@team-agent/installer 0.5.50 → 0.5.52

package/crates/team-agent/src/messaging/leader_channel.rs

@@ -0,0 +1,171 @@
+use std::path::Path;
+
+use serde_json::Value;
+
+use crate::codex_app_server::AppServerBinding;
+use crate::transport::{PaneInfo, Transport};
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum LiveLeaderChannel {
+    DirectTmux(DirectTmuxLeaderChannel),
+    CodexAppServer(AppServerBinding),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct DirectTmuxLeaderChannel {
+    pub pane_id: String,
+    pub tmux_socket: Option<String>,
+    pub observed: PaneInfo,
+    pub metadata_drift: Vec<&'static str>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum LeaderChannelResolution {
+    Live(LiveLeaderChannel),
+    Unbound(LeaderChannelUnbound),
+    ProbeFailed(String),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LeaderChannelUnbound {
+    ReceiverNotAttached,
+    TransportConflict,
+    MissingPaneId,
+    NonCanonicalTmuxSocket,
+    EndpointMismatch,
+    PaneNotLive,
+    PaneWorkspaceMismatch,
+    AppServerBindingInvalid,
+}
+
+/// Resolve the canonical receiver's live physical channel without mutating
+/// ownership. For direct tmux, `(absolute socket, pane id)` plus an available
+/// pane cwd inside the target workspace is the authority. Session/window/tty/
+/// fingerprint are observations and can only report drift.
+pub fn resolve_live_leader_channel(
+    workspace: &Path,
+    receiver: &Value,
+    transport: &dyn Transport,
+) -> LeaderChannelResolution {
+    if receiver
+        .get("status")
+        .and_then(Value::as_str)
+        .is_some_and(|status| status != "attached")
+    {
+        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::ReceiverNotAttached);
+    }
+    if receiver_transport_conflicts(receiver) {
+        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::TransportConflict);
+    }
+    if crate::codex_app_server::receiver_is_app_server(receiver) {
+        return match crate::codex_app_server::binding_from_receiver(receiver) {
+            Ok(binding) => {
+                LeaderChannelResolution::Live(LiveLeaderChannel::CodexAppServer(binding))
+            }
+            Err(_) => {
+                LeaderChannelResolution::Unbound(LeaderChannelUnbound::AppServerBindingInvalid)
+            }
+        };
+    }
+
+    let Some(pane_id) = receiver
+        .get("pane_id")
+        .and_then(Value::as_str)
+        .filter(|pane| !pane.is_empty())
+    else {
+        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::MissingPaneId);
+    };
+    let tmux_socket = receiver
+        .get("tmux_socket")
+        .and_then(Value::as_str)
+        .filter(|socket| !socket.is_empty());
+    if tmux_socket.is_some_and(|socket| !std::path::Path::new(socket).is_absolute()) {
+        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::NonCanonicalTmuxSocket);
+    }
+    if let Some(expected) = tmux_socket {
+        if transport.tmux_endpoint().as_deref() != Some(expected) {
+            return LeaderChannelResolution::Unbound(LeaderChannelUnbound::EndpointMismatch);
+        }
+    }
+    let targets = match transport.list_targets() {
+        Ok(targets) => targets,
+        Err(error) => return LeaderChannelResolution::ProbeFailed(error.to_string()),
+    };
+    let Some(observed) = targets
+        .into_iter()
+        .find(|target| target.pane_id.as_str() == pane_id)
+    else {
+        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::PaneNotLive);
+    };
+    if observed
+        .current_path
+        .as_deref()
+        .is_some_and(|path| !path_is_in_workspace(path, workspace))
+    {
+        return LeaderChannelResolution::Unbound(LeaderChannelUnbound::PaneWorkspaceMismatch);
+    }
+    let metadata_drift = receiver_metadata_drift(receiver, &observed);
+    LeaderChannelResolution::Live(LiveLeaderChannel::DirectTmux(DirectTmuxLeaderChannel {
+        pane_id: pane_id.to_string(),
+        tmux_socket: tmux_socket.map(str::to_string),
+        observed,
+        metadata_drift,
+    }))
+}
+
+fn path_is_in_workspace(path: &Path, workspace: &Path) -> bool {
+    let path = path.canonicalize().unwrap_or_else(|_| path.to_path_buf());
+    let workspace = workspace
+        .canonicalize()
+        .unwrap_or_else(|_| workspace.to_path_buf());
+    path == workspace || path.starts_with(workspace)
+}
+
+fn receiver_transport_conflicts(receiver: &Value) -> bool {
+    let mode = receiver.get("mode").and_then(Value::as_str);
+    let transport_kind = receiver.get("transport_kind").and_then(Value::as_str);
+    matches!((mode, transport_kind), (Some(mode), Some(kind)) if !mode.is_empty() && !kind.is_empty() && mode != kind)
+}
+
+fn receiver_metadata_drift(receiver: &Value, observed: &PaneInfo) -> Vec<&'static str> {
+    let mut drift = Vec::new();
+    if string_field(receiver, "session_name")
+        .is_some_and(|expected| expected != observed.session.as_str())
+    {
+        drift.push("session_name");
+    }
+    if string_field(receiver, "window_name").is_some_and(|expected| {
+        observed.window_name.as_ref().map(|value| value.as_str()) != Some(expected)
+    }) {
+        drift.push("window_name");
+    }
+    if string_field(receiver, "pane_tty")
+        .is_some_and(|expected| observed.tty.as_deref() != Some(expected))
+    {
+        drift.push("pane_tty");
+    }
+    let observed_fingerprint = format!(
+        "{}|{}|{}|{}",
+        observed.session.as_str(),
+        observed
+            .window_index
+            .map_or_else(String::new, |value| value.to_string()),
+        observed
+            .pane_index
+            .map_or_else(String::new, |value| value.to_string()),
+        observed.tty.as_deref().unwrap_or("")
+    );
+    if string_field(receiver, "fingerprint")
+        .is_some_and(|expected| expected != observed_fingerprint)
+    {
+        drift.push("fingerprint");
+    }
+    drift
+}
+
+fn string_field<'a>(value: &'a Value, key: &str) -> Option<&'a str> {
+    value
+        .get(key)
+        .and_then(Value::as_str)
+        .filter(|value| !value.is_empty())
+}

