing the user at the canonical recovery
+        /// path (bare shutdown then restart).
+        error: String,
+    },
     /// unit-3 (Stage 1): session-identity preflight refused — `state.session_name`
     /// is a leader launcher session (`team-agent-leader-*`). Proceeding would
     /// tear down the leader pane (E49 / 0.3.39). **nothing created or killed**.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.39",
+  "version": "0.5.41",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.39",
-    "@team-agent/cli-darwin-x64": "0.5.39",
-    "@team-agent/cli-linux-x64": "0.5.39"
+    "@team-agent/cli-darwin-arm64": "0.5.41",
+    "@team-agent/cli-darwin-x64": "0.5.41",
+    "@team-agent/cli-linux-x64": "0.5.41"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",