@team-agent/installer 0.5.91 → 0.5.94

package/crates/team-agent/src/coordinator/health.rs

@@ -74,7 +74,19 @@ use super::types::{
 /// returns: HealthReport。ok = 进程在跑 ∧ metadata 三元全等 ∧ 二进制身份一致 ∧ schema 兼容；service_available 刻意排除二进制身份，表示「这个 daemon 还能处理本队队列」；status 区分 Missing / InvalidPid / Running / Stale
 /// ---
 pub fn coordinator_health(workspace: &WorkspacePath) -> HealthReport {
-    let schema = message_store_schema_health(workspace);
+    coordinator_health_with_schema(workspace, message_store_schema_health(workspace))
+}
+
+/// Read-only coordinator health for diagnose. Unlike the lifecycle path, this
+/// never opens MessageStore and therefore cannot initialize or rewrite team.db.
+pub fn coordinator_health_read_only(workspace: &WorkspacePath) -> HealthReport {
+    coordinator_health_with_schema(workspace, message_store_schema_health_read_only(workspace))
+}
+
+fn coordinator_health_with_schema(
+    workspace: &WorkspacePath,
+    schema: SchemaHealth,
+) -> HealthReport {
     let current_binary_identity = current_coordinator_binary_identity();
     let pid_path = coordinator_pid_path(workspace);
     let pid = read_pid_file(&pid_path);
@@ -320,6 +332,7 @@ pub fn start_coordinator_with_team(
         }
     }
     command
+        .current_dir(workspace.as_path())
         .stdin(Stdio::null())
         .stdout(Stdio::from(log))
         .stderr(Stdio::from(log_err));
@@ -420,6 +433,16 @@ pub fn stop_coordinator(workspace: &WorkspacePath) -> Result<StopReport, StopErr
             pid: Some(pid),
         });
     }
+    let metadata_owned = read_coordinator_metadata(workspace)
+        .as_ref()
+        .is_some_and(|metadata| metadata.pid == pid);
+    if !metadata_owned || !coordinator_pid_owned_by_workspace(workspace, pid) {
+        return Ok(StopReport {
+            ok: false,
+            status: StopOutcome::NotOwned,
+            pid: Some(pid),
+        });
+    }
     if pid.get() == std::process::id() {
         remove_file_if_exists(&pid_path)?;
         remove_file_if_exists(&coordinator_meta_path(workspace))?;
@@ -429,7 +452,7 @@ pub fn stop_coordinator(workspace: &WorkspacePath) -> Result<StopReport, StopErr
             pid: Some(pid),
         });
     }
-    if !terminate_pid(pid) {
+    if !terminate_pid_for_workspace(pid, workspace.as_path()) {
         return Ok(StopReport {
             ok: false,
             status: StopOutcome::KillFailed,
@@ -456,7 +479,7 @@ fn stop_discovered_coordinators(
     let mut stopped = None;
     let mut failed = None;
     for pid in pids {
-        if terminate_pid(pid) {
+        if terminate_pid_for_workspace(pid, workspace.as_path()) {
             stopped.get_or_insert(pid);
         } else {
             failed.get_or_insert(pid);
@@ -489,47 +512,98 @@ fn discover_coordinator_pids(workspace: &WorkspacePath) -> Vec<Pid> {
         _ => return Vec::new(),
     };
     let text = String::from_utf8_lossy(&output.stdout);
-    let candidates = workspace_match_candidates(workspace.as_path());
+    let metadata_pid = read_coordinator_metadata(workspace).map(|metadata| metadata.pid.get());
     text.lines()
         .filter_map(|line| parse_ps_command_line(line))
-        .filter(|(pid, command)| {
-            *pid != std::process::id()
-                && coordinator_command_matches_workspace(command, &candidates)
+        .filter(|(pid, _command)| {
+            metadata_pid == Some(*pid)
+                && *pid != std::process::id()
+                && coordinator_pid_owned_by_workspace(workspace, Pid::new(*pid))
         })
         .map(|(pid, _)| Pid::new(pid))
         .collect()
 }
 
