@team-agent/installer 0.5.47 → 0.5.49

package/Cargo.lock

@@ -575,7 +575,7 @@ dependencies = [
 
 [[package]]
 name = "team-agent"
-version = "0.5.47"
+version = "0.5.49"
 dependencies = [
  "anyhow",
  "chrono",

package/Cargo.toml

@@ -9,7 +9,7 @@ members = ["crates/team-agent", "crates/win-conpty-phase0", "crates/conpty-trans
 
 [workspace.package]
 edition = "2021"
-version = "0.5.47"
+version = "0.5.49"
 license = "AGPL-3.0"
 rust-version = "1.95"
 

package/crates/team-agent/src/cli/named_address.rs

@@ -472,7 +472,10 @@ pub(crate) fn parse_leader_target_workspace_and_team(
     let target_workspace = resolve_workspace(sender_workspace, parsed.workspace.as_deref())?;
     match parsed.target {
         ParsedTarget::TeamEntity { team, entity } if entity == "leader" => {
-            Ok(Some((target_workspace, team)))
+            let state = load_state_checked(&target_workspace)?;
+            let canonical = canonical_named_team_key(&target_workspace, &state, &team)
+                .unwrap_or(team);
+            Ok(Some((target_workspace, canonical)))
         }
         _ => Ok(None),
     }
@@ -607,23 +610,30 @@ fn resolve_in_workspace(
         ParsedTarget::BareAgent(agent) => {
             resolve_bare_agent(sender_workspace, target_workspace, state, agent, transport)
         }
-        ParsedTarget::TeamEntity { team, entity } if entity == "leader" => resolve_leader(
-            sender_workspace,
-            target_workspace,
-            state,
-            team,
-            parsed,
-            transport,
-        ),
-        ParsedTarget::TeamEntity { team, entity } => resolve_worker(
-            sender_workspace,
-            target_workspace,
-            state,
-            team,
-            entity,
-            parsed,
-            transport,
-        ),
+        ParsedTarget::TeamEntity { team, entity } => {
+            let canonical = canonical_named_team_key(target_workspace, state, team)
+                .unwrap_or_else(|| team.clone());
+            if entity == "leader" {
+                resolve_leader(
+                    sender_workspace,
+                    target_workspace,
+                    state,
+                    &canonical,
+                    parsed,
+                    transport,
+                )
+            } else {
+                resolve_worker(
+                    sender_workspace,
+                    target_workspace,
+                    state,
+                    &canonical,
+                    entity,
+                    parsed,
+                    transport,
+                )
+            }
+        }
         ParsedTarget::SessionWindow { session, window } => resolve_session_window(
             sender_workspace,
             target_workspace,
@@ -1149,8 +1159,10 @@ fn transport_for_cli_target(
     parsed: &ParsedNamedAddress,
 ) -> Box<dyn Transport> {
     if let ParsedTarget::TeamEntity { team, entity } = &parsed.target {
+        let canonical = canonical_named_team_key(target_workspace, state, team)
+            .unwrap_or_else(|| team.clone());
         if entity == "leader" {
-            let team_scoped_socket = team_entry(state, team)
+            let team_scoped_socket = team_entry(state, &canonical)
                 .and_then(|entry| entry.get("leader_receiver"))
                 .and_then(|receiver| string_field(receiver, "tmux_socket"));
             let socket = team_scoped_socket.map(str::to_string).or_else(|| {
@@ -1164,7 +1176,7 @@ fn transport_for_cli_target(
                 return Box::new(crate::tmux_backend::TmuxBackend::for_tmux_endpoint(&socket));
             }
         }
-        if let Some(entry) = team_entry(state, team) {
+        if let Some(entry) = team_entry(state, &canonical) {
             let selected = crate::tmux_backend::tmux_backend_for_runtime_state_or_workspace(
                 target_workspace,
                 Some(entry),
@@ -1247,6 +1259,30 @@ fn team_entry<'a>(state: &'a Value, team: &str) -> Option<&'a Value> {
         .and_then(|teams| teams.get(team))
 }
 
+fn canonical_named_team_key(
+    target_workspace: &Path,
+    state: &Value,
+    requested: &str,
+) -> Option<String> {
+    if team_entry(state, requested).is_some() || is_legacy_single_team_active(state, requested) {
+        return Some(requested.to_string());
+    }
+    let selected = crate::state::projection::select_runtime_state(
+        target_workspace,
+        Some(requested),
+    )
+    .ok()?;
+    let canonical = selected
+        .get("active_team_key")
+        .and_then(Value::as_str)
+        .filter(|team| !team.is_empty())?;
+    state
+        .get("teams")
+        .and_then(Value::as_object)
+        .is_some_and(|teams| teams.contains_key(canonical))
+        .then(|| canonical.to_string())
+}
+
 /// E6 (0.5.9 offline-mailbox-toname-design §3.1): decide which
 /// `leader_receiver` object, if any, applies to `<team>/leader` before any
 /// downstream code reads it. Wrong runtime keys are rejected here with

package/crates/team-agent/src/cli/send.rs

@@ -144,9 +144,10 @@ pub fn cmd_send(args: &SendArgs) -> Result<CmdResult, CliError> {
     )?;
     let target = send_target(args.targets.as_deref(), args.target.as_deref());
     let mut opts = send_options_from_args(args);
-    if opts.team.is_none() {
-        opts.team = Some(TeamKey::new(selected.team_key.clone()));
-    }
+    // `args.team` is a selector and may be a legacy session/team-dir alias.
+    // All downstream membership and DB scope must use the canonical key that
+    // resolve_active_team returned, never the original selector spelling.
+    opts.team = Some(TeamKey::new(selected.team_key.clone()));
     let content = args.message.join(" ");
     // CR-061/N27 routing-ambiguous: a single positional with no `--to`/`--targets` and an
     // empty message body is a prompt-only invocation (`team-agent send "fix the build"`).

package/crates/team-agent/src/cli/tests/named_address.rs

@@ -222,6 +222,29 @@ fn resolve_name_team_disambiguated() {
     let _ = std::fs::remove_dir_all(&ws);
 }
 
