@team-agent/installer 0.5.40 → 0.5.42

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.40"
+version = "0.5.42"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.40"
+version = "0.5.42"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/diagnose.rs

@@ -198,9 +198,86 @@ pub(crate) fn diagnose_runtime_for_workspace(
     let (mut issues, mut repairs) = diagnose_runtime(state, backend);
     append_legacy_snapshot_issue(workspace, state, &mut issues);
     append_coordinator_health_issue(workspace, state, &mut issues, &mut repairs);
+    append_runtime_bindings_stale_after_boot_issue(workspace, state, &mut issues, &mut repairs);
     (issues, repairs)
 }
 
+/// 0.5.41 Slice 1 (fault-invisibility-locate.md §5/§6.2): read the
+/// coordinator heartbeat sidecar for the last-observed host boot
+/// identity and compare it against the current host boot. If they
+/// differ, the pane/pid/session bindings in state predate the current
+/// boot — surface `runtime_bindings_stale_after_boot` with a reused
+/// `team-agent restart` hint. Read-only: no mutation. When the
+/// heartbeat is missing OR the current host boot cannot be probed,
+/// stay silent (per §8 risk note — do not guess).
+fn append_runtime_bindings_stale_after_boot_issue(
+    workspace: &std::path::Path,
+    state: &Value,
+    issues: &mut Value,
+    repairs: &mut Value,
+) {
+    let workspace_path = crate::coordinator::WorkspacePath::new(workspace.to_path_buf());
+    let Some(heartbeat) = crate::coordinator::read_coordinator_heartbeat(&workspace_path) else {
+        return;
+    };
+    let Some(recorded_host_boot) = heartbeat
+        .get("host_boot_id")
+        .and_then(Value::as_str)
+        .filter(|s| !s.is_empty() && *s != "unknown")
+    else {
+        return;
+    };
+    let Some(current_host_boot) = crate::coordinator::probe_host_boot_id() else {
+        return;
+    };
+    if current_host_boot == recorded_host_boot {
+        return;
+    }
+    // Only surface when state actually has pane/session bindings that
+    // matter — otherwise there's nothing to be stale about.
+    let has_bindings = state
+        .get("agents")
+        .and_then(Value::as_object)
+        .is_some_and(|agents| {
+            agents.values().any(|agent| {
+                agent
+                    .get("pane_id")
+                    .and_then(Value::as_str)
+                    .is_some_and(|s| !s.is_empty())
+            })
+        });
+    if !has_bindings {
+        return;
+    }
+    let session_name = state
+        .get("session_name")
+        .and_then(Value::as_str)
+        .unwrap_or("unknown");
+    if let Some(items) = issues.as_array_mut() {
+        items.push(json!({
+            "id": "runtime_bindings_stale_after_boot",
+            "session_name": session_name,
+            "recorded_host_boot_id": recorded_host_boot,
+            "current_host_boot_id": current_host_boot,
+            "details": "cached pane/pid/session bindings predate the current host boot; runtime facts are stale",
+        }));
+    }
+    if let Some(items) = repairs.as_array_mut() {
+        items.push(json!({
+            "issue": "runtime_bindings_stale_after_boot",
+            "action_required": true,
+            "advisory": false,
+            "hint_action": "team-agent restart",
+            "action": format!(
+                "runtime bindings for `{session_name}` predate the current host boot \
+                 (recorded {recorded_host_boot}, current {current_host_boot}); rerun \
+                 `team-agent restart` to rebuild the pane/pid/session tuple"
+            ),
+            "dedupe_key": "runtime_bindings_stale_after_boot",
+        }));
+    }
+}
+
 fn append_legacy_snapshot_issue(workspace: &std::path::Path, state: &Value, issues: &mut Value) {
     let Ok(Some(details)) = crate::leader::detect_dual_state_divergence(workspace, state) else {
         return;

package/crates/team-agent/src/cli/status_port.rs

@@ -36,12 +36,19 @@ use rusqlite::params;
         let undelivered_backlog = count_undelivered_backlog(&conn, owner_team_id)?;
         let session_name = state.get("session_name").cloned().unwrap_or(Value::Null);
         let tmux_present = tmux_session_present(workspace, state, session_name.as_str());
+        // 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§6.3): resolve
+        // RuntimeFreshness once and thread it through the runtime block
+        // and per-agent enrichment. This is the single-source read that
+        // makes host-boot / coordinator / provider-exit staleness win
+        // over cached state.agents and DB agent_health.
+        let freshness = compute_runtime_freshness(workspace, state, &health);
         let runtime_block = build_runtime_status_block(
             coordinator_running,
             undelivered_backlog,
             !tmux_present,
+            &freshness,
         );
-        let agents = enrich_agents(state.get("agents"), tmux_present);
+        let agents = enrich_agents(state.get("agents"), tmux_present, &freshness);
         let tasks = state
             .get("tasks")
             .cloned()
@@ -438,7 +445,88 @@ use rusqlite::params;
             .to_string()
     }
 
