@team-agent/installer 0.5.49 → 0.5.51

package/crates/team-agent/src/cli/tests/leader_watch.rs

@@ -41,7 +41,7 @@ fn cli_send_persists_real_message_row() {
         workspace: ws.clone(),
         team: None,
         task: None,
-        sender: "leader".to_string(),
+        sender: TrustedSender::leader(),
         no_ack: false,
         no_wait: true,
         watch_result: false,

package/crates/team-agent/src/cli/tests/named_address.rs

@@ -149,7 +149,7 @@ fn named_send_args(
         workspace: ws.to_path_buf(),
         team: None,
         task: None,
-        sender: "leader".to_string(),
+        sender: TrustedSender::leader(),
         no_ack: false,
         no_wait: false,
         watch_result: false,
@@ -459,7 +459,7 @@ fn resolve_app_server_leader_name_fails_closed_on_transport_conflict() {
 
 #[cfg(unix)]
 #[test]
-fn send_to_name_app_server_leader_submits_turn_without_tmux_pane() {
+fn send_to_name_app_server_leader_persists_before_async_delivery() {
     let ws = named_ws("appserver-leader-send");
     let fake = crate::app_server_test_support::FakeAppServer::start(
         "named-send",
@@ -484,11 +484,13 @@ fn send_to_name_app_server_leader_submits_turn_without_tmux_pane() {
     };
 
     assert_eq!(value["ok"], json!(true));
-    assert_eq!(value["transport_kind"], json!("codex_app_server"));
-    assert_eq!(fake.received_turns().len(), 1);
-    assert_eq!(
-        fake.received_turns()[0]["params"]["clientUserMessageId"],
-        value["message_id"]
+    let message_id = value["message_id"].as_str().expect("persisted message id");
+    assert!(message_id.starts_with("msg_"));
+    let store = crate::message_store::MessageStore::open(&ws).unwrap();
+    assert!(store.message_exists(message_id).unwrap());
+    assert!(
+        fake.received_turns().is_empty(),
+        "send returns after persistence; coordinator owns physical delivery"
     );
     let _ = std::fs::remove_dir_all(&ws);
 }

package/crates/team-agent/src/cli/tests/run_delegation.rs

@@ -90,7 +90,7 @@ fn run_dispatches_status_to_handler_returns_ok() {
 
 #[test]
 fn run_dispatches_send_to_handler_returns_ok() {
-    // run([send w1 hello --sender leader --workspace <seeded>]) -> cmd_send -> messaging::send_message
+    // run([send w1 hello --workspace <seeded>]) -> cmd_send -> messaging::send_message
     // -> ok (w1 is an in-team agent) -> ExitCode::Ok. w1 must be seeded: golden refuses non-team targets.
     //
     // OLD seed: flat `{"agents": {"w1": ...}}`.
@@ -112,8 +112,6 @@ fn run_dispatches_send_to_handler_returns_ok() {
         "send".to_string(),
         "w1".to_string(),
         "hello".to_string(),
-        "--sender".to_string(),
-        "leader".to_string(),
         "--workspace".to_string(),
         ws.to_string_lossy().to_string(),
     ];
@@ -322,6 +320,7 @@ fn cli_add_agent_duplicate_id_surfaces_real_error() {
         workspace: team,
         team: None,
         role_file: dup_role.to_string_lossy().to_string(),
+        force: false,
         no_display: false,
         json: true,
     };

package/crates/team-agent/src/cli/tests/status_send.rs

@@ -460,7 +460,7 @@ fn send_args_fixture() -> SendArgs {
         workspace: PathBuf::from("."),
         team: Some("teamA".into()),
         task: Some("t-1".into()),
-        sender: "leader".into(),
+        sender: TrustedSender::leader(),
         no_ack: true,
         no_wait: true,
         watch_result: true,
@@ -515,7 +515,7 @@ fn send_options_negates_no_ack_and_no_wait_and_carries_watch() {
         "watch_result flag MUST pass through into SendOptions"
     );
     assert!(!opts.confirm_human);
-    assert_eq!(opts.sender, "leader");
+    assert_eq!(opts.sender.as_str(), "leader");
     assert_eq!(opts.timeout, 12.5);
 }
 
