@team-agent/installer 0.5.77 → 0.5.80

package/crates/team-agent/src/leader/owner_bind.rs

@@ -142,7 +142,28 @@ pub fn bind_owner_from_caller_pane(
         .as_ref()
         .and_then(|info| info.current_command.clone())
         .unwrap_or_else(|| tmux_pane_current_command(workspace, &pane).unwrap_or_default());
-    let provider = bind_provider_from_env_or_pane(&caller_current_command, caller_info);
+    let Some(provider) = bind_provider_from_env_or_pane(&caller_current_command, caller_info) else {
+        let hint = "set TEAM_AGENT_LEADER_PROVIDER or run from a provider pane; unknown commands are not Codex";
+        event_log.write(
+            LeaderEvent::OwnerBindRefused.name(),
+            json!({
+                "reason": serde_json::to_value(LeaseReason::CallerNotLeaderShaped)?,
+                "caller_pane_id": pane,
+                "caller_current_command": caller_current_command.clone(),
+                "team_id": team_id.as_str(),
+                "hint": hint,
+            }),
+        )?;
+        return Ok(OwnerBindResult {
+            ok: false,
+            owner: None,
+            caller_pane_id: PaneId::new(pane),
+            caller_current_command,
+            team_id: team_id.clone(),
+            reason: Some(LeaseReason::CallerNotLeaderShaped),
+            hint: Some(hint.to_string()),
+        });
+    };
     let machine_fingerprint = std::env::var("TEAM_AGENT_MACHINE_FINGERPRINT").unwrap_or_default();
     let os_user = std::env::var("USER")
         .or_else(|_| std::env::var("USERNAME"))
@@ -207,17 +228,13 @@ fn emit_owner_bound_event(
     Ok(())
 }
 
-fn bind_provider_from_env_or_pane(command: &str, pane: Option<PaneInfo>) -> Provider {
+fn bind_provider_from_env_or_pane(command: &str, pane: Option<PaneInfo>) -> Option<Provider> {
     let env_provider = std::env::var("TEAM_AGENT_LEADER_PROVIDER")
         .ok()
         .and_then(|raw| super::helpers::parse_provider(&raw));
     env_provider
         .or_else(|| pane.as_ref().and_then(super::attribute_pane_provider))
         .or_else(|| super::attribute_command_provider(command))
-        // E11 层2:未知命令不再静默默认 codex(会误绑任意 provider + 喂错分类器)。
-        // 无法识别时回落 Codex 仅作最末兜底,且该路径已被统一归因入口的显式 None 收窄
-        // (调用方理应只在已知 leader 命令上 bind);保留以不改 fn 签名/上游 panic 面。
-        .unwrap_or(Provider::Codex)
 }
 
 pub(crate) fn strict_owner_bind_provider(
@@ -352,13 +369,8 @@ mod e11_provider_bind_tests {
     }
 
     #[test]
-    fn strict_provider_never_falls_back_from_unknown_explicit_or_command() {
-        assert_eq!(
-            strict_owner_bind_provider(Some("pi"), "codex"),
-            Some(Provider::Pi)
-        );
+    fn provider_independent_rejects_unknown_or_node_without_fallback() {
         assert_eq!(strict_owner_bind_provider(Some("unknown"), "codex"), None);
-        assert_eq!(strict_owner_bind_provider(None, "pi"), Some(Provider::Pi));
         assert_eq!(strict_owner_bind_provider(None, "node"), None);
     }
 
@@ -394,3 +406,19 @@ mod e11_provider_bind_tests {
         assert_eq!(owner_bind_provider_wire("totally-unknown"), "");
     }
 }
+
+#[cfg(test)]
+mod claim_pi_carrier_tests {
+    use super::*;
+
+    #[test]
+    fn strict_provider_never_falls_back_from_unknown_explicit_or_command() {
+        assert_eq!(
+            strict_owner_bind_provider(Some("pi"), "codex"),
+            Some(Provider::Pi)
+        );
+        assert_eq!(strict_owner_bind_provider(Some("unknown"), "codex"), None);
+        assert_eq!(strict_owner_bind_provider(None, "pi"), Some(Provider::Pi));
+        assert_eq!(strict_owner_bind_provider(None, "node"), None);
+    }
+}

package/crates/team-agent/src/leader/rediscover/tests.rs

@@ -204,6 +204,71 @@ fn try_readopt_refuses_when_different_live_owner_uuid_mismatches() {
     assert!(state.get("team_owner").is_none());
 }
 
