@team-agent/installer 0.5.51 → 0.5.52

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -3119,10 +3119,16 @@ fn restart_candidate_from_state(
         .filter(|s| !s.is_empty())
         .map(SessionName::new)
         .unwrap_or_else(|| SessionName::new(team_name));
+    let retired = retired_agent_ids(state);
     let mut agents = state
         .get("agents")
         .and_then(serde_json::Value::as_object)
-        .map(|map| map.keys().map(AgentId::new).collect::<Vec<_>>())
+        .map(|map| {
+            map.keys()
+                .filter(|agent_id| !retired.contains(agent_id.as_str()))
+                .map(AgentId::new)
+                .collect::<Vec<_>>()
+        })
         .unwrap_or_default();
     agents.sort_by(|a, b| a.as_str().cmp(b.as_str()));
     RestartCandidate {
@@ -3135,6 +3141,19 @@ fn restart_candidate_from_state(
     }
 }
 
+fn retired_agent_ids(state: &serde_json::Value) -> std::collections::BTreeSet<String> {
+    state
+        .get("agent_lifecycle")
+        .and_then(serde_json::Value::as_object)
+        .into_iter()
+        .flat_map(|lifecycle| lifecycle.iter())
+        .filter(|(_, entry)| {
+            entry.get("state").and_then(serde_json::Value::as_str) == Some("retired")
+        })
+        .map(|(agent_id, _)| agent_id.clone())
+        .collect()
+}
+
 /// E5 task#3 / RC-A6a:每次 restart 都以**角色定义**(team_dir 的 TEAM.md+agents/*.md)
 /// compile_team 重建 runtime spec(覆盖),保留运行期 override(session_name 必须延续,
 /// 否则 tmux session 对不上)。写到 .team/runtime/<team_key>/team.spec.yaml。
@@ -3204,6 +3223,7 @@ fn rebuild_runtime_spec_from_roles(
     // 静态 team_dir/agents/*.md + state 记录的 dynamic role source。缺文件 fail-closed
     // 三行式,不静默 prune 已 live 的 helper(persist SaveConflict 保护继续生效)。
     merge_state_dynamic_role_files(&mut spec, run_workspace, &team_dir, team_key, state)?;
+    filter_retired_agents_from_spec(&mut spec, &retired_agent_ids(state));
     // 写 runtime spec(覆盖,原子 tmp+rename;Bug2)。
     let spec_path = crate::model::paths::runtime_spec_path(run_workspace, team_key);
     crate::lifecycle::launch::write_spec_atomic(&spec_path, &spec)?;
@@ -3216,6 +3236,15 @@ fn rebuild_runtime_spec_from_roles(
     Ok(spec)
 }
 
+fn filter_retired_agents_from_spec(
+    spec: &mut YamlValue,
+    retired: &std::collections::BTreeSet<String>,
+) {
+    for agent_id in retired {
+        *spec = super::remove::spec_without_agent(spec, &AgentId::new(agent_id));
+    }
+}
+
 /// 0.5.30 (`add-agent-restart-saveconflict-locate.md` §4/§11): 把 add-agent
 /// 写入 `state.agents.<id>.dynamic_role_file` 的动态 role 文档合并回 restart
 /// 重建 spec。规则:
@@ -3418,6 +3447,76 @@ mod tests {
         TransportError,
     };
 