-fn parse_ps_command_line(line: &str) -> Option<(u32, &str)> {
-    let line = line.trim_start();
-    let split = line.find(char::is_whitespace).unwrap_or(line.len());
-    let pid = line.get(..split)?.trim().parse::<u32>().ok()?;
-    let command = line.get(split..)?.trim();
-    Some((pid, command))
+fn coordinator_pid_owned_by_workspace(workspace: &WorkspacePath, pid: Pid) -> bool {
+    let workspace = workspace
+        .as_path()
+        .canonicalize()
+        .unwrap_or_else(|_| workspace.as_path().to_path_buf());
+    let Some(tokens) = crate::platform::argv::argv_tokens(pid.get()) else {
+        return false;
+    };
+    let is_team_agent = tokens.first().is_some_and(|token| is_team_agent_binary(token));
+    let is_coordinator = tokens.iter().any(|token| token == "coordinator");
+    let has_workspace = tokens.windows(2).any(|pair| {
+        pair[0] == "--workspace"
+            && Path::new(&pair[1])
+                .canonicalize()
+                .map(|path| path == workspace)
+                .unwrap_or(false)
+    });
+    is_team_agent && is_coordinator && has_workspace
 }
 
-fn workspace_match_candidates(workspace: &Path) -> Vec<String> {
-    let mut candidates = vec![workspace.to_string_lossy().to_string()];
-    if let Ok(canonical) = workspace.canonicalize() {
-        let text = canonical.to_string_lossy().to_string();
-        if !candidates.iter().any(|candidate| candidate == &text) {
-            candidates.push(text);
+fn terminate_pid_for_workspace(pid: Pid, workspace: &Path) -> bool {
+    if !coordinator_pid_owned_by_path(workspace, pid) {
+        return false;
+    }
+    let pids = process_tree_pids(pid)
+        .into_iter()
+        .filter(|candidate| coordinator_pid_owned_by_path(workspace, *candidate))
+        .collect::<Vec<_>>();
+    if pids.is_empty() {
+        return false;
+    }
+    for child in pids.iter().rev() {
+        let _ = crate::platform::process::terminate_pid(
+            child.get(),
+            crate::platform::process::SignalKind::TerminateGraceful,
+        );
+    }
+    if !wait_until_all_not_running(&pids, Duration::from_secs(5)) {
+        for child in pids.iter().rev() {
+            let _ = crate::platform::process::terminate_pid(
+                child.get(),
+                crate::platform::process::SignalKind::TerminateForce,
+            );
         }
     }
-    candidates
+    wait_until_all_not_running(&pids, Duration::from_secs(5))
 }
 
-fn coordinator_command_matches_workspace(command: &str, workspaces: &[String]) -> bool {
-    command
-        .split_whitespace()
-        .any(|token| token == "team-agent" || token.ends_with("/team-agent"))
-        && command
-            .split_whitespace()
-            .any(|token| token == "coordinator")
-        && command.contains("--workspace")
-        && workspaces
-            .iter()
-            .any(|workspace| command.contains(workspace))
+fn coordinator_pid_owned_by_path(workspace: &Path, pid: Pid) -> bool {
+    let workspace = workspace
+        .canonicalize()
+        .unwrap_or_else(|_| workspace.to_path_buf());
+    let Some(tokens) = crate::platform::argv::argv_tokens(pid.get()) else {
+        return false;
+    };
+    let is_team_agent = tokens.first().is_some_and(|token| is_team_agent_binary(token));
+    let is_coordinator = tokens.iter().any(|token| token == "coordinator");
+    let has_workspace = tokens.windows(2).any(|pair| {
+        pair[0] == "--workspace"
+            && Path::new(&pair[1])
+                .canonicalize()
+                .map(|path| path == workspace)
+                .unwrap_or(false)
+    });
+    is_team_agent && is_coordinator && has_workspace
+}
+
+fn is_team_agent_binary(token: &str) -> bool {
+    let Some(name) = Path::new(token).file_name().and_then(|name| name.to_str()) else {
+        return false;
+    };
+    name == "team-agent" || name == "team_agent" || name.starts_with("team-agent-")
+}
+
+fn parse_ps_command_line(line: &str) -> Option<(u32, &str)> {
+    let line = line.trim_start();
+    let split = line.find(char::is_whitespace).unwrap_or(line.len());
+    let pid = line.get(..split)?.trim().parse::<u32>().ok()?;
+    let command = line.get(split..)?.trim();
+    Some((pid, command))
 }
 
