@team-agent/installer 0.5.60 → 0.5.61

package/crates/team-agent/src/messaging/send.rs

@@ -9,9 +9,10 @@ use crate::model::ids::{AgentId, TaskId, TeamKey};
 use crate::transport::{PaneId, Transport};
 
 use super::helpers::{status_wire, MessageStatusShadow};
-use super::leader_receiver::{send_to_leader_receiver, send_to_leader_receiver_with_presentation};
+use super::leader_receiver::send_to_leader_receiver_with_presentation;
 use super::presentation::{
-    decide_presentation, PresentationRequest, PresentationSink, PresentationSource,
+    decide_presentation, PresentationDecision, PresentationRequest, PresentationSink,
+    PresentationSource,
 };
 use super::{
     persist_resolved_send, DeliveryBlocker, DeliveryOutcome, DeliveryRefusal, DeliveryStatus,
@@ -125,49 +126,14 @@ pub fn send_message(
         MessageTarget::Single(target) if target == "leader" => {
             let presentation = decide_presentation(&opts.presentation, PresentationSource::Send);
             if presentation.effective_sink != PresentationSink::Leader {
-                let mut intent = ResolvedSendIntent::accepted(
-                    opts.origin,
+                return persist_stored_only_send(
                     workspace,
-                    opts.team.clone(),
                     LogicalRecipient::Leader,
-                    opts.sender.clone(),
-                    opts.task_id.clone(),
                     content,
-                    None,
-                    false,
-                    opts.message_id.clone(),
+                    opts,
+                    &presentation,
+                    &event_log,
                 );
-                intent.initial_disposition = InitialDisposition::StoredOnly;
-                intent.presentation = presentation.clone();
-                let persisted = match persist_resolved_send(&intent)? {
-                    PersistResolution::Persisted(persisted) => persisted,
-                    PersistResolution::Duplicate(message_id) => {
-                        return Ok(refused_outcome_with_id(
-                            DeliveryRefusal::Duplicate,
-                            Some(message_id),
-                        ));
-                    }
-                };
-                event_log.write(
-                    "presentation.stored_without_live_inject",
-                    serde_json::json!({
-                        "message_id": persisted.message_id,
-                        "requested_sink": presentation.requested_sink,
-                        "effective_sink": presentation.effective_sink,
-                        "class": presentation.class,
-                        "policy_reason": presentation.policy_reason,
-                    }),
-                )?;
-                return Ok(DeliveryOutcome {
-                    ok: true,
-                    status: DeliveryStatus::StoredOnly,
-                    message_status: MessageStatusShadow("stored_only".to_string()),
-                    message_id: Some(persisted.message_id),
-                    verification: Some("durable_without_live_inject".to_string()),
-                    stage: None,
-                    reason: None,
-                    channel: Some(presentation.effective_sink.as_str().to_string()),
-                });
             }
             let outcome = send_to_leader_receiver_with_presentation(
                 workspace,
@@ -201,15 +167,7 @@ pub fn send_message(
         MessageTarget::Single(target) => target,
         MessageTarget::Broadcast => {
             let recipients = broadcast_recipients(&state, opts.sender.as_str(), opts.team.as_ref());
-            return fanout_send(
-                workspace,
-                &state,
-                &recipients,
-                content,
-                opts,
-                &event_log,
-                "*",
-            );
+            return fanout_send(workspace, &recipients, content, opts, "*");
         }
         MessageTarget::Fanout(recipients) if recipients.is_empty() => {
             // swallow batch 3 ②: a failed send carries its reason (Python send error
@@ -226,9 +184,7 @@ pub fn send_message(
             });
         }
         MessageTarget::Fanout(recipients) => {
-            return fanout_send(
-                workspace, &state, recipients, content, opts, &event_log, "fanout",
-            );
+            return fanout_send(workspace, recipients, content, opts, "fanout");
         }
     };
     // send.py:259-261 — a non-leader target that is NOT a known team agent is refused
@@ -240,6 +196,17 @@ pub fn send_message(
     if !in_team {
         return Ok(refused_outcome(DeliveryRefusal::TargetNotInTeam));
     }
+    let presentation = decide_presentation(&opts.presentation, PresentationSource::Send);
+    if presentation.effective_sink != PresentationSink::Leader {
+        return persist_stored_only_send(
+            workspace,
+            LogicalRecipient::from_resolved(recipient),
+            content,
+            opts,
+            &presentation,
+            &event_log,
+        );
+    }
     if let Some(outcome) = session_drift_refusal(
         &state,
         recipient,
@@ -354,6 +321,59 @@ pub fn send_message(
     })
 }
 