+#[test]
+fn try_readopt_inactive_bash_wrapper_with_matching_owner_uuid() {
+    let ws = ws("readopt-bash-ok");
+    let mut state = json!({"session_name": "sess"});
+    let uuid = "c1e3f7a7aeaed95491667b4d9c3ce6fb";
+    let mut recv = receiver("%0", uuid, 1);
+    let owner = owner("%0", uuid, 1);
+    let event_log = crate::event_log::EventLog::new(&ws);
+    let pane = json!({
+        "pane_id": "%0",
+        "session_name": "sess",
+        "window_name": "pi",
+        "pane_current_command": "bash",
+        "pane_current_path": ws.join("sub").to_string_lossy(),
+        "active": false,
+        "leader_session_uuid": uuid,
+        "leader_env": {
+            "TEAM_AGENT_LEADER_SESSION_UUID": uuid,
+            "TEAM_AGENT_WORKSPACE": ws.to_string_lossy(),
+            "TEAM_AGENT_TEAM_ID": "sess"
+        }
+    });
+    let got = try_readopt_leader_pane(
+        &ws,
+        &mut state,
+        &mut recv,
+        &pane,
+        &json!({"targets": [pane.clone()]}),
+        Some(&owner),
+        Provider::Codex,
+        LeaseSource::Manual,
+        &event_log,
+    )
+    .unwrap();
+    assert!(got.is_some(), "matching inactive wrapper must readopt");
+}
+
+#[test]
+fn try_readopt_bash_without_recorded_owner_uuid_refuses() {
+    let ws = ws("readopt-bash-no-id");
+    let mut state = json!({});
+    let mut recv = receiver("%0", "c1e3f7a7aeaed95491667b4d9c3ce6fb", 1);
+    let event_log = crate::event_log::EventLog::new(&ws);
+    let pane = json!({
+        "pane_id": "%0",
+        "session_name": "sess",
+        "pane_current_command": "bash",
+        "pane_current_path": ws.join("sub").to_string_lossy(),
+        "active": false
+    });
+    let got = try_readopt_leader_pane(
+        &ws,
+        &mut state,
+        &mut recv,
+        &pane,
+        &json!({"targets": [pane.clone()]}),
+        None,
+        Provider::Codex,
+        LeaseSource::Manual,
+        &event_log,
+    )
+    .unwrap();
+    assert!(got.is_none());
+}
+
 #[test]
 fn rediscover_updates_unique_env_triple_match() {
     let ws = ws("rediscover");

package/crates/team-agent/src/leader/rediscover.rs

@@ -42,7 +42,12 @@ pub fn try_readopt_leader_pane(
         )?;
         return Ok(None);
     };
-    if !readopt_candidate_is_usable_leader(workspace, &candidate) {
+    if !readopt_candidate_is_usable_leader(
+        workspace,
+        &candidate,
+        owner_record,
+        receiver_provider,
+    ) {
         event_log.write(
             LeaderEvent::ReceiverRebindRequired.name(),
             json!({"reason": "leader_pane_unusable"}),
@@ -598,14 +603,39 @@ fn target_iter(targets: &Value) -> Vec<LeaderTarget> {
     Vec::new()
 }
 
