@team-agent/installer 0.5.42 → 0.5.44

package/crates/team-agent/src/leader/tests/lease_api.rs

@@ -1,292 +1,330 @@
 use super::*;
 
-    // =====================================================================
-    // 7. 五条 lease 路径签名 + 返回 LeaseResult 形态(unimplemented → RED)
-    // =====================================================================
+// =====================================================================
+// 7. 五条 lease 路径签名 + 返回 LeaseResult 形态(unimplemented → RED)
+// =====================================================================
 
-    // attach_leader:手动 CLI attach(__init__.py:19-58 → attach_leader_to_state:276 →
-    // _resolve_leader_pane)。在无 live tmux 的测试环境,指定一个不存在的 pane %1 →
-    // _resolve_leader_pane raise RuntimeError("tmux pane not found: %1")(_legacy_pane_discovery.py:153),
-    // 映射到 LeaderError::Validation。golden(probe_attach.py 已验:真跑即 raise)。
-    // 强化:钉具体的 Err 形态 + 错误串含 pane id;并断言失败时绝不留下半绑定 state(无 team_owner)。
-    // unimplemented → RED(unimplemented panic ≠ 期望的 Validation,且后续 is_err 断言不会被求值)。
-    #[test]
-    fn attach_leader_errors_when_pane_not_resolvable() {
-        let ws = std::env::temp_dir().join(format!("ta_rs_attach_{}", std::process::id()));
-        std::fs::create_dir_all(&ws).unwrap();
-        let r = attach_leader(&ws, None, Some(&PaneId::new("%1")), Provider::Codex);
-        // 不可解析 pane → Err(Validation),错误串提及 pane not found。
-        match r {
-            Err(LeaderError::Validation(msg)) => {
-                assert!(msg.contains("%1"), "Validation 错误须含目标 pane id,got {msg}");
-                assert!(msg.contains("not found"), "须是 pane-not-found 形态,got {msg}");
-            }
-            Err(other) => panic!("期望 Validation(pane not found),got {other:?}"),
-            Ok(v) => panic!("无 live tmux pane 时不该成功 attach,got {v:?}"),
+// attach_leader:手动 CLI attach(__init__.py:19-58 → attach_leader_to_state:276 →
+// _resolve_leader_pane)。在无 live tmux 的测试环境,指定一个不存在的 pane %1 →
+// _resolve_leader_pane raise RuntimeError("tmux pane not found: %1")(_legacy_pane_discovery.py:153),
+// 映射到 LeaderError::Validation。golden(probe_attach.py 已验:真跑即 raise)。
+// 强化:钉具体的 Err 形态 + 错误串含 pane id;并断言失败时绝不留下半绑定 state(无 team_owner)。
+// unimplemented → RED(unimplemented panic ≠ 期望的 Validation,且后续 is_err 断言不会被求值)。
+#[test]
+fn attach_leader_errors_when_pane_not_resolvable() {
+    let ws = std::env::temp_dir().join(format!("ta_rs_attach_{}", std::process::id()));
+    std::fs::create_dir_all(&ws).unwrap();
+    let r = attach_leader(&ws, None, Some(&PaneId::new("%1")), Provider::Codex);
+    // 不可解析 pane → Err(Validation),错误串提及 pane not found。
+    match r {
+        Err(LeaderError::Validation(msg)) => {
+            assert!(
+                msg.contains("%1"),
+                "Validation 错误须含目标 pane id,got {msg}"
+            );
+            assert!(
+                msg.contains("not found"),
+                "须是 pane-not-found 形态,got {msg}"
+            );
         }
-        // 失败不留半绑定:state.json 无 team_owner。
-        let st = crate::state::persist::load_runtime_state(&ws).unwrap();
-        assert!(st.get("team_owner").is_none(), "resolve 失败不得落 team_owner");
+        Err(other) => panic!("期望 Validation(pane not found),got {other:?}"),
+        Ok(v) => panic!("无 live tmux pane 时不该成功 attach,got {v:?}"),
     }
+    // 失败不留半绑定:state.json 无 team_owner。
+    let st = crate::state::persist::load_runtime_state(&ws).unwrap();
+    assert!(
+        st.get("team_owner").is_none(),
+        "resolve 失败不得落 team_owner"
+    );
+}
 