-    fn enrich_agents(agents: Option<&Value>, tmux_session_present: bool) -> Value {
+    /// 0.5.41 Slice 3 (fault-invisibility-locate.md §5): single-source
+    /// runtime freshness projection consumed by status/diagnose. Read-
+    /// only over existing sources (`coordinator_health`, heartbeat
+    /// sidecar, watch state); computes NO transport calls of its own.
+    #[derive(Default, Clone)]
+    pub(crate) struct RuntimeFreshness {
+        pub coordinator_service_available: bool,
+        pub host_boot_stale: bool,
+        pub host_boot_recorded: Option<String>,
+        pub host_boot_current: Option<String>,
+        pub provider_exited_agents: std::collections::BTreeSet<String>,
+    }
+
+    impl RuntimeFreshness {
+        fn host_boot_stale_reason(&self) -> Option<&'static str> {
+            self.host_boot_stale.then_some("host_boot_mismatch")
+        }
+    }
+
+    pub(crate) fn compute_runtime_freshness(
+        workspace: &Path,
+        state: &Value,
+        health: &crate::coordinator::HealthReport,
+    ) -> RuntimeFreshness {
+        let workspace_path = crate::coordinator::WorkspacePath::new(workspace.to_path_buf());
+        let heartbeat = crate::coordinator::read_coordinator_heartbeat(&workspace_path);
+        let host_boot_recorded = heartbeat
+            .as_ref()
+            .and_then(|hb| hb.get("host_boot_id"))
+            .and_then(Value::as_str)
+            .filter(|s| !s.is_empty() && *s != "unknown")
+            .map(str::to_string);
+        let host_boot_current = crate::coordinator::probe_host_boot_id();
+        let host_boot_stale = match (host_boot_recorded.as_deref(), host_boot_current.as_deref()) {
+            (Some(recorded), Some(current)) => recorded != current,
+            _ => false,
+        };
+        // Collect worker-provider-exited agents from the coordinator
+        // abnormal_exit_watch payload (0.5.41 Slice 4 writes
+        // `worker_provider_exited` / `provider_process_dead=true`
+        // there). Read from top-level `coordinator.abnormal_exit_watch`
+        // OR the team-scoped mirror `teams.<key>.coordinator...`.
+        let mut provider_exited_agents = std::collections::BTreeSet::new();
+        for path in [
+            "/coordinator/abnormal_exit_watch",
+            &format!(
+                "/teams/{}/coordinator/abnormal_exit_watch",
+                state
+                    .get("active_team_key")
+                    .and_then(Value::as_str)
+                    .unwrap_or("")
+            ),
+        ] {
+            if let Some(watch) = state.pointer(path).and_then(Value::as_object) {
+                for (agent_id, entry) in watch {
+                    let exited = entry
+                        .get("worker_provider_exited")
+                        .and_then(Value::as_bool)
+                        == Some(true)
+                        || entry.get("provider_process_dead").and_then(Value::as_bool)
+                            == Some(true)
+                        || entry.get("provider_exit_marker").is_some();
+                    if exited {
+                        provider_exited_agents.insert(agent_id.clone());
+                    }
+                }
+            }
+        }
+        RuntimeFreshness {
+            coordinator_service_available: health.service_available,
+            host_boot_stale,
+            host_boot_recorded,
+            host_boot_current,
+            provider_exited_agents,
+        }
+    }
+
+    fn enrich_agents(
+        agents: Option<&Value>,
+        tmux_session_present: bool,
+        freshness: &RuntimeFreshness,
+    ) -> Value {
         let Some(Value::Object(input)) = agents else {
             return json!({});
         };
@@ -451,15 +539,74 @@ use rusqlite::params;
                         "interacted".to_string(),
                         Value::String(interacted_marker(obj.get("first_send_at"))),
                     );
-                    if let Some(reason) =
-                        stale_reason_for_agent(&Value::Object(obj.clone()), tmux_session_present)
+                    // 0.5.41 Slice 3: order stale sources most-authoritative-first.
+                    // Host boot mismatch wins because it invalidates all cached
+                    // pane/pid/session facts. Provider-exit marker wins over
+                    // pane liveness because the wrapper leaves an interactive
+                    // shell live. Coordinator unavailability without stronger
+                    // live provider proof means DB agent_health rows are stale.
+                    // Tmux session missing keeps its existing legacy path so
+                    // pre-0.5.41 tests remain byte-identical when no new
+                    // signal fires.
+                    let has_pane_binding = agent_has_pane_fact(&Value::Object(obj.clone()));
+                    // 0.5.41 Slice 3 (fault-invisibility-locate.md §5 point 3
+                    // + §9 RED4 live-provider guard): the wrapper-era pane
+                    // liveness cannot prove provider liveness — but a state
+                    // `pane_current_command` that MATCHES the agent's provider
+                    // IS positive proof (the abnormal.rs classifier writes it
+                    // when the pane's foreground command is the provider CLI).
+                    // When that positive proof is present, no stale downgrade
+                    // fires here so the agent renders as working.
+                    let provider_command_positive_proof = provider_current_command_matches(obj);
+                    // 0.5.41 Slice 3 (0.5.35 R4 regression guard): when the
+                    // runtime classifier has already written canonical
+                    // `worker_state=UNKNOWN` / `activity.status=uncertain`,
+                    // that is the authoritative honest observation — do NOT
+                    // reclassify it as `coordinator_unavailable` stale (which
+                    // would land it in the Stopped bucket instead of Unknown).
+                    // Host-boot mismatch and provider-exited marker are
+                    // stronger, more specific signals and still win.
+                    let canonical_unknown = agent_canonical_worker_state_is_unknown(obj);
+                    let new_reason = if freshness.host_boot_stale && has_pane_binding {
+                        freshness.host_boot_stale_reason()
+                    } else if freshness.provider_exited_agents.contains(agent_id) {
+                        Some("worker_provider_exited")
+                    } else if !freshness.coordinator_service_available
+                        && has_pane_binding
+                        && !provider_command_positive_proof
+                        && !canonical_unknown
                     {
+                        Some("coordinator_unavailable")
+                    } else {
+                        None
+                    };
+                    let legacy_reason = if provider_command_positive_proof {
+                        None
+                    } else {
+                        stale_reason_for_agent(
+                            &Value::Object(obj.clone()),
+                            tmux_session_present,
+                        )
+                    };
+                    let reason = new_reason.or(legacy_reason);
+                    if let Some(reason) = reason {
                         enriched.insert("stale".to_string(), Value::Bool(true));
                         enriched.insert(
                             "stale_reason".to_string(),
                             Value::String(reason.to_string()),
                         );
-                        if !tmux_session_present {
+                        // Downgrade cached BUSY/working when the stale source is
+                        // one of the new authoritative signals OR the pre-existing
+                        // session-missing signal. Legacy code only downgraded on
+                        // !tmux_session_present; that let host_boot / provider-
+                        // exit / coord-unavailable stale rows keep raw=running.
+                        let is_new_signal = matches!(
+                            reason,
+                            "host_boot_mismatch"
+                                | "worker_provider_exited"
+                                | "coordinator_unavailable"
+                        );
+                        if !tmux_session_present || is_new_signal {
                             downgrade_stale_agent(&mut enriched);
                         }
                     }
@@ -504,6 +651,49 @@ use rusqlite::params;
         }
     }
 