-fn readopt_candidate_is_usable_leader(workspace: &Path, target: &LeaderTarget) -> bool {
-    if !target.active || target.provider.is_none() {
-        return false;
-    }
-    target
+fn readopt_candidate_is_usable_leader(
+    workspace: &Path,
+    target: &LeaderTarget,
+    owner_record: Option<&TeamOwner>,
+    receiver_provider: Provider,
+) -> bool {
+    if !target
         .current_path
         .as_deref()
         .is_some_and(|path| path_in_workspace(path, workspace))
+    {
+        return false;
+    }
+    if target.provider.is_some() {
+        return true;
+    }
+    let Some(owner) = owner_record else {
+        return false;
+    };
+    if owner.pane_id.as_str() != target.pane_id.as_str() {
+        return false;
+    }
+    if owner.provider != receiver_provider {
+        return false;
+    }
+    match (
+        owner.leader_session_uuid.as_ref(),
+        target.leader_session_uuid.as_ref(),
+    ) {
+        (Some(recorded), Some(live)) => recorded == live,
+        (Some(_), None) => true,
+        (None, _) => false,
+    }
 }
 
 fn rediscover_candidate_is_usable_leader(target: &LeaderTarget) -> bool {

package/crates/team-agent/src/leader/start.rs

@@ -1412,13 +1412,6 @@ extern "C" fn managed_term_handler(_: libc::c_int) {
 }
 
 fn managed_attach_should_teardown(watch: &ManagedAttachWatch<'_>) -> bool {
-    let marker = crate::tmux_backend::leader_provider_exit_marker(watch.provider_label);
-    let target = Target::Pane(watch.spawned.pane_id.clone());
-    if let Ok(cap) = watch.transport.capture(&target, CaptureRange::Tail(80)) {
-        if cap.text.contains(&marker) || cap.text.contains("[team-agent] Provider exited") {
-            return true;
-        }
-    }
     matches!(
         leader_provider_health(
             watch.transport,
@@ -1674,65 +1667,21 @@ fn ensure_managed_provider_live_after_attach(
     )))
 }
 
-/// 0.4.x (CR C-3 P0): leader provider health reconciliation. The default
-/// `liveness()` check only proves the pane is ADDRESSABLE via tmux — it
-/// returns `Live` even when the provider has exited and the wrapper shell
-/// remains at its inert tail. This function distinguishes
-/// `provider_alive` from `provider_exited` by:
-///   1. Reading `pane_current_command` (tmux `#{pane_current_command}`).
-///   2. If the current command matches the expected provider binary (or
-///      one of its known aliases), report `Alive`.
-///   3. If the current command is a shell tail process AND the pane
-///      content contains the exit marker `[team-agent] <provider> exited`
-///      (emitted by `leader_shell_wrapper_command`), report
-///      `ProviderExited`.
-///   4. Otherwise (Unknown shell, no marker), report `Alive` as the
-///      conservative default — avoid false-positive exit alarms.
-///
-/// Note: when the leader shell wrapper is used (CR C-2), a provider exit
-/// leaves the pane as an inert `/bin/sh -c` tail with the exit marker in
-/// scrollback. Pre-wrapper code that hit `exec claude` would have left the
-/// pane as `[exited]` and `liveness()` would have returned `Dead`. The new
-/// failure mode requires this richer health check to surface
-/// `leader_provider_exited` as a distinct status.
+/// Reconcile real pane liveness with the supervising wrapper's exit receipt.
+/// Restored provider output may contain any exit-marker text; it is not process
+/// state and must never authorize destructive managed-window cleanup.
 pub fn leader_provider_health(
     transport: &dyn Transport,
     pane_id: &PaneId,
-    expected_provider_label: &str,
+    _expected_provider_label: &str,
 ) -> LeaderProviderHealth {
-    use crate::transport::{CaptureRange, PaneField, Target};
-    let liveness = transport.liveness(pane_id).ok();
-    if matches!(liveness, Some(PaneLiveness::Dead)) {
+    if matches!(transport.liveness(pane_id), Ok(PaneLiveness::Dead)) {
         return LeaderProviderHealth::Unreachable;
     }
-    let target = Target::Pane(pane_id.clone());
-    let current_command = transport
-        .query(&target, PaneField::PaneCurrentCommand)
-        .ok()
-        .flatten()
-        .map(|s| s.trim().to_lowercase())
-        .unwrap_or_default();
-    if !current_command.is_empty()
-        && (current_command == expected_provider_label
-            || current_command.contains(expected_provider_label))
-    {
-        return LeaderProviderHealth::Alive;
-    }
-    // Current command is NOT the provider — likely fell back to shell.
-    let is_shell = is_interactive_shell_basename(&current_command);
-    if is_shell {
-        // CR R6: marker text from single-source `leader_provider_exit_marker`
-        // so the wrapper printf and the health-check substring cannot drift.
-        let exit_marker_substr =
-            crate::tmux_backend::leader_provider_exit_marker(expected_provider_label);
-        if let Ok(cap) = transport.capture(&target, CaptureRange::Tail(200)) {
-            if cap.text.contains(&exit_marker_substr) {
-                return LeaderProviderHealth::ProviderExited;
-            }
-        }
+    if matches!(transport.provider_exit_status(pane_id), Ok(Some(_))) {
+        return LeaderProviderHealth::ProviderExited;
     }
-    // Conservative default — pane addressable, but couldn't positively
-    // confirm provider exit. Treat as Alive.
+    // Missing/unsupported receipts (including old wrappers) are not proof of exit.
     LeaderProviderHealth::Alive
 }
 
