@team-agent/installer 0.5.78 → 0.5.81

package/crates/team-agent/src/coordinator/tests/s3_bounded.rs

@@ -0,0 +1,239 @@
+use super::*;
+use serde_json::json;
+use std::io::{BufRead, Write};
+use std::path::{Path, PathBuf};
+use std::process::{Child, Command, Stdio};
+use crate::state::repository::{StateRepository, StateWriteIntent};
+
+const WORKER: &str = "coordinator::tests::s3_bounded::s3_process_worker";
+
+fn isolated(name: &str, check: impl FnOnce(&Path)) {
+    if std::env::var("TA_S3_CASE").as_deref() == Ok(name) {
+        check(&std::env::current_dir().unwrap());
+        return;
+    }
+    let dir = std::env::temp_dir().join(format!("ta-s3-{name}-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let output = Command::new(std::env::current_exe().unwrap())
+        .args(["--exact", &format!("coordinator::tests::s3_bounded::{name}"), "--nocapture"])
+        .env_clear().env("HOME", dir.join("home")).env("TA_S3_CASE", name)
+        .current_dir(&dir).output().unwrap();
+    print!("{}", String::from_utf8_lossy(&output.stdout));
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+    std::fs::remove_dir_all(dir).unwrap();
+}
+
+fn disk(dir: &Path) -> Value {
+    serde_json::from_str(&std::fs::read_to_string(crate::state::persist::runtime_state_path(dir)).unwrap()).unwrap()
+}
+
+fn seed(dir: &Path, legacy: bool) {
+    std::fs::create_dir_all(dir).unwrap();
+    let team = |key: &str| {
+        let spec = dir.join(".team/runtime").join(key).join("team.spec.yaml");
+        std::fs::create_dir_all(spec.parent().unwrap()).unwrap();
+        std::fs::write(&spec, format!("name: {key}\nagents: []\ntasks: []\n")).unwrap();
+        json!({
+            "session_name": key, "team_dir": dir.join(".team").join(key), "spec_path": spec,
+            "agents": {"w1": {"agent_id": "w1", "provider": "fake", "status": "running",
+                "window": "w1", "pane_id": "%11", "spawn_epoch": 1,
+                "session_id": "fixture-session", "startup_prompts": "handled"}},
+            "tasks": [{"id": "original", "title": "Original task", "assignee": "w1", "status": "pending"}],
+            "notes": ["original note"]
+        })
+    };
+    let mut state = team("T1");
+    state["active_team_key"] = json!("T1");
+    if !legacy { state["teams"] = json!({"T1": state.clone(), "T2": team("T2")}); }
+    crate::state::persist::save_runtime_state(dir, &state).unwrap();
+    MessageStore::open(dir).unwrap();
+    std::fs::write(dir.join("result.json"), json!({
+        "schema_version": "result_envelope_v1", "result_id": "result-original",
+        "task_id": "original", "agent_id": "w1", "status": "success", "summary": "done",
+        "artifacts": [], "changes": [], "tests": [], "risks": [], "next_actions": []
+    }).to_string()).unwrap();
+}
+
+fn task(id: &str) -> Value { json!({"id": id, "title": id, "assignee": "w1"}) }
+
+fn start_writer(dir: &Path, action: &str, team: Option<&str>, payload: Value, pause: bool) -> Child {
+    let mut child = Command::new(std::env::current_exe().unwrap())
+        .args(["--exact", WORKER, "--ignored", "--nocapture"])
+        .env_clear().env("HOME", dir.join("home"))
+        .env("TA_S3_ACTION", action).env("TA_S3_TEAM", team.unwrap_or(""))
+        .env("TA_S3_PAYLOAD", payload.to_string()).env("TA_S3_PAUSE", if pause { "1" } else { "0" })
+        .current_dir(dir).stdin(Stdio::piped()).stdout(Stdio::piped()).stderr(Stdio::piped())
+        .spawn().unwrap();
+    if pause {
+        let mut reader = std::io::BufReader::new(child.stdout.take().unwrap());
+        loop {
+            let mut line = String::new();
+            assert!(reader.read_line(&mut line).unwrap() > 0, "writer exited before barrier");
+            print!("{line}");
+            if line.contains("S3_READY") { break; }
+        }
+        child.stdout = Some(reader.into_inner());
+    }
+    child
+}
+
+fn finish(mut child: Child, paused: bool) {
+    if paused { child.stdin.take().unwrap().write_all(b"commit\n").unwrap(); }
+    let output = child.wait_with_output().unwrap();
+    print!("{}", String::from_utf8_lossy(&output.stdout));
+    assert!(output.status.success(), "{}", String::from_utf8_lossy(&output.stderr));
