oh-my-codex 0.20.2 → 0.20.3

package/dist/team/scaling.js

@@ -9,11 +9,13 @@
  * - File-based scaling lock prevents concurrent scale operations
  * - 'draining' worker status for graceful transitions during scale_down
  */
-import { join, resolve } from 'path';
-import { mkdir, rm } from 'fs/promises';
-import { sanitizeTeamName, isTmuxAvailable, waitForWorkerReady, dismissTrustPromptIfPresent, sendToWorker, isWorkerAlive, getWorkerPanePid, teardownWorkerPanes, buildWorkerStartupCommand, trustWorkerMiseConfigIfAvailable, writeWorkerStartupScriptCommand, resolveTeamWorkerCliForResolvedLaunchArgs, assertTeamWorkerCliPolicyCompatibility, tagPaneTeamOwner, } from './tmux-session.js';
-import { execFileSync, spawnSync } from 'child_process';
-import { teamReadConfig as readTeamConfig, teamSaveConfig as saveTeamConfig, teamWriteWorkerIdentity as writeWorkerIdentity, teamReadManifest as readTeamManifestV2, teamNormalizePolicy as normalizeTeamPolicy, teamReadWorkerStatus as readWorkerStatus, teamWriteWorkerStatus as writeWorkerStatus, teamWithScalingLock as withScalingLock, teamAppendEvent as appendTeamEvent, teamCreateTask as createStateTask, teamListTasks as listTasks, teamMarkDispatchRequestNotified as markDispatchRequestNotified, teamReadDispatchRequest as readDispatchRequest, teamTransitionDispatchRequest as transitionDispatchRequest, } from './team-ops.js';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'path';
+import { mkdir, readFile, realpath, rm, writeFile } from 'fs/promises';
+import { existsSync } from 'fs';
+import { sanitizeTeamName, isTmuxAvailable, waitForWorkerReady, dismissTrustPromptIfPresent, sendToWorker, isWorkerAlive, teardownWorkerPanes, buildWorkerStartupCommand, trustWorkerMiseConfigIfAvailable, writeWorkerStartupScriptCommand, resolveTeamWorkerCliForResolvedLaunchArgs, assertTeamWorkerCliPolicyCompatibility, tagPaneTeamOwner, readPaneTeamOwnerTagResult, } from './tmux-session.js';
+import { readExactPaneProofSync } from './exact-pane.js';
+import { spawnSync } from 'child_process';
+import { teamReadConfig as readTeamConfig, teamSaveConfig as saveTeamConfig, teamWriteWorkerIdentity as writeWorkerIdentity, teamReadManifest as readTeamManifestV2, teamNormalizePolicy as normalizeTeamPolicy, teamReadWorkerStatus as readWorkerStatus, teamWriteWorkerStatus as writeWorkerStatus, teamWithScalingLock as withScalingLock, teamWithTaskMembershipBarrier as withTaskMembershipBarrier, recoverTeamMembershipTaskTransaction, commitTeamMembershipTaskTransaction, finalizeTeamMembershipTaskTransaction, writeAtomic, teamRemoveDurableFile as removeDurableFile, teamAppendEvent as appendTeamEvent, teamCreateTask as createStateTask, teamListTasks as listTasks, teamReadTask as readTask, teamMarkDispatchRequestNotified as markDispatchRequestNotified, teamReadDispatchRequest as readDispatchRequest, teamTransitionDispatchRequest as transitionDispatchRequest, teamRemoveDispatchRequestsForWorkers as removeDispatchRequestsForWorkers, } from './team-ops.js';
 import { queueInboxInstruction, waitForDispatchReceipt, } from './mcp-comm.js';
 import { generateInitialInbox, buildTriggerDirective, writeWorkerRoleInstructionsFile, writeWorkerWorktreeRootAgentsFile, removeWorkerWorktreeRootAgentsFile, } from './worker-bootstrap.js';
 import { buildTeamWorkerGoalInstruction } from './goal-workflow.js';
@@ -24,8 +26,29 @@ import { resolveCodexHomeForLaunch } from '../cli/codex-home.js';
 import { parseTeamWorkerLaunchArgs, resolveTeamWorkerLaunchArgs, resolveAgentDefaultModel, resolveAgentReasoningEffort, shouldHonorAgentExactModel, TEAM_WORKER_INHERITED_MODEL_ENV, } from './model-contract.js';
 import { resolveCanonicalTeamStateRoot } from './state-root.js';
 import { ensureWorktree, planWorktreeTarget, rollbackProvisionedWorktrees, } from './worktree.js';
+import { withTaskClaimLock } from './state/locks.js';
 import { buildApprovedTeamHandoffSection, resolvePersistedApprovedTeamExecutionContinuityState, } from './approved-execution.js';
 import { readPersistedTeamUltragoalContext, renderLeaderOwnedUltragoalContextSection, } from './ultragoal-context.js';
+const TASK_CLAIM_LOCK_STALE_MS = 5 * 60 * 1000;
+async function withTaskClaimLocks(teamName, taskIds, cwd, fn) {
+    const uniqueTaskIds = [...new Set(taskIds)].sort((left, right) => Number(left) - Number(right));
+    const teamDir = (name, lockCwd) => join(resolveCanonicalTeamStateRoot(lockCwd), 'team', name);
+    const locks = {
+        teamDir,
+        taskClaimLockDir: (name, taskId, lockCwd) => (join(teamDir(name, lockCwd), 'claims', `task-${taskId}.lock`)),
+        mailboxLockDir: (name, workerName, lockCwd) => (join(teamDir(name, lockCwd), 'mailbox', `.lock-${workerName}`)),
+    };
+    const acquire = async (index) => {
+        if (index >= uniqueTaskIds.length)
+            return await fn();
+        const taskId = uniqueTaskIds[index];
+        const locked = await withTaskClaimLock(teamName, taskId, cwd, TASK_CLAIM_LOCK_STALE_MS, locks, async () => await acquire(index + 1));
+        if (!locked.ok)
+            throw new Error(`Timed out acquiring task claim lock for ${teamName}/${taskId}`);
+        return locked.value;
+    };
+    return await acquire(0);
+}
 // ── Environment gate ──────────────────────────────────────────────────────────
 const OMX_TEAM_SCALING_ENABLED_ENV = 'OMX_TEAM_SCALING_ENABLED';
 const WORKTREE_TRIGGER_STATE_ROOT = '$OMX_TEAM_STATE_ROOT';
@@ -80,6 +103,67 @@ function buildScaleUpWorkerLaunchPlans(params) {
 function resolveInstructionStateRoot(worktreePath) {
     return worktreePath ? WORKTREE_TRIGGER_STATE_ROOT : undefined;
 }
+function hasScaleUpFailureInjection(env, phase) {
+    return env.OMX_TEAM_SCALE_UP_INJECT_FAILURE?.split(',').map((value) => value.trim()).includes(phase) ?? false;
+}
+function throwIfScaleUpFailureInjected(env, phase) {
+    if (hasScaleUpFailureInjection(env, phase)) {
+        throw new Error(`injected_scale_up_failure:${phase}`);
+    }
+}
+function recoverCreatedWorktreeAfterEnsureFailure(plan, worktreePathExistedBeforeEnsure, branchExistedBeforeEnsure) {
+    if (worktreePathExistedBeforeEnsure || !existsSync(plan.worktreePath))
+        return null;
+    const commonDir = spawnSync('git', ['rev-parse', '--git-common-dir'], {
+        cwd: plan.worktreePath,
+        encoding: 'utf-8',
+        windowsHide: true,
+    });
+    const repoCommonDir = spawnSync('git', ['rev-parse', '--git-common-dir'], {
+        cwd: plan.repoRoot,
+        encoding: 'utf-8',
+        windowsHide: true,
+    });
+    if (commonDir.status !== 0
+        || repoCommonDir.status !== 0
+        || resolve(plan.worktreePath, (commonDir.stdout || '').trim())
+            !== resolve(plan.repoRoot, (repoCommonDir.stdout || '').trim())) {
+        return null;
+    }
+    if (plan.branchName) {
+        const branch = spawnSync('git', ['symbolic-ref', '-q', 'HEAD'], {
+            cwd: plan.worktreePath,
+            encoding: 'utf-8',
+            windowsHide: true,
+        });
+        if (branch.status !== 0 || (branch.stdout || '').trim() !== `refs/heads/${plan.branchName}`)
+            return null;
+    }
+    else {
+        const head = spawnSync('git', ['rev-parse', 'HEAD'], {
+            cwd: plan.worktreePath,
+            encoding: 'utf-8',
+            windowsHide: true,
+        });
+        const branch = spawnSync('git', ['symbolic-ref', '-q', 'HEAD'], {
+            cwd: plan.worktreePath,
+            encoding: 'utf-8',
+            windowsHide: true,
+        });
+        if (head.status !== 0 || branch.status === 0 || (head.stdout || '').trim() !== plan.baseRef)
+            return null;
+    }
+    return {
+        enabled: true,
+        repoRoot: plan.repoRoot,
+        worktreePath: plan.worktreePath,
+        detached: plan.detached,
+        branchName: plan.branchName,
+        created: true,
+        reused: false,
+        createdBranch: Boolean(plan.branchName && !branchExistedBeforeEnsure),
+    };
+}
 function assertUnreachableApprovedExecutionState(state) {
     throw new Error(`unreachable_scale_up_approved_execution_state:${JSON.stringify(state)}`);
 }
@@ -146,9 +230,9 @@ function resolveScaleUpWorktreeMode(config) {
         throw error;
     }
 }
-async function notifyWorkerPaneOutcome(sessionName, workerIndex, message, paneId, workerCli) {
+async function notifyWorkerPaneOutcome(sessionName, workerIndex, message, paneId, workerCli, expectedPanePid, expectedTeamOwnerId, hudPaneId) {
     try {
-        await sendToWorker(sessionName, workerIndex, message, paneId, workerCli);
+        await sendToWorker(sessionName, workerIndex, message, paneId, workerCli, expectedPanePid, expectedTeamOwnerId, hudPaneId);
         return { ok: true, transport: 'tmux_send_keys', reason: 'tmux_send_keys_sent' };
     }
     catch (error) {
@@ -177,356 +261,1114 @@ export async function scaleUp(teamName, count, agentType, tasks, cwd, env = proc
     const sanitized = sanitizeTeamName(teamName);
     const leaderCwd = resolve(cwd);
     return await withScalingLock(sanitized, leaderCwd, async () => {
-        const config = await readTeamConfig(sanitized, leaderCwd);
-        if (!config) {
-            return { ok: false, error: `Team ${sanitized} not found` };
-        }
-        const maxWorkers = config.max_workers;
-        const currentCount = config.workers.length;
-        if (currentCount + count > maxWorkers) {
-            return {
-                ok: false,
-                error: `Cannot add ${count} workers: would exceed max_workers (${currentCount} + ${count} > ${maxWorkers})`,
-            };
-        }
-        const teamStateRoot = config.team_state_root ?? resolveCanonicalTeamStateRoot(leaderCwd);
-        const codexHomeOverride = resolveCodexHomeForLaunch(leaderCwd, env);
-        const launchEnv = codexHomeOverride
-            ? { ...env, CODEX_HOME: codexHomeOverride }
-            : env;
-        // Build and validate every launch plan before any task, directory, worktree,
-        // pane, process, or config mutation. The plan is the sole source of launch
-        // policy; later task materialization must not alter it.
-        const initialNextIndex = config.next_worker_index ?? (currentCount + 1);
-        let workerLaunchPlans;
-        try {
-            const existingTasks = await listTasks(sanitized, leaderCwd);
-            workerLaunchPlans = buildScaleUpWorkerLaunchPlans({
-                count,
-                nextWorkerIndex: initialNextIndex,
-                agentType,
-                existingTasks,
-                incomingTasks: tasks,
-                launchEnv,
-                codexHomeOverride,
+        return await withTaskMembershipBarrier(sanitized, leaderCwd, async () => {
+            const config = await readTeamConfig(sanitized, leaderCwd);
+            if (!config) {
+                return { ok: false, error: `Team ${sanitized} not found` };
+            }
+            const originalConfig = JSON.parse(JSON.stringify(config));
+            const configPath = join(resolveCanonicalTeamStateRoot(leaderCwd), 'team', sanitized, 'config.json');
+            const manifestPath = join(resolveCanonicalTeamStateRoot(leaderCwd), 'team', sanitized, 'manifest.v2.json');
+            const originalManifestBytes = existsSync(manifestPath) ? await readFile(manifestPath, 'utf8') : null;
+            const maxWorkers = config.max_workers;
+            const currentCount = config.workers.length;
+            if (currentCount + count > maxWorkers) {
+                return {
+                    ok: false,
+                    error: `Cannot add ${count} workers: would exceed max_workers (${currentCount} + ${count} > ${maxWorkers})`,
+                };
+            }
+            const teamStateRoot = config.team_state_root ?? resolveCanonicalTeamStateRoot(leaderCwd);
+            const codexHomeOverride = resolveCodexHomeForLaunch(leaderCwd, env);
+            const launchEnv = codexHomeOverride
+                ? { ...env, CODEX_HOME: codexHomeOverride }
+                : env;
+            // Build and validate every launch plan before any task, directory, worktree,
+            // pane, process, or config mutation. The plan is the sole source of launch
+            // policy; later task materialization must not alter it.
