@team-agent/installer 0.5.51 → 0.5.53

package/crates/team-agent/src/lifecycle/tests/lane_ops.rs

@@ -8,6 +8,60 @@ const DELEG_ROLE_ALPHA_COMPAT: &str = "---\nname: alpha\nrole: Alpha Worker\npro
 type LaneKills = std::sync::Arc<std::sync::Mutex<Vec<String>>>;
 pub(super) type LaneSpawns = std::sync::Arc<std::sync::Mutex<Vec<(String, Vec<String>)>>>;
 
+fn emit_codex_fork_backing(argv: &[String], cwd: &std::path::Path) {
+    if !argv.windows(2).any(|pair| pair == ["codex", "fork"]) {
+        return;
+    }
+    static SESSION_SEQ: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+    let sequence = SESSION_SEQ.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+    let session_id = format!("lane-fork-{}-{sequence}", std::process::id());
+    let root = std::env::var_os("HOME")
+        .map(std::path::PathBuf::from)
+        .unwrap_or_else(|| std::path::PathBuf::from("."))
+        .join(".codex/sessions/lane-fixture");
+    std::fs::create_dir_all(&root).unwrap();
+    std::fs::write(
+        root.join(format!("rollout-{session_id}.jsonl")),
+        format!(
+            "{{\"session_meta\":{{\"payload\":{{\"id\":\"{session_id}\",\"cwd\":\"{}\"}}}},\"created_at\":\"{}\"}}\n",
+            cwd.to_string_lossy(),
+            chrono::Utc::now().to_rfc3339()
+        ),
+    )
+    .unwrap();
+}
+
+pub(super) struct LaneHomeGuard {
+    previous: Option<std::ffi::OsString>,
+    root: PathBuf,
+}
+
+impl LaneHomeGuard {
+    pub(super) fn enter(tag: &str) -> Self {
+        static HOME_SEQ: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
+        let root = std::env::temp_dir().join(format!(
+            "ta-lane-home-{tag}-{}-{}",
+            std::process::id(),
+            HOME_SEQ.fetch_add(1, std::sync::atomic::Ordering::Relaxed)
+        ));
+        let _ = std::fs::remove_dir_all(&root);
+        std::fs::create_dir_all(&root).unwrap();
+        let previous = std::env::var_os("HOME");
+        std::env::set_var("HOME", &root);
+        Self { previous, root }
+    }
+}
+
+impl Drop for LaneHomeGuard {
+    fn drop(&mut self) {
+        match &self.previous {
+            Some(value) => std::env::set_var("HOME", value),
+            None => std::env::remove_var("HOME"),
+        }
+        let _ = std::fs::remove_dir_all(&self.root);
+    }
+}
+
 /// Recording transport for Lane-A v2: `list_windows`/`list_targets` answer from a configurable window
 /// set (golden's `_tmux_window_exists` primitive = `tmux list-windows`); `kill_window` + spawn_first/into
 /// are RECORDED. Every other method returns a benign Ok (never panics) so stop/reset/remove/fork run
@@ -18,6 +72,7 @@ pub(super) struct LaneTransport {
     foreign: std::sync::Arc<std::sync::Mutex<Vec<(String, String)>>>,
     killed: LaneKills,
     spawns: LaneSpawns,
+    spawn_observed_at: std::sync::Arc<std::sync::Mutex<Vec<String>>>,
 }
 impl LaneTransport {
     pub(super) fn new(session: &str, windows: &[&str]) -> Self {
@@ -29,6 +84,7 @@ impl LaneTransport {
             foreign: std::sync::Arc::new(std::sync::Mutex::new(Vec::new())),
             killed: std::sync::Arc::new(std::sync::Mutex::new(Vec::new())),
             spawns: std::sync::Arc::new(std::sync::Mutex::new(Vec::new())),
+            spawn_observed_at: std::sync::Arc::new(std::sync::Mutex::new(Vec::new())),
         }
     }
     pub(super) fn killed(&self) -> Vec<String> {
@@ -37,6 +93,9 @@ impl LaneTransport {
     pub(super) fn spawns(&self) -> Vec<(String, Vec<String>)> {
         self.spawns.lock().unwrap().clone()
     }
+    fn spawn_observed_at(&self) -> Vec<String> {
+        self.spawn_observed_at.lock().unwrap().clone()
+    }
     fn add_foreign(&self, session: &str, window: &str) {
         self.foreign
             .lock()
@@ -53,9 +112,14 @@ impl crate::transport::Transport for LaneTransport {
         session: &crate::transport::SessionName,
         window: &crate::transport::WindowName,
         argv: &[String],
-        _c: &std::path::Path,
+        c: &std::path::Path,
         _e: &std::collections::BTreeMap<String, String>,
     ) -> Result<crate::transport::SpawnResult, crate::transport::TransportError> {
+        self.spawn_observed_at
+            .lock()
+            .unwrap()
+            .push(chrono::Utc::now().to_rfc3339());
+        emit_codex_fork_backing(argv, c);
         self.spawns
             .lock()
             .unwrap()
@@ -84,9 +148,14 @@ impl crate::transport::Transport for LaneTransport {
         session: &crate::transport::SessionName,
         window: &crate::transport::WindowName,
         argv: &[String],
-        _c: &std::path::Path,
+        c: &std::path::Path,
         _e: &std::collections::BTreeMap<String, String>,
     ) -> Result<crate::transport::SpawnResult, crate::transport::TransportError> {
+        self.spawn_observed_at
+            .lock()
+            .unwrap()
+            .push(chrono::Utc::now().to_rfc3339());
+        emit_codex_fork_backing(argv, c);
         self.spawns
             .lock()
             .unwrap()
@@ -147,7 +216,7 @@ impl crate::transport::Transport for LaneTransport {
         &self,
         _p: &crate::transport::PaneId,
     ) -> Result<crate::model::enums::PaneLiveness, crate::transport::TransportError> {
-        Ok(crate::model::enums::PaneLiveness::Unknown)
+        Ok(crate::model::enums::PaneLiveness::Live)
     }
     fn list_targets(
         &self,
@@ -434,6 +503,319 @@ fn force_remove_reconciles_all_seat_quadrants_without_cross_team_same_name_kill(
     }
 }
 
