@team-agent/installer 0.5.75 → 0.5.78

package/crates/team-agent/src/leader/lease.rs

@@ -32,6 +32,11 @@ pub(crate) struct AppliedLeaderGrant {
     pub(crate) receiver: Value,
 }
 
+#[derive(Debug, Default)]
+struct AttachRecovery {
+    blocked_counts: crate::message_store::BlockedLeaderRequeueCounts,
+}
+
 #[derive(Debug)]
 pub(crate) struct AttachLeaderError {
     source: LeaderError,
@@ -92,6 +97,23 @@ pub fn attach_leader(
             "tmux pane not found: {pane_id}"
         )));
     };
+    if let Some(bound) = live_bound_pane_blocking_other_attach(&state, &pane_id, &targets) {
+        let team_id = TeamKey::new(crate::state::projection::team_state_key(&state));
+        emit_lease_refusal(
+            &event_log,
+            LeaseReason::PreviousOwnerAliveRefused,
+            &state,
+            Some(bound.as_str()),
+            Some(pane_id.as_str()),
+            &team_id,
+        )?;
+        return Ok(refused(
+            LeaseReason::PreviousOwnerAliveRefused,
+            "team already has a live owner pane; do not attach-leader from another pane",
+            Some(current_owner_epoch(&state)),
+            Some(bound),
+        ));
+    }
     let mut receiver = receiver_for_attach_target(
         workspace,
         &state,
@@ -102,7 +124,23 @@ pub fn attach_leader(
     if let Some(endpoint) = target.endpoint.as_ref() {
         receiver.tmux_socket = Some(endpoint.clone());
     }
-    let validation = validate_attach_target(workspace, &state, &target.info, provider);
+    let validation = validate_attach_target(
+        workspace,
+        &state,
+        &target.info,
+        provider,
+        target.endpoint.as_deref(),
+    );
+    if validation.is_ok() {
+        copy_verified_grant_from_state(
+            workspace,
+            &state,
+            &target.info,
+            provider,
+            target.endpoint.as_deref(),
+            &mut receiver,
+        );
+    }
     if validation.is_err() {
         let pane_info = pane_info_value(&target.info);
         let targets_value = Value::Array(
@@ -126,8 +164,11 @@ pub fn attach_leader(
             if let Some(endpoint) = target.endpoint.as_deref() {
                 quiet_fake_leader_pane_echo(provider, &target.info, endpoint);
             }
-            let _ =
+            let recovery =
                 requeue_exhausted_watchers_after_attach(workspace, &state, &event_log, &pane_id)?;
+            let team_id = TeamKey::new(crate::state::projection::team_state_key(&state));
+            let attach_window_failures =
+                attach_window_failure_value(recovery.blocked_counts, &team_id, &pane_id);
             return Ok(LeaseResult {
                 ok: true,
                 status: LeaseStatus::Claimed,
@@ -141,6 +182,7 @@ pub fn attach_leader(
                     .map(str::to_string),
                 bound_pane_id: Some(pane_id),
                 topology_convergence: None,
+                attach_window_failures,
             });
         }
         event_log.write(
@@ -165,7 +207,10 @@ pub fn attach_leader(
         if let Some(endpoint) = target.endpoint.as_deref() {
             quiet_fake_leader_pane_echo(provider, &target.info, endpoint);
         }
-        let _ = requeue_exhausted_watchers_after_attach(workspace, &state, &event_log, &pane_id)?;
+        let recovery = requeue_exhausted_watchers_after_attach(workspace, &state, &event_log, &pane_id)?;
+        let team_id = TeamKey::new(crate::state::projection::team_state_key(&state));
+        let attach_window_failures =
+            attach_window_failure_value(recovery.blocked_counts, &team_id, &pane_id);
         return Ok(LeaseResult {
             ok: true,
             status: LeaseStatus::AlreadyBound,
@@ -176,6 +221,7 @@ pub fn attach_leader(
             action: None,
             bound_pane_id: Some(pane_id),
             topology_convergence: None,
+            attach_window_failures,
         });
     }
     let identity = leader_identity_context(workspace, None, Some(&state))?;
@@ -192,7 +238,10 @@ pub fn attach_leader(
     if let Some(endpoint) = target.endpoint.as_deref() {
         quiet_fake_leader_pane_echo(provider, &target.info, endpoint);
     }
-    let _ = requeue_exhausted_watchers_after_attach(workspace, &state, &event_log, &pane_id)?;
+    let recovery = requeue_exhausted_watchers_after_attach(workspace, &state, &event_log, &pane_id)?;
+    let team_id = TeamKey::new(crate::state::projection::team_state_key(&state));
+    let attach_window_failures =
+        attach_window_failure_value(recovery.blocked_counts, &team_id, &pane_id);
     Ok(LeaseResult {
         ok: true,
         status: LeaseStatus::Claimed,
@@ -203,6 +252,7 @@ pub fn attach_leader(
         action: None,
         bound_pane_id: Some(pane_id),
         topology_convergence: None,
+        attach_window_failures,
     })
 }
 