+#[test]
+fn resolve_qualified_name_canonicalizes_legacy_session_alias() {
+    let ws = named_ws("legacy-session-alias");
+    seed_state(
+        &ws,
+        state_with_teams(json!({
+            "teamdir": worker_team("team-displayname", "qa", "%1", "qa")
+        })),
+    );
+    let transport = OfflineTransport::new().with_targets(vec![pane(
+        "team-displayname",
+        "qa",
+        "%1",
+    )]);
+
+    let resolved = resolve_name_with_transport(&ws, "displayname/qa", &transport)
+        .expect("qualified legacy alias must resolve through the canonical selector");
+    assert_eq!(resolved.team_key.as_deref(), Some("teamdir"));
+    assert_eq!(resolved.agent_id.as_deref(), Some("qa"));
+    assert_eq!(resolved.pane_id, "%1");
+    let _ = std::fs::remove_dir_all(&ws);
+}
+
 #[test]
 fn resolve_name_stale_pane() {
     let ws = named_ws("stale-pane");

package/crates/team-agent/src/cli/tests/run_delegation.rs

@@ -230,7 +230,7 @@ fn cli_quick_start_invokes_real_lifecycle_compiles_spec() {
     };
     let _ = cmd_quick_start(&args); // real quick_start compiles the spec before any coordinator/launch step
                                     // E5: spec compiled to .team/runtime/<team_key>/, NOT the user team dir.
-    let team_key = team.file_name().unwrap().to_string_lossy().to_string();
+    let team_key = "clidelegteam";
     let workspace = crate::model::paths::team_workspace(&team).unwrap();
     let runtime_spec = crate::model::paths::runtime_spec_path(&workspace, &team_key);
     assert!(

package/crates/team-agent/src/cli/tests/status_send.rs

@@ -706,6 +706,48 @@ fn cmd_send_failed_outcome_yields_error_exit() {
     }
 }
 
+#[test]
+fn cmd_send_canonicalizes_legacy_session_alias_before_membership_projection() {
+    let ws = deleg_uniq_dir("send-team-alias");
+    let _ = crate::message_store::MessageStore::open(&ws).unwrap();
+    crate::state::persist::save_runtime_state(
+        &ws,
+        &json!({
+            "active_team_key": "teamdir",
+            "team_key": "teamdir",
+            "teams": {
+                "teamdir": {
+                    "status": "alive",
+                    "session_name": "team-displayname",
+                    "agents": {"w1": {"provider": "codex", "status": "running"}}
+                }
+            }
+        }),
+    )
+    .unwrap();
+    let args = SendArgs {
+        workspace: ws,
+        target: Some("w1".into()),
+        team: Some("displayname".into()),
+        task: None,
+        no_wait: true,
+        watch_result: false,
+        json: true,
+        ..send_args_fixture()
+    };
+
+    let result = cmd_send(&args).expect("alias selection should reach canonical team send");
+    let value = match result.output {
+        CmdOutput::Json(value) => value,
+        other => panic!("expected JSON send outcome, got {other:?}"),
+    };
+    assert_ne!(
+        value.get("reason").and_then(serde_json::Value::as_str),
+        Some("target_not_in_team"),
+        "selector accepted the alias, so membership must use its canonical team key: {value}"
+    );
+}
+
 // ═══════════════════════════════════════════════════════════════════════════
 // coordinator.ok — non-compact status carries the FULL coordinator_health (incl. `ok`); compact
 // strips to {status,pid,metadata_ok,schema_ok} (golden queries.py:77 + compact.py:35; ok =

