feat(pm): unify agent-native work management through org2-pm

[Neonforge98]

Problem

Work management was split across legacy typed tools, direct persistence writes, frontend-only session flows, and partially integrated CLI paths. Agents could observe one Work Item model while mutating another; project and standalone scopes behaved differently; and writes did not consistently share audit, optimistic-concurrency, idempotency, or wake semantics.

As a result, Work Items, linked Sessions, Discussion, sub-items, and Routines did not form one reliable execution loop. The previous audit-batch framing no longer described the actual scope of this branch.

Solution

This PR makes org2-pm the canonical agent-facing work-management surface and connects it to the existing Work Item, Session, Routine, Discussion, and Agent Org systems.

1. Canonical PM application services

• Adds service boundaries for work, routine, and project operations instead of routing mutations through ad hoc store access.
• Centralizes atomic create/claim/lifecycle transitions, claim-holder authority, audit events, change watermarks, optimistic concurrency, and idempotency.
• Hardens routine conversion and graph behavior, project commands, schema conformance, and product-mode handling.

2. Agent-facing org2-pm integration

• Makes org2-pm the sole agent-facing carrier for work-management operations and retires the overlapping legacy typed tools.
• Resolves agent identity and project/standalone scope from launch context, environment, and workspace markers.
• Ships the CLI as a desktop sidecar with stable response envelopes, project commands, standalone commands, and conformance coverage.

3. Linked Work Item sessions and Discussion

• Persists linked Work Item context through Session creation and launch, then mirrors lifecycle status back into the Work Item.
• Adds exactly-once receipt fallback after agent turns and forwards human Discussion comments into the linked Session safely.
• Supports shell-safe bodies, Work Item creation/quick-add flows, Chat Panel navigation, refresh behavior, and inline sub-item details.

4. Staged sub-item execution and feedback

• Adds stage-grouped sub-item presentation while keeping stages as execution ordering over ordinary sub-items.
• Exposes No stage, existing stages, and the next sequential stage directly in sub-item quick-add while preserving the title-plus-Enter path.
• Supports standalone claim/transition flows, failed-run retry, usage feedback, and stable detail navigation.
• Wakes a parent only after the current child barrier is satisfied, including completions written through either the app or CLI.
• Reuses a durable linked Session across barrier continuations and clears its execution lock at terminal state, preventing duplicate or stale Running rows.

5. Created Work Item cards in ordinary Sessions

• Recognizes successful org2-pm work create protocol envelopes from both live shell results and durable Session replay.
• Keeps created Work Item cards visible outside the collapsed command stack.
• Makes each card keyboard-accessible and clickable; opening it switches to My Station and opens or reuses the canonical Work Item detail tab.
• Uses the canonical result payload and launch context for navigation instead of parsing assistant-authored prose.

Potential risks

• This is a broad cross-layer change spanning Rust persistence and services, CLI/wire contracts, Session launch and prompt injection, and Work Item UI.
• The branch history was rewritten from 73 commits to 5 reviewable capability commits, followed by 2 focused UI commits. Anyone with the old branch checked out must reset or rebase onto the new head.
• Work Item payloads intentionally remain store-shaped until the planned durable-ID migration; protocol fixtures document the target contract in the meantime.
• The child-completion wake bridge observes change watermarks for external CLI writes. It is covered by tests but is not intended to behave like a distributed job queue.
• Existing disabled routine state is not automatically re-enabled because that state may reflect user intent; stuck portable runs reconcile lazily.
• The Stage picker derives choices from existing children and exposes the next sequential stage; direct CLI/API callers can still write other valid stage numbers.
• Session cards depend on a valid orgtrack/v1 work.create envelope; malformed or noncanonical shell output intentionally falls back to the existing command rendering.

Commit map

1. 58fe57a — harden work, routine, and project service boundaries
2. 6036649 — make org2-pm the agent work-management surface
3. 59203cc — unify Work Item sessions, Discussion, and detail UI
4. f1b0f13 — complete staged sub-item execution and feedback
5. 7d9923a — stabilize linked-session completion and CI
6. 56be338 — choose stages when adding sub-items
7. 5ec3d9b — link created Work Items from Session output

Verification

• pnpm lint — passed
• pnpm typecheck — passed
• Targeted Session card/parser tests — 3 files / 9 tests passed
• TZ=UTC pnpm vitest run --reporter=dot --silent — 1,009 files / 8,223 tests passed
• cargo test -p project_management -p orgtrack-pm-cli -p agent_core --quiet — passed
• cargo clippy --workspace --all-targets -- -D warnings — passed
• node scripts/tauri/prepare-sidecars.cjs --profile debug — passed
• pnpm tauri:build:fast:local — production frontend and local macOS app bundle built successfully
• Computer Use on the rebuilt macOS app — reopened an ordinary Session and confirmed historical result WI-0067 rendered as a persistent clickable card; switched to Agent's Station, clicked the card, and landed on its My Station detail page
• Computer Use live path — created WI-0068 from the same ordinary Session, observed the card immediately, switched to Agent's Station, clicked it, and landed on WI-0068 / CU Live Session Card Jump 0808
• Earlier Stage picker run — selected Stage 1, created parent WI-0064 and child WI-0065, observed the STAGE 1 group and 0/1 count, then confirmed Stage 2 became available for the next child
• Bundled-sidecar readback of WI-0065 — parent: WI-0064, stage: 1, status: planned
• Earlier regression run WI-0062 / WI-0063 — parent Done, child 1/1 completed, exactly one linked Session in Completed state, and no residual execution lock
• git diff --check — passed
• History integrity — 73 commits condensed to 5 reviewable capability commits; cumulative implementation preserved; UI follow-ups remain focused