package/crates/team-agent/src/messaging/leader_receiver.rs

@@ -13,7 +13,11 @@ use crate::transport::{
 };
 
 use super::helpers::MessageStatusShadow;
-use super::{DeliveryOutcome, DeliveryRefusal, DeliveryStage, DeliveryStatus, MessagingError};
+use super::persist::persist_internal_send;
+use super::{
+    DeliveryOutcome, DeliveryRefusal, DeliveryStage, DeliveryStatus, InitialDisposition,
+    InternalSendKind, MessagingError, PersistResolution,
+};
 
 /// `_send_to_leader_receiver` (`leader.py:69`) — **N31/N32 funnel primitive**:所有 leader-bound
 /// caller(send_message(to=leader) / report_result / request_human / idle reminder /
@@ -74,39 +78,32 @@ pub fn send_to_leader_receiver_with_message_id(
             serde_json::json!({"sender": sender, "leader_id": leader_id, "result_id": result_id}),
         )?;
     }
-    let message_id = if let Some(requested) = requested_message_id {
-        if store.message_exists(requested)? {
+    let message_id = match persist_internal_send(
+        workspace,
+        InternalSendKind::LeaderNotification,
+        Some(&owner_team),
+        task_id.map(TaskId::as_str),
+        sender,
+        leader_id,
+        content,
+        None,
+        false,
+        requested_message_id,
+        InitialDisposition::Accepted,
+    )? {
+        PersistResolution::Duplicate(requested) => {
             return Ok(DeliveryOutcome {
                 ok: false,
                 status: DeliveryStatus::Refused,
                 message_status: MessageStatusShadow("refused".to_string()),
-                message_id: Some(requested.to_string()),
+                message_id: Some(requested),
                 verification: None,
                 stage: None,
                 reason: Some(DeliveryRefusal::Duplicate),
                 channel: Some("leader_receiver".to_string()),
             });
         }
-        store.create_message_with_id(
-            requested,
-            task_id.map(TaskId::as_str),
-            sender,
-            leader_id,
-            content,
-            None,
-            false,
-            Some(&owner_team),
-        )?
-    } else {
-        store.create_message(
-            task_id.map(TaskId::as_str),
-            sender,
-            leader_id,
-            content,
-            None,
-            false,
-            Some(&owner_team),
-        )?
+        PersistResolution::Persisted(persisted) => persisted.message_id,
     };
     // #231 exactly-once across rebind: insert the leader_notification_log PK BEFORE the
     // unbound-pane check. That way, if the result row gets blocked (I-4) and later the
@@ -332,7 +329,32 @@ pub fn deliver_to_leader_fallback_pane(
             let submit_ok = super::delivery::inject_submit_verified(&report);
             let readback_ok = super::delivery::pane_readback_verified(&report);
             if submit_ok {
-                store.mark(message_id, "delivered", None)?;
+                store.record_delivery_submission(message_id, readback_ok)?;
+                if !super::delivery::leader_transcript_has_token(state, message_id) {
+                    store.mark(message_id, "submitted_pending_acceptance", None)?;
+                    event_log.write(
+                        "leader_receiver.acceptance_pending",
+                        serde_json::json!({
