feat(agent-org): add transactional turn context and member FIFO

[ShiboSheng]

Problem

Fixes #758

Agent Org turns currently persist a generic Turn Intent, but they do not have one canonical durable record that says which run, participant, turn kind, authority source, and activation episode own that turn. That leaves later Task, direct-member, group, and inbox producers without a trustworthy identity boundary, and it makes Member ordering vulnerable to per-source queues or half-written state.

PR3 needs to establish that ownership boundary without implementing the later PR4–PR10 product features, without adding a second runtime, and without making ordinary SDE sessions depend on Agent Org context storage.

Solution

• Add the canonical agent_org_runtime_turn_contexts table with strict row-shape checks, exhaustive typed decoding, source identity, activation/actor versioning, and one context per Agent Org Turn Intent.
• Add one (org_run_id, member_id) dispatch allocator. Task execution and every future user-directed Member source share the same monotonically increasing FIFO; Coordinator Root turns never consume a Member sequence.
• Admit the base Turn Intent, Member sequence, and companion context in one BEGIN IMMEDIATE transaction. Exact replay returns the existing identity and sequence; partial pairs, mismatched replay, unknown members, wrong sessions, and invalid authority fail closed without a repair guess or second allocation.
• Wire Starting initial Root admission into the existing Starting transaction, and route later Root submit, Queue, Force Send, and mid-turn steering through the same Coordinator admission boundary.
• Keep ordinary SDE restart reconciliation fenced to org_run_id IS NULL; run Agent Org recovery only after its schema is initialized, preserving typed initial Root recovery and isolating contextless historical rows.
• Accept only an empty Agent Org runtime namespace or the exact current 15-table manifest. The unpublished PR828-to-PR3 forward-upgrade branch has been removed; known legacy namespace retirement used by the supported release downgrade/return boundary remains isolated.
• Preserve cancelled as the authoritative terminal outcome when user Stop or Force Send interrupts a turn.

This PR is intentionally stacked on #836 (codex/issue-791-pr3-selected-rebuild) so its diff contains only PR3.

Potential risks

• Persistence: a partial, changed, or unknown agent_org_runtime_* schema now rejects startup instead of being guessed or upgraded. Recovery is to restore a backup or use a fresh namespace; do not hand-edit the tables.
• Historical local data: contextless terminal Agent Org turns remain readable history but cannot authorize new work. A contextless running turn remains unknown/in-flight and may require explicit local cleanup; PR3 does not invent its missing identity.
• Member entry points: old Member wake/direct/group/inbox calls that cannot prove typed authority fail before writing base/context/sequence state. Their supported product paths belong to PR4, PR8, and PR9.
• Concurrency: Agent Org admission adds one short indexed BEGIN IMMEDIATE writer transaction. The 50-connection mixed-source test passed, and packaged-app active/idle measurements showed no new timer, poll, context query, or memory staircase.
• Compatibility: the full PR3 -> official v1.2.6 -> PR3 UI test is blocked by fix(agent-org): [11/11] harden full-stack upgrade and rollback compatibility #840 because v1.2.6 cannot read the newer WorkStation members tab cache. PR3 does not modify that cache or PR825. Before the old UI failed, and after returning to PR3, the 15 runtime tables and key Agent Org business fingerprints remained intact. The complete cross-version UI matrix remains unverified until fix(agent-org): [11/11] harden full-stack upgrade and rollback compatibility #840.
• Stack order: fix(agent-org): isolate runtime persistence namespace #836 must land before this PR, or this branch must be rebased to the resulting develop HEAD before merge.

Verification

Automated checks ran on source tree e8ea88f767abed22f57fc7a4f43205b610e2b08d, now published as 32565bdaefd2bc9d051b8f4cfcb6d5923b27d0e9 after a commit-message-only Husky rewrite:

• cargo test -p agent_core core::coordination::agent_org_turn_contexts -- --nocapture — 8 passed, including strict replay, transaction rollback, delete cascade, shared FIFO, and 50 concurrent connections.
• cargo test -p agent_core core::coordination::schema -- --nocapture — 8 passed, including fresh/current-only manifest, corruption rejection, atomic legacy cleanup, concurrency, and schema-init timing.
• cargo test -p agent_core state::commands::session::message -- --nocapture — 21 passed, including steering/Force Send separation and authoritative cancellation.
• cargo test -p agent_core agent_org -- --nocapture --test-threads=1 — 232 passed.
• cargo test -p session_persistence turn_intents -- --nocapture — 13 passed, including ordinary SDE recovery with no context schema dependency.
• cargo check --workspace --all-targets — passed.
• cargo clippy -p agent_core -p session_persistence -p org2 --all-targets -- -D warnings — passed.
• rustfmt --edition 2021 --check <12 changed Rust files> — passed.
• git diff --check fe20ec604902d956b98aa7fab00bdd1469d9f7e3...HEAD — passed.
• cargo fmt --all -- --check — not clean because seven pre-existing, unchanged files have formatting drift; those unrelated files were deliberately not reformatted in this PR.
• Frontend lint/rendered E2E — not applicable: this PR changes no TypeScript, TSX, locale, IPC, or visible UI contract.

