@team-agent/installer 0.5.61 → 0.5.62

package/crates/team-agent/src/lifecycle/tests.rs

@@ -2,6 +2,7 @@
 use super::*;
 use serde_json::json;
 use std::sync::atomic::{AtomicU32, Ordering};
+use std::sync::OnceLock;
 
 static SEQ: AtomicU32 = AtomicU32::new(0);
 
@@ -20,6 +21,24 @@ fn sess(s: &str) -> SessionName {
     SessionName(s.to_string())
 }
 
+pub(crate) fn test_binary_path() -> &'static str {
+    static PATH: OnceLock<String> = OnceLock::new();
+    PATH.get_or_init(|| {
+        if let Ok(path) = std::env::var("CARGO_BIN_EXE_team-agent") {
+            return path;
+        }
+        let current = std::env::current_exe().expect("test executable path");
+        current
+            .parent()
+            .and_then(|deps| deps.parent())
+            .map(|target| target.join("team-agent"))
+            .expect("team-agent test binary path")
+            .to_string_lossy()
+            .into_owned()
+    })
+    .as_str()
+}
+
 mod agent_ops;
 mod core;
 mod lane_ops;
@@ -29,3 +48,43 @@ mod main_preserved;
 mod phase_b_contracts;
 mod phase_golden;
 mod restart;
+mod b0_legacy_snapshot_nonauthority_contract;
+mod b0_reader_hideone_audit_contract;
+mod behavioral_diff_264_red;
+mod claude_profile_launch_red;
+mod codex_mcp_approval_inheritance_red;
+mod codex_weak_window_attribution_red;
+mod copilot_provider_red;
+mod display_adaptive_red;
+mod core_034_real_red;
+mod f032_startup_prompt_best_effort_red;
+mod harvest2_a_batch_red;
+mod host_cotenant_death_p0_contract;
+mod lifecycle_rollback_red;
+mod quick_start_worker_readiness_red;
+mod realmachine_clusters_1_6_red;
+mod realmachine_residual_g1_g4_red;
+mod restart_build_before_destroy_0540_contract;
+mod restart_liveness_red;
+mod restart_rebind_hotfix_252_red;
+mod restart_session_capture_red;
+mod resume_recover_red;
+mod stale_team_saveconflict_contract;
+mod startup_latency_contract;
+mod status_credential_redaction_contract;
+mod subprep_codex_trust_roundtrip_red;
+mod swallow_batch4_semantics_red;
+mod team_in_team_identity_scope_red;
+mod team_in_team_sibling_quick_start_red;
+mod team_in_team_state_scope_red;
+mod team_key_retirement_roster_red;
+mod team_key_retirement_txn_red;
+mod test_isolation_escape_contract;
+mod upgrade_compat_0211_red;
+mod verify_rs031_window_consistency_red;
+mod worker_dangerous_bypass_argv_red;
+mod worker_spawn_env_red;
+mod acceptance_b_batch_red;
+mod claude_compatible_config_red;
+mod communication_mode_runtime_contract_red;
+mod clone_fork_copilot_perms_red;

package/crates/team-agent/src/lifecycle/types.rs

@@ -16,15 +16,6 @@ use super::DisplayBackend;
 // CROSS-LANE PLACEHOLDERS(13/14/15 兄弟 lane 尚未交付;leader 集成时 reconcile)
 // ===========================================================================
 
-/// step8 provider 还未暴露的 launch/resume/fork 命令构造门面。lifecycle 经它构造
-/// provider 命令字符串(`shell_command_for_agent`/`shell_resume_command_for_agent`/
-/// `shell_fork_command_for_agent`,`runtime` 自由函数)—— provider lane 落地后替换为
-/// 真实 `provider::shell_*` API。**PLACEHOLDER**:仅占位 argv,字段映射由 provider lane 定。
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct ShellCommand {
-    pub argv: Vec<String>,
-}
-
 /// `EventLog` 已在 step4 落地,但 lifecycle 发射的 typed `EventKind` 名集(`lifecycle.*`/
 /// `restart.*`/`display.*`)是 step4 owned 的稳定事件名(JSON 名与 Python 一致)。
 /// **PLACEHOLDER**:此处仅命名 lifecycle 关心的事件名常量集,leader 集成时映射到

package/crates/team-agent/src/mcp_server/helpers.rs

@@ -1,3 +1,4 @@
+//!
 //! step 14a · mcp_server::helpers — pure regularization + shared free helpers.
 