+    /// 0.5.41 Slice 3 (0.5.35 R4 regression guard): true when the agent
+    /// row carries the canonical `worker_state=UNKNOWN` OR
+    /// `activity.status=uncertain` observation the runtime classifier
+    /// writes. Used to skip the coordinator-unavailable stale mark
+    /// (see `enrich_agents`) so the pre-existing R4 rendering (UNKNOWN
+    /// beats WORKING) is preserved.
+    fn agent_canonical_worker_state_is_unknown(agent: &serde_json::Map<String, Value>) -> bool {
+        let worker_state_unknown = agent
+            .get("worker_state")
+            .and_then(Value::as_str)
+            .is_some_and(|value| value.eq_ignore_ascii_case("UNKNOWN"));
+        let activity_uncertain = agent
+            .get("activity")
+            .and_then(|v| v.get("status"))
+            .and_then(Value::as_str)
+            .is_some_and(|value| value.eq_ignore_ascii_case("uncertain"));
+        worker_state_unknown || activity_uncertain
+    }
+
+    /// 0.5.41 Slice 3 (fault-invisibility-locate.md §9 RED4 live-provider
+    /// guard): true when the agent row carries a `pane_current_command`
+    /// that matches the agent's provider CLI. This is positive proof
+    /// the provider is the pane's foreground process — the abnormal.rs
+    /// classifier writes this field after the marker/current-command
+    /// check clears. When true, stale-downgrade paths in
+    /// `enrich_agents` skip so the row keeps its BUSY/working state.
+    fn provider_current_command_matches(agent: &serde_json::Map<String, Value>) -> bool {
+        let Some(command) = agent
+            .get("pane_current_command")
+            .and_then(Value::as_str)
+            .filter(|s| !s.is_empty())
+        else {
+            return false;
+        };
+        let Some(provider_wire) = agent.get("provider").and_then(Value::as_str) else {
+            return false;
+        };
+        let Some(provider) = crate::provider::wire::parse_provider(provider_wire) else {
+            return false;
+        };
+        crate::leader::command_matches_provider(provider, command)
+    }
+
     fn agent_has_pane_fact(agent: &Value) -> bool {
         ["pane_id", "window", "window_name"].iter().any(|key| {
             agent
@@ -1120,6 +1310,7 @@ use rusqlite::params;
         coordinator_running: bool,
         undelivered: i64,
         tmux_session_missing: bool,
+        freshness: &RuntimeFreshness,
     ) -> Value {
         let mut runtime = serde_json::Map::new();
         runtime.insert(
@@ -1127,11 +1318,33 @@ use rusqlite::params;
             json!({"ok": coordinator_running}),
         );
         runtime.insert("undelivered".to_string(), json!(undelivered));
+        // 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§6.3): expose
+        // typed issues on the runtime block so `status --json --detail`
+        // can be scanned for `runtime_bindings_stale_after_boot` the
+        // same way `diagnose` surfaces it. Hint precedence: session-
+        // missing > host-boot-stale > coordinator-not-running-with-
+        // backlog — most-actionable-first.
+        let mut issues: Vec<Value> = Vec::new();
+        if freshness.host_boot_stale {
+            issues.push(json!({
+                "id": "runtime_bindings_stale_after_boot",
+                "recorded_host_boot_id": freshness.host_boot_recorded,
+                "current_host_boot_id": freshness.host_boot_current,
+            }));
+        }
+        if !issues.is_empty() {
+            runtime.insert("issues".to_string(), Value::Array(issues));
+        }
         if tmux_session_missing {
             runtime.insert(
                 "hint".to_string(),
                 json!("tmux session missing — run team-agent restart"),
             );
+        } else if freshness.host_boot_stale {
+            runtime.insert(
+                "hint".to_string(),
+                json!("runtime_bindings_stale_after_boot — run team-agent restart"),
+            );
         } else if !coordinator_running && undelivered > 0 {
             runtime.insert(
                 "hint".to_string(),
@@ -1146,7 +1359,13 @@ use rusqlite::params;
     /// Whether the coordinator HealthReport reflects a running tick loop. Used by the
     /// runtime block + the hint gate.
     fn coordinator_status_running(health: &crate::coordinator::HealthReport) -> bool {
-        matches!(health.status, crate::coordinator::CoordinatorHealthStatus::Running)
+        // 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§6.3): runtime
+        // service predicate is `service_available`, not any-`Running` pid.
+        // A stale-pid daemon is CoordinatorHealthStatus::Stale (or Running
+        // with metadata_ok=false); a service-compatible newer daemon is
+        // Running + service_available=true — send/diagnose already use
+        // this same truth source, and status must agree.
+        health.service_available
     }
 