+    #[test]
+    fn retired_filter_clears_every_spec_reference_via_remove_primitive() {
+        let mut spec = crate::model::yaml::loads(
+            r#"
+name: retirement-filter
+agents:
+  - id: gone
+  - id: keep
+runtime:
+  startup_order:
+    - gone
+    - keep
+routing:
+  default_assignee: gone
+  rules:
+    - match: gone-task
+      assign_to: gone
+    - match: keep-task
+      assign_to: keep
+tasks:
+  - title: gone-task
+    assignee: gone
+  - title: keep-task
+    assignee: keep
+"#,
+        )
+        .expect("fixture spec");
+        let retired = std::collections::BTreeSet::from(["gone".to_string()]);
+
+        filter_retired_agents_from_spec(&mut spec, &retired);
+
+        let agents = spec
+            .get("agents")
+            .and_then(YamlValue::as_list)
+            .expect("agents");
+        assert!(agents.iter().all(|agent| {
+            agent.get("id").and_then(YamlValue::as_str) != Some("gone")
+        }));
+        let startup_order = spec
+            .get("runtime")
+            .and_then(|runtime| runtime.get("startup_order"))
+            .and_then(YamlValue::as_list)
+            .expect("startup_order");
+        assert!(startup_order
+            .iter()
+            .all(|agent_id| agent_id.as_str() != Some("gone")));
+        let routing = spec.get("routing").expect("routing");
+        assert_ne!(
+            routing
+                .get("default_assignee")
+                .and_then(YamlValue::as_str),
+            Some("gone"),
+            "spec_default_assignee must not return a retired agent"
+        );
+        let rules = routing
+            .get("rules")
+            .and_then(YamlValue::as_list)
+            .expect("routing rules");
+        assert!(rules.iter().all(|rule| {
+            rule.get("assign_to").and_then(YamlValue::as_str) != Some("gone")
+        }));
+        let tasks = spec
+            .get("tasks")
+            .and_then(YamlValue::as_list)
+            .expect("tasks");
+        assert!(tasks.iter().all(|task| {
+            task.get("assignee").and_then(YamlValue::as_str) != Some("gone")
+        }));
+    }
+
     #[test]
     fn resume_decision_event_uses_central_scrub_and_preserves_required_failure() {
         let marker = "synthetic-resume-decision-marker";

package/crates/team-agent/src/lifecycle/restart/remove.rs

@@ -15,13 +15,15 @@ pub fn remove_agent(
     team: Option<&str>,
 ) -> Result<RemoveAgentOutcome, LifecycleError> {
     let paths = lifecycle_paths(workspace, team)?;
+    let canonical_team = paths.canonical_team(team).map(str::to_string);
+    let team = canonical_team.as_deref();
     let _lock = acquire_agent_lifecycle_lock(LifecycleLockRequest {
         workspace: &paths.run_workspace,
         operation: "remove-agent",
         team,
         agent_id: Some(agent_id),
     })?;
-    let transport = lifecycle_worker_tmux_backend_for_selected_state(&paths.run_workspace, team)?;
+    let transport = paths.tmux_backend()?;
     remove_agent_at_paths(
         &paths.run_workspace,
         &paths.spec_workspace,
@@ -42,6 +44,8 @@ pub fn remove_agent_with_transport(
     transport: &dyn crate::transport::Transport,
 ) -> Result<RemoveAgentOutcome, LifecycleError> {
     let paths = lifecycle_paths(workspace, team)?;
+    let canonical_team = paths.canonical_team(team).map(str::to_string);
+    let team = canonical_team.as_deref();
     let _lock = acquire_agent_lifecycle_lock(LifecycleLockRequest {
         workspace: &paths.run_workspace,
         operation: "remove-agent",
@@ -68,6 +72,8 @@ pub(crate) fn remove_agent_with_transport_locked(
     transport: &dyn crate::transport::Transport,
 ) -> Result<RemoveAgentOutcome, LifecycleError> {
     let paths = lifecycle_paths(workspace, team)?;
+    let canonical_team = paths.canonical_team(team).map(str::to_string);
+    let team = canonical_team.as_deref();
     remove_agent_at_paths(
         &paths.run_workspace,
         &paths.spec_workspace,
@@ -94,6 +100,8 @@ impl ForceRecreateSnapshot {
         transport: &dyn crate::transport::Transport,
     ) -> Result<Self, LifecycleError> {
         let paths = lifecycle_paths(workspace, team)?;
+        let canonical_team = paths.canonical_team(team).map(str::to_string);
+        let team = canonical_team.as_deref();
         let seat = resolve_seat(
             &paths.run_workspace,
             &paths.spec_workspace,
@@ -215,7 +223,9 @@ pub fn remove_agent_flag_requirements(
     team: Option<&str>,
 ) -> Result<RemoveAgentFlagRequirements, LifecycleError> {
     let paths = lifecycle_paths(workspace, team)?;
-    let transport = lifecycle_worker_tmux_backend_for_selected_state(&paths.run_workspace, team)?;
+    let canonical_team = paths.canonical_team(team).map(str::to_string);
+    let team = canonical_team.as_deref();
+    let transport = paths.tmux_backend()?;
     Ok(remove_agent_preflight(
         &paths.run_workspace,
         &paths.spec_workspace,
@@ -564,14 +574,16 @@ fn remove_agent_inner(
     // (team projection) — NOT a raw save, so other teams in a multi-team workspace are preserved.
     let mut removed_state = working_state;
     remove_agent_from_state(&mut removed_state, agent_id)?;
-    crate::state::repository::StateRepository::new(paths.run_workspace).save(
-        crate::state::repository::StateWriteIntent::RemoveAgent {
-            team_key,
-            agent_id: agent_id.as_str(),
-        },
-        &removed_state,
-    )
-    .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
+    mark_agent_retired_in_state(&mut removed_state, agent_id)?;
+    crate::state::repository::StateRepository::new(paths.run_workspace)
+        .save(
+            crate::state::repository::StateWriteIntent::RemoveAgent {
+                team_key,
+                agent_id: agent_id.as_str(),
+            },
+            &removed_state,
+        )
+        .map_err(|e| LifecycleError::StatePersist(e.to_string()))?;
     cleared_locations.push(serde_json::json!("state.json:agents"));
     write_remove_step_event(
         paths.run_workspace,
@@ -783,6 +795,57 @@ fn remove_agent_from_state(
     }
 }
 