@@ -327,47 +377,45 @@ fn attach_leader_targets(workspace: &Path, state: &Value) -> Vec<AttachLeaderTar
     // leader pane. Keep state-recorded worker endpoints as additional targets,
     // but do not let a cross-socket pane-id collision hide the caller pane.
     if let Some(endpoint) = crate::tmux_backend::socket_name_from_tmux_env() {
-        let backend = tmux_backend_for_endpoint(&endpoint);
-        let resolved_endpoint = backend.tmux_endpoint();
-        targets.extend(
-            backend
-                .list_targets()
-                .unwrap_or_default()
-                .into_iter()
-                .map(|info| AttachLeaderTarget {
-                    info,
-                    endpoint: resolved_endpoint.clone(),
-                }),
+        extend_attach_leader_targets(
+            &mut targets,
+            crate::transport_factory::leader_endpoint_transport(&endpoint).as_ref(),
         );
     }
     for endpoint in state_recorded_tmux_endpoints(state) {
-        let backend = tmux_backend_for_endpoint(&endpoint);
-        let resolved_endpoint = backend.tmux_endpoint();
-        targets.extend(
-            backend
-                .list_targets()
-                .unwrap_or_default()
-                .into_iter()
-                .map(|info| AttachLeaderTarget {
-                    info,
-                    endpoint: resolved_endpoint.clone(),
-                }),
+        extend_attach_leader_targets(
+            &mut targets,
+            crate::transport_factory::leader_endpoint_transport(&endpoint).as_ref(),
         );
     }
     // Phase 1d Batch 6: factory tmux workspace helper for
     // grep-visibility. Semantics unchanged; leader lease discovery is
     // tmux-only (caller pane = tmux pane, MUST-12 anchor).
+    let workspace_backend = crate::transport_factory::tmux_workspace_transport(workspace);
+    let workspace_endpoint = workspace_backend.tmux_endpoint();
+    let workspace_transport: Box<dyn Transport> = match workspace_endpoint
+        .as_deref()
+        .filter(|endpoint| !endpoint.is_empty() && *endpoint != "default")
+    {
+        Some(endpoint) => crate::transport_factory::leader_endpoint_transport(endpoint),
+        None => Box::new(workspace_backend),
+    };
+    extend_attach_leader_targets(&mut targets, workspace_transport.as_ref());
+    targets
+}
+
+fn extend_attach_leader_targets(targets: &mut Vec<AttachLeaderTarget>, transport: &dyn Transport) {
+    let resolved_endpoint = transport.tmux_endpoint();
     targets.extend(
-        crate::transport_factory::tmux_workspace_transport(workspace)
+        transport
             .list_targets()
             .unwrap_or_default()
             .into_iter()
             .map(|info| AttachLeaderTarget {
                 info,
-                endpoint: None,
+                endpoint: resolved_endpoint.clone(),
             }),
     );
-    targets
 }
 