+}
+
+fn write(dir: &Path, action: &str, team: Option<&str>, payload: Value) {
+    finish(start_writer(dir, action, team, payload, false), false);
+}
+
+#[test]
+#[ignore = "hermetic subprocess entry; parent contracts invoke this exact test"]
+fn s3_process_worker() {
+    let dir = std::env::current_dir().unwrap();
+    let action = std::env::var("TA_S3_ACTION").unwrap();
+    let team = std::env::var("TA_S3_TEAM").unwrap();
+    let team = (!team.is_empty()).then_some(team.as_str());
+    let payload: Value = serde_json::from_str(&std::env::var("TA_S3_PAYLOAD").unwrap()).unwrap();
+    if std::env::var("TA_S3_PAUSE").as_deref() == Ok("1") {
+        crate::state::repository::test_support::set_before_commit(|| {
+            println!("S3_READY");
+            std::io::stdout().flush().unwrap();
+            let mut line = String::new();
+            std::io::stdin().read_line(&mut line).unwrap();
+            assert_eq!(line.trim(), "commit");
+        });
+    }
+    let tools = crate::mcp_server::TeamOrchestratorTools::with_identity(
+        &dir, Some(crate::model::ids::AgentId::new("leader")), team.map(crate::model::ids::TeamKey::new),
+    );
+    match action.as_str() {
+        "assign" => { tools.assign_task(&payload, Some("bounded contract")).unwrap(); }
+        "note" => { println!("S3 note={:?}", tools.update_state(payload.as_str().unwrap()).unwrap()); }
+        "collect" => {
+            let output = crate::messaging::results::collect_for_team(&dir, Some(&dir.join("result.json")), false, team).unwrap();
+            assert_eq!(output["ok"], true);
+            println!("S3 collect={output}");
+        }
+        "sibling" => {
+            let mut state = StateRepository::new(&dir).load_workspace().unwrap();
+            state["teams"]["T3"] = json!({"session_name": "T3", "tasks": [task("third")], "notes": ["third"]});
+            StateRepository::new(&dir).save(StateWriteIntent::LaunchTeam { team_key: "T3" }, &state).unwrap();
+        }
+        "topology" => {
+            let mut state = StateRepository::new(&dir).load_team(Some("T1")).unwrap();
+            state["agents"]["w1"]["pane_id"] = json!("%22");
+            state["agents"]["w1"]["spawn_epoch"] = json!(2);
+            // A concurrent restart owns topology for this agent. StartAgent's
+            // add-only tail intentionally carries no existing-agent authority.
+            StateRepository::new(&dir).save(StateWriteIntent::RestartTeam {
+                team_key: "T1", topology_authority_agent_ids: &["w1"],
+                skip_capture_backfill_agent_ids: &[],
+            }, &state).unwrap();
+            assert_eq!(disk(&dir)["teams"]["T1"]["agents"]["w1"]["pane_id"], "%22");
+        }
+        _ => panic!("unexpected test action"),
+    }
+    println!("S3_COMMITTED {action}");
+}
+
+fn coordinator(dir: &Path, hook: SaveHook) -> Coordinator {
+    let transport = OfflineTransport::new().with_session_present(true)
+        .with_windows(vec![WindowName::new("live-peer")]);
+    Coordinator::for_test(WorkspacePath::new(dir.to_path_buf()),
+        Box::new(MockRegistry::new(&[], &[])), Box::new(transport), None, None)
+        .with_before_save_hook(hook)
+}
+
+#[test]
+fn s3_tick_preserves_tasks_notes_and_siblings() {
+    isolated("s3_tick_preserves_tasks_notes_and_siblings", |dir| {
+        seed(dir, false);
+        let hook: SaveHook = Box::new(|ws, observed| {
+            assert_eq!(observed["agents"]["w1"]["worker_state"], "DEAD", "tick must produce a real observation delta");
+            write(ws.as_path(), "assign", Some("T1"), task("new-task"));
+            write(ws.as_path(), "note", Some("T1"), json!("concurrent note"));
+            write(ws.as_path(), "collect", Some("T1"), Value::Null);
+            write(ws.as_path(), "note", Some("T2"), json!("sibling note"));
+            write(ws.as_path(), "sibling", None, Value::Null);
+            let latest = disk(ws.as_path());
+            assert_eq!(latest["teams"]["T1"]["agents"]["w1"]["pane_id"], observed["agents"]["w1"]["pane_id"]);
+            println!("S3 before tick save topology unchanged; committed business={}", latest["teams"]);
