@team-agent/installer 0.5.4 → 0.5.5

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.4"
+version = "0.5.5"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.4"
+version = "0.5.5"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/adapters.rs

@@ -1468,7 +1468,15 @@ fn format_inbox_human(
         for message in messages {
             let sender = message.get("sender").and_then(Value::as_str).unwrap_or("-");
             let content = message.get("content").and_then(Value::as_str).unwrap_or("");
-            lines.push(format!("- {sender}: {content}"));
+            let status = message.get("status").and_then(Value::as_str).unwrap_or("-");
+            let attempts = message
+                .get("delivery_attempts")
+                .and_then(Value::as_i64)
+                .unwrap_or(0);
+            let error = message.get("error").and_then(Value::as_str).unwrap_or("-");
+            lines.push(format!(
+                "- {sender}: {content} [status={status} attempts={attempts} error={error}]"
+            ));
         }
     }
     let pending = uncollected_result_count(workspace, owner_team_id)?;

package/crates/team-agent/src/cli/send.rs

@@ -90,9 +90,12 @@ pub fn cmd_send(args: &SendArgs) -> Result<CmdResult, CliError> {
     {
         return Ok(CmdResult::from_json(amb, args.json));
     }
-    let outcome = messaging::send_message(&selected.run_workspace, &target, &content, &opts)?;
-    let mut value = delivery_outcome_json(&outcome, &target, &content, &opts);
+    let mut outcome = messaging::send_message(&selected.run_workspace, &target, &content, &opts)?;
     if opts.watch_result {
+        outcome = observe_initial_delivery_for_watch(&selected, &target, &outcome, &opts)?;
+    }
+    let mut value = delivery_outcome_json(&outcome, &target, &content, &opts);
+    if opts.watch_result && initial_delivery_allows_watch(outcome.status) {
         if let Some(obj) = value.as_object_mut() {
             obj.insert("watch".to_string(), watch_notice_json(&target, &opts));
         }
@@ -575,6 +578,48 @@ fn primary_delivery_succeeded(status: DeliveryStatus) -> bool {
     )
 }
 
+fn initial_delivery_allows_watch(status: DeliveryStatus) -> bool {
+    matches!(
+        status,
+        DeliveryStatus::Delivered | DeliveryStatus::AlreadyDelivered
+    )
+}
+
+fn observe_initial_delivery_for_watch(
+    selected: &crate::state::selector::SelectedTeam,
+    target: &MessageTarget,
+    outcome: &DeliveryOutcome,
+    opts: &SendOptions,
+) -> Result<DeliveryOutcome, CliError> {
+    if !matches!(target, MessageTarget::Single(agent) if !agent.is_empty()) {
+        return Ok(outcome.clone());
+    }
+    if !matches!(outcome.status, DeliveryStatus::Queued) {
+        return Ok(outcome.clone());
+    }
+    let Some(message_id) = outcome.message_id.as_deref() else {
+        return Ok(outcome.clone());
+    };
+    let store = crate::message_store::MessageStore::open(&selected.run_workspace)
+        .map_err(|e| CliError::Runtime(e.to_string()))?;
+    let transport = crate::lifecycle::restart::lifecycle_worker_tmux_backend_for_selected_state(
+        &selected.run_workspace,
+        opts.team.as_ref().map(TeamKey::as_str),
+    )
+    .map_err(|e| CliError::Runtime(e.to_string()))?;
+    let event_log = crate::event_log::EventLog::new(&selected.run_workspace);
+    let state = selected_state_with_active_key(selected);
+    crate::messaging::delivery::deliver_pending_message(
+        &selected.run_workspace,
+        &store,
+        &transport,
+        message_id,
+        &event_log,
+        &state,
+    )
+    .map_err(CliError::from)
+}
+
 fn is_business_reject_text(error: &str) -> bool {
     let lower = error.to_ascii_lowercase();
     [
@@ -668,6 +713,8 @@ fn delivery_outcome_json(
     json!({
         "ok": outcome.ok,
         "status": delivery_status_wire(outcome.status),
+        "delivery_status": api_delivery_status(outcome),
+        "delivered": delivery_proven(outcome.status),
         "target": target_wire,
         "agent_id": first_target(target),
         "content_length_bytes": content.len(),
@@ -681,6 +728,26 @@ fn delivery_outcome_json(
     })
 }
 
+fn api_delivery_status(outcome: &DeliveryOutcome) -> &'static str {
+    if delivery_proven(outcome.status) {
+        return "delivered";
+    }
+    if matches!(outcome.status, DeliveryStatus::Queued) && outcome.message_status.0 == "accepted" {
+        return "pending";
+    }
+    delivery_status_wire(outcome.status)
+}
+
+fn delivery_proven(status: DeliveryStatus) -> bool {
+    matches!(
+        status,
+        DeliveryStatus::Delivered
+            | DeliveryStatus::AlreadyDelivered
+            | DeliveryStatus::BroadcastDelivered
+            | DeliveryStatus::FanoutDelivered
+    )
+}
+
 fn add_send_reminder_if_ok(value: &mut Value) {
     if value.get("ok").and_then(Value::as_bool) != Some(true) {
         return;

package/crates/team-agent/src/cli/status_port.rs

@@ -99,6 +99,7 @@ use rusqlite::params;
             "tasks": tasks,
             "messages": message_counts(&conn, owner_team_id)?,
             "queued_messages": queued_messages(&conn, owner_team_id, 8)?,
+            "pending_leader_notifications": pending_leader_notifications(&conn, owner_team_id, 8)?,
             "results": result_counts(&conn, owner_team_id)?,
             "latest_results": latest_result_summaries(&store, owner_team_id)?,
             "readiness": readiness,
@@ -639,6 +640,67 @@ use rusqlite::params;
         Ok(Value::Array(values))
     }
 
