@team-agent/installer 0.5.47 → 0.5.48

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.47"
+version = "0.5.48"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.47"
+version = "0.5.48"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/lifecycle/launch.rs

@@ -4366,6 +4366,7 @@ pub fn fork_agent_with_transport(
     // E5 §3:team_dir(角色定义+profiles)恒用户目录。spec 读用 selector 解析的 spec_path
     // (读序 B:runtime 优先、legacy 回落),写恒走 runtime_spec_path(canonical 落点)。
     let fork_team_dir = selected.team_dir.clone();
+    let fork_team = selected.team_key.clone();
     let read_spec_path = selected
         .spec_path
         .clone()
@@ -4373,7 +4374,7 @@ pub fn fork_agent_with_transport(
     let workspace = selected.run_workspace;
     let state = selected.state;
     ensure_owner_allowed_for_state(&state, Some(source_agent_id))?;
-    let spec_path = crate::model::paths::runtime_spec_path(&workspace, &selected.team_key);
+    let spec_path = crate::model::paths::runtime_spec_path(&workspace, &fork_team);
     let text = std::fs::read_to_string(&read_spec_path)
         .map_err(|e| LifecycleError::Compile(format!("{}: {e}", read_spec_path.display())))?;
     let spec = yaml::loads(&text).map_err(|e| LifecycleError::Compile(e.to_string()))?;
@@ -4487,7 +4488,6 @@ pub fn fork_agent_with_transport(
         &safety,
     )?;
     let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
-    let fork_team = crate::messaging::leader_receiver::active_team_key(&workspace, &state);
     let mcp_config = adapter.mcp_config(auth_mode).map_err(|e| {
         let _ = std::fs::write(&spec_path, text.as_bytes());
         LifecycleError::Provider(e.to_string())
@@ -4625,13 +4625,16 @@ pub fn fork_agent_with_transport(
             &mcp_config_path,
             as_agent_id,
             &profile_launch,
+            &fork_team,
         );
         return Err(e);
     }
-    if let Err(e) = crate::state::persist::save_runtime_state_with_lifecycle_topology_authority(
-        &workspace,
+    if let Err(e) = crate::state::repository::StateRepository::new(&workspace).save(
+        crate::state::repository::StateWriteIntent::ForkAgent {
+            team_key: &fork_team,
+            agent_id: as_agent_id.as_str(),
+        },
         &next_state,
-        &[as_agent_id.as_str()],
     ) {
         rollback_fork_after_spawn(
             &workspace,
@@ -4644,9 +4647,56 @@ pub fn fork_agent_with_transport(
             &mcp_config_path,
             as_agent_id,
             &profile_launch,
+            &fork_team,
         );
         return Err(LifecycleError::StatePersist(e.to_string()));
     }
+    let registration =
+        crate::state::projection::select_runtime_state(&workspace, Some(fork_team.as_str()))
+            .map_err(|e| e.to_string())
+            .and_then(|saved| {
+                let agent = saved
+                    .get("agents")
+                    .and_then(|agents| agents.get(as_agent_id.as_str()))
+                    .ok_or_else(|| "canonical team row is missing".to_string())?;
+                if agent.get("pane_id").and_then(serde_json::Value::as_str)
+                    != Some(spawn.pane_id.as_str())
+                {
+                    return Err("canonical team pane_id does not match spawned pane".to_string());
+                }
+                if agent.get("window").and_then(serde_json::Value::as_str) != Some(window.as_str())
+                {
+                    return Err("canonical team window does not match spawned window".to_string());
+                }
+                if let Some(pid) = spawn.child_pid {
+                    if agent.get("pane_pid").and_then(serde_json::Value::as_u64)
+                        != Some(u64::from(pid))
+                    {
+                        return Err(
+                            "canonical team pane_pid does not match spawned process".to_string()
+                        );
+                    }
+                }
+                Ok(())
+            });
+    if let Err(reason) = registration {
+        rollback_fork_after_spawn(
+            &workspace,
+            &spec_path,
+            &text,
+            &old_state,
+            transport,
+            &session_name,
+            &window,
+            &mcp_config_path,
+            as_agent_id,
+            &profile_launch,
+            &fork_team,
+        );
+        return Err(LifecycleError::StatePersist(format!(
+            "fork spawned but team registration readback failed: {reason}"
+        )));
+    }
     if let Err(e) = maybe_fail_fork_after_spawn("start_coordinator") {
         rollback_fork_after_spawn(
             &workspace,
@@ -4659,6 +4709,7 @@ pub fn fork_agent_with_transport(
             &mcp_config_path,
             as_agent_id,
             &profile_launch,
+            &fork_team,
         );
         return Err(e);
     }
@@ -4678,6 +4729,7 @@ pub fn fork_agent_with_transport(
             &mcp_config_path,
             as_agent_id,
             &profile_launch,
+            &fork_team,
         );
         LifecycleError::StatePersist(e.to_string())
     })?;
@@ -4704,16 +4756,19 @@ fn rollback_fork_after_spawn(
     mcp_config_path: &Path,
     agent_id: &AgentId,
     profile_launch: &crate::provider::ProviderProfileLaunch,
+    team_key: &str,
 ) {
     let _ = transport.kill_window(&Target::SessionWindow {
         session: session_name.clone(),
         window: window.clone(),
     });
     let _ = std::fs::write(spec_path, spec_text.as_bytes());
-    let _ = crate::state::persist::save_runtime_state_with_deleted_agents(
-        workspace,
+    let _ = crate::state::repository::StateRepository::new(workspace).save(
+        crate::state::repository::StateWriteIntent::AgentRollback {
+            team_key: Some(team_key),
+            agent_id: agent_id.as_str(),
+        },
         old_state,
-        &[agent_id.as_str()],
     );
     cleanup_fork_mcp_artifacts(workspace, agent_id, mcp_config_path, profile_launch);
 }

