@team-agent/installer 0.5.74 → 0.5.77

package/crates/team-agent/src/lifecycle/launch/spawn.rs

@@ -277,6 +277,10 @@ pub(super) fn spawn_agents(
                 provider,
             ),
         );
+        // The provider is the final typed value after profile overlays. Keep it
+        // separate from inherited LEADER_* identity and let the tmux invocation
+        // boundary add the actual pane/socket only for the provider process.
+        crate::layout::worker_env::inject_current_caller_provider(&mut env, provider);
         // BUG / C-1-2 / C-6-1 cr verdict — Copilot system_prompt 走 spawn env overlay +
         // per-worker AGENTS.md(B2 灵魂件降级):写
         //   <workspace>/.team/runtime/copilot-instructions/<agent_id>/AGENTS.md

package/crates/team-agent/src/lifecycle/launch/spec_state.rs

@@ -51,6 +51,10 @@
 //! sites can reference the phases by name. The phase fns themselves
 //! remain in launch.rs until the next batch of relocations.
 
+#[cfg(test)]
+#[path = "../../../tests/support/hermetic.rs"]
+mod hermetic;
+
 use std::collections::{BTreeMap, BTreeSet};
 use std::path::{Path, PathBuf};
 use std::process::Command;
@@ -66,16 +70,14 @@ use crate::transport::{PaneId, SessionName, Target, Transport, WindowName};
 use crate::lifecycle::lock::{acquire_agent_lifecycle_lock, LifecycleLockRequest};
 
 use super::identity::spec_display_backend;
-use super::leader_context::{
-    attributed_provider_for_pane_across_tmux_sockets, caller_provider_for_seed_with_lookup,
-    seed_unbound_launched_owner,
-};
+use super::leader_context::{caller_provider_for_seed_with_lookup, seed_unbound_launched_owner};
 use super::worker_env::spawn_timestamp;
 
 /// ---
 /// purpose: 由 spec 生成首份 runtime state 树
 /// params:
 ///   team_key: 本团队的 runtime 键
+///   scoped_endpoint: 本次起队已选中的 transport tmux endpoint，与 fresh bind 同源
 /// returns: 含 spec_path、workspace、team_dir、session_name、leader、agents、tasks 与 display_backend 的 state；随后按环境种入 launched owner，种不到则种一份 unbound owner
 /// ---
 pub(super) fn initial_runtime_state(
@@ -84,6 +86,7 @@ pub(super) fn initial_runtime_state(
     workspace: &Path,
     team_dir: &Path,
     team_key: &str,
+    scoped_endpoint: Option<&str>,
 ) -> serde_json::Value {
     let mut agents = serde_json::Map::new();
     for agent in spec_agent_values(spec) {
@@ -144,7 +147,7 @@ pub(super) fn initial_runtime_state(
     );
     state.insert("is_external_leader".to_string(), serde_json::json!(false));
     let mut state = serde_json::Value::Object(state);
-    if !seed_launched_owner_from_env(&mut state) {
+    if !seed_launched_owner_from_env(&mut state, scoped_endpoint) {
         let team_id = crate::state::projection::team_state_key(&state);
         seed_unbound_launched_owner(&mut state, &team_id);
     }
@@ -157,9 +160,12 @@ pub(super) fn initial_runtime_state(
 ///   state: 待改写的 state，成功时写入 owner 与 leader receiver
 /// returns: true 表示已种入，取不到 caller 身份或无 pane 时为 false
 /// ---
-pub(super) fn seed_launched_owner_from_env(state: &mut serde_json::Value) -> bool {
+pub(super) fn seed_launched_owner_from_env(
+    state: &mut serde_json::Value,
+    scoped_endpoint: Option<&str>,
+) -> bool {
     let team_id = crate::state::projection::team_state_key(state);
-    let Ok(caller) = crate::state::identity::caller_identity_from_env(
+    let Ok(mut caller) = crate::state::identity::caller_identity_from_env(
         Some(state),
         &crate::state::identity::SystemEnv,
         Some(&team_id),
@@ -167,11 +173,27 @@ pub(super) fn seed_launched_owner_from_env(state: &mut serde_json::Value) -> boo
     ) else {
         return false;
     };
-    seed_launched_owner_from_caller_with_provider_lookup(
-        state,
-        caller,
-        attributed_provider_for_pane_across_tmux_sockets,
-    )
+    let current_pane = std::env::var("TMUX_PANE")
+        .ok()
+        .filter(|pane| !pane.is_empty());
+    let current_endpoint = crate::tmux_backend::socket_name_from_tmux_env();
+    match crate::layout::worker_env::caller_provider_resolution(
+        current_pane.as_deref(),
+        current_endpoint.as_deref(),
+        scoped_endpoint,
+    ) {
+        crate::layout::worker_env::CallerProviderResolution::Invalid => return false,
+        crate::layout::worker_env::CallerProviderResolution::Valid(provider) => {
+            caller.provider = crate::provider::wire::provider_wire(provider).to_string();
+        }
+        crate::layout::worker_env::CallerProviderResolution::Absent => {}
+    }
+    // Absent keeps the existing explicit/direct pane path. Do not unbind a
+    // caller TMUX_PANE just because launcher context and LEADER_PROVIDER are
+    // both missing; that is the external-leader same-id-across-sockets case.
+    // Invalid already returned. Do not replace a missing provider with broad
+    // pane/process attribution.
+    seed_launched_owner_from_caller_with_provider_lookup(state, caller, |_| None)
 }
 