+pub(crate) fn mark_agent_retired_in_state(
+    state: &mut serde_json::Value,
+    agent_id: &AgentId,
+) -> Result<(), LifecycleError> {
+    let root = state.as_object_mut().ok_or_else(|| {
+        LifecycleError::StatePersist("runtime state root is not an object".to_string())
+    })?;
+    let lifecycle = root
+        .entry("agent_lifecycle".to_string())
+        .or_insert_with(|| serde_json::json!({}));
+    let lifecycle = lifecycle.as_object_mut().ok_or_else(|| {
+        LifecycleError::StatePersist("runtime state agent_lifecycle is not an object".to_string())
+    })?;
+    let entry = lifecycle
+        .entry(agent_id.as_str().to_string())
+        .or_insert_with(|| serde_json::json!({}));
+    if entry.get("state").and_then(serde_json::Value::as_str) == Some("retired") {
+        return Ok(());
+    }
+    let entry = entry.as_object_mut().ok_or_else(|| {
+        LifecycleError::StatePersist(format!(
+            "runtime state agent_lifecycle.{} is not an object",
+            agent_id.as_str()
+        ))
+    })?;
+    entry.insert("state".to_string(), serde_json::json!("retired"));
+    entry.insert(
+        "changed_at".to_string(),
+        serde_json::json!(chrono::Utc::now().to_rfc3339()),
+    );
+    entry.insert("reason".to_string(), serde_json::json!("remove-agent"));
+    Ok(())
+}
+
+pub(crate) fn clear_agent_retirement_in_state(state: &mut serde_json::Value, agent_id: &AgentId) {
+    let Some(lifecycle) = state
+        .get_mut("agent_lifecycle")
+        .and_then(serde_json::Value::as_object_mut)
+    else {
+        return;
+    };
+    let is_retired = lifecycle
+        .get(agent_id.as_str())
+        .and_then(|entry| entry.get("state"))
+        .and_then(serde_json::Value::as_str)
+        == Some("retired");
+    if is_retired {
+        lifecycle.remove(agent_id.as_str());
+    }
+}
+
 /// Build the persisted spec after removing one worker. Besides deleting the worker and startup entry,
 /// prune routing references that would otherwise point at the removed worker.
 pub(crate) fn spec_without_agent(spec: &YamlValue, agent_id: &AgentId) -> YamlValue {

package/crates/team-agent/src/lifecycle/restart.rs

@@ -16,6 +16,29 @@ use super::*;
 struct LifecyclePaths {
     run_workspace: std::path::PathBuf,
     spec_workspace: std::path::PathBuf,
+    selected: Option<crate::state::selector::SelectedTeam>,
+}
+
+impl LifecyclePaths {
+    fn canonical_team<'a>(&'a self, requested: Option<&'a str>) -> Option<&'a str> {
+        self.selected
+            .as_ref()
+            .map(|selected| selected.team_key.as_str())
+            .or(requested)
+    }
+
+    fn tmux_backend(&self) -> Result<crate::tmux_backend::TmuxBackend, LifecycleError> {
+        match self.selected.as_ref() {
+            Some(selected) => common::lifecycle_worker_tmux_backend_selection_for_state(
+                &selected.run_workspace,
+                &selected.state,
+            )
+            .map(|selection| selection.backend),
+            None => Ok(crate::tmux_backend::TmuxBackend::for_workspace(
+                &self.run_workspace,
+            )),
+        }
+    }
 }
 
