@team-agent/installer 0.5.78 → 0.5.81

package/crates/team-agent/src/provider/session_scan/common.rs

@@ -441,9 +441,11 @@ fn collect_candidate_files(
     allowed_team_root: Option<&Path>,
     out: &mut Vec<SessionCandidate>,
 ) -> Result<(), ProviderError> {
-    if depth > 4 {
+    if depth > 4 || !may_traverse_session_directory(dir, allowed_team_root) {
         return Ok(());
     }
+    #[cfg(test)]
+    tests::record_directory_read(dir);
     let entries = match std::fs::read_dir(dir) {
         Ok(entries) => entries,
         Err(e) if depth == 0 => return Err(ProviderError::Io(format!("{}: {e}", dir.display()))),
@@ -453,8 +455,23 @@ fn collect_candidate_files(
         let Ok(entry) = entry else {
             continue;
         };
+        #[cfg(test)]
+        tests::record_entry();
         let path = entry.path();
-        if path.is_dir() {
+        if !may_traverse_session_directory(&path, allowed_team_root) {
+            continue;
+        }
+        // read_dir already supplies the type for ordinary entries. Only links
+        // (or an unavailable type) need the old, following metadata lookup.
+        let is_dir = match entry.file_type() {
+            Ok(kind) if !kind.is_symlink() => kind.is_dir(),
+            _ => {
+                #[cfg(test)]
+                tests::record_following_metadata();
+                path.is_dir()
+            }
+        };
+        if is_dir {
             collect_candidate_files(
                 &path,
                 agent_id,
@@ -473,6 +490,11 @@ fn collect_candidate_files(
     Ok(())
 }
 
+fn may_traverse_session_directory(path: &Path, allowed_team_root: Option<&Path>) -> bool {
+    !path_is_under_team_runtime(path)
+        || allowed_team_root.is_some_and(|root| path.starts_with(root) || root.starts_with(path))
+}
+
 fn looks_like_session_file(path: &Path, agent_id: &str, allowed_team_root: Option<&Path>) -> bool {
     if path_is_under_team_runtime(path)
         && !allowed_team_root.is_some_and(|root| path.starts_with(root))