 fn tmux_backend_for_endpoint(endpoint: &str) -> crate::tmux_backend::TmuxBackend {
@@ -441,17 +489,34 @@ fn requeue_exhausted_watchers_after_attach(
     state: &Value,
     event_log: &crate::event_log::EventLog,
     pane_id: &PaneId,
-) -> Result<Vec<crate::messaging::WatcherNotice>, LeaderError> {
+) -> Result<AttachRecovery, LeaderError> {
     let store = MessageStore::open(workspace)?;
     let team_id = TeamKey::new(crate::state::projection::team_state_key(state));
-    let notices = crate::messaging::requeue_delivery_exhausted_watchers(
-        workspace, &store, event_log, &team_id, pane_id,
-    )?;
+    let (notices, blocked_counts) =
+        crate::messaging::watchers::requeue_delivery_exhausted_watchers_with_counts(
+            workspace, &store, event_log, &team_id, pane_id,
+        )?;
     event_log.write(
         super::LeaderEvent::ReceiverRequeuedExhaustedWatchers.name(),
         requeued_exhausted_watchers_event_payload(pane_id, &team_id, &notices),
     )?;
-    Ok(notices)
+    Ok(AttachRecovery { blocked_counts })
+}
+
+fn attach_window_failure_value(
+    counts: crate::message_store::BlockedLeaderRequeueCounts,
+    team_id: &TeamKey,
+    pane_id: &PaneId,
+) -> Option<Value> {
+    (counts.blocked_leader_unbound > 0).then(|| {
+        json!({
+            "team_id": team_id.as_str(),
+            "pane_id": pane_id.as_str(),
+            "reason": "leader_not_attached",
+            "count": counts.blocked_leader_unbound,
+            "status": "requeued_pending_physical_retry",
+        })
+    })
 }
 
 /// R8 D4 (decoupled for offline byte-lock — c-lite): build the `leader_receiver.requeued_exhausted_watchers`
@@ -949,6 +1014,7 @@ fn claim_lease_no_incident_with_target(
             action: None,
             bound_pane_id: Some(caller_pane.clone()),
             topology_convergence,
+            attach_window_failures: None,
         });
     }
     let owner_live = bound_pane_id.as_deref().is_some_and(|pane| {
@@ -1194,6 +1260,7 @@ fn claim_lease_no_incident_with_target(
         action: None,
         bound_pane_id: Some(caller_pane.clone()),
         topology_convergence,
+        attach_window_failures: None,
     })
 }
 
@@ -1452,6 +1519,7 @@ fn convergence_persistence_refusal(
         ),
         bound_pane_id,
         topology_convergence,
+        attach_window_failures: None,
     }
 }
 
@@ -1475,6 +1543,7 @@ fn refused(
         },
         bound_pane_id,
         topology_convergence: None,
+        attach_window_failures: None,
     }
 }
 
@@ -1491,6 +1560,22 @@ fn bound_pane(state: &Value) -> Option<String> {
         .or_else(|| get_path_str(state, &["team_owner", "pane_id"]).filter(|v| !v.is_empty()))
 }
 
+/// Live owner on this socket, different caller pane → ownership conflict,
+/// not "caller pane failed validation". Presence in list-panes is enough;
+/// do not require the owner pane to be the session's active pane.
+fn live_bound_pane_blocking_other_attach(
+    state: &Value,
+    caller: &PaneId,
+    targets: &[AttachLeaderTarget],
+) -> Option<PaneId> {
+    let bound = bound_pane(state)?;
+    if bound == caller.as_str() {
+        return None;
+    }
+    let live = targets.iter().any(|target| target.info.pane_id.as_str() == bound);
+    live.then(|| PaneId::new(bound))
+}
+
 fn bound_endpoint_matches_current_process(state: &Value) -> bool {
     let Some(bound) =
         get_path_str(state, &["leader_receiver", "tmux_socket"]).filter(|v| !v.is_empty())
@@ -1666,8 +1751,16 @@ fn claim_target_from_pane_info(target: &PaneInfo) -> Option<LeaderClaimTarget> {
     if !target.active {
         return None;
     }
+    claim_target_from_observed_pane(target)
+}
+
+fn claim_target_from_observed_pane(target: &PaneInfo) -> Option<LeaderClaimTarget> {
     let provider = super::attribute_pane_provider(target)?;
-    Some(LeaderClaimTarget {
+    Some(claim_target_with_provider(target, provider))
+}
+
+fn claim_target_with_provider(target: &PaneInfo, provider: Provider) -> LeaderClaimTarget {
+    LeaderClaimTarget {
         provider,
         leader_session_uuid: target_leader_session_uuid(target),
         team_id: target
@@ -1680,7 +1773,7 @@ fn claim_target_from_pane_info(target: &PaneInfo) -> Option<LeaderClaimTarget> {
         scope_authority: None,
         authorized_team_workspace: None,
         binding_nonce: None,
-    })
+    }
 }
 