+                            "message_id": message_id,
+                            "result_id": result_id,
+                            "reason": "provider_receipt_not_observed",
+                            "channel": "fallback_pane",
+                        }),
+                    )?;
+                    return Ok(DeliveryOutcome {
+                        ok: true,
+                        status: DeliveryStatus::RetryScheduled,
+                        message_status: MessageStatusShadow(
+                            "submitted_pending_acceptance".to_string(),
+                        ),
+                        message_id: Some(message_id.to_string()),
+                        verification: Some("provider_receipt_not_observed".to_string()),
+                        stage: Some(DeliveryStage::Submit),
+                        reason: None,
+                        channel: Some("leader_acceptance_pending".to_string()),
+                    });
+                }
+                store.mark_delivered_with_receipt(message_id)?;
                 event_log.write(
                     "leader_receiver.fallback_pane_submitted",
                     serde_json::json!({
@@ -562,21 +584,24 @@ pub fn enqueue_leader_mailbox_until_attach(
     sender: &str,
     event_log: &EventLog,
 ) -> Result<DeliveryOutcome, MessagingError> {
-    let store = MessageStore::open(target_workspace)?;
-    let message_id = store.create_message(
+    let PersistResolution::Persisted(persisted) = persist_internal_send(
+        target_workspace,
+        InternalSendKind::OfflineMailbox,
+        Some(canonical_team_key),
         task_id.map(TaskId::as_str),
         sender,
         "leader",
         content,
         None,
         false,
-        Some(canonical_team_key),
-    )?;
-    // The default row status after `create_message` is `accepted`. Flip it to
-    // `queued_until_leader_attach` so it stays out of `claim_for_delivery`
-    // eligible set and out of `deliver_pending_messages` scan until an
-    // attach/claim explicitly requeues it (see requeue_blocked_leader_messages).
-    store.mark(&message_id, "queued_until_leader_attach", None)?;
+        None,
+        InitialDisposition::QueuedUntilLeaderAttach,
+    )?
+    else {
+        unreachable!("offline mailbox does not accept caller-supplied ids")
+    };
+    let message_status = persisted.row_status.as_str().to_string();
+    let message_id = persisted.message_id;
     event_log.write(
         "leader_mailbox.queued_until_attach",
         serde_json::json!({
@@ -590,7 +615,7 @@ pub fn enqueue_leader_mailbox_until_attach(
     Ok(DeliveryOutcome {
         ok: true,
         status: DeliveryStatus::Queued,
-        message_status: MessageStatusShadow("queued_until_leader_attach".to_string()),
+        message_status: MessageStatusShadow(message_status),
         message_id: Some(message_id),
         verification: None,
         stage: None,

package/crates/team-agent/src/messaging/mod.rs

@@ -61,10 +61,13 @@ use crate::message_store::MessageStore;
 use crate::transport::{PaneId, Target, Transport};
 
 pub mod activity;
+pub mod address;
 pub mod delivery;
 pub mod helpers;
+pub mod leader_channel;
 pub mod leader_receiver;
 pub mod peers;
+pub mod persist;
 pub mod results;
 pub mod scheduler;
 pub mod selftest;
@@ -75,19 +78,29 @@ pub mod watchers;
 