 fn terminate_pid(pid: Pid) -> bool {
@@ -1004,6 +1078,34 @@ pub(crate) fn message_store_schema_health(workspace: &WorkspacePath) -> SchemaHe
     }
 }
 
+fn message_store_schema_health_read_only(workspace: &WorkspacePath) -> SchemaHealth {
+    let action = Some("run team-agent doctor --fix-schema --json".to_string());
+    match crate::db::migration::schema_diagnosis_workspace_read_only(workspace.as_path()) {
+        Ok(diagnosis) if diagnosis.ok && diagnosis.status == "ok" => SchemaHealth {
+            ok: true,
+            schema_version: crate::db::schema::SCHEMA_VERSION,
+            error: None,
+            action: None,
+        },
+        Ok(diagnosis) => SchemaHealth {
+            ok: false,
+            schema_version: crate::db::schema::SCHEMA_VERSION,
+            error: Some(SchemaError::InitFailed {
+                message: format!("team.db status: {}", diagnosis.status),
+            }),
+            action,
+        },
+        Err(error) => SchemaHealth {
+            ok: false,
+            schema_version: crate::db::schema::SCHEMA_VERSION,
+            error: Some(SchemaError::InitFailed {
+                message: error.to_string(),
+            }),
+            action,
+        },
+    }
+}
+
 fn read_pid_file(path: &Path) -> Option<Pid> {
     let text = std::fs::read_to_string(path).ok()?;
     let raw = text.trim().parse::<u32>().ok()?;

package/crates/team-agent/src/coordinator/tick.rs

@@ -160,6 +160,40 @@ fn coordinator_team_scoped_state(
     crate::state::projection::select_runtime_state(workspace, Some(selected)).ok()
 }
 
+fn live_sibling_team_state(
+    state: &Value,
+    missing_session: &str,
+    transport: &dyn crate::transport::Transport,
+) -> Result<Option<(String, Value)>, crate::transport::TransportError> {
+    let Some(teams) = state.get("teams").and_then(Value::as_object) else {
+        return Ok(None);
+    };
+    for (team_key, team_state) in teams {
+        let status = team_state
+            .get("status")
+            .and_then(Value::as_str)
+            .map(|status| status.to_ascii_lowercase());
+        if status.is_some_and(|status| status != "alive" && status != "running") {
+            continue;
+        }
+        let Some(session_name) = team_state
+            .get("session_name")
+            .and_then(Value::as_str)
+            .filter(|session| !session.is_empty() && *session != missing_session)
+        else {
+            continue;
+        };
+        let session = crate::transport::SessionName::new(session_name);
+        if transport.has_session(&session)? {
+            return Ok(Some((
+                team_key.clone(),
+                crate::state::projection::project_top_level_view(state, team_key),
+            )));
+        }
+    }
+    Ok(None)
+}
+
 // ===========================================================================
 // Coordinator struct(daemon lifecycle + tick orchestration)
 // ===========================================================================
@@ -330,20 +364,40 @@ impl Coordinator {
             .get("session_name")
             .and_then(Value::as_str)
             .filter(|s| !s.is_empty())
+            .map(str::to_owned)
         {
-            let session = crate::transport::SessionName::new(session_name);
+            let session = crate::transport::SessionName::new(&session_name);
             if !self.transport.has_session(&session)? {
                 event_log.write(
                     "coordinator.session_missing",
                     serde_json::json!({"session": session_name}),
                 )?;
-                notify_session_missing(self.workspace.as_path(), &state, &event_log, session_name)?;
-                return Ok(empty_tick_report(
-                    false,
-                    true,
-                    Some(TickStopReason::TmuxSessionMissing),
-                    None,
-                ));
+                if let Some((sibling_team, sibling_state)) =
+                    live_sibling_team_state(&state, &session_name, self.transport.as_ref())?
+                {
+                    event_log.write(
+                        "coordinator.session_missing_sibling_alive",
+                        serde_json::json!({
+                            "session": session_name,
+                            "sibling_team": sibling_team,
+                            "action": "continue_with_sibling_team",
+                        }),
+                    )?;
+                    state = sibling_state;
+                } else {
+                    notify_session_missing(
+                        self.workspace.as_path(),
+                        &state,
+                        &event_log,
+                        &session_name,
+                    )?;
+                    return Ok(empty_tick_report(
+                        false,
+                        true,
+                        Some(TickStopReason::TmuxSessionMissing),
+                        None,
+                    ));
+                }
             }
         }
 