@@ -866,15 +866,8 @@ fn cmd_send_unknown_task_surfaces_golden_error_envelope_not_silent() {
     let _ = std::fs::remove_dir_all(&ws);
 }
 
-// P0 (b') — the SWALLOW guard: `run()` (the CLI process entry) MUST RENDER the send error, not
-// discard Err(CliError) via unwrap_or (advisor %7 root cause). Proxy: emit_cli_error WRITES a
-// `.team/logs/cli-error-*.log` (and prints the compact envelope) — if run() swallowed, neither
-// happens. So a cli-error log containing the BARE "unknown task id: <id>" (no "validation:" prefix)
-// + ExitCode::Error proves run() rendered. Drives the real argv→(exit,render) path.
-// OLD/NEW: same Bug 1/2 seed sync as cmd_send_unknown_task_*; the render-vs-swallow
-// behavior under test is unchanged.
 #[test]
-fn run_send_unknown_task_renders_error_not_silent_swallow() {
+fn run_send_legacy_task_flag_is_internalized_before_persistence() {
     let ws = std::env::temp_dir().join(format!(
         "ta-run-sendunk-{}-{}",
         std::process::id(),
@@ -906,30 +899,21 @@ fn run_send_unknown_task_renders_error_not_silent_swallow() {
     let code = run(&argv, &ws);
     assert_eq!(
         code,
-        ExitCode::Error,
-        "run(send --task <unknown>) must exit Error, not Ok"
-    );
-    // run() must have RENDERED (emit_cli_error wrote the cli-error log); a swallow leaves none.
-    let logs_dir = ws.join(".team").join("logs");
-    let mut found = String::new();
-    if let Ok(entries) = std::fs::read_dir(&logs_dir) {
-        for entry in entries.flatten() {
-            let name = entry.file_name().to_string_lossy().to_string();
-            if name.starts_with("cli-error-") {
-                found = std::fs::read_to_string(entry.path()).unwrap_or_default();
-                break;
-            }
-        }
-    }
-    assert!(
-        found.contains("unknown task id: t-unknown"),
-        "run() must RENDER the send error (cli-error log written with the bare message) — a silent \
-         swallow (unwrap_or discards Err) leaves no log. got log body: {found:?}"
-    );
-    assert!(
-        !found.contains("validation:"),
-        "rendered error must be the bare golden message, NO 'validation:' prefix; got {found:?}"
+        ExitCode::Ok,
+        "legacy --task is sunset-noticed and ignored; public send persists without caller binding"
     );
+    let connection = rusqlite::Connection::open(
+        ws.join(".team").join("runtime").join("team.db"),
+    )
+    .unwrap();
+    let task_id: Option<String> = connection
+        .query_row(
+            "SELECT task_id FROM messages WHERE content = 'go' ORDER BY rowid DESC LIMIT 1",
+            [],
+            |row| row.get(0),
+        )
+        .unwrap();
+    assert_eq!(task_id, None, "caller-supplied task ids must not reach storage");
     let _ = std::fs::remove_dir_all(&ws);
 }
 

package/crates/team-agent/src/cli/types.rs

@@ -312,7 +312,7 @@ pub struct SendArgs {
     pub workspace: PathBuf,
     pub team: Option<String>,
     pub task: Option<String>,
-    pub sender: String,
+    pub sender: TrustedSender,
     pub no_ack: bool,
     pub no_wait: bool,
     pub watch_result: bool,
@@ -323,16 +323,12 @@ pub struct SendArgs {
     /// When set, the store insert uses this id verbatim; a repeat with the same
     /// id returns a `Duplicate` refusal instead of creating a second row.
     pub message_id: Option<String>,
-    /// F1 (0.3.26): `--pane <pane_id>` — direct pane-id targeting. Mutually
-    /// exclusive with `target` / `targets`. When set, the message is injected
-    /// directly into the specified tmux pane via `transport.inject`, bypassing
-    /// the agent-name → pane-id resolution + team-membership check. This is
-    /// the **cross-team communication** primitive: the target pane does not
-    /// need to be in the sender's team.
+    /// Deprecated compatibility input. Public send refuses pane identity and
+    /// requires a logical recipient so persistence always precedes delivery.
     pub pane: Option<String>,
     /// `--to-name <name>` — stable named addressing. Mutually exclusive with
     /// `target` / `targets` / `--pane`; resolves workspace/team/agent or leader
-    /// name to the current live pane before using direct pane injection.
+    /// name before delegating to the persisted message primitive.
     pub to_name: Option<String>,
     /// E7 (0.5.9 host-leader-registry-design): `--to-leader NAME` resolves
     /// NAME through `~/.team-agent/leaders`, canonical-validates, and then
@@ -501,6 +497,7 @@ pub struct AddAgentArgs {
     pub workspace: PathBuf,
     pub team: Option<String>,
     pub role_file: String,
+    pub force: bool,
     pub no_display: bool,
     pub json: bool,
 }

