feat(agent-org): add authoritative team lifecycle

[ShiboSheng]

Problem

Replaces #824.

Fixes #756.

Agent Org did not have one authoritative, restart-safe lifecycle boundary for a long-lived Team. Initial materialization, quiescence, Run View reads, watchdog recovery, and frontend polling could not yet guarantee that a Team moves safely through Starting -> Running/Idle/Failed, becomes free of active Provider work in Idle or Failed, and can later be extended without introducing another state owner.

Idle is a durable Team state, not a requirement to destroy reusable in-memory Session state after every Turn. The intended boundary is the same as a normal Rust-native SDE Session: a completed Turn stops all active Provider requests, streams, commands, and Turn-owned background work, while a compatible runtime may remain warm for the shared approximately one-hour Session idle-eviction window and be reused by the next Turn.

Solution

This branch starts from origin/develop at 641c43c8a37edfb89fb5b07d61bad7083c3bca18 and contains one adapted commit only.

• Add durable Starting materialization receipts and authoritative lifecycle transitions.
• Centralize quiescence so a Team enters Idle only from committed facts.
• Keep Run View pure-read.
• Use one bounded watchdog and shared frontend polling ownership, stopping polling while hidden or otherwise non-pollable.
• Keep the redesign behind one fail-closed rollout gate.
• Preserve the shared SDE runtime policy: terminal/finality ends active work but does not release a compatible runtime per Turn; the next Turn can reuse it, and the existing shared Session idle eviction, App restart, configuration mismatch, or explicit teardown removes it.

The resulting PR1 boundary does not add Pause/Resume, Archive/Delete, the Task FSM rewrite, Writer settings, UserDirectedWork, or Group-send behavior. It also does not add an Agent Org-specific per-Member cleanup timer. Failed Teams do not start a runtime; later Pause work releases only the formal runtimes captured by that pause episode, while Archive/Delete owns whole-Team runtime teardown.

Potential risks

• The redesign remains disabled by default and fail-closed. Existing rollout behavior must not be inferred to expose the new lifecycle to normal users yet.
• Lifecycle recovery spans persistence, Session state, watchdog work, and frontend polling. Focused and full automated suites pass, but the required packaged Idle performance path remains unverified on this rebuilt stack.
• Warm runtimes consume memory even though they perform no active work. Verification must separate active Provider work from warm-runtime count, measure reuse and RSS across multiple Teams/Members, and prove eventual shared idle eviction plus explicit Archive teardown. The approximately one-hour window is a shared cleanup behavior, not an exact 60-minute guarantee measured from Turn completion.
• The packaged test used the debug E2E fake provider. That provider can return text but cannot call the coordinator-only org_run_complete tool, so the run correctly retained completion_requested=0 and remained running under the fail-closed empty-task-board rule. This result does not establish a production lifecycle convergence defect.
• A future verification-only change should add an opt-in tool-capable fake-provider completion scenario, or rerun the scenario with a real tool-capable provider. That test work is intentionally deferred; no production-code change is currently indicated by this observation.

Architecture and performance audit

Reviewed compilation, structure, lifecycle semantics, fail-closed branches, persistence ownership, naming, wire compatibility, initialization parity, and launch/run-view resolver symmetry. The selected change keeps one bounded global watchdog, bounded recovery budgets, shared polling ownership, and the existing bounded Session idle-eviction owner; it introduces no per-component polling owner, per-Member timer, or unbounded cache.

The resource contract distinguishes active work from retained warm state. Idle must have no active Provider request/stream, Agent Org-owned process, Wake, poll, or background I/O. A compatible warm runtime is allowed only as passive reusable in-memory state and remains subject to shared eviction and later whole-Team teardown.

Performance verdict for this rebuilt tip is blocked, not failed: the packaged fixture did not reach a valid Idle precondition, so foreground/hidden Idle, warm reuse, memory, and eviction measurements cannot yet be claimed.

Verification

Passed on this PR tip:

• cargo check -p agent_core -p org2 -p session_persistence --all-targets
• cargo test -p agent_core agent_org -- --nocapture — 237 passed.
• pnpm run typecheck
• focused Vitest for agentOrgRunViewStore.test.ts — 12 passed.
• git diff --check origin/develop...HEAD
• Commit hooks, including scoped Rust Clippy.

The complete stacked tip was also verified after PR3 was added; those results are recorded in #836.

The stacked packaged app was rebuilt successfully with the redesign compiled and enabled:

• ORGII_AGENT_ORG_REDESIGN=1 WEBDRIVER=1 pnpm run tauri:build:fast -- /private/tmp/ORG2-stack-834-836.app — passed in 364.3 seconds.
• Physical macOS UI launch, Team selection, workspace selection, fake-provider/model selection, and Send all worked. The coordinator and four stable flat Member sessions materialized, and the fake-provider reply rendered.
• The rollout gate also failed closed when omitted, as intended.
• The fake provider did not issue org_run_complete; therefore this run did not exercise Running -> Idle, and no Idle foreground/hidden, active-work, warm-reuse, memory, or eviction result is claimed.

cargo fmt --all -- --check reports formatting differences already present on origin/develop in untouched files. No changed file in this PR contributes to that output.

Deferred verification

• Add a narrow test-only fake-provider mode that calls org_run_complete, then emits the coordinator final answer.
• Assert completion_requested=1, committed final output, no remaining quiescence blockers, status=idle, and last_activity_outcome=completed.
• After the Team is genuinely Idle, repeat the visible five-minute, hidden five-minute, restore-revalidation, active Provider/Wake, and watchdog-counter checks.
• Assert that Turn completion stops active Provider work but leaves a compatible runtime warm, that the next Turn reuses it, and that shared idle eviction later removes it so a subsequent Turn rebuilds it.
• Measure warm-runtime count and RSS across multiple Idle Teams/Members; verify no runtime-owned timer, poll, process, or background I/O remains.
• Retain a negative test proving that an empty task board without explicit completion intent remains running.
• Retain normal SDE regression coverage for Send/Queue/Stop/Resume/Compaction and the existing runtime reuse/idle-eviction behavior.

Commit provenance

• Selected source commit 7beec790733035741ed7c5591d31e2a8264bea3b -> adapted commit 239702009cab1d60baa288a2120cfee0df1b3891, authored by Shibo Sheng.

[ShiboSheng]

orgii://cloud/session/ref?v=1&org=bfa7b134-2486-45fa-81ad-a369441fafb4&owner=776dbd69-ac1d-4f72-a0d4-69cb4f2667dd&session=codexapp-rollout-2026-08-11T00-04-03-019fec6a-b4fe-7333-9faa-514f8a83850e