 struct LifecyclePathRefs<'a> {
@@ -115,8 +138,9 @@ fn lifecycle_paths(workspace: &Path, team: Option<&str>) -> Result<LifecyclePath
             LifecycleError::TeamSelect("active team spec workspace not found".to_string())
         })?;
     Ok(LifecyclePaths {
-        run_workspace: selected.run_workspace,
+        run_workspace: selected.run_workspace.clone(),
         spec_workspace,
+        selected: Some(selected),
     })
 }
 

package/crates/team-agent/src/lifecycle/tests/lane_ops.rs

@@ -434,6 +434,319 @@ fn force_remove_reconciles_all_seat_quadrants_without_cross_team_same_name_kill(
     }
 }
 
+#[test]
+fn remove_persists_retired_tombstone_and_explicit_readd_clears_it() {
+    let ws = lanea_ws_agents(json!({
+        "alpha": { "status": "stopped", "provider": "codex", "window": "alpha" },
+        "bravo": { "status": "running", "provider": "codex", "window": "bravo" }
+    }));
+    let mut seeded = crate::state::persist::load_runtime_state(&ws).unwrap();
+    seeded["team_key"] = json!("laneateam");
+    seeded["active_team_key"] = json!("laneateam");
+    let mut nested = crate::state::projection::compact_team_state(&seeded);
+    nested["status"] = json!("alive");
+    seeded["teams"] = json!({
+        "laneateam": nested,
+        "sibling": {
+            "team_key": "sibling",
+            "status": "shutdown",
+            "agents": {},
+            "agent_lifecycle": {
+                "alpha": {
+                    "state": "retired",
+                    "changed_at": "2026-07-20T00:00:00Z",
+                    "reason": "sibling retirement"
+                }
+            }
+        }
+    });
+    crate::state::persist::save_runtime_state(&ws, &seeded).unwrap();
+    let stale_tick = crate::state::projection::select_runtime_state(&ws, Some("laneateam"))
+        .expect("capture the coordinator projection from before remove");
+    let tx = LaneTransport::new("team-laneateam", &[]);
+    let role = ws.join("agents").join("alpha.md");
+
+    remove_agent_with_transport(&ws, &aid("alpha"), true, true, None, &tx).unwrap();
+    let removed: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
+    )
+    .unwrap();
+    assert_eq!(
+        removed["teams"]["laneateam"]["agent_lifecycle"]["alpha"]["state"], "retired",
+        "the first successful remove must directly persist the canonical tombstone"
+    );
+    assert!(
+        removed["teams"]["laneateam"]["agents"]
+            .get("alpha")
+            .is_none(),
+        "the first successful remove must directly delete the canonical agent row"
+    );
+    crate::state::repository::StateRepository::new(&ws)
+        .save(
+            crate::state::repository::StateWriteIntent::CoordinatorTick {
+                team_key: "laneateam",
+            },
+            &stale_tick,
+        )
+        .unwrap();
+    let after_stale_tick: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
+    )
+    .unwrap();
+    assert_eq!(
+        after_stale_tick["teams"]["laneateam"]["agent_lifecycle"]["alpha"]["state"], "retired",
+        "a stale coordinator save must not erase the first remove's tombstone"
+    );
+    assert!(
+        after_stale_tick["teams"]["laneateam"]["agents"]
+            .get("alpha")
+            .is_none(),
+        "a stale coordinator save must not resurrect the first removed agent"
+    );
+
+    crate::lifecycle::add_agent_with_transport(&ws, &aid("alpha"), &role, false, None, &tx)
+        .unwrap();
+    let readded = crate::state::persist::load_runtime_state(&ws).unwrap();
+    assert!(
+        readded["teams"]["laneateam"]["agent_lifecycle"]
+            .get("alpha")
+            .is_none(),
+        "explicit re-add must consume the retired tombstone"
+    );
+    assert!(readded["teams"]["laneateam"]["agents"]
+        .get("alpha")
+        .is_some());
+    assert_eq!(
+        readded["teams"]["sibling"]["agent_lifecycle"]["alpha"]["state"], "retired",
+        "selected-team re-add must not clear a sibling team's same-id retirement"
+    );
+}
+
+/// Cross-product RED (verifier, slice2b authority leak): the FAILURE dimension
+/// (a stale writer whose incoming projection predates a sibling retirement) x the
+/// BOUNDARY dimension (a sibling team carrying the SAME agent id). The tracked
+/// `remove_persists_..._readd_clears_it` sibling assertion covers only the
+/// non-stale corner (sibling tombstone already current in the add's input); it
+/// does NOT exercise an incoming sibling projection captured BEFORE the sibling
+/// retirement. topology-authority is keyed by bare `agent_id` with no team
+/// dimension (repository.rs:277-283 drops team_key; persist.rs iterates every
+/// sibling team with the same global id set), so an explicit AddAgent(alpha) in
+/// team A exempts alpha in team B too and a stale incoming resurrects B's alpha /