[Neonforge98]

真机升级 cell 实测通过（沙箱化真实 home 副本 + dev 构建，CLI↔GUI 跨进程）：

• 转换行为：scope-bound legacy 行被禁用、portable 接管（default_scope 正确写入）；scope-less legacy 行保持启用（Part B 生效），其 portable twin 每 tick 被 no_scope_binding 抑制（审计流可见 routine.fire_suppressed）、legacy watermark 持续推进
• 解除压制闭环：portable 触发 run₁（root+child 物化，CUG-0001/0002）→ 子项标 done → 下一调度 pass：run₁ 终态写回 succeeded → run₂ 立即触发（CUG-0004/0005）——坏版本在此处永久卡死
• 跨进程 CLI：work create 无 mode → PROJECT_MODE_REQUIRED exit 5；带 --scope --mode project → exit 0 落库
• UI 修复（launch productMode / ModePill CLI gating）由 134 个组件测试覆盖；dev 进程无法被 computer-use 索引，GUI 目测留待 review 时顺手一验

[Neonforge98]

S0 地基批已并入本 PR（6 个新提交，per 设计稿 agent-cli-unification-design §11/§13）：

1. in-tx 原语 + 单事务 create：write_work_item_in_tx / allocate_short_id_in_tx / resolve_project_scope_in_tx 抽取；work.create（project + standalone）的守卫、行写入、审计、watermark 同一个 BEGIN IMMEDIATE——create 的审计/幂等崩溃窗口关闭
2. routine.invoke 整图单事务：分配、全部条目（每个过存在性守卫）、关系、run 行、共享单次 seq bump 的全部审计行、幂等记录一次提交；中途失败整图回滚（跨 org 地雷测试实证）；调度器传 plan-time key（顺带关闭 invoke 与 mark_evaluated 之间的 crash-refire 窗口）
3. 单事务 claim：锁获取 + strict open→in_progress 一次 atomic 调用，OCC 入口校验一次——--expected-revision 从必败变可用，跨进程 e2e 已覆盖
4. 先占位再执行的幂等：并发同 key 恰好执行一次（并发测试实证），bootstrap 双开根项的竞态关闭；崩溃占位 30s 后可接管，失败执行删占位保持可重试
5. whole-row 生命周期路径全部入审计：delete/restore 走 serviced atomic（work.delete/work.restore + 版本 bump + watermark，云删除传播保留）；两个 whole-row Tauri 命令改走 audited overwrite；atomic 写回补 deleted_at 列
6. 契约修偶 + conformance 最小闸：claim 第二竞争分支归位 ALREADY_CLAIMED；execution-context schema 补 null 分支；4 处 fixture 文案对齐（decisions.md 记修订）；新 conformance 测试用真实 org2-pm 进程输出过 jsonschema 校验 + 全部 error fixture 的 retryable 一致性；parity-matrix 补上落地打勾

验证：project_management 568 + agent_core 3150 + orgtrack-pm-cli 10（含 2 个新 conformance）= 3728 全绿；clippy 零警告。

[Neonforge98]

全线进度收口（S0–S3 完成，S4 准备就绪）

按 agent-cli-unification-design.md 的切片计划，本 PR 现含 19 个提交，覆盖到 S3 全部 + S4 可逆准备部分。3731 个 Rust 测试全绿。

片	状态	内容
batch0	✅	Routine P0 自愈、create 覆盖守卫、launch productMode、ModePill 崩溃、683 测试债
S0	✅	in-tx 原语 + 单事务 create/claim/routine.invoke、先占位幂等、whole-row 入审计、conformance 闸、契约修偶
S1	✅	work assign/release、org2 project 命令族、分页、portable 状态过滤、幂等补全
S2	✅	shell env 注入（ORGII_* + PATH）、fail-closed 会话标记（冒充拒绝）、Project brief 命令节
S3	✅	L3 claim-holder 守卫、Tauri transition parity、转录 org2-pm 信封渲染器
S4	🟡 准备	deprecation 埋点 + WIM 命名清扫；工具删除未做（见下）

S4 工具删除为何未在本 PR

manage_work_item/manage_project 是 AI work-item filler、Create-Project-with-AI 等当前活流程的依赖。设计稿 §15.5 规定删除门控于：deprecation 零调用观察窗口 + 实测 CLI 全替换验证。本 PR 加了埋点（orgtrack_tool_deprecation span）让窗口可观察，但删除本身是时机决策，需要观察期数据 + 一轮双机实测确认 CLI 路径完整替换每个流程后再单开 PR 执行。

建议合并策略

本 PR 已相当大（19 提交，跨 Rust/TS/docs/e2e）。S0 的事务原语是 PM Graph Commit 的地基，S2/S3 是 agent-CLI 统一的核心。可整体 review 合并，也可按 batch0/S0 与 S1–S3 拆两批——commit 边界清晰，每片独立绿、可回滚。

[Neonforge98]

双机实测 (S4) 完成 — 报告: docs/orgtrack-pm-protocol/dual-instance-s4-2026-08-07.md。Cell A filler-via-CLI 真 LLM GREEN；Cell B 双机 CLI→云→inst-2 闭环；Cell C 子代理 root-walk 过；boot-2 确定性 0 epoch 变。实测另修 4 个真 bug（exec-mode pin / org 注线 / 分配器全局碰撞 / patch actor 审计）。

[Harry19081]

LGTM