@@ -1750,7 +1699,6 @@ pub enum LeaderProviderHealth {
 
 /// 0.4.x (CR R6 + R3): single-source shell-tail detection.
 /// Used by:
-///   - `leader_provider_health` to decide "pane is at the shell tail"
 ///   - shutdown logic to recognise a leader pane in shell-tail mode
 ///     as still owned by the leader (not stray).
 ///
@@ -1859,6 +1807,17 @@ fn persist_managed_leader_binding(
         &serde_json::json!(socket),
     );
     let bound_panes = merge_bound_panes(existing_recv.as_ref(), new_binding);
+    let existing_owner = state
+        .get("teams")
+        .and_then(|teams| teams.get(&team_key))
+        .and_then(|team| team.get("team_owner"))
+        .cloned();
+    let keep_field = |existing: Option<&serde_json::Value>, key: &str, fallback: serde_json::Value| {
+        existing
+            .and_then(|value| value.get(key))
+            .cloned()
+            .unwrap_or(fallback)
+    };
     let (scalar_pane, scalar_session, scalar_window, scalar_attached_at) =
         match existing_recv.as_ref() {
             Some(recv) if keep_existing_scalar => (
@@ -1867,20 +1826,41 @@ fn persist_managed_leader_binding(
                     .unwrap_or(pane.as_str())
                     .to_string(),
                 recv.get("session_name")
-                    .and_then(serde_json::Value::as_str)
-                    .unwrap_or(session.as_str())
-                    .to_string(),
+                    .cloned()
+                    .unwrap_or_else(|| serde_json::json!(session)),
                 recv.get("window_name")
-                    .and_then(serde_json::Value::as_str)
-                    .unwrap_or(window.as_str())
-                    .to_string(),
+                    .cloned()
+                    .unwrap_or_else(|| serde_json::json!(window)),
                 recv.get("attached_at")
                     .and_then(serde_json::Value::as_str)
                     .unwrap_or(now.as_str())
                     .to_string(),
             ),
-            _ => (pane.clone(), session.clone(), window.clone(), now.clone()),
+            _ => (
+                pane.clone(),
+                serde_json::json!(session),
+                serde_json::json!(window),
+                now.clone(),
+            ),
         };
+    let leader_session_uuid = if keep_existing_scalar {
+        keep_field(
+            existing_recv.as_ref(),
+            "leader_session_uuid",
+            serde_json::json!(identity.leader_session_uuid),
+        )
+    } else {
+        serde_json::json!(identity.leader_session_uuid)
+    };
+    let discovery = if keep_existing_scalar {
+        keep_field(
+            existing_recv.as_ref(),
+            "discovery",
+            serde_json::json!("managed_launcher"),
+        )
+    } else {
+        serde_json::json!("managed_launcher")
+    };
     let receiver = serde_json::json!({
         "mode": "direct_tmux",
         "status": "attached",
@@ -1890,20 +1870,43 @@ fn persist_managed_leader_binding(
         "session_name": scalar_session,
         "window_name": scalar_window,
         "tmux_socket": socket,
-        "leader_session_uuid": identity.leader_session_uuid,
+        "leader_session_uuid": leader_session_uuid.clone(),
         "owner_epoch": owner_epoch,
         "attached_at": scalar_attached_at,
-        "discovery": "managed_launcher",
+        "discovery": discovery,
         "bound_panes": bound_panes,