     /// Count of messages currently sitting in delivery-able backlog
@@ -1199,16 +1418,21 @@ use rusqlite::params;
             "schema": {
                 "message_store_schema_version": health.schema.schema_version,
             },
+            // 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§6.3):
+            // `service_available` is now always exposed alongside `ok`
+            // and `status` so status/diagnose consumers can share one
+            // service-availability truth without keying on the legacy
+            // `expose_binary_drift` conditional (that path only fired
+            // for the newer-daemon-preserved shape). `binary_identity_
+            // relation` moves to always-on for the same reason — RED3
+            // scans the summary for `daemon_newer_than_caller`.
+            "service_available": health.service_available,
+            "binary_identity_relation": binary_identity_relation,
         });
         if expose_binary_drift {
             if let Some(obj) = value.as_object_mut() {
                 obj.insert("wire_metadata_ok".to_string(), Value::Bool(true));
                 obj.insert("binary_identity_ok".to_string(), Value::Bool(false));
-                obj.insert(
-                    "binary_identity_relation".to_string(),
-                    Value::String(binary_identity_relation.to_string()),
-                );
-                obj.insert("service_available".to_string(), Value::Bool(true));
             }
         }
         value

package/crates/team-agent/src/cli/tests/lane_c.rs

@@ -78,9 +78,16 @@ use super::*;
                 "binary_version",
                 "schema_ok",
                 "schema_error",
-                "schema"
+                "schema",
+                // 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§6.3):
+                // service_available and binary_identity_relation are
+                // now always emitted (not only when expose_binary_drift
+                // fires) so status/diagnose share one service-
+                // availability truth.
+                "service_available",
+                "binary_identity_relation",
             ],
-            "golden coordinator_health insertion order with 0.5.18 identity fields; got {order:?}"
+            "golden coordinator_health insertion order with 0.5.41 fault-invisibility fields; got {order:?}"
         );
         assert!(
             coord.get("schema_version").is_none(),

package/crates/team-agent/src/coordinator/health.rs

@@ -99,6 +99,7 @@ pub fn start_coordinator_with_team(
             binary_path: Some(identity.binary_path),
             binary_version: Some(identity.binary_version),
             rotation_reason: None,
+            binary_identity_relation: health.binary_identity_relation,
             log: Some(coordinator_log_path(workspace)),
             schema_error: None,
             action: None,
@@ -113,6 +114,7 @@ pub fn start_coordinator_with_team(
             binary_path: Some(identity.binary_path),
             binary_version: Some(identity.binary_version),
             rotation_reason: health.metadata_mismatch_reason,
+            binary_identity_relation: health.binary_identity_relation,
             log: None,
             schema_error: health.schema.error,
             action: health.schema.action,
@@ -127,6 +129,7 @@ pub fn start_coordinator_with_team(
             binary_path: Some(identity.binary_path),
             binary_version: Some(identity.binary_version),
             rotation_reason: health.metadata_mismatch_reason,
+            binary_identity_relation: health.binary_identity_relation,
             log: None,
             schema_error: None,
             action: Some(
@@ -169,6 +172,7 @@ pub fn start_coordinator_with_team(
             binary_path: Some(identity.binary_path),
             binary_version: Some(identity.binary_version),
             rotation_reason: Some("daemon_newer_than_caller".to_string()),
+            binary_identity_relation: health.binary_identity_relation,
             log: Some(coordinator_log_path(workspace)),
             schema_error: None,
             action: None,
@@ -208,6 +212,7 @@ pub fn start_coordinator_with_team(
                 binary_path: Some(identity.binary_path),
                 binary_version: Some(identity.binary_version),
                 rotation_reason,
+                binary_identity_relation: health.binary_identity_relation,
                 log: None,
                 schema_error: None,
                 action: Some("refusing to rotate coordinator metadata that points at the caller process".to_string()),
@@ -224,6 +229,7 @@ pub fn start_coordinator_with_team(
                     binary_path: Some(identity.binary_path),
                     binary_version: Some(identity.binary_version),
                     rotation_reason,
+                    binary_identity_relation: health.binary_identity_relation,
                     log: None,
                     schema_error: None,
                     action: None,
@@ -271,6 +277,7 @@ pub fn start_coordinator_with_team(
         binary_path: Some(identity.binary_path),
         binary_version: Some(identity.binary_version),
         rotation_reason,
+        binary_identity_relation: health.binary_identity_relation,
         log: Some(log_path),
         schema_error: None,
         action: None,

package/crates/team-agent/src/coordinator/steps/abnormal.rs

@@ -43,7 +43,10 @@ pub(crate) fn detect_abnormal_exits(
                         &agent,
                         None,
                         None,
-                        ProcessLiveness::Unverifiable,
+                        process_check(
+                            ProcessLiveness::Unverifiable,
+                            "rollout_metadata_unavailable".to_string(),
+                        ),
                         None,
                         ErrorRecency::None,
                         None,
@@ -81,7 +84,10 @@ pub(crate) fn detect_abnormal_exits(
                         &agent,
                         Some(size),
                         mtime_ns,
-                        ProcessLiveness::Unverifiable,
+                        process_check(
+                            ProcessLiveness::Unverifiable,
+                            "rollout_read_failed".to_string(),
+                        ),
                         None,
                         ErrorRecency::None,
                         None,
@@ -119,7 +125,7 @@ pub(crate) fn detect_abnormal_exits(
                 &agent,
                 Some(size),
                 mtime_ns,
-                liveness.state,
+                liveness.clone(),
                 fact.as_ref().map(|f| f.signature.as_str()),
                 error_recency,
                 error_observation_key.as_deref(),
@@ -430,7 +436,16 @@ fn abnormal_watch_agents(state: &Value) -> Vec<AbnormalWatchAgent> {
 }
 
