@team-agent/installer 0.5.77 → 0.5.80

package/crates/team-agent/src/messaging/tests/leader_inject_acceptance.rs

@@ -556,3 +556,130 @@ impl Transport for RecordingTransport {
         Ok(AttachOutcome::Attached)
     }
 }
+
+#[test]
+fn resource188_batch_and_public_single_prepare_once_and_keep_fresh_leader_load() {
+    use crate::messaging::delivery::preparation_probe::COUNTS;
+    for batch in [true, false] {
+        let case = Case::new(if batch { "188-batch" } else { "188-single" });
+        let transport = RecordingTransport::new("");
+        let message = case
+            .store
+            .create_message(
+                None,
+                "worker",
+                "leader",
+                "count",
+                None,
+                false,
+                Some("acceptance-team"),
+            )
+            .unwrap();
+        COUNTS.with(|counts| counts.set((0, 0, 0)));
+        if batch {
+            deliver_pending_messages(&case.workspace, &case.state, &transport, &case.event_log)
+                .unwrap();
+        } else {
+            deliver_pending_message(
+                &case.workspace,
+                &case.store,
+                &transport,
+                &message,
+                &case.event_log,
+                &case.state,
+            )
+            .unwrap();
+        }
+        assert_eq!(
+            COUNTS.with(|counts| counts.get()),
+            (1, 2, 1),
+            "one preparation, pre/post-claim projections, one claim"
+        );
+        assert_eq!(transport.inject_count(), 1);
+        assert_eq!(
+            case.message_status(&message),
+            "submitted_pending_acceptance"
+        );
+    }
+}
+
+#[test]
+fn resource188_busy_and_refused_candidates_prepare_once_without_claiming() {
+    use crate::messaging::delivery::preparation_probe::COUNTS;
+    let mut case = Case::new("188-busy");
+    case.state["agents"] = serde_json::json!({"worker": {"agent_id": "worker", "status": "busy"}});
+    case.state["teams"] =
+        serde_json::json!({"acceptance-team": {"agents": case.state["agents"].clone()}});
+    crate::state::persist::save_runtime_state(&case.workspace, &case.state).unwrap();
+    let transport = RecordingTransport::new("");
+    let busy = case
+        .store
+        .create_message(
+            None,
+            "leader",
+            "worker",
+            "busy",
+            None,
+            false,
+            Some("acceptance-team"),
+        )
+        .unwrap();
+    let refused = case
+        .store
+        .create_message(
+            None,
+            "leader",
+            "worker",
+            "refuse",
+            None,
+            false,
+            Some("missing-team"),
+        )
+        .unwrap();
+    let before = case.message_status(&busy);
+    COUNTS.with(|counts| counts.set((0, 0, 0)));
+    deliver_pending_messages(&case.workspace, &case.state, &transport, &case.event_log).unwrap();
+    assert_eq!(COUNTS.with(|counts| counts.get()), (2, 2, 0));
+    assert_eq!(case.message_status(&busy), before);
+    assert_ne!(case.message_status(&refused), "delivered");
+    assert_eq!(transport.inject_count(), 0);
+    assert!(case.events().contains("send.deferred_busy"));
+    assert!(case.events().contains("delivery.projection_refused"));
+}
+
+#[test]
+fn resource188_receiver_revoked_between_prepare_and_claim_is_reloaded() {
+    use crate::messaging::delivery::preparation_probe::{BEFORE_CLAIM, COUNTS};
+    let case = Case::new("188-revoke");
+    let transport = RecordingTransport::new("");
+    let message = case
+        .store
+        .create_message(
+            None,
+            "worker",
+            "leader",
+            "race",
+            None,
+            false,
+            Some("acceptance-team"),
+        )
+        .unwrap();
+    let workspace = case.workspace.clone();
+    BEFORE_CLAIM.with(|hook| {
+        *hook.borrow_mut() = Some(Box::new(move || {
+            let mut latest = crate::state::persist::load_runtime_state(&workspace).unwrap();
+            latest["leader_receiver"]["status"] = serde_json::json!("rebind_required");
+            crate::state::persist::save_runtime_state(&workspace, &latest).unwrap();
+        }))
+    });
+    COUNTS.with(|counts| counts.set((0, 0, 0)));
+    deliver_pending_messages(&case.workspace, &case.state, &transport, &case.event_log).unwrap();
+    assert_eq!(COUNTS.with(|counts| counts.get()), (1, 2, 1));
+    assert_eq!(
+        transport.inject_count(),
+        0,
+        "must not use the prepared attached receiver after revoke"
+    );
+    assert_eq!(case.message_status(&message), "failed");
+    assert!(case.events().contains("leader_receiver.delivery_blocked"));
+}