-    // attach_leader 成功 post-state(需 live tmux pane + cross-lane _resolve_leader_pane):
-    // vacant acquire → status=Claimed、reason=vacant_acquired、owner_epoch 0→1、owner/receiver 绑同 pane、
-    // 且 workspace state.json 真被持久化。golden(_claim_lease_no_incident:81/102/139-143)。
-    // real-machine-gated(无 live tmux 无法驱动 pane resolver)。
-    #[test]
-    #[ignore = "needs a live tmux pane + cross-lane _resolve_leader_pane (step 9/11)"]
-    fn attach_leader_binds_pane_advances_epoch_and_persists() {
-        let ws = std::env::temp_dir().join(format!("ta_rs_attach_ok_{}", std::process::id()));
-        std::fs::create_dir_all(&ws).unwrap();
-        let pane = PaneId::new("%1");
-        let r = attach_leader(&ws, None, Some(&pane), Provider::Codex).unwrap();
-        assert!(r.ok);
-        assert_eq!(r.status, LeaseStatus::Claimed);
-        let owner = r.owner.as_ref().expect("attach 成功必带 owner");
-        assert_eq!(owner.pane_id, pane);
-        assert_eq!(owner.owner_epoch, OwnerEpoch(1), "vacant acquire 后 epoch=1");
-        assert_eq!(owner.provider, Provider::Codex);
-        let receiver = r.receiver.as_ref().expect("attach 成功必带 receiver");
-        assert_eq!(receiver.pane_id, pane);
-        assert_eq!(r.reason, Some(LeaseReason::VacantAcquired));
-        let persisted = crate::state::persist::load_runtime_state(&ws).unwrap();
-        assert_eq!(persisted["team_owner"]["pane_id"], serde_json::json!("%1"));
-        assert_eq!(persisted["team_owner"]["owner_epoch"], serde_json::json!(1));
-    }
+// attach_leader 成功 post-state(需 live tmux pane + cross-lane _resolve_leader_pane):
+// vacant acquire → status=Claimed、reason=vacant_acquired、owner_epoch 0→1、owner/receiver 绑同 pane、
+// 且 workspace state.json 真被持久化。golden(_claim_lease_no_incident:81/102/139-143)。
+// real-machine-gated(无 live tmux 无法驱动 pane resolver)。
+#[test]
+#[ignore = "needs a live tmux pane + cross-lane _resolve_leader_pane (step 9/11)"]
+fn attach_leader_binds_pane_advances_epoch_and_persists() {
+    let ws = std::env::temp_dir().join(format!("ta_rs_attach_ok_{}", std::process::id()));
+    std::fs::create_dir_all(&ws).unwrap();
+    let pane = PaneId::new("%1");
+    let r = attach_leader(&ws, None, Some(&pane), Provider::Codex).unwrap();
+    assert!(r.ok);
+    assert_eq!(r.status, LeaseStatus::Claimed);
+    let owner = r.owner.as_ref().expect("attach 成功必带 owner");
+    assert_eq!(owner.pane_id, pane);
+    assert_eq!(
+        owner.owner_epoch,
+        OwnerEpoch(1),
+        "vacant acquire 后 epoch=1"
+    );
+    assert_eq!(owner.provider, Provider::Codex);
+    let receiver = r.receiver.as_ref().expect("attach 成功必带 receiver");
+    assert_eq!(receiver.pane_id, pane);
+    assert_eq!(r.reason, Some(LeaseReason::VacantAcquired));
+    let persisted = crate::state::persist::load_runtime_state(&ws).unwrap();
+    assert_eq!(persisted["team_owner"]["pane_id"], serde_json::json!("%1"));
+    assert_eq!(persisted["team_owner"]["owner_epoch"], serde_json::json!(1));
+}
 
-    // autobind:$TMUX_PANE 缺 → Ok(None)(__init__.py:885-887,锁前直接返回,不开锁)。
-    // 强化:断言这是 lock-not-acquired 早退 —— 不写 state.json(无 receiver/owner 落盘),
-    // 不发任何 leader_receiver.* 事件(锁前 return,连 EventLog 都不构造)。
-    #[test]
-    fn autobind_returns_none_when_tmux_pane_missing() {
-        if std::env::var_os("TMUX_PANE").is_some() {
-            return; // 在 tmux 内:走绑定路径,本用例只验缺失分支。
-        }
-        let ws = std::env::temp_dir().join(format!("ta_rs_auto_{}", std::process::id()));
-        std::fs::create_dir_all(&ws).unwrap();
-        let r = autobind_leader_receiver_from_env(&ws, Provider::Codex, LeaseSource::Restart).unwrap();
-        assert!(r.is_none(), "$TMUX_PANE 缺 → autobind 返回 Ok(None)");
-        // lock-not-acquired 早退:state.json 未被写(load 兜底成空 state,无 team_owner/receiver)。
-        let st = crate::state::persist::load_runtime_state(&ws).unwrap();
-        assert!(st.get("leader_receiver").is_none(), "skip 路径不应落 receiver");
-        assert!(st.get("team_owner").is_none(), "skip 路径不应落 owner");
-        // 早退发生在 EventLog 构造前 → 无任何事件文件。
-        let events = crate::event_log::EventLog::new(&ws).tail(50).unwrap();
-        assert!(events.is_empty(), "skip 路径绝不写审计事件");
+// autobind:$TMUX_PANE 缺 → Ok(None)(__init__.py:885-887,锁前直接返回,不开锁)。
+// 强化:断言这是 lock-not-acquired 早退 —— 不写 state.json(无 receiver/owner 落盘),
+// 不发任何 leader_receiver.* 事件(锁前 return,连 EventLog 都不构造)。
+#[test]
+fn autobind_returns_none_when_tmux_pane_missing() {
+    if std::env::var_os("TMUX_PANE").is_some() {
+        return; // 在 tmux 内:走绑定路径,本用例只验缺失分支。
     }
+    let ws = std::env::temp_dir().join(format!("ta_rs_auto_{}", std::process::id()));
+    std::fs::create_dir_all(&ws).unwrap();
+    let r = autobind_leader_receiver_from_env(&ws, Provider::Codex, LeaseSource::Restart).unwrap();
+    assert!(r.is_none(), "$TMUX_PANE 缺 → autobind 返回 Ok(None)");
+    // lock-not-acquired 早退:state.json 未被写(load 兜底成空 state,无 team_owner/receiver)。
+    let st = crate::state::persist::load_runtime_state(&ws).unwrap();
+    assert!(
+        st.get("leader_receiver").is_none(),
+        "skip 路径不应落 receiver"
+    );
+    assert!(st.get("team_owner").is_none(), "skip 路径不应落 owner");
+    // 早退发生在 EventLog 构造前 → 无任何事件文件。
+    let events = crate::event_log::EventLog::new(&ws).tail(50).unwrap();
+    assert!(events.is_empty(), "skip 路径绝不写审计事件");
+}
 