 use std::io::Write as _;

package/crates/team-agent/src/mcp_server/lifecycle_tools/mod.rs

@@ -1,3 +1,4 @@
+//!
 //! MCP lifecycle tool facades.
 //!
 //! S0 keeps the old placeholder behavior behind stable module boundaries so

package/crates/team-agent/src/mcp_server/lifecycle_tools/state_status.rs

@@ -1,3 +1,4 @@
+//!
 use std::path::Path;
 
 use serde_json::Value;

package/crates/team-agent/src/mcp_server/mod.rs

@@ -1,3 +1,4 @@
+//!
 //! step 14a · mcp_server — stdio MCP server (`team_orchestrator`) over JSON-RPC 2.0.
 //!
 //! Card: `docs/phase0/subsystems/14-mcp_cli.md` (MCP half).

package/crates/team-agent/src/mcp_server/normalize.rs

@@ -1,3 +1,4 @@
+//!
 //! step 14a · mcp_server::normalize — string-alias regularization + result compaction.
 
 use serde_json::Value;
@@ -28,9 +29,9 @@ pub fn normalize_result_status(value: Option<&str>) -> ResultStatus {
     normalize_result_status_observed(value).0
 }
 
-/// The observed variant: `.1` carries the raw unrecognized literal so ingestion
-/// boundaries (wire report_result) can emit `provider.result.unknown_status_normalized`.
-pub fn normalize_result_status_observed(value: Option<&str>) -> (ResultStatus, Option<String>) {
+/// The internal observed variant: `.1` carries the raw unrecognized literal for
+/// callers that need to retain it.
+fn normalize_result_status_observed(value: Option<&str>) -> (ResultStatus, Option<String>) {
     let token = normalize_token(value);
     if token.is_empty() {
         return (ResultStatus::Success, None);

package/crates/team-agent/src/mcp_server/tools.rs

@@ -1,3 +1,4 @@
+//!
 //! step 14a · mcp_server::tools — `TeamOrchestratorTools`, the 12 typed handlers.
 
 use std::path::{Path, PathBuf};

package/crates/team-agent/src/mcp_server/types.rs

@@ -1,3 +1,4 @@
+//!
 //! step 14a · mcp_server::types — wire enums / envelopes / normalized-result carriers.
 
 use serde::{Deserialize, Serialize};
@@ -210,24 +211,6 @@ pub struct RpcError {
     pub message: String,
 }
 
-/// The `tools/call` result wrapper (`server.py:74-86`): `{content:[{type:"text",
-/// text:<json>}], isError:<bool>}`. `text` is the JSON-encoded [`ToolResult`]; the
-/// `is_error` flag mirrors `result.get("ok") is False`.
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
-pub struct ToolCallResult {
-    pub content: Vec<ToolCallContent>,
-    #[serde(rename = "isError")]
-    pub is_error: bool,
-}
-
-/// One `content[]` block — always `{type:"text", text:<json>}` here.
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct ToolCallContent {
-    #[serde(rename = "type")]
-    pub kind: String,
-    pub text: String,
-}
-
 /// A successful tool result body — the compacted delegate result
 /// (`normalize._compact_tool_result`, `normalize.py:6-64`). The whitelist-key
 /// compaction (ok/error key sets + `fanout_*` extras + `acknowledged_count`) lives

package/crates/team-agent/src/mcp_server/wire.rs

@@ -1,3 +1,4 @@
+//!
 //! step 14a · mcp_server::wire — stdio loop + JSON-RPC route + tool dispatch + contracts.
 