 fn workspace_claim_target_from_pane_info(
@@ -1691,7 +1784,7 @@ fn workspace_claim_target_from_pane_info(
     if !crate::state::owner_gate::workspace_paths_match(current_path, workspace) {
         return None;
     }
-    claim_target_from_pane_info(target)
+    claim_target_from_observed_pane(target)
 }
 
 fn write_claim_target_pane_nonce(target: &mut LeaderClaimTarget) -> Result<(), LeaderError> {
@@ -1787,6 +1880,7 @@ fn validate_attach_target(
     state: &Value,
     target: &PaneInfo,
     requested_provider: Provider,
+    endpoint: Option<&str>,
 ) -> Result<(), &'static str> {
     // 0.5.9 (E6 real-machine e2e wiring): an explicit `--provider fake`
     // is the operator's declaration that this pane is a fake-provider
@@ -1799,13 +1893,28 @@ fn validate_attach_target(
     // provider list, only wired in test/fixture flows.
     let claim_target = match workspace_claim_target_from_pane_info(workspace, target) {
         Some(target) => Some(target),
+        None if grant_allows_attach_target(workspace, state, target, requested_provider, endpoint)
+            || recorded_owner_live_facts_match(
+                workspace,
+                state,
+                target,
+                requested_provider,
+                endpoint,
+            ) =>
+        {
+            Some(
+                claim_target_from_observed_pane(target)
+                    .unwrap_or_else(|| claim_target_with_provider(target, requested_provider)),
+            )
+        }
         None if matches!(requested_provider, Provider::Fake) => None,
         None => return Err("leader_pane_validation_failed"),
     };
     let Some(claim_target) = claim_target else {
-        // Fake provider: skip session-uuid check since attribution was
-        // bypassed. Nothing else to validate.
-        return Ok(());
+        if matches!(requested_provider, Provider::Fake) {
+            return Ok(());
+        }
+        return Err("leader_pane_validation_failed");
     };
     let recorded_uuid = get_path_str(state, &["team_owner", "leader_session_uuid"])
         .or_else(|| get_path_str(state, &["leader_receiver", "leader_session_uuid"]));
@@ -1843,6 +1952,161 @@ fn receiver_for_attach_target(
     ))
 }
 