package/crates/team-agent/src/coordinator/conpty_shim.rs

@@ -41,7 +41,7 @@ use std::time::Duration;
 
 use conpty_transport::{pipe_name_for, NamedPipeClient};
 
-use crate::state::persist::{runtime_state_path, save_runtime_state};
+use crate::state::persist::runtime_state_path;
 use crate::state::StateError;
 
 /// Maximum shim connect+hello attempts before giving up. Each attempt
@@ -397,15 +397,11 @@ fn finalize(
     client: NamedPipeClient,
     workspace: &Path,
 ) -> Result<ShimHandle, ShimError> {
-    let state_path = runtime_state_path(workspace);
-    let mut state = if state_path.exists() {
-        match std::fs::read_to_string(&state_path) {
-            Ok(text) => serde_json::from_str::<Value>(&text).unwrap_or_else(|_| json!({})),
-            Err(_) => json!({}),
-        }
-    } else {
-        json!({})
-    };
+    let mut state = crate::state::repository::StateRepository::new(workspace)
+        .load_workspace_if_exists_without_migrations()
+        .ok()
+        .flatten()
+        .unwrap_or_else(|| json!({}));
     // CR C-1: token NOT stored. Only pid/pipe_name/pipe_ready.
     let obj = state
         .as_object_mut()
@@ -431,7 +427,14 @@ fn finalize(
             "pipe_ready": true,
         }),
     );
-    save_runtime_state(workspace, &state).map_err(|e| ShimError::StatePersist { source: e })?;
+    crate::state::repository::StateRepository::new(workspace)
+        .save(
+            crate::state::repository::StateWriteIntent::CoordinatorConptyShim {
+                team_key: state.get("active_team_key").and_then(Value::as_str),
+            },
+            &state,
+        )
+        .map_err(|e| ShimError::StatePersist { source: e })?;
     // 0.5.x Windows portability Batch 7 F6: state merge now preserves
     // the `transport.shim` block through downstream saves (see
     // `state::persist::preserve_transport_shim`), so the Batch 6
@@ -450,12 +453,9 @@ fn finalize(
 /// Windows worker). Callers use `platform::process::terminate_pid`
 /// on the returned pid.
 pub fn recorded_shim_pid(workspace: &Path) -> Option<u32> {
-    let state_path = runtime_state_path(workspace);
-    if !state_path.exists() {
-        return None;
-    }
-    let text = std::fs::read_to_string(&state_path).ok()?;
-    let state: Value = serde_json::from_str(&text).ok()?;
+    let state = crate::state::repository::StateRepository::new(workspace)
+        .load_workspace_if_exists_without_migrations()
+        .ok()??;
     state
         .get("transport")?
         .get("shim")?
@@ -466,12 +466,9 @@ pub fn recorded_shim_pid(workspace: &Path) -> Option<u32> {
 