 // ── re-export: 保持 `crate::messaging::X` 与 test `super::X` 解析不变 ──────────
 pub use activity::{classify_agent_activity, detect_cross_worker_deadlocks, detect_idle_fallbacks};
+pub use address::{parse_logical_address, LogicalAddress, LogicalAddressTarget};
 pub use delivery::{
-    deliver_pending_message, deliver_pending_messages, deliver_stored_message, execute_trust_retry,
-    handle_trust_retry_needed, record_turn_open_if_leader_to_worker,
+    deliver_pending_message, deliver_pending_messages, deliver_persisted_message,
+    deliver_stored_message, execute_trust_retry, handle_trust_retry_needed,
+    record_turn_open_if_leader_to_worker,
     retry_injection_after_trust_auto_answer, stamp_first_send_at_if_leader_to_worker,
     tmux_pane_width,
 };
 pub use helpers::fail_leader_delivery;
+pub use leader_channel::{
+    resolve_live_leader_channel, DirectTmuxLeaderChannel, LeaderChannelResolution,
+    LeaderChannelUnbound, LiveLeaderChannel,
+};
 pub use leader_receiver::{
     deliver_to_leader_fallback_pane, enqueue_leader_mailbox_until_attach,
     mirror_peer_message_to_leader, send_to_leader_receiver,
     send_to_leader_receiver_with_message_id,
 };
 pub use peers::allow_peer_talk;
+pub use persist::{
+    persist_resolved_send, DeliveryBlocker, InitialDisposition, InternalSendKind,
+    LogicalRecipient, PersistResolution, PersistedSend, ResolvedSendIntent, SendOrigin,
+};
 pub use results::{
     collect, collect_for_team, collect_results_and_notify_watchers, report_result,
     report_result_for_owner_team, report_result_for_owner_team_with_primary_error,