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -113,11 +113,7 @@ pub(crate) fn start_agent_at_paths(
     let window = agent_window(&agent, agent_id);
     let adaptive_layout =
         open_display && crate::lifecycle::launch::state_uses_adaptive_layout(&state);
-    let fake_provider = raw_agent
-        .get("provider")
-        .and_then(serde_json::Value::as_str)
-        .is_some_and(|provider| provider.eq_ignore_ascii_case("fake"));
-    if force && !fake_provider && is_per_agent_window(&window, agent_id) {
+    if force && is_per_agent_window(&window, agent_id) {
         let expected_pane_id = raw_agent
             .get("pane_id")
             .and_then(serde_json::Value::as_str)
@@ -276,12 +272,20 @@ pub(crate) fn start_agent_at_paths(
         None,
         Some(resolved_team_key.as_str()),
     )?;
-    verify_spawned_pane_matches_target(
+    if let Err(error) = verify_spawned_pane_matches_target(
         transport,
         &spawn.spawn.pane_id,
         &session_name,
         &spawn.spawn.window,
-    )?;
+    ) {
+        if let Err(rollback_error) = transport.kill_pane(&spawn.spawn.pane_id) {
+            return Err(LifecycleError::RequirementUnmet(format!(
+                "{error}; failed to roll back spawned pane {}: {rollback_error}",
+                spawn.spawn.pane_id.as_str()
+            )));
+        }
+        return Err(error);
+    }
     let actual_spawn_window = spawn.spawn.window.as_str().to_string();
     mark_agent_started(
         &mut state,