     });
+    let owner_uuid = if keep_existing_scalar {
+        keep_field(
+            existing_owner.as_ref(),
+            "leader_session_uuid",
+            leader_session_uuid.clone(),
+        )
+    } else {
+        leader_session_uuid.clone()
+    };
+    let claimed_via = if keep_existing_scalar {
+        keep_field(
+            existing_owner.as_ref(),
+            "claimed_via",
+            serde_json::json!("claim-leader"),
+        )
+    } else {
+        serde_json::json!("claim-leader")
+    };
+    let claimed_at = if keep_existing_scalar {
+        keep_field(existing_owner.as_ref(), "claimed_at", serde_json::json!(now))
+    } else {
+        serde_json::json!(now)
+    };
     let owner = serde_json::json!({
         "pane_id": scalar_pane,
         "provider": provider.clone(),
         "machine_fingerprint": identity.machine_fingerprint,
-        "leader_session_uuid": identity.leader_session_uuid,
+        "leader_session_uuid": owner_uuid,
         "owner_epoch": owner_epoch,
-        "claimed_at": now,
-        "claimed_via": "claim-leader",
+        "claimed_at": claimed_at,
+        "claimed_via": claimed_via,
         "os_user": identity.os_user,
     });
     if let Some(obj) = state.as_object_mut() {
@@ -2946,6 +2949,7 @@ mod tests {
         screens: Mutex<Vec<String>>,
         sent: Mutex<Vec<(Target, Vec<Key>)>>,
         liveness: PaneLiveness,
+        exit_status: Option<u8>,
         targets: Vec<PaneInfo>,
         window_options: Mutex<Vec<(String, String)>>,
         window_option_error: Mutex<Option<String>>,
@@ -2959,6 +2963,7 @@ mod tests {
                 screens: Mutex::new(screens),
                 sent: Mutex::new(Vec::new()),
                 liveness: PaneLiveness::Unknown,
+                exit_status: None,
                 targets: Vec::new(),
                 window_options: Mutex::new(Vec::new()),
                 window_option_error: Mutex::new(None),
@@ -2972,6 +2977,7 @@ mod tests {
                 screens: Mutex::new(Vec::new()),
                 sent: Mutex::new(Vec::new()),
                 liveness,
+                exit_status: None,
                 targets: Vec::new(),
                 window_options: Mutex::new(Vec::new()),
                 window_option_error: Mutex::new(None),
@@ -2985,6 +2991,7 @@ mod tests {
                 screens: Mutex::new(Vec::new()),
                 sent: Mutex::new(Vec::new()),
                 liveness,
+                exit_status: None,
                 targets,
                 window_options: Mutex::new(Vec::new()),
                 window_option_error: Mutex::new(None),
@@ -3000,6 +3007,7 @@ mod tests {
                 screens: Mutex::new(Vec::new()),
                 sent: Mutex::new(Vec::new()),
                 liveness: PaneLiveness::Unknown,
+                exit_status: None,
                 targets: Vec::new(),
                 window_options: Mutex::new(Vec::new()),
                 window_option_error: Mutex::new(Some(error.to_string())),
@@ -3131,6 +3139,10 @@ mod tests {
             Ok(self.liveness)
         }
 
+        fn provider_exit_status(&self, _pane: &PaneId) -> Result<Option<u8>, TransportError> {
+            Ok(self.exit_status)
+        }
+
         fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
             Ok(self.targets.clone())
         }
@@ -3804,22 +3816,37 @@ mod tests {
     }
 