+/// erases B's retirement tombstone. Red at da11f98c: teamB.alpha lifecycle Null.
+#[test]
+fn add_agent_authority_must_not_cross_team_erase_sibling_same_id_retirement() {
+    // Disk latest: team A alive with alpha; team B alpha ABSENT + retired.
+    let ws = lanea_ws_agents(json!({
+        "alpha": { "status": "running", "provider": "codex", "window": "alpha" },
+        "bravo": { "status": "running", "provider": "codex", "window": "bravo" }
+    }));
+    let mut latest = crate::state::persist::load_runtime_state(&ws).unwrap();
+    latest["team_key"] = json!("laneateam");
+    latest["active_team_key"] = json!("laneateam");
+    let mut nested_a = crate::state::projection::compact_team_state(&latest);
+    nested_a["status"] = json!("alive");
+    latest["teams"] = json!({
+        "laneateam": nested_a,
+        "sibling": {
+            "team_key": "sibling",
+            "status": "alive",
+            "agents": {},
+            "agent_lifecycle": {
+                "alpha": {
+                    "state": "retired",
+                    "changed_at": "2026-07-21T00:00:00Z",
+                    "reason": "sibling retirement (newer than the stale incoming)"
+                }
+            }
+        }
+    });
+    crate::state::persist::save_runtime_state(&ws, &latest).unwrap();
+
+    // Incoming STALE root: captured BEFORE team B retired alpha, so its sibling
+    // entry still carries alpha ACTIVE with no tombstone. A concurrent explicit
+    // AddAgent(alpha) in team A carries this whole stale multi-team projection.
+    let mut incoming_stale = latest.clone();
+    incoming_stale["teams"]["sibling"] = json!({
+        "team_key": "sibling",
+        "status": "alive",
+        "agents": { "alpha": { "status": "running", "provider": "codex", "window": "alpha" } },
+        "agent_lifecycle": {}
+    });
+
+    crate::state::repository::StateRepository::new(&ws)
+        .save(
+            crate::state::repository::StateWriteIntent::AddAgent {
+                team_key: "laneateam",
+                agent_id: "alpha",
+            },
+            &incoming_stale,
+        )
+        .unwrap();
+
+    let after: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
+    )
+    .unwrap();
+    // The AddAgent authority is scoped to team A's alpha ONLY; team B's newer
+    // same-id retirement must survive (the stale incoming must not resurrect it).
+    assert_eq!(
+        after["teams"]["sibling"]["agent_lifecycle"]["alpha"]["state"],
+        json!("retired"),
+        "selected-team AddAgent authority must not cross team boundary by bare agent id: \
+         team B's newer same-id retirement was erased by team A's stale re-add"
+    );
+    assert!(
+        after["teams"]["sibling"]["agents"].get("alpha").is_none(),
+        "a stale incoming must not resurrect the sibling team's retired same-id agent"
+    );
+}
+
+/// Identity-source boundary (verifier, slice2b authority fix new adjudication
+/// face, same family as slice1 empty-current): the legacy top-level scope anchor
+/// now prefers `active_team_key`. Verify it does not over-exempt / under-protect
+/// when `active_team_key` is a NON-EMPTY but TERMINAL / mismatched value (points
+/// at a team not present in `teams`). The AddAgent authority is (laneateam,
+/// alpha); with a ghost active_team_key, the top-level filter must resolve NO
+/// exemption for the ghost, so a real retirement anywhere is still protected —
+/// the anchor must not silently widen authority to a bare id under a dangling
+/// active_team_key (that would be the empty-current forgery shape at slice1).
+#[test]
+fn terminal_active_team_key_does_not_widen_topology_authority_to_bare_id() {
+    // Disk latest: laneateam alive with alpha; sibling alpha ABSENT + retired.
+    let ws = lanea_ws_agents(json!({
+        "alpha": { "status": "running", "provider": "codex", "window": "alpha" },
+        "bravo": { "status": "running", "provider": "codex", "window": "bravo" }
+    }));
+    let mut latest = crate::state::persist::load_runtime_state(&ws).unwrap();
+    latest["team_key"] = json!("laneateam");
+    latest["active_team_key"] = json!("laneateam");
+    let mut nested_a = crate::state::projection::compact_team_state(&latest);
+    nested_a["status"] = json!("alive");
+    latest["teams"] = json!({
+        "laneateam": nested_a,
+        "sibling": {
+            "team_key": "sibling",
+            "status": "alive",
+            "agents": {},
+            "agent_lifecycle": {
+                "alpha": { "state": "retired", "changed_at": "2026-07-21T00:00:00Z", "reason": "sibling" }
+            }
+        }
+    });
+    crate::state::persist::save_runtime_state(&ws, &latest).unwrap();
+
+    // Incoming STALE root whose active_team_key points at a GHOST team not in