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -89,11 +89,19 @@ fn same_role_cohort_error(
     expected_live: usize,
     expected_old_only: bool,
 ) -> Option<String> {
-    let panes = transport.list_targets().ok()?;
+    let panes = match transport.list_targets() {
+        Ok(panes) => panes,
+        Err(error) => {
+            return Some(format!(
+                "{operation} refused: same-role cohort observation failed: {error}"
+            ));
+        }
+    };
     let mut cardinality_proofs = Vec::new();
     let mut binding_proofs = Vec::new();
+    let mut observation_proofs = Vec::new();
     for target in targets {
-        let live_panes = panes
+        let candidate_panes = panes
             .iter()
             .filter(|pane| pane.session.as_str() == session_name.as_str())
             .filter(|pane| {
@@ -101,20 +109,30 @@ fn same_role_cohort_error(
                     .as_ref()
                     .is_some_and(|window| window.as_str() == target.window)
             })
-            .filter(|pane| {
-                !expected_old_only
-                    || target
-                        .expected_pane_id
-                        .as_deref()
-                        .is_some_and(|expected| pane.pane_id.as_str() == expected)
-            })
-            .filter(|pane| {
-                transport
-                    .liveness(&pane.pane_id)
-                    .is_ok_and(|live| live == crate::transport::PaneLiveness::Live)
-            })
-            .map(|pane| pane.pane_id.as_str().to_string())
             .collect::<Vec<_>>();
+        let mut live_panes = Vec::new();
+        for pane in candidate_panes {
+            match transport.liveness(&pane.pane_id) {
+                Ok(crate::transport::PaneLiveness::Live) => {
+                    live_panes.push(pane.pane_id.as_str().to_string());
+                }
+                Ok(crate::transport::PaneLiveness::Dead) => {}
+                Ok(crate::transport::PaneLiveness::Unknown) => {
+                    observation_proofs.push(format!(
+                        "{}:window={}:pane={}:liveness=unknown",
+                        target.agent_id,
+                        target.window,
+                        pane.pane_id.as_str()
+                    ));
+                }
+                Err(error) => observation_proofs.push(format!(
+                    "{}:window={}:pane={}:liveness_error={error}",
+                    target.agent_id,
+                    target.window,
+                    pane.pane_id.as_str()
+                )),
+            }
+        }
         if live_panes.len() != expected_live {
             cardinality_proofs.push(format!(
                 "{}:window={}:live_panes=[{}]",
@@ -135,6 +153,12 @@ fn same_role_cohort_error(
             }
         }
     }
+    if !observation_proofs.is_empty() {
+        return Some(format!(
+            "{operation} refused: same-role cohort observation failed; {}",
+            observation_proofs.join("; ")
+        ));
+    }
     if !binding_proofs.is_empty() {
         return Some(format!(
             "{operation} refused: spawn identity/binding mismatch; {}",
@@ -476,6 +500,16 @@ pub(super) fn spawn_agent_window(
     );
     if let Some(error) = startup_prompt.capture_error.as_deref() {
         if is_structural_startup_prompt_error(error) {
+            if let Err(rollback_error) = transport.kill_pane(&spawn.pane_id) {
+                return Err(LifecycleError::Transport(format!(
+                    "startup prompt structural failure for {}:{} pane {}: {}; failed to roll back spawned pane: {}",
+                    session_name.as_str(),
+                    window.as_str(),
+                    spawn.pane_id.as_str(),
+                    error,
+                    rollback_error
+                )));
+            }
             return Err(LifecycleError::Transport(format!(
                 "startup prompt structural failure for {}:{} pane {}: {}",
                 session_name.as_str(),