package/crates/team-agent/src/lifecycle/launch.rs

@@ -3167,10 +3167,18 @@ pub fn quick_start_with_transport_in_workspace_with_display(
     if !open_display {
         override_spec_display_backend(&mut spec, "none");
     }
-    let requested_team = quick_start_requested_team_key(team_id, name)
-        .map(str::to_string)
-        .or_else(|| spec_team_id(&spec));
     let explicit_team_key = quick_start_requested_team_key(team_id, name).map(str::to_string);
+    let canonical_team_key = explicit_team_key
+        .clone()
+        .or_else(|| spec_team_id(&spec).filter(|team| !team.is_empty()))
+        .unwrap_or_else(|| {
+            runtime_team_key_for_spec(
+                &agents_dir.join("team.spec.yaml"),
+                &spec,
+                &spec_session_name(&spec),
+            )
+        });
+    let requested_team = Some(canonical_team_key.clone());
     let team_depth = quick_start_depth_guard(
         &workspace,
         agents_dir,
@@ -3248,14 +3256,12 @@ pub fn quick_start_with_transport_in_workspace_with_display(
     // spec's runtime.session_name with one derived from the REQUESTED team identity
     // so launch_with_transport (which reads runtime.session_name) spawns into an
     // isolated session per requested team.
-    if let Some(requested) = requested_team.as_deref() {
+    if let Some(requested) = explicit_team_key.as_deref() {
         override_spec_session_name(&mut spec, &format!("team-{requested}"));
     }
     let session_name = spec_session_name(&spec);
-    // team_key 身份源 = team_dir(agents_dir).name(角色定义目录),不依赖 spec 落点。
-    let state_team_key = explicit_team_key.clone().unwrap_or_else(|| {
-        runtime_team_key_for_spec(&agents_dir.join("team.spec.yaml"), &spec, &session_name)
-    });
+    // team_key 已在入口由显式 id/name 或 compiled spec identity 单次确定。
+    let state_team_key = canonical_team_key;
     warn_ignored_owner_team_id(workspace.as_path(), agents_dir, &state_team_key);
     // E5 spec 迁移:spec 写到 .team/runtime/<team_key>/(中间产物,绝不落用户目录 agents_dir)。
     // Bug2:原子写(tmp+rename),避免半截 spec。
@@ -3265,7 +3271,13 @@ pub fn quick_start_with_transport_in_workspace_with_display(
         .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
     let resolved_spec_path =
         std::fs::canonicalize(&spec_path).unwrap_or_else(|_| spec_path.clone());
-    let mut state = initial_runtime_state(&spec, &resolved_spec_path, &workspace, agents_dir);
+    let mut state = initial_runtime_state(
+        &spec,
+        &resolved_spec_path,
+        &workspace,
+        agents_dir,
+        &state_team_key,
+    );
     // 0.5.x Phase 1d hot-path 接线(裁决1 msg_76e1d98202b8): use the
     // generic annotator that writes `state.transport = { kind, source }`
     // for every backend AND (for tmux) preserves the existing
@@ -4366,6 +4378,7 @@ pub fn fork_agent_with_transport(
     // E5 §3:team_dir(角色定义+profiles)恒用户目录。spec 读用 selector 解析的 spec_path
     // (读序 B:runtime 优先、legacy 回落),写恒走 runtime_spec_path(canonical 落点)。
     let fork_team_dir = selected.team_dir.clone();
+    let fork_team = selected.team_key.clone();
     let read_spec_path = selected
         .spec_path
         .clone()
@@ -4373,7 +4386,7 @@ pub fn fork_agent_with_transport(
     let workspace = selected.run_workspace;
     let state = selected.state;
     ensure_owner_allowed_for_state(&state, Some(source_agent_id))?;
-    let spec_path = crate::model::paths::runtime_spec_path(&workspace, &selected.team_key);
+    let spec_path = crate::model::paths::runtime_spec_path(&workspace, &fork_team);
     let text = std::fs::read_to_string(&read_spec_path)
         .map_err(|e| LifecycleError::Compile(format!("{}: {e}", read_spec_path.display())))?;
     let spec = yaml::loads(&text).map_err(|e| LifecycleError::Compile(e.to_string()))?;
@@ -4487,7 +4500,6 @@ pub fn fork_agent_with_transport(
         &safety,
     )?;
     let resolved_tool_refs: Vec<&str> = tools.iter().map(String::as_str).collect();
-    let fork_team = crate::messaging::leader_receiver::active_team_key(&workspace, &state);
     let mcp_config = adapter.mcp_config(auth_mode).map_err(|e| {
         let _ = std::fs::write(&spec_path, text.as_bytes());
         LifecycleError::Provider(e.to_string())
@@ -4625,13 +4637,16 @@ pub fn fork_agent_with_transport(
             &mcp_config_path,
             as_agent_id,
             &profile_launch,
+            &fork_team,
         );
         return Err(e);
     }
-    if let Err(e) = crate::state::persist::save_runtime_state_with_lifecycle_topology_authority(
-        &workspace,
+    if let Err(e) = crate::state::repository::StateRepository::new(&workspace).save(
+        crate::state::repository::StateWriteIntent::ForkAgent {
+            team_key: &fork_team,
+            agent_id: as_agent_id.as_str(),
+        },
         &next_state,
-        &[as_agent_id.as_str()],
     ) {
         rollback_fork_after_spawn(
             &workspace,
@@ -4644,9 +4659,56 @@ pub fn fork_agent_with_transport(
             &mcp_config_path,
             as_agent_id,
             &profile_launch,
+            &fork_team,
         );
         return Err(LifecycleError::StatePersist(e.to_string()));
     }
+    let registration =
+        crate::state::projection::select_runtime_state(&workspace, Some(fork_team.as_str()))
+            .map_err(|e| e.to_string())
+            .and_then(|saved| {
+                let agent = saved
+                    .get("agents")
+                    .and_then(|agents| agents.get(as_agent_id.as_str()))
+                    .ok_or_else(|| "canonical team row is missing".to_string())?;
+                if agent.get("pane_id").and_then(serde_json::Value::as_str)
+                    != Some(spawn.pane_id.as_str())
+                {
+                    return Err("canonical team pane_id does not match spawned pane".to_string());
+                }
+                if agent.get("window").and_then(serde_json::Value::as_str) != Some(window.as_str())
+                {
+                    return Err("canonical team window does not match spawned window".to_string());
+                }
+                if let Some(pid) = spawn.child_pid {
+                    if agent.get("pane_pid").and_then(serde_json::Value::as_u64)
+                        != Some(u64::from(pid))
+                    {
+                        return Err(
+                            "canonical team pane_pid does not match spawned process".to_string()
+                        );
+                    }
+                }
+                Ok(())
+            });
+    if let Err(reason) = registration {
+        rollback_fork_after_spawn(
+            &workspace,
+            &spec_path,
+            &text,
+            &old_state,
+            transport,
+            &session_name,
+            &window,
+            &mcp_config_path,
+            as_agent_id,
+            &profile_launch,
+            &fork_team,
+        );
+        return Err(LifecycleError::StatePersist(format!(
+            "fork spawned but team registration readback failed: {reason}"
+        )));
+    }
     if let Err(e) = maybe_fail_fork_after_spawn("start_coordinator") {
         rollback_fork_after_spawn(
             &workspace,
@@ -4659,6 +4721,7 @@ pub fn fork_agent_with_transport(
             &mcp_config_path,
             as_agent_id,
             &profile_launch,
+            &fork_team,
         );
         return Err(e);
     }
@@ -4678,6 +4741,7 @@ pub fn fork_agent_with_transport(
             &mcp_config_path,
             as_agent_id,
             &profile_launch,
+            &fork_team,
         );
         LifecycleError::StatePersist(e.to_string())
     })?;
@@ -4704,16 +4768,19 @@ fn rollback_fork_after_spawn(
     mcp_config_path: &Path,
     agent_id: &AgentId,
     profile_launch: &crate::provider::ProviderProfileLaunch,
+    team_key: &str,
 ) {
     let _ = transport.kill_window(&Target::SessionWindow {
         session: session_name.clone(),
         window: window.clone(),
     });
     let _ = std::fs::write(spec_path, spec_text.as_bytes());
-    let _ = crate::state::persist::save_runtime_state_with_deleted_agents(
-        workspace,
+    let _ = crate::state::repository::StateRepository::new(workspace).save(
+        crate::state::repository::StateWriteIntent::AgentRollback {
+            team_key: Some(team_key),
+            agent_id: agent_id.as_str(),
+        },
         old_state,
-        &[agent_id.as_str()],
     );
     cleanup_fork_mcp_artifacts(workspace, agent_id, mcp_config_path, profile_launch);
 }
@@ -5049,6 +5116,7 @@ fn initial_runtime_state(
     spec_path: &Path,
     workspace: &Path,
     team_dir: &Path,
+    team_key: &str,
 ) -> serde_json::Value {
     let mut agents = serde_json::Map::new();
     for agent in spec_agent_values(spec) {
@@ -5090,6 +5158,7 @@ fn initial_runtime_state(
         "team_dir".to_string(),
         serde_json::json!(team_dir.to_string_lossy().to_string()),
     );
+    state.insert("team_key".to_string(), serde_json::json!(team_key));
     state.insert(
         "session_name".to_string(),
         serde_json::json!(spec_session_name(spec).as_str()),