+#[test]
+fn remove_persists_retired_tombstone_and_explicit_readd_clears_it() {
+    let ws = lanea_ws_agents(json!({
+        "alpha": { "status": "stopped", "provider": "codex", "window": "alpha" },
+        "bravo": { "status": "running", "provider": "codex", "window": "bravo" }
+    }));
+    let mut seeded = crate::state::persist::load_runtime_state(&ws).unwrap();
+    seeded["team_key"] = json!("laneateam");
+    seeded["active_team_key"] = json!("laneateam");
+    let mut nested = crate::state::projection::compact_team_state(&seeded);
+    nested["status"] = json!("alive");
+    seeded["teams"] = json!({
+        "laneateam": nested,
+        "sibling": {
+            "team_key": "sibling",
+            "status": "shutdown",
+            "agents": {},
+            "agent_lifecycle": {
+                "alpha": {
+                    "state": "retired",
+                    "changed_at": "2026-07-20T00:00:00Z",
+                    "reason": "sibling retirement"
+                }
+            }
+        }
+    });
+    crate::state::persist::save_runtime_state(&ws, &seeded).unwrap();
+    let stale_tick = crate::state::projection::select_runtime_state(&ws, Some("laneateam"))
+        .expect("capture the coordinator projection from before remove");
+    let tx = LaneTransport::new("team-laneateam", &[]);
+    let role = ws.join("agents").join("alpha.md");
+
+    remove_agent_with_transport(&ws, &aid("alpha"), true, true, None, &tx).unwrap();
+    let removed: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
+    )
+    .unwrap();
+    assert_eq!(
+        removed["teams"]["laneateam"]["agent_lifecycle"]["alpha"]["state"], "retired",
+        "the first successful remove must directly persist the canonical tombstone"
+    );
+    assert!(
+        removed["teams"]["laneateam"]["agents"]
+            .get("alpha")
+            .is_none(),
+        "the first successful remove must directly delete the canonical agent row"
+    );
+    crate::state::repository::StateRepository::new(&ws)
+        .save(
+            crate::state::repository::StateWriteIntent::CoordinatorTick {
+                team_key: "laneateam",
+            },
+            &stale_tick,
+        )
+        .unwrap();
+    let after_stale_tick: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
+    )
+    .unwrap();
+    assert_eq!(
+        after_stale_tick["teams"]["laneateam"]["agent_lifecycle"]["alpha"]["state"], "retired",
+        "a stale coordinator save must not erase the first remove's tombstone"
+    );
+    assert!(
+        after_stale_tick["teams"]["laneateam"]["agents"]
+            .get("alpha")
+            .is_none(),
+        "a stale coordinator save must not resurrect the first removed agent"
+    );
+
+    crate::lifecycle::add_agent_with_transport(&ws, &aid("alpha"), &role, false, None, &tx)
+        .unwrap();
+    let readded = crate::state::persist::load_runtime_state(&ws).unwrap();
+    assert!(
+        readded["teams"]["laneateam"]["agent_lifecycle"]
+            .get("alpha")
+            .is_none(),
+        "explicit re-add must consume the retired tombstone"
+    );
+    assert!(readded["teams"]["laneateam"]["agents"]
+        .get("alpha")
+        .is_some());
+    assert_eq!(
+        readded["teams"]["sibling"]["agent_lifecycle"]["alpha"]["state"], "retired",
+        "selected-team re-add must not clear a sibling team's same-id retirement"
+    );
+}
+
+/// Cross-product RED (verifier, slice2b authority leak): the FAILURE dimension
+/// (a stale writer whose incoming projection predates a sibling retirement) x the
+/// BOUNDARY dimension (a sibling team carrying the SAME agent id). The tracked
+/// `remove_persists_..._readd_clears_it` sibling assertion covers only the
+/// non-stale corner (sibling tombstone already current in the add's input); it
+/// does NOT exercise an incoming sibling projection captured BEFORE the sibling
+/// retirement. topology-authority is keyed by bare `agent_id` with no team
+/// dimension (repository.rs:277-283 drops team_key; persist.rs iterates every
+/// sibling team with the same global id set), so an explicit AddAgent(alpha) in
+/// team A exempts alpha in team B too and a stale incoming resurrects B's alpha /
+/// erases B's retirement tombstone. Red at da11f98c: teamB.alpha lifecycle Null.
+#[test]
+fn add_agent_authority_must_not_cross_team_erase_sibling_same_id_retirement() {
+    // Disk latest: team A alive with alpha; team B alpha ABSENT + retired.
+    let ws = lanea_ws_agents(json!({
+        "alpha": { "status": "running", "provider": "codex", "window": "alpha" },