+            const initialNextIndex = config.next_worker_index ?? (currentCount + 1);
+            let workerLaunchPlans;
+            try {
+                const existingTasks = await listTasks(sanitized, leaderCwd);
+                workerLaunchPlans = buildScaleUpWorkerLaunchPlans({
+                    count,
+                    nextWorkerIndex: initialNextIndex,
+                    agentType,
+                    existingTasks,
+                    incomingTasks: tasks,
+                    launchEnv,
+                    codexHomeOverride,
+                });
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+            let nextIndex = initialNextIndex;
+            const sessionName = config.tmux_session;
+            const manifest = await readTeamManifestV2(sanitized, leaderCwd);
+            const dispatchPolicy = normalizeTeamPolicy(manifest?.policy, {
+                display_mode: manifest?.policy?.display_mode === 'split_pane' ? 'split_pane' : 'auto',
+                worker_launch_mode: config.worker_launch_mode,
             });
-        }
-        catch (error) {
-            return {
-                ok: false,
-                error: error instanceof Error ? error.message : String(error),
-            };
-        }
-        let nextIndex = initialNextIndex;
-        const sessionName = config.tmux_session;
-        const manifest = await readTeamManifestV2(sanitized, leaderCwd);
-        const dispatchPolicy = normalizeTeamPolicy(manifest?.policy, {
-            display_mode: manifest?.policy?.display_mode === 'split_pane' ? 'split_pane' : 'auto',
-            worker_launch_mode: config.worker_launch_mode,
-        });
-        const approvedExecutionState = await resolvePersistedApprovedTeamExecutionContinuityState(sanitized, config.leader_cwd ?? leaderCwd, config.team_state_root ?? teamStateRoot);
-        const approvedExecutionGate = resolveScaleUpApprovedExecutionGate(sanitized, approvedExecutionState);
-        if (!approvedExecutionGate.ok) {
-            return approvedExecutionGate;
-        }
-        const persistedUltragoalContext = await readPersistedTeamUltragoalContext(sanitized, config.leader_cwd ?? leaderCwd, config.team_state_root ?? teamStateRoot);
-        const approvedContextSection = joinContextSections(approvedExecutionGate.approvedContextSection, renderLeaderOwnedUltragoalContextSection(persistedUltragoalContext));
-        const effectiveWorktreeMode = config.worktree_mode ?? resolveScaleUpWorktreeMode(config);
-        if (!config.worktree_mode && effectiveWorktreeMode.enabled) {
-            config.worktree_mode = effectiveWorktreeMode;
-            await saveTeamConfig(config, leaderCwd);
-        }
-        const addedWorkers = [];
-        const createdTaskIds = [];
-        const rollbackScaleUp = async (error, context = {}) => {
-            for (const w of addedWorkers) {
-                const idx = config.workers.findIndex((worker) => worker.name === w.name);
-                if (idx >= 0) {
-                    config.workers.splice(idx, 1);
+            const approvedExecutionState = await resolvePersistedApprovedTeamExecutionContinuityState(sanitized, config.leader_cwd ?? leaderCwd, config.team_state_root ?? teamStateRoot);
+            const approvedExecutionGate = resolveScaleUpApprovedExecutionGate(sanitized, approvedExecutionState);
+            if (!approvedExecutionGate.ok) {
+                return approvedExecutionGate;
+            }
+            const persistedUltragoalContext = await readPersistedTeamUltragoalContext(sanitized, config.leader_cwd ?? leaderCwd, config.team_state_root ?? teamStateRoot);
+            const approvedContextSection = joinContextSections(approvedExecutionGate.approvedContextSection, renderLeaderOwnedUltragoalContextSection(persistedUltragoalContext));
+            const initialSplitTargetCandidate = config.workers[config.workers.length - 1];
+            const initialSplitTargetWorker = initialSplitTargetCandidate?.pane_id?.trim()
+                ? initialSplitTargetCandidate
+                : undefined;
+            const initialSplitTarget = initialSplitTargetWorker?.pane_id ?? config.leader_pane_id ?? '';
+            const initialSplitTargetOwnerId = typeof config.tmux_pane_owner_id === 'string'
+                ? config.tmux_pane_owner_id.trim()
+                : '';
+            if (!initialSplitTargetOwnerId) {
+                return {
+                    ok: false,
+                    error: `scale_up_split_target_owner_unavailable:${initialSplitTarget}`,
+                };
+            }
+            let initialExpectedSplitTargetPid = initialSplitTargetWorker
+                ? initialSplitTargetWorker.pid
+                : config.leader_pane_pid;
+            if (typeof initialExpectedSplitTargetPid !== 'number'
+                || !Number.isSafeInteger(initialExpectedSplitTargetPid)
+                || initialExpectedSplitTargetPid <= 0) {
+                // Legacy configs may lack a persisted PID, but the persisted pane ID and
+                // canonical owner remain mandatory. Pin only the exact live pane proven
+                // from one global snapshot, then re-prove it after reading the owner tag
+                // so a recycled pane ID cannot be backfilled.
+                const migrationProof = readExactPaneProofSync(initialSplitTarget);
+                if (migrationProof.status !== 'live') {
+                    return {
+                        ok: false,
+                        error: `scale_up_split_target_proof_unavailable:${initialSplitTarget}:${migrationProof.reason}`,
+                    };
+                }
+                const migrationOwner = readPaneTeamOwnerTagResult(migrationProof.paneId);
+                if (migrationOwner.status !== 'value' || migrationOwner.value !== initialSplitTargetOwnerId) {
+                    return {
+                        ok: false,
+                        error: `scale_up_split_target_owner_changed:${migrationProof.paneId}`,
+                    };
+                }
+                const finalMigrationProof = readExactPaneProofSync(migrationProof.paneId);
+                if (finalMigrationProof.status !== 'live') {
+                    return {
+                        ok: false,
+                        error: `scale_up_split_target_proof_unavailable:${migrationProof.paneId}:${finalMigrationProof.reason}`,
+                    };
+                }
+                if (finalMigrationProof.pid !== migrationProof.pid) {
+                    return {
+                        ok: false,
+                        error: `scale_up_split_target_pid_changed:${migrationProof.paneId}:${migrationProof.pid}:${finalMigrationProof.pid}`,
+                    };
+                }
+                if (initialSplitTargetWorker) {
+                    initialSplitTargetWorker.pid = finalMigrationProof.pid;
+                }
+                else {
+                    config.leader_pane_pid = finalMigrationProof.pid;
                 }
                 try {
-                    if (w.pane_id) {
-                        execFileSync('tmux', ['kill-pane', '-t', w.pane_id], { stdio: 'pipe',
-                            windowsHide: true,
-                        });
-                    }
+                    await saveTeamConfig(config, leaderCwd);
                 }
-                catch { }
-                if (w.worktree_path) {
-                    await removeWorkerWorktreeRootAgentsFile(sanitized, w.name, teamStateRoot, w.worktree_path).catch(() => { });
+                catch (error) {
+                    return {
+                        ok: false,
+                        error: `scale_up_split_target_pid_persistence_failed:${initialSplitTarget}:${error instanceof Error ? error.message : String(error)}`,
+                    };
                 }
+                Object.assign(originalConfig, JSON.parse(JSON.stringify(config)));
+                initialExpectedSplitTargetPid = finalMigrationProof.pid;
             }
-            if (context.workerName &&
-                context.worktreePath &&
-                !addedWorkers.some((worker) => worker.name === context.workerName)) {
-                await removeWorkerWorktreeRootAgentsFile(sanitized, context.workerName, teamStateRoot, context.worktreePath).catch(() => { });
+            const initialSplitTargetProof = readExactPaneProofSync(initialSplitTarget);
+            if (initialSplitTargetProof.status !== 'live') {
+                return {
+                    ok: false,
+                    error: `scale_up_split_target_proof_unavailable:${initialSplitTarget}:${initialSplitTargetProof.reason}`,
+                };
+            }
+            if (initialSplitTargetProof.pid !== initialExpectedSplitTargetPid) {
+                return {
+                    ok: false,
+                    error: `scale_up_split_target_pid_changed:${initialSplitTarget}:${initialExpectedSplitTargetPid}:${initialSplitTargetProof.pid}`,
+                };
+            }
+            const effectiveWorktreeMode = config.worktree_mode ?? resolveScaleUpWorktreeMode(config);
+            if (!config.worktree_mode && effectiveWorktreeMode.enabled) {
+                config.worktree_mode = effectiveWorktreeMode;
             }
-            if (context.paneId) {
+            const addedWorkers = [];
+            // A scale-up pane becomes killable during rollback only after its exact
+            // process identity was pinned and, when Team ownership is configured, its
+            // owner tag command completed. A returned pane ID alone is cleanup debt,
+            // never authority to affect a potentially recycled pane.
+            const rollbackTaggedPaneOwnerIds = new Map();
+            const createdTaskIds = [];
+            const provisionedWorktrees = [];
+            const preparedWorkerDirectoryOwner = new Map();
+            const preparedStartupScriptOwner = new Map();
+            const runtimeDirectoryPath = join(teamStateRoot, 'team', sanitized, 'runtime');
+            const runtimeDirectoryExisted = existsSync(runtimeDirectoryPath);
+            const rollbackScaleUp = async (error, context = {}) => {
+                const rollbackWorkers = [...new Map([...addedWorkers, context.worker]
+                        .filter((worker) => Boolean(worker))
+                        .map((worker) => [worker.name, worker])).values()];
+                const rollbackWorkerNames = new Set(rollbackWorkers.map((worker) => worker.name));
+                // Persist every concrete rollback worker before pane teardown. If the
+                // process exits after this point, canonical config/manifest state still
+                // identifies each live pane and its retryable resources.
                 try {
-                    execFileSync('tmux', ['kill-pane', '-t', context.paneId], { stdio: 'pipe',
-                        windowsHide: true,
+                    await withTaskMembershipBarrier(sanitized, leaderCwd, async () => {
+                        await recoverTeamMembershipTaskTransaction(sanitized, leaderCwd);
+                        const currentConfigBytes = await readFile(configPath, 'utf8');
+                        const currentManifestBytes = existsSync(manifestPath) ? await readFile(manifestPath, 'utf8') : null;
+                        const currentConfig = JSON.parse(currentConfigBytes);
+                        const trackedByName = new Map(currentConfig.workers.map((worker) => [worker.name, worker]));
+                        for (const worker of rollbackWorkers)
+                            trackedByName.set(worker.name, worker);
+                        const trackedConfig = {
+                            ...currentConfig,
+                            workers: [...trackedByName.values()],
+                            worker_count: trackedByName.size,
+                            next_worker_index: Math.max(currentConfig.next_worker_index ?? (currentConfig.workers.length + 1), ...rollbackWorkers.map((worker) => worker.index + 1)),
+                        };
+                        const trackedManifestBytes = currentManifestBytes === null
+                            ? null
+                            : JSON.stringify({
+                                ...JSON.parse(currentManifestBytes),
+                                workers: trackedConfig.workers,
+                                worker_count: trackedConfig.worker_count,
+                                next_worker_index: trackedConfig.next_worker_index,
+                            }, null, 2);
+                        await commitTeamMembershipTaskTransaction(sanitized, leaderCwd, {
+                            baseGeneration: currentConfig.config_generation ?? 0,
+                            tasks: [],
+                            config: { oldBytes: currentConfigBytes, newBytes: JSON.stringify(trackedConfig, null, 2) },
+                            manifest: { oldBytes: currentManifestBytes, newBytes: trackedManifestBytes },
+                            recoverToNewOnFailure: true,
+                        });
+                        const verified = await readTeamConfig(sanitized, leaderCwd);
+                        if (!verified || rollbackWorkers.some((worker) => !verified.workers.some((entry) => entry.name === worker.name && entry.pane_id === worker.pane_id))) {
+                            throw new Error('canonical_scale_up_rollback_tracking_verification_failed');
+                        }
+                        Object.assign(config, verified);
                     });
                 }
-                catch { }
-            }
-            for (const taskId of createdTaskIds) {
-                await rm(join(leaderCwd, '.omx', 'state', 'team', sanitized, 'tasks', `task-${taskId}.json`), { force: true }).catch(() => { });
-            }
-            config.worker_count = config.workers.length;
-            config.next_worker_index = initialNextIndex;
-            await saveTeamConfig(config, leaderCwd);
-            return { ok: false, error };
-        };
-        // Persist incoming tasks only after launch policy is frozen; the resulting
-        // task listing is used for inbox and task materialization, never launch policy.