package/crates/team-agent/src/state/abnormal_watch/tests/mod.rs

@@ -0,0 +1,248 @@
+use super::*;
+use crate::state::persist::{load_runtime_state, runtime_state_path, save_runtime_state};
+
+fn workspace() -> std::path::PathBuf {
+    use std::sync::atomic::{AtomicUsize, Ordering};
+    static NEXT: AtomicUsize = AtomicUsize::new(0);
+    let path = std::env::temp_dir().join(format!(
+        "watch-188-{}-{}",
+        std::process::id(),
+        NEXT.fetch_add(1, Ordering::Relaxed)
+    ));
+    std::fs::create_dir_all(path.join(".team/runtime")).unwrap();
+    path
+}
+
+#[test]
+fn complete_empty_roster_prunes_but_missing_roster_and_paused_members_survive() {
+    let mut state = json!({
+        "agents": {},
+        "teams": {
+            "empty": {"agents": {}, "coordinator": {"abnormal_exit_watch": {"old": {}}}},
+            "unknown": {"coordinator": {"abnormal_exit_watch": {"old": {}}}},
+            "paused": {"agents": {"p": {"status": "paused"}}, "coordinator": {
+                "abnormal_exit_watch": {"p": {"last_notified_key": "keep"}, "gone": {}}
+            }}
+        },
+        "coordinator": {"abnormal_exit_watch": {"unknown": {}}}
+    });
+    compact_after_merge(&mut state, None, &[]);
+    assert_eq!(
+        state["teams"]["empty"]["coordinator"]["abnormal_exit_watch"],
+        json!({})
+    );
+    assert_eq!(
+        state["teams"]["unknown"]["coordinator"]["abnormal_exit_watch"],
+        json!({"old": {}})
+    );
+    assert_eq!(
+        state["teams"]["paused"]["coordinator"]["abnormal_exit_watch"],
+        json!({"p": {"last_notified_key": "keep"}})
+    );
+    assert_eq!(
+        state["coordinator"]["abnormal_exit_watch"],
+        json!({"unknown": {}})
+    );
+    assert!(!needs_compaction(&state));
+}
+
+#[test]
+fn root_legacy_union_is_not_migrated_by_bare_agent_name() {
+    let mut state = json!({"agents": {}, "teams": {
+        "a": {"agents": {"w": {}}}, "b": {"agents": {"w": {}}}
+    }, "coordinator": {"abnormal_exit_watch": {"w": {"last_notified_key": "legacy"}, "gone": {}}}});
+    compact_after_merge(&mut state, None, &[]);
+    assert_eq!(
+        state["coordinator"]["abnormal_exit_watch"]
+            .as_object()
+            .unwrap()
+            .len(),
+        1
+    );
+    for team in ["a", "b"] {
+        let projection = crate::state::projection::project_top_level_view(&state, team);
+        assert!(projection["coordinator"]
+            .get("abnormal_exit_watch")
+            .is_none());
+    }
+}
+
+#[test]
+fn fallback_preserves_other_coordinator_fields_and_owned_watch() {
+    let state = json!({"coordinator": {"tick": 9, "abnormal_exit_watch": {"w": {}}}, "teams": {
+        "a": {"agents": {}},
+        "b": {"agents": {}, "coordinator": {"abnormal_exit_watch": {"owned": {}}, "tick": 2}}
+    }});
+    let a = crate::state::projection::project_top_level_view(&state, "a");
+    let b = crate::state::projection::project_top_level_view(&state, "b");
+    assert_eq!(a["coordinator"], json!({"tick": 9}));
+    assert_eq!(b["coordinator"], state["teams"]["b"]["coordinator"]);
+}
+
+fn observed() -> Value {
