@team-agent/installer 0.5.49 → 0.5.51

package/crates/team-agent/src/messaging/delivery.rs

@@ -45,20 +45,28 @@ pub fn deliver_stored_message(
 ) -> Result<DeliveryOutcome, MessagingError> {
     let _ = (wait_visible, timeout);
     let recipient = target.unwrap_or("leader");
-    let store = MessageStore::open(workspace)?;
-    let message_id = store.create_message(
+    let super::PersistResolution::Persisted(persisted) = super::persist::persist_internal_send(
+        workspace,
+        super::InternalSendKind::Delivery,
+        team.map(TeamKey::as_str),
         task_id.map(crate::model::ids::TaskId::as_str),
         sender,
         recipient,
         content,
         None,
         requires_ack,
-        team.map(TeamKey::as_str),
-    )?;
+        None,
+        super::InitialDisposition::Accepted,
+    )?
+    else {
+        unreachable!("internal delivery does not accept caller-supplied ids")
+    };
+    let message_status = persisted.row_status.as_str().to_string();
+    let message_id = persisted.message_id;
     Ok(DeliveryOutcome {
         ok: true,
         status: DeliveryStatus::Queued,
-        message_status: MessageStatusShadow("accepted".to_string()),
+        message_status: MessageStatusShadow(message_status),
         message_id: Some(message_id),
         verification: None,
         stage: None,
@@ -67,6 +75,17 @@ pub fn deliver_stored_message(
     })
 }
 
+pub fn deliver_persisted_message(
+    workspace: &Path,
+    transport: &dyn Transport,
+    message_id: &str,
+    event_log: &EventLog,
+    state: &serde_json::Value,
+) -> Result<DeliveryOutcome, MessagingError> {
+    let store = MessageStore::open(workspace)?;
+    deliver_pending_message(workspace, &store, transport, message_id, event_log, state)
+}
+
 // ===========================================================================
 // delivery.py — 单条 tmux 注入投递 + trust 有界重试 + turn-open arm (card §16)
 // ===========================================================================
@@ -200,6 +219,22 @@ pub fn deliver_pending_message(
         }
         _ => state,
     };
+    if message.recipient == "leader" && message.status == "submitted_pending_acceptance" {
+        return observe_pending_leader_acceptance(store, event_log, state, message_id);
+    }
+    if message.recipient == "leader" && message.status == "queued_until_leader_attach" {
+        if leader_receiver_status(state) != Some("attached") {
+            return Ok(leader_acceptance_pending_outcome(
+                message_id,
+                "queued_until_leader_attach",
+            ));
+        }
+        store.mark(message_id, "accepted", None)?;
+        event_log.write(
+            "leader_receiver.mailbox_requeued",
+            serde_json::json!({"message_id": message_id}),
+        )?;
+    }
     let attempt = if store.claim_for_delivery(message_id)? {
         message.delivery_attempts.saturating_add(1)
     } else if message.status == "target_resolved" && message.error.is_some() {
@@ -524,14 +559,10 @@ pub fn deliver_pending_message(
     }
     let submit_verified = inject_submit_verified(&inject_report);
     let readback_verified = pane_readback_verified(&inject_report);
-    // Leader pane: inject success is delivery proof. Worker pane: post-submit
-    // evidence is the delivery proof; stale Phase-1 readback must not veto it
-    // and cannot independently prove the current Enter submitted.
-    let verified = if is_leader_recipient {
-        true
-    } else {
-        submit_verified
-    };
+    // A successful tmux command is never provider-acceptance proof. Leader and
+    // worker delivery both require post-submit evidence; leader additionally
+    // waits for its authoritative provider transcript below.
+    let verified = submit_verified;
     if !verified {
         let reason = if !readback_verified {
             "pane_readback_unverified:capture_missing_token".to_string()
@@ -658,7 +689,26 @@ pub fn deliver_pending_message(
             });
         }
     }
-    store.mark(message_id, "delivered", None)?;
+    if is_leader_recipient {
+        store.record_delivery_submission(message_id, readback_verified)?;
+        if !leader_transcript_has_token(state, message_id) {
+            store.mark(message_id, "submitted_pending_acceptance", None)?;
+            event_log.write(
+                "leader_receiver.acceptance_pending",
+                serde_json::json!({
+                    "message_id": message_id,
+                    "reason": "provider_receipt_not_observed",
+                }),
+            )?;
+            return Ok(leader_acceptance_pending_outcome(
+                message_id,
+                "submitted_pending_acceptance",
+            ));
+        }
+        store.mark_delivered_with_receipt(message_id)?;
+    } else {
+        store.mark(message_id, "delivered", None)?;
+    }
     let mut delivered_event = serde_json::json!({"message_id": message_id});
     if let Some(metadata) = resolved.metadata.as_ref() {
         append_target_metadata(&mut delivered_event, metadata);
@@ -908,7 +958,8 @@ fn deliver_leader_via_app_server(
     );
     match crate::codex_app_server::submit_to_bound_thread(&binding, message_id, &rendered) {
         Ok(submit) => {
-            store.mark(message_id, "delivered", None)?;
+            store.record_delivery_submission(message_id, true)?;
+            store.mark_delivered_with_receipt(message_id)?;
             event_log.write(
                 "message.delivered",
                 serde_json::json!({"message_id": message_id}),
@@ -1800,10 +1851,16 @@ pub fn deliver_pending_messages(
         let conn = crate::db::schema::open_db(store.db_path())?;
         let mut stmt = conn.prepare(
             "select message_id from messages
-             where status in ('pending', 'accepted', 'target_resolved')
+             where status in (
+                 'pending', 'accepted', 'target_resolved',
+                 'submitted_pending_acceptance', 'queued_until_leader_attach', ?1
+             )
              order by created_at, message_id",
         )?;
-        let rows = stmt.query_map([], |row| row.get::<_, String>(0))?;
+        let rows = stmt.query_map(
+            [crate::message_store::MessageRowStatus::QueuedCoordinatorUnavailable.as_str()],
+            |row| row.get::<_, String>(0),
+        )?;
         rows.collect::<Result<Vec<_>, _>>()?
     };
     let mut delivered = Vec::new();
@@ -1874,7 +1931,7 @@ pub fn deliver_pending_messages(
                 continue;
             }
         };
-        if outcome.ok {
+        if matches!(outcome.status, DeliveryStatus::Delivered) {
             delivered.push(message_id);
         }
     }
@@ -2017,6 +2074,73 @@ fn recipient_is_busy(state: &serde_json::Value, recipient: &str) -> bool {
         == Some("busy")
 }
 