+    /// 0.5.5 gate054 round-2: leader notifications that were refused with
+    /// `rebind_required` (status=failed, error=leader_not_attached) sit as
+    /// failed rows in the store; without a dedicated status field the
+    /// operator sees only `messages.failed=N` and cannot tell that the
+    /// notifications are waiting for a rebind. This field surfaces them
+    /// alongside `queued_messages` so `attach-leader` / `takeover` is
+    /// visibly the fix. Once the pane is rebound the requeue path flips
+    /// each row back to `status=accepted` and it drops out of this list.
+    fn pending_leader_notifications(
+        conn: &rusqlite::Connection,
+        owner_team_id: Option<&str>,
+        limit: usize,
+    ) -> Result<Value, CliError> {
+        let limit = i64::try_from(limit).unwrap_or(i64::MAX);
+        let sql = match owner_team_id {
+            Some(_) => {
+                "select message_id, sender, status, error, created_at, delivery_attempts
+                 from messages
+                 where recipient = 'leader'
+                   and status = 'failed'
+                   and error = 'leader_not_attached'
+                   and owner_team_id = ?1
+                 order by created_at desc
+                 limit ?2"
+            }
+            None => {
+                "select message_id, sender, status, error, created_at, delivery_attempts
+                 from messages
+                 where recipient = 'leader'
+                   and status = 'failed'
+                   and error = 'leader_not_attached'
+                 order by created_at desc
+                 limit ?1"
+            }
+        };
+        let mut stmt = conn
+            .prepare(sql)
+            .map_err(|e| CliError::Runtime(e.to_string()))?;
+        let map_row = |row: &rusqlite::Row<'_>| {
+            Ok(json!({
+                "message_id": row.get::<_, String>(0)?,
+                "sender": row.get::<_, Option<String>>(1)?,
+                "status": row.get::<_, String>(2)?,
+                "error": row.get::<_, Option<String>>(3)?,
+                "created_at": row.get::<_, Option<String>>(4)?,
+                "delivery_attempts": row.get::<_, i64>(5)?,
+                "channel": "rebind_required",
+                "action": "run team-agent attach-leader or team-agent takeover",
+            }))
+        };
+        let rows = match owner_team_id {
+            Some(team) => stmt.query_map(params![team, limit], map_row),
+            None => stmt.query_map(params![limit], map_row),
+        }
+        .map_err(|e| CliError::Runtime(e.to_string()))?;
+        let values = rows
+            .collect::<Result<Vec<_>, _>>()
+            .map_err(|e| CliError::Runtime(e.to_string()))?;
+        Ok(Value::Array(values))
+    }
+
     /// 0.4.x: slim default compact payload — exactly 7 top-level fields.
     /// Diagnostic detail moves to `--detail`. Plan:
     /// /Users/alauda/Documents/code/team-agent-public/.team/artifacts/status-compact-plan.md

package/crates/team-agent/src/cli/tests/status_send.rs

@@ -511,33 +511,26 @@ use super::*;
     }
 
     #[test]
-    fn cmd_send_watch_result_surfaces_registered_notice() {
-        // gate CRITICAL: --watch-result -> SendOptions.watch_result=true -> send_message attaches
-        // result['watch']={status:'registered', watcher_id, task_id, agent_id, notice}
-        // (send.py:322-337). That dict MUST survive verbatim into CmdResult Json output.
+    fn cmd_send_watch_result_does_not_register_before_delivery() {
+        // 0.5.x send contract: --watch-result may only advertise a watcher after
+        // initial worker delivery is physically proven.
         let r = cmd_send(&send_args_fixture()).expect("cmd_send returns CmdResult");
         let v = match r.output {
             CmdOutput::Json(v) => v,
             other => panic!("expected Json, got {other:?}"),
         };
-        let watch = v
-            .get("watch")
-            .expect("watch_result:true MUST attach result['watch'] (send.py:326)");
-        assert_eq!(
-            watch.get("status").and_then(|s| s.as_str()),
-            Some("registered"),
-            "registered-watcher notice status must be exactly 'registered'"
+        assert!(
+            v.get("delivery_status").and_then(|s| s.as_str()).is_some(),
+            "send output must expose delivery_status; got {v}"
         );
-        assert!(watch.get("watcher_id").is_some(), "watch notice carries watcher_id");
         assert_eq!(
-            watch.get("agent_id").and_then(|s| s.as_str()),
-            Some("alice"),
-            "watch notice agent_id == the send target"
+            v.get("delivered").and_then(|s| s.as_bool()),
+            Some(false),
+            "undelivered send outcome must not look delivered"
         );
-        // non-queued notice golden bytes (send.py:335):
-        assert_eq!(
-            watch.get("notice").and_then(|s| s.as_str()),
-            Some("Team Agent will collect the result and notify the leader when this task reports completion.")
+        assert!(
+            !v.as_object().unwrap().contains_key("watch"),
+            "watch_result:true must not attach result['watch'] before delivery; got {v}"
         );
     }
 

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -143,6 +143,7 @@ pub(crate) fn start_agent_at_paths(
         if let Ok(spec) = load_team_spec(spec_workspace) {
             write_team_state(spec_workspace, &spec, &state)?;
         }
+        replay_worker_target_missing_messages(workspace, agent_id, &team_key, &state, transport)?;
         let coordinator_started = start_coordinator_for_workspace(workspace)?;
         let target = format!("{}:{window}", session_name.as_str());
         write_start_agent_noop_event(workspace, agent_id, &target, coordinator_started)?;
@@ -282,6 +283,7 @@ pub(crate) fn start_agent_at_paths(
         spawn_session_id,
         tmux_start_mode_for_spawn(&spawn, into_existing_session),
     )?;
+    replay_worker_target_missing_messages(workspace, agent_id, &team_key, &state, transport)?;
     let coordinator_started = start_coordinator_for_workspace(workspace)?;
     Ok(StartAgentOutcome::Running {
         env: AgentActionEnvelope {
@@ -297,6 +299,33 @@ pub(crate) fn start_agent_at_paths(
     })
 }
 
+fn replay_worker_target_missing_messages(
+    workspace: &Path,
+    agent_id: &AgentId,
+    team_key: &str,
+    state: &serde_json::Value,
+    transport: &dyn crate::transport::Transport,
+) -> Result<(), LifecycleError> {
+    let store = crate::message_store::MessageStore::open(workspace)
+        .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
+    let event_log = crate::event_log::EventLog::new(workspace);
+    let ids = crate::messaging::delivery::requeue_worker_target_missing_messages(
+        workspace,
+        &store,
+        &event_log,
+        agent_id.as_str(),
+        Some(team_key),
+    )
+    .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
+    if !ids.is_empty() {
+        crate::messaging::delivery::deliver_pending_messages(
+            workspace, state, transport, &event_log,
+        )
+        .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
+    }
+    Ok(())
+}
+
 fn verify_spawned_pane_matches_target(
     transport: &dyn crate::transport::Transport,
     pane: &crate::transport::PaneId,