package/crates/team-agent/src/lifecycle/restart/agent.rs

@@ -113,11 +113,7 @@ pub(crate) fn start_agent_at_paths(
     let window = agent_window(&agent, agent_id);
     let adaptive_layout =
         open_display && crate::lifecycle::launch::state_uses_adaptive_layout(&state);
-    let fake_provider = raw_agent
-        .get("provider")
-        .and_then(serde_json::Value::as_str)
-        .is_some_and(|provider| provider.eq_ignore_ascii_case("fake"));
-    if force && !fake_provider && is_per_agent_window(&window, agent_id) {
+    if force && is_per_agent_window(&window, agent_id) {
         let expected_pane_id = raw_agent
             .get("pane_id")
             .and_then(serde_json::Value::as_str)
@@ -276,12 +272,20 @@ pub(crate) fn start_agent_at_paths(
         None,
         Some(resolved_team_key.as_str()),
     )?;
-    verify_spawned_pane_matches_target(
+    if let Err(error) = verify_spawned_pane_matches_target(
         transport,
         &spawn.spawn.pane_id,
         &session_name,
         &spawn.spawn.window,
-    )?;
+    ) {
+        if let Err(rollback_error) = transport.kill_pane(&spawn.spawn.pane_id) {
+            return Err(LifecycleError::RequirementUnmet(format!(
+                "{error}; failed to roll back spawned pane {}: {rollback_error}",
+                spawn.spawn.pane_id.as_str()
+            )));
+        }
+        return Err(error);
+    }
     let actual_spawn_window = spawn.spawn.window.as_str().to_string();
     mark_agent_started(
         &mut state,

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -89,11 +89,19 @@ fn same_role_cohort_error(
     expected_live: usize,
     expected_old_only: bool,
 ) -> Option<String> {
-    let panes = transport.list_targets().ok()?;
+    let panes = match transport.list_targets() {
+        Ok(panes) => panes,
+        Err(error) => {
+            return Some(format!(
+                "{operation} refused: same-role cohort observation failed: {error}"
+            ));
+        }
+    };
     let mut cardinality_proofs = Vec::new();
     let mut binding_proofs = Vec::new();
+    let mut observation_proofs = Vec::new();
     for target in targets {
-        let live_panes = panes
+        let candidate_panes = panes
             .iter()
             .filter(|pane| pane.session.as_str() == session_name.as_str())
             .filter(|pane| {
@@ -101,20 +109,30 @@ fn same_role_cohort_error(
                     .as_ref()
                     .is_some_and(|window| window.as_str() == target.window)
             })
-            .filter(|pane| {
-                !expected_old_only
-                    || target
-                        .expected_pane_id
-                        .as_deref()
-                        .is_some_and(|expected| pane.pane_id.as_str() == expected)
-            })
-            .filter(|pane| {
-                transport
-                    .liveness(&pane.pane_id)
-                    .is_ok_and(|live| live == crate::transport::PaneLiveness::Live)
-            })
-            .map(|pane| pane.pane_id.as_str().to_string())
             .collect::<Vec<_>>();
+        let mut live_panes = Vec::new();
+        for pane in candidate_panes {
+            match transport.liveness(&pane.pane_id) {
+                Ok(crate::transport::PaneLiveness::Live) => {
+                    live_panes.push(pane.pane_id.as_str().to_string());
+                }
+                Ok(crate::transport::PaneLiveness::Dead) => {}
+                Ok(crate::transport::PaneLiveness::Unknown) => {
+                    observation_proofs.push(format!(
+                        "{}:window={}:pane={}:liveness=unknown",
+                        target.agent_id,
+                        target.window,
+                        pane.pane_id.as_str()
+                    ));
+                }
+                Err(error) => observation_proofs.push(format!(
+                    "{}:window={}:pane={}:liveness_error={error}",
+                    target.agent_id,
+                    target.window,
+                    pane.pane_id.as_str()
+                )),
+            }
+        }
         if live_panes.len() != expected_live {
             cardinality_proofs.push(format!(
                 "{}:window={}:live_panes=[{}]",
@@ -135,6 +153,12 @@ fn same_role_cohort_error(
             }
         }
     }
+    if !observation_proofs.is_empty() {
+        return Some(format!(
+            "{operation} refused: same-role cohort observation failed; {}",
+            observation_proofs.join("; ")
+        ));
+    }
     if !binding_proofs.is_empty() {
         return Some(format!(
             "{operation} refused: spawn identity/binding mismatch; {}",
@@ -476,6 +500,16 @@ pub(super) fn spawn_agent_window(
     );
     if let Some(error) = startup_prompt.capture_error.as_deref() {
         if is_structural_startup_prompt_error(error) {
+            if let Err(rollback_error) = transport.kill_pane(&spawn.pane_id) {
+                return Err(LifecycleError::Transport(format!(
+                    "startup prompt structural failure for {}:{} pane {}: {}; failed to roll back spawned pane: {}",
+                    session_name.as_str(),
+                    window.as_str(),
+                    spawn.pane_id.as_str(),
+                    error,
+                    rollback_error
+                )));
+            }
             return Err(LifecycleError::Transport(format!(
                 "startup prompt structural failure for {}:{} pane {}: {}",
                 session_name.as_str(),