package/crates/team-agent/src/coordinator/types.rs

@@ -164,6 +164,8 @@ pub enum StopOutcome {
     Missing,
     /// pid 非整数 → 清文件返回(`lifecycle.py:238`)。
     InvalidPidRemoved,
+    /// The pid file points to a live process owned by another workspace.
+    NotOwned,
     /// SIGTERM 失败(`lifecycle.py:243`)。
     KillFailed,
     /// SIGTERM + 清 pid/meta 成功(`lifecycle.py:247`)。

package/crates/team-agent/src/db/migration.rs

@@ -8,7 +8,7 @@
 
 use std::path::{Path, PathBuf};
 
-use rusqlite::Connection;
+use rusqlite::{Connection, OpenFlags};
 
 use crate::db::schema::{ensure_schema_indexes, table_layout, SCHEMA_VERSION};
 use crate::db::DbError;
@@ -423,22 +423,33 @@ pub fn ensure_table_layout(
 /// `schema_migration.py:schema_diagnosis`:只读判定(不变更 DB)。
 fn schema_diagnosis(db_path: &Path, schema_version: i64) -> Result<Diagnosis, DbError> {
     if !db_path.exists() {
-        // T3-3 cr verdict (A parity lock, 2026-06-10): a missing db is the LEGAL
-        // first-use state — ok:true is layered with the explicit status axis and the
-        // recommended_action guidance (Python schema_migration.py:180-190 verbatim),
-        // never a silent fake-green.
-        return Ok(Diagnosis {
-            ok: true,
-            status: "missing".to_string(),
-            user_version: 0,
-            layout_diffs: vec![],
-            recommended_action:
-                "No team.db exists yet; initialize_schema will create it on first use.".to_string(),
-        });
+        return Ok(missing_schema_diagnosis());
     }
     let conn = Connection::open(db_path)?;
-    let uv = pragma_user_version(&conn)?;
-    let diffs = layout_diffs(&conn)?;
+    schema_diagnosis_from_connection(&conn, schema_version)
+}
+
+fn missing_schema_diagnosis() -> Diagnosis {
+    // T3-3 cr verdict (A parity lock, 2026-06-10): a missing db is the LEGAL
+    // first-use state — ok:true is layered with the explicit status axis and the
+    // recommended_action guidance (Python schema_migration.py:180-190 verbatim),
+    // never a silent fake-green.
+    Diagnosis {
+        ok: true,
+        status: "missing".to_string(),
+        user_version: 0,
+        layout_diffs: vec![],
+        recommended_action:
+            "No team.db exists yet; initialize_schema will create it on first use.".to_string(),
+    }
+}
+
+fn schema_diagnosis_from_connection(
+    conn: &Connection,
+    schema_version: i64,
+) -> Result<Diagnosis, DbError> {
+    let uv = pragma_user_version(conn)?;
+    let diffs = layout_diffs(conn)?;
     let diff_tables: Vec<String> = diffs.iter().map(|d| d.table.to_string()).collect();
     let ok = diffs.is_empty() && uv == schema_version;
     Ok(Diagnosis {
@@ -466,6 +477,16 @@ pub fn schema_diagnosis_workspace(workspace: &Path) -> Result<Diagnosis, DbError
     )
 }
 