package/crates/team-agent/src/messaging/delivery.rs

@@ -165,7 +165,7 @@ pub fn deliver_pending_message(
     };
     let attempt = if store.claim_for_delivery(message_id)? {
         message.delivery_attempts.saturating_add(1)
-    } else if message.status == "target_resolved" {
+    } else if message.status == "target_resolved" && message.error.is_some() {
         bump_delivery_attempts(store, message_id)?
     } else {
         return Ok(DeliveryOutcome {
@@ -190,6 +190,42 @@ pub fn deliver_pending_message(
             )? {
                 return Ok(outcome);
             }
+            // 0.5.4 gate054 cross-team leak fix: a `leader_receiver.status`
+            // other than `"attached"` (restart demotes killed-session receivers
+            // to `"rebind_required"` — lifecycle/restart/rebuild.rs:1311) MUST
+            // refuse delivery before any pane injection or cross-server pane-id
+            // probing. Without this gate, a stale receiver on team A's socket
+            // could otherwise fall back to the same pane id on the main tmux
+            // server (delivery.rs:1150-1201) and inject A's leader traffic into
+            // team B's leader pane. See .team/artifacts/0.5.4-gate-crossteam-notify-triage.md.
+            if let Some(status) = leader_receiver_status(state) {
+                if status != "attached" {
+                    store.mark(message_id, "failed", Some("leader_not_attached"))?;
+                    event_log.write(
+                        "leader_receiver.delivery_blocked",
+                        serde_json::json!({
+                            "message_id": message_id,
+                            "sender": message.sender,
+                            "reason": "leader_receiver_not_attached",
+                            "channel": "rebind_required",
+                            "action": "run team-agent attach-leader or team-agent takeover",
+                            "status": status,
+                        }),
+                    )?;
+                    return Ok(DeliveryOutcome {
+                        ok: false,
+                        status: DeliveryStatus::Refused,
+                        message_status: MessageStatusShadow("failed".to_string()),
+                        message_id: Some(message_id.to_string()),
+                        verification: Some(
+                            "run team-agent attach-leader or team-agent takeover".to_string(),
+                        ),
+                        stage: None,
+                        reason: Some(DeliveryRefusal::LeaderNotAttached),
+                        channel: Some("rebind_required".to_string()),
+                    });
+                }
+            }
             if crate::codex_app_server::receiver_is_app_server(receiver) {
                 return deliver_leader_via_app_server(
                     store,
@@ -288,6 +324,16 @@ pub fn deliver_pending_message(
         });
     }
     let target = resolve_inject_target(state, &message.recipient, transport, &live_targets);
+    if let Some(outcome) = block_missing_worker_target(
+        store,
+        event_log,
+        message_id,
+        &message.recipient,
+        &target,
+        &live_targets,
+    )? {
+        return Ok(outcome);
+    }
     // Contract B / MUST-10 / N31/N32: physical paste+Enter into a startup trust/update
     // menu is NOT provider delivery — the menu consumes the Enter and the task text
     // is lost (PROBE-2 root-cause). Before injection, peek at the recipient's pane for
@@ -358,6 +404,15 @@ pub fn deliver_pending_message(
                     channel: Some("rebind_required".to_string()),
                 });
             }
+            if transport_error_is_target_missing(&error) {
+                return mark_worker_target_missing(
+                    store,
+                    event_log,
+                    message_id,
+                    &message.recipient,
+                    Some(reason),
+                );
+            }
             event_log.write(
                 "send.inject_failed",
                 serde_json::json!({
@@ -574,6 +629,136 @@ pub fn deliver_pending_message(
     Ok(outcome)
 }
 
+fn block_missing_worker_target(
+    store: &MessageStore,
+    event_log: &EventLog,
+    message_id: &str,
+    recipient: &str,
+    target: &Target,
+    live_targets: &[PaneInfo],
+) -> Result<Option<DeliveryOutcome>, MessagingError> {
+    let Target::SessionWindow { session, window } = target else {
+        return Ok(None);
+    };
+    if live_targets.is_empty() {
+        return Ok(None);
+    }
+    if window.as_str().ends_with("_pane_conflicts_with_leader") {
+        return Ok(None);
+    }
+    if live_targets.iter().any(|pane| {
+        pane.session.as_str() == session.as_str()
+            && pane
+                .window_name
+                .as_ref()
+                .is_some_and(|name| name.as_str() == window.as_str())
+    }) {
+        return Ok(None);
+    }
+    mark_worker_target_missing(store, event_log, message_id, recipient, None).map(Some)
+}
+
+fn mark_worker_target_missing(
+    store: &MessageStore,
+    event_log: &EventLog,
+    message_id: &str,
+    recipient: &str,
+    verification: Option<String>,
+) -> Result<DeliveryOutcome, MessagingError> {
+    let action = format!("run team-agent start-agent {recipient} --allow-fresh");
+    store.mark(
+        message_id,
+        "queued_pane_missing",
+        Some("tmux_target_missing"),
+    )?;
+    event_log.write(
+        "send.inject_blocked",
+        serde_json::json!({
+            "message_id": message_id,
+            "recipient": recipient,
+            "reason": "tmux_target_missing",
+            "channel": "delivery_blocked",
+            "action": action,
+            "verification": verification,
+        }),
+    )?;
+    Ok(DeliveryOutcome {
+        ok: false,
+        status: DeliveryStatus::Blocked,
+        message_status: MessageStatusShadow("queued_pane_missing".to_string()),
+        message_id: Some(message_id.to_string()),
+        verification: verification.or(Some(action)),
+        stage: Some(DeliveryStage::Inject),
+        reason: Some(DeliveryRefusal::TmuxTargetMissing),
+        channel: Some("delivery_blocked".to_string()),
+    })
+}
+
+fn transport_error_is_target_missing(error: &crate::transport::TransportError) -> bool {
+    match error {
+        crate::transport::TransportError::TargetNotFound { .. } => true,
+        crate::transport::TransportError::Subprocess { stderr, .. } => {
+            let stderr = stderr.to_ascii_lowercase();
+            (stderr.contains("can't find") || stderr.contains("no such"))
+                && (stderr.contains("pane")
+                    || stderr.contains("window")
+                    || stderr.contains("session"))
+        }
+        _ => false,
+    }
+}
+
+pub fn requeue_worker_target_missing_messages(
+    workspace: &Path,
+    store: &MessageStore,
+    event_log: &EventLog,
+    recipient: &str,
+    owner_team_id: Option<&str>,
+) -> Result<Vec<String>, MessagingError> {
+    let conn = crate::db::schema::open_db(store.db_path())?;
+    let now = chrono::Utc::now().to_rfc3339();
+    let mut stmt = conn.prepare(
+        "select message_id from messages
+         where recipient = ?1
+           and status = 'queued_pane_missing'
+           and error = 'tmux_target_missing'
+           and (
+               (?2 is null and owner_team_id is null)
+               or owner_team_id = ?2
+           )
+         order by created_at, message_id",
+    )?;
+    let ids = stmt
+        .query_map(params![recipient, owner_team_id], |row| {
+            row.get::<_, String>(0)
+        })?
+        .collect::<Result<Vec<_>, _>>()?;
+    drop(stmt);
+    for message_id in &ids {
+        conn.execute(
+            "update messages
+             set status = 'accepted',
+                 error = null,
+                 updated_at = ?2
+             where message_id = ?1",
+            params![message_id, now.as_str()],
+        )?;
+    }
+    if !ids.is_empty() {
+        event_log.write(
+            "worker_receiver.blocked_messages_requeued",
+            serde_json::json!({
+                "recipient": recipient,
+                "owner_team_id": owner_team_id,
+                "count": ids.len(),
+                "message_ids": ids,
+            }),
+        )?;
+    }
+    let _ = workspace;
+    Ok(ids)
+}
+
 /// 0.3.27: promoted to pub(crate) for leader_receiver.rs verification gate.
 pub(crate) fn inject_submit_verified(report: &InjectReport) -> bool {
     match report.submit_verification {
@@ -1170,34 +1355,17 @@ fn delivery_transport_for_recipient<'a>(
     if socket == crate::tmux_backend::socket_name_for_workspace(workspace) {
         DeliveryTransport::Borrowed(product_transport)
     } else {
+        // 0.5.4 gate054 cross-team leak fix: when `leader_receiver.tmux_socket`
+        // is present and non-canonical, it is a hard channel boundary — the
+        // caller (team A on socket X) explicitly recorded which tmux server
+        // hosts its leader pane. Pane ids (`%N`) are only unique per tmux
+        // server, so probing product/default servers for the same pane id and
+        // switching transports on a match can cross the team/tmux boundary and
+        // inject A's leader traffic into team B's leader pane. If the pane is
+        // absent on the recorded endpoint, let the downstream
+        // `leader_receiver_pane_is_usable` guard produce `rebind_required`
+        // instead of falling back to another server.
         let endpoint_backend = crate::transport_factory::tmux_endpoint_transport(socket);
-        if let Some(pane_id) = pane_id {
-            if endpoint_backend
-                .list_targets()
-                .unwrap_or_default()
-                .iter()
-                .any(|target| target.pane_id.as_str() == pane_id)
-            {
-                return DeliveryTransport::Owned(Box::new(endpoint_backend));
-            }
-            if product_transport
-                .list_targets()
-                .unwrap_or_default()
-                .iter()
-                .any(|target| target.pane_id.as_str() == pane_id)
-            {
-                return DeliveryTransport::Borrowed(product_transport);
-            }
-            let default_backend = crate::transport_factory::tmux_default_transport();
-            if default_backend
-                .list_targets()
-                .unwrap_or_default()
-                .iter()
-                .any(|target| target.pane_id.as_str() == pane_id)
-            {
-                return DeliveryTransport::Owned(Box::new(default_backend));
-            }
-        }
         DeliveryTransport::Owned(Box::new(endpoint_backend))
     }
 }
@@ -1237,6 +1405,15 @@ fn leader_receiver_tmux_socket(state: &serde_json::Value) -> Option<&str> {
     leader_receiver_field(state, "tmux_socket")
 }
 