package/crates/team-agent/src/lifecycle/tests/lane_ops.rs

@@ -14,7 +14,7 @@ pub(super) type LaneSpawns = std::sync::Arc<std::sync::Mutex<Vec<(String, Vec<St
 /// end-to-end in-process.
 pub(super) struct LaneTransport {
     session: String,
-    windows: Vec<String>,
+    windows: std::sync::Arc<std::sync::Mutex<Vec<String>>>,
     killed: LaneKills,
     spawns: LaneSpawns,
 }
@@ -22,7 +22,9 @@ impl LaneTransport {
     pub(super) fn new(session: &str, windows: &[&str]) -> Self {
         Self {
             session: session.to_string(),
-            windows: windows.iter().map(|w| (*w).to_string()).collect(),
+            windows: std::sync::Arc::new(std::sync::Mutex::new(
+                windows.iter().map(|w| (*w).to_string()).collect(),
+            )),
             killed: std::sync::Arc::new(std::sync::Mutex::new(Vec::new())),
             spawns: std::sync::Arc::new(std::sync::Mutex::new(Vec::new())),
         }
@@ -120,6 +122,8 @@ impl crate::transport::Transport for LaneTransport {
     ) -> Result<Vec<crate::transport::PaneInfo>, crate::transport::TransportError> {
         Ok(self
             .windows
+            .lock()
+            .unwrap()
             .iter()
             .map(|w| crate::transport::PaneInfo {
                 pane_id: crate::transport::PaneId::new(format!("%{w}")),
@@ -149,6 +153,8 @@ impl crate::transport::Transport for LaneTransport {
         if s.as_str() == self.session {
             Ok(self
                 .windows
+                .lock()
+                .unwrap()
                 .iter()
                 .map(|w| crate::transport::WindowName::new(w.as_str()))
                 .collect())
@@ -174,13 +180,22 @@ impl crate::transport::Transport for LaneTransport {
         &self,
         t: &crate::transport::Target,
     ) -> Result<(), crate::transport::TransportError> {
-        let name = match t {
-            crate::transport::Target::Pane(p) => p.as_str().to_string(),
+        let (name, window) = match t {
+            crate::transport::Target::Pane(p) => (p.as_str().to_string(), None),
             crate::transport::Target::SessionWindow { session, window } => {
-                format!("{}:{}", session.as_str(), window.as_str())
+                (
+                    format!("{}:{}", session.as_str(), window.as_str()),
+                    Some(window.as_str()),
+                )
             }
         };
         self.killed.lock().unwrap().push(name);
+        if let Some(window) = window {
+            self.windows
+                .lock()
+                .unwrap()
+                .retain(|candidate| candidate != window);
+        }
         Ok(())
     }
     fn attach_session(

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -80,11 +80,10 @@ fn layout_pane(
 }
 
 /// E5 spec 迁移:spec 不再落 team_dir,而在 <team_workspace>/.team/runtime/<team_key>/。
-/// team_key = team_dir.name(quick_start_team_dir → "teamdir");workspace = team_workspace(team)。
+/// quick-start 未显式指定 id 时,team_key 来自 compiled TEAM.md name(`quickteam`)。
 pub(super) fn quick_start_runtime_spec_path(team: &std::path::Path) -> PathBuf {
     let workspace = crate::model::paths::team_workspace(team).unwrap();
-    let team_key = team.file_name().unwrap().to_string_lossy().to_string();
-    crate::model::paths::runtime_spec_path(&workspace, &team_key)
+    crate::model::paths::runtime_spec_path(&workspace, "quickteam")
 }
 
 /// 在 team 自身或其 team_workspace 父下找 .team/runtime/*/team.spec.yaml。run_workspace 解析
@@ -172,6 +171,26 @@ fn quick_start_compiles_real_spec_to_team_spec_yaml() {
     }
 }
 
+#[test]
+fn quick_start_without_team_id_uses_compiled_team_name_as_canonical_key() {
+    let team = quick_start_team_dir(QS_VALID_ROLE);
+    let workspace = crate::model::paths::team_workspace(&team).unwrap();
+    let transport = OfflineTransport::new();
+
+    let result = quick_start_with_transport(&team, None, true, None, &transport);
+    assert!(result.is_ok(), "quick-start fixture must run: {result:?}");
+
+    let state = crate::state::persist::load_runtime_state(&workspace).unwrap();
+    assert_eq!(state["active_team_key"], json!("quickteam"));
+    assert_eq!(state["team_key"], json!("quickteam"));
+    assert!(state["teams"].get("quickteam").is_some(), "{state}");
+    assert!(state["teams"].get("teamdir").is_none(), "{state}");
+    assert!(
+        crate::model::paths::runtime_spec_path(&workspace, "quickteam").exists(),
+        "runtime spec must share the canonical key"
+    );
+}
+
 #[test]
 fn quick_start_teamdir_under_dot_team_uses_project_workspace_for_status_and_collect() {
     let workspace = temp_ws();
@@ -215,8 +234,8 @@ fn quick_start_teamdir_under_dot_team_uses_project_workspace_for_status_and_coll
             "input={}",
             input.display()
         );
-        // E5: selector resolves spec_path to .team/runtime/<team_key>/ (team_key="current").
-        let expected_spec = crate::model::paths::runtime_spec_path(&workspace, "current");
+        // E5: selector resolves spec_path to .team/runtime/<canonical team_key>/.
+        let expected_spec = crate::model::paths::runtime_spec_path(&workspace, "quickteam");
         assert_eq!(
             selected
                 .spec_path
@@ -1319,7 +1338,7 @@ fn quick_start_persists_selected_tmux_endpoint_and_attach_commands() {
     assert_eq!(state["tmux_socket"], json!(endpoint));
     assert_eq!(state["is_external_leader"], json!(false));
     assert_eq!(
-        state["teams"]["teamdir"]["is_external_leader"],
+        state["teams"]["quickteam"]["is_external_leader"],
         json!(false)
     );
 }
@@ -2876,7 +2895,7 @@ fn quick_start_seeds_tasks_key_from_compiled_spec() {
 }
 