+/// 对 workspace 的 team.db 执行严格只读 diagnosis，不创建或初始化缺失/空文件。
+pub fn schema_diagnosis_workspace_read_only(workspace: &Path) -> Result<Diagnosis, DbError> {
+    let db_path = workspace.join(".team").join("runtime").join("team.db");
+    if !db_path.exists() {
+        return Ok(missing_schema_diagnosis());
+    }
+    let conn = Connection::open_with_flags(&db_path, OpenFlags::SQLITE_OPEN_READ_ONLY)?;
+    schema_diagnosis_from_connection(&conn, SCHEMA_VERSION)
+}
+
 /// `schema_migration.py:_workspace_from_db_path`:`<ws>/.team/runtime/team.db` → `<ws>`。
 fn workspace_from_db_path(db_path: &Path) -> Option<PathBuf> {
     let parts: Vec<_> = db_path.iter().collect();

package/crates/team-agent/src/kill_audit.rs

@@ -2,7 +2,7 @@
 
 use std::path::Path;
 
-use serde_json::json;
+use serde_json::{json, Value};
 
 use crate::event_log::{EventLog, EventLogError};
 use crate::transport::{BackendKind, Transport};
@@ -29,6 +29,45 @@ pub(crate) fn pre_kill_audit(
             "argv": argv,
             "endpoint": endpoint,
             "targets": targets,
+            "workspace": Value::Null,
+            "team": Value::Null,
+            "generation": Value::Null,
+            "owner_evidence": "legacy_unscoped",
+            "reason": "legacy_callsite",
+        }),
+    )?;
+    Ok(())
+}
+
+pub(crate) fn pre_kill_audit_scoped(
+    event_log: &EventLog,
+    transport: &dyn Transport,
+    caller: &str,
+    action: &str,
+    targets: &[String],
+    workspace: &Path,
+    team: Option<&str>,
+    generation: Option<&str>,
+    owner_evidence: &str,
+    reason: &str,
+) -> Result<(), EventLogError> {
+    let endpoint = transport.tmux_endpoint();
+    let argv = destructive_argv(transport.kind(), endpoint.as_deref(), action, targets);
+    event_log.write(
+        "transport.pre_kill_audit",
+        json!({
+            "phase": "pre_call",
+            "caller": caller,
+            "caller_pid": std::process::id(),
+            "action": action,
+            "argv": argv,
+            "endpoint": endpoint,
+            "targets": targets,
+            "workspace": workspace.to_string_lossy(),
+            "team": team,
+            "generation": generation,
+            "owner_evidence": owner_evidence,
+            "reason": reason,
         }),
     )?;
     Ok(())
@@ -57,7 +96,7 @@ fn destructive_argv(
         vec![format!("{kind:?}").to_ascii_lowercase()]
     };
     argv.push(action.to_string());
-    if action == KILL_SESSION {
+    if action == KILL_SESSION || action == "kill-pane" {
         for target in targets {
             argv.push("-t".to_string());
             argv.push(target.clone());

package/crates/team-agent/src/lifecycle/launch/quick_start.rs

@@ -124,11 +124,7 @@ impl FreshQuickStartLeaderBindingOps for RuntimeFreshQuickStartLeaderBindingOps<
     }
 
     fn observe_command(&mut self, pane: &PaneId) -> Option<String> {
-        self.transport
-            .query(&Target::Pane(pane.clone()), PaneField::PaneCurrentCommand)
-            .ok()
-            .flatten()
-            .filter(|command| !command.trim().is_empty())
+        query_caller_pane_command(self.transport, pane)
     }
 