+fn persist_stored_only_send(
+    workspace: &Path,
+    recipient: LogicalRecipient,
+    content: &str,
+    opts: &SendOptions,
+    presentation: &PresentationDecision,
+    event_log: &EventLog,
+) -> Result<DeliveryOutcome, MessagingError> {
+    let mut intent = ResolvedSendIntent::accepted(
+        opts.origin,
+        workspace,
+        opts.team.clone(),
+        recipient,
+        opts.sender.clone(),
+        opts.task_id.clone(),
+        content,
+        None,
+        opts.requires_ack,
+        opts.message_id.clone(),
+    );
+    intent.initial_disposition = InitialDisposition::StoredOnly;
+    intent.presentation = presentation.clone();
+    let persisted = match persist_resolved_send(&intent)? {
+        PersistResolution::Persisted(persisted) => persisted,
+        PersistResolution::Duplicate(message_id) => {
+            return Ok(refused_outcome_with_id(
+                DeliveryRefusal::Duplicate,
+                Some(message_id),
+            ));
+        }
+    };
+    event_log.write(
+        "presentation.stored_without_live_inject",
+        serde_json::json!({
+            "message_id": persisted.message_id,
+            "requested_sink": presentation.requested_sink,
+            "effective_sink": presentation.effective_sink,
+            "class": presentation.class,
+            "policy_reason": presentation.policy_reason,
+        }),
+    )?;
+    Ok(DeliveryOutcome {
+        ok: true,
+        status: DeliveryStatus::StoredOnly,
+        message_status: MessageStatusShadow("stored_only".to_string()),
+        message_id: Some(persisted.message_id),
+        verification: Some("durable_without_live_inject".to_string()),
+        stage: None,
+        reason: None,
+        channel: Some(presentation.effective_sink.as_str().to_string()),
+    })
+}
+
 fn stale_worker_target_missing_preflight(
     workspace: &Path,
     state: &serde_json::Value,
@@ -804,11 +824,9 @@ fn broadcast_recipients(
 