+/// 0.5.4 gate054 cross-team leak fix: read the bound `leader_receiver.status`
+/// through the same team-scope resolution as [`leader_receiver_tmux_socket`].
+/// Restart marks demoted receivers as `"rebind_required"`
+/// (lifecycle/restart/rebuild.rs:1311); delivery must refuse before injecting
+/// or cross-server pane-id probing (delivery.rs:1150-1201).
+fn leader_receiver_status(state: &serde_json::Value) -> Option<&str> {
+    leader_receiver_field(state, "status")
+}
+
 fn leader_receiver_has_noncanonical_tmux_socket(state: &serde_json::Value) -> bool {
     leader_receiver_tmux_socket(state)
         .is_some_and(|socket| socket != "default" && !std::path::Path::new(socket).is_absolute())
@@ -1494,6 +1671,7 @@ struct PendingMessage {
     task_id: Option<String>,
     owner_team_id: Option<String>,
     status: String,
+    error: Option<String>,
     delivery_attempts: u32,
 }
 
@@ -1504,7 +1682,7 @@ fn message_for_delivery(
     let conn = crate::db::schema::open_db(store.db_path())?;
     let message = conn
         .query_row(
-            "select sender, recipient, content, task_id, owner_team_id, status, delivery_attempts from messages where message_id = ?1",
+            "select sender, recipient, content, task_id, owner_team_id, status, error, delivery_attempts from messages where message_id = ?1",
             params![message_id],
             |row| {
                 Ok(PendingMessage {
@@ -1514,7 +1692,8 @@ fn message_for_delivery(
                     task_id: row.get::<_, Option<String>>(3)?,
                     owner_team_id: row.get::<_, Option<String>>(4)?,
                     status: row.get::<_, String>(5)?,
-                    delivery_attempts: row.get::<_, i64>(6)?.max(0) as u32,
+                    error: row.get::<_, Option<String>>(6)?,
+                    delivery_attempts: row.get::<_, i64>(7)?.max(0) as u32,
                 })
             },
         )

package/crates/team-agent/src/messaging/leader_receiver.rs

@@ -8,7 +8,7 @@ use serde_json::Value;
 use crate::event_log::EventLog;
 use crate::message_store::{MessageStore, NotificationClaimParams};
 use crate::model::ids::TaskId;
-use crate::transport::{InjectPayload, Key, PaneId, Target, Transport};
+use crate::transport::{InjectPayload, InjectReport, Key, PaneId, Target, Transport, TransportError};
 