 use std::io::{BufRead, Write};
@@ -86,16 +87,15 @@ pub fn dispatch(tools: &TeamOrchestratorTools, request: &Value) -> ToolResult {
 /// `handle_mcp(tools, request)` (`server.py:46-91`): the JSON-RPC router.
 ///   - `initialize` → serverInfo `team_orchestrator` v0.1.4 + echoed protocolVersion.
 ///   - `tools/list` → `{tools: TOOLS}`.
-///   - `tools/call` → run [`dispatch`], wrap into [`ToolCallResult`] (`isError` =
-///     dispatch returned `Err`); the arg-vs-runtime exception split (`server.py:
-///     69-72`) classifies a caught failure into `InvalidToolArguments` vs
-///     `InternalRuntimeError`.
+///   - `tools/call` → run [`dispatch`], wrap through the live
+///     `tool_call_result_value` path (`isError` = dispatch returned `Err`); the
+///     arg-vs-runtime exception split (`server.py:69-72`) classifies a caught
+///     failure into `InvalidToolArguments` vs `InternalRuntimeError`.
 ///   - `notifications/*` → `Ok(None)` (no frame; **must not** emit to stdout).
 ///   - unknown method → `-32601` error frame.
 /// Returns `Ok(None)` only for the notifications path; every other branch yields a
 /// frame.
 ///
-/// [`ToolCallResult`]: super::ToolCallResult
 pub fn handle_mcp(
     tools: &TeamOrchestratorTools,
     request: &Value,

package/crates/team-agent/src/messaging/activity.rs

@@ -1,3 +1,4 @@
+//!
 //! idle_alerts.py — idle/deadlock 检测 (team-scoped 抑制 + last-fire 节流;card §23) +
 //! activity_detector.py — classifier 产物 (card §24)。
 //! §11 IRON LAW (bug-071/077/085):无信号 → Uncertain,绝不 Idle。

package/crates/team-agent/src/messaging/address.rs

@@ -1,3 +1,4 @@
+//!
 //! Pure logical-address grammar shared by public entry-point adapters.
 
 use std::path::PathBuf;

package/crates/team-agent/src/messaging/delivery.rs

@@ -1,3 +1,4 @@
+//!
 //! internal_delivery.py + delivery.py — coordinator/调度器侧 thin wrapper + 单条 tmux 注入投递
 //! + trust 有界重试 + turn-open arm (card §16/§65)。
 
@@ -93,7 +94,7 @@ pub fn deliver_persisted_message(
 
 /// `_tmux_pane_width` (`delivery.py:20`):查询 pane 列宽。**fail-safe** (bug-064/082):失败
 /// 返回 [`PaneWidthQuery::Failed`],**绝不**给默认宽度。借 step 9 transport 的 query。
-pub fn tmux_pane_width(transport: &dyn Transport, target: &Target) -> PaneWidthQuery {
+pub(crate) fn tmux_pane_width(transport: &dyn Transport, target: &Target) -> PaneWidthQuery {
     let queried = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {
         transport.query(target, crate::transport::PaneField::PaneWidth)
     }));
@@ -2254,7 +2255,7 @@ pub fn execute_trust_retry(
 
 /// `_record_turn_open_if_leader_to_worker` (`delivery.py:430`):**take-over arm 来自真实投递**
 /// (card §121) —— 仅 leader→worker 注入/投递成功后才 arm,绝不凭空 arm。
-pub fn record_turn_open_if_leader_to_worker(
+pub(crate) fn record_turn_open_if_leader_to_worker(
     workspace: &Path,
     state: &serde_json::Value,
     sender: &str,
@@ -2413,7 +2414,7 @@ fn arm_turn_open(state: &mut serde_json::Value, recipient: &str, message_id: &Op
 
 /// `_stamp_first_send_at_if_leader_to_worker` (`delivery.py:380`):首次 leader→worker 投递戳
 /// `first_send_at` (step 13 restart Route B atomicity 决策读它)。
-pub fn stamp_first_send_at_if_leader_to_worker(
+pub(crate) fn stamp_first_send_at_if_leader_to_worker(
     workspace: &Path,
     state: &serde_json::Value,
     sender: &str,

package/crates/team-agent/src/messaging/helpers.rs

@@ -1,3 +1,4 @@
+//!
 //! 私有内部 helpers (status wire / envelope 校验 / scheduled kind 解析 / activity 信号
 //! 解析 / id 生成 / MessageStatusShadow 占位)。跨子模块/测试可见者升 `pub(crate)`。
 