-        for (const task of tasks) {
-            const createdTask = await createStateTask(sanitized, {
-                subject: task.subject,
-                description: task.description,
-                status: 'pending',
-                owner: task.owner,
-                blocked_by: task.blocked_by,
-                role: task.role,
-            }, leaderCwd);
-            createdTaskIds.push(createdTask.id);
-        }
-        const materializedTasks = await listTasks(sanitized, leaderCwd);
-        for (const workerLaunchPlan of workerLaunchPlans) {
-            const { workerIndex, workerName, runtimeRole, workerLaunchArgs, workerCli, } = workerLaunchPlan;
-            nextIndex = workerIndex + 1;
-            if (workerLaunchPlan.mixedTaskRoles.length > 1) {
-                console.log(`[omx:scaling] ${workerName}: mixed task roles [${workerLaunchPlan.mixedTaskRoles.join(', ')}], falling back to ${agentType}`);
-            }
-            // Create worker directory
-            const workerDirPath = join(leaderCwd, '.omx', 'state', 'team', sanitized, 'workers', workerName);
-            await mkdir(workerDirPath, { recursive: true });
-            const worktreeMode = effectiveWorktreeMode;
-            const workerWorkspaceResult = worktreeMode.enabled
-                ? ensureWorktree(planWorktreeTarget({
-                    cwd: leaderCwd,
-                    scope: 'team',
-                    mode: worktreeMode,
-                    teamName: sanitized,
-                    workerName,
-                }))
-                : { enabled: false };
-            const workerWorkspace = workerWorkspaceResult.enabled ? workerWorkspaceResult : null;
-            const workerCwd = workerWorkspace ? workerWorkspace.worktreePath : leaderCwd;
-            // Build startup command and create tmux pane
-            const rawRolePromptContent = await loadRolePrompt(runtimeRole, join(leaderCwd, '.codex', 'prompts'))
-                ?? await loadRolePrompt(runtimeRole, codexPromptsDir());
-            const resolvedWorkerModel = parseTeamWorkerLaunchArgs(workerLaunchArgs).modelOverride ?? undefined;
-            const rolePromptContent = rawRolePromptContent
-                ? composeRoleInstructionsForRole(runtimeRole, rawRolePromptContent, resolvedWorkerModel)
-                : null;
-            const teamInstructionsPath = join(leaderCwd, '.omx', 'state', 'team', sanitized, 'worker-agents.md');
-            const instructionsFilePath = workerWorkspace
-                ? await writeWorkerWorktreeRootAgentsFile({
-                    teamName: sanitized,
-                    workerName,
-                    workerRole: runtimeRole,
-                    rolePromptContent: rolePromptContent ?? '',
-                    teamStateRoot,
-                    leaderCwd,
-                    worktreePath: workerWorkspace.worktreePath,
-                })
-                : rolePromptContent
-                    ? await writeWorkerRoleInstructionsFile(sanitized, workerName, leaderCwd, teamInstructionsPath, runtimeRole, rolePromptContent)
-                    : teamInstructionsPath;
-            const extraEnv = {
-                OMX_TEAM_STATE_ROOT: teamStateRoot,
-                OMX_TEAM_LEADER_CWD: leaderCwd,
-                OMX_MODEL_INSTRUCTIONS_FILE: instructionsFilePath,
-                ...(codexHomeOverride ? { CODEX_HOME: codexHomeOverride } : {}),
+                catch (trackingError) {
+                    return { ok: false, error: `scale_up_rollback_membership_persistence_failed:${String(trackingError)}` };
+                }
+                const cleanupDebt = [];
+                try {
+                    await removeDispatchRequestsForWorkers(sanitized, [...rollbackWorkerNames], leaderCwd);
+                }
+                catch (rollbackError) {
+                    cleanupDebt.push(`authoritative_dispatch_cleanup_failed:${String(rollbackError)}`);
+                }
+                const rollbackPaneIds = [...new Set([
+                        ...rollbackWorkers.map((worker) => worker.pane_id),
+                        context.paneId,
+                    ].filter((paneId) => typeof paneId === 'string' && paneId.trim().startsWith('%')))];
+                const resolvedPaneIds = new Set();
+                const unresolvedPaneIds = new Set();
+                const expectedPanePids = {};
+                const requiredTeamOwnerId = config.tmux_pane_owner_id?.trim();
+                const authorizedRollbackPaneIds = new Set();
+                for (const paneId of rollbackPaneIds) {
+                    const matchingWorkers = rollbackWorkers.filter((worker) => worker.pane_id === paneId);
+                    const worker = matchingWorkers.length === 1 ? matchingWorkers[0] : undefined;
+                    const expectedPanePid = worker?.pid;
+                    if (!worker || typeof expectedPanePid !== 'number' || !Number.isInteger(expectedPanePid) || expectedPanePid <= 0) {
+                        unresolvedPaneIds.add(paneId);
+                        cleanupDebt.push(`pane_pid_unpinned:${paneId}`);
+                        continue;
+                    }
+                    if (requiredTeamOwnerId && rollbackTaggedPaneOwnerIds.get(paneId) !== requiredTeamOwnerId) {
+                        unresolvedPaneIds.add(paneId);
+                        cleanupDebt.push(`pane_owner_unverified:${paneId}`);
+                        continue;
+                    }
+                    expectedPanePids[paneId] = expectedPanePid;
+                    authorizedRollbackPaneIds.add(paneId);
+                }
+                try {
+                    const paneTeardown = await teardownWorkerPanes([...authorizedRollbackPaneIds], {
+                        leaderPaneId: config.leader_pane_id,
+                        hudPaneId: config.hud_pane_id,
+                        expectedPanePids,
+                        authorizePaneKill: (paneId) => {
+                            if (!requiredTeamOwnerId)
+                                return true;
+                            const expectedOwnerId = rollbackTaggedPaneOwnerIds.get(paneId);
+                            if (expectedOwnerId !== requiredTeamOwnerId)
+                                return false;
+                            const currentOwner = readPaneTeamOwnerTagResult(paneId);
+                            return currentOwner.status === 'value' && currentOwner.value === expectedOwnerId;
+                        },
+                    });
+                    for (const paneId of [...paneTeardown.provenGonePaneIds, ...paneTeardown.killedPaneIds])
+                        resolvedPaneIds.add(paneId);
+                    for (const paneId of paneTeardown.kill.failedPaneIds)
+                        unresolvedPaneIds.add(paneId);
+                    for (const proof of paneTeardown.proofUnavailable)
+                        unresolvedPaneIds.add(proof.paneId);
+                    if (paneTeardown.kill.failedPaneIds.length > 0)
+                        cleanupDebt.push(`pane_teardown_failed:${paneTeardown.kill.failedPaneIds.join(',')}`);
+                    if (paneTeardown.proofUnavailable.length > 0) {
+                        cleanupDebt.push(`pane_proof_unavailable:${paneTeardown.proofUnavailable.map((proof) => `${proof.paneId}:${proof.reason}`).join(',')}`);
+                    }
+                    if (paneTeardown.kill.failedPaneIds.length > 0 || paneTeardown.proofUnavailable.length > 0) {
+                        for (const paneId of rollbackPaneIds) {
+                            if (!resolvedPaneIds.has(paneId))
+                                unresolvedPaneIds.add(paneId);
+                        }
+                        const unresolvedWithoutDirectFailure = [...unresolvedPaneIds].filter((paneId) => !paneTeardown.kill.failedPaneIds.includes(paneId)
+                            && !paneTeardown.proofUnavailable.some((proof) => proof.paneId === paneId));
+                        if (unresolvedWithoutDirectFailure.length > 0) {
+                            cleanupDebt.push(`pane_teardown_unresolved:${unresolvedWithoutDirectFailure.join(',')}`);
+                        }
+                    }
+                }
+                catch (cleanupError) {
+                    for (const paneId of rollbackPaneIds)
+                        unresolvedPaneIds.add(paneId);
+                    cleanupDebt.push(`pane_cleanup_exception:${String(cleanupError)}`);
+                }
+                const unresolvedWorkerNames = new Set(rollbackWorkers
+                    .filter((worker) => typeof worker.pane_id === 'string' && unresolvedPaneIds.has(worker.pane_id))
+                    .map((worker) => worker.name));
+                if (context.workerName && context.paneId && unresolvedPaneIds.has(context.paneId)) {
+                    unresolvedWorkerNames.add(context.workerName);
+                }
+                try {
+                    await withTaskMembershipBarrier(sanitized, leaderCwd, async () => {
+                        await recoverTeamMembershipTaskTransaction(sanitized, leaderCwd);
+                        const currentConfigBytes = await readFile(configPath, 'utf8');
+                        const currentConfig = JSON.parse(currentConfigBytes);
+                        const currentManifestBytes = existsSync(manifestPath) ? await readFile(manifestPath, 'utf8') : null;
+                        const retainedWorkers = rollbackWorkers.filter((worker) => unresolvedWorkerNames.has(worker.name));
+                        const desiredByName = new Map(originalConfig.workers.map((worker) => [worker.name, worker]));
+                        for (const worker of retainedWorkers)
+                            desiredByName.set(worker.name, worker);
+                        const desiredConfig = {
+                            ...originalConfig,
+                            workers: [...desiredByName.values()],
+                            worker_count: desiredByName.size,
+                            next_worker_index: Math.max(originalConfig.next_worker_index ?? (originalConfig.workers.length + 1), ...retainedWorkers.map((worker) => worker.index + 1)),
+                        };
+                        const desiredManifestBytes = originalManifestBytes === null
+                            ? null
+                            : JSON.stringify({
+                                ...JSON.parse(originalManifestBytes),
+                                workers: desiredConfig.workers,
+                                worker_count: desiredConfig.worker_count,
+                                next_worker_index: desiredConfig.next_worker_index,
+                            }, null, 2);
+                        const taskChanges = [];
+                        for (const taskId of createdTaskIds) {
+                            const taskPath = join(teamStateRoot, 'team', sanitized, 'tasks', `task-${taskId}.json`);
+                            const task = await readTask(sanitized, taskId, leaderCwd);
+                            taskChanges.push({
+                                taskId,
+                                oldBytes: existsSync(taskPath) ? await readFile(taskPath, 'utf8') : null,
+                                newBytes: task && unresolvedWorkerNames.has(task.owner ?? '')
+                                    ? JSON.stringify(task, null, 2)
+                                    : null,
+                            });
+                        }
+                        await commitTeamMembershipTaskTransaction(sanitized, leaderCwd, {
+                            baseGeneration: currentConfig.config_generation ?? 0,
+                            tasks: taskChanges,
+                            config: { oldBytes: currentConfigBytes, newBytes: JSON.stringify(desiredConfig, null, 2) },
+                            manifest: { oldBytes: currentManifestBytes, newBytes: desiredManifestBytes },
+                            recoverToNewOnFailure: true,
+                            retainJournalOnSuccess: true,
+                            failRollbackPersistence: hasScaleUpFailureInjection(env, 'rollback-membership-persistence'),
+                            failRollbackPersistenceAfter: hasScaleUpFailureInjection(env, 'rollback-membership-config-persistence')
+                                ? 'config'
+                                : hasScaleUpFailureInjection(env, 'rollback-membership-manifest-persistence')
+                                    ? 'manifest'
+                                    : undefined,
+                        });
+                        const verified = JSON.parse(await readFile(configPath, 'utf8'));
+                        if (!verified || retainedWorkers.some((worker) => !verified.workers.some((entry) => entry.name === worker.name && entry.pane_id === worker.pane_id))) {
+                            throw new Error('canonical_scale_up_rollback_membership_verification_failed');
+                        }
+                        if (verified.workers.some((worker) => rollbackWorkerNames.has(worker.name) && !unresolvedWorkerNames.has(worker.name))) {
+                            throw new Error('canonical_scale_up_rollback_resolved_membership_verification_failed');
+                        }
+                        await finalizeTeamMembershipTaskTransaction(sanitized, leaderCwd);
+                        Object.assign(config, verified);
+                    });
+                }
+                catch (rollbackError) {
+                    const journalPath = join(teamStateRoot, 'team', sanitized, '.membership-task-transaction.json');
+                    const suffix = existsSync(journalPath) ? String(rollbackError) : `no_recoverable_journal:${String(rollbackError)}`;
+                    return { ok: false, error: `scale_up_rollback_membership_persistence_failed:${suffix}` };
+                }
+                const cleanupWorkerNames = new Set([
+                    ...rollbackWorkers
+                        .filter((worker) => typeof worker.pane_id !== 'string' || resolvedPaneIds.has(worker.pane_id))
+                        .map((worker) => worker.name),
+                    ...(context.workerName && !unresolvedWorkerNames.has(context.workerName) ? [context.workerName] : []),
+                ]);
+                try {
+                    for (const taskId of createdTaskIds) {
+                        const task = await readTask(sanitized, taskId, leaderCwd);
+                        if (task && unresolvedWorkerNames.has(task.owner ?? ''))
+                            continue;
+                        await rm(join(teamStateRoot, 'team', sanitized, 'tasks', `task-${taskId}.json`), { force: true });
+                    }
+                    await Promise.all([...cleanupWorkerNames].map(async (workerName) => {
+                        await rm(join(teamStateRoot, 'team', sanitized, 'workers', workerName), { recursive: true, force: true });
+                    }));
+                    for (const taskId of createdTaskIds) {
+                        const task = await readTask(sanitized, taskId, leaderCwd);
+                        if (task && unresolvedWorkerNames.has(task.owner ?? ''))
+                            continue;
+                        if (task)
+                            throw new Error(`canonical_scale_up_rollback_task_verification_failed:${taskId}`);
+                    }
+                    for (const workerName of cleanupWorkerNames) {
+                        if (existsSync(join(teamStateRoot, 'team', sanitized, 'workers', workerName))) {
+                            throw new Error(`canonical_scale_up_rollback_worker_verification_failed:${workerName}`);
+                        }
+                    }
+                }
+                catch (rollbackError) {
+                    cleanupDebt.push(`canonical_cleanup_failed:${String(rollbackError)}`);
+                }
+                try {
+                    const contextWorkerName = context.worker?.name ?? context.workerName;
+                    const contextWorktreePath = context.worker?.worktree_path ?? context.worktreePath;
+                    if (contextWorkerName && contextWorktreePath && !unresolvedWorkerNames.has(contextWorkerName)) {
+                        await removeWorkerWorktreeRootAgentsFile(sanitized, contextWorkerName, teamStateRoot, contextWorktreePath);
+                    }
+                    const unresolvedWorktreePaths = new Set(rollbackWorkers
+                        .filter((worker) => unresolvedWorkerNames.has(worker.name) && typeof worker.worktree_path === 'string')
+                        .map((worker) => resolve(worker.worktree_path)));
+                    await rollbackProvisionedWorktrees(provisionedWorktrees.filter((worktree) => !unresolvedWorktreePaths.has(resolve(worktree.worktreePath))));
+                    await Promise.all([...preparedWorkerDirectoryOwner.entries()]
+                        .filter(([, workerName]) => !unresolvedWorkerNames.has(workerName))
+                        .map(async ([workerDirPath]) => {
+                        await rm(workerDirPath, { recursive: true, force: true });
+                    }));
+                    await Promise.all([...preparedStartupScriptOwner.entries()]
+                        .filter(([, workerName]) => !unresolvedWorkerNames.has(workerName))
+                        .map(async ([startupScriptPath]) => {
+                        await rm(startupScriptPath, { force: true });
+                    }));
+                    if (!runtimeDirectoryExisted && unresolvedWorkerNames.size === 0)
+                        await rm(runtimeDirectoryPath, { recursive: true, force: true });
+                }
+                catch (cleanupError) {
+                    cleanupDebt.push(`resource_cleanup_failed:${String(cleanupError)}`);
+                }
+                if (cleanupDebt.length > 0) {
+                    const reason = `scale_up_rollback_cleanup_debt:${cleanupDebt.join(';')}; retry cleanup for [${[...rollbackWorkerNames].join(',')}]`;
+                    try {
+                        await appendTeamEvent(sanitized, { type: 'team_leader_nudge', worker: 'leader-fixed', reason }, leaderCwd);
+                    }
+                    catch (eventError) {
+                        cleanupDebt.push(`cleanup_debt_event_failed:${String(eventError)}`);
+                    }
+                    return { ok: false, error: `scale_up_rollback_cleanup_debt:${cleanupDebt.join(';')}` };
+                }
+                return { ok: false, error };
             };
-            if (workerWorkspace) {
-                extraEnv.OMX_TEAM_WORKTREE_PATH = workerWorkspace.worktreePath;
-                if (workerWorkspace.branchName) {
-                    extraEnv.OMX_TEAM_WORKTREE_BRANCH = workerWorkspace.branchName;
-                }
-                extraEnv.OMX_TEAM_WORKTREE_DETACHED = workerWorkspace.detached ? '1' : '0';
-            }
-            trustWorkerMiseConfigIfAvailable(workerCwd);
-            const cmd = writeWorkerStartupScriptCommand(sanitized, workerIndex, workerLaunchArgs, workerCwd, extraEnv, workerCli, undefined, runtimeRole) ?? buildWorkerStartupCommand(sanitized, workerIndex, workerLaunchArgs, workerCwd, extraEnv, workerCli, undefined, runtimeRole);
-            // Find the right-most worker pane to split from, or fall back to leader pane.