 fn agent_pid(agent: &Value) -> Option<Pid> {
-    ["provider_pid", "process_id", "pid", "child_pid", "pane_pid"]
+    // 0.5.41 Slice 4 (fault-invisibility-locate.md §5 point 3 / §6.4,
+    // 0.5.39 CR D-m): after the 0.5.39 worker shell wrapper landed,
+    // `pane_pid` is the long-lived shell — NOT the provider. Treating
+    // it as `provider pid` and probing it via `kill(0)` reports "alive"
+    // for a pane whose provider CLI already exited, which is exactly
+    // the false-BUSY that suppressed `worker_provider_exited`. Only
+    // pids we know are the provider itself (`provider_pid` /
+    // `process_id` / `pid` written by explicit spawn accounting, or
+    // `child_pid` from the transport's SpawnResult) count here.
+    ["provider_pid", "process_id", "pid", "child_pid"]
         .into_iter()
         .find_map(|key| json_u32(agent.get(key)).map(Pid::new))
 }
@@ -512,9 +527,52 @@ fn agent_process_liveness(
     targets: &[crate::transport::PaneInfo],
     transport: &dyn crate::transport::Transport,
 ) -> ProcessCheck {
+    // 0.5.41 Slice 4 (fault-invisibility-locate.md §5 point 3 / §6.4,
+    // 0.5.39 CR D-m): after the worker wrapper landed, `pane_pid` may
+    // be the long-lived shell that survived provider exit. Reordered
+    // to prefer POSITIVE provider evidence in this order:
+    //   1. Explicit provider pid (agent.pid) — set by the transport's
+    //      SpawnResult.child_pid or explicit provider_pid state field.
+    //   2. Explicit liveness field.
+    //   3. Explicit dead-status field.
+    //   4. Explicit provider current-command (state.pane_current_command).
+    //   5. Live-pane current-command matching provider = alive.
+    //   6. Live-pane current-command shell + capture-tail worker exit
+    //      marker = DEAD (positive proof provider exited).
+    //   7. Live pane, no positive evidence = Unverifiable (NOT alive,
+    //      NOT working). Legacy code returned pid_process_check(pane_pid)
+    //      here — that was the D-m false BUSY.
+    //   8. Pane / window liveness falls back on Unverifiable.
     if let Some(pid) = agent.pid {
         return pid_process_check("pid", pid);
     }
+    // 0.5.41 Slice 4 (fault-invisibility-locate.md §5 point 3 / §6.4):
+    // BEFORE consulting the loose `explicit_process_liveness` path
+    // (which happily maps state.status=`running` to Alive), probe the
+    // pane for POSITIVE provider evidence via current-command + worker
+    // exit marker. Under the 0.5.39 wrapper, `state.status=running` is
+    // administrative spawn accounting, not runtime truth — a provider
+    // may have exited into the shell fallback while state still reads
+    // running. The marker probe positively proves that case; when it
+    // fires we return Dead here instead of the false Alive further
+    // down.
+    if let Some(target) = matching_agent_target(agent, session_name, targets) {
+        if let Some(command) = target.current_command.as_deref() {
+            return pane_command_process_check_with_marker(agent, transport, target, command);
+        }
+    }
+    if let Some(command) = agent.current_command.as_deref() {
+        return command_process_check_with_marker(agent, transport, command);
+    }
+    if let Some(pane_id) = agent.pane_id.as_deref() {
+        // Even without pane current_command / matching target, try the
+        // marker probe directly — the wrapper's printf leaves the marker
+        // in the pane's capture tail whether or not the transport
+        // reports pane_current_command.
+        if let Some(check) = worker_provider_exit_marker_check(agent, transport) {
+            return check;
+        }
+    }
     if let Some(liveness) = agent.process_liveness {
         return process_check(
             liveness,
@@ -532,19 +590,15 @@ fn agent_process_liveness(
             format!("status:{}", agent.status.as_deref().unwrap_or("unknown")),
         );
     }
-    if let Some(command) = agent.current_command.as_deref() {
-        return command_process_check(agent.provider, command);
-    }
     if let Some(target) = matching_agent_target(agent, session_name, targets) {
-        if let Some(command) = target.current_command.as_deref() {
-            return pane_command_process_check(agent.provider, target, command);
-        }
-        if let Some(pid) = target.pane_pid.map(Pid::new) {
-            return pid_process_check("pane_pid", pid);
-        }
+        // Reached only when the target has no current_command AND no
+        // marker was found earlier. Legacy code returned
+        // `pid_process_check("pane_pid", pane_pid)` here — that's the
+        // wrapper shell under 0.5.39. Now Unverifiable (not-working).
+        let _ = target;
         return process_check(
             ProcessLiveness::Unverifiable,
-            "pane_present_pid_unknown".to_string(),
+            "pane_present_provider_evidence_unknown".to_string(),
         );
     }
     if let Some(pane_id) = agent.pane_id.as_deref() {
@@ -555,7 +609,7 @@ fn agent_process_liveness(
             }
             Ok(crate::transport::PaneLiveness::Live) => process_check(
                 ProcessLiveness::Unverifiable,
-                format!("pane_live_pid_unknown:{pane_id}"),
+                format!("pane_live_provider_evidence_unknown:{pane_id}"),
             ),
             Ok(crate::transport::PaneLiveness::Unknown) => process_check(
                 ProcessLiveness::Unverifiable,
@@ -577,7 +631,7 @@ fn agent_process_liveness(
     match transport.list_windows(&session) {
         Ok(windows) if windows.iter().any(|known| known.as_str() == window) => process_check(
             ProcessLiveness::Unverifiable,
-            "window_present_pid_unknown".to_string(),
+            "window_present_provider_evidence_unknown".to_string(),
         ),
         Ok(_) => process_check(ProcessLiveness::Dead, format!("window_missing:{window}")),
         Err(error) => process_check(
@@ -651,6 +705,79 @@ fn pane_command_process_check(
     }
 }
 