+            Ok(())
+        });
+        let report = coordinator(dir, hook).tick().unwrap();
+        assert!(report.ok, "tick must save its observation: {report:?}");
+        let state = disk(dir);
+        let team = &state["teams"]["T1"];
+        assert_eq!(team["tasks"][0]["accepted_result_id"], "result-original");
+        assert!(team["tasks"].as_array().unwrap().iter().any(|row| row["id"] == "new-task"));
+        assert_eq!(team["notes"], json!(["original note", "concurrent note"]));
+        assert_eq!(team["agents"]["w1"]["worker_state"], "DEAD");
+        assert_eq!(state["teams"]["T2"]["notes"], json!(["original note", "sibling note"]));
+        assert_eq!(state["teams"]["T3"]["notes"], json!(["third"]));
+        assert_eq!(state["tasks"], team["tasks"]);
+        assert_eq!(StateRepository::new(dir).load_team(Some("T1")).unwrap()["tasks"], team["tasks"]);
+        println!("S3 after tick save={state}");
+    });
+}
+
+#[test]
+fn s3_business_writers_commit_once_on_latest() {
+    isolated("s3_business_writers_commit_once_on_latest", |root| {
+        for (i, (left, right)) in [
+            (("assign", task("left")), ("assign", task("right"))),
+            (("note", json!("same note")), ("note", json!("same note"))),
+            (("note", json!("same note")), ("assign", task("right"))),
+            (("collect", Value::Null), ("assign", task("right"))),
+            (("collect", Value::Null), ("note", json!("same note"))),
+        ].into_iter().enumerate() {
+            let dir = root.join(i.to_string());
+            seed(&dir, false);
+            let waiting = start_writer(&dir, left.0, Some("T1"), left.1, true);
+            write(&dir, right.0, Some("T1"), right.1);
+            finish(waiting, true);
+            let state = disk(&dir);
+            let team = &state["teams"]["T1"];
+            if left.0 == "assign" { assert!(team["tasks"].as_array().unwrap().iter().any(|task| task["id"] == "left")); }
+            if right.0 == "assign" { assert!(team["tasks"].as_array().unwrap().iter().any(|task| task["id"] == "right")); }
+            if left.0 == "collect" { assert_eq!(team["tasks"][0]["accepted_result_id"], "result-original"); }
+            let notes = usize::from(left.0 == "note") + usize::from(right.0 == "note");
+            assert_eq!(team["notes"].as_array().unwrap().len(), 1 + notes);
+            if left.0 == "note" && right.0 == "assign" {
+                let markdown = std::fs::read_to_string(dir.join(".team/runtime/T1/team_state.md")).unwrap();
+                assert!(markdown.contains("right"), "note must render the committed task view: {markdown}");
+            }
+            if left.0 == "collect" {
+                write(&dir, "assign", Some("T1"), json!({"id": "original", "assignee": "w1", "title": "edited"}));
+                assert_eq!(disk(&dir)["teams"]["T1"]["tasks"][0]["accepted_result_id"], "result-original");
+            }
+            println!("S3 pair {i} canonical={team}");
+        }
+    });
+}
+
+#[test]
+fn s3_legacy_note_and_collection_keep_independent_updates() {
+    isolated("s3_legacy_note_and_collection_keep_independent_updates", |dir| {
+        seed(dir, true);
+        let waiting = start_writer(dir, "collect", None, Value::Null, true);
+        write(dir, "note", None, json!("legacy note"));
+        finish(waiting, true);
+        let state = disk(dir);
+        assert_eq!(state["tasks"][0]["accepted_result_id"], "result-original");
+        assert_eq!(state["notes"], json!(["original note", "legacy note"]));
+        assert!(state.get("teams").is_none(), "legacy single Team shape remains valid");
+    });
+}
+
+#[test]
+fn s3_observation_keeps_live_topology_conflict() {
+    isolated("s3_observation_keeps_live_topology_conflict", |dir| {
+        seed(dir, false);
+        let hook: SaveHook = Box::new(|ws, _| { write(ws.as_path(), "topology", Some("T1"), Value::Null); Ok(()) });
+        let report = coordinator(dir, hook).tick().unwrap();
+        assert_eq!(report.reason, Some(TickStopReason::PersistenceDegraded));
+        assert_eq!(disk(dir)["teams"]["T1"]["agents"]["w1"]["pane_id"], "%22");
+    });
+}