 /// ---
@@ -619,9 +641,13 @@ pub(super) fn team_workspace(team_dir: &Path) -> PathBuf {
 
 #[cfg(test)]
 mod tests {
-    #![allow(clippy::unwrap_used)]
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
     use super::*;
+    use crate::layout::worker_env::{CALLER_ENDPOINT_ENV, CALLER_PANE_ENV, CALLER_PROVIDER_ENV};
     use crate::model::enums::Provider;
+    use serde_json::json;
+
+    use super::hermetic::HermeticTestEnv;
 
     fn yaml_agent(bypass: bool) -> Value {
         crate::model::yaml::loads(&format!(
@@ -651,4 +677,103 @@ mod tests {
         assert!(!safety.enabled);
         assert_eq!(safety.source, DangerousApprovalSource::Disabled);
     }
+
+    fn seed_state() -> serde_json::Value {
+        json!({
+            "team_key": "verify031",
+            "workspace": "/tmp/ws",
+            "session_name": "team-verify031",
+            "agents": {}
+        })
+    }
+
+    fn owner_pane(state: &serde_json::Value) -> Option<&str> {
+        state
+            .pointer("/teams/verify031/team_owner/pane_id")
+            .and_then(serde_json::Value::as_str)
+    }
+
+    fn owner_provider(state: &serde_json::Value) -> Option<&str> {
+        state
+            .pointer("/teams/verify031/team_owner/provider")
+            .and_then(serde_json::Value::as_str)
+    }
+
+    fn receiver_pane(state: &serde_json::Value) -> Option<&str> {
+        state
+            .pointer("/teams/verify031/leader_receiver/pane_id")
+            .and_then(serde_json::Value::as_str)
+    }
+
+    #[test]
+    #[serial_test::serial(env)]
+    fn seed_absent_caller_keeps_direct_tmux_pane_without_unbinding() {
+        let hermetic = HermeticTestEnv::enter("seed-absent-direct-pane");
+        let _tmux = hermetic.with_env("TMUX", "/tmp/default-tmux-socket,123,0");
+        let _pane = hermetic.with_env("TMUX_PANE", "%0");
+        let mut state = seed_state();
+        assert!(
+            seed_launched_owner_from_env(&mut state, Some("/tmp/product-team.sock")),
+            "Absent caller context must still seed the caller's TMUX_PANE; state={state}"
+        );
+        assert_eq!(owner_pane(&state), Some("%0"));
+        assert_eq!(receiver_pane(&state), Some("%0"));
+        assert!(
+            owner_provider(&state).is_none(),
+            "direct pane seed must not invent a provider; state={state}"
+        );
+    }
+
+    #[test]
+    #[serial_test::serial(env)]
+    fn seed_valid_caller_uses_typed_provider_and_same_scoped_endpoint() {
+        let hermetic = HermeticTestEnv::enter("seed-valid-scoped");
+        let _tmux = hermetic.with_env("TMUX", "/tmp/tmux.sock,1,0");
+        let _pane = hermetic.with_env("TMUX_PANE", "%1");
+        let _provider = hermetic.with_env(CALLER_PROVIDER_ENV, "pi");
+        let _caller_pane = hermetic.with_env(CALLER_PANE_ENV, "%1");
+        let _caller_endpoint = hermetic.with_env(CALLER_ENDPOINT_ENV, "/tmp/tmux.sock");
+        let mut state = seed_state();
+        assert!(seed_launched_owner_from_env(
+            &mut state,
+            Some("/tmp/tmux.sock")
+        ));
+        assert_eq!(owner_pane(&state), Some("%1"));
+        assert_eq!(owner_provider(&state), Some("pi"));
+        assert_eq!(receiver_pane(&state), Some("%1"));
+    }
+
+    #[test]
+    #[serial_test::serial(env)]
+    fn seed_invalid_caller_does_not_fall_back_to_direct_pane() {
+        let hermetic = HermeticTestEnv::enter("seed-invalid-scoped");
+        let _tmux = hermetic.with_env("TMUX", "/tmp/tmux.sock,1,0");
+        let _pane = hermetic.with_env("TMUX_PANE", "%1");
+        let _provider = hermetic.with_env(CALLER_PROVIDER_ENV, "pi");
+        let _caller_pane = hermetic.with_env(CALLER_PANE_ENV, "%1");
+        let _caller_endpoint = hermetic.with_env(CALLER_ENDPOINT_ENV, "/tmp/tmux.sock");
+        let mut state = seed_state();
+        assert!(
+            !seed_launched_owner_from_env(&mut state, Some("/tmp/product.sock")),
+            "scoped endpoint mismatch must fail closed; state={state}"
+        );
+        assert!(owner_pane(&state).is_none(), "state={state}");
+        assert!(receiver_pane(&state).is_none(), "state={state}");
+    }
+
+    #[test]
+    #[serial_test::serial(env)]
+    fn seed_absent_keeps_explicit_leader_provider() {
+        let hermetic = HermeticTestEnv::enter("seed-absent-explicit");
+        let _tmux = hermetic.with_env("TMUX", "/tmp/tmux.sock,1,0");
+        let _pane = hermetic.with_env("TMUX_PANE", "%3");
+        let _leader = hermetic.with_env("TEAM_AGENT_LEADER_PROVIDER", "pi");
+        let mut state = seed_state();
+        assert!(seed_launched_owner_from_env(
+            &mut state,
+            Some("/tmp/tmux.sock")
+        ));
+        assert_eq!(owner_pane(&state), Some("%3"));
+        assert_eq!(owner_provider(&state), Some("pi"));
+    }
 }

