feat(agent-org): ship bounded public Team timeline

[ShiboSheng]

Problem

Fixes #765

Depends on #1085 and is intentionally based on codex/issue-764-group-inbox, the frozen PR9 head.

The pre-PR10 Group surface subscribed to the Coordinator plus every materialized Member Session, loaded complete histories, merged them in the frontend, and guessed reply relationships from timestamps. That made cost grow with Team size and could not enforce Direct versus Group visibility at the authoritative boundary.

The first bounded PR10 projection removed that unsafe path, but initially projected only group_root and group_mention. Real completed Team runs therefore hid the launch requirement, Task progress, Team lifecycle changes, completion certificate, and final report, leaving users with an empty or materially incomplete Group timeline even though canonical records existed.

Solution

This branch delivers the complete PR10 boundary across all three commits:

• Replace the N-Session frontend merge and timestamp matching with one backend-owned, cursor-paged Team projection and one run-scoped shared frontend store.
• Project a conversation branch from the canonical launch input, exact initial Coordinator reply, GroupRoot and GroupMention messages, exact assistant replies, and the public final report.
• Project a typed public-activity branch from Task create/start/terminal/reassignment/replacement, Pause/Resume, Member Return, completion certificate, final-report failure, and Archive authorities.
• Exclude Direct conversation, Linked Inbox content, internal coordination reminders, tool/thinking rows, and raw provider failures at the backend authority boundary.
• Use an opaque stable cursor ordered by (created_at, source_rank, stable_source_id, item_ordinal), retain the 50 default / 100 maximum page limits and response-byte cap, and execute at most four SQL statements per page.
• Persist exact causal markers for the launch reply and reuse PR9 causal IDs for Group replies; malformed or missing authorities fail closed as bounded diagnostics instead of guessing a nearby response.
• Keep independent turnIntentId Stop/Retry state, single-flight refresh, deduplication, stale-generation rejection, push coalescing, hidden-dirty behavior, and listener/cache cleanup in the shared store.
• Wake queued work correctly after a Member Return so the public Return transition and subsequent execution stay consistent.
• Render conversation bubbles and compact localized activity rows with parity across all 13 sessions.json locales.

The internal Agent Org redesign rollout gate remains closed by default while this PR is Draft. This branch does not add a second projection table, polling loop, shared Group lifecycle, schema migration, or compatibility fallback.

Potential risks

• Rollout remains gated: the bounded query and representative packaged UI pass, but the full issue matrix of five-minute foreground/hidden/multiple-Idle-Team CPU/RSS/request observation and every real rendered cross-entry journey has not been completed on the final head. The earlier branch evidence also recorded an RSS navigation gate and a Data Science Team template tool-access blocker. The Draft must not be marked ready or the default gate opened until those are resolved or explicitly re-scoped.
• Fresh/reset schema contract: this stack adds canonical expression indexes but intentionally ships no intermediate-stack migration. A database created by an earlier unpublished stack commit must be reset/recreated with the matching schema. No production user database was mutated during verification.
• Historical launch replies: runs created before the exact launch-reply marker cannot safely reconstruct that assistant reply. The projection shows the canonical launch request, typed activity, and public final report but will not guess an old reply by time.
• Large dynamic projection: the query is bounded and measured at 50 Members / 10,000 events, but unusual SQLite distributions outside the fixture remain an operational risk until the complete real-machine observation gate is finished.
• Rollback/recovery: first disable the existing rollout gate. If code rollback is required, revert this branch to PR9 and use a database/config created for that matching stack revision; do not re-enable the deleted N-Session merge as a fallback.

Verification

• pnpm exec vitest run on the original six affected suites — 48 passed.
• pnpm vitest run src/engines/ChatPanel/ChatHistory/GroupChatView/AgentOrgGroupProjectionView.test.ts src/engines/ChatPanel/hooks/agentOrgGroupProjectionStore.test.ts src/api/tauri/agent/orgTasks.test.ts — 28 passed.
• cargo test -p session_persistence — 47 passed on the original bounded-projection commit.
• cargo test -p agent_core --lib — 3,429 passed, 3 ignored on the original bounded-projection commit.
• cargo test -p agent_core group_projection::tests -- --nocapture — 6 passed, 1 performance test intentionally ignored by the default run.
• cargo test -p agent_core only_the_exact_initial_root_turn_gets_a_public_reply_marker -- --nocapture — passed.
• cargo test -p session_persistence group_projection_reply_queries_use_canonical_expression_indexes -- --nocapture — passed and proves the canonical expression indexes are selected.
• cargo test -p agent_core public_timeline_p90_stays_bounded_for_fifty_members_and_ten_thousand_events -- --ignored --nocapture — 50 Members, 10,000 events, 30 samples, P90 11.707 ms against the 200 ms budget; no writes.
• cargo clippy -p agent_core --all-targets -- -D warnings — passed on the original bounded-projection commit.
• Commit hook on the final head: scoped TypeScript check passed; Clippy passed for agent_core and session_persistence; ESLint checked 5 staged frontend files; circular dependencies 0.
• cargo check -p agent_core, cargo fmt --all -- --check, and pnpm typecheck — passed on the final head.
• All 13 locale JSON files parse and each contains the 14 public-activity keys.
• node --check tests/e2e/specs/core/agent-org-group-chat-ui.spec.mjs — passed.
• ORGII_AGENT_ORG_REDESIGN=1 pnpm tauri:build:fast -- --instance 10 plus representative SQLite data — packaged Tauri app opened the real Team run and rendered the launch requirement, Task lifecycle, completion certificate, exact later Group replies, and public final reports. Direct/Linked/internal raw rows were absent from the Group surface.

Stack and review map

• Base / PR9: feat(agent-org): add multi-target Group work and Linked Inbox #1085 at 3a97ebca4e36138149e0d0302989ead0a3b513b4.
• Projection, actions, and old-path deletion: bb6cc17f6d88421224a2d9efb0bb4d9b176f4757.
• Return-to-queued-work lifecycle correction: fa7398efd2b7d6159e3b2aa4c7f8b2ac888bd87e.
• Complete public Team timeline and real-data regression fix: dc1133eebe206f81a10c7925e3046c8023415293.
• Branch delta from PR9: 100 files, 8,346 additions, 2,506 deletions. Locale churn accounts for 13 mechanically parallel files; deleted frontend history/live-session modules are the required removal of the old N-Session path.

Deliberately deferred before Ready

• Complete the remaining five-minute foreground, hidden, and multiple Idle Team resource observations, including request/channel/CPU/RSS evidence.
• Resolve or explicitly re-scope the recorded repeated-navigation RSS stability and Data Science Team template blockers.
• Run the remaining full real rendered Direct, Linked Inbox, intervention, Pause, Archive, multi-target, and ordinary-SDE regression matrix on the frozen final head.
• Only then consider enabling the default product rollout and marking this PR ready.