package/crates/team-agent/src/lifecycle/tests/lane_ops.rs

@@ -14,7 +14,7 @@ pub(super) type LaneSpawns = std::sync::Arc<std::sync::Mutex<Vec<(String, Vec<St
 /// end-to-end in-process.
 pub(super) struct LaneTransport {
     session: String,
-    windows: Vec<String>,
+    windows: std::sync::Arc<std::sync::Mutex<Vec<String>>>,
     killed: LaneKills,
     spawns: LaneSpawns,
 }
@@ -22,7 +22,9 @@ impl LaneTransport {
     pub(super) fn new(session: &str, windows: &[&str]) -> Self {
         Self {
             session: session.to_string(),
-            windows: windows.iter().map(|w| (*w).to_string()).collect(),
+            windows: std::sync::Arc::new(std::sync::Mutex::new(
+                windows.iter().map(|w| (*w).to_string()).collect(),
+            )),
             killed: std::sync::Arc::new(std::sync::Mutex::new(Vec::new())),
             spawns: std::sync::Arc::new(std::sync::Mutex::new(Vec::new())),
         }
@@ -120,6 +122,8 @@ impl crate::transport::Transport for LaneTransport {
     ) -> Result<Vec<crate::transport::PaneInfo>, crate::transport::TransportError> {
         Ok(self
             .windows
+            .lock()
+            .unwrap()
             .iter()
             .map(|w| crate::transport::PaneInfo {
                 pane_id: crate::transport::PaneId::new(format!("%{w}")),
@@ -149,6 +153,8 @@ impl crate::transport::Transport for LaneTransport {
         if s.as_str() == self.session {
             Ok(self
                 .windows
+                .lock()
+                .unwrap()
                 .iter()
                 .map(|w| crate::transport::WindowName::new(w.as_str()))
                 .collect())
@@ -174,13 +180,22 @@ impl crate::transport::Transport for LaneTransport {
         &self,
         t: &crate::transport::Target,
     ) -> Result<(), crate::transport::TransportError> {
-        let name = match t {
-            crate::transport::Target::Pane(p) => p.as_str().to_string(),
+        let (name, window) = match t {
+            crate::transport::Target::Pane(p) => (p.as_str().to_string(), None),
             crate::transport::Target::SessionWindow { session, window } => {
-                format!("{}:{}", session.as_str(), window.as_str())
+                (
+                    format!("{}:{}", session.as_str(), window.as_str()),
+                    Some(window.as_str()),
+                )
             }
         };
         self.killed.lock().unwrap().push(name);
+        if let Some(window) = window {
+            self.windows
+                .lock()
+                .unwrap()
+                .retain(|candidate| candidate != window);
+        }
         Ok(())
     }
     fn attach_session(

package/crates/team-agent/src/state/repository.rs

@@ -315,16 +315,22 @@ fn route_direct(
         StateWriteIntent::RemoveAgent { agent_id, .. } => {
             helper_write_team_scoped_with_deleted_agents(workspace, state, &[agent_id])
         }
-        // ForkAgent -> the launch fork writer uses the root helper at
-        // lifecycle/launch.rs:4542.
-        StateWriteIntent::ForkAgent { .. } => helper_write_root(workspace, state),
-        // AgentRollback -> pre-state rollback uses either the root helper or
-        // the deleted-agents variant depending on the caller; S1a keeps the
-        // root form as the shared entry, and rollback specializations retain
-        // their allowlisted callsites in launch.rs / restart/remove.rs.
-        StateWriteIntent::AgentRollback { agent_id, .. } => {
-            helper_write_root_with_deleted_agents(workspace, state, &[agent_id])
+        // ForkAgent mutates a selected team projection, so persist it back to
+        // that projection with the forked row as lifecycle topology authority.
+        StateWriteIntent::ForkAgent { agent_id, .. } => {
+            helper_write_team_scoped_with_lifecycle_topology_authority(
+                workspace,
+                state,
+                &[agent_id],
+            )
         }
+        // Team-scoped rollback must restore only the selected projection and
+        // preserve sibling teams. Legacy callers without a team keep the root
+        // deleted-agents writer.
+        StateWriteIntent::AgentRollback { team_key, agent_id } => match team_key {
+            Some(_) => helper_write_team_scoped_with_deleted_agents(workspace, state, &[agent_id]),
+            None => helper_write_root_with_deleted_agents(workspace, state, &[agent_id]),
+        },
         // ClaimLeader -> leader/lease.rs:1625 uses the root helper, and the
         // scoped preserve-claim-fields variant at :1702 uses the team-tombstoned
         // agents helper.

package/crates/team-agent/src/tmux_backend/tests.rs

@@ -514,9 +514,9 @@ fn spawn_into_same_named_replacement_returns_identity_created_by_spawn_command()
 }
 