-            // Keep the initial split from leader horizontal to preserve the leader-left
-            // / workers-right composition.
-            const splitTarget = config.workers.length > 0
-                ? (config.workers[config.workers.length - 1]?.pane_id ?? config.leader_pane_id ?? '')
-                : (config.leader_pane_id ?? '');
-            const splitDirection = splitTarget === (config.leader_pane_id ?? '') ? '-h' : '-v';
-            const result = spawnSync('tmux', [
-                'split-window', splitDirection, '-t', splitTarget, '-d', '-P', '-F', '#{pane_id}', '-c', workerCwd, cmd,
-            ], { encoding: 'utf-8' });
-            if (result.status !== 0) {
-                return await rollbackScaleUp(`Failed to create tmux pane for ${workerName}: ${(result.stderr || '').trim()}`, { workerName, worktreePath: workerWorkspace?.worktreePath });
-            }
-            const paneId = (result.stdout || '').trim().split('\n')[0]?.trim();
-            if (!paneId || !paneId.startsWith('%')) {
-                return await rollbackScaleUp(`Failed to capture pane ID for ${workerName}`, {
-                    paneId,
-                    workerName,
-                    worktreePath: workerWorkspace?.worktreePath,
-                });
+            // Persist incoming tasks only after launch policy is frozen; the resulting
+            // task listing is used for inbox and task materialization, never launch policy.
+            let materializedTasks;
+            try {
+                for (const task of tasks) {
+                    const createdTask = await createStateTask(sanitized, {
+                        subject: task.subject,
+                        description: task.description,
+                        status: 'pending',
+                        owner: task.owner,
+                        blocked_by: task.blocked_by,
+                        role: task.role,
+                    }, leaderCwd);
+                    createdTaskIds.push(createdTask.id);
+                }
+                materializedTasks = await listTasks(sanitized, leaderCwd);
+            }
+            catch (error) {
+                return await rollbackScaleUp(`scale_up_task_materialization_failed:${error instanceof Error ? error.message : String(error)}`);
             }
-            if (config.tmux_pane_owner_id) {
+            for (const workerLaunchPlan of workerLaunchPlans) {
+                const { workerIndex, workerName, runtimeRole, workerLaunchArgs, workerCli, } = workerLaunchPlan;
+                // Freeze the split target and its identity before preparing any artifacts.
+                // Later proof must establish that this exact pane process still owns the
+                // target; a recycled pane ID must never become split authority.
+                const splitTargetCandidate = config.workers[config.workers.length - 1];
+                const splitTargetWorker = splitTargetCandidate?.pane_id?.trim() ? splitTargetCandidate : undefined;
+                const splitTarget = splitTargetWorker?.pane_id ?? config.leader_pane_id ?? '';
+                const expectedSplitTargetPid = splitTargetWorker
+                    ? splitTargetWorker.pid
+                    : config.leader_pane_pid;
+                const expectedSplitTargetOwnerId = typeof config.tmux_pane_owner_id === 'string'
+                    ? config.tmux_pane_owner_id.trim()
+                    : '';
+                if (typeof expectedSplitTargetPid !== 'number'
+                    || !Number.isSafeInteger(expectedSplitTargetPid)
+                    || expectedSplitTargetPid <= 0) {
+                    return await rollbackScaleUp(`scale_up_split_target_pid_missing:${splitTarget}`);
+                }
+                if (!expectedSplitTargetOwnerId) {
+                    return await rollbackScaleUp(`scale_up_split_target_owner_unavailable:${splitTarget}`);
+                }
+                const splitDirection = splitTarget === (config.leader_pane_id ?? '') ? '-h' : '-v';
+                nextIndex = workerIndex + 1;
+                if (workerLaunchPlan.mixedTaskRoles.length > 1) {
+                    console.log(`[omx:scaling] ${workerName}: mixed task roles [${workerLaunchPlan.mixedTaskRoles.join(', ')}], falling back to ${agentType}`);
+                }
+                // Prepare every pre-pane artifact under the rollback boundary. A pane is
+                // not required for ownership: workerName and any created worktree are
+                // sufficient for rollback to clean a failed preparation.
+                const workerDirPath = join(leaderCwd, '.omx', 'state', 'team', sanitized, 'workers', workerName);
+                const startupScriptPath = join(teamStateRoot, 'team', sanitized, 'runtime', `worker-${workerIndex}-startup.sh`);
+                let workerWorkspace = null;
+                let workerCwd = leaderCwd;
+                let cmd;
+                let rawRolePromptContent = null;
                 try {
-                    tagPaneTeamOwner(paneId, config.tmux_pane_owner_id);
+                    preparedWorkerDirectoryOwner.set(workerDirPath, workerName);
+                    await mkdir(workerDirPath, { recursive: true });
+                    if (effectiveWorktreeMode.enabled) {
+                        const worktreePlan = planWorktreeTarget({
+                            cwd: leaderCwd,
+                            scope: 'team',
+                            mode: effectiveWorktreeMode,
+                            teamName: sanitized,
+                            workerName,
+                        });
+                        if (!worktreePlan.enabled)
+                            throw new Error(`worktree_not_planned:${workerName}`);
+                        const worktreePathExistedBeforeEnsure = existsSync(worktreePlan.worktreePath);
+                        const branchExistedBeforeEnsure = worktreePlan.branchName
+                            ? spawnSync('git', ['show-ref', '--verify', '--quiet', `refs/heads/${worktreePlan.branchName}`], {
+                                cwd: worktreePlan.repoRoot,
+                                encoding: 'utf-8',
+                                windowsHide: true,
+                            }).status === 0
+                            : false;
+                        try {
+                            const ensuredWorkspace = ensureWorktree(worktreePlan);
+                            throwIfScaleUpFailureInjected(env, 'worktree-ensure-post-create');
+                            if (!ensuredWorkspace.enabled)
+                                throw new Error(`worktree_not_provisioned:${workerName}`);
+                            workerWorkspace = ensuredWorkspace;
+                        }
+                        catch (error) {
+                            const recoveredWorkspace = recoverCreatedWorktreeAfterEnsureFailure(worktreePlan, worktreePathExistedBeforeEnsure, branchExistedBeforeEnsure);
+                            if (recoveredWorkspace) {
+                                workerWorkspace = recoveredWorkspace;
+                                provisionedWorktrees.push(recoveredWorkspace);
+                            }
+                            throw error;
+                        }
+                        if (!workerWorkspace)
+                            throw new Error(`worktree_not_provisioned:${workerName}`);
+                        provisionedWorktrees.push(workerWorkspace);
+                        throwIfScaleUpFailureInjected(env, 'worktree-post-create');
+                        workerCwd = workerWorkspace.worktreePath;
+                    }
+                    rawRolePromptContent = await loadRolePrompt(runtimeRole, join(leaderCwd, '.codex', 'prompts'))
+                        ?? await loadRolePrompt(runtimeRole, codexPromptsDir());
+                    const resolvedWorkerModel = parseTeamWorkerLaunchArgs(workerLaunchArgs).modelOverride ?? undefined;
+                    const rolePromptContent = rawRolePromptContent
+                        ? composeRoleInstructionsForRole(runtimeRole, rawRolePromptContent, resolvedWorkerModel)
+                        : null;
+                    const teamInstructionsPath = join(leaderCwd, '.omx', 'state', 'team', sanitized, 'worker-agents.md');
+                    const instructionsFilePath = workerWorkspace
+                        ? await writeWorkerWorktreeRootAgentsFile({
+                            teamName: sanitized,
+                            workerName,
+                            workerRole: runtimeRole,
+                            rolePromptContent: rolePromptContent ?? '',
+                            teamStateRoot,
+                            leaderCwd,
+                            worktreePath: workerWorkspace.worktreePath,
+                        })
+                        : rolePromptContent
+                            ? await writeWorkerRoleInstructionsFile(sanitized, workerName, leaderCwd, teamInstructionsPath, runtimeRole, rolePromptContent)
+                            : teamInstructionsPath;
+                    const extraEnv = {
+                        OMX_TEAM_STATE_ROOT: teamStateRoot,
+                        OMX_TEAM_LEADER_CWD: leaderCwd,
+                        OMX_MODEL_INSTRUCTIONS_FILE: instructionsFilePath,
+                        ...(codexHomeOverride ? { CODEX_HOME: codexHomeOverride } : {}),
+                    };
+                    if (workerWorkspace) {
+                        extraEnv.OMX_TEAM_WORKTREE_PATH = workerWorkspace.worktreePath;
+                        if (workerWorkspace.branchName) {
+                            extraEnv.OMX_TEAM_WORKTREE_BRANCH = workerWorkspace.branchName;
+                        }
+                        extraEnv.OMX_TEAM_WORKTREE_DETACHED = workerWorkspace.detached ? '1' : '0';
+                    }
+                    trustWorkerMiseConfigIfAvailable(workerCwd);
+                    preparedStartupScriptOwner.set(startupScriptPath, workerName);
+                    const startupCommand = writeWorkerStartupScriptCommand(sanitized, workerIndex, workerLaunchArgs, workerCwd, extraEnv, workerCli, undefined, runtimeRole);
+                    cmd = startupCommand ?? buildWorkerStartupCommand(sanitized, workerIndex, workerLaunchArgs, workerCwd, extraEnv, workerCli, undefined, runtimeRole);
                 }
                 catch (error) {
-                    return await rollbackScaleUp(`Failed to tag tmux pane for ${workerName}: ${error instanceof Error ? error.message : String(error)}`, { paneId, workerName, worktreePath: workerWorkspace?.worktreePath });
-                }
-            }
-            // Intentionally avoid forcing `select-layout tiled` here.
-            // Tiled relayout reflows leader/HUD panes and breaks team window layout.
-            // Get PID
-            const panePid = getWorkerPanePid(sessionName, workerIndex, paneId);
-            const workerInfo = {
-                name: workerName,
-                index: workerIndex,
-                role: runtimeRole,
-                worker_cli: workerCli,
-                assigned_tasks: [],
-                pid: panePid ?? undefined,
-                pane_id: paneId,
-                working_dir: workerCwd,
-                worktree_repo_root: workerWorkspace ? workerWorkspace.repoRoot : undefined,
-                worktree_path: workerWorkspace ? workerWorkspace.worktreePath : undefined,
-                worktree_branch: workerWorkspace ? (workerWorkspace.branchName ?? undefined) : undefined,
-                worktree_detached: workerWorkspace ? workerWorkspace.detached : undefined,
-                worktree_created: workerWorkspace ? workerWorkspace.created : undefined,
-                team_state_root: teamStateRoot,
-            };
-            await writeWorkerIdentity(sanitized, workerName, workerInfo, leaderCwd);
-            // Wait for worker readiness
-            const readyTimeoutMs = resolveWorkerReadyTimeoutMs(env);
-            const skipReadyWait = env.OMX_TEAM_SKIP_READY_WAIT === '1';
-            if (!skipReadyWait) {
-                const ready = waitForWorkerReady(sessionName, workerIndex, readyTimeoutMs, paneId);
-                if (!ready) {
-                    console.log(`[omx:scaling] Warning: worker ${workerName} did not become ready within timeout`);
-                }
-            }
-            // Get assigned tasks for this worker
-            const workerTasks = materializedTasks.filter(t => t.owner === workerName);
-            const inbox = generateInitialInbox(workerName, sanitized, agentType, workerTasks, {
-                teamStateRoot,
-                leaderCwd,
-                workerRole: runtimeRole,
-                rolePromptContent: rawRolePromptContent ?? undefined,
-                worktreeRootAgentsCanonical: Boolean(workerWorkspace?.worktreePath),
-                approvedContextSection,
-                workerGoalInstruction: buildTeamWorkerGoalInstruction(sanitized, workerName, workerTasks, { teamStateRoot }),
-            });
-            const triggerDirective = buildTriggerDirective(workerName, sanitized, resolveInstructionStateRoot(workerInfo.worktree_path));
-            const queued = await queueInboxInstruction({
-                teamName: sanitized,
-                workerName,
-                workerIndex,
-                paneId,
-                inbox,
-                triggerMessage: triggerDirective.text,
-                intent: triggerDirective.intent,
-                cwd: leaderCwd,
-                transportPreference: dispatchPolicy.dispatch_mode,
-                fallbackAllowed: true,
-                inboxCorrelationKey: `scale_up:${workerName}`,
-                notify: async (_target, message) => {
-                    if (dispatchPolicy.dispatch_mode === 'hook_preferred_with_fallback') {
-                        return { ok: true, transport: 'hook', reason: 'queued_for_hook_dispatch' };
+                    return await rollbackScaleUp(`scale_up_worker_preparation_failed:${workerName}:${error instanceof Error ? error.message : String(error)}`, { workerName, worktreePath: workerWorkspace?.worktreePath });
+                }
+                // The target and its expected PID were frozen before preparation. Prove
+                // the same identity immediately before the split-window side effect.