+fn leader_rollout_path(state: &serde_json::Value) -> Option<std::path::PathBuf> {
+    state
+        .get("leader")
+        .and_then(|leader| leader.get("rollout_path"))
+        .and_then(serde_json::Value::as_str)
+        .or_else(|| {
+            leader_receiver_value(state)
+                .and_then(|receiver| receiver.get("rollout_path"))
+                .and_then(serde_json::Value::as_str)
+        })
+        .filter(|path| !path.is_empty())
+        .map(std::path::PathBuf::from)
+}
+
+pub(crate) fn leader_transcript_has_token(state: &serde_json::Value, message_id: &str) -> bool {
+    let Some(path) = leader_rollout_path(state) else {
+        return false;
+    };
+    rollout_tail_contains(
+        &path,
+        &format!("[team-agent-token:{message_id}]"),
+        64 * 1024,
+    )
+}
+
+fn leader_acceptance_pending_outcome(message_id: &str, status: &str) -> DeliveryOutcome {
+    DeliveryOutcome {
+        ok: true,
+        status: DeliveryStatus::RetryScheduled,
+        message_status: MessageStatusShadow(status.to_string()),
+        message_id: Some(message_id.to_string()),
+        verification: Some("provider_receipt_not_observed".to_string()),
+        stage: Some(DeliveryStage::Submit),
+        reason: None,
+        channel: Some("leader_acceptance_pending".to_string()),
+    }
+}
+
+fn observe_pending_leader_acceptance(
+    store: &MessageStore,
+    event_log: &EventLog,
+    state: &serde_json::Value,
+    message_id: &str,
+) -> Result<DeliveryOutcome, MessagingError> {
+    if !leader_transcript_has_token(state, message_id) {
+        return Ok(leader_acceptance_pending_outcome(
+            message_id,
+            "submitted_pending_acceptance",
+        ));
+    }
+    store.mark_delivered_with_receipt(message_id)?;
+    event_log.write(
+        "message.delivered",
+        serde_json::json!({"message_id": message_id}),
+    )?;
+    Ok(DeliveryOutcome {
+        ok: true,
+        status: DeliveryStatus::Delivered,
+        message_status: MessageStatusShadow("delivered".to_string()),
+        message_id: Some(message_id.to_string()),
+        verification: Some("provider_transcript_receipt".to_string()),
+        stage: None,
+        reason: None,
+        channel: Some("leader_receiver".to_string()),
+    })
+}
+
 /// `_handle_trust_retry_needed` (`delivery.py:221`):trust 应答失败时调度有界退避重试
 /// (`attempt < MAX` → schedule;`>= MAX` → 终态 mark failed + `trust_auto_answer_exhausted`)。
 pub fn handle_trust_retry_needed(
@@ -2341,8 +2465,10 @@ fn save_scoped_state(
     state: &serde_json::Value,
     owner_team_id: Option<&str>,
 ) -> Result<(), MessagingError> {
-    if owner_team_id.filter(|team| !team.is_empty()).is_some() {
-        if state
+    let scoped_owner_team_id = owner_team_id
+        .filter(|team| !team.is_empty())
+        .filter(|_| {
+            state
             .get("teams")
             .and_then(serde_json::Value::as_object)
             .is_some_and(|teams| {
@@ -2354,14 +2480,13 @@ fn save_scoped_state(
                     })
                     .is_some_and(|team| teams.contains_key(&team))
             })
-        {
-            crate::state::projection::save_team_scoped_state(workspace, state)?;
-        } else {
-            crate::state::persist::save_runtime_state(workspace, state)?;
-        }
-    } else {
-        crate::state::persist::save_runtime_state(workspace, state)?;
-    }
+        });
+    crate::state::repository::StateRepository::new(workspace).save(
+        crate::state::repository::StateWriteIntent::MessagingDeliveryState {
+            owner_team_id: scoped_owner_team_id,
+        },
+        state,
+    )?;
     Ok(())
 }
 