package/crates/team-agent/src/lifecycle/restart/common.rs

@@ -523,6 +523,9 @@ pub(super) fn spawn_agent_window(
             provider,
         ),
     );
+    // Keep the launcher-known typed provider independent from inherited
+    // LEADER_* identity. The tmux wrapper binds pane/socket at invocation time.
+    crate::layout::worker_env::inject_current_caller_provider(&mut env, provider);
 
     // 0.4.6 Stage 2: write actual spawn plan event BEFORE invoking the
     // transport spawn. Mirrors `launch.rs:359-380` (the reference impl)

package/crates/team-agent/src/lifecycle/restart/rebuild.rs

@@ -1303,7 +1303,7 @@ fn restart_with_selected_team_and_transport(
         )?;
         // 0.3.30 Bug 1: auto-attach on partial restart too — workers that did
         // come up still need a leader_receiver pane to deliver report_result.
-        try_autobind_leader_after_restart(
+        let attach_window_failures = try_autobind_leader_after_restart(
             &selected.run_workspace,
             Some(selected.team_key.as_str()),
             &state,
@@ -1316,6 +1316,7 @@ fn restart_with_selected_team_and_transport(
             coordinator,
             next_actions,
             attach_commands,
+            attach_window_failures,
         });
     }
     phase_timer.emit(&selected.run_workspace, "restart.phase", "completed");
@@ -1331,7 +1332,8 @@ fn restart_with_selected_team_and_transport(
     // invoked from a tmux pane should bind that pane as leader_receiver,
     // restoring the worker→leader delivery path. Failure is non-fatal — the
     // user can still run `team-agent attach-leader` manually.
-    try_autobind_leader_after_restart(&selected.run_workspace, Some(&selected.team_key), &state);
+    let attach_window_failures =
+        try_autobind_leader_after_restart(&selected.run_workspace, Some(&selected.team_key), &state);
     if let Ok(probe) = crate::lifecycle::display::probe_display_capabilities(&selected.run_workspace)
     {
         let _ = crate::lifecycle::display::rebuild_adaptive_display_after_rebind(
@@ -1352,6 +1354,7 @@ fn restart_with_selected_team_and_transport(
         coordinator,
         next_actions,
         attach_commands,
+        attach_window_failures,
     })
 }
 