package/crates/team-agent/src/coordinator/tick.rs

@@ -193,6 +193,8 @@ pub struct Coordinator {
     /// bug-084 save 注入钩。`None` ⇔ 真实 `state::save_runtime_state`。
     #[allow(dead_code)]
     save_hook: Option<SaveHook>,
+    #[cfg(test)]
+    before_save_hook: Option<SaveHook>,
     /// tick 副作用 ORDER 探针。`None` ⇔ 不记录(生产)。
     #[allow(dead_code)]
     order_recorder: Option<OrderRecorder>,
@@ -219,6 +221,8 @@ impl Coordinator {
             transport,
             daemon_team_key: None,
             save_hook: None,
+            #[cfg(test)]
+            before_save_hook: None,
             order_recorder: None,
         }
     }
@@ -263,10 +267,18 @@ impl Coordinator {
             transport,
             daemon_team_key: None,
             save_hook,
+            before_save_hook: None,
             order_recorder,
         }
     }
 
+    /// A test barrier before the real repository save; never replaces the save.
+    #[cfg(test)]
+    pub(crate) fn with_before_save_hook(mut self, hook: SaveHook) -> Self {
+        self.before_save_hook = Some(hook);
+        self
+    }
+
     // ── tick 编排(lifecycle.py:250-385)──────────────────────────────────────
 
     /// 单次 tick(`coordinator_tick`,`lifecycle.py:250`)。固定顺序串 step 8-11 原子:
@@ -308,6 +320,7 @@ impl Coordinator {
             self.daemon_team_key.as_deref(),
         )
         .unwrap_or(raw_state);
+        let before_observation = state.clone();
         let store = crate::message_store::MessageStore::open(self.workspace.as_path())?;
         let event_log = EventLog::new(self.workspace.as_path());
         increment_coordinator_tick_iteration_count(&self.workspace);
@@ -487,26 +500,21 @@ impl Coordinator {
         };
 