 use super::helpers::MessageStatusShadow;
 use super::{DeliveryOutcome, DeliveryRefusal, DeliveryStage, DeliveryStatus, MessagingError};
@@ -286,27 +286,41 @@ pub fn deliver_to_leader_fallback_pane(
     let rendered = render_fallback_pane_message(content, message_id, primary_error);
     let target = Target::Pane(PaneId::new(&pane_id));
     let payload = InjectPayload::Text(rendered);
-    // 0.5.x Phase 1d Batch 4: leader-fallback pane inject uses the
-    // factory tmux channel helpers so `grep transport_factory::tmux_`
-    // enumerates every tmux-only leader-channel site. Semantics are
-    // identical to the previous direct `TmuxBackend::*` calls
-    // (helpers are thin wrappers). `transport_kind`-based dispatch
-    // is the parallel `feat/appserver-leader-host` work; this batch
-    // stays helper-swap only.
-    let inject_result = leader_tmux_socket(state)
-        .and_then(|socket| {
+    // 0.5.5 gate054 cross-team notify boundary: when the leader receiver
+    // has a recorded `tmux_socket` (canonical), that socket is a HARD
+    // channel boundary. Pane ids (`%N`) are only unique per tmux server,
+    // so falling back from a missing/dead pane on the recorded endpoint
+    // to the workspace-canonical or default tmux server can inject team
+    // A's leader traffic into team B's leader pane on a different socket
+    // (real-machine gate054 acceptance B-arm: private socket %1 absent
+    // after leader kill, default server's %1 was the main leader — the
+    // prior chain silently landed A's `report_result` there).
+    //
+    // Loud-not-silent (user tie-break E23 / N32): if the recorded endpoint
+    // rejects the inject we return `Blocked` with `channel=rebind_required`
+    // and audit `leader_receiver.fallback_pane_failed` — the message row
+    // stays pending in the store, coordinator surfaces the pending
+    // notification via status/monitor, and no cross-server injection is
+    // attempted.
+    let inject_result: Result<InjectReport, TransportError> = match leader_tmux_socket(state) {
+        Some(socket) => {
             let backend = crate::transport_factory::tmux_endpoint_transport(socket);
-            backend.inject(&target, &payload, Key::Enter, true).ok()
-        })
-        .map(Ok)
-        .unwrap_or_else(|| {
-            let backend = crate::transport_factory::tmux_workspace_transport(workspace);
-            backend.inject(&target, &payload, Key::Enter, true)
-        })
-        .or_else(|_| {
-            let backend = crate::transport_factory::tmux_default_transport();
             backend.inject(&target, &payload, Key::Enter, true)
-        });
+        }
+        None => {
+            // No socket recorded → legacy (pre-0.5) shape where the receiver
+            // was implicitly bound to the workspace-canonical tmux server.
+            // Keep the workspace→default chain here (single team assumption)
+            // but never mix it with a recorded-socket team.
+            let backend = crate::transport_factory::tmux_workspace_transport(workspace);
+            backend
+                .inject(&target, &payload, Key::Enter, true)
+                .or_else(|_| {
+                    let backend = crate::transport_factory::tmux_default_transport();
+                    backend.inject(&target, &payload, Key::Enter, true)
+                })
+        }
+    };
 
     match inject_result {
         Ok(report) => {
@@ -367,6 +381,14 @@ pub fn deliver_to_leader_fallback_pane(
             }
         }
         Err(error) => {
+            // 0.5.5 gate054: when a leader_receiver.tmux_socket is recorded,
+            // a fallback inject error is a HARD team-boundary event — we do
+            // not cross to workspace/default tmux (see the inject_result
+            // branch above). Surface `rebind_required` so callers wire the
+            // notification status accordingly; the row stays pending in the
+            // store and the audit event carries the same forensic fields as
+            // the pre-fix path.
+            let socket_bound = leader_tmux_socket(state).is_some();
             event_log.write(
                 "leader_receiver.fallback_pane_failed",
                 serde_json::json!({
@@ -377,17 +399,28 @@ pub fn deliver_to_leader_fallback_pane(
                     "primary_error": primary_error,
                     "delivered_via": "fallback_pane",
                     "reason": error.to_string(),
+                    "socket_bound": socket_bound,
                 }),
             )?;
+            // Row status is left untouched so status/monitor surfaces the
+            // pending notification until the operator rebinds the leader.
+            let (status, channel) = if socket_bound {
+                (
+                    DeliveryStatus::Blocked,
+                    "rebind_required".to_string(),
+                )
+            } else {
+                (DeliveryStatus::Failed, "fallback_pane".to_string())
+            };
             Ok(DeliveryOutcome {
                 ok: false,
-                status: DeliveryStatus::Failed,
+                status,
                 message_status: MessageStatusShadow("failed".to_string()),
                 message_id: Some(message_id.to_string()),
                 verification: Some(error.to_string()),
                 stage: None,
                 reason: Some(DeliveryRefusal::TmuxTargetMissing),
-                channel: Some("fallback_pane".to_string()),
+                channel: Some(channel),
             })
         }
     }
@@ -445,9 +478,11 @@ pub(crate) fn leader_pane_bound_but_not_live(workspace: &Path, state: &Value) ->
 }
 
 fn leader_pane_is_live(workspace: &Path, state: &Value, pane_id: &str) -> bool {
-    // 0.5.x Phase 1d Batch 4: leader liveness uses factory tmux
-    // channel helpers. Semantics unchanged; `transport_kind`-based
-    // dispatch is the parallel feat/appserver-leader-host work.
+    // 0.5.5 gate054 boundary: when a socket is recorded, liveness is
+    // scoped to that endpoint. Never union with workspace/default targets
+    // (pane ids are only unique per tmux server; a stray same-numbered
+    // pane on another server would falsely report "live" and steer the
+    // fallback path into a cross-team inject).
     if let Some(socket) = leader_tmux_socket(state) {
         return crate::transport_factory::tmux_endpoint_transport(socket)
             .list_targets()

package/crates/team-agent/src/messaging/tests/runtime.rs

@@ -1683,6 +1683,58 @@ fn slice1_inject_failures_are_bounded_and_stop_retrying_same_message() {
     );
 }
 