 fn fanout_send(
     workspace: &Path,
-    state: &serde_json::Value,
     recipients: &[String],
     content: &str,
     opts: &SendOptions,
-    event_log: &EventLog,
     channel_label: &str,
 ) -> Result<DeliveryOutcome, MessagingError> {
     let mut last_message_id: Option<String> = None;
@@ -821,30 +839,17 @@ fn fanout_send(
             continue;
         }
         attempted_count = attempted_count.saturating_add(1);
-        let outcome = if recipient == "leader" {
-            send_to_leader_receiver(
-                workspace,
-                state,
-                recipient,
-                content,
-                opts.task_id.as_ref(),
-                opts.sender.as_str(),
-                opts.requires_ack,
-                None,
-                event_log,
-            )?
-        } else {
-            // single-recipient re-entry — strip fanout metadata to avoid recursion + ensure
-            // each row gets its own caller-supplied message_id (none) so SQLite PK doesn't clash.
-            let mut inner_opts = opts.clone();
-            inner_opts.message_id = None;
-            super::send::send_message(
-                workspace,
-                &MessageTarget::Single(recipient.clone()),
-                content,
-                &inner_opts,
-            )?
-        };
+        // Every expanded recipient re-enters the same presentation-aware send
+        // funnel. Strip the caller idempotency key so each durable fanout row
+        // receives its own stable message id.
+        let mut inner_opts = opts.clone();
+        inner_opts.message_id = None;
+        let outcome = super::send::send_message(
+            workspace,
+            &MessageTarget::Single(recipient.clone()),
+            content,
+            &inner_opts,
+        )?;
         if outcome.ok {
             delivered_count = delivered_count.saturating_add(1);
             if let Some(mid) = outcome.message_id.clone() {
@@ -862,8 +867,12 @@ fn fanout_send(
             return Ok(outcome);
         }
     }
+    let presentation = decide_presentation(&opts.presentation, PresentationSource::Send);
+    let stored_only = presentation.effective_sink != PresentationSink::Leader;
     let status = if any_failure {
         DeliveryStatus::FanoutPartial
+    } else if delivered_count > 0 && stored_only {
+        DeliveryStatus::StoredOnly
     } else if delivered_count > 0 {
         DeliveryStatus::FanoutDelivered
     } else {
@@ -874,9 +883,13 @@ fn fanout_send(
         status,
         message_status: MessageStatusShadow(status_wire(status).to_string()),
         message_id: last_message_id,
-        verification: None,
+        verification: stored_only.then(|| "durable_without_live_inject".to_string()),
         stage: None,
         reason: None,
-        channel: Some(channel_label.to_string()),
+        channel: Some(if stored_only {
+            presentation.effective_sink.as_str().to_string()
+        } else {
+            channel_label.to_string()
+        }),
     })
 }

package/crates/team-agent/src/messaging/tests/leader_channel.rs

@@ -101,10 +101,10 @@ fn legacy_receiver_without_status_still_rejects_a_foreign_workspace() {
         .with_tmux_endpoint(socket)
         .with_targets(vec![observed]);
 
-    assert_eq!(
+    assert!(matches!(
         resolve_live_leader_channel(workspace, &receiver, &transport),
-        LeaderChannelResolution::Unbound(LeaderChannelUnbound::PaneWorkspaceMismatch)
-    );
+        LeaderChannelResolution::Unbound(LeaderChannelUnbound::PaneWorkspaceMismatch(_))
+    ));
 }
 
 #[test]
@@ -162,8 +162,8 @@ fn same_socket_and_pane_in_a_foreign_workspace_is_not_a_live_leader() {
         .with_tmux_endpoint(socket)
         .with_targets(vec![observed]);
 
-    assert_eq!(
+    assert!(matches!(
         resolve_live_leader_channel(workspace, &receiver(socket), &transport),
-        LeaderChannelResolution::Unbound(LeaderChannelUnbound::PaneWorkspaceMismatch)
-    );
+        LeaderChannelResolution::Unbound(LeaderChannelUnbound::PaneWorkspaceMismatch(_))
+    ));
 }

package/crates/team-agent/src/messaging/tests/leader_inject_acceptance.rs

@@ -99,6 +99,141 @@ fn attached_leader_mailbox_is_rechecked_by_the_normal_delivery_tick() {
     assert!(case.events().contains("leader_receiver.mailbox_requeued"));
 }
 