@@ -268,7 +269,7 @@ fn idle_activity() -> AgentActivity {
 /// outcome **不被视为 success**(I-3 反向断言要求 `leader_receiver.rs` 源文件不得含
 /// `DeliveryStatus::FallbackLog` 或 `fallback_inbox` 字面量,所以本函数从 `leader_receiver.rs`
 /// 搬到本 helpers 模块,字面量在此被允许)。
-pub fn fail_leader_delivery(
+pub(crate) fn fail_leader_delivery(
     workspace: &std::path::Path,
     payload: &serde_json::Value,
     reason: DeliveryRefusal,

package/crates/team-agent/src/messaging/leader_channel.rs

@@ -1,3 +1,4 @@
+//!
 use std::path::Path;
 
 use serde_json::Value;

package/crates/team-agent/src/messaging/leader_receiver.rs

@@ -1,3 +1,4 @@
+//!
 //! leader.py — leader pane 注入边界 + 恰好一次去重门 (card §21/§72)。
 
 use std::path::Path;
@@ -59,7 +60,7 @@ pub fn send_to_leader_receiver(
 /// stable message id for transport-fallback retries. The public function above
 /// keeps the existing call surface unchanged.
 #[allow(clippy::too_many_arguments)]
-pub fn send_to_leader_receiver_with_message_id(
+pub(crate) fn send_to_leader_receiver_with_message_id(
     workspace: &Path,
     state: &serde_json::Value,
     leader_id: &str,

package/crates/team-agent/src/messaging/mod.rs

@@ -1,3 +1,4 @@
+//!
 //! step 11 · messaging — delivery / scheduler / results / collect / report_result /
 //! watchers / leader-receiver / selftest 编排状态机 (ROUND-0 SKELETON).
 //!
@@ -83,11 +84,8 @@ pub use address::{parse_logical_address, LogicalAddress, LogicalAddressTarget};
 pub use delivery::{
     deliver_pending_message, deliver_pending_messages, deliver_persisted_message,
     deliver_stored_message, execute_trust_retry, handle_trust_retry_needed,
-    record_turn_open_if_leader_to_worker,
-    retry_injection_after_trust_auto_answer, stamp_first_send_at_if_leader_to_worker,
-    tmux_pane_width,
+    retry_injection_after_trust_auto_answer,
 };
-pub use helpers::fail_leader_delivery;
 pub use leader_channel::{
     resolve_live_leader_channel, DirectTmuxLeaderChannel, LeaderChannelResolution,
     LeaderChannelUnbound, LiveLeaderChannel,
@@ -95,7 +93,7 @@ pub use leader_channel::{
 pub use leader_receiver::{
     deliver_to_leader_fallback_pane, enqueue_leader_mailbox_until_attach,
     mirror_peer_message_to_leader, send_to_leader_receiver,
-    send_to_leader_receiver_with_message_id, send_to_leader_receiver_with_presentation,
+    send_to_leader_receiver_with_presentation,
 };
 pub use peers::allow_peer_talk;
 pub use persist::{
@@ -107,24 +105,22 @@ pub use results::{
     report_result_for_owner_team, report_result_for_owner_team_with_primary_error,
 };
 pub use scheduler::{detect_stuck_agents, fire_due_scheduled_events, stuck_cancel, stuck_list};
-pub use selftest::{evaluate_idle_behavior, run_comms_selftest, CommsSelftestDriver};
+pub use selftest::{run_comms_selftest, CommsSelftestDriver};
 pub use send::{
-    apply_worker_sender_bypass, send_message, session_drift_refusal, MessageTarget, SendOptions,
-    TrustedSender,
+    apply_worker_sender_bypass, send_message, MessageTarget, SendOptions, TrustedSender,
 };
 pub use trust::{attempt_trust_auto_answer, TrustAnswerOutcome};
 pub use types::{
-    ActivityStatus, AgentActivity, AlertSnapshot, AlertSuppression, AlertType, CheckEvidence,
-    CheckKind, CheckStatus, ContractSuiteCheck, DeliveryOutcome, DeliveryRefusal, DeliveryStage,
-    DeliveryStatus, IdleEvaluation, LeaderNotificationKey, LeaderReceiver, PaneWidthQuery,
+    ActivityStatus, AgentActivity, AlertType, CheckEvidence, CheckKind, CheckStatus,
+    ContractSuiteCheck, DeliveryOutcome, DeliveryRefusal, DeliveryStage, DeliveryStatus,
+    IdleEvaluation, LeaderNotificationKey, LeaderReceiver, PaneWidthQuery,
     ProviderSdkCalls, ReceiverMode, ScheduledKind, SelftestCheck, SelftestReport, SendEventPayload,
     TrustRetryPayload, WatcherNotice, WorkerRuntimeState, RESULT_DELIVERY_MAX_ATTEMPTS,
     SEND_RETRY_MAX_ATTEMPTS, TRUST_RETRY_BACKOFF_SECONDS, TRUST_RETRY_MAX_ATTEMPTS,
 };
 pub use watchers::{
-    delivered_result_message, format_result_watcher_notification, notify_result_watchers,
-    requeue_after_claim_leader, requeue_delivery_exhausted_watchers, result_id_from_text,
-    retry_result_deliveries,
+    format_result_watcher_notification, requeue_after_claim_leader,
+    requeue_delivery_exhausted_watchers, result_id_from_text, retry_result_deliveries,
 };
 