+                const splitTargetProof = readExactPaneProofSync(splitTarget);
+                if (splitTargetProof.status !== 'live') {
+                    return await rollbackScaleUp(`scale_up_split_target_proof_unavailable:${splitTarget}:${splitTargetProof.reason}`, { workerName, worktreePath: workerWorkspace?.worktreePath });
+                }
+                if (splitTargetProof.pid !== expectedSplitTargetPid) {
+                    return await rollbackScaleUp(`scale_up_split_target_pid_changed:${splitTarget}:${expectedSplitTargetPid}:${splitTargetProof.pid}`, { workerName, worktreePath: workerWorkspace?.worktreePath });
+                }
+                const currentSplitTargetOwner = readPaneTeamOwnerTagResult(splitTargetProof.paneId);
+                if (currentSplitTargetOwner.status !== 'value' || currentSplitTargetOwner.value !== expectedSplitTargetOwnerId) {
+                    return await rollbackScaleUp(`scale_up_split_target_owner_changed:${splitTargetProof.paneId}`, { workerName, worktreePath: workerWorkspace?.worktreePath });
+                }
+                // The owner read is untrusted and may race pane-ID reuse. Bind the split
+                // to the same persisted process again immediately before the effect.
+                const finalSplitTargetProof = readExactPaneProofSync(splitTargetProof.paneId);
+                if (finalSplitTargetProof.status !== 'live') {
+                    return await rollbackScaleUp(`scale_up_split_target_proof_unavailable:${splitTargetProof.paneId}:${finalSplitTargetProof.reason}`, { workerName, worktreePath: workerWorkspace?.worktreePath });
+                }
+                if (finalSplitTargetProof.pid !== expectedSplitTargetPid) {
+                    return await rollbackScaleUp(`scale_up_split_target_pid_changed:${splitTargetProof.paneId}:${expectedSplitTargetPid}:${finalSplitTargetProof.pid}`, { workerName, worktreePath: workerWorkspace?.worktreePath });
+                }
+                const result = spawnSync('tmux', [
+                    'split-window', splitDirection, '-t', finalSplitTargetProof.paneId, '-d', '-P', '-F', '#{pane_id}', '-c', workerCwd, cmd,
+                ], { encoding: 'utf-8' });
+                if (result.status !== 0) {
+                    return await rollbackScaleUp(`Failed to create tmux pane for ${workerName}: ${(result.stderr || '').trim()}`, { workerName, worktreePath: workerWorkspace?.worktreePath });
+                }
+                const paneId = (result.stdout || '').trim().split('\n')[0]?.trim();
+                if (!paneId || !paneId.startsWith('%')) {
+                    return await rollbackScaleUp(`Failed to capture pane ID for ${workerName}`, {
+                        paneId,
+                        workerName,
+                        worktreePath: workerWorkspace?.worktreePath,
+                    });
+                }
+                const paneProof = readExactPaneProofSync(paneId);
+                const workerInfo = {
+                    name: workerName,
+                    index: workerIndex,
+                    role: runtimeRole,
+                    worker_cli: workerCli,
+                    assigned_tasks: [],
+                    pid: paneProof.status === 'live' ? paneProof.pid : undefined,
+                    pane_id: paneId,
+                    working_dir: workerCwd,
+                    worktree_repo_root: workerWorkspace ? workerWorkspace.repoRoot : undefined,
+                    worktree_path: workerWorkspace ? workerWorkspace.worktreePath : undefined,
+                    worktree_branch: workerWorkspace ? (workerWorkspace.branchName ?? undefined) : undefined,
+                    worktree_detached: workerWorkspace ? workerWorkspace.detached : undefined,
+                    worktree_created: workerWorkspace ? workerWorkspace.created : undefined,
+                    team_state_root: teamStateRoot,
+                };
+                if (paneProof.status !== 'live') {
+                    return await rollbackScaleUp(`Failed to prove tmux pane for ${workerName}`, { paneId, worker: workerInfo });
+                }
+                if (config.tmux_pane_owner_id) {
+                    try {
+                        tagPaneTeamOwner(paneProof.paneId, config.tmux_pane_owner_id, paneProof.pid);
+                        rollbackTaggedPaneOwnerIds.set(paneProof.paneId, config.tmux_pane_owner_id.trim());
+                    }
+                    catch (error) {
+                        return await rollbackScaleUp(`Failed to tag tmux pane for ${workerName}: ${error instanceof Error ? error.message : String(error)}`, { paneId, worker: workerInfo });
                     }
-                    return await notifyWorkerPaneOutcome(sessionName, workerIndex, message, paneId, workerCli);
-                },
-            });
-            let outcome = queued;
-            if (dispatchPolicy.dispatch_mode === 'hook_preferred_with_fallback' && queued.request_id) {
-                const receipt = await waitForDispatchReceipt(sanitized, queued.request_id, leaderCwd, {
-                    timeoutMs: dispatchPolicy.dispatch_ack_timeout_ms,
-                    pollMs: 50,
-                });
-                if (receipt && (receipt.status === 'notified' || receipt.status === 'delivered')) {
-                    outcome = { ok: true, transport: 'hook', reason: `hook_receipt_${receipt.status}`, request_id: queued.request_id };
                 }
-                else {
-                    const fallback = await notifyWorkerPaneOutcome(sessionName, workerIndex, triggerDirective.text, paneId, workerCli);
-                    if (receipt?.status === 'failed') {
-                        if (fallback.ok) {
-                            await transitionDispatchRequest(sanitized, queued.request_id, 'failed', 'failed', { last_reason: `fallback_confirmed_after_failed_receipt:${fallback.reason}` }, leaderCwd).catch(() => { });
-                            outcome = {
-                                ok: true,
-                                transport: fallback.transport,
-                                reason: `fallback_confirmed_after_failed_receipt:${fallback.reason}`,
-                                request_id: queued.request_id,
-                            };
+                // Intentionally avoid forcing `select-layout tiled` here.
+                // Tiled relayout reflows leader/HUD panes and breaks team window layout.
+                try {
+                    await writeWorkerIdentity(sanitized, workerName, workerInfo, leaderCwd);
+                    throwIfScaleUpFailureInjected(env, 'identity');
+                    // Wait for worker readiness
+                    const readyTimeoutMs = resolveWorkerReadyTimeoutMs(env);
+                    const skipReadyWait = env.OMX_TEAM_SKIP_READY_WAIT === '1';
+                    if (!skipReadyWait) {
+                        const ready = waitForWorkerReady(sessionName, workerIndex, readyTimeoutMs, paneId, workerInfo.pid, config.tmux_pane_owner_id ?? undefined, config.hud_pane_id ?? undefined);
+                        if (!ready) {
+                            console.log(`[omx:scaling] Warning: worker ${workerName} did not become ready within timeout`);
+                        }
+                    }
+                    // Get assigned tasks for this worker
+                    const workerTasks = materializedTasks.filter(t => t.owner === workerName);
+                    const inbox = generateInitialInbox(workerName, sanitized, agentType, workerTasks, {
+                        teamStateRoot,
+                        leaderCwd,
+                        workerRole: runtimeRole,
+                        rolePromptContent: rawRolePromptContent ?? undefined,
+                        worktreeRootAgentsCanonical: Boolean(workerWorkspace?.worktreePath),
+                        approvedContextSection,
+                        workerGoalInstruction: buildTeamWorkerGoalInstruction(sanitized, workerName, workerTasks, { teamStateRoot }),
+                    });
+                    throwIfScaleUpFailureInjected(env, 'inbox');
+                    const triggerDirective = buildTriggerDirective(workerName, sanitized, resolveInstructionStateRoot(workerInfo.worktree_path));
+                    const queued = await queueInboxInstruction({
+                        teamName: sanitized,
+                        workerName,
+                        workerIndex,
+                        paneId,
+                        inbox,
+                        triggerMessage: triggerDirective.text,
+                        intent: triggerDirective.intent,
+                        cwd: leaderCwd,
+                        transportPreference: dispatchPolicy.dispatch_mode,
+                        fallbackAllowed: true,
+                        inboxCorrelationKey: `scale_up:${workerName}`,
+                        notify: async (_target, message) => {
+                            if (dispatchPolicy.dispatch_mode === 'hook_preferred_with_fallback') {
+                                return { ok: true, transport: 'hook', reason: 'queued_for_hook_dispatch' };
+                            }
+                            return await notifyWorkerPaneOutcome(sessionName, workerIndex, message, paneId, workerCli, workerInfo.pid, config.tmux_pane_owner_id ?? undefined, config.hud_pane_id ?? undefined);
+                        },
+                    });
+                    let outcome = queued;
+                    if (dispatchPolicy.dispatch_mode === 'hook_preferred_with_fallback' && queued.request_id) {
+                        const receipt = await waitForDispatchReceipt(sanitized, queued.request_id, leaderCwd, {
+                            timeoutMs: dispatchPolicy.dispatch_ack_timeout_ms,
+                            pollMs: 50,
+                        });
+                        if (receipt && (receipt.status === 'notified' || receipt.status === 'delivered')) {
+                            outcome = { ok: true, transport: 'hook', reason: `hook_receipt_${receipt.status}`, request_id: queued.request_id };
                         }
                         else {
-                            await transitionDispatchRequest(sanitized, queued.request_id, 'failed', 'failed', { last_reason: `fallback_attempted_but_unconfirmed:${fallback.reason}` }, leaderCwd).catch(() => { });
-                            outcome = {
-                                ok: false,
-                                transport: fallback.transport,
-                                reason: `fallback_attempted_but_unconfirmed:${fallback.reason}`,
-                                request_id: queued.request_id,
-                            };
+                            const fallback = await notifyWorkerPaneOutcome(sessionName, workerIndex, triggerDirective.text, paneId, workerCli, workerInfo.pid, config.tmux_pane_owner_id ?? undefined, config.hud_pane_id ?? undefined);
+                            if (receipt?.status === 'failed') {
+                                if (fallback.ok) {
+                                    await transitionDispatchRequest(sanitized, queued.request_id, 'failed', 'failed', { last_reason: `fallback_confirmed_after_failed_receipt:${fallback.reason}` }, leaderCwd).catch(() => { });
+                                    outcome = {
+                                        ok: true,
+                                        transport: fallback.transport,
+                                        reason: `fallback_confirmed_after_failed_receipt:${fallback.reason}`,
+                                        request_id: queued.request_id,
+                                    };
+                                }
+                                else {
+                                    await transitionDispatchRequest(sanitized, queued.request_id, 'failed', 'failed', { last_reason: `fallback_attempted_but_unconfirmed:${fallback.reason}` }, leaderCwd).catch(() => { });
+                                    outcome = {
+                                        ok: false,
+                                        transport: fallback.transport,
+                                        reason: `fallback_attempted_but_unconfirmed:${fallback.reason}`,
+                                        request_id: queued.request_id,
+                                    };
+                                }
+                            }
+                            else if (fallback.ok) {
+                                const marked = await markDispatchRequestNotified(sanitized, queued.request_id, { last_reason: `fallback_confirmed:${fallback.reason}` }, leaderCwd);
+                                if (!marked) {
+                                    await transitionDispatchRequest(sanitized, queued.request_id, 'failed', 'failed', { last_reason: `fallback_confirmed_after_failed_receipt:${fallback.reason}` }, leaderCwd).catch(() => { });
+                                }
+                                outcome = {
+                                    ok: true,
+                                    transport: fallback.transport,
+                                    reason: `hook_timeout_fallback_confirmed:${fallback.reason}`,
+                                    request_id: queued.request_id,
+                                };
+                            }
+                            else {
+                                const current = await readDispatchRequest(sanitized, queued.request_id, leaderCwd);
+                                if (current) {
+                                    await transitionDispatchRequest(sanitized, queued.request_id, current.status, 'failed', { last_reason: `fallback_attempted_but_unconfirmed:${fallback.reason}` }, leaderCwd).catch(() => { });
+                                }
+                                outcome = {
+                                    ok: false,
+                                    transport: fallback.transport,
+                                    reason: `fallback_attempted_but_unconfirmed:${fallback.reason}`,
+                                    request_id: queued.request_id,
+                                };
+                            }
                         }
                     }
-                    else if (fallback.ok) {
-                        const marked = await markDispatchRequestNotified(sanitized, queued.request_id, { last_reason: `fallback_confirmed:${fallback.reason}` }, leaderCwd);
-                        if (!marked) {
-                            await transitionDispatchRequest(sanitized, queued.request_id, 'failed', 'failed', { last_reason: `fallback_confirmed_after_failed_receipt:${fallback.reason}` }, leaderCwd).catch(() => { });
+                    // Retry dispatch once if a trust prompt is blocking the worker pane (fixes #393).