+        "bravo": { "status": "running", "provider": "codex", "window": "bravo" }
+    }));
+    let mut latest = crate::state::persist::load_runtime_state(&ws).unwrap();
+    latest["team_key"] = json!("laneateam");
+    latest["active_team_key"] = json!("laneateam");
+    let mut nested_a = crate::state::projection::compact_team_state(&latest);
+    nested_a["status"] = json!("alive");
+    latest["teams"] = json!({
+        "laneateam": nested_a,
+        "sibling": {
+            "team_key": "sibling",
+            "status": "alive",
+            "agents": {},
+            "agent_lifecycle": {
+                "alpha": {
+                    "state": "retired",
+                    "changed_at": "2026-07-21T00:00:00Z",
+                    "reason": "sibling retirement (newer than the stale incoming)"
+                }
+            }
+        }
+    });
+    crate::state::persist::save_runtime_state(&ws, &latest).unwrap();
+
+    // Incoming STALE root: captured BEFORE team B retired alpha, so its sibling
+    // entry still carries alpha ACTIVE with no tombstone. A concurrent explicit
+    // AddAgent(alpha) in team A carries this whole stale multi-team projection.
+    let mut incoming_stale = latest.clone();
+    incoming_stale["teams"]["sibling"] = json!({
+        "team_key": "sibling",
+        "status": "alive",
+        "agents": { "alpha": { "status": "running", "provider": "codex", "window": "alpha" } },
+        "agent_lifecycle": {}
+    });
+
+    crate::state::repository::StateRepository::new(&ws)
+        .save(
+            crate::state::repository::StateWriteIntent::AddAgent {
+                team_key: "laneateam",
+                agent_id: "alpha",
+            },
+            &incoming_stale,
+        )
+        .unwrap();
+
+    let after: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
+    )
+    .unwrap();
+    // The AddAgent authority is scoped to team A's alpha ONLY; team B's newer
+    // same-id retirement must survive (the stale incoming must not resurrect it).
+    assert_eq!(
+        after["teams"]["sibling"]["agent_lifecycle"]["alpha"]["state"],
+        json!("retired"),
+        "selected-team AddAgent authority must not cross team boundary by bare agent id: \
+         team B's newer same-id retirement was erased by team A's stale re-add"
+    );
+    assert!(
+        after["teams"]["sibling"]["agents"].get("alpha").is_none(),
+        "a stale incoming must not resurrect the sibling team's retired same-id agent"
+    );
+}
+
+/// Identity-source boundary (verifier, slice2b authority fix new adjudication
+/// face, same family as slice1 empty-current): the legacy top-level scope anchor
+/// now prefers `active_team_key`. Verify it does not over-exempt / under-protect
+/// when `active_team_key` is a NON-EMPTY but TERMINAL / mismatched value (points
+/// at a team not present in `teams`). The AddAgent authority is (laneateam,
+/// alpha); with a ghost active_team_key, the top-level filter must resolve NO
+/// exemption for the ghost, so a real retirement anywhere is still protected —
+/// the anchor must not silently widen authority to a bare id under a dangling
+/// active_team_key (that would be the empty-current forgery shape at slice1).
+#[test]
+fn terminal_active_team_key_does_not_widen_topology_authority_to_bare_id() {
+    // Disk latest: laneateam alive with alpha; sibling alpha ABSENT + retired.
+    let ws = lanea_ws_agents(json!({
+        "alpha": { "status": "running", "provider": "codex", "window": "alpha" },
+        "bravo": { "status": "running", "provider": "codex", "window": "bravo" }
+    }));
+    let mut latest = crate::state::persist::load_runtime_state(&ws).unwrap();
+    latest["team_key"] = json!("laneateam");
+    latest["active_team_key"] = json!("laneateam");
+    let mut nested_a = crate::state::projection::compact_team_state(&latest);
+    nested_a["status"] = json!("alive");
+    latest["teams"] = json!({
+        "laneateam": nested_a,
+        "sibling": {
+            "team_key": "sibling",
+            "status": "alive",
+            "agents": {},
+            "agent_lifecycle": {
+                "alpha": { "state": "retired", "changed_at": "2026-07-21T00:00:00Z", "reason": "sibling" }
+            }
+        }
+    });
+    crate::state::persist::save_runtime_state(&ws, &latest).unwrap();
+
+    // Incoming STALE root whose active_team_key points at a GHOST team not in
+    // `teams`, and whose sibling entry is the pre-retire (alpha active) shape.
+    let mut incoming_stale = latest.clone();
+    incoming_stale["active_team_key"] = json!("ghostteam-does-not-exist");
+    incoming_stale["teams"]["sibling"] = json!({