package/crates/team-agent/src/messaging/tests/runtime.rs

@@ -3376,10 +3376,18 @@ fn gate054_status_surfaces_pending_leader_notifications() {
         entry.get("channel").and_then(serde_json::Value::as_str),
         Some("rebind_required")
     );
-    assert!(entry
+    let action = entry
         .get("action")
         .and_then(serde_json::Value::as_str)
-        .is_some_and(|action| action.contains("attach-leader") || action.contains("takeover")));
+        .unwrap_or("");
+    assert!(
+        action.contains("historical leader mailbox debt"),
+        "historical debt action must stay debt-scoped; action={action}"
+    );
+    assert!(
+        !action.contains("attach-leader") && !action.contains("takeover") && !action.contains("claim-leader"),
+        "historical debt must not authorize bind commands; action={action}"
+    );
 }
 
 #[test]

package/crates/team-agent/src/provider/adapters/cursor_agent.rs

@@ -15,10 +15,8 @@
 //! `.team/scripts/cursor_seat.sh` 实测一致：
 //!   `--trust --sandbox disabled --workspace <物理路径> [--force] [--model]`
 //! Role 不入 argv，写 `<workspace>/.cursor/rules/*.mdc` + `alwaysApply: true`。
-//! MCP 无 `--mcp-config`；身份必须写进 per-seat
-//! `provider-config/<id>/cursor/.cursor/mcp.json` 的 env 表
+//! MCP 无 `--mcp-config`；身份必须写进 `.cursor/mcp.json` 的 env 表
 //! （cursor 不把父进程 TEAM_AGENT_* 传给 MCP 子进程）。
-//! spawn 把 `--workspace` 指到该工程根，并用 `--add-dir` 挂上真 workspace。
 //!
 //! 隐藏 flag `--system-prompt` / `--allowed-tools` 实测存在但 help 未列，
 //! 随时可能消失。可以在注释里记录，代码里不许调。
@@ -75,8 +73,7 @@ pub(crate) fn cursor_agent_base_command(
     let _ = effort;
     // system_prompt 不入 argv（help 无 --rules / --append-system-prompt）。
     // launch 写 `<workspace>/.cursor/rules/team-agent-role-<agent_id>.mdc`。
-    // mcp_config 也不入 argv（无 --mcp-config）。launch 写
-    // `.team/runtime/provider-config/<id>/cursor/.cursor/mcp.json`
+    // mcp_config 也不入 argv（无 --mcp-config）。launch 写 `.cursor/mcp.json`
     // 并 `agent mcp enable team_orchestrator`。这里收下以免静默丢弃。
     let _ = (adapter, auth_mode, mcp_config, managed_mcp_config, system_prompt);
     argv.push("--workspace".to_string());

package/crates/team-agent/src/provider/session_scan/common/tests.rs

@@ -1,5 +1,50 @@
 use super::*;
 