 #[test]
-fn spawn_with_command_refuses_spawn_pane_owned_by_other_window() {
+fn spawn_with_command_refuses_and_rolls_back_spawn_pane_owned_by_other_window() {
     let pane_inventory = "%5\tteamsess\t1\tw2\t0\t/dev/ttys005\tnode\t1\t/work/dir\t1\t0\t125\n";
-    let (be, _rec) = backend_with(
+    let (be, rec) = backend_with(
         MockResp::Out(ok("")),
         vec![
             MockResp::Out(ok("%5\n")),
@@ -539,6 +539,48 @@ fn spawn_with_command_refuses_spawn_pane_owned_by_other_window() {
             && msg.contains("observed=teamsess:w2"),
         "error must include requested/observed ownership evidence, got {msg}"
     );
+    let calls = rec.lock().unwrap().clone();
+    assert!(
+        calls
+            .iter()
+            .any(|call| call == &svec(&["tmux", "kill-pane", "-t", "%5"])),
+        "identity mismatch must roll back the exact pane created by this spawn; calls={calls:?}"
+    );
+}
+
+#[test]
+fn spawn_with_command_retries_until_spawn_pane_is_visible() {
+    let pane_inventory = "%6\tteamsess\t1\tw1\t0\t/dev/ttys006\tnode\t1\t/work/dir\t1\t0\t126\n";
+    let (be, rec) = backend_with(
+        MockResp::Out(ok(pane_inventory)),
+        vec![MockResp::Out(ok("%6\n")), MockResp::Out(ok(""))],
+    );
+    let result = be
+        .spawn_into(
+            &SessionName::new("teamsess"),
+            &WindowName::new("w1"),
+            &svec(&["provider-bin"]),
+            Path::new("/work/dir"),
+            &BTreeMap::new(),
+        )
+        .expect("spawn pane must tolerate bounded tmux inventory lag");
+    let calls = rec.lock().unwrap().clone();
+
+    assert_eq!(result.pane_id.as_str(), "%6");
+    assert_eq!(
+        calls
+            .iter()
+            .filter(|call| call.get(1).is_some_and(|arg| arg == "list-panes"))
+            .count(),
+        2,
+        "spawn identity must retry the same pane id until it becomes visible; calls={calls:?}"
+    );
+    assert!(
+        calls
+            .iter()
+            .all(|call| call.get(1).is_none_or(|arg| arg != "kill-pane")),
+        "a delayed but valid identity must not be rolled back; calls={calls:?}"
+    );
 }
 
 #[test]
@@ -1742,16 +1784,16 @@ fn query_single_field_argv_and_nonzero_maps_to_none() {
 }
 