+#[test]
+fn target_missing_session_window_blocks_without_generic_inject_exhaustion() {
+    let ws = tmp_ws("targetmissing");
+    let store = store_for(&ws);
+    let log = EventLog::new(&ws);
+    let state = serde_json::json!({
+        "session_name": "team-targetmissing",
+        "leader_receiver": {"pane_id": "%leader"},
+        "agents": {"w1": {"provider": "fake", "window": "w1"}}
+    });
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+    let message_id = store
+        .create_message(None, "leader", "w1", "ping", None, false, None)
+        .unwrap();
+    let transport = OfflineTransport::new()
+        .with_session_present(true)
+        .with_targets(vec![pane_info("%2", "team-targetmissing", "other")]);
+
+    let out = deliver_pending_message(&ws, &store, &transport, &message_id, &log, &state)
+        .expect("target-missing classification should be a delivery outcome");
+
+    assert!(!out.ok);
+    assert_eq!(out.status, DeliveryStatus::Blocked);
+    assert_eq!(out.message_status.0, "queued_pane_missing");
+    assert_eq!(out.reason, Some(DeliveryRefusal::TmuxTargetMissing));
+    assert!(
+        transport.inject_targets().is_empty(),
+        "target-missing must block before physical inject; targets={:?}",
+        transport.inject_targets()
+    );
+
+    let conn = crate::db::schema::open_db(store.db_path()).unwrap();
+    let (status, error): (String, Option<String>) = conn
+        .query_row(
+            "select status, error from messages where message_id = ?1",
+            [&message_id],
+            |row| Ok((row.get(0)?, row.get(1)?)),
+        )
+        .unwrap();
+    assert_eq!(status, "queued_pane_missing");
+    assert_eq!(error.as_deref(), Some("tmux_target_missing"));
+    let events = log.tail(0).unwrap();
+    assert!(
+        events.iter().any(|event| {
+            event.get("event").and_then(serde_json::Value::as_str) == Some("send.inject_blocked")
+                && event.get("reason").and_then(serde_json::Value::as_str)
+                    == Some("tmux_target_missing")
+        }),
+        "target-missing block must be explicit in events; events={events:?}"
+    );
+}
+
 #[test]
 fn u1_projection_refused_emits_delivery_event() {
     let ws = tmp_ws("u1projref");
@@ -2730,3 +2782,397 @@ fn e15_direct_inject_is_gated_by_deliver_failure_not_unconditional() {
         "E23: private direct inject must stay deleted; all callers use deliver_to_leader_fallback_pane"
     );
 }
+
+// ════════════════════════════════════════════════════════════════════════
+// 0.5.4 gate054 — cross-team notify boundary.
+//
+// Triage: .team/artifacts/0.5.4-gate-crossteam-notify-triage.md
+//
+// Shape (regression):
+//   - Gate team's `leader_receiver` records `pane_id=%1`, `tmux_socket=/tmp/gate`,
+//     `status="rebind_required"` (disposable leader was killed post-restart).
+//   - The main tmux server has a live `%1` on the workspace-canonical socket.
+//   - `deliver_pending_message` MUST refuse with `channel=rebind_required` and
+//     MUST NOT probe the main/default tmux server for the same pane id.
+// ════════════════════════════════════════════════════════════════════════
+
+#[test]
+fn gate054_rebind_required_status_refuses_leader_delivery_without_cross_server_probe() {
+    let ws = tmp_ws("gate054status");
+    let store = store_for(&ws);
+    let log = EventLog::new(&ws);
+    // Explicit endpoint socket (non-canonical for this workspace) with a
+    // stale receiver demoted to `rebind_required` after the gate's leader
+    // window was killed.
+    let state = serde_json::json!({
+        "session_name": "team-gate054",
+        "tmux_endpoint": "/tmp/gate-socket-does-not-exist",
+        "leader_receiver": {
+            "pane_id": "%1",
+            "tmux_socket": "/tmp/gate-socket-does-not-exist",
+            "status": "rebind_required"
+        },
+        "agents": {
+            "probe": {"provider": "fake", "pane_id": "%0", "window": "probe"}
+        }
+    });
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+    let message_id = store
+        .create_message(
+            None,
+            "probe",
+            "leader",
+            "gate054 must not leak",
+            None,
+            false,
+            None,
+        )
+        .unwrap();
+
+    // The transport we pass is the "main"/default server backend which does
+    // have a live `%1`. If the fix regresses and delivery falls back cross-
+    // server by pane id, it would inject here.
+    let default_backend = OfflineTransport::new()
+        .with_targets(vec![pane_info("%1", "team-main", "leader")]);
+
+    let out = deliver_pending_message(&ws, &store, &default_backend, &message_id, &log, &state)
+        .expect("status guard must be a business refusal, not panic");
+
+    assert!(
+        !out.ok,
+        "0.5.4 gate054: leader_receiver.status='rebind_required' must refuse delivery"
+    );
+    assert_eq!(out.channel.as_deref(), Some("rebind_required"));
+    assert_eq!(out.message_status.0, "failed");
+    assert_eq!(out.reason, Some(DeliveryRefusal::LeaderNotAttached));
+    // Cross-server invariant: even though the default backend has a live `%1`
+    // matching the recorded receiver pane id, delivery MUST NOT inject there.
+    assert!(
+        default_backend.inject_targets().is_empty(),
+        "0.5.4 gate054: leader delivery must not cross to a different tmux server by pane id; \
+         inject_targets={:?}",
+        default_backend.inject_targets()
+    );
+    let events = log.tail(0).unwrap();
+    assert!(
+        events.iter().any(|event| {
+            event.get("event").and_then(serde_json::Value::as_str)
+                == Some("leader_receiver.delivery_blocked")
+                && event.get("reason").and_then(serde_json::Value::as_str)
+                    == Some("leader_receiver_not_attached")
+                && event.get("channel").and_then(serde_json::Value::as_str)
+                    == Some("rebind_required")
+                && event.get("status").and_then(serde_json::Value::as_str)
+                    == Some("rebind_required")
+        }),
+        "0.5.4 gate054: refused status must audit as leader_receiver_not_attached / rebind_required; events={events:?}"
+    );
+}
+
+#[test]
+fn gate054_attached_status_still_delivers_when_pane_is_live() {
+    // Companion negative: prove the new status gate does NOT over-refuse when
+    // `status="attached"` and the workspace-canonical socket has the pane.
+    let ws = tmp_ws("gate054ok");
+    let store = store_for(&ws);
+    let log = EventLog::new(&ws);
+    let state = serde_json::json!({
+        "session_name": "team-gate054ok",
+        "leader_receiver": {
+            "pane_id": "%leader",
+            "status": "attached"
+        },
+        "agents": {"w1": {"provider": "fake", "pane_id": "%1"}}
+    });
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+    let message_id = store
+        .create_message(None, "w1", "leader", "hi", None, false, None)
+        .unwrap();
+    let transport = OfflineTransport::new()
+        .with_targets(vec![pane_info("%leader", "team-gate054ok", "leader")]);
+
+    let out = deliver_pending_message(&ws, &store, &transport, &message_id, &log, &state)
+        .expect("attached leader must still deliver");
+
+    assert!(
+        out.ok,
+        "0.5.4 gate054: status='attached' with a live pane must not be over-refused: {out:?}"
+    );
+    assert_eq!(out.message_status.0, "delivered");
+}
+
+// ════════════════════════════════════════════════════════════════════════
+// 0.5.5 gate054 B-arm — deliver_to_leader_fallback_pane must not cross to
+// another tmux server by pane id when a socket is recorded.
+//
+// Triage: real-machine acceptance B-fail — primary path (delivery.rs) refused
+// with rebind_required, but report_result's fallback_pane bailout selected a
+// same-numbered pane (%1) on the default tmux server (the main team's leader)
+// and returned leader_notified:true / delivered_via=fallback_pane.
+// ════════════════════════════════════════════════════════════════════════
+
+#[test]
+fn gate054_fallback_pane_socket_recorded_does_not_cross_to_default_server() {
+    use crate::messaging::deliver_to_leader_fallback_pane;
+    let ws = tmp_ws("gate054fallback");
+    let store = store_for(&ws);
+    let log = EventLog::new(&ws);
+    // Recorded socket points at a non-existent endpoint (mimics the gate
+    // team's private socket after its leader session was killed). The main
+    // team's default tmux server MAY have a same-numbered `%1` — the fix
+    // must refuse to inject there.
+    let bogus_socket = format!("/tmp/team-agent-gate054-nonexistent-{}", std::process::id());
+    let state = serde_json::json!({
+        "session_name": "team-gate054",
+        "leader_receiver": {
+            "pane_id": "%1",
+            "tmux_socket": bogus_socket,
+            "status": "rebind_required"
+        }
+    });
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+    let message_id = store
+        .create_message(None, "coordinator", "leader", "fallback payload", None, false, None)
+        .unwrap();
+
+    let outcome = deliver_to_leader_fallback_pane(
+        &ws,
+        &state,
+        &message_id,