     fn attach(
@@ -142,7 +138,7 @@ impl FreshQuickStartLeaderBindingOps for RuntimeFreshQuickStartLeaderBindingOps<
         self.applied_grant = None;
         self.registry_receipt = None;
         let event_log = crate::event_log::EventLog::new(workspace);
-        let targets = match self.transport.list_targets() {
+        let targets = match list_caller_targets(self.transport) {
             Ok(targets) => targets,
             Err(_) => {
                 self.last_failure_reason = Some("caller_pane_unobservable");
@@ -290,11 +286,19 @@ impl FreshQuickStartLeaderBindingOps for RuntimeFreshQuickStartLeaderBindingOps<
             self.last_failure_reason = Some("receiver_missing");
             return false;
         };
+        let leader_transport = receiver
+            .get("tmux_socket")
+            .and_then(serde_json::Value::as_str)
+            .filter(|endpoint| !endpoint.is_empty())
+            .map(crate::transport_factory::leader_endpoint_transport);
+        let live_channel_transport: &dyn Transport = leader_transport
+            .as_deref()
+            .unwrap_or(self.transport);
         if !matches!(
             crate::messaging::resolve_live_leader_channel(
                 workspace,
                 receiver,
-                self.transport,
+                live_channel_transport,
             ),
             crate::messaging::LeaderChannelResolution::Live(_)
         ) {
@@ -875,6 +879,42 @@ fn existing_runtime_identity_view(
     state.clone()
 }
 
+fn caller_read_transport() -> Option<Box<dyn Transport>> {
+    let endpoint = crate::tmux_backend::socket_name_from_tmux_env()?;
+    // Unit tests use an injected transport even when they seed a synthetic TMUX
+    // tuple.  Never make those hermetic tests depend on a host tmux server; the
+    // production path below remains a read-only endpoint probe.
+    #[cfg(test)]
+    if !Path::new(&endpoint).exists() {
+        return None;
+    }
+    Some(Box::new(crate::tmux_backend::TmuxBackend::for_tmux_endpoint(
+        &endpoint,
+    )))
+}
+
+fn query_caller_pane_command(transport: &dyn Transport, pane: &PaneId) -> Option<String> {
+    let caller_transport = caller_read_transport();
+    let query_transport: &dyn Transport = caller_transport
+        .as_deref()
+        .unwrap_or(transport);
+    query_transport
+        .query(&Target::Pane(pane.clone()), PaneField::PaneCurrentCommand)
+        .ok()
+        .flatten()
+        .filter(|command| !command.trim().is_empty())
+}
+
+fn list_caller_targets(
+    transport: &dyn Transport,
+) -> Result<Vec<crate::transport::PaneInfo>, crate::transport::TransportError> {
+    if let Some(caller_transport) = caller_read_transport() {
+        caller_transport.list_targets()
+    } else {
+        transport.list_targets()
+    }
+}
+
 fn preflight_fresh_leader_identity(
     transport: &dyn Transport,
 ) -> Option<(String, Vec<String>, Vec<String>)> {
@@ -900,13 +940,7 @@ fn preflight_fresh_leader_identity(
             let Some(pane) = pane else {
                 return None;
             };
-            let command = transport
-                .query(
-                    &Target::Pane(PaneId::new(pane)),
-                    PaneField::PaneCurrentCommand,
-                )
-                .ok()
-                .flatten()
+            let command = query_caller_pane_command(transport, &PaneId::new(pane))
                 .unwrap_or_default();
             let explicit = std::env::var("TEAM_AGENT_LEADER_PROVIDER")
                 .ok()

package/crates/team-agent/src/lifecycle/launch/quick_start_transport.rs

@@ -3,7 +3,7 @@
 //! contract:
 //!   provides:
 //!     - name: quick_start_tmux_backend
-//!       what: 优先复用调用方所在 tmux socket，否则按 workspace 派生
+//!       what: 按 workspace 派生私有 socket；调用方 tmux 只用于 leader receiver 绑定
 //!     - name: annotate_runtime_transport
 //!       what: 把 transport 种类与来源写进 state，tmux 时再写 endpoint 三字段
 //!     - name: attach_commands_for_runtime_windows
@@ -37,15 +37,11 @@ use crate::lifecycle::lock::{acquire_agent_lifecycle_lock, LifecycleLockRequest}
 use super::*;
 