         self.record_step(TickStepGroup::Persist, "atomic_save");
+        #[cfg(test)]
+        if let Some(hook) = &self.before_save_hook {
+            hook(&self.workspace, &state)?;
+        }
         let saved = match &self.save_hook {
             Some(hook) => hook(&self.workspace, &state),
             None => {
-                // 0.5.42 S1b (s1b-writer-cluster-locate.md §3.2 /
-                // §4.4): the daemon tick's single terminal save
-                // routes through `StateRepository` with the
-                // `CoordinatorTick` intent. Repository dispatch is
-                // byte-identical to the old `save_team_scoped_state`
-                // helper (see `state/repository.rs:CoordinatorTick =>
-                // helper_write_team_scoped`), so persist/merge/lock/
-                // atomic-rename semantics and degraded-mapping stay
-                // unchanged. No cached repository, no extra load, no
-                // retry — the caller still owns the `Value` and
-                // failure still returns `TickReport{PersistenceDegraded}`
-                // via the `saved.is_err()` branch below.
+                // Keep the sampled topology guard, but commit only this tick's
+                // observations onto latest so task/note writers cannot be lost.
                 let team_key = crate::state::projection::team_state_key(&state);
-                crate::state::repository::StateRepository::new(self.workspace.as_path()).save(
+                crate::state::repository::StateRepository::new(self.workspace.as_path()).commit_observations(
                     crate::state::repository::StateWriteIntent::CoordinatorTick {
                         team_key: team_key.as_str(),
                     },
+                    &before_observation,
                     &state,
                 )
             }

package/crates/team-agent/src/leader/start.rs

@@ -1412,13 +1412,6 @@ extern "C" fn managed_term_handler(_: libc::c_int) {
 }
 
 fn managed_attach_should_teardown(watch: &ManagedAttachWatch<'_>) -> bool {
-    let marker = crate::tmux_backend::leader_provider_exit_marker(watch.provider_label);
-    let target = Target::Pane(watch.spawned.pane_id.clone());
-    if let Ok(cap) = watch.transport.capture(&target, CaptureRange::Tail(80)) {
-        if cap.text.contains(&marker) || cap.text.contains("[team-agent] Provider exited") {
-            return true;
-        }
-    }
     matches!(
         leader_provider_health(
             watch.transport,
@@ -1674,65 +1667,21 @@ fn ensure_managed_provider_live_after_attach(
     )))
 }
 
-/// 0.4.x (CR C-3 P0): leader provider health reconciliation. The default
-/// `liveness()` check only proves the pane is ADDRESSABLE via tmux — it
-/// returns `Live` even when the provider has exited and the wrapper shell
-/// remains at its inert tail. This function distinguishes
-/// `provider_alive` from `provider_exited` by:
-///   1. Reading `pane_current_command` (tmux `#{pane_current_command}`).
-///   2. If the current command matches the expected provider binary (or
-///      one of its known aliases), report `Alive`.
-///   3. If the current command is a shell tail process AND the pane
-///      content contains the exit marker `[team-agent] <provider> exited`
-///      (emitted by `leader_shell_wrapper_command`), report
-///      `ProviderExited`.
-///   4. Otherwise (Unknown shell, no marker), report `Alive` as the
-///      conservative default — avoid false-positive exit alarms.
-///
-/// Note: when the leader shell wrapper is used (CR C-2), a provider exit
-/// leaves the pane as an inert `/bin/sh -c` tail with the exit marker in
-/// scrollback. Pre-wrapper code that hit `exec claude` would have left the
-/// pane as `[exited]` and `liveness()` would have returned `Dead`. The new
-/// failure mode requires this richer health check to surface
-/// `leader_provider_exited` as a distinct status.
+/// Reconcile real pane liveness with the supervising wrapper's exit receipt.
+/// Restored provider output may contain any exit-marker text; it is not process
+/// state and must never authorize destructive managed-window cleanup.
 pub fn leader_provider_health(
     transport: &dyn Transport,
     pane_id: &PaneId,
-    expected_provider_label: &str,
+    _expected_provider_label: &str,
 ) -> LeaderProviderHealth {
-    use crate::transport::{CaptureRange, PaneField, Target};
-    let liveness = transport.liveness(pane_id).ok();
-    if matches!(liveness, Some(PaneLiveness::Dead)) {
+    if matches!(transport.liveness(pane_id), Ok(PaneLiveness::Dead)) {
         return LeaderProviderHealth::Unreachable;
     }
-    let target = Target::Pane(pane_id.clone());
-    let current_command = transport
-        .query(&target, PaneField::PaneCurrentCommand)
-        .ok()
-        .flatten()
-        .map(|s| s.trim().to_lowercase())
-        .unwrap_or_default();
-    if !current_command.is_empty()
-        && (current_command == expected_provider_label
-            || current_command.contains(expected_provider_label))
-    {
-        return LeaderProviderHealth::Alive;
+    if matches!(transport.provider_exit_status(pane_id), Ok(Some(_))) {
+        return LeaderProviderHealth::ProviderExited;
     }
-    // Current command is NOT the provider — likely fell back to shell.
-    let is_shell = is_interactive_shell_basename(&current_command);
-    if is_shell {
-        // CR R6: marker text from single-source `leader_provider_exit_marker`
-        // so the wrapper printf and the health-check substring cannot drift.
-        let exit_marker_substr =
-            crate::tmux_backend::leader_provider_exit_marker(expected_provider_label);
-        if let Ok(cap) = transport.capture(&target, CaptureRange::Tail(200)) {
-            if cap.text.contains(&exit_marker_substr) {
-                return LeaderProviderHealth::ProviderExited;
-            }
-        }
-    }
-    // Conservative default — pane addressable, but couldn't positively
-    // confirm provider exit. Treat as Alive.
+    // Missing/unsupported receipts (including old wrappers) are not proof of exit.
     LeaderProviderHealth::Alive
 }
 