 // Stage A — golden launch/core.py:62-71 seeded top-level runtime state in insertion order:
-// spec_path, workspace, team_dir, session_name, leader, agents, tasks, display_backend.
+// spec_path, workspace, team_dir, team_key, session_name, leader, agents, tasks, display_backend.
 //
 // OLD (Python parity): the top-level shape ended at `display_backend`.
 // NEW (Bug 1/2 — team-in-team state scope, see tests/team_in_team_state_scope_red.rs):
@@ -2889,9 +2908,9 @@ fn quick_start_seeds_tasks_key_from_compiled_spec() {
 //   The post-launch hook drops the top-level owner triple when the launched pane is
 //   unbound (empty pane_id), and only the per-team entry retains the binding.
 //   R1: topology is explicit; fresh managed teams carry `is_external_leader=false`
-//   before the team-in-team suffix. Order remains the golden prefix
-//   (spec_path … display_backend) + topology marker + new suffix (active_team_key,
-//   teams). display_backend stays the resolved backend from display/backend.py:12-29
+//   before the team-in-team suffix. Canonical `team_key` is seeded before owner
+//   binding; the remaining order stays the golden prefix + topology marker + new
+//   suffix (active_team_key, teams). display_backend stays the resolved backend from display/backend.py:12-29
 //   (default adaptive), not the raw optional spec field.
 #[test]
 #[serial(env)]
@@ -2924,6 +2943,9 @@ fn quick_start_state_seeds_spec_path_workspace_leader_display_backend() {
             "spec_path",
             "workspace",
             "team_dir",
+            // Seed canonical identity before owner binding so the initial
+            // receiver is written under the same team key as the saved state.
+            "team_key",
             "session_name",
             "leader",
             "agents",
@@ -2937,17 +2959,12 @@ fn quick_start_state_seeds_spec_path_workspace_leader_display_backend() {
             // field); source is `"unknown"` until Phase 2 threads
             // `ResolvedTransport.source` through the launch call site.
             "transport",
-            // 0.4.0 refactor: `team_key` added as top-level topology marker
-            // alongside active_team_key (refactor-modular-architecture). The
-            // owner / leader_receiver / owner_epoch invariants below still
-            // hold — those live only under teams[<active_team_key>].
-            "team_key",
             "active_team_key",
             "teams",
         ],
         "state.json top-level key order must match golden launch/core.py:62-71 \
          plus R1 topology marker and Bug 1/2 team-in-team suffix \
-         (is_external_leader, team_key, active_team_key, teams). \
+         (is_external_leader, active_team_key, teams). \
          Bug 2 owner team-scope (N1/N12/N18/N29) deliberately keeps owner / \
          leader_receiver / owner_epoch OFF the top level — they live ONLY under \
          teams[<active_team_key>] so per-team isolation has a single source of \

package/crates/team-agent/src/lifecycle/tests/phase_b_contracts.rs

@@ -451,7 +451,7 @@ fn team_dir_with_roles(role_docs: &[(&str, &str)]) -> PathBuf {
     std::fs::create_dir_all(team.join("agents")).unwrap();
     std::fs::write(
         team.join("TEAM.md"),
-        "---\nname: phaseb\nobjective: Phase B.\nprovider: codex\n---\n\nPhase B team.\n",
+        "---\nname: teamdir\nobjective: Phase B.\nprovider: codex\nsession_name: team-phaseb\n---\n\nPhase B team.\n",
     )
     .unwrap();
     for (file, role_doc) in role_docs {
@@ -536,7 +536,7 @@ fn add_fixture() -> (PathBuf, PathBuf, PathBuf, OfflineTransport) {
     quick_start_with_transport_in_workspace_with_display(
         &workspace,
         &team,
-        None,
+        Some("teamdir"),
         true,
         None,
         &launch_transport,

package/crates/team-agent/src/lifecycle/tests/phase_golden.rs

@@ -367,7 +367,7 @@ fn two_worker_team_dir(hermetic: &HermeticTestEnv) -> PathBuf {
     std::fs::create_dir_all(team.join("agents")).unwrap();
     std::fs::write(
         team.join("TEAM.md"),
-        "---\nname: phasegolden\nobjective: Phase golden.\nprovider: codex\n---\n\nPhase golden team.\n",
+        "---\nname: teamdir\nobjective: Phase golden.\nprovider: codex\nsession_name: team-phasegolden\n---\n\nPhase golden team.\n",
     )
     .unwrap();
     for id in ["w1", "w2"] {

package/crates/team-agent/src/state/repository.rs

@@ -315,16 +315,22 @@ fn route_direct(
         StateWriteIntent::RemoveAgent { agent_id, .. } => {
             helper_write_team_scoped_with_deleted_agents(workspace, state, &[agent_id])
         }
-        // ForkAgent -> the launch fork writer uses the root helper at
-        // lifecycle/launch.rs:4542.
-        StateWriteIntent::ForkAgent { .. } => helper_write_root(workspace, state),
-        // AgentRollback -> pre-state rollback uses either the root helper or
-        // the deleted-agents variant depending on the caller; S1a keeps the
-        // root form as the shared entry, and rollback specializations retain
-        // their allowlisted callsites in launch.rs / restart/remove.rs.
-        StateWriteIntent::AgentRollback { agent_id, .. } => {
-            helper_write_root_with_deleted_agents(workspace, state, &[agent_id])
+        // ForkAgent mutates a selected team projection, so persist it back to
+        // that projection with the forked row as lifecycle topology authority.
+        StateWriteIntent::ForkAgent { agent_id, .. } => {
+            helper_write_team_scoped_with_lifecycle_topology_authority(
+                workspace,
+                state,
+                &[agent_id],
+            )
         }
+        // Team-scoped rollback must restore only the selected projection and
+        // preserve sibling teams. Legacy callers without a team keep the root
+        // deleted-agents writer.
+        StateWriteIntent::AgentRollback { team_key, agent_id } => match team_key {
+            Some(_) => helper_write_team_scoped_with_deleted_agents(workspace, state, &[agent_id]),
+            None => helper_write_root_with_deleted_agents(workspace, state, &[agent_id]),
+        },
         // ClaimLeader -> leader/lease.rs:1625 uses the root helper, and the
         // scoped preserve-claim-fields variant at :1702 uses the team-tombstoned
         // agents helper.

package/crates/team-agent/src/tmux_backend/tests.rs

@@ -514,9 +514,9 @@ fn spawn_into_same_named_replacement_returns_identity_created_by_spawn_command()
 }
 