+    // `teams`, and whose sibling entry is the pre-retire (alpha active) shape.
+    let mut incoming_stale = latest.clone();
+    incoming_stale["active_team_key"] = json!("ghostteam-does-not-exist");
+    incoming_stale["teams"]["sibling"] = json!({
+        "team_key": "sibling",
+        "status": "alive",
+        "agents": { "alpha": { "status": "running", "provider": "codex", "window": "alpha" } },
+        "agent_lifecycle": {}
+    });
+
+    crate::state::repository::StateRepository::new(&ws)
+        .save(
+            crate::state::repository::StateWriteIntent::AddAgent {
+                team_key: "laneateam",
+                agent_id: "alpha",
+            },
+            &incoming_stale,
+        )
+        .unwrap();
+
+    let after: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
+    )
+    .unwrap();
+    // A dangling active_team_key must not widen the (laneateam, alpha) authority
+    // into a bare `alpha` exemption that reaches the sibling: sibling stays
+    // retired, not resurrected.
+    assert_eq!(
+        after["teams"]["sibling"]["agent_lifecycle"]["alpha"]["state"],
+        json!("retired"),
+        "a terminal/ghost active_team_key must not widen topology authority to a bare id \
+         and erase the sibling's same-id retirement"
+    );
+    assert!(
+        after["teams"]["sibling"]["agents"].get("alpha").is_none(),
+        "a terminal active_team_key must not let a stale incoming resurrect the sibling agent"
+    );
+}
+
+/// Cross-product cell (verifier, slice2b current-alias fix): the `current`
+/// physical alias dimension x the sibling same-id retirement dimension. The
+/// reset fix routes `team == "current"` authority through `top_level_team`
+/// (active_team_key). This pins that the alias branch does NOT leak that
+/// active-team authority into a REAL sibling that merely shares the agent id:
+/// a `current` alias entry (= the active team's physical projection) plus a
+/// distinct sibling team both carrying `alpha`, sibling retired, stale incoming
+/// resurrecting sibling alpha. The current-alias authority must clear only the
+/// active team's own alpha, never the sibling's newer retirement.
+#[test]
+fn current_alias_authority_does_not_leak_into_real_sibling_same_id_retirement() {
+    let ws = lanea_ws_agents(json!({
+        "alpha": { "status": "running", "provider": "codex", "window": "alpha" },
+        "bravo": { "status": "running", "provider": "codex", "window": "bravo" }
+    }));
+    let mut latest = crate::state::persist::load_runtime_state(&ws).unwrap();
+    latest["team_key"] = json!("laneateam");
+    latest["active_team_key"] = json!("laneateam");
+    let mut nested_a = crate::state::projection::compact_team_state(&latest);
+    nested_a["status"] = json!("alive");
+    // `current` is the physical alias of the active team (laneateam); a REAL
+    // sibling team also carries alpha, retired and newer than the stale incoming.
+    latest["teams"] = json!({
+        "laneateam": nested_a.clone(),
+        "current": nested_a,
+        "sibling": {
+            "team_key": "sibling",
+            "status": "alive",
+            "agents": {},
+            "agent_lifecycle": {
+                "alpha": { "state": "retired", "changed_at": "2026-07-21T00:00:00Z", "reason": "sibling" }
+            }
+        }
+    });
+    crate::state::persist::save_runtime_state(&ws, &latest).unwrap();
+
+    let mut incoming_stale = latest.clone();
+    incoming_stale["teams"]["sibling"] = json!({
+        "team_key": "sibling",
+        "status": "alive",
+        "agents": { "alpha": { "status": "running", "provider": "codex", "window": "alpha" } },
+        "agent_lifecycle": {}
+    });
+
+    crate::state::repository::StateRepository::new(&ws)
+        .save(
+            crate::state::repository::StateWriteIntent::AddAgent {
+                team_key: "laneateam",
+                agent_id: "alpha",
+            },
+            &incoming_stale,
+        )
+        .unwrap();
+
+    let after: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
+    )
+    .unwrap();
+    // The current-alias authority is the ACTIVE team's; it must not reach the
+    // real sibling that only shares the id.
+    assert_eq!(
+        after["teams"]["sibling"]["agent_lifecycle"]["alpha"]["state"],
+        json!("retired"),
+        "current-alias authority must not leak into a real sibling's same-id retirement"
+    );
+    assert!(
+        after["teams"]["sibling"]["agents"].get("alpha").is_none(),
+        "a stale incoming must not resurrect the real sibling's retired same-id agent \
+         via the current-alias authority path"
+    );
+}
+
 const CHARLIE_ROLE: &str = "---\nname: charlie\nrole: Charlie Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nCharlie.\n";
 