@@ -2374,8 +2499,10 @@ fn save_scoped_state_reapplying_after_conflict<F>(
 where
     F: FnOnce(&mut serde_json::Value),
 {
-    if owner_team_id.filter(|team| !team.is_empty()).is_some()
-        && state
+    let scoped_owner_team_id = owner_team_id
+        .filter(|team| !team.is_empty())
+        .filter(|_| {
+            state
             .get("teams")
             .and_then(serde_json::Value::as_object)
             .is_some_and(|teams| {
@@ -2387,15 +2514,14 @@ where
                     })
                     .is_some_and(|team| teams.contains_key(&team))
             })
-    {
-        crate::state::projection::save_team_scoped_state_reapplying_after_conflict(
-            workspace, state, reapply,
-        )?;
-    } else {
-        crate::state::persist::save_runtime_state_reapplying_after_conflict(
-            workspace, state, reapply,
-        )?;
-    }
+        });
+    crate::state::repository::StateRepository::new(workspace).save_reapplying(
+        crate::state::repository::StateWriteIntent::MessagingDeliveryState {
+            owner_team_id: scoped_owner_team_id,
+        },
+        state,
+        reapply,
+    )?;
     Ok(())
 }
 

package/crates/team-agent/src/messaging/helpers.rs

@@ -274,21 +274,25 @@ pub fn fail_leader_delivery(
     error: Option<&str>,
 ) -> Result<DeliveryOutcome, MessagingError> {
     let store = MessageStore::open(workspace)?;
-    let sender = payload
-        .get("sender")
-        .and_then(serde_json::Value::as_str)
-        .unwrap_or("system");
-    let content = payload
-        .get("content")
-        .and_then(serde_json::Value::as_str)
-        .unwrap_or("");
-    let task_id = payload.get("task_id").and_then(serde_json::Value::as_str);
-    let message_id = match payload
+    let Some(message_id) = payload
         .get("message_id")
         .and_then(serde_json::Value::as_str)
-    {
-        Some(existing) => existing.to_string(),
-        None => store.create_message(task_id, sender, "leader", content, None, false, None)?,
+        .map(ToOwned::to_owned)
+    else {
+        crate::event_log::EventLog::new(workspace).write(
+            "leader_receiver.delivery_failed_without_message",
+            serde_json::json!({"reason": serde_json::to_value(reason).ok(), "error": error}),
+        )?;
+        return Ok(DeliveryOutcome {
+            ok: false,
+            status: DeliveryStatus::FallbackLog,
+            message_status: MessageStatusShadow("failed".to_string()),
+            message_id: None,
+            verification: None,
+            stage: None,
+            reason: Some(reason),
+            channel: Some("fallback_log".to_string()),
+        });
     };
     store.mark(&message_id, "failed", error)?;
     crate::event_log::EventLog::new(workspace).write(