+fn selected_grant_receiver<'a>(state: &'a Value) -> Option<&'a Value> {
+    let key = crate::state::projection::team_state_key(state);
+    crate::lifecycle::launch::selected_team_leader_receiver(state, &key)
+}
+
+pub(crate) fn grant_allows_attach_target(
+    workspace: &Path,
+    state: &Value,
+    target: &PaneInfo,
+    requested_provider: Provider,
+    endpoint: Option<&str>,
+) -> bool {
+    let Some(receiver) = selected_grant_receiver(state) else {
+        return false;
+    };
+    let authority = receiver
+        .get("scope_authority")
+        .and_then(Value::as_str)
+        .unwrap_or("");
+    if authority != "explicit_claim" && authority != "fresh_caller" {
+        return false;
+    }
+    let Some(authorized) = receiver
+        .get("authorized_team_workspace")
+        .and_then(Value::as_str)
+        .filter(|raw| !raw.is_empty())
+    else {
+        return false;
+    };
+    if !crate::state::owner_gate::workspace_paths_match(Path::new(authorized), workspace) {
+        return false;
+    }
+    let Some(recorded_nonce) = receiver
+        .get("binding_nonce")
+        .and_then(Value::as_str)
+        .filter(|raw| !raw.is_empty())
+    else {
+        return false;
+    };
+    let live_nonce = target
+        .leader_env
+        .get(crate::tmux_backend::PANE_BINDING_NONCE_METADATA_KEY)
+        .map(String::as_str);
+    let pane_ok = receiver.get("pane_id").and_then(Value::as_str) == Some(target.pane_id.as_str());
+    let socket_ok = match (receiver.get("tmux_socket").and_then(Value::as_str), endpoint) {
+        (Some(recorded), Some(actual)) => recorded == actual,
+        (None, _) | (_, None) => false,
+    };
+    let provider_ok = receiver
+        .get("provider")
+        .and_then(Value::as_str)
+        .and_then(crate::provider::wire::parse_provider)
+        == Some(requested_provider);
+    let owner_epoch = get_path_u64(state, &["team_owner", "owner_epoch"])
+        .or_else(|| get_path_u64(state, &["leader_receiver", "owner_epoch"]));
+    let receiver_epoch = receiver.get("owner_epoch").and_then(Value::as_u64);
+    let epoch_ok = match (owner_epoch, receiver_epoch) {
+        (Some(owner), Some(recv)) => owner == recv && owner > 0,
+        _ => false,
+    };
+    pane_ok && socket_ok && live_nonce == Some(recorded_nonce) && provider_ok && epoch_ok
+}
+
+fn recorded_owner_live_facts_match(
+    workspace: &Path,
+    state: &Value,
+    target: &PaneInfo,
+    requested_provider: Provider,
+    endpoint: Option<&str>,
+) -> bool {
+    let current_path = target.current_path.as_deref();
+    let Some(current_path) = current_path else {
+        return false;
+    };
+    if !crate::state::owner_gate::workspace_paths_match(current_path, workspace) {
+        return false;
+    }
+    let receiver = selected_grant_receiver(state);
+    let recorded_pane = get_path_str(state, &["team_owner", "pane_id"])
+        .or_else(|| get_path_str(state, &["leader_receiver", "pane_id"]))
+        .or_else(|| {
+            receiver
+                .and_then(|value| value.get("pane_id"))
+                .and_then(Value::as_str)
+                .map(str::to_string)
+        });
+    if recorded_pane.as_deref() != Some(target.pane_id.as_str()) {
+        return false;
+    }
+    let recorded_socket = get_path_str(state, &["leader_receiver", "tmux_socket"]).or_else(|| {
+        receiver
+            .and_then(|value| value.get("tmux_socket"))
+            .and_then(Value::as_str)
+            .map(str::to_string)
+    });
+    match (recorded_socket.as_deref(), endpoint) {
+        (Some(recorded), Some(actual)) if recorded == actual => {}
+        _ => return false,
+    }
+    let recorded_provider = get_path_str(state, &["team_owner", "provider"])
+        .or_else(|| get_path_str(state, &["leader_receiver", "provider"]))
+        .or_else(|| {
+            receiver
+                .and_then(|value| value.get("provider"))
+                .and_then(Value::as_str)
+                .map(str::to_string)
+        })
+        .and_then(|raw| parse_provider(&raw));
+    if recorded_provider != Some(requested_provider) {
+        return false;
+    }
+    let recorded_uuid = get_path_str(state, &["team_owner", "leader_session_uuid"])
+        .or_else(|| get_path_str(state, &["leader_receiver", "leader_session_uuid"]));
+    let Some(recorded_uuid) = recorded_uuid.filter(|raw| !raw.is_empty()) else {
+        return false;
+    };
+    match target_leader_session_uuid(target) {
+        Some(live_uuid) => live_uuid.as_str() == recorded_uuid,
+        None => true,
+    }
+}
+
+fn copy_verified_grant_from_state(
+    workspace: &Path,
+    state: &Value,
+    target: &PaneInfo,
+    provider: Provider,
+    endpoint: Option<&str>,
+    receiver: &mut LeaderReceiver,
+) {
+    if !grant_allows_attach_target(workspace, state, target, provider, endpoint) {
+        return;
+    }
+    let Some(existing) = selected_grant_receiver(state) else {
+        return;