 /// Read `state.transport.shim.pipe_name` for reconnect routing.
 pub fn recorded_shim_pipe_name(workspace: &Path) -> Option<String> {
-    let state_path = runtime_state_path(workspace);
-    if !state_path.exists() {
-        return None;
-    }
-    let text = std::fs::read_to_string(&state_path).ok()?;
-    let state: Value = serde_json::from_str(&text).ok()?;
+    let state = crate::state::repository::StateRepository::new(workspace)
+        .load_workspace_if_exists_without_migrations()
+        .ok()??;
     state
         .get("transport")?
         .get("shim")?
@@ -647,19 +644,26 @@ pub fn mark_transport_unavailable(workspace: &Path, reason: &str) -> Result<(),
     // Clear the shim block from state so subsequent factory
     // `conpty_pipe_ready` checks return false and the operator sees
     // an honest "no live shim" via status --detail.
-    let state_path = runtime_state_path(workspace);
-    if !state_path.exists() {
-        return Ok(());
-    }
-    let text = std::fs::read_to_string(&state_path).map_err(StateError::from)?;
-    let mut state: Value = serde_json::from_str(&text).unwrap_or_else(|_| serde_json::json!({}));
+    let mut state = match crate::state::repository::StateRepository::new(workspace)
+        .load_workspace_if_exists_without_migrations()
+    {
+        Ok(Some(state)) => state,
+        Ok(None) => return Ok(()),
+        Err(StateError::Json(_)) => serde_json::json!({}),
+        Err(error) => return Err(error),
+    };
     if let Some(transport) = state.get_mut("transport").and_then(|t| t.as_object_mut()) {
         if let Some(shim) = transport.get_mut("shim").and_then(|s| s.as_object_mut()) {
             shim.insert("pipe_ready".to_string(), serde_json::json!(false));
             shim.insert("unavailable_reason".to_string(), serde_json::json!(reason));
         }
     }
-    save_runtime_state(workspace, &state)
+    crate::state::repository::StateRepository::new(workspace).save(
+        crate::state::repository::StateWriteIntent::CoordinatorConptyShim {
+            team_key: state.get("active_team_key").and_then(Value::as_str),
+        },
+        &state,
+    )
 }
 
 #[cfg(test)]

package/crates/team-agent/src/coordinator/steps/abnormal.rs

@@ -32,6 +32,10 @@ pub(crate) fn detect_abnormal_exits(
     let team = crate::state::projection::team_state_key(&snapshot);
     let session_name = snapshot.get("session_name").and_then(Value::as_str);
     for agent in abnormal_watch_agents(&snapshot) {
+        // Pane/process liveness is independent of transcript content. A
+        // frozen rollout is common after pane death, so probe before the
+        // metadata dedupe gate; only the expensive tail scan stays deduped.
+        let liveness = agent_process_liveness(&agent, session_name, targets, transport);
         let rollout_path = resolve_agent_rollout_path(workspace, &agent.rollout_path);
         let metadata = match std::fs::metadata(&rollout_path) {
             Ok(metadata) => metadata,
@@ -67,6 +71,7 @@ pub(crate) fn detect_abnormal_exits(
             abnormal_watch_stored_metadata(&snapshot, &agent.agent_id),
         ) {
             if stored == (size, mtime) {
+                refresh_abnormal_watch_liveness(state, &agent.agent_id, &liveness);
                 continue;
             }
         }
@@ -97,7 +102,6 @@ pub(crate) fn detect_abnormal_exits(
                 continue;
             }
         };
-        let liveness = agent_process_liveness(&agent, session_name, targets, transport);
         let fact = crate::provider::latest_explicit_error_fact(agent.provider, &text);
         let error_observation_key = fact
             .as_ref()
@@ -218,6 +222,7 @@ pub(crate) fn detect_abnormal_exits(
         } else {
             "refused"
         };
+        let provider_process_dead = provider_process_dead_fact(&liveness);
         event_log.write(
             "worker.abnormal_exit",
             serde_json::json!({
@@ -227,7 +232,7 @@ pub(crate) fn detect_abnormal_exits(
                 "path": agent.rollout_path_display.as_str(),
                 "dead_process": liveness.state == ProcessLiveness::Dead,
                 "process_dead": liveness.state == ProcessLiveness::Dead,
-                "provider_process_dead": liveness.state == ProcessLiveness::Dead,
+                "provider_process_dead": provider_process_dead,
                 "latest_error": true,
                 "latest_explicit_error": true,
                 "error_recency": error_recency.as_str(),
@@ -235,7 +240,7 @@ pub(crate) fn detect_abnormal_exits(
                 "dead_process_and_latest_error": liveness.state == ProcessLiveness::Dead,
                 "dead_process_and_latest_explicit_error": liveness.state == ProcessLiveness::Dead,
                 "process_dead_and_latest_explicit_error": liveness.state == ProcessLiveness::Dead,
-                "provider_process_dead_and_latest_explicit_error": liveness.state == ProcessLiveness::Dead,
+                "provider_process_dead_and_latest_explicit_error": provider_process_dead,
                 "signature": fact.signature.as_str(),
                 "turn_id": fact.turn_id.as_ref().map(|id| id.as_str()),
                 "apiErrorStatus": fact.api_error_status,
@@ -256,6 +261,50 @@ pub(crate) fn detect_abnormal_exits(
     Ok(())
 }
 