 /// ---
-/// purpose: 定出 quick-start 使用的 tmux 后端
-/// returns: 调用方环境里有 socket 就复用它，否则按 workspace 派生一个
+/// purpose: 定出 quick-start 使用的私有 tmux 后端
+/// returns: 始终按 workspace 派生 endpoint；调用方 $TMUX 仅供 leader receiver 身份绑定
 /// ---
 pub(crate) fn quick_start_tmux_backend(workspace: &Path) -> crate::tmux_backend::TmuxBackend {
-    if let Some(endpoint) = crate::tmux_backend::socket_name_from_tmux_env() {
-        crate::tmux_backend::TmuxBackend::for_tmux_endpoint(&endpoint)
-    } else {
-        crate::tmux_backend::TmuxBackend::for_workspace(workspace)
-    }
+    crate::tmux_backend::TmuxBackend::for_workspace(workspace)
 }
 
 /// ---

package/crates/team-agent/src/lifecycle/launch.rs

@@ -146,6 +146,23 @@ pub fn launch_with_transport_in_workspace(
             transport,
             &started,
         )?;
+        let owner_team = load_runtime_state(workspace)
+            .ok()
+            .map(|state| crate::state::projection::team_state_key(&state))
+            .filter(|team| !team.is_empty())
+            .unwrap_or_else(|| session_name.as_str().to_string());
+        let generation = started
+            .first()
+            .map(|agent| agent.spawned_at.as_str())
+            .unwrap_or(session_name.as_str());
+        transport
+            .set_session_owner_with_generation(
+                &session_name,
+                workspace,
+                &owner_team,
+                generation,
+            )
+            .map_err(|error| LifecycleError::Transport(error.to_string()))?;
         // 0.5.38: per-worker timing tags (source="launch") so operators can
         // trace which worker's spawn dominates wall time. Zeros for now on
         // the sub-timings — Step 1 first enables shape assertion; a later

package/crates/team-agent/src/lifecycle/tests/launch_spawn.rs

@@ -2,6 +2,7 @@
 mod hermetic_guard;
 
 use super::*;
+use crate::tmux_backend::TmuxBackend;
 use crate::transport::test_support::OfflineTransport;
 use serde_json::json;
 use serial_test::serial;
@@ -1428,19 +1429,21 @@ fn quick_start_default_adaptive_groups_workers_into_layout_panes() {
 
 #[test]
 #[serial(env)]
-fn quick_start_tmux_backend_prefers_absolute_tmux_env_endpoint() {
+fn quick_start_tmux_backend_uses_workspace_private_endpoint() {
     let leader_socket = "/tmp/team-agent-layout-leader-socket";
     let _tmux = EnvVarGuard::set("TMUX", &format!("{leader_socket},123,0"));
-    let backend = quick_start_tmux_backend(std::path::Path::new("/tmp/layout-workspace"));
+    let workspace = std::path::Path::new("/tmp/layout-workspace");
+    let backend = quick_start_tmux_backend(workspace);
+    let expected = TmuxBackend::for_workspace(workspace);
 
     assert_eq!(
-        crate::transport::Transport::tmux_endpoint(&backend).as_deref(),
-        Some(leader_socket),
-        "quick-start from inside tmux must use the caller's full $TMUX socket endpoint"
+        crate::transport::Transport::tmux_endpoint(&backend),
+        crate::transport::Transport::tmux_endpoint(&expected),
+        "quick-start workers must use the workspace-private socket, not ambient $TMUX"
     );
     assert_eq!(
-        selected_tmux_socket_source(&backend, std::path::Path::new("/tmp/layout-workspace")),
-        Some("leader_env")
+        selected_tmux_socket_source(&backend, workspace),
+        Some("workspace")
     );
 }