+        "team_key": "sibling",
+        "status": "alive",
+        "agents": { "alpha": { "status": "running", "provider": "codex", "window": "alpha" } },
+        "agent_lifecycle": {}
+    });
+
+    crate::state::repository::StateRepository::new(&ws)
+        .save(
+            crate::state::repository::StateWriteIntent::AddAgent {
+                team_key: "laneateam",
+                agent_id: "alpha",
+            },
+            &incoming_stale,
+        )
+        .unwrap();
+
+    let after: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
+    )
+    .unwrap();
+    // A dangling active_team_key must not widen the (laneateam, alpha) authority
+    // into a bare `alpha` exemption that reaches the sibling: sibling stays
+    // retired, not resurrected.
+    assert_eq!(
+        after["teams"]["sibling"]["agent_lifecycle"]["alpha"]["state"],
+        json!("retired"),
+        "a terminal/ghost active_team_key must not widen topology authority to a bare id \
+         and erase the sibling's same-id retirement"
+    );
+    assert!(
+        after["teams"]["sibling"]["agents"].get("alpha").is_none(),
+        "a terminal active_team_key must not let a stale incoming resurrect the sibling agent"
+    );
+}
+
+/// Cross-product cell (verifier, slice2b current-alias fix): the `current`
+/// physical alias dimension x the sibling same-id retirement dimension. The
+/// reset fix routes `team == "current"` authority through `top_level_team`
+/// (active_team_key). This pins that the alias branch does NOT leak that
+/// active-team authority into a REAL sibling that merely shares the agent id:
+/// a `current` alias entry (= the active team's physical projection) plus a
+/// distinct sibling team both carrying `alpha`, sibling retired, stale incoming
+/// resurrecting sibling alpha. The current-alias authority must clear only the
+/// active team's own alpha, never the sibling's newer retirement.
+#[test]
+fn current_alias_authority_does_not_leak_into_real_sibling_same_id_retirement() {
+    let ws = lanea_ws_agents(json!({
+        "alpha": { "status": "running", "provider": "codex", "window": "alpha" },
+        "bravo": { "status": "running", "provider": "codex", "window": "bravo" }
+    }));
+    let mut latest = crate::state::persist::load_runtime_state(&ws).unwrap();
+    latest["team_key"] = json!("laneateam");
+    latest["active_team_key"] = json!("laneateam");
+    let mut nested_a = crate::state::projection::compact_team_state(&latest);
+    nested_a["status"] = json!("alive");
+    // `current` is the physical alias of the active team (laneateam); a REAL
+    // sibling team also carries alpha, retired and newer than the stale incoming.
+    latest["teams"] = json!({
+        "laneateam": nested_a.clone(),
+        "current": nested_a,
+        "sibling": {
+            "team_key": "sibling",
+            "status": "alive",
+            "agents": {},
+            "agent_lifecycle": {
+                "alpha": { "state": "retired", "changed_at": "2026-07-21T00:00:00Z", "reason": "sibling" }
+            }
+        }
+    });
+    crate::state::persist::save_runtime_state(&ws, &latest).unwrap();
+
+    let mut incoming_stale = latest.clone();
+    incoming_stale["teams"]["sibling"] = json!({
+        "team_key": "sibling",
+        "status": "alive",
+        "agents": { "alpha": { "status": "running", "provider": "codex", "window": "alpha" } },
+        "agent_lifecycle": {}
+    });
+
+    crate::state::repository::StateRepository::new(&ws)
+        .save(
+            crate::state::repository::StateWriteIntent::AddAgent {
+                team_key: "laneateam",
+                agent_id: "alpha",
+            },
+            &incoming_stale,
+        )
+        .unwrap();
+
+    let after: serde_json::Value = serde_json::from_str(
+        &std::fs::read_to_string(crate::state::persist::runtime_state_path(&ws)).unwrap(),
+    )
+    .unwrap();
+    // The current-alias authority is the ACTIVE team's; it must not reach the
+    // real sibling that only shares the id.
+    assert_eq!(
+        after["teams"]["sibling"]["agent_lifecycle"]["alpha"]["state"],
+        json!("retired"),
+        "current-alias authority must not leak into a real sibling's same-id retirement"
+    );
+    assert!(
+        after["teams"]["sibling"]["agents"].get("alpha").is_none(),
+        "a stale incoming must not resurrect the real sibling's retired same-id agent \
+         via the current-alias authority path"
+    );
+}
+
 const CHARLIE_ROLE: &str = "---\nname: charlie\nrole: Charlie Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nCharlie.\n";
 