     #[test]
-    fn managed_attach_teardown_detects_provider_exit_marker() {
+    fn managed_attach_teardown_requires_exit_receipt_not_replayed_markers() {
         let spawned = managed_spawn_result();
-        let transport = ScriptedTransport::new(vec![
-            "[team-agent] claude exited with 1\n[team-agent] Provider exited; this pane no longer accepts input.".to_string(),
+        let mut transport = ScriptedTransport::new(vec![
+            "[team-agent] pi exited with 1\n[team-agent] Provider exited".to_string(),
         ]);
-        let watch = super::ManagedAttachWatch {
-            transport: &transport,
-            spawned: &spawned,
-            session: &spawned.session,
-            session_existed_before: false,
-            workspace: Path::new("/tmp"),
-            provider_label: "claude",
-        };
-        assert!(
-            super::managed_attach_should_teardown(&watch),
-            "exit marker in capture must trigger teardown"
+        transport.liveness = PaneLiveness::Live;
+        for exit_status in [None, Some(0), Some(17)] {
+            transport.exit_status = exit_status;
+            let watch = super::ManagedAttachWatch {
+                transport: &transport,
+                spawned: &spawned,
+                session: &spawned.session,
+                session_existed_before: false,
+                workspace: Path::new("/tmp"),
+                provider_label: "pi",
+            };
+            assert_eq!(
+                super::managed_attach_should_teardown(&watch),
+                exit_status.is_some()
+            );
+        }
+        assert_eq!(
+            transport.screens.lock().unwrap().len(),
+            1,
+            "health must not read history"
+        );
+        transport.liveness = PaneLiveness::Dead;
+        transport.exit_status = None;
+        assert_eq!(
+            super::leader_provider_health(&transport, &spawned.pane_id, "pi"),
+            super::LeaderProviderHealth::Unreachable
         );
     }
 
@@ -3881,18 +3908,22 @@ mod tests {
     }
 
     fn persist_test_identity(workspace: &Path) -> LeaderIdentity {
+        persist_test_identity_named(workspace, "tester")
+    }
+
+    fn persist_test_identity_named(workspace: &Path, os_user: &str) -> LeaderIdentity {
         LeaderIdentity {
             leader_session_uuid: LeaderSessionUuid::derive(
                 "fp",
                 &workspace.to_string_lossy(),
-                "tester",
+                os_user,
                 "current",
             )
             .unwrap(),
             leader_session_uuid_source: LeaderSessionUuidSource::Derived,
             machine_fingerprint: "fp".to_string(),
             workspace_abspath: workspace.to_path_buf(),
-            os_user: "tester".to_string(),
+            os_user: os_user.to_string(),
             team_id: TeamKey::new("current"),
         }
     }
@@ -3995,6 +4026,84 @@ mod tests {
         let _ = std::fs::remove_dir_all(&workspace);
     }
 