+    let mut state = json!({"active_team_key": "a", "agents": {"w": {
+        "provider": "codex", "rollout_path": "/fixture/w.jsonl", "spawn_epoch": 1
+    }}, "coordinator": {"abnormal_exit_watch": {"w": {"last_notified_key": "keep"}}}});
+    state["coordinator"]["abnormal_exit_watch"]["w"]["watch_identity"] =
+        observation_identity(&state, "w").unwrap();
+    state
+}
+
+#[test]
+fn observation_identity_separates_same_name_team_path_and_spawn_generation() {
+    let initial = observed();
+    let mut unchanged = initial.clone();
+    begin_observation(&mut unchanged, "w");
+    begin_observation(&mut unchanged, "w");
+    assert_eq!(
+        unchanged, initial,
+        "same observation retains notification dedupe"
+    );
+    for (pointer, value) in [
+        ("/active_team_key", json!("b")),
+        ("/agents/w/rollout_path", json!("/fixture/other.jsonl")),
+        ("/agents/w/spawn_epoch", json!(2)),
+        ("/agents/w/provider", json!("claude")),
+        ("/agents/w/spawned_at", json!("new-incarnation")),
+    ] {
+        let mut changed = initial.clone();
+        if pointer.ends_with("spawned_at") {
+            changed["agents"]["w"]["spawned_at"] = value;
+        } else {
+            *changed.pointer_mut(pointer).unwrap() = value;
+        }
+        begin_observation(&mut changed, "w");
+        assert!(changed["coordinator"]["abnormal_exit_watch"]
+            .get("w")
+            .is_none());
+    }
+}
+
+#[test]
+fn legacy_unknown_identity_is_retained_until_member_is_observed() {
+    let mut state = observed();
+    state["coordinator"]["abnormal_exit_watch"]["w"]
+        .as_object_mut()
+        .unwrap()
+        .remove("watch_identity");
+    let legacy = state.clone();
+    compact_after_merge(&mut state, None, &[]);
+    assert_eq!(
+        state, legacy,
+        "membership compaction cannot guess legacy identity"
+    );
+    begin_observation(&mut state, "w");
+    assert!(state["coordinator"]["abnormal_exit_watch"]
+        .get("w")
+        .is_none());
+}
+
+#[test]
+fn unchanged_normal_save_compacts_large_old_snapshots_and_cannot_resurrect_them() {
+    let ws = workspace();
+    let watch: serde_json::Map<String, Value> = (0..100)
+        .map(|n| {
+            (
+                format!("old-{n}"),
+                json!({"last_notified_key": "x".repeat(100)}),
+            )
+        })
+        .collect();
+    let mut state =
+        json!({"agents": {}, "teams": {}, "coordinator": {"abnormal_exit_watch": watch}});
+    for n in 0..8 {
+        state["teams"][format!("team-{n}")] =
+            json!({"agents": {}, "coordinator": state["coordinator"].clone()});
+    }
+    let original = serde_json::to_vec(&state).unwrap().len();
+    // Warm the old cache without invoking the load-time migrations, which
+    // could otherwise compact before the no-change save under test.
+    crate::state::persist::save_runtime_state_without_migrations(&ws, &state).unwrap();
+    let stale = state;
+    assert_eq!(
+        serde_json::from_slice::<Value>(&std::fs::read(runtime_state_path(&ws)).unwrap())
+            .unwrap(),
+        stale
+    );
+    save_runtime_state(&ws, &stale).unwrap();