 struct HermeticTestEnv {
@@ -558,6 +940,10 @@ fn force_recreate_is_one_lock_transaction_for_all_seat_quadrants_and_rolls_back_
             state["agents"].get("charlie").is_some(),
             "{quadrant}: state restored"
         );
+        assert!(
+            state["agent_lifecycle"].get("charlie").is_none(),
+            "{quadrant}: successful force-recreate consumes its interim tombstone"
+        );
         let spec_text = std::fs::read_to_string(selected_spec_path(&ws)).unwrap();
         assert_eq!(
             spec_text.matches("id: \"charlie\"").count(),
@@ -604,6 +990,10 @@ fn force_recreate_is_one_lock_transaction_for_all_seat_quadrants_and_rolls_back_
         state["agents"].get("charlie").is_some(),
         "rollback restores state"
     );
+    assert!(
+        state["agent_lifecycle"].get("charlie").is_none(),
+        "preflight failure must not create a retirement tombstone"
+    );
     assert!(
         std::fs::read_to_string(selected_spec_path(&ws))
             .unwrap()
@@ -702,6 +1092,11 @@ fn force_recreate_post_consumption_failure_restores_before_tuple_and_health() {
         sibling_health,
         "rollback never changes the sibling team's same-agent health row"
     );
+    let state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    assert!(
+        state["agent_lifecycle"].get("charlie").is_none(),
+        "post-consumption rollback restores the before-state without a new tombstone"
+    );
 }
 