+#[test]
+fn leader_submit_without_receipt_source_cannot_park_forever_without_a_completion_writer() {
+    let case = Case::new_without_rollout("missing-receipt-source");
+    let transport = RecordingTransport::new("");
+    let message_id = case.seed_message("missing receipt source canary");
+
+    let first = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .expect("verified leader transport submission");
+
+    assert_ne!(
+        case.message_status(&message_id),
+        "submitted_pending_acceptance",
+        "F4 acceptance-stall: a verified leader transport submit with no reachable \
+         receipt source must not enter submitted_pending_acceptance, because that \
+         protected state has no completion writer. The runtime may close the \
+         transport-acceptance fact or expose a provider-session receipt writer, \
+         but it must not report an indefinitely retryable fact-terminal. outcome={first:?}"
+    );
+    assert_eq!(
+        transport.inject_count(),
+        1,
+        "the acceptance repair must not obtain progress by physically injecting twice"
+    );
+
+    let _ = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    );
+    assert_eq!(
+        transport.inject_count(),
+        1,
+        "a second coordinator observation must not replay the already-submitted leader message"
+    );
+}
+
+#[test]
+fn nonempty_missing_receipt_source_is_not_token_absent() {
+    assert_unavailable_rollout_converges(
+        "missing-rollout",
+        PathBuf::from("definitely-missing-leader-rollout.jsonl"),
+        false,
+    );
+}
+
+#[test]
+fn nonempty_unreadable_receipt_source_is_not_token_absent() {
+    assert_unavailable_rollout_converges(
+        "unreadable-rollout",
+        PathBuf::from("leader-rollout-is-a-directory"),
+        true,
+    );
+}
+
+fn assert_unavailable_rollout_converges(tag: &str, rollout: PathBuf, directory: bool) {
+    let case = Case::new_with_unavailable_rollout(tag, rollout, directory);
+    let transport = RecordingTransport::new("");
+    let message_id = case.seed_message("unavailable receipt source canary");
+
+    let first = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    )
+    .expect("verified leader transport submission");
+
+    assert_eq!(
+        case.message_status(&message_id),
+        "injected_awaiting_receipt",
+        "F4 receipt observation must distinguish an unreadable nonempty rollout_path \
+         from a readable rollout that lacks the token. The former is \
+         receipt-source-unavailable and must converge to the typed parked state, \
+         not remain submitted_pending_acceptance. shape={tag} outcome={first:?}"
+    );
+    assert_eq!(
+        first.verification.as_deref(),
+        Some("leader_receipt_source_unavailable"),
+        "the outcome must expose read-unavailable rather than TokenAbsent; shape={tag}"
+    );
+    assert_eq!(transport.inject_count(), 1);
+
+    let _ = deliver_pending_message(
+        &case.workspace,
+        &case.store,
+        &transport,
+        &message_id,
+        &case.event_log,
+        &case.state,
+    );
+    assert_eq!(
+        transport.inject_count(),
+        1,
+        "read-unavailable convergence must not obtain progress by a second physical \
+         injection; shape={tag}"
+    );
+}
+
+#[test]
+fn worker_consumption_writer_remains_a_positive_control() {
+    let case = Case::new("worker-positive-control");
+    let message_id = case
+        .store
+        .create_message(
+            None,
+            "leader",
+            "worker",
+            "worker consume canary",
+            None,
+            false,
+            None,
+        )
+        .unwrap();
+
+    case.store.mark(&message_id, "consumed", None).unwrap();
+
+    assert_eq!(
+        case.message_status(&message_id),
+        "consumed",
+        "positive control: the independent worker consumption writer must remain reachable"
+    );
+}
+
 struct Case {
     workspace: PathBuf,
     rollout: PathBuf,
@@ -134,6 +269,58 @@ impl Case {
         }
     }
 
+    fn new_without_rollout(tag: &str) -> Self {
+        let workspace = tmp_ws(&format!("leader-inject-acceptance-{tag}"));
+        let rollout = workspace.join("absent-leader.jsonl");
+        let state = serde_json::json!({
+            "active_team_key": "acceptance-team",
+            "session_name": "team-acceptance",
+            "leader_receiver": {
+                "pane_id": "%leader",
+                "status": "attached",
+                "provider": "claude"
+            }
+        });
+        crate::state::persist::save_runtime_state(&workspace, &state).unwrap();
+        let store = MessageStore::open(&workspace).unwrap();
+        let event_log = EventLog::new(&workspace);
+        Self {
+            workspace,
+            rollout,
+            store,
+            event_log,
+            state,
+        }
+    }
+
+    fn new_with_unavailable_rollout(tag: &str, relative: PathBuf, directory: bool) -> Self {
+        let workspace = tmp_ws(&format!("leader-inject-acceptance-{tag}"));
+        let rollout = workspace.join(relative);
+        if directory {
+            std::fs::create_dir_all(&rollout).unwrap();
+        }
+        let state = serde_json::json!({
+            "active_team_key": "acceptance-team",
+            "session_name": "team-acceptance",
+            "leader_receiver": {
+                "pane_id": "%leader",
+                "status": "attached",
+                "provider": "claude",
+                "rollout_path": rollout,
+            }
+        });
+        crate::state::persist::save_runtime_state(&workspace, &state).unwrap();
+        let store = MessageStore::open(&workspace).unwrap();
+        let event_log = EventLog::new(&workspace);
+        Self {
+            workspace,
+            rollout,
+            store,
+            event_log,
+            state,
+        }
+    }
+
     fn seed_message(&self, content: &str) -> String {
         self.store
             .create_message(None, "worker", "leader", content, None, false, None)