package/crates/team-agent/src/messaging/persist.rs

@@ -0,0 +1,309 @@
+//! Durable boundary between resolved logical addressing and delivery/recovery.
+
+use std::path::{Path, PathBuf};
+
+use crate::db::message_store::{MessageRowStatus, MessageStore, PersistMessageInput};
+use crate::model::ids::{AgentId, TaskId, TeamKey};
+
+use super::send::TrustedSender;
+use super::MessagingError;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum InternalSendKind {
+    Delivery,
+    LeaderNotification,
+    OfflineMailbox,
+    Selftest,
+    Watcher,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SendOrigin {
+    Cli,
+    Mcp,
+    Internal(InternalSendKind),
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum LogicalRecipient {
+    Worker(AgentId),
+    Leader,
+}
+
+impl LogicalRecipient {
+    pub fn from_resolved(value: impl Into<String>) -> Self {
+        let value = value.into();
+        if value == "leader" {
+            Self::Leader
+        } else {
+            Self::Worker(AgentId::new(value))
+        }
+    }
+
+    pub fn as_str(&self) -> &str {
+        match self {
+            Self::Worker(agent) => agent.as_str(),
+            Self::Leader => "leader",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum DeliveryBlocker {
+    CoordinatorUnavailable,
+}
+
+impl DeliveryBlocker {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::CoordinatorUnavailable => "coordinator_unavailable",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum InitialDisposition {
+    Accepted,
+    QueuedUntilLeaderAttach,
+    Blocked(DeliveryBlocker),
+}
+
+impl InitialDisposition {
+    fn row_status(self) -> MessageRowStatus {
+        match self {
+            Self::Accepted => MessageRowStatus::Accepted,
+            Self::QueuedUntilLeaderAttach => MessageRowStatus::QueuedUntilLeaderAttach,
+            Self::Blocked(DeliveryBlocker::CoordinatorUnavailable) => {
+                MessageRowStatus::QueuedCoordinatorUnavailable
+            }
+        }
+    }
+
+    fn error(self) -> Option<&'static str> {
+        match self {
+            Self::Blocked(blocker) => Some(blocker.as_str()),
+            Self::Accepted | Self::QueuedUntilLeaderAttach => None,
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct ResolvedSendIntent {
+    pub origin: SendOrigin,
+    pub target_workspace: PathBuf,
+    pub owner_team_id: Option<TeamKey>,
+    pub recipient: LogicalRecipient,
+    pub sender: TrustedSender,
+    pub task_id: Option<TaskId>,
+    pub content: String,
+    pub reply_to: Option<String>,
+    pub requires_ack: bool,
+    pub requested_message_id: Option<String>,
+    pub initial_disposition: InitialDisposition,
+}
+
+impl ResolvedSendIntent {
+    #[allow(clippy::too_many_arguments)]
+    pub fn accepted(
+        origin: SendOrigin,
+        workspace: &Path,
+        owner_team_id: Option<TeamKey>,
+        recipient: LogicalRecipient,
+        sender: TrustedSender,
+        task_id: Option<TaskId>,
+        content: impl Into<String>,
+        reply_to: Option<String>,
+        requires_ack: bool,
+        requested_message_id: Option<String>,
+    ) -> Self {
+        Self {
+            origin,
+            target_workspace: workspace.to_path_buf(),
+            owner_team_id,
+            recipient,
+            sender,
+            task_id,
+            content: content.into(),
+            reply_to,
+            requires_ack,
+            requested_message_id,
+            initial_disposition: InitialDisposition::Accepted,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PersistedSend {
+    pub message_id: String,
+    pub owner_team_id: Option<TeamKey>,
+    pub recipient: LogicalRecipient,
+    pub row_status: MessageRowStatus,
+    pub blocker: Option<DeliveryBlocker>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PersistResolution {
+    Persisted(PersistedSend),
+    Duplicate(String),
+}
+
+/// The only production entry point that creates a durable message row.
+pub fn persist_resolved_send(
+    intent: &ResolvedSendIntent,
+) -> Result<PersistResolution, MessagingError> {
+    let store = MessageStore::open(&intent.target_workspace)?;
+    if let Some(requested) = intent.requested_message_id.as_deref() {
+        if store.message_exists(requested)? {
+            return Ok(PersistResolution::Duplicate(requested.to_string()));
+        }
+    }
+    let status = intent.initial_disposition.row_status();
+    let message_id = store.persist_message(PersistMessageInput {
+        message_id: intent.requested_message_id.as_deref(),
+        owner_team_id: intent.owner_team_id.as_ref().map(TeamKey::as_str),
+        task_id: intent.task_id.as_ref().map(TaskId::as_str),
+        sender: intent.sender.as_str(),
+        recipient: intent.recipient.as_str(),
+        reply_to: intent.reply_to.as_deref(),
+        requires_ack: intent.requires_ack,
+        status,
+        content: &intent.content,
+        error: intent.initial_disposition.error(),
+    })?;
+    Ok(PersistResolution::Persisted(PersistedSend {