 #[test]
-fn spawn_with_command_refuses_spawn_pane_owned_by_other_window() {
+fn spawn_with_command_refuses_and_rolls_back_spawn_pane_owned_by_other_window() {
     let pane_inventory = "%5\tteamsess\t1\tw2\t0\t/dev/ttys005\tnode\t1\t/work/dir\t1\t0\t125\n";
-    let (be, _rec) = backend_with(
+    let (be, rec) = backend_with(
         MockResp::Out(ok("")),
         vec![
             MockResp::Out(ok("%5\n")),
@@ -539,6 +539,48 @@ fn spawn_with_command_refuses_spawn_pane_owned_by_other_window() {
             && msg.contains("observed=teamsess:w2"),
         "error must include requested/observed ownership evidence, got {msg}"
     );
+    let calls = rec.lock().unwrap().clone();
+    assert!(
+        calls
+            .iter()
+            .any(|call| call == &svec(&["tmux", "kill-pane", "-t", "%5"])),
+        "identity mismatch must roll back the exact pane created by this spawn; calls={calls:?}"
+    );
+}
+
+#[test]
+fn spawn_with_command_retries_until_spawn_pane_is_visible() {
+    let pane_inventory = "%6\tteamsess\t1\tw1\t0\t/dev/ttys006\tnode\t1\t/work/dir\t1\t0\t126\n";
+    let (be, rec) = backend_with(
+        MockResp::Out(ok(pane_inventory)),
+        vec![MockResp::Out(ok("%6\n")), MockResp::Out(ok(""))],
+    );
+    let result = be
+        .spawn_into(
+            &SessionName::new("teamsess"),
+            &WindowName::new("w1"),
+            &svec(&["provider-bin"]),
+            Path::new("/work/dir"),
+            &BTreeMap::new(),
+        )
+        .expect("spawn pane must tolerate bounded tmux inventory lag");
+    let calls = rec.lock().unwrap().clone();
+
+    assert_eq!(result.pane_id.as_str(), "%6");
+    assert_eq!(
+        calls
+            .iter()
+            .filter(|call| call.get(1).is_some_and(|arg| arg == "list-panes"))
+            .count(),
+        2,
+        "spawn identity must retry the same pane id until it becomes visible; calls={calls:?}"
+    );
+    assert!(
+        calls
+            .iter()
+            .all(|call| call.get(1).is_none_or(|arg| arg != "kill-pane")),
+        "a delayed but valid identity must not be rolled back; calls={calls:?}"
+    );
 }
 
 #[test]
@@ -1742,16 +1784,16 @@ fn query_single_field_argv_and_nonzero_maps_to_none() {
 }
 
 // ── 11. list_targets (TRANSPORT TRIO) — `list-panes -a -F TMUX_PANE_FORMAT` + per-line parse ────
-// Golden _legacy_pane_discovery.py:29-33 _tmux_list_panes: `tmux list-panes -a -F <TMUX_PANE_FORMAT>`
-// (returncode != 0 -> []), parse each tab line via _parse_tmux_pane_info. TMUX_PANE_FORMAT
-// (runtime.py:456-460) is the byte-exact tab string locked below; P5 (C-P5-3) appends
+// Golden _legacy_pane_discovery.py:29-33 _tmux_list_panes: `tmux list-panes -a -F <TMUX_PANE_FORMAT>`.
+// The Rust backend uses the printable separator locked below so the 12-field frame stays explicit
+// in argv/log evidence, while retaining the golden nonzero -> empty inventory behavior. P5 (C-P5-3) appends
 // `#{pane_pid}` as field 12 so pane pids ride the single list-panes call (the per-pane
 // display-message N+1 fallback is gone). leader_env stays the reverse-env real-machine bit.
 #[test]
 fn list_targets_argv_and_parses_tmux_pane_format() {
-    const FMT: &str = "#{pane_id}\t#{session_name}\t#{window_index}\t#{window_name}\t#{pane_index}\t#{pane_tty}\t#{pane_current_command}\t#{pane_active}\t#{pane_current_path}\t#{session_attached}\t#{pane_in_mode}\t#{pane_pid}";
-    let stdout = "%7\tteam-x\t0\twin0\t0\t/dev/ttys003\tcodex\t1\t/Users/me/work\t1\t0\t41001\n\
-                      %8\tteam-x\t1\twin1\t0\t/dev/ttys004\tnode\t0\t/Users/me/other\t0\t0\t41002\n";
+    const FMT: &str = "#{pane_id}__TA_FIELD__#{session_name}__TA_FIELD__#{window_index}__TA_FIELD__#{window_name}__TA_FIELD__#{pane_index}__TA_FIELD__#{pane_tty}__TA_FIELD__#{pane_current_command}__TA_FIELD__#{pane_active}__TA_FIELD__#{pane_current_path}__TA_FIELD__#{session_attached}__TA_FIELD__#{pane_in_mode}__TA_FIELD__#{pane_pid}";
+    let stdout = "%7__TA_FIELD__team-x__TA_FIELD__0__TA_FIELD__win0__TA_FIELD__0__TA_FIELD__/dev/ttys003__TA_FIELD__codex__TA_FIELD__1__TA_FIELD__/Users/me/work__TA_FIELD__1__TA_FIELD__0__TA_FIELD__41001\n\
+                      %8__TA_FIELD__team-x__TA_FIELD__1__TA_FIELD__win1__TA_FIELD__0__TA_FIELD__/dev/ttys004__TA_FIELD__node__TA_FIELD__0__TA_FIELD__/Users/me/other__TA_FIELD__0__TA_FIELD__0__TA_FIELD__41002\n";
     let (be, rec) = backend_with(MockResp::Out(ok(stdout)), vec![]);
     let panes = be.list_targets().expect("list_targets ok");
     assert_eq!(

package/crates/team-agent/src/tmux_backend.rs

@@ -71,6 +71,8 @@ pub trait CommandRunner: Send + Sync {
 pub struct RealCommandRunner;
 
 const COMMAND_TIMEOUT: Duration = Duration::from_secs(5);
+const SPAWN_IDENTITY_TIMEOUT: Duration = Duration::from_millis(500);
+const SPAWN_IDENTITY_POLL_INTERVAL: Duration = Duration::from_millis(25);
 