 #[test]
@@ -1140,6 +1535,11 @@ fn lanea_remove_rollback_restarts_force_stopped_worker() {
          RemoveRollback::restore. spawns={:?}",
         tx.spawns()
     );
+    let restored = crate::state::persist::load_runtime_state(&ws).unwrap();
+    assert!(
+        restored["agent_lifecycle"].get("alpha").is_none(),
+        "failed remove must roll back the transaction-created tombstone"
+    );
 }
 
 // ── REMOVE #11 (remove-dynamic-role-path-and-required-8, warn) [RED] — missing REQUIRED role file raises
@@ -1263,14 +1663,11 @@ fn lanea_fork_gate_error_text_and_spec_rollback_on_adapter_arm() {
     );
 }
 
-// ── FORK (fork-report-session-id-is-pane-id) [RED] — report session_id is the captured id / None, not pane
-// Golden operations.py:399,408 returns state['agents'][as_agent_id].get('session_id') — the captured
-// provider session id (or None if capture missed, raise_on_missed=False). Rust sets
-// session_id: Some(SessionId::new(spawn.pane_id)) (launch.rs:502) — the tmux pane id ('%newfork'),
-// a different value kind. RED: the report session_id must NOT be the pane id (None, since the Rust fork
-// path performs no session capture).
+// Successful fork reports the verified provider session id, never the pane id.
 #[test]
+#[serial_test::serial(env)]
 fn lanea_fork_report_session_id_is_not_pane_id() {
+    let _home = LaneHomeGuard::enter("fork-report");
     let ws = fork_ws(DELEG_ROLE_ALPHA); // codex+subscription -> native fork supported -> full success path
     let tx = LaneTransport::new("team-laneateam", &[]);
     let report =
@@ -1282,9 +1679,41 @@ fn lanea_fork_report_session_id_is_not_pane_id() {
         "golden operations.py:399,408: report.session_id is the captured provider session id / None, NEVER the \
          tmux pane id; Rust returns Some(pane_id='%newfork')"
     );
-    assert_eq!(
-        report.session_id, None,
-        "the Rust fork path captures no session -> report.session_id must be None (golden capture-missed), not the pane id"
+    assert!(
+        report.session_id.is_some(),
+        "a successful fork must carry the verified NEW provider session id"
+    );
+    let state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    let row = &state["agents"]["newfork"];
+    assert!(row["spawned_at"]
+        .as_str()
+        .is_some_and(|value| chrono::DateTime::parse_from_rfc3339(value).is_ok()));
+    assert_eq!(row["spawn_epoch"], serde_json::json!(1));
+}
+
+#[test]
+fn fresh_start_persists_boundary_from_before_transport_spawn() {
+    let ws = lanea_one_agent_ws("stopped");
+    let tx = LaneTransport::new("team-laneateam", &[]);
+    crate::lifecycle::start_agent_with_transport(&ws, &aid("alpha"), false, false, true, None, &tx)
+        .expect("fresh start");
+
+    let transport_observed_at = tx
+        .spawn_observed_at()
+        .into_iter()
+        .next()
+        .expect("transport spawn observation");
+    let transport_observed_at =
+        chrono::DateTime::parse_from_rfc3339(&transport_observed_at).unwrap();
+    let state = crate::state::persist::load_runtime_state(&ws).unwrap();
+    let spawned_at = state["agents"]["alpha"]["spawned_at"]
+        .as_str()
+        .and_then(|value| chrono::DateTime::parse_from_rfc3339(value).ok())
+        .expect("persisted spawn boundary");
+    assert!(
+        spawned_at <= transport_observed_at,
+        "the persisted capture boundary must precede the transport spawn; \
+         spawned_at={spawned_at}, transport_observed_at={transport_observed_at}"
     );
 }
 