+    let first = std::fs::read(runtime_state_path(&ws)).unwrap();
+    assert!(
+        first.len() < original / 10,
+        "size must depend on actual members, not watch x teams"
+    );
+    save_runtime_state(&ws, &stale).unwrap();
+    assert_eq!(std::fs::read(runtime_state_path(&ws)).unwrap(), first);
+    std::fs::remove_dir_all(ws).unwrap();
+}
+
+#[test]
+fn latest_roster_merge_precedes_pruning_and_explicit_deletion_removes_watch() {
+    let ws = workspace();
+    let latest = json!({"active_team_key": "a", "session_name": "team-a", "agents": {
+        "w": {"agent_id": "w", "provider": "codex", "status": "paused"}
+    }, "coordinator": {"abnormal_exit_watch": {"w": {"last_notified_key": "keep"}}}});
+    save_runtime_state(&ws, &latest).unwrap();
+    let mut stale = load_runtime_state(&ws).unwrap();
+    stale["agents"] = json!({});
+    save_runtime_state(&ws, &stale).unwrap();
+    let merged = load_runtime_state(&ws).unwrap();
+    assert!(merged["agents"].get("w").is_some());
+    assert_eq!(
+        merged["coordinator"]["abnormal_exit_watch"]["w"]["last_notified_key"],
+        "keep"
+    );
+    crate::state::persist::save_runtime_state_with_deleted_agents(&ws, &stale, &["w"]).unwrap();
+    let removed = load_runtime_state(&ws).unwrap();
+    assert!(removed["agents"].get("w").is_none());
+    assert_eq!(removed["coordinator"]["abnormal_exit_watch"], json!({}));
+    std::fs::remove_dir_all(ws).unwrap();
+}
+
+#[test]
+fn unknown_team_retains_history_until_observation_but_never_authorizes_reuse() {
+    let mut state = observed();
+    state["active_team_key"] = Value::Null;
+    let before = state.clone();
+    assert!(observation_identity(&state, "w").is_none());
+    compact_after_merge(&mut state, None, &[]);
+    assert_eq!(state, before);
+    assert!(!matches_observation(
+        &state,
+        "w",
+        &state["coordinator"]["abnormal_exit_watch"]["w"]
+    ));
+    begin_observation(&mut state, "w");
+    assert!(state["coordinator"]["abnormal_exit_watch"]
+        .get("w")
+        .is_none());
+}
+
+#[test]
+fn malformed_team_catalog_does_not_authorize_root_pruning() {
+    let mut state =
+        json!({"agents": {}, "teams": [], "coordinator": {"abnormal_exit_watch": {"w": {}}}});
+    let before = state.clone();
+    compact_after_merge(&mut state, None, &[]);
+    assert_eq!(state, before);
+    assert!(!needs_compaction(&state));
+}
+
+#[test]
+fn lock_held_latest_membership_protects_rows_without_roster_stub_fields() {
+    let latest = json!({"agents": {"unknown-row": {}}, "teams": {
+        "new-sibling": {"agents": {"sibling": {}}}
+    }});
+    let mut incoming = json!({"agents": {}, "coordinator": {"abnormal_exit_watch": {
+        "unknown-row": {}, "sibling": {}, "gone": {}
+    }}});
+    compact_after_merge(&mut incoming, Some(&latest), &[]);
+    assert_eq!(
+        incoming["coordinator"]["abnormal_exit_watch"],
+        json!({"unknown-row": {}, "sibling": {}})
+    );
+    compact_after_merge(&mut incoming, Some(&latest), &["unknown-row"]);
+    assert_eq!(
+        incoming["coordinator"]["abnormal_exit_watch"],
+        json!({"sibling": {}})
+    );
+}