package/crates/team-agent/src/messaging/leader_receiver.rs

@@ -13,7 +13,11 @@ use crate::transport::{
 };
 
 use super::helpers::MessageStatusShadow;
-use super::{DeliveryOutcome, DeliveryRefusal, DeliveryStage, DeliveryStatus, MessagingError};
+use super::persist::persist_internal_send;
+use super::{
+    DeliveryOutcome, DeliveryRefusal, DeliveryStage, DeliveryStatus, InitialDisposition,
+    InternalSendKind, MessagingError, PersistResolution,
+};
 
 /// `_send_to_leader_receiver` (`leader.py:69`) — **N31/N32 funnel primitive**:所有 leader-bound
 /// caller(send_message(to=leader) / report_result / request_human / idle reminder /
@@ -74,39 +78,32 @@ pub fn send_to_leader_receiver_with_message_id(
             serde_json::json!({"sender": sender, "leader_id": leader_id, "result_id": result_id}),
         )?;
     }
-    let message_id = if let Some(requested) = requested_message_id {
-        if store.message_exists(requested)? {
+    let message_id = match persist_internal_send(
+        workspace,
+        InternalSendKind::LeaderNotification,
+        Some(&owner_team),
+        task_id.map(TaskId::as_str),
+        sender,
+        leader_id,
+        content,
+        None,
+        false,
+        requested_message_id,
+        InitialDisposition::Accepted,
+    )? {
+        PersistResolution::Duplicate(requested) => {
             return Ok(DeliveryOutcome {
                 ok: false,
                 status: DeliveryStatus::Refused,
                 message_status: MessageStatusShadow("refused".to_string()),
-                message_id: Some(requested.to_string()),
+                message_id: Some(requested),
                 verification: None,
                 stage: None,
                 reason: Some(DeliveryRefusal::Duplicate),
                 channel: Some("leader_receiver".to_string()),
             });
         }
-        store.create_message_with_id(
-            requested,
-            task_id.map(TaskId::as_str),
-            sender,
-            leader_id,
-            content,
-            None,
-            false,
-            Some(&owner_team),
-        )?
-    } else {
-        store.create_message(
-            task_id.map(TaskId::as_str),
-            sender,
-            leader_id,
-            content,
-            None,
-            false,
-            Some(&owner_team),
-        )?
+        PersistResolution::Persisted(persisted) => persisted.message_id,
     };
     // #231 exactly-once across rebind: insert the leader_notification_log PK BEFORE the
     // unbound-pane check. That way, if the result row gets blocked (I-4) and later the
@@ -332,7 +329,32 @@ pub fn deliver_to_leader_fallback_pane(
             let submit_ok = super::delivery::inject_submit_verified(&report);
             let readback_ok = super::delivery::pane_readback_verified(&report);
             if submit_ok {
-                store.mark(message_id, "delivered", None)?;
+                store.record_delivery_submission(message_id, readback_ok)?;
+                if !super::delivery::leader_transcript_has_token(state, message_id) {
+                    store.mark(message_id, "submitted_pending_acceptance", None)?;
+                    event_log.write(
+                        "leader_receiver.acceptance_pending",
+                        serde_json::json!({
+                            "message_id": message_id,
+                            "result_id": result_id,
+                            "reason": "provider_receipt_not_observed",
+                            "channel": "fallback_pane",
+                        }),
+                    )?;
+                    return Ok(DeliveryOutcome {
+                        ok: true,
+                        status: DeliveryStatus::RetryScheduled,
+                        message_status: MessageStatusShadow(
+                            "submitted_pending_acceptance".to_string(),
+                        ),
+                        message_id: Some(message_id.to_string()),
+                        verification: Some("provider_receipt_not_observed".to_string()),
+                        stage: Some(DeliveryStage::Submit),
+                        reason: None,
+                        channel: Some("leader_acceptance_pending".to_string()),
+                    });
+                }
+                store.mark_delivered_with_receipt(message_id)?;
                 event_log.write(
                     "leader_receiver.fallback_pane_submitted",
                     serde_json::json!({
@@ -562,21 +584,24 @@ pub fn enqueue_leader_mailbox_until_attach(
     sender: &str,
     event_log: &EventLog,
 ) -> Result<DeliveryOutcome, MessagingError> {
-    let store = MessageStore::open(target_workspace)?;
-    let message_id = store.create_message(
+    let PersistResolution::Persisted(persisted) = persist_internal_send(
+        target_workspace,
+        InternalSendKind::OfflineMailbox,
+        Some(canonical_team_key),
         task_id.map(TaskId::as_str),
         sender,
         "leader",
         content,
         None,
         false,
-        Some(canonical_team_key),
-    )?;
-    // The default row status after `create_message` is `accepted`. Flip it to
-    // `queued_until_leader_attach` so it stays out of `claim_for_delivery`
-    // eligible set and out of `deliver_pending_messages` scan until an
-    // attach/claim explicitly requeues it (see requeue_blocked_leader_messages).
-    store.mark(&message_id, "queued_until_leader_attach", None)?;
+        None,
+        InitialDisposition::QueuedUntilLeaderAttach,
+    )?
+    else {
+        unreachable!("offline mailbox does not accept caller-supplied ids")
+    };
+    let message_status = persisted.row_status.as_str().to_string();
+    let message_id = persisted.message_id;
     event_log.write(
         "leader_mailbox.queued_until_attach",
         serde_json::json!({
@@ -590,7 +615,7 @@ pub fn enqueue_leader_mailbox_until_attach(
     Ok(DeliveryOutcome {
         ok: true,
         status: DeliveryStatus::Queued,
-        message_status: MessageStatusShadow("queued_until_leader_attach".to_string()),
+        message_status: MessageStatusShadow(message_status),
         message_id: Some(message_id),
         verification: None,
         stage: None,