@@ -1750,7 +1699,6 @@ pub enum LeaderProviderHealth {
 
 /// 0.4.x (CR R6 + R3): single-source shell-tail detection.
 /// Used by:
-///   - `leader_provider_health` to decide "pane is at the shell tail"
 ///   - shutdown logic to recognise a leader pane in shell-tail mode
 ///     as still owned by the leader (not stray).
 ///
@@ -3001,6 +2949,7 @@ mod tests {
         screens: Mutex<Vec<String>>,
         sent: Mutex<Vec<(Target, Vec<Key>)>>,
         liveness: PaneLiveness,
+        exit_status: Option<u8>,
         targets: Vec<PaneInfo>,
         window_options: Mutex<Vec<(String, String)>>,
         window_option_error: Mutex<Option<String>>,
@@ -3014,6 +2963,7 @@ mod tests {
                 screens: Mutex::new(screens),
                 sent: Mutex::new(Vec::new()),
                 liveness: PaneLiveness::Unknown,
+                exit_status: None,
                 targets: Vec::new(),
                 window_options: Mutex::new(Vec::new()),
                 window_option_error: Mutex::new(None),
@@ -3027,6 +2977,7 @@ mod tests {
                 screens: Mutex::new(Vec::new()),
                 sent: Mutex::new(Vec::new()),
                 liveness,
+                exit_status: None,
                 targets: Vec::new(),
                 window_options: Mutex::new(Vec::new()),
                 window_option_error: Mutex::new(None),
@@ -3040,6 +2991,7 @@ mod tests {
                 screens: Mutex::new(Vec::new()),
                 sent: Mutex::new(Vec::new()),
                 liveness,
+                exit_status: None,
                 targets,
                 window_options: Mutex::new(Vec::new()),
                 window_option_error: Mutex::new(None),
@@ -3055,6 +3007,7 @@ mod tests {
                 screens: Mutex::new(Vec::new()),
                 sent: Mutex::new(Vec::new()),
                 liveness: PaneLiveness::Unknown,
+                exit_status: None,
                 targets: Vec::new(),
                 window_options: Mutex::new(Vec::new()),
                 window_option_error: Mutex::new(Some(error.to_string())),
@@ -3186,6 +3139,10 @@ mod tests {
             Ok(self.liveness)
         }
 
+        fn provider_exit_status(&self, _pane: &PaneId) -> Result<Option<u8>, TransportError> {
+            Ok(self.exit_status)
+        }
+
         fn list_targets(&self) -> Result<Vec<PaneInfo>, TransportError> {
             Ok(self.targets.clone())
         }
@@ -3859,22 +3816,37 @@ mod tests {
     }
 