-    // autobind 成功支:$TMUX_PANE 命中 → 锁内 attach_leader_to_state → Ok(Some(receiver))。
-    // receiver.pane_id == 注入 pane,discovery==EnvPane($TMUX_PANE 直接命中)。
-    // env 变更进程全局且与并行 test race,且依赖跨 lane 的 live pane resolver,故 real-machine-gated。
-    #[test]
-    #[ignore = "needs live $TMUX_PANE + cross-lane _resolve_leader_pane; env mutation races parallel tests"]
-    fn autobind_binds_env_pane_on_success() {
-        let ws = std::env::temp_dir().join(format!("ta_rs_auto_ok_{}", std::process::id()));
-        std::fs::create_dir_all(&ws).unwrap();
-        // SAFETY: #[ignore]d,单独 `--ignored --test-threads=1` 跑,不与并行 test race。
-        unsafe { std::env::set_var("TMUX_PANE", "%42") };
-        let r = autobind_leader_receiver_from_env(&ws, Provider::Codex, LeaseSource::Restart).unwrap();
-        unsafe { std::env::remove_var("TMUX_PANE") };
-        let receiver = r.expect("$TMUX_PANE 命中 → Ok(Some(receiver))");
-        assert_eq!(receiver.pane_id, PaneId::new("%42"));
-        assert_eq!(receiver.discovery, Some(Discovery::EnvPane), "$TMUX_PANE 命中 → discovery=env_pane");
-    }
+// autobind 成功支:$TMUX_PANE 命中 → 锁内 attach_leader_to_state → Ok(Some(receiver))。
+// receiver.pane_id == 注入 pane,discovery==EnvPane($TMUX_PANE 直接命中)。
+// env 变更进程全局且与并行 test race,且依赖跨 lane 的 live pane resolver,故 real-machine-gated。
+#[test]
+#[ignore = "needs live $TMUX_PANE + cross-lane _resolve_leader_pane; env mutation races parallel tests"]
+fn autobind_binds_env_pane_on_success() {
+    let ws = std::env::temp_dir().join(format!("ta_rs_auto_ok_{}", std::process::id()));
+    std::fs::create_dir_all(&ws).unwrap();
+    // SAFETY: #[ignore]d,单独 `--ignored --test-threads=1` 跑,不与并行 test race。
+    unsafe { std::env::set_var("TMUX_PANE", "%42") };
+    let r = autobind_leader_receiver_from_env(&ws, Provider::Codex, LeaseSource::Restart).unwrap();
+    unsafe { std::env::remove_var("TMUX_PANE") };
+    let receiver = r.expect("$TMUX_PANE 命中 → Ok(Some(receiver))");
+    assert_eq!(receiver.pane_id, PaneId::new("%42"));
+    assert_eq!(
+        receiver.discovery,
+        Some(Discovery::EnvPane),
+        "$TMUX_PANE 命中 → discovery=env_pane"
+    );
+}
 
-    // claim_leader:无 ambiguous incident → 走 claim_lease_no_incident 直接 acquire/CAS。
-    // 现 unimplemented → RED;锁住返回 LeaseResult。
-    #[test]
-    fn claim_leader_returns_lease_result() {
-        let ws = std::env::temp_dir().join(format!("ta_rs_claim_{}", std::process::id()));
-        std::fs::create_dir_all(&ws).unwrap();
-        let r = claim_leader(&ws, None, false).unwrap();
-        // 无 caller pane(测试进程无 TMUX_PANE)→ refused not_in_tmux_pane(__init__.py:616-618)。
-        if std::env::var_os("TMUX_PANE").is_none() {
-            assert!(!r.ok);
-            assert_eq!(r.status, LeaseStatus::Refused);
-            assert_eq!(r.reason, Some(LeaseReason::NotInTmuxPane));
-            assert!(r.action.is_some());
-        }
+// claim_leader:无 ambiguous incident → 走 claim_lease_no_incident 直接 acquire/CAS。
+// 现 unimplemented → RED;锁住返回 LeaseResult。
+#[test]
+fn claim_leader_returns_lease_result() {
+    let ws = std::env::temp_dir().join(format!("ta_rs_claim_{}", std::process::id()));
+    std::fs::create_dir_all(&ws).unwrap();
+    let r = claim_leader(&ws, None, false).unwrap();
+    // 无 caller pane(测试进程无 TMUX_PANE)→ refused not_in_tmux_pane(__init__.py:616-618)。
+    if std::env::var_os("TMUX_PANE").is_none() {
+        assert!(!r.ok);
+        assert_eq!(r.status, LeaseStatus::Refused);
+        assert_eq!(r.reason, Some(LeaseReason::NotInTmuxPane));
+        assert!(r.action.is_some());
     }
+}
 