+#[derive(Default, Debug)]
+struct EnumerationCounts {
+    directories: Vec<PathBuf>,
+    entries: usize,
+    following_metadata: usize,
+}
+
+thread_local! {
+    static ENUMERATION: std::cell::RefCell<EnumerationCounts> =
+        std::cell::RefCell::new(EnumerationCounts::default());
+}
+
+pub(super) fn record_directory_read(path: &Path) {
+    ENUMERATION.with(|counts| counts.borrow_mut().directories.push(path.to_path_buf()));
+}
+
+pub(super) fn record_entry() {
+    ENUMERATION.with(|counts| counts.borrow_mut().entries += 1);
+}
+
+pub(super) fn record_following_metadata() {
+    ENUMERATION.with(|counts| counts.borrow_mut().following_metadata += 1);
+}
+
+fn take_counts() -> EnumerationCounts {
+    ENUMERATION.with(|counts| std::mem::take(&mut *counts.borrow_mut()))
+}
+
+// The previous traversal boundary, run only on the synthetic fixture. Count
+// explicit metadata calls, not inferred OS syscalls or elapsed-time thresholds.
+fn legacy_enumeration_counts(dir: &Path, depth: usize, counts: &mut EnumerationCounts) {
+    if depth > 4 {
+        return;
+    }
+    counts.directories.push(dir.to_path_buf());
+    for entry in std::fs::read_dir(dir).unwrap() {
+        let path = entry.unwrap().path();
+        counts.entries += 1;
+        counts.following_metadata += 1;
+        if path.is_dir() {
+            legacy_enumeration_counts(&path, depth + 1, counts);
+        }
+    }
+}
+
 fn temp_dir(name: &str) -> PathBuf {
     static N: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(0);
     let n = N.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
@@ -110,3 +155,162 @@ fn codex_prompt_worker_identity_mismatch_is_rejected_for_that_agent() {
     assert!(candidates.is_empty());
     let _ = std::fs::remove_dir_all(&dir);
 }
+
+#[test]
+fn repeated_wide_directory_scans_remove_leaf_metadata_without_hiding_new_files() {
+    let dir = temp_dir("wide-discovery");
+    for group in 0..4 {
+        let child = dir.join("source").join(format!("group-{group}"));
+        std::fs::create_dir_all(&child).unwrap();
+        for index in 0..128 {
+            std::fs::write(child.join(format!("code-{index}.rs")), "").unwrap();
+        }
+    }
+    for _ in 0..2 {
+        let mut before = EnumerationCounts::default();
+        legacy_enumeration_counts(&dir, 0, &mut before);
+        assert_eq!((before.directories.len(), before.entries), (6, 517));
+        assert_eq!(before.following_metadata, 517);
+
+        take_counts();
+        let mut candidates = Vec::new();
+        collect_candidate_files(&dir, "worker", 0, false, None, &mut candidates).unwrap();
+        let after = take_counts();
+        assert!(candidates.is_empty());
+        assert_eq!((after.directories.len(), after.entries), (6, 517));
+        assert_eq!(after.following_metadata, 0);
+    }
+    // No .team subtree is needed to reproduce the redundant metadata work.
+    // A negative scan must not suppress a later file in the same nested cwd.
+    let rollout = dir.join("source/group-3/rollout-worker.jsonl");
+    write_codex_rollout(&rollout, &dir, "late-worker", "worker");
+    let mut candidates = Vec::new();
+    collect_candidate_files(&dir, "worker", 0, false, None, &mut candidates).unwrap();
+    let after = take_counts();
+    assert_eq!((after.directories.len(), after.entries), (6, 518));
+    assert_eq!(after.following_metadata, 0);
+    assert_eq!(candidates.len(), 1);
+    assert_eq!(candidates[0].path, rollout);
+    assert!(!candidates[0].requires_cwd_match);
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn team_subtrees_are_pruned_before_enumeration_but_claude_root_and_ancestors_survive() {
+    let dir = temp_dir("team-pruning");
+    let allowed = dir.join(".team/runtime/claude/projects");
+    let owned = allowed.join("cwd/owned.jsonl");
+    let unrelated = dir.join(".team/artifacts/deep/ignored.jsonl");
+    let sibling = dir.join(".team/runtime/other/ignored.jsonl");
+    for path in [&owned, &unrelated, &sibling] {
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(path, "{}").unwrap();
+    }
+
+    let mut before = EnumerationCounts::default();