+    #[test]
+    fn multi_leader_persist_keeps_first_owner_uuid() {
+        let workspace = std::env::temp_dir().join(format!(
+            "ta-multi-leader-uuid-{}",
+            std::process::id()
+        ));
+        std::fs::create_dir_all(workspace.join(".team").join("runtime")).unwrap();
+        let original_uuid = "b2b230cfd645e78cf49e8147ba32ff3b";
+        let state = serde_json::json!({
+            "active_team_key": "current",
+            "teams": {
+                "current": {
+                    "leader_receiver": {
+                        "status": "attached",
+                        "pane_id": "%0",
+                        "discovery": "env_pane",
+                        "leader_session_uuid": original_uuid,
+                        "owner_epoch": 1,
+                        "attached_at": "2026-09-09T17:08:31.965311+00:00",
+                        "tmux_socket": "/private/tmp/tmux-501/ta-33bddc6e7687",
+                        "session_name": null,
+                        "provider": "codex"
+                    },
+                    "team_owner": {
+                        "pane_id": "%0",
+                        "leader_session_uuid": original_uuid,
+                        "owner_epoch": 1,
+                        "claimed_via": "quick-start"
+                    }
+                }
+            }
+        });
+        std::fs::write(
+            crate::state::persist::runtime_state_path(&workspace),
+            serde_json::to_vec_pretty(&state).unwrap(),
+        )
+        .unwrap();
+        let mut plan = persist_test_plan(&workspace);
+        plan.identity = Some(persist_test_identity_named(&workspace, "second-launcher"));
+        let second_uuid = plan
+            .identity
+            .as_ref()
+            .unwrap()
+            .leader_session_uuid
+            .as_str()
+            .to_string();
+        assert_ne!(second_uuid, original_uuid);
+        let spawned = SpawnResult {
+            pane_id: PaneId::new("%2"),
+            session: SessionName::new(
+                "team-agent-leader-codex-team-agent-live-0578-r4-19450903",
+            ),
+            window: WindowName::new("codex-second"),
+            child_pid: Some(2),
+        };
+        persist_managed_leader_binding(&plan, &workspace, &spawned).expect("second persist");
+        let loaded = crate::state::persist::load_runtime_state(&workspace).unwrap();
+        let recv = &loaded["teams"]["current"]["leader_receiver"];
+        let owner = &loaded["teams"]["current"]["team_owner"];
+        assert_eq!(recv["pane_id"], serde_json::json!("%0"));
+        assert_eq!(recv["leader_session_uuid"], serde_json::json!(original_uuid));
+        assert_eq!(recv["discovery"], serde_json::json!("env_pane"));
+        assert_eq!(recv["session_name"], serde_json::Value::Null);
+        assert_eq!(recv["owner_epoch"], serde_json::json!(1));
+        assert_eq!(
+            owner["leader_session_uuid"],
+            serde_json::json!(original_uuid)
+        );
+        let panes = recv["bound_panes"].as_array().expect("bound_panes");
+        let ids: Vec<&str> = panes
+            .iter()
+            .filter_map(|pane| pane.get("pane_id").and_then(serde_json::Value::as_str))
+            .collect();
+        assert!(ids.contains(&"%0"), "bound_panes missing first: {recv}");
+        assert!(ids.contains(&"%2"), "bound_panes missing second: {recv}");
+        let _ = std::fs::remove_dir_all(&workspace);
+    }
+
     #[test]
     fn multi_leader_clear_promotes_remaining() {
         let workspace =

package/crates/team-agent/src/leader/tests/wake_start_owner.rs

@@ -1,5 +1,8 @@
 use super::*;
 
+#[path = "../../../tests/support/hermetic.rs"]
+mod hermetic;
+
 // =====================================================================
 // 5. leader_session_name — sha1 派生 + 文件夹消毒(unimplemented → RED)
 // =====================================================================
@@ -111,18 +114,21 @@ fn owner_bind_refused_event_name_is_owner_bind_refused() {
 // old uuid 为 None → old_uuid_prefix == ""(空串,非缺省);全 32 hex uuid 绝不出现在任何字段。
 // unimplemented → RED。
 #[test]
+#[serial_test::serial(env)]
 fn emit_owner_bound_event_logs_prefix_only_never_full_uuid() {
     let _lock = ENV_LOCK.lock().unwrap();
-    let ws = std::env::temp_dir().join(format!("ta_rs_emit_{}", std::process::id()));
-    std::fs::create_dir_all(&ws).unwrap();
-    let _env = EnvGuard::apply(&[
-        ("TMUX_PANE", Some("%7")),
-        ("TEAM_AGENT_MACHINE_FINGERPRINT", Some("fp")),
-        ("TEAM_AGENT_LEADER_PROVIDER", Some("codex")),
-        ("TEAM_AGENT_LEADER_SESSION_UUID_OVERRIDE", None),
-    ]);
+    let hermetic = hermetic::HermeticTestEnv::enter("owner-bound-uuid");
+    let ws = hermetic.workspace("emit");
+    let _pane = hermetic.with_env("TMUX_PANE", "%7");
+    let _fingerprint = hermetic.with_env("TEAM_AGENT_MACHINE_FINGERPRINT", "fp");
+    let _provider = hermetic.with_env("TEAM_AGENT_LEADER_PROVIDER", "codex");
     let result = bind_owner_from_caller_pane(&ws, &TeamKey::new("default"), None).unwrap();
-    assert!(result.ok, "caller pane should produce an owner binding");
+    assert!(
+        result.ok,
+        "caller pane must produce an owner binding; reason={:?} hint={:?}",
+        result.reason,
+        result.hint
+    );
     let owner = result.owner.as_ref().expect("successful bind has owner");
     let full = owner
         .leader_session_uuid