-    // write_lease_dual_state:同一锁内双写(C17,__init__.py:588-596);unimplemented → RED。
-    // 强化:带 session_name 时必须落 BOTH —— workspace state.json + team/<session> snapshot,
-    // 两份 team_owner.pane_id / owner_epoch 必须一致(永不分叉)。空 body Ok(()) 会被这里抓。
-    #[test]
-    // Foundation-0 F0-2 conversion of the C17 dual-write invariant test:
-    // legacy per-session snapshot dual-write has been retired
-    // (`.team/artifacts/foundation-0-slice-design.md` §§4-5). The lease
-    // helper now persists ONLY the canonical root state; a legacy
-    // snapshot is diagnostic-only and never re-appears as a side effect
-    // of `write_lease_dual_state`. This test enforces exactly that:
-    // canonical root gets the owner tuple, and the legacy per-session
-    // path stays absent unless a diagnostic path explicitly writes it.
-    fn write_lease_dual_state_persists_canonical_root_only_no_legacy_side_effect() {
-        let ws = std::env::temp_dir().join(format!("ta_rs_dual_{}", std::process::id()));
-        std::fs::create_dir_all(&ws).unwrap();
-        let state = serde_json::json!({
-            "session_name": "team-sess",
-            "team_owner": {"pane_id": "%1", "owner_epoch": 2, "leader_session_uuid": "uuuu"},
-            "leader_receiver": {"pane_id": "%1", "owner_epoch": 2},
-        });
-        write_lease_dual_state(&ws, &state).unwrap();
-        // Canonical root state.json IS written; F0-2 keeps this as the
-        // single product authority.
-        let ws_path = crate::state::persist::runtime_state_path(&ws);
-        let ws_state: serde_json::Value =
-            serde_json::from_str(&std::fs::read_to_string(&ws_path).expect("workspace state.json 必须存在")).unwrap();
-        assert_eq!(ws_state["team_owner"]["pane_id"], serde_json::json!("%1"));
-        assert_eq!(ws_state["team_owner"]["owner_epoch"], serde_json::json!(2));
-        // Legacy per-session snapshot MUST NOT be a side effect of the
-        // lease save path any more — this is the RED2 authority-write
-        // guard shape at the unit-test layer.
-        let legacy_snap = crate::lifecycle::helpers::team_snapshot_path(&ws, "team-sess");
-        assert!(
-            !legacy_snap.exists(),
-            "F0-2: write_lease_dual_state must not write the legacy per-session snapshot; found {}",
-            legacy_snap.display(),
-        );
-    }
+// write_lease_dual_state:同一锁内双写(C17,__init__.py:588-596);unimplemented → RED。
+// 强化:带 session_name 时必须落 BOTH —— workspace state.json + team/<session> snapshot,
+// 两份 team_owner.pane_id / owner_epoch 必须一致(永不分叉)。空 body Ok(()) 会被这里抓。
+#[test]
+// Foundation-0 F0-2 conversion of the C17 dual-write invariant test:
+// legacy per-session snapshot dual-write has been retired
+// (`.team/artifacts/foundation-0-slice-design.md` §§4-5). The lease
+// helper now persists ONLY the canonical root state; a legacy
+// snapshot is diagnostic-only and never re-appears as a side effect
+// of `write_lease_dual_state`. This test enforces exactly that:
+// canonical root gets the owner tuple, and the legacy per-session
+// path stays absent unless a diagnostic path explicitly writes it.
+fn write_lease_dual_state_persists_canonical_root_only_no_legacy_side_effect() {
+    let ws = std::env::temp_dir().join(format!("ta_rs_dual_{}", std::process::id()));
+    std::fs::create_dir_all(&ws).unwrap();
+    let state = serde_json::json!({
+        "session_name": "team-sess",
+        "team_owner": {"pane_id": "%1", "owner_epoch": 2, "leader_session_uuid": "uuuu"},
+        "leader_receiver": {"pane_id": "%1", "owner_epoch": 2},
+    });
+    write_lease_dual_state(&ws, &state).unwrap();
+    // Canonical root state.json IS written; F0-2 keeps this as the
+    // single product authority.
+    let ws_path = crate::state::persist::runtime_state_path(&ws);
+    let ws_state: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(&ws_path).expect("workspace state.json 必须存在"),
+    )
+    .unwrap();
+    assert_eq!(ws_state["team_owner"]["pane_id"], serde_json::json!("%1"));
+    assert_eq!(ws_state["team_owner"]["owner_epoch"], serde_json::json!(2));
+    // Legacy per-session snapshot MUST NOT be a side effect of the
+    // lease save path any more — this is the RED2 authority-write
+    // guard shape at the unit-test layer.
+    let legacy_snap = crate::lifecycle::helpers::team_snapshot_path(&ws, "team-sess");
+    assert!(
+        !legacy_snap.exists(),
+        "F0-2: write_lease_dual_state must not write the legacy per-session snapshot; found {}",
+        legacy_snap.display(),
+    );
+}
 