@@ -1825,9 +1828,9 @@ fn try_autobind_leader_after_restart(
     workspace: &std::path::Path,
     team: Option<&str>,
     state: &serde_json::Value,
-) {
+) -> Option<serde_json::Value> {
     if std::env::var_os("TMUX_PANE").is_none() {
-        return;
+        return None;
     }
     // Provider: prefer the existing team_owner.provider (if rebind),
     // else leader_receiver.provider (stale, but still informative),
@@ -1854,6 +1857,7 @@ fn try_autobind_leader_after_restart(
     let team_str = team;
     match crate::leader::attach_leader(workspace, team_str, None, provider) {
         Ok(result) if result.ok => {
+            let debt = result.attach_window_failures.clone();
             let _ = crate::leader::registry::register_binding_from_state_best_effort(
                 workspace,
                 team_str,
@@ -1864,18 +1868,21 @@ fn try_autobind_leader_after_restart(
                 result.bound_pane_id.as_ref().map(|p| p.as_str()),
                 team_str,
             );
+            debt
         }
         Ok(result) => {
             eprintln!(
                 "team_agent::restart auto_attach_leader skipped reason={:?} team={:?}",
                 result.reason, team_str,
             );
+            None
         }
         Err(error) => {
             eprintln!(
                 "team_agent::restart auto_attach_leader failed error={error} team={team_str:?} \
                  (run `team-agent attach-leader` from your tmux pane to bind manually)",
             );
+            None
         }
     }
 }

package/crates/team-agent/src/lifecycle/tests/b0_reader_hideone_audit_contract.rs

@@ -18,6 +18,8 @@ mod hermetic_guard;
 
 #[path = "../../../tests/support/composite_source.rs"]
 mod composite_source;
+#[path = "../../../tests/support/brief_probe.rs"]
+mod brief_probe;
 use std::path::{Path, PathBuf};
 
 use serde_json::{json, Value};
@@ -97,6 +99,18 @@ fn stale_snapshot_cannot_flip_status_or_diagnose_ok_readiness() {
     let case = B0HideOneCase::new("status-diagnose-hide-one");
     let root = case.current_state();
     save_runtime_state(&case.workspace, &root).expect("seed current root state");
+    let probe = brief_probe::install_trusted_nodeprobe(
+        &case.workspace.join("probe"),
+        NEW_ENDPOINT,
+        SESSION,
+        WORKER,
+        "%new",
+        "fake",
+    );
+    let _path = case.env.with_env(
+        "PATH",
+        &brief_probe::path_with_probe(&probe, std::env::var_os("PATH").as_deref()),
+    );
 
     let status_before = case.run_json(&[
         "status",
@@ -136,10 +150,20 @@ fn stale_snapshot_cannot_flip_status_or_diagnose_ok_readiness() {
         "--json",
     ]);
 
-    assert_eq!(
-        status_after.pointer("/agents/worker/pane_id").and_then(Value::as_str),
-        Some("%new"),
-        "F0-3 RED3: status must not display the stale snapshot pane as the worker authority; before={status_before} after={status_after}"
+    let node = brief_node(&status_after).unwrap_or_else(|| {
+        panic!("F0-3 RED3: status must retain the worker in the seven-field projection; before={status_before} after={status_after}")
+    });
+    assert_eq!(node.get("name").and_then(Value::as_str), Some(WORKER));
+    assert_eq!(node.get("provider").and_then(Value::as_str), Some("fake"));
+    assert_eq!(node.get("runtime_status").and_then(Value::as_str), Some("running"));
+    assert_eq!(node.get("activity").and_then(Value::as_str), Some("idle"));
+    assert_eq!(node.get("health").and_then(Value::as_str), Some("normal"));
+    assert_eq!(node.get("session_name").and_then(Value::as_str), Some(SESSION));
+    assert!(
+        node.get("tmux_command")
+            .and_then(Value::as_str)
+            .is_some_and(|command| command.contains(NEW_ENDPOINT) && command.contains("team-b0-hideone:worker.%new")),
+        "F0-3 RED3: trusted root probe must produce a non-empty exact endpoint command; node={node}"
     );
     assert_eq!(
         worker_status_tuple(&status_before),
@@ -333,18 +357,25 @@ impl B0HideOneCase {
     }
 }
 