Packaged-app real-machine verification:

• BuildFast: /private/tmp/ORG2-PR3-758-no-pr828-upgrade.app, executable SHA-256 dc282e927a3c5eab7d5ad4f9180ea15c1d53dc970e8d789f5a01d029de578bc4.
• Real UI passed Starting initial Root, later Root, natural Queue, Force Send, ordinary SDE, user Stop, Command+5 active-path observation, clean quit, and three launches/restarts.
• Old Member entry attempted through the real wake path returned the typed context error with zero base Turn, context, or allocator half-write.
• SQLite finished with quick_check=ok, the exact 15 runtime tables, 50 contexts, zero active Turn Intents, and zero ordinary-SDE contexts. Coordinator contexts had null dispatch/sequence fields and created no allocator row.
• Run, Agent Org Turn, context, Task, Inbox, materialization, initial-input, and all-Turn logical fingerprints matched before and after restart.
• Command+5 showed no context endpoint/polling. Five-minute visible and hidden idle windows kept CPU near zero and RSS stable without staircase growth.
• Official v1.2.6 downgrade UI leg: blocked by fix(agent-org): [11/11] harden full-stack upgrade and rollback compatibility #840 as described under risks; no PR3 cache change was made.

Screenshots are not attached because PR3 has no new visible UI. The acceptance evidence is the production UI side effects correlated with SQLite, logs, Command+5, restart fingerprints, and performance samples.

[ShiboSheng]

orgii://cloud/session/ref?v=1&org=bfa7b134-2486-45fa-81ad-a369441fafb4&owner=776dbd69-ac1d-4f72-a0d4-69cb4f2667dd&session=codexapp-rollout-2026-08-18T12-18-21-01a01317-7b35-7870-a0cc-c50302820f61

[ShiboSheng]

Test-contract note: restoring the original input after Stop (deferred)

The full live-provider regression on 2026-08-24 identified a test-contract conflict between an older rendered E2E scenario and the current product behavior. We are intentionally making no PR3 production-code change and no test change in this stack. This note records the expected behavior so future regressions do not incorrectly classify it as a PR3 failure.

Current behavior

• If the user clicks Stop before any visible agent output appears, the original user message is restored to the composer.
• If Thought content, a Tool call/result, or a partial assistant response is already visible, the original user message is not restored; the composer is empty and available for new input.
• In both cases, the original user message and any already-rendered execution history remain in the conversation.

The second behavior is intentional. Once a request has partially executed, automatically preparing the same request for resubmission could cause commands or other side effects to run twice. The existing useSessionActions unit test explicitly protects the rule that a message is not restored after renderable agent output exists.

Source of the conflict

The older rendered E2E helper runStopRestoresInFlightScenario still expects the original message to be restored unconditionally after Stop, including after long-running Tool work has started. That assertion conflicts with both the current implementation and its unit test. This is test-contract drift, not a FIFO, Turn-context, or Stop-backend defect.

How future regressions should classify this scenario

When visible live-provider output exists before Stop, PR3 Stop should pass without restoring the original composer text if all of the following are true:

• the durable Turn reaches cancelled with reason user_stop;
• the Stop control returns to Send and the composer is usable;
• active Provider work, the shell, and all child processes stop;
• no late assistant final, Tool side effect, or duplicate Turn appears.

The absence of restored composer text alone must not be reported as a PR3 failure in this scenario.

Future test-only follow-up

A separate test-only follow-up should split the rendered E2E contract into two explicit cases:

1. Stop before any visible agent output: the original message must be restored.
2. Stop after Thought, Tool, or partial assistant output: the original message must not be restored, while cancellation, process exit, and late-side-effect suppression are fully verified.

Until that follow-up lands, the accurate PR3 verdict is: Agent Org Member FIFO, Queue, Force Send, Stop cancellation, and late-reply suppression pass; not restoring a draft after visible agent output is the expected behavior, not a failure.