-    #[test]
-    fn lease_divergence_reads_restart_snapshot_for_special_session_names() {
-        // Foundation-0 F0-2 conversion: `write_lease_dual_state` no longer
-        // side-effects a legacy snapshot; the divergence detector is a
-        // diagnostic reader that fires only when a diagnostic writer
-        // (e.g. `lifecycle::save_team_runtime_snapshot`) has produced
-        // the sidecar. Sequence exercised here: canonical root save →
-        // diagnostic snapshot save with a different pane → divergence
-        // reader observes the drift.
-        let ws = std::env::temp_dir().join(format!("ta_rs_dual_special_{}", std::process::id()));
-        std::fs::create_dir_all(&ws).unwrap();
-        let state = serde_json::json!({
-            "session_name": "team:proj-中文",
-            "team_owner": {"pane_id": "%1", "owner_epoch": 2, "leader_session_uuid": "uuuu"},
-            "leader_receiver": {"pane_id": "%1", "owner_epoch": 2},
-        });
-        write_lease_dual_state(&ws, &state).unwrap();
-        let safe_path = crate::lifecycle::helpers::team_snapshot_path(&ws, "team:proj-中文");
-        let raw_path = crate::model::paths::runtime_dir(&ws)
-            .join("teams")
-            .join("team:proj-中文")
-            .join("state.json");
-        // F0-2: canonical save must not create either the restart-safe
-        // or the raw legacy snapshot as a side effect.
-        assert!(
+#[test]
+fn lease_divergence_reads_restart_snapshot_for_special_session_names() {
+    // Foundation-0 F0-2 conversion: `write_lease_dual_state` no longer
+    // side-effects a legacy snapshot; the divergence detector is a
+    // diagnostic reader that fires only when a diagnostic writer
+    // (e.g. `lifecycle::save_team_runtime_snapshot`) has produced
+    // the sidecar. Sequence exercised here: canonical root save →
+    // diagnostic snapshot save with a different pane → divergence
+    // reader observes the drift.
+    let ws = std::env::temp_dir().join(format!("ta_rs_dual_special_{}", std::process::id()));
+    std::fs::create_dir_all(&ws).unwrap();
+    let state = serde_json::json!({
+        "session_name": "team:proj-中文",
+        "team_owner": {"pane_id": "%1", "owner_epoch": 2, "leader_session_uuid": "uuuu"},
+        "leader_receiver": {"pane_id": "%1", "owner_epoch": 2},
+    });
+    write_lease_dual_state(&ws, &state).unwrap();
+    let safe_path = crate::lifecycle::helpers::team_snapshot_path(&ws, "team:proj-中文");
+    let raw_path = crate::model::paths::runtime_dir(&ws)
+        .join("teams")
+        .join("team:proj-中文")
+        .join("state.json");
+    // F0-2: canonical save must not create either the restart-safe
+    // or the raw legacy snapshot as a side effect.
+    assert!(
             !safe_path.exists(),
             "F0-2: canonical write_lease_dual_state must not create the restart-safe legacy snapshot: {}",
             safe_path.display()
         );
-        assert!(
-            !raw_path.exists(),
-            "F0-2: canonical write_lease_dual_state must not create the raw legacy snapshot: {}",
-            raw_path.display()
-        );
+    assert!(
+        !raw_path.exists(),
+        "F0-2: canonical write_lease_dual_state must not create the raw legacy snapshot: {}",
+        raw_path.display()
+    );
 
-        // Diagnostic write path with a divergent pane so we can exercise
-        // the divergence reader below.
-        let restart_state = serde_json::json!({
-            "session_name": "team:proj-中文",
-            "team_owner": {"pane_id": "%9", "owner_epoch": 2, "leader_session_uuid": "uuuu"},
-            "leader_receiver": {"pane_id": "%9", "owner_epoch": 2},
-        });
-        let restart_path = crate::lifecycle::save_team_runtime_snapshot(&ws, &restart_state).unwrap();
-        assert_eq!(restart_path, safe_path);
-        assert!(
-            restart_path.exists(),
-            "diagnostic snapshot must be written to a real file: {}",
-            restart_path.display()
-        );
+    // Diagnostic write path with a divergent pane so we can exercise
+    // the divergence reader below.
+    let restart_state = serde_json::json!({
+        "session_name": "team:proj-中文",
+        "team_owner": {"pane_id": "%9", "owner_epoch": 2, "leader_session_uuid": "uuuu"},
+        "leader_receiver": {"pane_id": "%9", "owner_epoch": 2},
+    });
+    let restart_path = crate::lifecycle::save_team_runtime_snapshot(&ws, &restart_state).unwrap();
+    assert_eq!(restart_path, safe_path);
+    assert!(
+        restart_path.exists(),
+        "diagnostic snapshot must be written to a real file: {}",
+        restart_path.display()
+    );
 