+        Some("res_gate054_fallback"),
+        "S3 restart complete",
+        false, // primary was NOT ok (report_result path)
+        Some("primary_delivery_error:leader_not_attached"),
+        &log,
+    )
+    .expect("fallback pane primitive must not panic");
+
+    // Must NOT succeed by crossing to another server.
+    assert!(
+        !outcome.ok,
+        "0.5.5 gate054: fallback_pane must not cross a recorded socket boundary: outcome={outcome:?}"
+    );
+    // Loud-not-silent: caller wire status resolves to rebind_required
+    // (results.rs matches channel or Blocked → 'rebind_required').
+    assert!(
+        outcome.channel.as_deref() == Some("rebind_required")
+            || matches!(outcome.status, DeliveryStatus::Blocked),
+        "0.5.5 gate054: cross-boundary refusal must surface as rebind_required, got outcome={outcome:?}"
+    );
+    // Audit noise: fallback_pane_attempt + fallback_pane_failed with the
+    // recorded socket_bound=true forensic field.
+    let events = log.tail(0).unwrap();
+    let attempt = events
+        .iter()
+        .find(|e| {
+            e.get("event").and_then(serde_json::Value::as_str)
+                == Some("leader_receiver.fallback_pane_attempt")
+        });
+    assert!(
+        attempt.is_some(),
+        "fallback_pane_attempt audit must fire even on socket-bounded refusal; events={events:?}"
+    );
+    let failed = events.iter().find(|e| {
+        e.get("event").and_then(serde_json::Value::as_str)
+            == Some("leader_receiver.fallback_pane_failed")
+    });
+    assert!(
+        failed.is_some(),
+        "fallback_pane_failed audit must fire when the recorded socket rejects inject; events={events:?}"
+    );
+    assert_eq!(
+        failed
+            .and_then(|e| e.get("socket_bound"))
+            .and_then(serde_json::Value::as_bool),
+        Some(true),
+        "socket_bound forensic field must record the boundary state"
+    );
+}
+
+#[test]
+fn gate054_rebind_replay_requeues_failed_leader_message_on_attach() {
+    // Round-2 real-machine shape: direct report_result → primary refused with
+    // rebind_required → row is `status=failed, error=leader_not_attached`.
+    // `attach-leader` must requeue it back to `status=accepted` so the
+    // coordinator tick's `deliver_pending_messages` replays it to the new
+    // leader pane. Same message_id — no second replay mechanism, no new
+    // watcher, exactly-once via leader_notification_log PK.
+    use crate::model::ids::TeamKey;
+    let ws = tmp_ws("gate054replay");
+    let store = store_for(&ws);
+    let log = EventLog::new(&ws);
+    let team_id = "gate055r2b";
+
+    // Seed the same shape the primary-path refusal leaves behind.
+    let message_id = store
+        .create_message(
+            None,
+            "probe-worker",
+            "leader",
+            "B2_NOTIFY report_result payload",
+            None,
+            false,
+            Some(team_id),
+        )
+        .unwrap();
+    store
+        .mark(&message_id, "failed", Some("leader_not_attached"))
+        .unwrap();
+    // Sanity: precondition matches acceptance evidence.
+    let conn = crate::db::schema::open_db(store.db_path()).unwrap();
+    let (status_before, error_before): (String, Option<String>) = conn
+        .query_row(
+            "select status, error from messages where message_id = ?1",
+            [&message_id],
+            |r| Ok((r.get(0)?, r.get(1)?)),
+        )
+        .unwrap();
+    assert_eq!(status_before, "failed");
+    assert_eq!(error_before.as_deref(), Some("leader_not_attached"));
+
+    // The attach-leader path calls requeue_delivery_exhausted_watchers with
+    // the newly-claimed pane. Even with NO exhausted watchers to requeue,
+    // it must flip the blocked leader row back to accepted.
+    let team = TeamKey::new(team_id);
+    let new_pane = PaneId::new("%1"); // new leader window on the private socket
+    let notices = crate::messaging::requeue_delivery_exhausted_watchers(
+        &ws, &store, &log, &team, &new_pane,
+    )
+    .unwrap();
+    assert!(
+        notices.is_empty(),
+        "no exhausted watchers seeded → no watcher notices; only the message row should have been requeued"
+    );
+
+    let (status_after, error_after): (String, Option<String>) = conn
+        .query_row(
+            "select status, error from messages where message_id = ?1",
+            [&message_id],
+            |r| Ok((r.get(0)?, r.get(1)?)),
+        )
+        .unwrap();
+    assert_eq!(
+        status_after, "accepted",
+        "gate054 round-2: rebind_required leader row must flip back to 'accepted' on attach-leader"
+    );
+    assert!(
+        error_after.is_none(),
+        "gate054 round-2: error must be cleared on requeue so deliver_pending_message replays cleanly"
+    );
+
+    // Audit noise: leader_receiver.blocked_messages_requeued fired with the
+    // exact team + claimed pane + count for status/monitor observability.
+    let events = log.tail(0).unwrap();
+    let requeued = events.iter().find(|e| {
+        e.get("event").and_then(serde_json::Value::as_str)
+            == Some("leader_receiver.blocked_messages_requeued")
+    });
+    assert!(
+        requeued.is_some(),
+        "attach-leader requeue of blocked leader messages must audit; events={events:?}"
+    );
+    assert_eq!(
+        requeued
+            .and_then(|e| e.get("count"))
+            .and_then(serde_json::Value::as_u64),
+        Some(1)
+    );
+    assert_eq!(
+        requeued
+            .and_then(|e| e.get("team_id"))
+            .and_then(serde_json::Value::as_str),
+        Some(team_id)
+    );
+}
+
+#[test]
+fn gate054_status_surfaces_pending_leader_notifications() {
+    // Round-2: user-facing visibility — status must show the blocked leader
+    // notification as pending, not just as `messages.failed=1`.
+    use crate::cli::status_port::status_scoped;
+    let ws = tmp_ws("gate054status");
+    let store = store_for(&ws);
+    let team_id = "gate055r2b";
+
+    let message_id = store
+        .create_message(
+            None,
+            "probe-worker",
+            "leader",
+            "B2_NOTIFY report_result payload",
+            None,
+            false,
+            Some(team_id),
+        )
+        .unwrap();
+    store
+        .mark(&message_id, "failed", Some("leader_not_attached"))
+        .unwrap();
+
+    // Minimal runtime state so status can render.
+    let state = serde_json::json!({
+        "session_name": format!("team-{team_id}"),
+        "active_team_key": team_id,
+        "teams": {team_id: {"team_key": team_id}},
+        "leader_receiver": {
+            "pane_id": "%1",
+            "status": "rebind_required",
+        }
+    });
+    crate::state::persist::save_runtime_state(&ws, &state).unwrap();
+
+    let payload = status_scoped(&ws, &state, Some(team_id), false, false).unwrap();
+    let pending = payload
+        .get("pending_leader_notifications")
+        .and_then(serde_json::Value::as_array)
+        .expect("status must expose pending_leader_notifications as an array");
+    assert_eq!(
+        pending.len(),
+        1,
+        "the blocked leader message must appear in pending_leader_notifications"
+    );
+    let entry = &pending[0];
+    assert_eq!(
+        entry.get("message_id").and_then(serde_json::Value::as_str),
+        Some(message_id.as_str())
+    );
+    assert_eq!(
+        entry.get("channel").and_then(serde_json::Value::as_str),
+        Some("rebind_required")
+    );
+    assert!(entry
+        .get("action")
+        .and_then(serde_json::Value::as_str)
+        .is_some_and(|action| action.contains("attach-leader")
+            || action.contains("takeover")));
+}
+
+#[test]
+fn gate054_fallback_pane_grep_guard_no_cross_server_chain_when_socket_recorded() {
+    // Structural grep: the recorded-socket branch of the fallback inject
+    // chain must NOT compose the workspace or default tmux backends after
+    // the endpoint backend rejects. This is the byte-level fence against
+    // silent regression.
+    let src = include_str!("../leader_receiver.rs");
+    let inject_start = src
+        .find("let inject_result: Result<InjectReport, TransportError>")
+        .expect("fallback inject chain must remain single-typed");
+    let inject_end = src[inject_start..]
+        .find("};\n\n    match inject_result")
+        .map(|off| inject_start + off + 2)
+        .expect("fallback inject chain must terminate before match");
+    let chain = &src[inject_start..inject_end];
+    // The socket-recorded arm is the `Some(socket) => {..}` block. It must
+    // NOT contain a workspace or default fallback.
+    let some_arm_start = chain.find("Some(socket) => {").expect("Some(socket) arm");
+    let some_arm_end = chain[some_arm_start..]
+        .find("None => {")
+        .map(|off| some_arm_start + off)
+        .expect("None arm must follow");
+    let some_arm = &chain[some_arm_start..some_arm_end];
+    assert!(
+        !some_arm.contains("tmux_workspace_transport")
+            && !some_arm.contains("tmux_default_transport"),
+        "0.5.5 gate054: socket-recorded fallback arm must not compose workspace/default backends; arm={some_arm}"
+    );
+}