package/crates/team-agent/src/messaging/tests/runtime.rs

@@ -2976,9 +2976,8 @@ fn gate054_attached_status_still_accepts_when_pane_is_live() {
     // Injection-case revision: transport submit success is NOT a provider
     // receipt, so the old `delivered` pin was a false-positive lock
     // (MUST-10: physical submit is the framework's fact; acceptance is the
-    // provider's). The un-refused path now parks the SAME row in
-    // submitted_pending_acceptance until a provider receipt or retry
-    // schedule advances it.
+    // provider's). The un-refused path now records the SAME row in the typed
+    // post-injection fact state until a provider receipt advances it.
     let ws = tmp_ws("gate054ok");
     let store = store_for(&ws);
     let log = EventLog::new(&ws);
@@ -3012,10 +3011,18 @@ fn gate054_attached_status_still_accepts_when_pane_is_live() {
         1,
         "gate054: exactly one physical inject must have happened (MUST-10 anchor)"
     );
+    let injected_awaiting_receipt = crate::db::message_store::MessageRowStatus::ALL
+        .iter()
+        .map(|status| status.as_str())
+        .find(|status| *status == "injected_awaiting_receipt")
+        .expect(
+            "gate054 signed reanchor: typed status directory must expose \
+             injected_awaiting_receipt",
+        );
     assert_eq!(
-        out.message_status.0, "submitted_pending_acceptance",
-        "gate054 (injection-case revision): a successful physical submit without a provider \
-         receipt must park as submitted_pending_acceptance, never claim delivered: {out:?}"
+        out.message_status.0, injected_awaiting_receipt,
+        "gate054 signed reanchor: a successful physical inject without a provider receipt \
+         must remain non-delivered as injected_awaiting_receipt, never claim delivered: {out:?}"
     );
 }
 

package/crates/team-agent/src/messaging/types.rs

@@ -53,6 +53,11 @@ pub enum DeliveryRefusal {
     TmuxTargetMissing,
     MessageAlreadyClaimed,
     LeaderNotAttached,
+    /// The recorded leader pane is live but belongs to another workspace.
+    /// Keep this typed cause distinct from an actually unattached leader so
+    /// the send surface can return the existing recovery action.
+    #[serde(rename = "PaneWorkspaceMismatch")]
+    PaneWorkspaceMismatch,
     NoCallerPane,
     TeamOwnerMismatch,
     Ambiguous,

package/crates/team-agent/src/messaging/watchers.rs

@@ -529,6 +529,11 @@ pub(crate) fn requeue_blocked_leader_messages(
                     "blocked_leader_unbound": counts.blocked_leader_unbound,
                     "queued_until_leader_attach": counts.queued_until_leader_attach,
                 },
+                "attach_window_failures": {
+                    "reason": "leader_not_attached",
+                    "count": counts.blocked_leader_unbound,
+                    "status": "requeued_pending_physical_retry",
+                },
             }),
         )?;
     }

package/crates/team-agent/src/model/mod.rs

@@ -18,6 +18,7 @@ pub mod ids;
 // cli/send.rs (positional adapter), mcp_server/tools.rs (owner-scoped
 // peer suggestions). Never a routing authority — advisory only.
 pub(crate) mod name_similarity;
+pub mod pane_authority_refusal;
 pub mod paths;
 pub mod permissions;
 pub mod routing;