package/crates/team-agent/src/state/abnormal_watch.rs

@@ -0,0 +1,144 @@
+//! Scope and lifecycle boundaries for the abnormal-exit observation cache.
+use std::collections::BTreeSet;
+
+use serde_json::{json, Value};
+
+fn members(state: &Value) -> Option<BTreeSet<String>> {
+    Some(state.get("agents")?.as_object()?.keys().cloned().collect())
+}
+
+// A missing roster is unknown. Only a complete, lock-merged roster authorizes
+// discarding absent members; liveness, pause status and record age do not.
+fn scopes(state: &Value) -> Vec<(Option<String>, Option<BTreeSet<String>>)> {
+    let mut root = members(state);
+    if state.get("teams").is_some_and(|teams| !teams.is_object()) {
+        root = None;
+    }
+    let mut scopes = Vec::new();
+    if let Some(teams) = state.get("teams").and_then(Value::as_object) {
+        for (team, entry) in teams {
+            let roster = members(entry);
+            root = match (root, &roster) {
+                (Some(mut union), Some(keys)) => {
+                    union.extend(keys.iter().cloned());
+                    Some(union)
+                }
+                _ => None,
+            };
+            scopes.push((Some(team.clone()), roster));
+        }
+    }
+    scopes.push((None, root));
+    scopes
+}
+
+pub(crate) fn needs_compaction(state: &Value) -> bool {
+    scopes(state).into_iter().any(|(team, roster)| {
+        let entry = team.as_ref().map_or(state, |key| &state["teams"][key]);
+        roster.is_some_and(|keys| {
+            entry
+                .pointer("/coordinator/abnormal_exit_watch")
+                .and_then(Value::as_object)
+                .is_some_and(|watch| watch.keys().any(|key| !keys.contains(key)))
+        })
+    })
+}
+
+/// Call only after the persistence lock's latest-roster merge.
+pub(crate) fn compact_after_merge(state: &mut Value, latest: Option<&Value>, deleted: &[&str]) {
+    let latest_scopes = latest.map(scopes).unwrap_or_default();
+    for (team, mut roster) in scopes(state) {
+        // The normal merge may omit a roster row with no allowlisted stub
+        // fields, or a whole sibling absent from a stale input. Membership in
+        // lock-held latest still forbids pruning its observation. Only explicit
+        // deletion authority can subtract it from this retention union.
+        if let Some((_, latest_roster)) = latest_scopes.iter().find(|(key, _)| key == &team) {
+            roster = match (roster, latest_roster) {
+                (Some(mut keys), Some(latest_keys)) => {
+                    keys.extend(
+                        latest_keys
+                            .iter()
+                            .filter(|key| !deleted.contains(&key.as_str()))
+                            .cloned(),
+                    );
+                    Some(keys)
+                }
+                _ => None,
+            };
+        }
+        let Some(keys) = roster else { continue };
+        let entry = match team {
+            Some(team) => &mut state["teams"][&team],
+            None => &mut *state,
+        };
+        if let Some(watch) = entry
+            .pointer_mut("/coordinator/abnormal_exit_watch")
+            .and_then(Value::as_object_mut)
+        {
+            watch.retain(|key, _| keys.contains(key));
+        }
+    }
+}
+
+/// New observations carry their team and cohort, never just a bare agent id.
+pub(crate) fn observation_identity(state: &Value, agent_id: &str) -> Option<Value> {
+    let agent = state.get("agents")?.get(agent_id)?;
+    let provider = crate::provider::wire::parse_provider(agent.get("provider")?.as_str()?)?;
+    let path = ["rollout_path", "transcript_path", "session_log_path"]
+        .into_iter()
+        .find_map(|key| agent.get(key).and_then(Value::as_str))
+        .filter(|path| !path.is_empty())?;
+    let spawn_epoch = agent.get("spawn_epoch").and_then(Value::as_u64);
+    let spawned_at = agent
+        .get("spawned_at")
+        .and_then(Value::as_str)
+        .filter(|value| !value.is_empty());
+    // Preserve the watcher's existing legacy cohort: missing spawn fields
+    // remain explicit nulls, never a fabricated generation. A later known
+    // cohort changes this identity and establishes a new baseline.
+    let team = state
+        .get("active_team_key")
+        .and_then(Value::as_str)
+        .filter(|team| !team.is_empty())
+        .map(str::to_string)
+        .or_else(|| {
+            let team = super::projection::team_state_key(state);
+            (team != super::projection::CURRENT_TEAM_ALIAS).then_some(team)
+        })?;
+    Some(json!({
+        "team_key": team,
+        "agent_id": agent_id,
+        "provider": crate::provider::wire::provider_wire(provider),
+        "path": path,
+        "spawn_epoch": spawn_epoch,
+        "spawned_at": spawned_at,
+    }))
+}
+
+pub(crate) fn matches_observation(state: &Value, agent_id: &str, row: &Value) -> bool {
+    observation_identity(state, agent_id)
+        .is_some_and(|identity| row.get("watch_identity") == Some(&identity))
+}
+
+/// Legacy/foreign-cohort facts cannot be reused as current observation evidence.
+/// This is invoked only when actually observing the member, not for paused or
+/// otherwise ineligible members. The next scan establishes the ordinary baseline.
+pub(crate) fn begin_observation(state: &mut Value, agent_id: &str) {
+    let identity = observation_identity(state, agent_id);
+    if let Some(watch) = state
+        .pointer_mut("/coordinator/abnormal_exit_watch")
+        .and_then(Value::as_object_mut)
+    {
+        if watch.get(agent_id).is_some_and(|row| {
+            identity
+                .as_ref()
+                .is_none_or(|identity| row.get("watch_identity") != Some(identity))
+        }) {
+            watch.remove(agent_id);
+        }
+    }
+}
+
+#[cfg(test)]
+#[allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
+mod tests;