+    legacy_enumeration_counts(&dir, 0, &mut before);
+    assert_eq!((before.directories.len(), before.entries), (8, 10));
+    assert_eq!(before.following_metadata, 10);
+
+    take_counts();
+    let mut candidates = Vec::new();
+    collect_candidate_files(&dir, "worker", 0, false, None, &mut candidates).unwrap();
+    let counts = take_counts();
+    assert!(candidates.is_empty());
+    assert_eq!(counts.directories, vec![dir.clone()]);
+    assert_eq!((counts.entries, counts.following_metadata), (1, 0));
+
+    // Starting at the runtime ancestor must reach the explicit Claude root,
+    // while siblings inside .team remain excluded before read_dir.
+    let ancestor = dir.join(".team");
+    collect_candidate_files(&ancestor, "worker", 0, true, Some(&allowed), &mut candidates)
+        .unwrap();
+    let counts = take_counts();
+    assert_eq!(counts.directories.len(), 5);
+    assert_eq!((counts.entries, counts.following_metadata), (7, 0));
+    assert!(!counts
+        .directories
+        .iter()
+        .any(|path| path.starts_with(dir.join(".team/artifacts"))));
+    assert!(!counts
+        .directories
+        .iter()
+        .any(|path| path.starts_with(dir.join(".team/runtime/other"))));
+    assert_eq!(candidates.len(), 1);
+    assert_eq!(candidates[0].path, owned);
+    assert!(candidates[0].requires_cwd_match);
+
+    candidates.clear();
+    collect_optional_candidate_files(&allowed, "worker", Some(&allowed), &mut candidates)
+        .unwrap();
+    assert_eq!(take_counts().directories.len(), 2);
+    assert_eq!(candidates.len(), 1);
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+fn traversal_keeps_depth_limit_and_required_root_errors() {
+    let dir = temp_dir("depth-limit");
+    let at_limit = dir.join("one/two/three/four/at-limit.jsonl");
+    let beyond = dir.join("one/two/three/four/five/beyond.jsonl");
+    std::fs::create_dir_all(beyond.parent().unwrap()).unwrap();
+    std::fs::write(&at_limit, "{}").unwrap();
+    std::fs::write(&beyond, "{}").unwrap();
+    take_counts();
+    let mut candidates = Vec::new();
+    collect_candidate_files(&dir, "worker", 0, false, None, &mut candidates).unwrap();
+    let counts = take_counts();
+    assert_eq!(counts.directories.len(), 5);
+    assert_eq!(counts.following_metadata, 0);
+    assert_eq!(candidates.len(), 1);
+    assert_eq!(candidates[0].path, at_limit);
+    assert!(collect_candidate_files(
+        &dir.join("missing"),
+        "worker",
+        0,
+        false,
+        None,
+        &mut Vec::new()
+    )
+    .is_err());
+    assert!(collect_optional_candidate_files(
+        &dir.join("missing"),
+        "worker",
+        None,
+        &mut Vec::new()
+    )
+    .is_ok());
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+#[test]
+#[cfg(unix)]
+fn symlink_files_directories_and_cycles_keep_following_metadata_and_depth_semantics() {
+    use std::os::unix::fs::symlink;
+    let dir = temp_dir("symlink-discovery");
+    let target = dir.join("target");
+    std::fs::create_dir(&target).unwrap();
+    std::fs::write(target.join("session.jsonl"), "{}").unwrap();
+    symlink(&target, dir.join("linked-dir")).unwrap();
+    symlink(target.join("session.jsonl"), dir.join("linked-file.jsonl")).unwrap();
+    symlink(dir.join("absent"), dir.join("dangling.jsonl")).unwrap();
+    symlink(&target, target.join("cycle")).unwrap();
+    take_counts();
+    let mut candidates = Vec::new();
+    collect_candidate_files(&dir, "worker", 0, false, None, &mut candidates).unwrap();
+    let counts = take_counts();
+    assert_eq!(counts.directories.len(), 9);
+    assert_eq!(counts.entries, 20);
+    assert_eq!(counts.following_metadata, 11);
+    assert_eq!(candidates.len(), 10);
+    assert!(candidates
+        .iter()
+        .any(|item| item.path == dir.join("linked-file.jsonl")));
+    assert!(candidates
+        .iter()
+        .any(|item| item.path == dir.join("linked-dir/session.jsonl")));
+    assert!(candidates
+        .iter()
+        .any(|item| item.path == dir.join("dangling.jsonl")));
+    std::fs::remove_dir_all(dir).unwrap();
+}