 // `MessageStatusShadow` 是 [`DeliveryOutcome::message_status`] 的公有字段类型,原在模块根

package/crates/team-agent/src/messaging/peers.rs

@@ -1,3 +1,4 @@
+//!
 //! peer messaging compatibility helpers.
 
 use std::path::Path;
@@ -7,6 +8,7 @@ use crate::message_store::MessageStore;
 
 use super::MessagingError;
 
+///
 /// `leader.py:allow_peer_talk`: persist a bidirectional peer allowlist entry.
 pub fn allow_peer_talk(
     workspace: &Path,

package/crates/team-agent/src/messaging/persist.rs

@@ -1,3 +1,4 @@
+//!
 //! Durable boundary between resolved logical addressing and delivery/recovery.
 
 use std::path::{Path, PathBuf};
@@ -152,6 +153,7 @@ pub enum PersistResolution {
     Duplicate(String),
 }
 
+///
 /// The only production entry point that creates a durable message row.
 pub fn persist_resolved_send(
     intent: &ResolvedSendIntent,
@@ -168,7 +170,7 @@ pub fn persist_resolved_send(
         message_id: intent.requested_message_id.as_deref(),
         owner_team_id: intent.owner_team_id.as_ref().map(TeamKey::as_str),
         task_id: intent.task_id.as_ref().map(TaskId::as_str),
-        sender: intent.sender.as_str(),
+        sender: intent.sender.display_name(),
         recipient: intent.recipient.as_str(),
         reply_to: intent.reply_to.as_deref(),
         requires_ack: intent.requires_ack,

package/crates/team-agent/src/messaging/presentation.rs

@@ -1,3 +1,4 @@
+//!
 //! Typed presentation metadata shared by message and result ingress.
 
 use serde::{Deserialize, Serialize};
@@ -256,7 +257,7 @@ pub fn normalize_send_presentation(
     })
 }
 
-pub fn normalize_presentation(value: Option<&Value>) -> (PresentationRequest, Option<String>) {
+pub(crate) fn normalize_presentation(value: Option<&Value>) -> (PresentationRequest, Option<String>) {
     let Some(value) = value else {
         return (PresentationRequest::default(), None);
     };

package/crates/team-agent/src/messaging/results.rs

@@ -1,3 +1,4 @@
+//!
 //! results.py — collect + report_result + envelope 校验编排 (card §66/§67)。
 
 use std::path::{Path, PathBuf};

package/crates/team-agent/src/messaging/scheduler.rs

@@ -1,3 +1,4 @@
+//!
 //! scheduler.py — 调度器心脏 + stuck 检测 + 告警抑制 (card §18/§68/§73)。
 
 use std::path::Path;

package/crates/team-agent/src/messaging/selftest.rs

@@ -291,7 +291,7 @@ fn message_owner_team(db_path: &Path, message_id: &str) -> Result<Option<String>
 }
 