     #[test]
-    fn managed_attach_teardown_detects_provider_exit_marker() {
+    fn managed_attach_teardown_requires_exit_receipt_not_replayed_markers() {
         let spawned = managed_spawn_result();
-        let transport = ScriptedTransport::new(vec![
-            "[team-agent] claude exited with 1\n[team-agent] Provider exited; this pane no longer accepts input.".to_string(),
+        let mut transport = ScriptedTransport::new(vec![
+            "[team-agent] pi exited with 1\n[team-agent] Provider exited".to_string(),
         ]);
-        let watch = super::ManagedAttachWatch {
-            transport: &transport,
-            spawned: &spawned,
-            session: &spawned.session,
-            session_existed_before: false,
-            workspace: Path::new("/tmp"),
-            provider_label: "claude",
-        };
-        assert!(
-            super::managed_attach_should_teardown(&watch),
-            "exit marker in capture must trigger teardown"
+        transport.liveness = PaneLiveness::Live;
+        for exit_status in [None, Some(0), Some(17)] {
+            transport.exit_status = exit_status;
+            let watch = super::ManagedAttachWatch {
+                transport: &transport,
+                spawned: &spawned,
+                session: &spawned.session,
+                session_existed_before: false,
+                workspace: Path::new("/tmp"),
+                provider_label: "pi",
+            };
+            assert_eq!(
+                super::managed_attach_should_teardown(&watch),
+                exit_status.is_some()
+            );
+        }
+        assert_eq!(
+            transport.screens.lock().unwrap().len(),
+            1,
+            "health must not read history"
+        );
+        transport.liveness = PaneLiveness::Dead;
+        transport.exit_status = None;
+        assert_eq!(
+            super::leader_provider_health(&transport, &spawned.pane_id, "pi"),
+            super::LeaderProviderHealth::Unreachable
         );
     }
 

package/crates/team-agent/src/lifecycle/launch/pi_mcp.rs

@@ -151,14 +151,30 @@ pub(crate) fn parse_pi_list_models_table(bytes: &[u8]) -> Result<Vec<String>, Pr
         if line.trim().is_empty() {
             continue;
         }
-        let columns = line.split_whitespace().collect::<Vec<_>>();
-        if columns.len() < 2 || columns[0].is_empty() || columns[1].is_empty() {
-            return Err(ProviderError::Command(format!(
+        let malformed = || {
+            ProviderError::Command(format!(
                 "Pi model catalog row {} is malformed",
                 index + 2
-            )));
+            ))
+        };
+        let (provider, model) = line
+            .trim()
+            .split_once(char::is_whitespace)
+            .ok_or_else(malformed)?;
+        let mut model = model.trim();
+        // Pi prints the raw model id, which may contain spaces. Only the
+        // capability columns following it are single whitespace-free values.
+        for _ in 2..header_columns.len() {
+            model = model
+                .rsplit_once(char::is_whitespace)
+                .ok_or_else(malformed)?
+                .0
+                .trim_end();
+        }
+        if model.is_empty() {
+            return Err(malformed());
         }
-        let exact = format!("{}/{}", columns[0], columns[1]);
+        let exact = format!("{provider}/{model}");
         if !seen.insert(exact.clone()) {
             return Err(ProviderError::Command(format!(
                 "Pi model catalog contains duplicate exact id {exact:?}"

package/crates/team-agent/src/lifecycle/tests/fixtures/pi_list_models_spaced_ids.stdout.txt