package/crates/team-agent/src/provider/session_scan/common.rs

@@ -441,9 +441,11 @@ fn collect_candidate_files(
     allowed_team_root: Option<&Path>,
     out: &mut Vec<SessionCandidate>,
 ) -> Result<(), ProviderError> {
-    if depth > 4 {
+    if depth > 4 || !may_traverse_session_directory(dir, allowed_team_root) {
         return Ok(());
     }
+    #[cfg(test)]
+    tests::record_directory_read(dir);
     let entries = match std::fs::read_dir(dir) {
         Ok(entries) => entries,
         Err(e) if depth == 0 => return Err(ProviderError::Io(format!("{}: {e}", dir.display()))),
@@ -453,8 +455,23 @@ fn collect_candidate_files(
         let Ok(entry) = entry else {
             continue;
         };
+        #[cfg(test)]
+        tests::record_entry();
         let path = entry.path();
-        if path.is_dir() {
+        if !may_traverse_session_directory(&path, allowed_team_root) {
+            continue;
+        }
+        // read_dir already supplies the type for ordinary entries. Only links
+        // (or an unavailable type) need the old, following metadata lookup.
+        let is_dir = match entry.file_type() {
+            Ok(kind) if !kind.is_symlink() => kind.is_dir(),
+            _ => {
+                #[cfg(test)]
+                tests::record_following_metadata();
+                path.is_dir()
+            }
+        };
+        if is_dir {
             collect_candidate_files(
                 &path,
                 agent_id,
@@ -473,6 +490,11 @@ fn collect_candidate_files(
     Ok(())
 }
 
+fn may_traverse_session_directory(path: &Path, allowed_team_root: Option<&Path>) -> bool {
+    !path_is_under_team_runtime(path)
+        || allowed_team_root.is_some_and(|root| path.starts_with(root) || root.starts_with(path))
+}
+
 fn looks_like_session_file(path: &Path, agent_id: &str, allowed_team_root: Option<&Path>) -> bool {
     if path_is_under_team_runtime(path)
         && !allowed_team_root.is_some_and(|root| path.starts_with(root))