package/crates/team-agent/src/state/mod.rs

@@ -15,6 +15,7 @@
 //! 绝不 in-place truncate,绝不让审计/重试失败拖垮可见的原 state。
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
 
+pub(crate) mod abnormal_watch;
 pub mod identity;
 // Stage 0 of identity-boundary unified plan (architect direction 2026-06-23):
 // shared identity primitives. Pure additive — Stage 1+ consume these.

package/crates/team-agent/src/state/persist.rs

@@ -492,7 +492,8 @@ fn persist_runtime_state_with_merge_options_and_expected(
     // Exact-seed cleanup must observe lock-held disk, not a pre-lock cache or
     // byte-equality hit. A matching in-memory document would otherwise no-op
     // and leave the seed, or skip copying a concurrent owner.
-    let skip_pre_lock_fast_path = exact_owner_seed_to_clear.is_some()
+    let skip_pre_lock_fast_path = super::abnormal_watch::needs_compaction(&migrated)
+        || exact_owner_seed_to_clear.is_some()
         || expected_owner_receiver.is_some()
         || exact_owner_receiver_to_clear.is_some()
         || exact_owner_receiver_to_restore.is_some();
@@ -542,7 +543,7 @@ fn persist_runtime_state_with_merge_options_and_expected(
             ));
         }
     }
-    if let Some(latest) = latest {
+    if let Some(latest) = latest.as_ref() {
         let deleted = deleted_agent_ids
             .iter()
             .copied()
@@ -572,7 +573,7 @@ fn persist_runtime_state_with_merge_options_and_expected(
             .collect::<BTreeSet<_>>();
         apply_persist_merge_contract(
             &mut migrated,
-            &latest,
+            latest,
             &deleted,
             skip_capture_backfill_team_key,
             &skip_capture_backfill,
@@ -583,14 +584,55 @@ fn persist_runtime_state_with_merge_options_and_expected(
             exact_owner_receiver_to_restore,
         )?;
     }
+    super::abnormal_watch::compact_after_merge(&mut migrated, latest.as_ref(), deleted_agent_ids);
     // Stage 3 save-output strip second pass (defence-in-depth): after the
     // `preserve_latest_roster_entries` lock-held merge, a future addition
     // to the preserve path could re-introduce root owner fields from the
     // on-disk latest. Re-strip here so the serialized payload is always
     // canonical-only when a canonical teams.<key>.team_owner is present.
     crate::state::ownership::strip_top_level_ownership_if_canonical_present(&mut migrated);
-    // 字节对拍 Python json.dumps(indent=2, ensure_ascii=False)(无尾换行)。
-    let payload = serde_json::to_string_pretty(&migrated)?;
+    write_state_under_lock(workspace, &path, &migrated)
+}
+
+/// Apply a bounded writer to disk under state-save, without a cache shortcut.
+pub(super) fn update_runtime_state(
+    workspace: &Path,
+    update: impl FnOnce(&Value) -> Result<Value, StateError>,
+) -> Result<Value, StateError> {
+    let path = runtime_state_path(workspace);
+    let _lock = RuntimeLock::acquire(workspace, "state-save", 2.0)?;
+    // Malformed/unreadable state is an error, never an empty store.
+    let mut latest = match std::fs::read_to_string(&path) {
+        Ok(text) => serde_json::from_str(&text)?,
+        Err(error) if error.kind() == io::ErrorKind::NotFound => json!({}),
+        Err(error) => return Err(error.into()),
+    };
+    normalize_agent_session_state(&mut latest);
+    migrate_state_identity(&mut latest, &SystemEnv, workspace)?;
+    let _ = migrate_active_team_key(&mut latest);
+    let mut committed = update(&latest)?;
+    merge_ordinary_state(&mut committed, &latest)?;
+    migrate_state_identity(&mut committed, &SystemEnv, workspace)?;
+    crate::state::ownership::strip_top_level_ownership_if_canonical_present(&mut committed);
+    if committed == latest {
+        cache_set(&path, &committed);
+        return Ok(committed);
+    }
+    write_state_under_lock(workspace, &path, &committed)?;
+    Ok(committed)
+}
+
+/// Reuse ordinary roster, topology, ownership, capture and endpoint guards.
+pub(super) fn merge_ordinary_state(incoming: &mut Value, latest: &Value) -> Result<(), StateError> {
+    apply_persist_merge_contract(
+        incoming, latest, &BTreeSet::new(), None, &BTreeSet::new(),
+        &BTreeSet::new(), &BTreeSet::new(), None, None, None,
+    )
+}
+
+fn write_state_under_lock(workspace: &Path, path: &Path, migrated: &Value) -> Result<(), StateError> {
+    // Shared retry/self-heal/atomic replacement path; caller owns state-save.
+    let payload = serde_json::to_string_pretty(migrated)?;
     let delays = [0.05_f64, 0.2, 0.5];
 
     for attempt in 0..=delays.len() {

package/crates/team-agent/src/state/projection.rs

@@ -486,7 +486,13 @@ pub fn project_top_level_view(state: &Value, team_key: &str) -> Value {
         .is_some_and(|o| o.contains_key("coordinator"))
         && !p.contains_key("coordinator")
     {
-        p.insert("coordinator".to_string(), state["coordinator"].clone());
+        let mut coordinator = state["coordinator"].clone();
+        // Workspace legacy watch facts have no proven owner in this team.
+        // Preserve other coordinator fields, but never broadcast this cache.
+        if let Some(coordinator) = coordinator.as_object_mut() {
+            coordinator.remove("abnormal_exit_watch");
+        }
+        p.insert("coordinator".to_string(), coordinator);
     }
     Value::Object(p)
 }
@@ -769,6 +775,30 @@ pub fn save_team_scoped_state(workspace: &Path, team_state: &Value) -> Result<()
     save_team_scoped_state_with_deleted_agents(workspace, team_state, &[])
 }
 