+/// 0.5.41 Slice 4 (fault-invisibility-locate.md §5 point 3 / §6.4):
+/// after the 0.5.39 worker wrapper landed, a pane whose current command
+/// is a shell + capture-tail contains the worker exit marker is POSITIVE
+/// proof the provider exited. Falls back to plain current-command check
+/// when a pane_id is not available for capture (state-only path).
+fn command_process_check_with_marker(
+    agent: &AbnormalWatchAgent,
+    transport: &dyn crate::transport::Transport,
+    command: &str,
+) -> ProcessCheck {
+    if crate::leader::command_matches_provider(agent.provider, command) {
+        return process_check(ProcessLiveness::Alive, format!("current_command:{command}"));
+    }
+    if let Some(check) = worker_provider_exit_marker_check(agent, transport) {
+        return check;
+    }
+    process_check(
+        ProcessLiveness::Dead,
+        format!("provider_not_foreground:{command}"),
+    )
+}
+
+fn pane_command_process_check_with_marker(
+    agent: &AbnormalWatchAgent,
+    transport: &dyn crate::transport::Transport,
+    pane: &crate::transport::PaneInfo,
+    command: &str,
+) -> ProcessCheck {
+    if crate::leader::attribute_pane_provider(pane)
+        .is_some_and(|candidate| crate::leader::provider_matches(candidate, agent.provider))
+    {
+        return process_check(ProcessLiveness::Alive, format!("current_command:{command}"));
+    }
+    if let Some(check) = worker_provider_exit_marker_check(agent, transport) {
+        return check;
+    }
+    process_check(
+        ProcessLiveness::Dead,
+        format!("provider_not_foreground:{command}"),
+    )
+}
+
+/// 0.5.41 Slice 4: probe the pane's capture-tail for the single-source
+/// worker exit marker (`tmux_backend::worker_provider_exit_marker`).
+/// Returns `Some(Dead)` when the marker is found (positive proof
+/// provider exited), or `None` when we can't run the capture (no
+/// pane_id in agent), so callers keep their default decision. Absence
+/// of marker in a valid capture is intentionally NOT `alive` (locate
+/// §8 risk: capture tail can scroll past the marker) — callers still
+/// return `Dead` for "provider not foreground" because current command
+/// already disproved provider liveness at that call site.
+fn worker_provider_exit_marker_check(
+    agent: &AbnormalWatchAgent,
+    transport: &dyn crate::transport::Transport,
+) -> Option<ProcessCheck> {
+    let pane_id_str = agent.pane_id.as_deref()?;
+    let pane = crate::transport::PaneId::new(pane_id_str);
+    let target = crate::transport::Target::Pane(pane);
+    let provider_label = crate::provider::wire::command_name(agent.provider);
+    let marker = crate::tmux_backend::worker_provider_exit_marker(provider_label);
+    let cap = transport
+        .capture(&target, crate::transport::CaptureRange::Tail(200))
+        .ok()?;
+    if cap.text.contains(&marker) {
+        Some(process_check(
+            ProcessLiveness::Dead,
+            format!("worker_provider_exited:{pane_id_str}"),
+        ))
+    } else {
+        None
+    }
+}
+
 fn process_check(state: ProcessLiveness, detail: String) -> ProcessCheck {
     ProcessCheck { state, detail }
 }
@@ -681,18 +808,26 @@ fn abnormal_watch_payload(
     agent: &AbnormalWatchAgent,
     size: Option<u64>,
     mtime_ns: Option<u64>,
-    liveness: ProcessLiveness,
+    liveness: ProcessCheck,
     signature: Option<&str>,
     error_recency: ErrorRecency,
     error_observation_key: Option<&str>,
     error: Option<String>,
 ) -> Value {
-    let liveness_wire = process_liveness_wire(liveness);
-    let dead_process = liveness == ProcessLiveness::Dead;
+    let liveness_wire = process_liveness_wire(liveness.state);
+    let dead_process = liveness.state == ProcessLiveness::Dead;
     let latest_explicit_error = signature.is_some();
-    let gate = AbnormalExitGate::new(liveness, latest_explicit_error, error_recency);
+    let gate = AbnormalExitGate::new(liveness.state, latest_explicit_error, error_recency);
     let notify = gate.should_notify_worker_abnormal_exit();
     let suppressed_reason = gate.suppressed_reason();
+    // 0.5.41 Slice 4 (fault-invisibility-locate.md §6.4): typed
+    // classification for status/render — `worker_provider_exited` is
+    // true only when Dead was proven via the capture-tail worker exit
+    // marker (detail prefix `worker_provider_exited:`). status_port's
+    // RuntimeFreshness collector reads this field to downgrade the
+    // corresponding agent row.
+    let worker_provider_exited =
+        dead_process && liveness.detail.starts_with("worker_provider_exited:");
     serde_json::json!({
         "path": agent.rollout_path_display.as_str(),
         "provider": provider_wire(agent.provider),
@@ -701,9 +836,11 @@ fn abnormal_watch_payload(
         "last_offset": size,
         "last_signature": signature,
         "last_liveness": liveness_wire,
+        "last_liveness_detail": liveness.detail,
         "dead_process": dead_process,
         "process_dead": dead_process,
         "provider_process_dead": dead_process,
+        "worker_provider_exited": worker_provider_exited,
         "latest_error": latest_explicit_error,
         "latest_explicit_error": latest_explicit_error,
         "error_recency": error_recency.as_str(),