package/crates/team-agent/src/messaging/watchers.rs

@@ -436,45 +436,61 @@ pub fn requeue_after_claim_leader(
             }),
         )?;
     }
-    // #231 C-5: requeue blocked leader-bound messages that hit I-4 `rebind_required`
-    // while no leader pane was attached. Same row, same message_id — flip status back
-    // from `failed`/`leader_not_attached` to `accepted` so `deliver_pending_messages`
-    // replays it through the SAME pipeline. The leader_notification_log PK is already
-    // there (primitive wrote it before the unbound check), so this replay can't create
-    // a duplicate notification — exactly-once across rebind, no new send/notify rows.
-    let requeued_blocked = conn.execute(
+    let requeued_blocked =
+        requeue_blocked_leader_messages(&conn, event_log, owner_team_id, claimed_pane_id)?;
+    if !out.is_empty() || requeued_blocked > 0 {
+        let _ = retry_result_deliveries(workspace, event_log)?;
+    }
+    Ok(out)
+}
+
+/// 0.5.5 gate054 round-2: attach-leader (and claim-leader) requeue for leader messages
+/// that were refused with `rebind_required` while no leader pane was attached.
+///
+/// #231 C-5 semantics: same row, same message_id — flip `status` back from
+/// `failed`/`leader_not_attached` to `accepted` so `deliver_pending_messages`
+/// replays it through the SAME pipeline. The `leader_notification_log` PK is
+/// already there (primitive wrote it before the unbound check), so this replay
+/// cannot create a duplicate notification — exactly-once across rebind, no new
+/// send/notify rows and no second replay mechanism.
+pub(crate) fn requeue_blocked_leader_messages(
+    conn: &rusqlite::Connection,
+    event_log: &EventLog,
+    owner_team_id: &TeamKey,
+    claimed_pane_id: &PaneId,
+) -> Result<usize, MessagingError> {
+    let requeued = conn.execute(
         "update messages
          set status = 'accepted',
              error = null,
-             updated_at = ?3
+             updated_at = ?2
          where recipient = 'leader'
            and status = 'failed'
            and error = 'leader_not_attached'
            and owner_team_id = ?1",
-        params![
-            owner_team_id.as_str(),
-            claimed_pane_id.as_str(),
-            chrono::Utc::now().to_rfc3339(),
-        ],
+        params![owner_team_id.as_str(), chrono::Utc::now().to_rfc3339()],
     )?;
-    if requeued_blocked > 0 {
+    if requeued > 0 {
         event_log.write(
             "leader_receiver.blocked_messages_requeued",
             serde_json::json!({
                 "team_id": owner_team_id.as_str(),
                 "claimed_pane_id": claimed_pane_id.as_str(),
-                "count": requeued_blocked,
+                "count": requeued,
             }),
         )?;
     }
-    if !out.is_empty() {
-        let _ = retry_result_deliveries(workspace, event_log)?;
-    }
-    Ok(out)
+    Ok(requeued)
 }
 
 /// `requeue_delivery_exhausted_watchers`: attach-leader 成功后把已经耗尽投递
 /// 重试的 watcher 放回 notify_failed, 留给 coordinator tick 重试投递。
+///
+/// 0.5.5 gate054 round-2: also requeue direct leader messages that were refused
+/// with `rebind_required` (status=failed / error=leader_not_attached). Without
+/// this the direct `report_result` path leaves a failed row that
+/// `deliver_pending_messages` never re-picks — the new leader would never see the
+/// pending notification.
 pub fn requeue_delivery_exhausted_watchers(
     _workspace: &Path,
     store: &MessageStore,
@@ -522,6 +538,7 @@ pub fn requeue_delivery_exhausted_watchers(
         )?;
     }
     drop(stmt);
+    let _ = requeue_blocked_leader_messages(&conn, event_log, owner_team_id, claimed_pane_id)?;
     Ok(out)
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.4",
-    "@team-agent/cli-darwin-x64": "0.5.4",
-    "@team-agent/cli-linux-x64": "0.5.4"
+    "@team-agent/cli-darwin-arm64": "0.5.5",
+    "@team-agent/cli-darwin-x64": "0.5.5",
+    "@team-agent/cli-linux-x64": "0.5.5"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",