+    };
+    let authority = existing
+        .get("scope_authority")
+        .and_then(Value::as_str)
+        .filter(|raw| *raw == "explicit_claim" || *raw == "fresh_caller");
+    let nonce = existing
+        .get("binding_nonce")
+        .and_then(Value::as_str)
+        .filter(|raw| !raw.is_empty());
+    let authorized = existing
+        .get("authorized_team_workspace")
+        .and_then(Value::as_str)
+        .filter(|raw| !raw.is_empty());
+    if let (Some(authority), Some(nonce), Some(authorized)) = (authority, nonce, authorized) {
+        receiver.scope_authority = Some(authority.to_string());
+        receiver.binding_nonce = Some(nonce.to_string());
+        receiver.authorized_team_workspace = Some(PathBuf::from(authorized));
+    }
+}
+
 fn pane_info_value(target: &PaneInfo) -> Value {
     let leader_env = target
         .leader_env
@@ -1997,7 +2261,7 @@ fn authorize_fresh_caller_receiver(
     let Some(target) = caller_target else {
         return Ok(());
     };
-    if target.pane_id.as_str() != pane.as_pane_id().as_str() || !target.active {
+    if target.pane_id.as_str() != pane.as_pane_id().as_str() {
         return Err(LeaderError::Validation(
             "fresh caller pane observation does not match the bound pane".to_string(),
         ));
@@ -2873,4 +3137,237 @@ mod tests {
             Some(absolute)
         );
     }
+
+    fn grant_state(endpoint: &str, nonce: &str, epoch: u64, provider: &str) -> Value {
+        json!({
+            "team_owner": {
+                "pane_id": "%1",
+                "provider": provider,
+                "owner_epoch": epoch
+            },
+            "leader_receiver": {
+                "status": "attached",
+                "pane_id": "%1",
+                "provider": provider,
+                "owner_epoch": epoch,
+                "tmux_socket": endpoint,
+                "scope_authority": "fresh_caller",
+                "authorized_team_workspace": "/tmp/grant-ws",
+                "binding_nonce": nonce
+            }
+        })
+    }
+
+    fn grant_pane(nonce: &str) -> PaneInfo {
+        let mut leader_env = std::collections::BTreeMap::new();
+        leader_env.insert(
+            crate::tmux_backend::PANE_BINDING_NONCE_METADATA_KEY.to_string(),
+            nonce.to_string(),
+        );
+        PaneInfo {
+            pane_id: PaneId::new("%1"),
+            session: crate::transport::SessionName::new("s"),
+            window_index: None,
+            window_name: None,
+            pane_index: None,
+            tty: None,
+            current_command: Some("codex".to_string()),
+            current_path: Some(PathBuf::from("/tmp/grant-ws")),
+            active: true,
+            pane_pid: None,
+            leader_env,
+        }
+    }
+
+    #[test]
+    #[serial_test::serial(env)]
+    fn grant_reuses_verified_endpoint() {
+        let workspace = PathBuf::from("/tmp/grant-ws");
+        let state = grant_state("/tmp/leader.sock", "n1", 2, "codex");
+        let pane = grant_pane("n1");
+        let transport = crate::transport::test_support::OfflineTransport::default()
+            .with_tmux_endpoint("/tmp/leader.sock")
+            .with_targets(vec![pane.clone()]);
+        crate::transport_factory::with_leader_endpoint_transport(
+            "/tmp/leader.sock",
+            transport,
+            || {
+                let targets = attach_leader_targets(&workspace, &state);
+                let target = targets
+                    .iter()
+                    .find(|target| {
+                        target.info.pane_id.as_str() == "%1"
+                            && target.endpoint.as_deref() == Some("/tmp/leader.sock")
+                    })
+                    .expect("attach_leader_targets must discover the recorded endpoint");
+                assert!(grant_allows_attach_target(
+                    &workspace,
+                    &state,
+                    &target.info,
+                    crate::provider::Provider::Codex,
+                    target.endpoint.as_deref(),
+                ));
+                let mut receiver = crate::leader::LeaderReceiver {
+                    mode: crate::leader::ReceiverMode::DirectTmux,
+                    status: crate::leader::ReceiverStatus::Attached,
+                    provider: crate::provider::Provider::Codex,
+                    pane_id: PaneId::new("%1"),
+                    session_name: None,
+                    window_index: None,
+                    window_name: None,
+                    pane_index: None,
+                    pane_tty: None,
+                    pane_current_command: None,
+                    tmux_socket: None,
+                    scope_authority: None,
+                    authorized_team_workspace: None,
+                    binding_nonce: None,
+                    fingerprint: None,
+                    leader_session_uuid: None,
+                    owner_epoch: None,
+                    attached_at: None,