package/crates/team-agent/src/state/abnormal_watch/tests/mod.rs

@@ -0,0 +1,248 @@
+use super::*;
+use crate::state::persist::{load_runtime_state, runtime_state_path, save_runtime_state};
+
+fn workspace() -> std::path::PathBuf {
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    static NEXT: AtomicUsize = AtomicUsize::new(0);
+    let path = std::env::temp_dir().join(format!(
+        "watch-188-{}-{}",
+        std::process::id(),
+        NEXT.fetch_add(1, Ordering::Relaxed)
+    ));
+    std::fs::create_dir_all(path.join(".team/runtime")).unwrap();
+    path
+}
+
+#[test]
+fn complete_empty_roster_prunes_but_missing_roster_and_paused_members_survive() {
+    let mut state = json!({
+        "agents": {},
+        "teams": {
+            "empty": {"agents": {}, "coordinator": {"abnormal_exit_watch": {"old": {}}}},
+            "unknown": {"coordinator": {"abnormal_exit_watch": {"old": {}}}},
+            "paused": {"agents": {"p": {"status": "paused"}}, "coordinator": {
+                "abnormal_exit_watch": {"p": {"last_notified_key": "keep"}, "gone": {}}
+            }}
+        },
+        "coordinator": {"abnormal_exit_watch": {"unknown": {}}}
+    });
+    compact_after_merge(&mut state, None, &[]);
+    assert_eq!(
+        state["teams"]["empty"]["coordinator"]["abnormal_exit_watch"],
+        json!({})
+    );
+    assert_eq!(
+        state["teams"]["unknown"]["coordinator"]["abnormal_exit_watch"],
+        json!({"old": {}})
+    );
+    assert_eq!(
+        state["teams"]["paused"]["coordinator"]["abnormal_exit_watch"],
+        json!({"p": {"last_notified_key": "keep"}})
+    );
+    assert_eq!(
+        state["coordinator"]["abnormal_exit_watch"],
+        json!({"unknown": {}})
+    );
+    assert!(!needs_compaction(&state));
+}
+
+#[test]
+fn root_legacy_union_is_not_migrated_by_bare_agent_name() {
+    let mut state = json!({"agents": {}, "teams": {
+        "a": {"agents": {"w": {}}}, "b": {"agents": {"w": {}}}
+    }, "coordinator": {"abnormal_exit_watch": {"w": {"last_notified_key": "legacy"}, "gone": {}}}});
+    compact_after_merge(&mut state, None, &[]);
+    assert_eq!(
+        state["coordinator"]["abnormal_exit_watch"]
+            .as_object()
+            .unwrap()
+            .len(),
+        1
+    );
+    for team in ["a", "b"] {
+        let projection = crate::state::projection::project_top_level_view(&state, team);
+        assert!(projection["coordinator"]
+            .get("abnormal_exit_watch")
+            .is_none());
+    }
+}
+
+#[test]
+fn fallback_preserves_other_coordinator_fields_and_owned_watch() {
+    let state = json!({"coordinator": {"tick": 9, "abnormal_exit_watch": {"w": {}}}, "teams": {
+        "a": {"agents": {}},
+        "b": {"agents": {}, "coordinator": {"abnormal_exit_watch": {"owned": {}}, "tick": 2}}
+    }});
+    let a = crate::state::projection::project_top_level_view(&state, "a");
+    let b = crate::state::projection::project_top_level_view(&state, "b");
+    assert_eq!(a["coordinator"], json!({"tick": 9}));
+    assert_eq!(b["coordinator"], state["teams"]["b"]["coordinator"]);
+}
+
+fn observed() -> Value {
+    let mut state = json!({"active_team_key": "a", "agents": {"w": {
+        "provider": "codex", "rollout_path": "/fixture/w.jsonl", "spawn_epoch": 1
+    }}, "coordinator": {"abnormal_exit_watch": {"w": {"last_notified_key": "keep"}}}});
+    state["coordinator"]["abnormal_exit_watch"]["w"]["watch_identity"] =
+        observation_identity(&state, "w").unwrap();
+    state
+}
+
+#[test]
+fn observation_identity_separates_same_name_team_path_and_spawn_generation() {
+    let initial = observed();
+    let mut unchanged = initial.clone();
+    begin_observation(&mut unchanged, "w");
+    begin_observation(&mut unchanged, "w");
+    assert_eq!(
+        unchanged, initial,
+        "same observation retains notification dedupe"
+    );
+    for (pointer, value) in [
+        ("/active_team_key", json!("b")),
+        ("/agents/w/rollout_path", json!("/fixture/other.jsonl")),
+        ("/agents/w/spawn_epoch", json!(2)),
+        ("/agents/w/provider", json!("claude")),
+        ("/agents/w/spawned_at", json!("new-incarnation")),
+    ] {
+        let mut changed = initial.clone();
+        if pointer.ends_with("spawned_at") {
+            changed["agents"]["w"]["spawned_at"] = value;
+        } else {
+            *changed.pointer_mut(pointer).unwrap() = value;
+        }
+        begin_observation(&mut changed, "w");
+        assert!(changed["coordinator"]["abnormal_exit_watch"]
+            .get("w")
+            .is_none());
+    }
+}
+
+#[test]
+fn legacy_unknown_identity_is_retained_until_member_is_observed() {
+    let mut state = observed();
+    state["coordinator"]["abnormal_exit_watch"]["w"]