package/crates/team-agent/src/coordinator/tick.rs

@@ -424,7 +424,25 @@ impl Coordinator {
         let saved = match &self.save_hook {
             Some(hook) => hook(&self.workspace, &state),
             None => {
-                crate::state::projection::save_team_scoped_state(self.workspace.as_path(), &state)
+                // 0.5.42 S1b (s1b-writer-cluster-locate.md §3.2 /
+                // §4.4): the daemon tick's single terminal save
+                // routes through `StateRepository` with the
+                // `CoordinatorTick` intent. Repository dispatch is
+                // byte-identical to the old `save_team_scoped_state`
+                // helper (see `state/repository.rs:CoordinatorTick =>
+                // helper_write_team_scoped`), so persist/merge/lock/
+                // atomic-rename semantics and degraded-mapping stay
+                // unchanged. No cached repository, no extra load, no
+                // retry — the caller still owns the `Value` and
+                // failure still returns `TickReport{PersistenceDegraded}`
+                // via the `saved.is_err()` branch below.
+                let team_key = crate::state::projection::team_state_key(&state);
+                crate::state::repository::StateRepository::new(self.workspace.as_path()).save(
+                    crate::state::repository::StateWriteIntent::CoordinatorTick {
+                        team_key: team_key.as_str(),
+                    },
+                    &state,
+                )
             }
         };
         if saved.is_err() {
@@ -1494,10 +1512,18 @@ pub(crate) fn write_coordinator_heartbeat(
                 .map(ToString::to_string)
         })
         .unwrap_or_else(|| format!("coord_unknown_{}", pid.get()));
+    // 0.5.41 Slice 1 (fault-invisibility-locate.md §5/§6.1): stamp the
+    // host boot identity onto every heartbeat write so downstream
+    // status/diagnose can detect "all pane/pid/session bindings predate
+    // the current host boot" without inventing a new sidecar. Existing
+    // `boot_id` stays as the daemon-generation id.
+    let host_boot_id = probe_host_boot_id().unwrap_or_else(|| "unknown".to_string());
     let mut next = serde_json::json!({
         "coordinator_tick_iteration_count": next_count,
         "pid": pid.get(),
         "boot_id": boot_id,
+        "host_boot_id": host_boot_id,
+        "host_boot_time": now.clone(),
         "binary_path": identity.binary_path,
         "binary_version": identity.binary_version,
         "last_phase": last_phase,
@@ -1523,6 +1549,57 @@ fn coordinator_heartbeat_path(workspace: &WorkspacePath) -> PathBuf {
     crate::model::paths::runtime_dir(workspace.as_path()).join("coordinator_tick.json")
 }
 
+/// 0.5.41 Slice 1 (fault-invisibility-locate.md §6.1): single-helper
+/// probe for the current host boot identity. Test overrides via
+/// `TEAM_AGENT_TEST_HOST_BOOT_ID` (deterministic RED path). On real
+/// hosts, reads platform files: Linux `/proc/sys/kernel/random/boot_id`
+/// (128-bit UUID stable across the boot), macOS `sysctl kern.boottime`
+/// falls back to a formatted timestamp. Returns None when the platform
+/// signal cannot be read — the caller MUST NOT guess; downstream
+/// treats a missing/mismatched host boot separately from a matched one.
+pub(crate) fn probe_host_boot_id() -> Option<String> {
+    if let Ok(override_id) = std::env::var("TEAM_AGENT_TEST_HOST_BOOT_ID") {
+        if !override_id.is_empty() {
+            return Some(override_id);
+        }
+    }
+    // Linux: stable UUID for the current boot.
+    if let Ok(raw) = std::fs::read_to_string("/proc/sys/kernel/random/boot_id") {
+        let trimmed = raw.trim();
+        if !trimmed.is_empty() {
+            return Some(format!("linux-{trimmed}"));
+        }
+    }
+    // macOS/BSD: kern.boottime via sysctl. Cheap and root-free.
+    #[cfg(target_os = "macos")]
+    {
+        if let Ok(output) = std::process::Command::new("sysctl")
+            .args(["-n", "kern.boottime"])
+            .output()
+        {
+            if output.status.success() {
+                let text = String::from_utf8_lossy(&output.stdout);
+                let trimmed = text.trim();
+                if !trimmed.is_empty() {
+                    return Some(format!("macos-{trimmed}"));
+                }
+            }
+        }
+    }
+    None
+}
+
+/// 0.5.41 Slice 1: expose the last-written heartbeat sidecar so
+/// `cli::diagnose` / `cli::status_port` can consume it read-only. Any
+/// error (missing file, malformed JSON) returns None — callers treat
+/// that as "unknown, fall back to existing facts" per locate §8 risk
+/// note, they must never guess a stale/fresh verdict from absence.
+pub fn read_coordinator_heartbeat(workspace: &WorkspacePath) -> Option<Value> {
+    let path = coordinator_heartbeat_path(workspace);
+    let text = std::fs::read_to_string(path).ok()?;
+    serde_json::from_str(&text).ok()
+}
+
 fn read_coordinator_heartbeat_value(path: &Path) -> Value {
     std::fs::read_to_string(path)
         .ok()

package/crates/team-agent/src/coordinator/types.rs

@@ -330,6 +330,15 @@ pub struct StartReport {
     pub binary_path: Option<String>,
     pub binary_version: Option<String>,
     pub rotation_reason: Option<String>,
+    /// 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§9 RED3): typed
+    /// binary-identity relation between the caller and the daemon that
+    /// was observed. Populated on every path (unknown when the health
+    /// probe returned no metadata). Downstream `coordinator_start_
+    /// summary_value` exposes this so restart/start summaries no longer
+    /// flatten `daemon_newer_than_caller` into a plain `already_running`
+    /// (RED3: caller-older-than-daemon must remain distinguishable
+    /// from a same-binary fresh daemon).
+    pub binary_identity_relation: CoordinatorBinaryIdentityRelation,
     /// coordinator.log 路径(成功路径,`lifecycle.py:54/121`)。
     pub log: Option<PathBuf>,
     /// schema_incompatible 时的修复 hint / 失败原因。

package/crates/team-agent/src/leader/lease.rs

@@ -1750,7 +1750,25 @@ fn state_owner(state: &Value) -> Option<TeamOwner> {
 /// name for 0.5.x call-site stability. The B0 legacy snapshot is
 /// diagnostic-only via `lifecycle::save_team_runtime_snapshot`.
 pub fn write_lease_dual_state(workspace: &Path, state: &Value) -> Result<(), LeaderError> {
-    crate::state::persist::save_runtime_state(workspace, state)?;
+    // 0.5.42 S1b (s1b-writer-cluster-locate.md §4.4): terminal root
+    // save routes through `StateRepository` with the `ClaimLeader`
+    // intent. Dispatch is byte-identical to the old
+    // `save_runtime_state` helper (see
+    // `state/repository.rs:ClaimLeader => helper_write_root`), so the
+    // full lease writer cluster (attach_leader / attach_app_server /
+    // attach_leader_to_state / claim_lease_no_incident_with_target /
+    // rediscover) keeps its persist/merge/CAS/readback semantics.
+    // Public signature/error mapping preserved for caller stability.
+    // Repository does NOT compute owner_epoch, re-run convergence,
+    // emit ownership events, or acquire a second lease lock — the
+    // caller still owns all of that.
+    let team_key = canonical_owner_write_key(state);
+    crate::state::repository::StateRepository::new(workspace).save(
+        crate::state::repository::StateWriteIntent::ClaimLeader {
+            team_key: team_key.as_str(),
+        },
+        state,
+    )?;
     Ok(())
 }
 