 // ── 11. list_targets (TRANSPORT TRIO) — `list-panes -a -F TMUX_PANE_FORMAT` + per-line parse ────
-// Golden _legacy_pane_discovery.py:29-33 _tmux_list_panes: `tmux list-panes -a -F <TMUX_PANE_FORMAT>`
-// (returncode != 0 -> []), parse each tab line via _parse_tmux_pane_info. TMUX_PANE_FORMAT
-// (runtime.py:456-460) is the byte-exact tab string locked below; P5 (C-P5-3) appends
+// Golden _legacy_pane_discovery.py:29-33 _tmux_list_panes: `tmux list-panes -a -F <TMUX_PANE_FORMAT>`.
+// The Rust backend uses the printable separator locked below so the 12-field frame stays explicit
+// in argv/log evidence, while retaining the golden nonzero -> empty inventory behavior. P5 (C-P5-3) appends
 // `#{pane_pid}` as field 12 so pane pids ride the single list-panes call (the per-pane
 // display-message N+1 fallback is gone). leader_env stays the reverse-env real-machine bit.
 #[test]
 fn list_targets_argv_and_parses_tmux_pane_format() {
-    const FMT: &str = "#{pane_id}\t#{session_name}\t#{window_index}\t#{window_name}\t#{pane_index}\t#{pane_tty}\t#{pane_current_command}\t#{pane_active}\t#{pane_current_path}\t#{session_attached}\t#{pane_in_mode}\t#{pane_pid}";
-    let stdout = "%7\tteam-x\t0\twin0\t0\t/dev/ttys003\tcodex\t1\t/Users/me/work\t1\t0\t41001\n\
-                      %8\tteam-x\t1\twin1\t0\t/dev/ttys004\tnode\t0\t/Users/me/other\t0\t0\t41002\n";
+    const FMT: &str = "#{pane_id}__TA_FIELD__#{session_name}__TA_FIELD__#{window_index}__TA_FIELD__#{window_name}__TA_FIELD__#{pane_index}__TA_FIELD__#{pane_tty}__TA_FIELD__#{pane_current_command}__TA_FIELD__#{pane_active}__TA_FIELD__#{pane_current_path}__TA_FIELD__#{session_attached}__TA_FIELD__#{pane_in_mode}__TA_FIELD__#{pane_pid}";
+    let stdout = "%7__TA_FIELD__team-x__TA_FIELD__0__TA_FIELD__win0__TA_FIELD__0__TA_FIELD__/dev/ttys003__TA_FIELD__codex__TA_FIELD__1__TA_FIELD__/Users/me/work__TA_FIELD__1__TA_FIELD__0__TA_FIELD__41001\n\
+                      %8__TA_FIELD__team-x__TA_FIELD__1__TA_FIELD__win1__TA_FIELD__0__TA_FIELD__/dev/ttys004__TA_FIELD__node__TA_FIELD__0__TA_FIELD__/Users/me/other__TA_FIELD__0__TA_FIELD__0__TA_FIELD__41002\n";
     let (be, rec) = backend_with(MockResp::Out(ok(stdout)), vec![]);
     let panes = be.list_targets().expect("list_targets ok");
     assert_eq!(

package/crates/team-agent/src/tmux_backend.rs

@@ -71,6 +71,8 @@ pub trait CommandRunner: Send + Sync {
 pub struct RealCommandRunner;
 
 const COMMAND_TIMEOUT: Duration = Duration::from_secs(5);
+const SPAWN_IDENTITY_TIMEOUT: Duration = Duration::from_millis(500);
+const SPAWN_IDENTITY_POLL_INTERVAL: Duration = Duration::from_millis(25);
 