-        // F0-2 RED1 diagnostic marker is present on the on-disk file.
-        let snap_state: serde_json::Value =
-            serde_json::from_str(&std::fs::read_to_string(&restart_path).unwrap()).unwrap();
-        assert_eq!(snap_state["_not_authoritative"], serde_json::json!(true));
+    // F0-2 RED1 diagnostic marker is present on the on-disk file.
+    let snap_state: serde_json::Value =
+        serde_json::from_str(&std::fs::read_to_string(&restart_path).unwrap()).unwrap();
+    assert_eq!(snap_state["_not_authoritative"], serde_json::json!(true));
 
-        let d = detect_dual_state_divergence(&ws, &state)
-            .unwrap()
-            .expect("divergence detector must read the diagnostic snapshot");
-        assert_eq!(d["workspace_owner_pane"], serde_json::json!("%1"));
-        assert_eq!(d["team_owner_pane"], serde_json::json!("%9"));
-        assert_eq!(d["workspace_receiver_pane"], serde_json::json!("%1"));
-        assert_eq!(d["team_receiver_pane"], serde_json::json!("%9"));
-    }
+    let d = detect_dual_state_divergence(&ws, &state)
+        .unwrap()
+        .expect("divergence detector must read the diagnostic snapshot");
+    assert_eq!(d["workspace_owner_pane"], serde_json::json!("%1"));
+    assert_eq!(d["team_owner_pane"], serde_json::json!("%9"));
+    assert_eq!(d["workspace_receiver_pane"], serde_json::json!("%1"));
+    assert_eq!(d["team_receiver_pane"], serde_json::json!("%9"));
+}
 
-    #[test]
-    fn detect_dual_state_divergence_reads_legacy_raw_snapshot_when_safe_absent() {
-        let ws = std::env::temp_dir().join(format!("ta_rs_dual_legacy_{}", std::process::id()));
-        std::fs::create_dir_all(&ws).unwrap();
-        let state = serde_json::json!({
-            "session_name": "team:legacy-中文",
-            "team_owner": {"pane_id": "%1", "leader_session_uuid": "uuuu", "owner_epoch": 2},
-            "leader_receiver": {"pane_id": "%1", "owner_epoch": 2},
-        });
-        let safe_path = crate::lifecycle::helpers::team_snapshot_path(&ws, "team:legacy-中文");
-        assert!(!safe_path.exists(), "test setup requires safe path absent");
-        let raw_dir = crate::model::paths::runtime_dir(&ws)
-            .join("teams")
-            .join("team:legacy-中文");
-        std::fs::create_dir_all(&raw_dir).unwrap();
-        let snap = serde_json::json!({
-            "session_name": "team:legacy-中文",
-            "team_owner": {"pane_id": "%8", "leader_session_uuid": "uuuu", "owner_epoch": 2},
-            "leader_receiver": {"pane_id": "%8", "owner_epoch": 2},
-        });
-        std::fs::write(raw_dir.join("state.json"), serde_json::to_string(&snap).unwrap()).unwrap();
+#[test]
+fn detect_dual_state_divergence_reads_legacy_raw_snapshot_when_safe_absent() {
+    let ws = std::env::temp_dir().join(format!("ta_rs_dual_legacy_{}", std::process::id()));
+    std::fs::create_dir_all(&ws).unwrap();
+    let state = serde_json::json!({
+        "session_name": "team:legacy-中文",
+        "team_owner": {"pane_id": "%1", "leader_session_uuid": "uuuu", "owner_epoch": 2},
+        "leader_receiver": {"pane_id": "%1", "owner_epoch": 2},
+    });
+    let safe_path = crate::lifecycle::helpers::team_snapshot_path(&ws, "team:legacy-中文");
+    assert!(!safe_path.exists(), "test setup requires safe path absent");
+    let raw_dir = crate::model::paths::runtime_dir(&ws)
+        .join("teams")
+        .join("team:legacy-中文");
+    std::fs::create_dir_all(&raw_dir).unwrap();
+    let snap = serde_json::json!({
+        "session_name": "team:legacy-中文",
+        "team_owner": {"pane_id": "%8", "leader_session_uuid": "uuuu", "owner_epoch": 2},
+        "leader_receiver": {"pane_id": "%8", "owner_epoch": 2},
+    });
+    std::fs::write(
+        raw_dir.join("state.json"),
+        serde_json::to_string(&snap).unwrap(),
+    )
+    .unwrap();
 
-        let d = detect_dual_state_divergence(&ws, &state)
-            .unwrap()
-            .expect("legacy raw snapshot fallback must preserve old teams");
-        assert_eq!(d["workspace_owner_pane"], serde_json::json!("%1"));
-        assert_eq!(d["team_owner_pane"], serde_json::json!("%8"));
-        assert_eq!(d["workspace_receiver_pane"], serde_json::json!("%1"));
-        assert_eq!(d["team_receiver_pane"], serde_json::json!("%8"));
-    }
+    let d = detect_dual_state_divergence(&ws, &state)
+        .unwrap()
+        .expect("legacy raw snapshot fallback must preserve old teams");
+    assert_eq!(d["workspace_owner_pane"], serde_json::json!("%1"));
+    assert_eq!(d["team_owner_pane"], serde_json::json!("%8"));
+    assert_eq!(d["workspace_receiver_pane"], serde_json::json!("%1"));
+    assert_eq!(d["team_receiver_pane"], serde_json::json!("%8"));
+}
 