+                    if (!outcome.ok && dismissTrustPromptIfPresent(sessionName, workerIndex, paneId, workerInfo.pid, config.tmux_pane_owner_id ?? undefined, config.hud_pane_id ?? undefined)) {
+                        waitForWorkerReady(sessionName, workerIndex, readyTimeoutMs, paneId, workerInfo.pid, config.tmux_pane_owner_id ?? undefined, config.hud_pane_id ?? undefined);
+                        const retry = await notifyWorkerPaneOutcome(sessionName, workerIndex, triggerDirective.text, paneId, workerCli, workerInfo.pid, config.tmux_pane_owner_id ?? undefined, config.hud_pane_id ?? undefined);
+                        if (retry.ok) {
+                            outcome = retry;
                         }
-                        outcome = {
-                            ok: true,
-                            transport: fallback.transport,
-                            reason: `hook_timeout_fallback_confirmed:${fallback.reason}`,
-                            request_id: queued.request_id,
-                        };
                     }
-                    else {
-                        const current = await readDispatchRequest(sanitized, queued.request_id, leaderCwd);
-                        if (current) {
-                            await transitionDispatchRequest(sanitized, queued.request_id, current.status, 'failed', { last_reason: `fallback_attempted_but_unconfirmed:${fallback.reason}` }, leaderCwd).catch(() => { });
-                        }
-                        outcome = {
-                            ok: false,
-                            transport: fallback.transport,
-                            reason: `fallback_attempted_but_unconfirmed:${fallback.reason}`,
-                            request_id: queued.request_id,
-                        };
+                    if (!outcome.ok) {
+                        return await rollbackScaleUp(`scale_up_dispatch_failed:${workerName}:${outcome.reason}`, {
+                            paneId,
+                            worker: workerInfo,
+                        });
                     }
+                    throwIfScaleUpFailureInjected(env, 'post-dispatch-rollback');
+                    addedWorkers.push(workerInfo);
+                    config.workers.push(workerInfo);
+                    config.worker_count = config.workers.length;
+                    config.next_worker_index = nextIndex;
+                    throwIfScaleUpFailureInjected(env, 'config');
+                    await saveTeamConfig(config, leaderCwd);
+                    throwIfScaleUpFailureInjected(env, 'finalization');
                 }
-            }
-            // Retry dispatch once if a trust prompt is blocking the worker pane (fixes #393).
-            if (!outcome.ok && dismissTrustPromptIfPresent(sessionName, workerIndex, paneId)) {
-                waitForWorkerReady(sessionName, workerIndex, readyTimeoutMs, paneId);
-                const retry = await notifyWorkerPaneOutcome(sessionName, workerIndex, triggerDirective.text, paneId, workerCli);
-                if (retry.ok) {
-                    outcome = retry;
+                catch (error) {
+                    return await rollbackScaleUp(`scale_up_worker_materialization_failed:${workerName}:${error instanceof Error ? error.message : String(error)}`, { paneId, worker: workerInfo });
                 }
             }
-            if (!outcome.ok) {
-                return await rollbackScaleUp(`scale_up_dispatch_failed:${workerName}:${outcome.reason}`, {
-                    paneId,
-                    workerName,
-                    worktreePath: workerWorkspace?.worktreePath,
-                });
+            try {
+                await appendTeamEvent(sanitized, {
+                    type: 'team_leader_nudge',
+                    worker: 'leader-fixed',
+                    reason: `scale_up: added ${count} worker(s), new count=${config.worker_count}`,
+                }, leaderCwd);
+            }
+            catch (error) {
+                return await rollbackScaleUp(`scale_up_finalization_failed:${error instanceof Error ? error.message : String(error)}`);
+            }
+            return {
+                ok: true,
+                addedWorkers,
+                newWorkerCount: config.worker_count,
+                nextWorkerIndex: nextIndex,
+            };
+        });
+    });
+}
+export function isSameOrInsidePath(path, root, pathSemantics = { relative, isAbsolute, sep }) {
+    const relativePath = pathSemantics.relative(root, path);
+    return relativePath === ''
+        || (!pathSemantics.isAbsolute(relativePath)
+            && relativePath !== '..'
+            && !relativePath.startsWith(`..${pathSemantics.sep}`));
+}
+async function assertExistingPathParentContained(path, root) {
+    const canonicalRoot = await realpath(root);
+    let candidate = resolve(path);
+    while (!existsSync(candidate)) {
+        const parent = dirname(candidate);
+        if (parent === candidate)
+            throw new Error(`scale_down_cleanup_debt_path_missing_parent:${path}`);
+        candidate = parent;
+    }
+    const canonicalExistingPath = await realpath(candidate);
+    if (!isSameOrInsidePath(canonicalExistingPath, canonicalRoot)) {
+        throw new Error(`scale_down_cleanup_debt_path_escape:${path}`);
+    }
+}
+async function validateScaleDownCleanupResources(teamName, leaderCwd, teamStateRoot, workers) {
+    const canonicalLeaderCwd = await realpath(leaderCwd);
+    let repoRoot = canonicalLeaderCwd;
+    const repoRootResult = spawnSync('git', ['rev-parse', '--show-toplevel'], {
+        cwd: leaderCwd,
+        encoding: 'utf-8',
+        windowsHide: true,
+    });
+    const reportedRepoRoot = (repoRootResult.stdout || '').trim();
+    if (repoRootResult.status === 0 && reportedRepoRoot) {
+        repoRoot = await realpath(resolve(reportedRepoRoot));
+    }
+    const canonicalTeamStateRoot = await realpath(resolve(teamStateRoot));
+    const expectedWorkerRoot = join(canonicalTeamStateRoot, 'team', teamName, 'workers');
+    for (const worker of workers) {
+        const expectedWorkerDirectory = join(expectedWorkerRoot, worker.name);
+        await assertExistingPathParentContained(expectedWorkerDirectory, canonicalTeamStateRoot);
+        if (worker.team_state_root !== undefined
+            && (!isAbsolute(worker.team_state_root) || worker.team_state_root !== resolve(worker.team_state_root)
+                || resolve(worker.team_state_root) !== canonicalTeamStateRoot)) {
+            throw new Error(`scale_down_cleanup_debt_invalid_team_state_root:${worker.name}`);
+        }
+        if (worker.worktree_path === undefined) {
+            if (worker.worktree_repo_root !== undefined || worker.worktree_branch !== undefined
+                || worker.worktree_detached !== undefined || worker.worktree_created !== undefined) {
+                throw new Error(`scale_down_cleanup_debt_invalid_worktree_metadata:${worker.name}`);
             }
-            addedWorkers.push(workerInfo);
-            config.workers.push(workerInfo);
-            config.worker_count = config.workers.length;
-            config.next_worker_index = nextIndex;
-            await saveTeamConfig(config, leaderCwd);
+            continue;
         }
-        await appendTeamEvent(sanitized, {
-            type: 'team_leader_nudge',
-            worker: 'leader-fixed',
-            reason: `scale_up: added ${count} worker(s), new count=${config.worker_count}`,
-        }, leaderCwd);
-        return {
-            ok: true,
-            addedWorkers,
-            newWorkerCount: config.worker_count,
-            nextWorkerIndex: nextIndex,
-        };
+        const expectedWorktreePath = join(repoRoot, '.omx', 'team', teamName, 'worktrees', worker.name);
+        if (!isAbsolute(worker.worktree_path) || worker.worktree_path !== resolve(worker.worktree_path)
+            || resolve(worker.worktree_path) !== expectedWorktreePath
+            || (worker.worktree_repo_root !== undefined && (!isAbsolute(worker.worktree_repo_root)
+                || worker.worktree_repo_root !== resolve(worker.worktree_repo_root)
+                || resolve(worker.worktree_repo_root) !== repoRoot))
+            || (worker.worktree_detached !== undefined && typeof worker.worktree_detached !== 'boolean')
+            || (worker.worktree_created !== undefined && typeof worker.worktree_created !== 'boolean')
+            || (worker.worktree_created === true && (typeof worker.worktree_repo_root !== 'string' || typeof worker.worktree_detached !== 'boolean'))) {
+            throw new Error(`scale_down_cleanup_debt_invalid_worktree_target:${worker.name}`);
+        }
+        await assertExistingPathParentContained(expectedWorktreePath, repoRoot);
+        if (existsSync(expectedWorktreePath) && await realpath(expectedWorktreePath) !== expectedWorktreePath) {
+            throw new Error(`scale_down_cleanup_debt_worktree_symlink:${worker.name}`);
+        }
+    }
+}
+async function cleanupScaleDownResources(teamName, teamStateRoot, workers) {
+    for (const worker of workers) {
+        // An absent exact worktree means a prior cleanup completed before crashing.
+        // Do not replay a restoration or git removal against a replacement path.
+        if (worker.worktree_path && existsSync(worker.worktree_path)) {
+            await removeWorkerWorktreeRootAgentsFile(teamName, worker.name, worker.team_state_root ?? teamStateRoot, worker.worktree_path);
+        }
+    }
+    const worktrees = workers
+        .filter((worker) => worker.worktree_created === true
+        && typeof worker.worktree_path === 'string'
+        && existsSync(worker.worktree_path)
+        && typeof worker.worktree_repo_root === 'string'
+        && typeof worker.worktree_detached === 'boolean')
+        .map((worker) => ({
+        enabled: true,
+        repoRoot: worker.worktree_repo_root,
+        worktreePath: worker.worktree_path,
+        detached: worker.worktree_detached,
+        branchName: worker.worktree_branch ?? null,
+        created: true,
+        reused: false,
+        // Membership records do not establish branch ownership. Preserve a named
+        // branch rather than deleting one that may have predated this worker.
+        createdBranch: false,
+    }));
+    if (worktrees.length > 0)
+        await rollbackProvisionedWorktrees(worktrees);
+    await Promise.all(workers.map(async (worker) => {
+        await rm(join(teamStateRoot, 'team', teamName, 'workers', worker.name), { recursive: true, force: true });
+    }));
+}
+function asScaleDownDebtResources(debt, removedWorkerNames) {
+    const resources = debt.resource_workers;
+    if (!Array.isArray(resources) || resources.length !== removedWorkerNames.length)
+        return null;
+    const expected = new Set(removedWorkerNames);
+    const seen = new Set();
+    for (const worker of resources) {
+        if (!worker || typeof worker.name !== 'string' || !expected.has(worker.name) || seen.has(worker.name)
+            || (worker.worktree_path !== undefined && typeof worker.worktree_path !== 'string')
+            || (worker.worktree_repo_root !== undefined && typeof worker.worktree_repo_root !== 'string')
+            || (worker.worktree_branch !== undefined && typeof worker.worktree_branch !== 'string')
+            || (worker.worktree_detached !== undefined && typeof worker.worktree_detached !== 'boolean')
+            || (worker.worktree_created !== undefined && typeof worker.worktree_created !== 'boolean')
+            || (worker.team_state_root !== undefined && typeof worker.team_state_root !== 'string'))
+            return null;
+        seen.add(worker.name);
+    }
+    return resources;
+}
+function asScaleDownDebtPanes(debt, removedWorkerNames, resources, leaderPaneId, hudPaneId) {
+    const workers = debt.workers;
+    const unresolved = debt.unresolved_panes;
+    if (!Array.isArray(workers) || (unresolved !== undefined && !Array.isArray(unresolved)))
+        return null;
+    const expectedNames = new Set(removedWorkerNames);
+    const resourceNames = new Set(resources.map((resource) => resource.name));
+    const canonicalByName = new Map();
+    const allPaneIds = new Set();
+    const normalizedLeaderPaneId = typeof leaderPaneId === 'string' ? leaderPaneId.trim() : '';
+    const normalizedHudPaneId = typeof hudPaneId === 'string' ? hudPaneId.trim() : '';
+    const validate = (pane, requireCanonicalMatch) => {
+        if (!pane || typeof pane.name !== 'string' || !expectedNames.has(pane.name) || !resourceNames.has(pane.name)
+            || typeof pane.index !== 'number' || !Number.isInteger(pane.index) || pane.index <= 0
+            || pane.index !== Number(pane.name.slice('worker-'.length))
+            || typeof pane.pane_id !== 'string' || !/^%\d+$/.test(pane.pane_id)
+            || pane.pane_id === normalizedLeaderPaneId || pane.pane_id === normalizedHudPaneId
+            || (pane.pid !== null && (!Number.isSafeInteger(pane.pid) || pane.pid <= 0)))
+            return false;
+        const canonical = canonicalByName.get(pane.name);
+        if (requireCanonicalMatch) {
+            return canonical !== undefined
+                && canonical.index === pane.index
+                && canonical.pane_id === pane.pane_id
+                && canonical.pid === pane.pid;
+        }
+        if (canonical !== undefined || allPaneIds.has(pane.pane_id))
+            return false;
+        canonicalByName.set(pane.name, pane);
+        allPaneIds.add(pane.pane_id);
+        return true;
+    };
+    for (const worker of workers) {
+        if (!validate(worker, false))
+            return null;
+    }
+    const unresolvedNames = new Set();
+    const unresolvedPaneIds = new Set();
+    for (const pane of unresolved ?? []) {
+        if (unresolvedNames.has(pane.name ?? '') || unresolvedPaneIds.has(pane.pane_id)
+            || !validate(pane, true))
+            return null;
+        unresolvedNames.add(pane.name);
+        unresolvedPaneIds.add(pane.pane_id);
+    }
+    return unresolved && unresolved.length > 0 ? unresolved : workers;
+}
+async function hasMatchingScaleDownDebtWorkerIdentity(teamStateRoot, teamName, pane) {
+    try {
+        const identity = JSON.parse(await readFile(join(teamStateRoot, 'team', teamName, 'workers', pane.name ?? '', 'identity.json'), 'utf8'));
+        return identity.name === pane.name
+            && identity.index === pane.index
+            && identity.pane_id === pane.pane_id
+            && identity.pid === pane.pid;
+    }
+    catch {
+        return false;
+    }
+}
+export async function reconcileScaleDownCleanupDebt(teamName, cwd, _callerConfig) {
+    const sanitized = sanitizeTeamName(teamName);
+    const leaderCwd = resolve(cwd);
+    return await withTaskMembershipBarrier(sanitized, leaderCwd, async () => {
+        await recoverTeamMembershipTaskTransaction(sanitized, leaderCwd);
+        // Authorization is derived only from the canonical state observed under the
+        // membership barrier; callers may hold a stale pre-transaction config.