@@ -0,0 +1,9 @@
+provider      model                         context  max-out  thinking  images
+cursor        claude-opus-4-7@1m:fast       1M       16.4K    yes       yes
+cursor        claude-opus-4-7@1m:slow       1M       16.4K    yes       yes
+openai-codex  gpt-5.6-luna                  272K     128K     yes       yes
+team-agent    Claude Opus 4.6 (Thinking)    200K     32.8K    yes       yes
+team-agent    Claude Sonnet 4.6 (Thinking)  200K     32.8K    yes       yes
+team-agent    Gemini 3.8 Flash              200K     32.8K    yes       yes
+team-agent    gpt-5.6-luna                  200K     32.8K    yes       yes
+team-agent    qwen3.8-27b                   262.1K   32.8K    yes       yes

package/crates/team-agent/src/lifecycle/tests/pi_catalog_red.rs

@@ -8,6 +8,77 @@ use crate::model::enums::ProviderEffort;
 use crate::provider::adapters::pi::{build_pi_command_argv, PiCommandRequest, PiSessionSelector};
 
 const CATALOG: &[u8] = include_bytes!("fixtures/pi_list_models_g0.stdout.txt");
+// Public pi --list-models rows captured for issue #186, preserving column widths.
+const SPACED_IDS_CATALOG: &[u8] = include_bytes!("fixtures/pi_list_models_spaced_ids.stdout.txt");
+
+#[test]
+fn pi_catalog_preserves_spaced_ids_and_qualified_slug_variants() {
+    let models = parse_pi_list_models_table(SPACED_IDS_CATALOG).expect("public catalog rows");
+    assert_eq!(
+        models,
+        vec![
+            "cursor/claude-opus-4-7@1m:fast",
+            "cursor/claude-opus-4-7@1m:slow",
+            "openai-codex/gpt-5.6-luna",
+            "team-agent/Claude Opus 4.6 (Thinking)",
+            "team-agent/Claude Sonnet 4.6 (Thinking)",
+            "team-agent/Gemini 3.8 Flash",
+            "team-agent/gpt-5.6-luna",
+            "team-agent/qwen3.8-27b",
+        ]
+    );
+    for exact in &models {
+        assert_eq!(select_exact_pi_model(&models, exact).unwrap(), *exact);
+        assert!(argv_has_pair(&command_for_model(exact), "--model", exact));
+    }
+}
+
+#[test]
+fn pi_catalog_still_rejects_duplicate_complete_spaced_ids() {
+    let text = std::str::from_utf8(SPACED_IDS_CATALOG).unwrap();
+    let repeated = text
+        .lines()
+        .find(|line| line.contains("Claude Opus 4.6 (Thinking)"))
+        .unwrap();
+    let duplicate = format!("{text}{repeated}\n");
+    let error = parse_pi_list_models_table(duplicate.as_bytes()).unwrap_err();
+    assert!(error
+        .to_string()
+        .contains("duplicate exact id \"team-agent/Claude Opus 4.6 (Thinking)\""));
+    let exact = "team-agent/Claude Opus 4.6 (Thinking)";
+    assert!(select_exact_pi_model(&[exact.into(), exact.into()], exact).is_err());
+}
+
+#[test]
+fn pi_catalog_preserves_internal_whitespace_with_compact_and_full_headers() {
+    for catalog in [
+        "provider model\r\nteam-agent\tClaude  Opus 4.6 (Thinking)  \r\n",
+        "provider model context max-out thinking images\r\nteam-agent\tClaude  Opus 4.6 (Thinking)\t200K  32.8K\tyes  yes  \r\n",
+    ] {
+        assert_eq!(
+            parse_pi_list_models_table(catalog.as_bytes()).unwrap(),
+            vec!["team-agent/Claude  Opus 4.6 (Thinking)"]
+        );
+    }
+}
+
+#[test]
+fn pi_catalog_rejects_rows_without_model_or_required_trailing_fields() {
+    for row in [
+        "team-agent",
+        "team-agent 200K 32.8K yes yes",
+        "team-agent gpt-5.6-luna 200K 32.8K yes",
+    ] {
+        let catalog = format!("provider model context max-out thinking images\n{row}\n");
+        assert!(
+            parse_pi_list_models_table(catalog.as_bytes())
+                .unwrap_err()
+                .to_string()
+                .contains("row 2 is malformed"),
+            "missing model or capability fields must refuse: {row}"
+        );
+    }
+}
 
 fn argv_has_pair(argv: &[String], flag: &str, value: &str) -> bool {
     argv.windows(2)