package/crates/team-agent/src/messaging/mod.rs

@@ -61,10 +61,12 @@ use crate::message_store::MessageStore;
 use crate::transport::{PaneId, Target, Transport};
 
 pub mod activity;
+pub mod address;
 pub mod delivery;
 pub mod helpers;
 pub mod leader_receiver;
 pub mod peers;
+pub mod persist;
 pub mod results;
 pub mod scheduler;
 pub mod selftest;
@@ -75,9 +77,11 @@ pub mod watchers;
 
 // ── re-export: 保持 `crate::messaging::X` 与 test `super::X` 解析不变 ──────────
 pub use activity::{classify_agent_activity, detect_cross_worker_deadlocks, detect_idle_fallbacks};
+pub use address::{parse_logical_address, LogicalAddress, LogicalAddressTarget};
 pub use delivery::{
-    deliver_pending_message, deliver_pending_messages, deliver_stored_message, execute_trust_retry,
-    handle_trust_retry_needed, record_turn_open_if_leader_to_worker,
+    deliver_pending_message, deliver_pending_messages, deliver_persisted_message,
+    deliver_stored_message, execute_trust_retry, handle_trust_retry_needed,
+    record_turn_open_if_leader_to_worker,
     retry_injection_after_trust_auto_answer, stamp_first_send_at_if_leader_to_worker,
     tmux_pane_width,
 };
@@ -88,6 +92,10 @@ pub use leader_receiver::{
     send_to_leader_receiver_with_message_id,
 };
 pub use peers::allow_peer_talk;
+pub use persist::{
+    persist_resolved_send, DeliveryBlocker, InitialDisposition, InternalSendKind,
+    LogicalRecipient, PersistResolution, PersistedSend, ResolvedSendIntent, SendOrigin,
+};
 pub use results::{
     collect, collect_for_team, collect_results_and_notify_watchers, report_result,
     report_result_for_owner_team, report_result_for_owner_team_with_primary_error,
@@ -96,6 +104,7 @@ pub use scheduler::{detect_stuck_agents, fire_due_scheduled_events, stuck_cancel
 pub use selftest::{evaluate_idle_behavior, run_comms_selftest, CommsSelftestDriver};
 pub use send::{
     apply_worker_sender_bypass, send_message, session_drift_refusal, MessageTarget, SendOptions,
+    TrustedSender,
 };
 pub use trust::{attempt_trust_auto_answer, TrustAnswerOutcome};
 pub use types::{