+        const config = await readTeamConfig(sanitized, leaderCwd);
+        if (!config)
+            return { ok: false, error: `Team ${sanitized} not found` };
+        const teamStateRoot = config.team_state_root ?? resolveCanonicalTeamStateRoot(leaderCwd);
+        const cleanupDebtPath = join(teamStateRoot, 'team', sanitized, '.scale-down-cleanup-debt.json');
+        if (!existsSync(cleanupDebtPath))
+            return { ok: true };
+        let debt;
+        try {
+            debt = JSON.parse(await readFile(cleanupDebtPath, 'utf8'));
+        }
+        catch (error) {
+            return { ok: false, error: `scale_down_cleanup_debt_unreadable:${String(error)}` };
+        }
+        if (debt.schema_version !== 1 || debt.operation !== 'scale_down') {
+            return { ok: false, error: 'scale_down_cleanup_debt_malformed' };
+        }
+        const removedWorkerNames = Array.isArray(debt.removed_worker_names)
+            ? debt.removed_worker_names
+            : (Array.isArray(debt.workers) ? debt.workers.map((worker) => worker?.name).filter((name) => typeof name === 'string') : []);
+        if (removedWorkerNames.length === 0
+            || removedWorkerNames.some((name) => !/^worker-\d+$/.test(name))
+            || new Set(removedWorkerNames).size !== removedWorkerNames.length) {
+            return { ok: false, error: 'scale_down_cleanup_debt_malformed' };
+        }
+        const resources = asScaleDownDebtResources(debt, removedWorkerNames);
+        if (!resources)
+            return { ok: false, error: 'scale_down_cleanup_debt_malformed' };
+        try {
+            await validateScaleDownCleanupResources(sanitized, leaderCwd, teamStateRoot, resources);
+        }
+        catch {
+            return { ok: false, error: 'scale_down_cleanup_debt_malformed' };
+        }
+        const panes = asScaleDownDebtPanes(debt, removedWorkerNames, resources, config.leader_pane_id, config.hud_pane_id);
+        // Validate all journal bindings before classifying or mutating recovery state.
+        // A journal is evidence, never authority to target an arbitrary global pane.
+        if (!panes)
+            return { ok: false, error: 'scale_down_cleanup_debt_malformed' };
+        const stillCanonical = removedWorkerNames.filter((name) => config.workers.some((worker) => worker.name === name));
+        // A pre-commit journal is not authorization to kill or remove anything.
+        if (stillCanonical.length === removedWorkerNames.length) {
+            await removeDurableFile(cleanupDebtPath);
+            return { ok: true };
+        }
+        if (stillCanonical.length > 0)
+            return { ok: false, error: 'scale_down_cleanup_debt_membership_inconsistent' };
+        // A cleanup journal may never reuse a pane identity held by a worker that
+        // survived the committed membership update. This is checked before any
+        // liveness or owner probes so malformed debt cannot cause a tmux effect.
+        const survivingWorkers = config.workers.filter((worker) => !removedWorkerNames.includes(worker.name));
+        if (panes.some((pane) => survivingWorkers.some((worker) => (worker.pane_id === pane.pane_id
+            || (pane.pid !== null && worker.pid === pane.pid))))) {
+            return { ok: false, error: 'scale_down_cleanup_debt_malformed' };
+        }
+        const resolvedPaneIds = new Set();
+        const reasons = [];
+        const expectedOwnerId = typeof config.tmux_pane_owner_id === 'string'
+            ? config.tmux_pane_owner_id.trim()
+            : '';
+        for (const pane of panes) {
+            // Legacy PID-less records can establish convergence from an authoritative
+            // global absence/dead proof, but can never authorize a live-pane effect.
+            const freshProof = readExactPaneProofSync(pane.pane_id);
+            if (freshProof.status === 'gone') {
+                resolvedPaneIds.add(pane.pane_id);
+                continue;
+            }
+            if (freshProof.status === 'unavailable') {
+                reasons.push(`${pane.pane_id}:${freshProof.reason}`);
+                continue;
+            }
+            if (pane.pid === null) {
+                reasons.push(`${pane.pane_id}:legacy_pid_missing_live`);
+                continue;
+            }
+            if (freshProof.pid !== pane.pid) {
+                reasons.push(`${pane.pane_id}:pane_pid_changed`);
+                continue;
+            }
+            // A live debt pane must remain bound to the removed worker's recorded
+            // identity; the team-wide owner token alone only proves team membership.
+            if (!await hasMatchingScaleDownDebtWorkerIdentity(teamStateRoot, sanitized, pane)) {
+                reasons.push(`${pane.pane_id}:worker_identity_unavailable`);
+                continue;
+            }
+            // Owner reads are authoritative only for this canonical Team token. Missing,
+            // mismatched, and unavailable tags all fail closed for a live pane effect.
+            if (!expectedOwnerId) {
+                reasons.push(`${pane.pane_id}:team_owner_unavailable`);
+                continue;
+            }
+            const owner = readPaneTeamOwnerTagResult(pane.pane_id);
+            if (owner.status === 'error') {
+                reasons.push(`${pane.pane_id}:team_owner_unavailable`);
+                continue;
+            }
+            if (owner.status !== 'value' || owner.value !== expectedOwnerId) {
+                reasons.push(`${pane.pane_id}:team_owner_mismatch`);
+                continue;
+            }
+            // teardownWorkerPanes re-proves this exact pane immediately before the kill
+            // and pins the same durable PID through the kill confirmation.
+            const teardown = await teardownWorkerPanes([pane.pane_id], {
+                leaderPaneId: config.leader_pane_id,
+                hudPaneId: config.hud_pane_id,
+                expectedPanePids: { [pane.pane_id]: pane.pid },
+                authorizePaneKill: (paneId) => {
+                    const currentOwner = readPaneTeamOwnerTagResult(paneId);
+                    return currentOwner.status === 'value' && currentOwner.value === expectedOwnerId;
+                },
+            });
+            if (teardown.provenGonePaneIds.includes(pane.pane_id) || teardown.killedPaneIds.includes(pane.pane_id)) {
+                resolvedPaneIds.add(pane.pane_id);
+                continue;
+            }
+            reasons.push(...teardown.proofUnavailable.map((proof) => `${proof.paneId}:${proof.reason}`));
+            reasons.push(...teardown.kill.failedPaneIds.map((paneId) => `${paneId}:kill_failed`));
+            if (teardown.proofUnavailable.length === 0 && teardown.kill.failedPaneIds.length === 0) {
+                reasons.push(`${pane.pane_id}:teardown_unresolved`);
+            }
+        }
+        const unresolvedPanes = panes.filter((pane) => !resolvedPaneIds.has(pane.pane_id));
+        if (unresolvedPanes.length > 0) {
+            await writeAtomic(cleanupDebtPath, JSON.stringify({
+                ...debt,
+                status: 'unresolved',
+                updated_at: new Date().toISOString(),
+                unresolved_panes: unresolvedPanes,
+                reasons,
+            }, null, 2));
+            return { ok: false, error: `scale_down_cleanup_debt_unresolved:${unresolvedPanes.map((pane) => pane.pane_id).join(',')}` };
+        }
+        try {
+            await cleanupScaleDownResources(sanitized, teamStateRoot, resources);
+        }
+        catch (error) {
+            await writeAtomic(cleanupDebtPath, JSON.stringify({
+                ...debt,
+                status: 'resource_cleanup_pending',
+                updated_at: new Date().toISOString(),
+                unresolved_panes: [],
+                reasons: [`resource_cleanup_failed:${String(error)}`],
+            }, null, 2));
+            return { ok: false, error: `scale_down_cleanup_debt_resource_cleanup_failed:${String(error)}` };
+        }
+        await removeDurableFile(cleanupDebtPath);
+        return { ok: true };
     });
 }
 /**
@@ -542,10 +1384,17 @@ export async function scaleDown(teamName, cwd, options = {}, env = process.env)
     const force = options.force === true;
     const drainTimeoutMs = options.drainTimeoutMs ?? 30_000;
     return await withScalingLock(sanitized, leaderCwd, async () => {
-        const config = await readTeamConfig(sanitized, leaderCwd);
+        const config = await withTaskMembershipBarrier(sanitized, leaderCwd, async () => {
+            await recoverTeamMembershipTaskTransaction(sanitized, leaderCwd);
+            return await readTeamConfig(sanitized, leaderCwd);
+        });
         if (!config) {
             return { ok: false, error: `Team ${sanitized} not found` };
         }
+        let teamStateRoot = config.team_state_root ?? resolveCanonicalTeamStateRoot(leaderCwd);
+        const priorCleanup = await reconcileScaleDownCleanupDebt(sanitized, leaderCwd, config);
+        if (!priorCleanup.ok)
+            return priorCleanup;
         // Determine which workers to remove
         let targetWorkers;
         if (options.workerNames && options.workerNames.length > 0) {
@@ -595,6 +1444,33 @@ export async function scaleDown(teamName, cwd, options = {}, env = process.env)
         }
         const sessionName = config.tmux_session;
         const removedNames = [];
+        const priorWorkerStatusArtifacts = new Map();
+        for (const worker of targetWorkers) {
+            const statusPath = join(teamStateRoot, 'team', sanitized, 'workers', worker.name, 'status.json');
+            try {
+                priorWorkerStatusArtifacts.set(worker.name, { exists: true, raw: await readFile(statusPath) });
+            }
+            catch (error) {
+                if (error.code === 'ENOENT') {
+                    priorWorkerStatusArtifacts.set(worker.name, { exists: false });
+                }
+                else {
+                    throw error;
+                }
+            }
+        }
+        const restorePriorWorkerStatuses = async (workers) => {
+            await Promise.all(workers.map(async (worker) => {
+                const statusPath = join(teamStateRoot, 'team', sanitized, 'workers', worker.name, 'status.json');
+                const priorArtifact = priorWorkerStatusArtifacts.get(worker.name);
+                if (priorArtifact?.exists) {
+                    await writeFile(statusPath, priorArtifact.raw);
+                }
+                else {
+                    await rm(statusPath, { force: true });
+                }
+            }));
+        };
         // Phase 1: Set workers to 'draining' status
         for (const w of targetWorkers) {
             const drainingStatus = {
@@ -611,69 +1487,239 @@ export async function scaleDown(teamName, cwd, options = {}, env = process.env)
                 const allDrained = await Promise.all(targetWorkers.map(async (w) => {
                     const status = await readWorkerStatus(sanitized, w.name, leaderCwd);
                     return status.state === 'idle' || status.state === 'done' ||
-                        status.state === 'draining' || !isWorkerAlive(sessionName, w.index, w.pane_id);
+                        status.state === 'draining' || !isWorkerAlive(sessionName, w.index, w.pane_id, w.pid, config.tmux_pane_owner_id ?? undefined, config.hud_pane_id ?? undefined);
                 }));
                 if (allDrained.every(Boolean))
                     break;
                 await new Promise(r => setTimeout(r, 2_000));
             }
         }
-        // Phase 3: Kill tmux panes and remove from config
-        const leaderPaneId = config.leader_pane_id;
-        const hudPaneId = config.hud_pane_id;
-        const targetPaneIds = targetWorkers
-            .map((w) => w.pane_id)
-            .filter((paneId) => typeof paneId === 'string' && paneId.trim().length > 0);
-        await teardownWorkerPanes(targetPaneIds, {
-            leaderPaneId,
-            hudPaneId,
-        });
-        const detachedWorktreesToRollback = targetWorkers
-            .filter((worker) => worker.worktree_created === true
-            && worker.worktree_detached === true
-            && typeof worker.worktree_repo_root === 'string'
-            && worker.worktree_repo_root.length > 0
-            && typeof worker.worktree_path === 'string'
-            && worker.worktree_path.length > 0)
-            .map((worker) => ({
-            enabled: true,
-            repoRoot: worker.worktree_repo_root,
-            worktreePath: resolve(worker.worktree_path),
-            detached: true,
-            branchName: null,
-            created: true,
-            reused: false,
-            createdBranch: false,
-        }));
-        if (detachedWorktreesToRollback.length > 0) {
-            try {
-                await rollbackProvisionedWorktrees(detachedWorktreesToRollback);
-            }
-            catch (error) {
-                return { ok: false, error: `scale_down_worktree_cleanup_failed:${String(error)}` };
-            }
+        // Phase 3: acquire the membership barrier and task claim locks before any
+        // pane effect. The barrier and locks remain held through the canonical
+        // snapshot, exact pane teardown, and forward-recoverable commit.