-    // detect_dual_state_divergence:无 session_name → None(__init__.py:560-561);unimplemented → RED。
-    #[test]
-    fn detect_dual_state_divergence_none_without_session_name() {
-        let ws = std::env::temp_dir().join(format!("ta_rs_div_{}", std::process::id()));
-        std::fs::create_dir_all(&ws).unwrap();
-        let state = serde_json::json!({"team_owner": {"pane_id": "%1"}}); // 无 session_name。
-        let d = detect_dual_state_divergence(&ws, &state).unwrap();
-        assert!(d.is_none(), "无 session_name → 无 snapshot 可比 → None");
-    }
+// detect_dual_state_divergence:无 session_name → None(__init__.py:560-561);unimplemented → RED。
+#[test]
+fn detect_dual_state_divergence_none_without_session_name() {
+    let ws = std::env::temp_dir().join(format!("ta_rs_div_{}", std::process::id()));
+    std::fs::create_dir_all(&ws).unwrap();
+    let state = serde_json::json!({"team_owner": {"pane_id": "%1"}}); // 无 session_name。
+    let d = detect_dual_state_divergence(&ws, &state).unwrap();
+    assert!(d.is_none(), "无 session_name → 无 snapshot 可比 → None");
+}
 
-    // C18 核心:workspace state.json 与 team snapshot 在 owner pane 上分叉 → Some(具体分叉字段)。
-    // golden(probe_leader_strengthen.py):workspace owner=%1 / snapshot owner=%9 →
-    // {workspace_owner_pane:%1, team_owner_pane:%9, workspace_receiver_pane:%1, team_receiver_pane:%9}。
-    // unimplemented → RED。
-    #[test]
-    fn detect_dual_state_divergence_reports_diverging_panes() {
-        let ws = std::env::temp_dir().join(format!("ta_rs_divx_{}", std::process::id()));
-        std::fs::create_dir_all(&ws).unwrap();
-        let state = serde_json::json!({
-            "session_name": "team-sess",
-            "team_owner": {"pane_id": "%1", "leader_session_uuid": "uuuu", "owner_epoch": 2},
-            "leader_receiver": {"pane_id": "%1", "owner_epoch": 2},
-        });
-        // 写一份分叉 snapshot:owner/receiver pane 都是 %9(不同于 workspace 的 %1)。
-        let snap_dir = crate::model::paths::runtime_dir(&ws).join("teams").join("team-sess");
-        std::fs::create_dir_all(&snap_dir).unwrap();
-        let snap = serde_json::json!({
-            "session_name": "team-sess",
-            "team_owner": {"pane_id": "%9", "leader_session_uuid": "uuuu", "owner_epoch": 2},
-            "leader_receiver": {"pane_id": "%9", "owner_epoch": 2},
-        });
-        std::fs::write(snap_dir.join("state.json"), serde_json::to_string(&snap).unwrap()).unwrap();
-        let d = detect_dual_state_divergence(&ws, &state).unwrap().expect("分叉 → Some(details)");
-        assert_eq!(d["workspace_owner_pane"], serde_json::json!("%1"));
-        assert_eq!(d["team_owner_pane"], serde_json::json!("%9"));
-        assert_eq!(d["workspace_receiver_pane"], serde_json::json!("%1"));
-        assert_eq!(d["team_receiver_pane"], serde_json::json!("%9"));
+// C18 核心:workspace state.json 与 team snapshot 在 owner pane 上分叉 → Some(具体分叉字段)。
+// golden(probe_leader_strengthen.py):workspace owner=%1 / snapshot owner=%9 →
+// {workspace_owner_pane:%1, team_owner_pane:%9, workspace_receiver_pane:%1, team_receiver_pane:%9}。
+// unimplemented → RED。
+#[test]
+fn detect_dual_state_divergence_reports_diverging_panes() {
+    let ws = std::env::temp_dir().join(format!("ta_rs_divx_{}", std::process::id()));
+    std::fs::create_dir_all(&ws).unwrap();
+    let state = serde_json::json!({
+        "session_name": "team-sess",
+        "team_owner": {"pane_id": "%1", "leader_session_uuid": "uuuu", "owner_epoch": 2},
+        "leader_receiver": {"pane_id": "%1", "owner_epoch": 2},
+    });
+    // 写一份分叉 snapshot:owner/receiver pane 都是 %9(不同于 workspace 的 %1)。
+    let snap_dir = crate::model::paths::runtime_dir(&ws)
+        .join("teams")
+        .join("team-sess");
+    std::fs::create_dir_all(&snap_dir).unwrap();
+    let snap = serde_json::json!({
+        "session_name": "team-sess",
+        "team_owner": {"pane_id": "%9", "leader_session_uuid": "uuuu", "owner_epoch": 2},
+        "leader_receiver": {"pane_id": "%9", "owner_epoch": 2},
+    });
+    std::fs::write(
+        snap_dir.join("state.json"),
+        serde_json::to_string(&snap).unwrap(),
+    )
+    .unwrap();
+    let d = detect_dual_state_divergence(&ws, &state)
+        .unwrap()
+        .expect("分叉 → Some(details)");
+    assert_eq!(d["workspace_owner_pane"], serde_json::json!("%1"));
+    assert_eq!(d["team_owner_pane"], serde_json::json!("%9"));
+    assert_eq!(d["workspace_receiver_pane"], serde_json::json!("%1"));
+    assert_eq!(d["team_receiver_pane"], serde_json::json!("%9"));
 