 /// `evaluate_idle_behavior` (`diagnose/comms.py:50`):idle 分类准确性评估。零 token,走 driver。
-pub fn evaluate_idle_behavior(
+pub(crate) fn evaluate_idle_behavior(
     workspace: &Path,
     agent_id: &str,
     claimed_status: &str,

package/crates/team-agent/src/messaging/send.rs

@@ -36,21 +36,54 @@ pub enum MessageTarget {
 /// Public CLI/MCP inputs never construct this value from a caller-supplied
 /// string. The wrapper keeps that trust boundary visible throughout delivery
 /// instead of degrading the identity back to an untyped option field.
-#[derive(Debug, Clone, PartialEq, Eq, serde::Serialize)]
-#[serde(transparent)]
-pub struct TrustedSender(AgentId);
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct TrustedSender {
+    agent_id: AgentId,
+    full_name: Option<String>,
+}
 
 impl TrustedSender {
     pub fn from_runtime_identity(agent_id: AgentId) -> Self {
-        Self(agent_id)
+        Self {
+            agent_id,
+            full_name: None,
+        }
+    }
+
+    pub fn from_runtime_identity_with_source(
+        agent_id: AgentId,
+        workspace: impl std::fmt::Display,
+        team: &str,
+    ) -> Self {
+        let full_name = format!("{}::{}/{}", workspace, team, agent_id.as_str());
+        Self {
+            agent_id,
+            full_name: Some(full_name),
+        }
     }
 
     pub fn leader() -> Self {
-        Self(AgentId::new("leader"))
+        Self {
+            agent_id: AgentId::new("leader"),
+            full_name: None,
+        }
     }
 
     pub fn as_str(&self) -> &str {
-        self.0.as_str()
+        self.agent_id.as_str()
+    }
+
+    pub fn display_name(&self) -> &str {
+        self.full_name.as_deref().unwrap_or_else(|| self.as_str())
+    }
+}
+
+impl serde::Serialize for TrustedSender {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        serializer.serialize_str(self.display_name())
     }
 }
 
@@ -141,7 +174,7 @@ pub fn send_message(
                 "leader",
                 content,
                 opts.task_id.as_ref(),
-                opts.sender.as_str(),
+                opts.sender.display_name(),
                 opts.requires_ack,
                 None,
                 opts.message_id.as_deref(),
@@ -742,7 +775,7 @@ pub fn apply_worker_sender_bypass(
 
 /// `session_drift_refusal` (`session_drift.py:69`):send 时检测会话漂移并拒绝。
 /// `None` = 无漂移 (放行);`Some` = 拒绝 [`DeliveryOutcome`] (reason=`SessionDrift`)。
-pub fn session_drift_refusal(
+pub(crate) fn session_drift_refusal(
     state: &serde_json::Value,
     target: &str,
     leader_id: &str,

package/crates/team-agent/src/messaging/tests/mod.rs

@@ -1,5 +1,10 @@
 #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 use super::*;
+use super::delivery::tmux_pane_width;
+use super::helpers::fail_leader_delivery;
+use super::selftest::evaluate_idle_behavior;
+use super::send::session_drift_refusal;
+use super::watchers::{delivered_result_message, notify_result_watchers};
 use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
 

package/crates/team-agent/src/messaging/types.rs

@@ -407,14 +407,14 @@ pub struct IdleEvaluation {
 
 /// 抑制快照 (card §50;`scheduler.py:383` `_agent_alert_snapshot`)。清除判据靠 snapshot diff。
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct AlertSnapshot {
+pub(crate) struct AlertSnapshot {
     pub assigned_task_ids: Vec<TaskId>,
     pub delivered_message_ids: Vec<String>,
 }
 
 /// 告警抑制条目 (card §50;`scheduler.py:287`)。
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct AlertSuppression {
+pub(crate) struct AlertSuppression {
     pub suppressed_at: String,
     pub suppressed_by: String,
     pub snapshot: AlertSnapshot,

package/crates/team-agent/src/messaging/watchers.rs

@@ -5,12 +5,13 @@ use std::path::Path;
 use rusqlite::{params, OptionalExtension};
 
 use crate::event_log::EventLog;
+use crate::leader::LeaderIncident;
 use crate::message_store::{MessageStore, NotificationClaimParams};
 use crate::model::ids::{TaskId, TeamKey};
 use crate::transport::PaneId;
 