+        .as_object_mut()
+        .unwrap()
+        .remove("watch_identity");
+    let legacy = state.clone();
+    compact_after_merge(&mut state, None, &[]);
+    assert_eq!(
+        state, legacy,
+        "membership compaction cannot guess legacy identity"
+    );
+    begin_observation(&mut state, "w");
+    assert!(state["coordinator"]["abnormal_exit_watch"]
+        .get("w")
+        .is_none());
+}
+
+#[test]
+fn unchanged_normal_save_compacts_large_old_snapshots_and_cannot_resurrect_them() {
+    let ws = workspace();
+    let watch: serde_json::Map<String, Value> = (0..100)
+        .map(|n| {
+            (
+                format!("old-{n}"),
+                json!({"last_notified_key": "x".repeat(100)}),
+            )
+        })
+        .collect();
+    let mut state =
+        json!({"agents": {}, "teams": {}, "coordinator": {"abnormal_exit_watch": watch}});
+    for n in 0..8 {
+        state["teams"][format!("team-{n}")] =
+            json!({"agents": {}, "coordinator": state["coordinator"].clone()});
+    }
+    let original = serde_json::to_vec(&state).unwrap().len();
+    // Warm the old cache without invoking the load-time migrations, which
+    // could otherwise compact before the no-change save under test.
+    crate::state::persist::save_runtime_state_without_migrations(&ws, &state).unwrap();
+    let stale = state;
+    assert_eq!(
+        serde_json::from_slice::<Value>(&std::fs::read(runtime_state_path(&ws)).unwrap())
+            .unwrap(),
+        stale
+    );
+    save_runtime_state(&ws, &stale).unwrap();
+    let first = std::fs::read(runtime_state_path(&ws)).unwrap();
+    assert!(
+        first.len() < original / 10,
+        "size must depend on actual members, not watch x teams"
+    );
+    save_runtime_state(&ws, &stale).unwrap();
+    assert_eq!(std::fs::read(runtime_state_path(&ws)).unwrap(), first);
+    std::fs::remove_dir_all(ws).unwrap();
+}
+
+#[test]
+fn latest_roster_merge_precedes_pruning_and_explicit_deletion_removes_watch() {
+    let ws = workspace();
+    let latest = json!({"active_team_key": "a", "session_name": "team-a", "agents": {
+        "w": {"agent_id": "w", "provider": "codex", "status": "paused"}
+    }, "coordinator": {"abnormal_exit_watch": {"w": {"last_notified_key": "keep"}}}});
+    save_runtime_state(&ws, &latest).unwrap();
+    let mut stale = load_runtime_state(&ws).unwrap();
+    stale["agents"] = json!({});
+    save_runtime_state(&ws, &stale).unwrap();
+    let merged = load_runtime_state(&ws).unwrap();
+    assert!(merged["agents"].get("w").is_some());
+    assert_eq!(
+        merged["coordinator"]["abnormal_exit_watch"]["w"]["last_notified_key"],
+        "keep"
+    );
+    crate::state::persist::save_runtime_state_with_deleted_agents(&ws, &stale, &["w"]).unwrap();
+    let removed = load_runtime_state(&ws).unwrap();
+    assert!(removed["agents"].get("w").is_none());
+    assert_eq!(removed["coordinator"]["abnormal_exit_watch"], json!({}));
+    std::fs::remove_dir_all(ws).unwrap();
+}
+
+#[test]
+fn unknown_team_retains_history_until_observation_but_never_authorizes_reuse() {
+    let mut state = observed();
+    state["active_team_key"] = Value::Null;
+    let before = state.clone();
+    assert!(observation_identity(&state, "w").is_none());
+    compact_after_merge(&mut state, None, &[]);
+    assert_eq!(state, before);
+    assert!(!matches_observation(
+        &state,
+        "w",
+        &state["coordinator"]["abnormal_exit_watch"]["w"]
+    ));
+    begin_observation(&mut state, "w");
+    assert!(state["coordinator"]["abnormal_exit_watch"]
+        .get("w")
+        .is_none());
+}
+
+#[test]
+fn malformed_team_catalog_does_not_authorize_root_pruning() {
+    let mut state =
+        json!({"agents": {}, "teams": [], "coordinator": {"abnormal_exit_watch": {"w": {}}}});
+    let before = state.clone();
+    compact_after_merge(&mut state, None, &[]);
+    assert_eq!(state, before);
+    assert!(!needs_compaction(&state));
+}
+
+#[test]
+fn lock_held_latest_membership_protects_rows_without_roster_stub_fields() {
+    let latest = json!({"agents": {"unknown-row": {}}, "teams": {
+        "new-sibling": {"agents": {"sibling": {}}}
+    }});
+    let mut incoming = json!({"agents": {}, "coordinator": {"abnormal_exit_watch": {
+        "unknown-row": {}, "sibling": {}, "gone": {}
+    }}});
+    compact_after_merge(&mut incoming, Some(&latest), &[]);
+    assert_eq!(
+        incoming["coordinator"]["abnormal_exit_watch"],
+        json!({"unknown-row": {}, "sibling": {}})
+    );
+    compact_after_merge(&mut incoming, Some(&latest), &["unknown-row"]);
+    assert_eq!(
+        incoming["coordinator"]["abnormal_exit_watch"],
+        json!({"sibling": {}})
+    );
+}