-        // 匹配 snapshot(与 workspace 一致)→ None(无分叉)。
-        std::fs::write(snap_dir.join("state.json"), serde_json::to_string(&state).unwrap()).unwrap();
-        assert!(
-            detect_dual_state_divergence(&ws, &state).unwrap().is_none(),
-            "两份一致 → 无分叉 → None"
-        );
-    }
+    // 匹配 snapshot(与 workspace 一致)→ None(无分叉)。
+    std::fs::write(
+        snap_dir.join("state.json"),
+        serde_json::to_string(&state).unwrap(),
+    )
+    .unwrap();
+    assert!(
+        detect_dual_state_divergence(&ws, &state).unwrap().is_none(),
+        "两份一致 → 无分叉 → None"
+    );
+}
 
 // R8 D4 (c-lite offline byte-lock): the leader_receiver.requeued_exhausted_watchers payload-build,
 // extracted from the real-tmux attach flow into a pure helper, must produce golden shape.
@@ -308,17 +346,34 @@ fn r8_requeued_exhausted_watchers_event_payload_golden_shape() {
         &crate::model::ids::TeamKey::new("team-a"),
         &notices,
     );
-    let keys: std::collections::BTreeSet<&str> =
-        payload.as_object().unwrap().keys().map(String::as_str).collect();
-    let expected: std::collections::BTreeSet<&str> = ["watcher_ids", "count", "trigger"].into_iter().collect();
+    let keys: std::collections::BTreeSet<&str> = payload
+        .as_object()
+        .unwrap()
+        .keys()
+        .map(String::as_str)
+        .collect();
+    let expected: std::collections::BTreeSet<&str> =
+        ["watcher_ids", "count", "trigger"].into_iter().collect();
     assert_eq!(keys, expected,
         "D4: leader_receiver.requeued_exhausted_watchers payload must be golden {{watcher_ids, count, trigger}} \
          (leader/__init__.py:39-44), not the Rust {{pane_id, team_id, watcher_ids, requeued}}; got {keys:?}");
     assert_eq!(
-        payload.get("watcher_ids").and_then(|v| v.as_array()).map(|a| a.iter().filter_map(|x| x.as_str()).collect::<Vec<_>>()),
-        Some(vec!["w1"]), "watcher_ids must be the string list of requeued ids");
-    assert_eq!(payload.get("count").and_then(|v| v.as_u64()), Some(1), "count == number of requeued watchers");
-    assert_eq!(payload.get("trigger").and_then(|v| v.as_str()), Some("attach_leader"));
+        payload
+            .get("watcher_ids")
+            .and_then(|v| v.as_array())
+            .map(|a| a.iter().filter_map(|x| x.as_str()).collect::<Vec<_>>()),
+        Some(vec!["w1"]),
+        "watcher_ids must be the string list of requeued ids"
+    );
+    assert_eq!(
+        payload.get("count").and_then(|v| v.as_u64()),
+        Some(1),
+        "count == number of requeued watchers"
+    );
+    assert_eq!(
+        payload.get("trigger").and_then(|v| v.as_str()),
+        Some("attach_leader")
+    );
 }
 
 // 0.5.x Windows portability Batch 5: `FakeAppServer` uses UNIX domain
@@ -355,8 +410,14 @@ fn app_server_attach_writes_transport_kind_tuple_and_advances_epoch() {
         .expect("app-server attach should succeed");
 
     assert_eq!(out["ok"], serde_json::json!(true));
-    assert_eq!(out["leader_receiver"]["transport_kind"], serde_json::json!("codex_app_server"));
-    assert_eq!(out["leader_receiver"]["mode"], serde_json::json!("codex_app_server"));
+    assert_eq!(
+        out["leader_receiver"]["transport_kind"],
+        serde_json::json!("codex_app_server")
+    );
+    assert_eq!(
+        out["leader_receiver"]["mode"],
+        serde_json::json!("codex_app_server")
+    );
     assert_eq!(
         out["leader_receiver"]["app_server"]["thread_id"],
         serde_json::json!("thread-live")
@@ -376,7 +437,10 @@ fn app_server_attach_writes_transport_kind_tuple_and_advances_epoch() {
         serde_json::json!("thread-live")
     );
     assert_eq!(saved["leader_receiver"].get("pane_id"), None);
-    assert_eq!(saved["team_owner"]["transport_kind"], serde_json::json!("codex_app_server"));
+    assert_eq!(
+        saved["team_owner"]["transport_kind"],
+        serde_json::json!("codex_app_server")
+    );
     assert_eq!(saved["owner_epoch"], serde_json::json!(1));
 }