 impl CommandRunner for RealCommandRunner {
     fn run(&self, argv: &[String]) -> Result<CommandOutput, std::io::Error> {
@@ -779,46 +781,68 @@ impl TmuxBackend {
             });
         }
         let pane_id = PaneId::new(pane);
-        let targets = self.list_targets()?;
-        if let Some(target) = targets.iter().find(|target| {
-            target.pane_id == pane_id
-                && target.session.as_str() == session.as_str()
-                && target
-                    .window_name
-                    .as_ref()
-                    .is_some_and(|name| name.as_str() == window.as_str())
-        }) {
-            return Ok(SpawnResult {
-                pane_id,
-                session: session.clone(),
-                window: window.clone(),
-                child_pid: target.pane_pid,
-            });
-        }
-        let observed = targets
-            .iter()
-            .find(|target| target.pane_id == pane_id)
-            .map(|target| {
-                format!(
-                    "{}:{}",
-                    target.session.as_str(),
-                    target
-                        .window_name
-                        .as_ref()
-                        .map(WindowName::as_str)
-                        .unwrap_or("<unknown>")
-                )
-            })
-            .unwrap_or_else(|| "<missing-from-list-targets>".to_string());
+        let deadline = Instant::now() + SPAWN_IDENTITY_TIMEOUT;
+        let observed = loop {
+            match self.list_targets() {
+                Ok(targets) => {
+                    if let Some(target) = targets.iter().find(|target| {
+                        target.pane_id == pane_id
+                            && target.session.as_str() == session.as_str()
+                            && target
+                                .window_name
+                                .as_ref()
+                                .is_some_and(|name| name.as_str() == window.as_str())
+                    }) {
+                        return Ok(SpawnResult {
+                            pane_id,
+                            session: session.clone(),
+                            window: window.clone(),
+                            child_pid: target.pane_pid,
+                        });
+                    }
+                    if let Some(target) = targets.iter().find(|target| target.pane_id == pane_id) {
+                        break format!(
+                            "{}:{}",
+                            target.session.as_str(),
+                            target
+                                .window_name
+                                .as_ref()
+                                .map(WindowName::as_str)
+                                .unwrap_or("<unknown>")
+                        );
+                    }
+                    if Instant::now() >= deadline {
+                        break "<missing-from-list-targets>".to_string();
+                    }
+                }
+                Err(error) => {
+                    if Instant::now() >= deadline {
+                        break format!("<list-targets-error:{error}>");
+                    }
+                }
+            }
+            std::thread::sleep(SPAWN_IDENTITY_POLL_INTERVAL);
+        };
+        let rollback_argv = vec![
+            "tmux".to_string(),
+            "kill-pane".to_string(),
+            "-t".to_string(),
+            pane_id.as_str().to_string(),
+        ];
+        let rollback_error = self.run_ok(&rollback_argv).err();
+        let rollback_suffix = rollback_error
+            .map(|error| format!("; failed to roll back spawned pane: {error}"))
+            .unwrap_or_default();
         Err(TransportError::Subprocess {
             argv: spawn_argv,
             code: output.code,
             stderr: format!(
-                "tmux spawn pane identity mismatch: requested={}:{} observed_pane={} observed={}",
+                "tmux spawn pane identity mismatch: requested={}:{} observed_pane={} observed={}{}",
                 session.as_str(),
                 window.as_str(),
                 pane_id.as_str(),
-                observed
+                observed,
+                rollback_suffix
             ),
         })
     }
@@ -2314,7 +2338,9 @@ impl Transport for TmuxBackend {
     fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
         // P5 (C-P5-3): `#{pane_pid}` rides the single list-panes call (field index 11),
         // killing the per-pane display-message N+1 fallback.
-        const TMUX_PANE_FORMAT: &str = "#{pane_id}\t#{session_name}\t#{window_index}\t#{window_name}\t#{pane_index}\t#{pane_tty}\t#{pane_current_command}\t#{pane_active}\t#{pane_current_path}\t#{session_attached}\t#{pane_in_mode}\t#{pane_pid}";
+        // Use a printable sentinel so the 12-field frame stays explicit in argv/log evidence;
+        // `parse_pane_info_line` retains compatibility with legacy tab-delimited output.
+        const TMUX_PANE_FORMAT: &str = "#{pane_id}__TA_FIELD__#{session_name}__TA_FIELD__#{window_index}__TA_FIELD__#{window_name}__TA_FIELD__#{pane_index}__TA_FIELD__#{pane_tty}__TA_FIELD__#{pane_current_command}__TA_FIELD__#{pane_active}__TA_FIELD__#{pane_current_path}__TA_FIELD__#{session_attached}__TA_FIELD__#{pane_in_mode}__TA_FIELD__#{pane_pid}";
         let argv = self.tmux_argv(&[
             "tmux".to_string(),
             "list-panes".to_string(),
@@ -2510,7 +2536,11 @@ fn query_pane_pid(backend: &TmuxBackend, pane: &PaneId) -> Result<Option<u32>, T
 }
 
 fn parse_pane_info_line(line: &str) -> Option<PaneInfo> {
-    let fields = line.split('\t').collect::<Vec<_>>();
+    let fields = if line.contains("__TA_FIELD__") {
+        line.split("__TA_FIELD__").collect::<Vec<_>>()
+    } else {
+        line.split('\t').collect::<Vec<_>>()
+    };
     if fields.len() < 11 {
         return None;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.47",
+  "version": "0.5.48",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.47",
-    "@team-agent/cli-darwin-x64": "0.5.47",
-    "@team-agent/cli-linux-x64": "0.5.47"
+    "@team-agent/cli-darwin-arm64": "0.5.48",
+    "@team-agent/cli-darwin-x64": "0.5.48",
+    "@team-agent/cli-linux-x64": "0.5.48"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",