 struct HermeticTestEnv {
@@ -558,6 +871,10 @@ fn force_recreate_is_one_lock_transaction_for_all_seat_quadrants_and_rolls_back_
             state["agents"].get("charlie").is_some(),
             "{quadrant}: state restored"
         );
+        assert!(
+            state["agent_lifecycle"].get("charlie").is_none(),
+            "{quadrant}: successful force-recreate consumes its interim tombstone"
+        );
         let spec_text = std::fs::read_to_string(selected_spec_path(&ws)).unwrap();
         assert_eq!(
             spec_text.matches("id: \"charlie\"").count(),
@@ -604,6 +921,10 @@ fn force_recreate_is_one_lock_transaction_for_all_seat_quadrants_and_rolls_back_
         state["agents"].get("charlie").is_some(),
         "rollback restores state"
     );
+    assert!(
+        state["agent_lifecycle"].get("charlie").is_none(),
+        "preflight failure must not create a retirement tombstone"
+    );
     assert!(
         std::fs::read_to_string(selected_spec_path(&ws))
             .unwrap()
@@ -702,6 +1023,11 @@ fn force_recreate_post_consumption_failure_restores_before_tuple_and_health() {
         sibling_health,
         "rollback never changes the sibling team's same-agent health row"
     );
+    let state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    assert!(
+        state["agent_lifecycle"].get("charlie").is_none(),
+        "post-consumption rollback restores the before-state without a new tombstone"
+    );
 }
 
 #[test]
@@ -1140,6 +1466,11 @@ fn lanea_remove_rollback_restarts_force_stopped_worker() {
          RemoveRollback::restore. spawns={:?}",
         tx.spawns()
     );
+    let restored = crate::state::persist::load_runtime_state(&ws).unwrap();
+    assert!(
+        restored["agent_lifecycle"].get("alpha").is_none(),
+        "failed remove must roll back the transaction-created tombstone"
+    );
 }
 
 // ── REMOVE #11 (remove-dynamic-role-path-and-required-8, warn) [RED] — missing REQUIRED role file raises