+fn brief_node(status: &Value) -> Option<&Value> {
+    status
+        .get("nodes")
+        .and_then(Value::as_array)
+        .and_then(|nodes| nodes.iter().find(|node| {
+            node.get("name").and_then(Value::as_str) == Some(WORKER)
+        }))
+}
+
 fn worker_status_tuple(status: &Value) -> Value {
-    let worker = status
-        .get("agents")
-        .and_then(Value::as_object)
-        .and_then(|agents| agents.get(WORKER))
-        .cloned()
-        .unwrap_or(Value::Null);
+    let worker = brief_node(status).cloned().unwrap_or(Value::Null);
     json!({
-        "ok": status.get("ok").cloned().unwrap_or(Value::Null),
-        "pane_id": worker.get("pane_id").cloned().unwrap_or(Value::Null),
-        "status": worker.get("status").cloned().unwrap_or(Value::Null),
-        "readiness": status.get("readiness").cloned().unwrap_or(Value::Null),
+        "name": worker.get("name").cloned().unwrap_or(Value::Null),
+        "provider": worker.get("provider").cloned().unwrap_or(Value::Null),
+        "runtime_status": worker.get("runtime_status").cloned().unwrap_or(Value::Null),
+        "activity": worker.get("activity").cloned().unwrap_or(Value::Null),
+        "health": worker.get("health").cloned().unwrap_or(Value::Null),
+        "session_name": worker.get("session_name").cloned().unwrap_or(Value::Null),
+        "tmux_command": worker.get("tmux_command").cloned().unwrap_or(Value::Null),
     })
 }
 

package/crates/team-agent/src/lifecycle/tests/clone_agent_preserves_source_tools.rs

@@ -234,6 +234,7 @@ fn clone_ok(case: &Case, source: &str, dest: &str) {
 
 /// clone 后分身 role + spec tools 必须等于源席；三件套源不得被扩成六件。
 #[test]
+#[serial_test::serial(env)]
 fn clone_agent_preserves_source_tools() {
     let case = Case::start();
     let qs = case.run(&[

package/crates/team-agent/src/lifecycle/tests/harvest2_a_batch_red.rs

@@ -425,7 +425,7 @@ check behind it = false green); it must reflect an actual doctor result"
 /// Mutates the process-global PATH/HOME — must not race host_cotenant's ps/tmux
 /// shims (P0 pid-probe isolation), hence `#[serial(pid_probe)]`.
 #[test]
-#[serial(pid_probe)]
+#[serial(env, pid_probe)]
 fn t3_claude_auth_hint_parse_failure_is_not_present() {
     let home = tmp_ws("t3-auth-home");
     let shim_dir = home.join("bin");

package/crates/team-agent/src/lifecycle/tests/phase_golden.rs

@@ -1,8 +1,8 @@
 use super::launch_spawn::seed_healthy_coordinator;
 use super::*;
 use crate::cli::{
-    cmd_collect, cmd_send, cmd_status, lifecycle_port, CmdOutput, CmdResult, CollectArgs, SendArgs,
-    StatusArgs,
+    cmd_collect, cmd_diagnose, cmd_send, cmd_status, lifecycle_port, CmdOutput, CmdResult,
+    CollectArgs, DiagnoseArgs, SendArgs, StatusArgs,
 };
 use crate::transport::test_support::OfflineTransport;
 use crate::transport::WindowName;
@@ -176,29 +176,28 @@ fn phase_f_golden_events_state_status_zero_drift() {
 #[test]
 #[serial_test::serial(env)]
 fn phase_golden_unbound_not_ready_requires_claim_leader() {
-    // 已废除的行为：旧实现只说不 ready、不说怎么恢复，把人晾在原地。此断言证明它确实没了。
-    // Independent of golden.json so a later regenerate cannot erase it.
-    // Companion status keys grok_slot ← 77bddb95 / 0c319cca; next_action ← 080903a2.
-    let compact = run_compact_status_after_quick_start();
-    let not_ready = compact
-        .get("not_ready")
-        .and_then(Value::as_object)
-        .unwrap_or_else(|| panic!("compact must carry not_ready; got {compact}"));
-    let reasons = not_ready
-        .get("reasons")
+    // Unbound recovery guidance belongs to the diagnose/quick-start refusal
+    // surface, not to the seven-field status brief.
+    let diagnose = run_diagnose_after_quick_start();
+    let issues = diagnose
+        .get("issues")
         .and_then(Value::as_array)
         .cloned()
         .unwrap_or_default();
     assert!(
-        reasons
-            .iter()
-            .any(|reason| reason.as_str() == Some("leader_receiver_unbound")),
-        "tombstone fixture must still produce leader_receiver_unbound; not_ready={not_ready:?}"
+        issues.iter().any(|issue| {
+            issue.as_str() == Some("leader_not_attached")
+                || issue.get("id").and_then(Value::as_str) == Some("leader_channel_unbound")
+        }),
+        "tombstone fixture must still diagnose leader_receiver_unbound; diagnose={diagnose}"
     );
-    assert_eq!(
-        not_ready.get("next_action").and_then(Value::as_str),
-        Some("claim-leader"),
-        "when not_ready.reasons contains leader_receiver_unbound, next_action must be claim-leader; not_ready={not_ready:?}"
+    let repairs = diagnose
+        .get("suggested_repairs")
+        .map(Value::to_string)
+        .unwrap_or_default();
+    assert!(
+        repairs.contains("claim-leader"),
+        "diagnose must retain claim-leader recovery guidance; diagnose={diagnose}"
     );
 }
 