+        let removableWorkers = targetWorkers;
+        let removableWorkerNames = new Set(removableWorkers.map((worker) => worker.name));
+        let teardownFailure = null;
+        try {
+            await withTaskMembershipBarrier(sanitized, leaderCwd, async () => {
+                await recoverTeamMembershipTaskTransaction(sanitized, leaderCwd);
+                const authoritativeConfig = await readTeamConfig(sanitized, leaderCwd);
+                if (!authoritativeConfig)
+                    throw new Error('canonical_scale_down_config_missing');
+                const authoritativeWorkers = removableWorkers.map((worker) => authoritativeConfig.workers.find((candidate) => candidate.name === worker.name));
+                if (authoritativeWorkers.some((worker) => !worker)) {
+                    throw new Error('canonical_scale_down_membership_changed');
+                }
+                // Capture targets from the canonical generation while the membership
+                // authority is held; no caller-owned worker record authorizes a pane effect.
+                removableWorkers = authoritativeWorkers;
+                removableWorkerNames = new Set(removableWorkers.map((worker) => worker.name));
+                teamStateRoot = authoritativeConfig.team_state_root ?? resolveCanonicalTeamStateRoot(leaderCwd);
+                Object.assign(config, authoritativeConfig);
+                const candidateTaskIds = (await listTasks(sanitized, leaderCwd))
+                    .filter((task) => task.status !== 'completed' && task.status !== 'failed')
+                    .map((task) => task.id);
+                await withTaskClaimLocks(sanitized, candidateTaskIds, leaderCwd, async () => {
+                    const lockedTasks = await listTasks(sanitized, leaderCwd);
+                    const configPath = join(teamStateRoot, 'team', sanitized, 'config.json');
+                    const configSnapshot = await readFile(configPath);
+                    const manifestPath = join(teamStateRoot, 'team', sanitized, 'manifest.v2.json');
+                    const manifestSnapshot = existsSync(manifestPath) ? await readFile(manifestPath) : null;
+                    const reconciledTasks = lockedTasks.filter((task) => task.status !== 'completed' && task.status !== 'failed'
+                        && (removableWorkerNames.has(task.owner ?? '') || removableWorkerNames.has(task.claim?.owner ?? '')));
+                    const taskSnapshots = new Map();
+                    for (const task of reconciledTasks) {
+                        taskSnapshots.set(task.id, await readFile(join(teamStateRoot, 'team', sanitized, 'tasks', `task-${task.id}.json`)));
+                    }
+                    const postSnapshotMarker = env.OMX_TEAM_SCALE_DOWN_POST_SNAPSHOT_MARKER;
+                    if (postSnapshotMarker)
+                        await writeFile(postSnapshotMarker, 'snapshot-held\n');
+                    const boundaryHoldMs = Number.parseInt(env.OMX_TEAM_SCALE_DOWN_BOUNDARY_HOLD_MS ?? '', 10);
+                    if (Number.isFinite(boundaryHoldMs) && boundaryHoldMs > 0)
+                        await new Promise((resolve) => setTimeout(resolve, boundaryHoldMs));
+                    const currentConfig = JSON.parse(configSnapshot.toString('utf8'));
+                    const nextConfig = {
+                        ...currentConfig,
+                        workers: currentConfig.workers.filter((worker) => !removableWorkerNames.has(worker.name)),
+                    };
+                    nextConfig.worker_count = nextConfig.workers.length;
+                    const nextManifest = manifestSnapshot
+                        ? JSON.stringify({
+                            ...JSON.parse(manifestSnapshot.toString('utf8')),
+                            workers: nextConfig.workers,
+                            worker_count: nextConfig.worker_count,
+                        }, null, 2)
+                        : null;
+                    const membershipTransaction = {
+                        baseGeneration: currentConfig.config_generation ?? 0,
+                        tasks: reconciledTasks.map((task) => ({
+                            taskId: task.id,
+                            oldBytes: taskSnapshots.get(task.id)?.toString('utf8') ?? null,
+                            newBytes: JSON.stringify({
+                                ...task,
+                                owner: undefined,
+                                claim: undefined,
+                                status: task.status === 'in_progress' ? 'pending' : task.status,
+                                version: Math.max(1, task.version ?? 1) + 1,
+                            }, null, 2),
+                        })),
+                        config: {
+                            oldBytes: configSnapshot.toString('utf8'),
+                            newBytes: JSON.stringify(nextConfig, null, 2),
+                        },
+                        manifest: {
+                            oldBytes: manifestSnapshot?.toString('utf8') ?? null,
+                            newBytes: nextManifest,
+                        },
+                        interruptAfterFirstTaskWrite: env.OMX_TEAM_SCALE_DOWN_INJECT_FAILURE === 'after-first-task-write',
+                        failRollbackPersistence: env.OMX_TEAM_SCALE_DOWN_INJECT_FAILURE === 'rollback-persistence-failure',
+                        recoverToNewOnFailure: true,
+                    };
+                    const cleanupDebtPath = join(teamStateRoot, 'team', sanitized, '.scale-down-cleanup-debt.json');
+                    const cleanupDebtBase = {
+                        schema_version: 1,
+                        operation: 'scale_down',
+                        status: 'pending_teardown',
+                        created_at: new Date().toISOString(),
+                        removed_worker_names: removableWorkers.map((worker) => worker.name),
+                        workers: removableWorkers
+                            .filter((worker) => (typeof worker.pane_id === 'string' && /^%\d+$/.test(worker.pane_id)))
+                            .map((worker) => ({
+                            name: worker.name,
+                            index: worker.index,
+                            pane_id: worker.pane_id,
+                            pid: worker.pid ?? null,
+                        })),
+                        resource_workers: removableWorkers.map((worker) => ({
+                            name: worker.name,
+                            worktree_path: worker.worktree_path,
+                            worktree_repo_root: worker.worktree_repo_root,
+                            worktree_branch: worker.worktree_branch,
+                            worktree_detached: worker.worktree_detached,
+                            worktree_created: worker.worktree_created,
+                            team_state_root: worker.team_state_root,
+                        })),
+                    };
+                    await writeAtomic(cleanupDebtPath, JSON.stringify(cleanupDebtBase, null, 2));
+                    await commitTeamMembershipTaskTransaction(sanitized, leaderCwd, membershipTransaction);
+                    const committed = await readTeamConfig(sanitized, leaderCwd);
+                    if (!committed || committed.workers.some((worker) => removableWorkerNames.has(worker.name))) {
+                        throw new Error('canonical_scale_down_config_verification_failed');
+                    }
+                    config.workers = committed.workers;
+                    config.worker_count = committed.worker_count;
+                    for (const task of reconciledTasks) {
+                        const reconciled = await readTask(sanitized, task.id, leaderCwd);
+                        if (reconciled && (removableWorkerNames.has(reconciled.owner ?? '') || removableWorkerNames.has(reconciled.claim?.owner ?? ''))) {
+                            throw new Error(`canonical_scale_down_task_verification_failed:${task.id}`);
+                        }
+                    }
+                    // PID-less rollback records are cleanup debt, not effect authority. A
+                    // fresh gone proof may resolve one, but a live or unavailable proof
+                    // must remain debt rather than letting teardown adopt its current PID.
+                    const pinnedPaneWorkers = removableWorkers.filter((worker) => (typeof worker.pane_id === 'string'
+                        && /^%\d+$/.test(worker.pane_id)
+                        && typeof worker.pid === 'number'
+                        && Number.isSafeInteger(worker.pid)
+                        && worker.pid > 0));
+                    const unpinnedPaneWorkers = removableWorkers.filter((worker) => (typeof worker.pane_id === 'string'
+                        && /^%\d+$/.test(worker.pane_id)
+                        && !pinnedPaneWorkers.some((pinnedWorker) => pinnedWorker.name === worker.name)));
+                    const unpinnedResolvedPaneIds = new Set();
+                    const unpinnedProofDebt = [];
+                    for (const worker of unpinnedPaneWorkers) {
+                        const proof = readExactPaneProofSync(worker.pane_id);
+                        if (proof.status === 'gone') {
+                            unpinnedResolvedPaneIds.add(worker.pane_id);
+                        }
+                        else if (proof.status === 'unavailable') {
+                            unpinnedProofDebt.push(`${worker.pane_id}:${proof.reason}`);
+                        }
+                        else {
+                            unpinnedProofDebt.push(`${worker.pane_id}:legacy_pid_missing_live`);
+                        }
+                    }
+                    const targetPaneIds = pinnedPaneWorkers.map((worker) => worker.pane_id);
+                    const expectedScaleDownOwnerId = typeof config.tmux_pane_owner_id === 'string'
+                        ? config.tmux_pane_owner_id.trim()
+                        : '';
+                    const paneTeardown = await teardownWorkerPanes(targetPaneIds, {
+                        leaderPaneId: config.leader_pane_id,
+                        hudPaneId: config.hud_pane_id,
+                        expectedPanePids: Object.fromEntries(pinnedPaneWorkers.map((worker) => [worker.pane_id, worker.pid])),
+                        authorizePaneKill: (paneId) => {
+                            const currentOwner = readPaneTeamOwnerTagResult(paneId);
+                            return Boolean(expectedScaleDownOwnerId)
+                                && currentOwner.status === 'value'
+                                && currentOwner.value === expectedScaleDownOwnerId;
+                        },
+                    });
+                    const resolvedPaneIds = new Set([
+                        ...unpinnedResolvedPaneIds,
+                        ...paneTeardown.provenGonePaneIds,
+                        ...paneTeardown.killedPaneIds,
+                    ]);
+                    const unresolvedWorkers = removableWorkers.filter((worker) => (typeof worker.pane_id === 'string' && !resolvedPaneIds.has(worker.pane_id)));
+                    if (unresolvedWorkers.length > 0) {
+                        await restorePriorWorkerStatuses(unresolvedWorkers);
+                        const proofDebt = [...unpinnedProofDebt, ...paneTeardown.proofUnavailable.map((proof) => `${proof.paneId}:${proof.reason}`)];
+                        const killDebt = paneTeardown.kill.failedPaneIds.map((paneId) => `${paneId}:kill_failed`);
+                        await writeAtomic(cleanupDebtPath, JSON.stringify({
+                            ...cleanupDebtBase,
+                            status: 'unresolved',
+                            updated_at: new Date().toISOString(),
+                            unresolved_panes: unresolvedWorkers.map((worker) => ({
+                                name: worker.name,
+                                index: worker.index,
+                                pane_id: worker.pane_id,
+                                pid: worker.pid ?? null,
+                            })),
+                            reasons: [...proofDebt, ...killDebt],
+                        }, null, 2));
+                        if (paneTeardown.proofUnavailable.length > 0) {
+                            teardownFailure = { ok: false, error: `scale_down_pane_proof_unavailable:${proofDebt.join(',')}` };
+                            return;
+                        }
+                        const unresolvedDebt = unresolvedWorkers
+                            .map((worker) => `pane_teardown_unresolved:${worker.pane_id}`)
+                            .join(';');
+                        const failedDebt = paneTeardown.kill.failedPaneIds.length > 0
+                            ? `pane_teardown_failed:${paneTeardown.kill.failedPaneIds.join(',')};`
+                            : '';
+                        teardownFailure = { ok: false, error: `scale_down_cleanup_debt:${failedDebt}${unresolvedDebt}` };
+                        return;
+                    }
+                    await writeAtomic(cleanupDebtPath, JSON.stringify({
+                        ...cleanupDebtBase,
+                        status: 'resource_cleanup_pending',
+                        updated_at: new Date().toISOString(),
+                        unresolved_panes: [],
+                    }, null, 2));
+                });
+            });
         }
-        for (const w of targetWorkers) {
-            if (w.worktree_path) {
-                await removeWorkerWorktreeRootAgentsFile(sanitized, w.name, w.team_state_root ?? config.team_state_root ?? resolveCanonicalTeamStateRoot(leaderCwd), w.worktree_path).catch(() => { });
-            }
-            removedNames.push(w.name);
+        catch (error) {
+            await restorePriorWorkerStatuses(removableWorkers);
+            return { ok: false, error: `scale_down_task_reconciliation_failed:${String(error)}` };
         }
-        // Phase 4: Update config
-        const removedSet = new Set(removedNames);
-        config.workers = config.workers.filter(w => !removedSet.has(w.name));
-        config.worker_count = config.workers.length;
-        await saveTeamConfig(config, leaderCwd);
-        await appendTeamEvent(sanitized, {
-            type: 'team_leader_nudge',
-            worker: 'leader-fixed',
-            reason: `scale_down: removed ${removedNames.length} worker(s) [${removedNames.join(', ')}], new count=${config.worker_count}`,
-        }, leaderCwd);
-        return {
-            ok: true,
-            removedWorkers: removedNames,
-            newWorkerCount: config.worker_count,
-        };
+        if (teardownFailure)
+            return teardownFailure;
+        targetWorkers = removableWorkers;
+        // Resource cleanup remains represented by the committed debt until every
+        // worker directory, status, generated AGENTS file, and provisioned worktree
+        // has converged. Reconciliation reacquires authority before consuming it.
+        removedNames.push(...targetWorkers.map((worker) => worker.name));
+        const resourceCleanup = await reconcileScaleDownCleanupDebt(sanitized, leaderCwd, config);
+        if (!resourceCleanup.ok)
+            return resourceCleanup;
+        const reason = `scale_down: removed ${removedNames.length} worker(s) [${removedNames.join(', ')}], new count=${config.worker_count}`;
+        try {
+            await appendTeamEvent(sanitized, { type: 'team_leader_nudge', worker: 'leader-fixed', reason }, leaderCwd);
+        }
+        catch {
+            // The cleanup transaction has already converged; event delivery is advisory.
+        }
+        return { ok: true, removedWorkers: removedNames, newWorkerCount: config.worker_count };
     });
 }
 // ── Helpers ───────────────────────────────────────────────────────────────────