+fn provider_process_dead_fact(liveness: &ProcessCheck) -> bool {
+    liveness.state == ProcessLiveness::Dead
+        && !liveness.detail.starts_with("pane_dead:")
+        && !liveness.detail.starts_with("window_missing:")
+}
+
+fn worker_provider_exited_fact(liveness: &ProcessCheck) -> bool {
+    provider_process_dead_fact(liveness) && liveness.detail.starts_with("worker_provider_exited:")
+}
+
+fn refresh_abnormal_watch_liveness(state: &mut Value, agent_id: &str, liveness: &ProcessCheck) {
+    let Some(watch) = coordinator_child_object(state, "abnormal_exit_watch")
+        .and_then(|watch| watch.get_mut(agent_id))
+        .and_then(Value::as_object_mut)
+    else {
+        return;
+    };
+    let dead_process = liveness.state == ProcessLiveness::Dead;
+    let provider_process_dead = provider_process_dead_fact(liveness);
+    let latest_explicit_error = watch
+        .get("latest_explicit_error")
+        .and_then(Value::as_bool)
+        .unwrap_or(false);
+    // Persist fact transitions, not the tick's observation time; otherwise an
+    // unchanged transcript makes every steady tick rewrite state.json.
+    let patch = serde_json::json!({
+        "last_liveness": process_liveness_wire(liveness.state),
+        "last_liveness_detail": liveness.detail.as_str(),
+        "dead_process": dead_process,
+        "process_dead": dead_process,
+        "provider_process_dead": provider_process_dead,
+        "worker_provider_exited": worker_provider_exited_fact(liveness),
+        "provider_process_dead_and_latest_explicit_error": provider_process_dead && latest_explicit_error,
+    });
+    if let Some(patch) = patch.as_object() {
+        if patch
+            .iter()
+            .any(|(key, value)| watch.get(key) != Some(value))
+        {
+            watch.extend(patch.clone());
+        }
+    }
+}
+
 #[derive(Debug, Clone)]
 struct AbnormalWatchAgent {
     agent_id: String,
@@ -816,8 +865,8 @@ fn abnormal_watch_payload(
     // marker (detail prefix `worker_provider_exited:`). status_port's
     // RuntimeFreshness collector reads this field to downgrade the
     // corresponding agent row.
-    let worker_provider_exited =
-        dead_process && liveness.detail.starts_with("worker_provider_exited:");
+    let provider_process_dead = provider_process_dead_fact(&liveness);
+    let worker_provider_exited = worker_provider_exited_fact(&liveness);
     serde_json::json!({
         "path": agent.rollout_path_display.as_str(),
         "provider": provider_wire(agent.provider),
@@ -829,7 +878,7 @@ fn abnormal_watch_payload(
         "last_liveness_detail": liveness.detail,
         "dead_process": dead_process,
         "process_dead": dead_process,
-        "provider_process_dead": dead_process,
+        "provider_process_dead": provider_process_dead,
         "worker_provider_exited": worker_provider_exited,
         "latest_error": latest_explicit_error,
         "latest_explicit_error": latest_explicit_error,
@@ -839,11 +888,10 @@ fn abnormal_watch_payload(
         "dead_process_and_latest_error": dead_process && latest_explicit_error,
         "dead_process_and_latest_explicit_error": dead_process && latest_explicit_error,
         "process_dead_and_latest_explicit_error": dead_process && latest_explicit_error,
-        "provider_process_dead_and_latest_explicit_error": dead_process && latest_explicit_error,
+        "provider_process_dead_and_latest_explicit_error": provider_process_dead && latest_explicit_error,
         "suppressed_reason": suppressed_reason,
         "notification": notify,
         "last_error": error,
-        "last_checked_at": chrono::Utc::now().to_rfc3339(),
     })
 }
 