@@ -474,7 +473,7 @@ fn strip_full_line_json_comments(text: &str) -> String {
         .join("\n")
 }
 
-fn run_compact_status_after_quick_start() -> Value {
+fn run_diagnose_after_quick_start() -> Value {
     let hermetic = HermeticTestEnv::enter("tombstone-claim-leader");
     let _permission_mode = EnvVarGuard::set(ANCESTRY_ENV, "[]");
     let team = two_worker_team_dir(&hermetic);
@@ -491,20 +490,17 @@ fn run_compact_status_after_quick_start() -> Value {
         false,
     )
     .expect("tombstone fixture must quick-start");
-    let status = cmd_status(&StatusArgs {
-        agent: None,
+    let diagnose = cmd_diagnose(&DiagnoseArgs {
         workspace,
-        detail: false,
-        summary: false,
         json: true,
         team: Some("teamdir".to_string()),
     });
-    match cmd_value(status) {
+    match cmd_value(diagnose) {
         Value::Object(map) => map
             .get("output")
             .cloned()
-            .unwrap_or_else(|| panic!("compact status missing output")),
-        other => panic!("compact status must be a JSON object, got {other}"),
+            .unwrap_or_else(|| panic!("diagnose missing output")),
+        other => panic!("diagnose must be a JSON object, got {other}"),
     }
 }
 

package/crates/team-agent/src/lifecycle/tests/upgrade_compat_0211_red.rs

@@ -72,12 +72,19 @@ fn upgrade_0211_state_team_key_runtime_key_not_spec_name() {
         },
         Some(TEAM_KEY),
     ));
+    let node_names = status
+        .get("nodes")
+        .and_then(Value::as_array)
+        .expect("status brief must expose nodes")
+        .iter()
+        .filter_map(|node| node.get("name").and_then(Value::as_str))
+        .collect::<Vec<_>>();
     assert!(
-        status.pointer("/agents/upgrade_worker").is_some(),
+        node_names.contains(&"upgrade_worker"),
         "status --team upgrade-key must project the runtime-key team; status={status}"
     );
     assert!(
-        status.pointer("/agents/sibling_worker").is_none(),
+        !node_names.contains(&"sibling_worker"),
         "status --team upgrade-key must not collapse to sibling/spec-name state; status={status}"
     );
 }
@@ -216,15 +223,20 @@ fn upgrade_status_collect_scope_by_selected_team_key() {
         },
         Some(TEAM_KEY),
     ));
-    assert_eq!(
-        status.pointer("/results/total").and_then(Value::as_i64),
-        Some(2),
-        "status --team upgrade-key must count only upgrade-key results and exclude sibling rows; status={status}"
+    let node_names = status
+        .get("nodes")
+        .and_then(Value::as_array)
+        .expect("status brief must expose nodes")
+        .iter()
+        .filter_map(|node| node.get("name").and_then(Value::as_str))
+        .collect::<Vec<_>>();
+    assert!(
+        node_names.contains(&"upgrade_worker"),
+        "status --team upgrade-key must retain the selected runtime-key node; status={status}"
     );
-    assert_eq!(
-        status.pointer("/messages/accepted").and_then(Value::as_i64),
-        Some(1),
-        "status --team upgrade-key must count only upgrade-key messages; status={status}"
+    assert!(
+        !node_names.contains(&"sibling_worker"),
+        "status --team upgrade-key must not expose sibling rows; status={status}"
     );
 
     let collect = json_output(cmd_collect_for_team(