+                    discovery: None,
+                    requested_provider: None,
+                    warning: None,
+                };
+                copy_verified_grant_from_state(
+                    &workspace,
+                    &state,
+                    &target.info,
+                    crate::provider::Provider::Codex,
+                    target.endpoint.as_deref(),
+                    &mut receiver,
+                );
+                assert_eq!(receiver.binding_nonce.as_deref(), Some("n1"));
+                assert_eq!(receiver.scope_authority.as_deref(), Some("fresh_caller"));
+            },
+        );
+    }
+
+    #[test]
+    fn claim_leader_discovery_still_requires_focus() {
+        let mut pane = grant_pane("n1");
+        pane.active = false;
+        pane.current_command = Some("codex".to_string());
+        assert!(
+            claim_target_from_pane_info(&pane).is_none(),
+            "claim-leader discovery must keep pane_active; attach validation uses observed pane"
+        );
+        assert!(claim_target_from_observed_pane(&pane).is_some());
+    }
+
+    #[test]
+    fn grant_rejects_wrong_socket_same_pane() {
+        let workspace = PathBuf::from("/tmp/grant-ws");
+        let state = grant_state("/tmp/leader.sock", "n1", 2, "codex");
+        let pane = grant_pane("n1");
+        assert!(!grant_allows_attach_target(
+            &workspace,
+            &state,
+            &pane,
+            crate::provider::Provider::Codex,
+            Some("/tmp/other.sock"),
+        ));
+    }
+
+    #[test]
+    fn grant_rejects_missing_epoch() {
+        let workspace = PathBuf::from("/tmp/grant-ws");
+        let mut state = grant_state("/tmp/leader.sock", "n1", 2, "codex");
+        state["leader_receiver"]
+            .as_object_mut()
+            .unwrap()
+            .remove("owner_epoch");
+        let pane = grant_pane("n1");
+        assert!(!grant_allows_attach_target(
+            &workspace,
+            &state,
+            &pane,
+            crate::provider::Provider::Codex,
+            Some("/tmp/leader.sock"),
+        ));
+    }
+
+    #[test]
+    fn grant_rejects_wrong_nonce_and_provider() {
+        let workspace = PathBuf::from("/tmp/grant-ws");
+        let state = grant_state("/tmp/leader.sock", "n1", 2, "codex");
+        let pane = grant_pane("other-nonce");
+        assert!(!grant_allows_attach_target(
+            &workspace,
+            &state,
+            &pane,
+            crate::provider::Provider::Codex,
+            Some("/tmp/leader.sock"),
+        ));
+        let pane = grant_pane("n1");
+        assert!(!grant_allows_attach_target(
+            &workspace,
+            &state,
+            &pane,
+            crate::provider::Provider::Copilot,
+            Some("/tmp/leader.sock"),
+        ));
+    }
+
+    fn listed(pane: &str) -> AttachLeaderTarget {
+        AttachLeaderTarget {
+            info: PaneInfo {
+                pane_id: PaneId::new(pane),
+                session: crate::transport::SessionName::new("leader"),
+                window_index: None,
+                window_name: None,
+                pane_index: None,
+                tty: None,
+                current_command: None,
+                current_path: None,
+                active: pane == "%6",
+                pane_pid: None,
+                leader_env: std::collections::BTreeMap::new(),
+            },
+            endpoint: Some("/tmp/ta.sock".to_string()),
+        }
+    }
+
+    #[test]
+    fn live_owner_blocks_other_pane_even_if_owner_is_not_active() {
+        // R3 same-socket: owner %0 exists (pane_dead=0) but is not the
+        // session's active pane; caller %6 must not skip to pane validation.
+        let state = serde_json::json!({
+            "leader_receiver": {"pane_id": "%0", "owner_epoch": 1},
+            "team_owner": {"pane_id": "%0", "owner_epoch": 1},
+        });
+        let targets = vec![listed("%0"), listed("%6")];
+        let blocked =
+            live_bound_pane_blocking_other_attach(&state, &PaneId::new("%6"), &targets);
+        assert_eq!(blocked, Some(PaneId::new("%0")));
+    }
+
+    #[test]
+    fn live_owner_does_not_block_attach_from_bound_pane() {
+        let state = serde_json::json!({
+            "leader_receiver": {"pane_id": "%0"},
+        });
+        let targets = vec![listed("%0"), listed("%6")];
+        assert!(live_bound_pane_blocking_other_attach(
+            &state,
+            &PaneId::new("%0"),
+            &targets,
+        )
+        .is_none());
+    }
+
+    #[test]
+    fn missing_owner_pane_is_not_treated_as_live_conflict() {
+        let state = serde_json::json!({
+            "leader_receiver": {"pane_id": "%0"},
+        });
+        let targets = vec![listed("%6")];
+        assert!(live_bound_pane_blocking_other_attach(
+            &state,
+            &PaneId::new("%6"),
+            &targets,
+        )
+        .is_none());
+    }
 }