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -71,10 +71,11 @@ fn codex_identity_rollout(
     std::fs::write(
         &path,
         format!(
-            "{{\"session_meta\":{{\"payload\":{{\"id\":\"{session_id}\",\"cwd\":\"{}\"}}}}}}\n\
+            "{{\"session_meta\":{{\"payload\":{{\"id\":\"{session_id}\",\"cwd\":\"{}\",\"created_at\":\"{}\"}}}}}}\n\
              {{\"type\":\"turn_context\",\"payload\":{{}}}}\n\
              {{\"type\":\"response_item\",\"payload\":{{\"content\":[{{\"type\":\"input_text\",\"text\":\"You are Team Agent worker `{embedded_agent_id}` with role `fixture`.\"}}]}}}}\n",
-            workspace.to_string_lossy()
+            workspace.to_string_lossy(),
+            chrono::Utc::now().to_rfc3339()
         ),
     )
     .unwrap();
@@ -705,6 +706,7 @@ fn spine_add_agent_rejects_duplicate_agent_id() {
 #[test]
 fn e5_add_agent_does_not_copy_role_into_platform_dir_and_injects_into_spec() {
     let team = quick_start_team_dir(QS_VALID_ROLE);
+    seed_canonical_team_identity(&team, "teamdir");
     // External role file OUTSIDE team_dir/agents, with recognizable body content.
     let role = team.parent().unwrap().join("w2-external-role.md");
     let role_body = "---\nname: w2\nrole: Second Worker\nprovider: codex\nmodel: gpt-5.5\nauth_mode: subscription\ntools:\n  - mcp_team\n---\n\nUNIQUE-E5-BUG1-MARKER body for w2.\n";
@@ -1154,6 +1156,12 @@ pub(super) fn seed_healthy_coordinator(workspace: &std::path::Path) {
     .unwrap();
 }
 
+fn seed_canonical_team_identity(workspace: &std::path::Path, team_key: &str) {
+    let mut state = crate::state::persist::load_runtime_state(workspace).unwrap();
+    state["active_team_key"] = json!(team_key);
+    crate::state::persist::save_runtime_state(workspace, &state).unwrap();
+}
+
 // RED — quick_start_with_transport must drive the REAL spawn path: launch.dry_run==false, started
 // non-empty (one per compiled agent), and the transport records >=1 spawn carrying that agent's
 // provider build_command. Today the dry_run=true bug -> launch.started empty + ZERO spawns recorded ->
@@ -2263,6 +2271,7 @@ fn add_agent_with_transport_spawns_new_worker_not_stub() {
     let role_file = team.join("worker2-role.md"); // OUTSIDE agents/ -> not a duplicate of an existing agent
     std::fs::write(&role_file, DELEG_ROLE_WORKER2).unwrap();
     seed_healthy_coordinator(&team);
+    seed_canonical_team_identity(&team, "addteam");
     let transport = OfflineTransport::new();
 