+        message_id,
+        owner_team_id: intent.owner_team_id.clone(),
+        recipient: intent.recipient.clone(),
+        row_status: status,
+        blocker: match intent.initial_disposition {
+            InitialDisposition::Blocked(blocker) => Some(blocker),
+            InitialDisposition::Accepted | InitialDisposition::QueuedUntilLeaderAttach => None,
+        },
+    }))
+}
+
+#[allow(clippy::too_many_arguments)]
+pub(crate) fn persist_internal_send(
+    workspace: &Path,
+    kind: InternalSendKind,
+    owner_team_id: Option<&str>,
+    task_id: Option<&str>,
+    sender: &str,
+    recipient: &str,
+    content: &str,
+    reply_to: Option<&str>,
+    requires_ack: bool,
+    requested_message_id: Option<&str>,
+    initial_disposition: InitialDisposition,
+) -> Result<PersistResolution, MessagingError> {
+    let mut intent = ResolvedSendIntent::accepted(
+        SendOrigin::Internal(kind),
+        workspace,
+        owner_team_id.map(TeamKey::new),
+        LogicalRecipient::from_resolved(recipient),
+        TrustedSender::from_runtime_identity(AgentId::new(sender)),
+        task_id.map(TaskId::new),
+        content,
+        reply_to.map(ToOwned::to_owned),
+        requires_ack,
+        requested_message_id.map(ToOwned::to_owned),
+    );
+    intent.initial_disposition = initial_disposition;
+    persist_resolved_send(&intent)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn workspace(tag: &str) -> PathBuf {
+        let path =
+            std::env::temp_dir().join(format!("ta-send-persist-{tag}-{}", std::process::id()));
+        std::fs::create_dir_all(&path).unwrap();
+        path
+    }
+
+    #[test]
+    fn coordinator_blocker_is_durable_and_not_delivered() {
+        let workspace = workspace("coordinator-blocker");
+        let mut intent = ResolvedSendIntent::accepted(
+            SendOrigin::Cli,
+            &workspace,
+            Some(TeamKey::new("carc")),
+            LogicalRecipient::from_resolved("w1"),
+            TrustedSender::leader(),
+            None,
+            "probe",
+            None,
+            true,
+            None,
+        );
+        intent.initial_disposition =
+            InitialDisposition::Blocked(DeliveryBlocker::CoordinatorUnavailable);
+        let PersistResolution::Persisted(persisted) = persist_resolved_send(&intent).unwrap()
+        else {
+            panic!("fresh intent must persist")
+        };
+        assert_eq!(
+            persisted.row_status,
+            MessageRowStatus::QueuedCoordinatorUnavailable
+        );
+        assert_eq!(
+            persisted.blocker,
+            Some(DeliveryBlocker::CoordinatorUnavailable)
+        );
+        let store = MessageStore::open(&workspace).unwrap();
+        let connection = crate::db::schema::open_db(store.db_path()).unwrap();
+        let (status, delivered_at, error): (String, Option<String>, Option<String>) = connection
+            .query_row(
+                "select status, delivered_at, error from messages where message_id = ?1",
+                [&persisted.message_id],
+                |row| Ok((row.get(0)?, row.get(1)?, row.get(2)?)),
+            )
+            .unwrap();
+        assert_eq!(status, "queued_coordinator_unavailable");
+        assert_eq!(delivered_at, None);
+        assert_eq!(error.as_deref(), Some("coordinator_unavailable"));
+    }
+
+    #[test]
+    fn production_row_creation_is_owned_by_persisted_primitive() {
+        for (name, source) in [
+            ("send", include_str!("send.rs")),
+            ("leader_receiver", include_str!("leader_receiver.rs")),
+            ("delivery", include_str!("delivery.rs")),
+            ("watchers", include_str!("watchers.rs")),
+            ("helpers", include_str!("helpers.rs")),
+            ("selftest", include_str!("selftest.rs")),
+        ] {
+            assert!(
+                !source.contains(".create_message(")
+                    && !source.contains(".create_message_with_id("),
+                "{name} still creates message rows outside persist_resolved_send"
+            );
+        }
+    }
+
+    #[test]
+    fn persisted_truth_and_workspace_identity_have_forward_consumers() {
+        for (name, source) in [
+            ("send", include_str!("send.rs")),
+            ("delivery", include_str!("delivery.rs")),
+            ("leader_receiver", include_str!("leader_receiver.rs")),
+        ] {
+            assert!(
+                source.contains("persisted.row_status"),
+                "{name} rebuilds wire truth instead of consuming PersistedSend"
+            );
+        }
+        let watchers = include_str!("watchers.rs");
+        assert!(
+            !watchers.contains(".and_then(std::path::Path::parent)"),
+            "watcher identity must not be derived from the team.db layout"
+        );
+        assert!(
+            watchers.contains("deliver_primary_watcher(\n                    workspace,"),
+            "watcher must forward the caller's canonical workspace"
+        );
+    }
+}