@@ -1060,6 +1108,7 @@ fn write_abnormal_check(
     mtime_ns: Option<u64>,
 ) -> Result<(), TickError> {
     let dead_process = liveness.state == ProcessLiveness::Dead;
+    let provider_process_dead = provider_process_dead_fact(liveness);
     let latest_explicit_error = fact.is_some();
     event_log.write(
         "worker.abnormal_exit.check",
@@ -1073,7 +1122,7 @@ fn write_abnormal_check(
             "mtime_ns": mtime_ns,
             "dead_process": dead_process,
             "process_dead": dead_process,
-            "provider_process_dead": dead_process,
+            "provider_process_dead": provider_process_dead,
             "latest_error": latest_explicit_error,
             "latest_explicit_error": latest_explicit_error,
             "error_recency": error_recency.as_str(),
@@ -1081,7 +1130,7 @@ fn write_abnormal_check(
             "dead_process_and_latest_error": dead_process && latest_explicit_error,
             "dead_process_and_latest_explicit_error": dead_process && latest_explicit_error,
             "process_dead_and_latest_explicit_error": dead_process && latest_explicit_error,
-            "provider_process_dead_and_latest_explicit_error": dead_process && latest_explicit_error,
+            "provider_process_dead_and_latest_explicit_error": provider_process_dead && latest_explicit_error,
             "notification": matches!(decision, AbnormalExitDecision::Notify),
             "suppressed_reason": match decision {
                 AbnormalExitDecision::Suppress(reason) => Some(reason),
@@ -1107,6 +1156,7 @@ fn write_abnormal_suppressed(
     liveness: &ProcessCheck,
     reason: &str,
 ) -> Result<(), TickError> {
+    let provider_process_dead = provider_process_dead_fact(liveness);
     event_log.write(
         "abnormal_exit.single_signal_suppressed",
         serde_json::json!({
@@ -1118,7 +1168,7 @@ fn write_abnormal_suppressed(
             "notification": false,
             "dead_process": liveness.state == ProcessLiveness::Dead,
             "process_dead": liveness.state == ProcessLiveness::Dead,
-            "provider_process_dead": liveness.state == ProcessLiveness::Dead,
+            "provider_process_dead": provider_process_dead,
             "latest_error": false,
             "latest_explicit_error": false,
             "error_recency": ErrorRecency::None.as_str(),
@@ -1845,7 +1895,13 @@ pub(crate) fn attempt_due_recoveries(
         return;
     };
     if clear_stale_terminal_next_retry_at(&mut state) {
-        let _ = crate::state::persist::save_runtime_state(workspace, &state);
+        let _ = crate::state::repository::StateRepository::new(workspace).save(
+            crate::state::repository::StateWriteIntent::CoordinatorApiErrorRecovery {
+                team_key: state.get("active_team_key").and_then(Value::as_str),
+                agent_id: None,
+            },
+            &state,
+        );
     }
     let due_agents = collect_due_recovery_agents(&state);
     for agent_id in due_agents {
@@ -2098,7 +2154,13 @@ fn write_recovery_intent_result(workspace: &Path, agent_id: &str, update: Recove
             }
         }
     }
-    let _ = crate::state::persist::save_runtime_state(workspace, &state);
+    let _ = crate::state::repository::StateRepository::new(workspace).save(
+        crate::state::repository::StateWriteIntent::CoordinatorApiErrorRecovery {
+            team_key: state.get("active_team_key").and_then(Value::as_str),
+            agent_id: Some(agent_id),
+        },
+        &state,
+    );
 }
 
 #[cfg(test)]
@@ -2510,6 +2572,66 @@ mod tests {
         assert_eq!(suppressed["fresh_error"], serde_json::json!(false));
     }
 
