feat(agent-org): enable direct Member work

[ShiboSheng]

Problem

Fixes #763

Canonical Agent Org Member pages could not start independent, durable user-directed work. A direct message was either rejected or injected as steering into the current formal TaskExecution; Paused Members could not legally run it, and the old intervention overlay expired after 180 seconds. The transport carried only a boolean intervention hint, so the backend could not prove the exact EventStore user source or recover one stable Turn after a crash.

Return to Work also polled and blanket-drained Inbox state instead of applying an idempotent receipt transition. After the initial PR8 implementation, a cleared receipt was still projected as current returned activity on every Run View refresh, and the frontend discarded the real applied outcome. This made a standalone Planner direct chain repeatedly claim that formal work had resumed even though no formal Task had ever been suspended.

Solution

• Keep the existing Member send chain as the only production entry point and carry the exact EventStore source id plus stable Turn id through it.
• Admit each direct root as durable UserDirectedWork with a bounded per-Member FIFO, a persistent intervention receipt/chain, exact retry identity, and transactional queue-cap/source validation.
• Reuse the existing scheduler and warm runtime. Busy formal work yields by exact lease and generation; direct work cannot run until that lease is released, and timeout/restart recovery never opens a second lane.
• Rebuild tool authority per Turn. Direct work can use file, shell, test, and existing approval-managed tools; ordinary Members are denied Task graph writes at schema, actor, and Store layers, while Writer Members reuse the PR7 graph-admin receipt path.
• Give direct work its own persistence and finalization path so it does not complete/fail/requeue formal Tasks, drain formal Inbox, spend recovery budget, or block formal quiescence.
• Replace Return polling with an idempotent receipt/request transaction. The protocol reports replay as already_applied while also returning the original applied outcome, whether formal work existed, the cleared revision/time, and the optional unique continuation.
• Project only active receipts into current Member/Overview activity. Standalone direct chains are side_quest; receipts with an exact formal Task/Turn binding are user_intervention. Cleared history remains durable for idempotency and audit but never reappears as current returned state.
• Use the same receipt transition for two accurate controls: standalone/Idle/Paused work shows End direct work, while a resumable formal handoff shows Return to formal work. Success is one standard four-second Toast derived from the applied outcome; Run View refresh, Session switching, and App restart do not replay it.
• Project yielding/intervention/timeout activity, queue count, source, and Writer capability without changing Team status. Working, Idle, and Paused Members can use the composer; Archived remains read-only. New copy is present in all 13 sessions.json locales.
• Make Archive/Team Delete cancel direct work without replay and atomically remove EventStore plus Session-owned OrgTrack history. Shared resource identities without Session history remain available to unrelated Sessions.
• Keep ORGII_AGENT_ORG_REDESIGN disabled by default. PR9 can add source adapters to the same dispatcher; this PR does not add Group or peer fan-out.

Potential risks

• This is a cross-layer concurrency and persistence change spanning the send wire, SQLite authority, scheduler, recovery, tools, and UI. Race/fault tests cover the owning boundaries, and packaged-App evidence showed one active Provider Turn per Member, but unusual OS/process termination points remain the highest-risk area.
• The gated Agent Org runtime uses canonical DDL with no migration or downgrade path for old local rollout data. Rollback is to disable the gate and revert the PR; affected gated test/local data may need reset rather than schema downgrade. The removed latest-returned index may remain harmlessly in an existing gated database.
• The one-shot Toast intentionally has no persisted acknowledgement or new global owner. Exact command replay remains durable, but a process crash after Return commits and before the Toast paints may omit that transient notice rather than replay it on restart.
• The PR is stacked on Draft PR feat(agent-org): add idempotent task graph writers #956 and must merge after that exact base. Rebasing or changing PR7 requires rerunning affected integration checks.
• The focused live WDIO spec is included but is not counted as passed on macOS because the packaged artifact did not expose the Tauri WebDriver plugin port. The same rendered send, Stop, End/Return, Pause, Resume, Archive, and Delete paths passed through Computer Use on the packaged App.
• BuildFast validates the real Rust backend, RPC, SQLite, filesystem, and packaged UI, but does not validate release signing, notarization, updater, or installer-only behavior.
• Static screenshots are not attached to this Draft because the acceptance-critical behavior is a sequence of lifecycle transitions plus runtime/database invariants. Computer Use inspected light/dark, narrow, Idle, Paused, yielding, timeout, error, active intervention, and Archived states; architecture/UI/performance audit records are included in the diff.

Verification

• pnpm typecheck — passed.
• pnpm lint — exited 0 with five unchanged warnings in WorkItems files outside PR8.
• pnpm vitest run --silent --reporter=dot — 1,119 files and 8,800 tests passed.
• cargo fmt -p agent_core and git diff --check — passed.
• cargo check -p agent_core — passed.
• cargo clippy -p agent_core --all-targets -- -D warnings — passed; only Cargo's unrelated future-incompatibility notice for block v0.1.6 remains.
• cargo test -p agent_core --lib -- --test-threads=1 — 3,264 passed, 0 failed, 2 ignored.
• Commit hooks — passed scoped TypeScript, ESLint/circular checks, formatting, and agent_core Clippy.
• ORGII_AGENT_ORG_REDESIGN=1 pnpm tauri:build:fast — passed on the final production source in 325.8 seconds; checked-in rollout default remains off.
• Idle Planner real-provider case — inspected a real Texas Hold'em pot-odds failure and ran the project tests. The rendered End action showed one accurate four-second Idle Toast; Session A→B→A and a full App restart did not replay it or restore a returned row.
• Busy Implementer real-provider case — updated a real fixture README and ran its full tests while a formal Task was bound. Activity remained user_intervention after the direct queue reached zero; the rendered Return action immediately showed one The original Task resumed Toast. SQLite readback recorded restored_task, cleared revision 1, and exactly one continuation.
• Runtime evidence after Return — zero active Provider Turns; retained Coordinator/Member runtimes were warm owners, not concurrent work.
• Visible and hidden five-minute captures — zero PR8 Run View, Member Wake, UDW, intervention, or Provider polling; hidden restore caused one bounded refresh.
• Permanent Delete revalidation — exact database readback found zero Team run, canonical Session, edit, diff, final-diff, resource-interaction, or commit-link history. One shared resource identity remained by design.
• Focused live WDIO execution — blocked before the rendered Session loaded because the packaged artifact did not report a WebDriver plugin port; not reported as passed.

Scope and rollout

• Base: PR feat(agent-org): add idempotent task graph writers #956 at 722f6bce39c5a52efc14fcc59707f14eaa93a39a.
• Gate: ORGII_AGENT_ORG_REDESIGN, default off.
• Not included: Coordinator safety, formal task convergence/finalization, chat scroll behavior, Group mention/fan-out, peer user-directed Inbox, downstream side-quest outcome UI, full Group projection, full rollout, new Task states, a second runtime/dispatcher, TTL, or automatic Return.
• The PR remains Draft while the stacked base is Draft and the WDIO infrastructure path is blocked.

Audit

• Ten-layer architecture audit: included under docs/architecture-audit-2026-08-26/.
• Frontend consistency audit: included under docs/frontend-ui-audit-2026-08-26/.
• Lifecycle/performance guard: included under docs/org2-performance-guard-2026-08-26/.