+/// Materialize a bounded Team update from the lock-held workspace. Siblings
+/// come only from latest; retain the existing primary/legacy projection rules.
+pub(super) fn merge_committed_team(existing: &Value, team_state: &Value, target_key: &str) -> Value {
+    let mut primary = existing.get("session_name").and_then(Value::as_str)
+        .filter(|name| !name.is_empty()).map(|_| team_state_key(existing));
+    if primary.as_deref().is_some_and(|key| key != target_key)
+        && existing.get("session_name") == team_state.get("session_name")
+    {
+        primary = Some(target_key.to_string());
+    }
+    let mut teams = take_object(existing.get("teams"));
+    if teams.is_empty() && primary.as_deref() == Some(target_key) {
+        return compact_team_state(team_state);
+    }
+    teams.insert(target_key.to_string(), compact_team_state(team_state));
+    let mut merged = if primary.is_none() || primary.as_deref() == Some(target_key) {
+        to_object(team_state)
+    } else {
+        to_object(existing)
+    };
+    merged.insert("teams".to_string(), Value::Object(teams));
+    Value::Object(merged)
+}
+
 pub(crate) fn save_team_scoped_state_reapplying_after_conflict<F>(
     workspace: &Path,
     team_state: &Value,

package/crates/team-agent/src/state/repository/tests.rs

@@ -46,3 +46,84 @@ fn optional_unmigrated_read_preserves_missing_corrupt_and_valid_shapes(
     std::fs::remove_dir_all(workspace)?;
     Ok(())
 }
+
+#[test]
+fn coordinator_observations_keep_legacy_identity_and_shape()
+    -> Result<(), Box<dyn std::error::Error>> {
+    let nonce = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)?
+        .as_nanos();
+    let workspace =
+        std::env::temp_dir().join(format!("state-repository-legacy-observation-{nonce}"));
+    let initial = serde_json::json!({
+        "active_team_key": "team",
+        "agents": {"w1": {"agent_id": "w1", "provider": "codex", "status": "running"}}
+    });
+    let path = super::helper_workspace_path(&workspace);
+    if let Some(parent) = path.parent() {
+        std::fs::create_dir_all(parent)?;
+    }
+    std::fs::write(&path, serde_json::to_vec(&initial)?)?;
+    let repository = super::StateRepository::new(&workspace);
+    let before = repository.load_workspace()?;
+
+    let mut observed = before.clone();
+    observed["coordinator"] = serde_json::json!({
+        "abnormal_exit_watch": {"w1": {"last_error_observation_key": "error-1"}}
+    });
+    repository.commit_observations(
+        StateWriteIntent::CoordinatorTick {
+            team_key: "current",
+        },
+        &before,
+        &observed,
+    )?;
+    let first = repository.load_workspace()?;
+    assert!(
+        first.get("teams").is_none(),
+        "legacy observation must not synthesize teams.current"
+    );
+    assert_eq!(first["active_team_key"], serde_json::json!("team"));
+    assert_eq!(
+        first["coordinator"]["abnormal_exit_watch"]["w1"]["last_error_observation_key"],
+        serde_json::json!("error-1")
+    );
+
+    let mut observed = first.clone();
+    observed["coordinator"]["abnormal_exit_watch"]["w1"]["last_error_observation_key"] =
+        serde_json::json!("error-2");
+    repository.commit_observations(
+        StateWriteIntent::CoordinatorTick {
+            team_key: "current",
+        },
+        &first,
+        &observed,
+    )?;
+    let second = repository.load_workspace()?;
+    assert!(
+        second.get("teams").is_none(),
+        "legacy shape must remain root-only"
+    );
+    assert_eq!(second["active_team_key"], serde_json::json!("team"));
+    assert_eq!(
+        second["coordinator"]["abnormal_exit_watch"]["w1"]["last_error_observation_key"],
+        serde_json::json!("error-2")
+    );
+
+    let mut changed_latest = second.clone();
+    changed_latest["active_team_key"] = serde_json::json!("other");
+    std::fs::write(&path, serde_json::to_vec(&changed_latest)?)?;
+    let err = repository
+        .commit_observations(
+            StateWriteIntent::CoordinatorTick {
+                team_key: "current",
+            },
+            &second,
+            &observed,
+        )
+        .expect_err("identity drift must refuse the stale legacy observation");
+    assert!(matches!(err, super::StateError::SaveConflict(_)));
+
+    std::fs::remove_dir_all(workspace)?;
+    Ok(())
+}