 #[derive(Debug, Clone, PartialEq, Eq)]
-pub struct RecoveryIncident {
+pub(crate) struct RecoveryIncident {
     pub incident_id: String,
     pub occurred_at: String,
 }
@@ -20,7 +21,7 @@ use super::{MessagingError, WatcherNotice, RESULT_DELIVERY_MAX_ATTEMPTS};
 /// `notify_result_watchers` (`result_delivery.py:38`):匹配 + 去重 + (有界) 投递 result 给 leader
 /// watcher。**恰好一次** (Gap 32/38):同 result_id 多 watcher → 1 次注入,余 `superseded`。
 /// 去重唯一原语 = [`MessageStore::claim_leader_notification_delivery`]。`collect`/coordinator tick 调。
-pub fn notify_result_watchers(
+pub(crate) fn notify_result_watchers(
     workspace: &Path,
     result: &serde_json::Value,
     event_log: &EventLog,
@@ -475,20 +476,25 @@ pub fn requeue_after_claim_leader(
 
 pub fn recover_watchers_for_incident(
     workspace: &Path,
-    store: &MessageStore,
     event_log: &EventLog,
     owner_team_id: &TeamKey,
     claimed_pane_id: &PaneId,
-    incident: &RecoveryIncident,
+    incident: LeaderIncident,
 ) -> Result<Vec<WatcherNotice>, MessagingError> {
-    requeue_after_claim_leader(
-        workspace,
-        store,
-        event_log,
-        owner_team_id,
-        claimed_pane_id,
-        Some(&incident.occurred_at),
-    )
+    match incident {
+        LeaderIncident::LeaderAttached => Ok(Vec::new()),
+        LeaderIncident::LeaderClaimed => {
+            let store = MessageStore::open(workspace)?;
+            requeue_after_claim_leader(
+                workspace,
+                &store,
+                event_log,
+                owner_team_id,
+                claimed_pane_id,
+                None,
+            )
+        }
+    }
 }
 
 /// 0.5.5 gate054 round-2: attach-leader (and claim-leader) requeue for leader messages
@@ -601,7 +607,7 @@ pub fn requeue_delivery_exhausted_watchers(
 
 /// `delivered_result_message` (`result_delivery.py:394`):内容级去重 —— 查某 result_id 是否已有
 /// 投递的 leader 通知消息。
-pub fn delivered_result_message(
+pub(crate) fn delivered_result_message(
     store: &MessageStore,
     result_id: &str,
     task_id: Option<&TaskId>,

package/crates/team-agent/src/model/enums.rs

@@ -1,3 +1,4 @@
+//!
 //! §19 散字符串态 → 穷尽 enum。每个 variant 与 Python 字符串**一一对应**(`#[serde]`
 //! rename 到精确字符串),保证 spec/state/event 序列化字节不漂移(§7)。
 //!

package/crates/team-agent/src/model/errors.rs

@@ -1,3 +1,4 @@
+//!
 //! 用户面错误。
 //!
 //! 陷阱 #6(02-model 卡):Python `errors.py` 用自定义 `RuntimeError` **遮蔽**内建

package/crates/team-agent/src/model/ids.rs

@@ -1,3 +1,4 @@
+//!
 //! §3 id newtypes —— Python 把 agent/task/team id 全用裸 `str` 混传(route/owner-gate/
 //! tasks 串台)。newtype 让"混传"编不过。serde `transparent` 保证序列化字节 == 裸字符串。
 

package/crates/team-agent/src/model/mod.rs

@@ -1,3 +1,4 @@
+//!
 //! step 2 · model — typed bedrock (REWRITE_PROMPT.md §6 step 2).
 //!
 //! 纯数据 + 纯函数核心:Python 的散字符串 / `dict[str,Any]` 在此变 §3 id-newtype +

package/crates/team-agent/src/model/name_similarity.rs

@@ -1,3 +1,4 @@
+//!
 //! 0.5.45 naming-addressing (design §3.2/§4.1) — shared pure name
 //! similarity ranking helper.
 //!

package/crates/team-agent/src/model/pane_authority_refusal.rs

@@ -1,3 +1,4 @@
+//!
 //! Shared typed catalog for ambient tmux pane authority refusals.
 //!
 //! This module owns identities and payload shape only. Launchers and CLI

package/crates/team-agent/src/model/paths.rs

@@ -1,3 +1,4 @@
+//!
 //! `.team/` 布局路径(移植 `paths.py` 的 workspace/team-dir 部分)。
 //!
 //! Python 端 `runtime_dir`/`logs_dir`/`artifacts_dir`/`messages_dir` 把 `.team/<sub>`