+    #[test]
+    fn abnormal_unchanged_transcript_keeps_provider_death_out_of_pane_projection() {
+        let dir = temp_abnormal_dir("unchanged-provider-dead");
+        let rollout = dir.join("rollout-w1.jsonl");
+        std::fs::write(
+            &rollout,
+            "{\"method\":\"turn/completed\",\"params\":{\"turn\":{\"id\":\"t1\",\"status\":\"completed\"}}}\n",
+        )
+        .unwrap();
+        seed_abnormal_state(&dir, &rollout, "alive", 1);
+        let coordinator = abnormal_test_coordinator(&dir);
+        coordinator.tick().unwrap();
+
+        let mut state = crate::state::persist::load_runtime_state(&dir).unwrap();
+        state["agents"]["w1"]["process_liveness"] = serde_json::json!("dead");
+        crate::state::persist::save_runtime_state(&dir, &state).unwrap();
+        coordinator.tick().unwrap();
+
+        let state = crate::state::persist::load_runtime_state(&dir).unwrap();
+        let agent = &state["agents"]["w1"];
+        assert!(
+            agent.get("provider_process_dead").is_none(),
+            "provider death belongs to abnormal watch, not the pane-dead seat projection: {agent}"
+        );
+        assert!(
+            agent.get("stale_reason").is_none(),
+            "provider death must not be mislabeled pane_dead: {agent}"
+        );
+        let watch = &state["coordinator"]["abnormal_exit_watch"]["w1"];
+        assert_eq!(watch["provider_process_dead"], serde_json::json!(true));
+        assert_eq!(watch["worker_provider_exited"], serde_json::json!(false));
+        assert_eq!(
+            watch["last_liveness_detail"],
+            serde_json::json!("explicit:dead")
+        );
+    }
+
+    #[test]
+    fn abnormal_pane_absence_is_not_provider_process_death() {
+        let agent = test_abnormal_agent("/tmp/rollout.jsonl", Some(1), None);
+        for detail in ["pane_dead:%1", "window_missing:w1"] {
+            let payload = abnormal_watch_payload(
+                &agent,
+                Some(1),
+                Some(2),
+                process_check(ProcessLiveness::Dead, detail.to_string()),
+                None,
+                ErrorRecency::None,
+                None,
+                None,
+            );
+            assert_eq!(
+                payload["provider_process_dead"],
+                serde_json::json!(false),
+                "pane absence and provider death are distinct facts: {payload}"
+            );
+            assert_eq!(payload["worker_provider_exited"], serde_json::json!(false));
+        }
+    }
+
     #[test]
     fn abnormal_recency_treats_cohort_change_as_stale() {
         let agent = test_abnormal_agent("/tmp/rollout.jsonl", Some(2), None);

package/crates/team-agent/src/coordinator/tick.rs

@@ -752,6 +752,43 @@ impl Coordinator {
                 }
             };
             if !windows.iter().any(|known| known == &window) {
+                // Missing is proof only inside a non-empty same-session
+                // inventory (a live peer exists). An empty snapshot is an
+                // unavailable transport, not proof every worker died.
+                if windows.is_empty() {
+                    continue;
+                }
+                if let Some(agent_obj) = agent.as_object_mut() {
+                    agent_obj.insert("status".to_string(), serde_json::json!("stopped"));
+                    agent_obj.insert("worker_state".to_string(), serde_json::json!("DEAD"));
+                    agent_obj.insert("stale".to_string(), serde_json::json!(true));
+                    agent_obj.insert("stale_reason".to_string(), serde_json::json!("pane_dead"));
+                }
+                let conn = crate::db::schema::open_db(store.db_path()).map_err(|error| {
+                    TickError::MessageStore(crate::message_store::MessageStoreError::Db(error))
+                })?;
+                conn.execute(
+                    "insert into agent_health(owner_team_id, agent_id, status, updated_at) \
+                     values (?1, ?2, 'DEAD', ?3) \
+                     on conflict(owner_team_id, agent_id) do update set \
+                     status='DEAD', updated_at=excluded.updated_at",
+                    rusqlite::params![
+                        team_key.as_ref().map(|key| key.as_str()),
+                        agent_id,
+                        chrono::Utc::now().to_rfc3339()
+                    ],
+                )
+                .map_err(|error| {
+                    TickError::MessageStore(crate::message_store::MessageStoreError::Sqlite(error))
+                })?;
+                let _ = event_log.write(
+                    "coordinator.agent_pane_dead",
+                    serde_json::json!({
+                        "agent_id": agent_id,
+                        "target": format!("{target:?}"),
+                        "stale_reason": "pane_dead",
+                    }),
+                );
                 continue;
             }
             // Warm-idle suppression still gates pane fallback ONLY. When