@@ -1838,7 +1856,16 @@ fn save_claim_team_scoped_state(workspace: &Path, state: &Value, target_key: &st
         writes_endpoint_convergence,
     );
     merged.insert("teams".to_string(), Value::Object(teams));
-    crate::state::persist::save_runtime_state(workspace, &Value::Object(merged))?;
+    // 0.5.42 S1b (s1b-writer-cluster-locate.md §4.4): only the
+    // terminal save routes through `StateRepository`; the entire
+    // load/merge/compact block above stays in place — repository is a
+    // writer facade, not a projection assembler.
+    crate::state::repository::StateRepository::new(workspace).save(
+        crate::state::repository::StateWriteIntent::ClaimLeader {
+            team_key: target_key,
+        },
+        &Value::Object(merged),
+    )?;
     Ok(())
 }
 

package/crates/team-agent/src/lifecycle/types.rs

@@ -91,6 +91,12 @@ pub struct CoordinatorStartSummary {
     pub binary_path: Option<String>,
     pub binary_version: Option<String>,
     pub rotation_reason: Option<String>,
+    /// 0.5.41 Slice 3 (fault-invisibility-locate.md §5/§9 RED3): typed
+    /// binary-identity relation between caller and daemon that was
+    /// observed. Carried through from `StartReport` so restart/start
+    /// summaries keep `daemon_newer_than_caller` distinguishable from
+    /// a same-binary fresh daemon (both surface as `already_running`).
+    pub binary_identity_relation: String,
 }
 
 impl CoordinatorStartSummary {
@@ -102,6 +108,7 @@ impl CoordinatorStartSummary {
             binary_path: report.binary_path.clone(),
             binary_version: report.binary_version.clone(),
             rotation_reason: report.rotation_reason.clone(),
+            binary_identity_relation: report.binary_identity_relation.as_str().to_string(),
         }
     }
 }
@@ -126,6 +133,7 @@ pub fn coordinator_start_summary_value(summary: &CoordinatorStartSummary) -> ser
         "binary_path": summary.binary_path,
         "binary_version": summary.binary_version,
         "rotation_reason": summary.rotation_reason,
+        "binary_identity_relation": summary.binary_identity_relation,
     })
 }
 

package/crates/team-agent/src/state/repository.rs

@@ -1,17 +1,32 @@
-//! S1a StateRepository facade.
+//! StateRepository facade.
 //!
-//! Ref: `.team/artifacts/s1a-state-repository-design.md`
+//! Ref:
+//! - `.team/artifacts/s1a-state-repository-design.md` (skeleton)
+//! - `.team/artifacts/s1b-writer-cluster-locate.md` (0.5.42 first
+//!   writer-cluster migration: `CoordinatorTick` + `ClaimLeader`)
 //!
-//! S1a is a **skeleton + governance** slice. `StateRepository` is a thin write
-//! facade that dispatches every write to the existing helper family without
-//! changing helper behavior, merge policy, or on-disk layout. The value it adds
-//! is that every write now carries a `StateWriteIntent`, so S1b can migrate
-//! writer clusters one semantic at a time.
+//! `StateRepository` is a thin write facade that dispatches every write
+//! to the existing helper family without changing helper behavior,
+//! merge policy, or on-disk layout. The value it adds is that every
+//! write now carries a `StateWriteIntent`, so writer clusters migrate
+//! one semantic at a time.
 //!
-//! Non-goals in S1a (see design section 11): no schema rewrite, no path
-//! layout change, no writer migration, no helper deletion. Every existing
-//! caller keeps calling the raw helpers behind the S1a allowlist; only new
-//! direct callsites are governed.
+//! 0.5.42 status: first real consumers are the daemon `Coordinator::
+//! tick` production save (`CoordinatorTick`) and the lease/claim
+//! writer cluster's two terminal saves (`ClaimLeader`) —
+//! `write_lease_dual_state` + `save_claim_team_scoped_state`.
+//! Post-S1b, the direct-save allowlist drops from 73 to 70; the three
+//! migrated sites have no allowlist row and every future direct save
+//! must either enter through `StateRepository` or claim an explicit
+//! new allowlist row (fail-closed).
+//!
+//! Non-goals kept from S1a (design §11) + reasserted by
+//! s1b-writer-cluster-locate.md §7: no schema rewrite, no path layout
+//! change, no helper deletion, no epoch computation in the repository,
+//! no retry / reload / event emission, no reinterpretation of
+//! `owner_epoch` / `topology_convergence` / readback proof — the
+//! caller still owns the whole `Value`, and repository dispatches to
+//! the same existing persist helper the direct edge used to hit.
 
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.40",
+  "version": "0.5.42",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.40",
-    "@team-agent/cli-darwin-x64": "0.5.40",
-    "@team-agent/cli-linux-x64": "0.5.40"
+    "@team-agent/cli-darwin-arm64": "0.5.42",
+    "@team-agent/cli-darwin-x64": "0.5.42",
+    "@team-agent/cli-linux-x64": "0.5.42"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",