 impl CommandRunner for RealCommandRunner {
     fn run(&self, argv: &[String]) -> Result<CommandOutput, std::io::Error> {
@@ -779,46 +781,68 @@ impl TmuxBackend {
             });
         }
         let pane_id = PaneId::new(pane);
-        let targets = self.list_targets()?;
-        if let Some(target) = targets.iter().find(|target| {
-            target.pane_id == pane_id
-                && target.session.as_str() == session.as_str()
-                && target
-                    .window_name
-                    .as_ref()
-                    .is_some_and(|name| name.as_str() == window.as_str())
-        }) {
-            return Ok(SpawnResult {
-                pane_id,
-                session: session.clone(),
-                window: window.clone(),
-                child_pid: target.pane_pid,
-            });
-        }
-        let observed = targets
-            .iter()
-            .find(|target| target.pane_id == pane_id)
-            .map(|target| {
-                format!(
-                    "{}:{}",
-                    target.session.as_str(),
-                    target
-                        .window_name
-                        .as_ref()
-                        .map(WindowName::as_str)
-                        .unwrap_or("<unknown>")
-                )
-            })
-            .unwrap_or_else(|| "<missing-from-list-targets>".to_string());
+        let deadline = Instant::now() + SPAWN_IDENTITY_TIMEOUT;
+        let observed = loop {
+            match self.list_targets() {
+                Ok(targets) => {
+                    if let Some(target) = targets.iter().find(|target| {
+                        target.pane_id == pane_id
+                            && target.session.as_str() == session.as_str()
+                            && target
+                                .window_name
+                                .as_ref()
+                                .is_some_and(|name| name.as_str() == window.as_str())
+                    }) {
+                        return Ok(SpawnResult {
+                            pane_id,
+                            session: session.clone(),
+                            window: window.clone(),
+                            child_pid: target.pane_pid,
+                        });
+                    }
+                    if let Some(target) = targets.iter().find(|target| target.pane_id == pane_id) {
+                        break format!(
+                            "{}:{}",
+                            target.session.as_str(),
+                            target
+                                .window_name
+                                .as_ref()
+                                .map(WindowName::as_str)
+                                .unwrap_or("<unknown>")
+                        );
+                    }
+                    if Instant::now() >= deadline {
+                        break "<missing-from-list-targets>".to_string();
+                    }
+                }
+                Err(error) => {
+                    if Instant::now() >= deadline {
+                        break format!("<list-targets-error:{error}>");
+                    }
+                }
+            }
+            std::thread::sleep(SPAWN_IDENTITY_POLL_INTERVAL);
+        };
+        let rollback_argv = vec![
+            "tmux".to_string(),
+            "kill-pane".to_string(),
+            "-t".to_string(),
+            pane_id.as_str().to_string(),
+        ];
+        let rollback_error = self.run_ok(&rollback_argv).err();
+        let rollback_suffix = rollback_error
+            .map(|error| format!("; failed to roll back spawned pane: {error}"))
+            .unwrap_or_default();
         Err(TransportError::Subprocess {
             argv: spawn_argv,
             code: output.code,
             stderr: format!(
-                "tmux spawn pane identity mismatch: requested={}:{} observed_pane={} observed={}",
+                "tmux spawn pane identity mismatch: requested={}:{} observed_pane={} observed={}{}",
                 session.as_str(),
                 window.as_str(),
                 pane_id.as_str(),
-                observed
+                observed,
+                rollback_suffix
             ),
         })
     }
@@ -2314,7 +2338,9 @@ impl Transport for TmuxBackend {
     fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
         // P5 (C-P5-3): `#{pane_pid}` rides the single list-panes call (field index 11),
         // killing the per-pane display-message N+1 fallback.
-        const TMUX_PANE_FORMAT: &str = "#{pane_id}\t#{session_name}\t#{window_index}\t#{window_name}\t#{pane_index}\t#{pane_tty}\t#{pane_current_command}\t#{pane_active}\t#{pane_current_path}\t#{session_attached}\t#{pane_in_mode}\t#{pane_pid}";
+        // Use a printable sentinel so the 12-field frame stays explicit in argv/log evidence;
+        // `parse_pane_info_line` retains compatibility with legacy tab-delimited output.
+        const TMUX_PANE_FORMAT: &str = "#{pane_id}__TA_FIELD__#{session_name}__TA_FIELD__#{window_index}__TA_FIELD__#{window_name}__TA_FIELD__#{pane_index}__TA_FIELD__#{pane_tty}__TA_FIELD__#{pane_current_command}__TA_FIELD__#{pane_active}__TA_FIELD__#{pane_current_path}__TA_FIELD__#{session_attached}__TA_FIELD__#{pane_in_mode}__TA_FIELD__#{pane_pid}";
         let argv = self.tmux_argv(&[
             "tmux".to_string(),
             "list-panes".to_string(),
@@ -2510,7 +2536,11 @@ fn query_pane_pid(backend: &TmuxBackend, pane: &PaneId) -> Result<Option<u32>, T
 }
 
 fn parse_pane_info_line(line: &str) -> Option<PaneInfo> {
-    let fields = line.split('\t').collect::<Vec<_>>();
+    let fields = if line.contains("__TA_FIELD__") {
+        line.split("__TA_FIELD__").collect::<Vec<_>>()
+    } else {
+        line.split('\t').collect::<Vec<_>>()
+    };
     if fields.len() < 11 {
         return None;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@team-agent/installer",
-  "version": "0.5.47",
+  "version": "0.5.49",
   "description": "npx installer for Team Agent",
   "keywords": [
     "codex",
@@ -20,9 +20,9 @@
     "team-agent-installer": "npm/install.mjs"
   },
   "optionalDependencies": {
-    "@team-agent/cli-darwin-arm64": "0.5.47",
-    "@team-agent/cli-darwin-x64": "0.5.47",
-    "@team-agent/cli-linux-x64": "0.5.47"
+    "@team-agent/cli-darwin-arm64": "0.5.49",
+    "@team-agent/cli-darwin-x64": "0.5.49",
+    "@team-agent/cli-linux-x64": "0.5.49"
   },
   "scripts": {
     "postinstall": "node npm/bincheck.mjs",