     let _result = add_agent_with_transport(
@@ -2473,6 +2482,10 @@ fn restart_allow_fresh_copilot_keeps_session_id_null_until_capture_confirms() {
         .windows(2)
         .find_map(|pair| (pair[0] == "--session-id").then(|| pair[1].clone()))
         .expect("copilot fresh spawn argv must include --session-id");
+    let instructions =
+        std::fs::read_to_string(ws.join(".team/runtime/copilot-instructions/alpha/AGENTS.md"))
+            .expect("restart/add/clone spawn must materialize Copilot instructions");
+    assert!(instructions.contains("Alpha Worker"));
     let state = crate::state::persist::load_runtime_state(&ws).expect("load state");
     let agent = state.pointer("/agents/alpha").expect("alpha state");
     // 0.4.6 contract: session_id stays null until scanner confirms sqlite.
@@ -3076,6 +3089,7 @@ fn quick_start_running_agent_state_shape_after_spawn_is_golden() {
             "captured_at",
             "captured_via",
             "attribution_confidence",
+            "capture_state",
             "spawn_cwd",
             "spawned_at",
             "pane_id",
@@ -3331,6 +3345,7 @@ fn add_agent_reachability_gate_returns_error_when_spawn_pane_not_addressable() {
     let role_file = team.join("worker2-role.md");
     std::fs::write(&role_file, DELEG_ROLE_WORKER2).unwrap();
     seed_healthy_coordinator(&team);
+    seed_canonical_team_identity(&team, "reachgate");
 
     // Models "spawn to wrong socket" / "spawn succeeded but pane orphan": the
     // OfflineTransport records the spawn but reports the new pane is NOT
@@ -3390,6 +3405,7 @@ fn add_agent_reachability_gate_passes_when_spawn_pane_addressable() {
     let role_file = team.join("worker2-role.md");
     std::fs::write(&role_file, DELEG_ROLE_WORKER2).unwrap();
     seed_healthy_coordinator(&team);
+    seed_canonical_team_identity(&team, "gatepass");
 
     // Default OfflineTransport: spawned_panes_addressable=true, liveness=Unknown
     // (treated as not-Dead by the gate's fallthrough).
@@ -4149,6 +4165,7 @@ fn e42_re_add_and_remove_agree_on_existence_after_add() {
     let role_file = team.join("newagent.md");
     std::fs::write(&role_file, DELEG_ROLE_WORKER2).unwrap();
     seed_healthy_coordinator(&team);
+    seed_canonical_team_identity(&team, "e42sym");
     let transport = OfflineTransport::new();
     // (1) first add
     let r1 = crate::lifecycle::add_agent_with_transport(
@@ -4205,6 +4222,7 @@ fn e42_add_writes_to_canonical_runtime_spec_and_state_consistently() {
     let role_file = team.join("newagent.md");
     std::fs::write(&role_file, DELEG_ROLE_WORKER2).unwrap();
     seed_healthy_coordinator(&team);
+    seed_canonical_team_identity(&team, "e42proj");
     let transport = OfflineTransport::new();
     let _ = crate::lifecycle::add_agent_with_transport(
         &team,

package/crates/team-agent/src/lifecycle/tests/main_preserved.rs

@@ -318,6 +318,7 @@ fn reset_agent_discard_session_rebuilds_window_via_start_respawn() {
 }
 
 #[test]
+#[serial_test::serial(env)]
 fn reset_agent_discard_session_syncs_projection_epoch_inputs_for_restart_agent_command() {
     let ws = restart_ws_two_resumable_workers();
     let mut state = crate::state::persist::load_runtime_state(&ws).expect("load state");

package/crates/team-agent/src/lifecycle/tests/phase_b_contracts.rs

@@ -1,5 +1,5 @@
 use super::agent_ops::lanea_team_ws;
-use super::lane_ops::{fork_ws, LaneTransport};
+use super::lane_ops::{fork_ws, LaneHomeGuard, LaneTransport};
 use super::launch_spawn::{
     quick_start_team_dir, seed_healthy_coordinator, DELEG_ROLE_ALPHA, QS_VALID_ROLE,
 };
@@ -129,7 +129,9 @@ fn concurrent_reset_discard_session_serializes() {
 }
 
 #[test]
+#[serial_test::serial(env)]
 fn add_fork_remove_share_lifecycle_lock_behavior() {
+    let _home = LaneHomeGuard::enter("phase-b-fork");
     let (add_team, add_workspace, add_role, add_transport) = add_fixture();
     let add_agent = aid("w2");
     let add_state_before =