feat(agent-org): support Idle Coordinator chat with hard work gates

[ShiboSheng]

Stack position

• Delivery order: 2 of 5
• Intended PR: PR 2 — Idle Root questions, one send path, and hard Idle gates
• Depends on: feat(agent-org): add long-lived Team lifecycle and durable quiescence #702
• Next: feat(agent-org): enforce Coordinator-only Task graphs and atomic activation #704
• Design source of truth: docs/architecture/agent-org-long-lived-team-session-design.md, especially sections 8, 12–15, 17–18, 24, and 25.4

This PR is a Draft intermediate layer. It opens safe Coordinator conversation in Idle/Paused, but Task activation remains disabled until PR 3 and explicit @Member remains fail-closed until PR 4.

Problem / Motivation

After a Team becomes Idle, users need to keep asking the Coordinator questions in the same Conversation. The current Root/Group paths are split, Group delivery can auto-resume Paused work, and a member mention may enter a normal Worker work Inbox. Merely enabling the composer would therefore risk duplicate messages, unwanted work Wake, or hidden Task mutation.

Goal

Route Root messages and Group messages without an explicit member target through one durable Coordinator send/Queue/EventStore path in Working, Idle, and Paused. Questions may be answered, but this PR must produce no new work and must not silently redirect explicit member mentions.

Required scope

• Send Idle Root messages and Group messages with no explicit Member target, or explicitly addressed to Coordinator, through the ordinary Root Session path.
• Preserve Paused when the same Root/Group question is sent; remove the old auto-resume behavior.
• Before PR 4 is enabled, reject explicit @Member in Working/Idle/Paused with one typed member_conversation_not_enabled receipt. Do not route it to Root or the legacy Worker work Inbox.
• Enforce Store/Tool gates that block general Idle Task mutation, work/coordination Inbox writes, TaskExecution Wake, and completion side effects.
• Persist accepted Root turns with backend-derived agent_org_turn_kind=coordinator; the UI/mention payload cannot manufacture member/work kind.
• Give Root bounded historical Team/Task/Artifact context and the Idle rule: answer questions, but do not activate Tasks in this PR.
• Preserve stable authoritative user-message and Root Turn ownership for PR 3 activation receipts.
• Keep Run View a bounded projection; do not introduce Proposal, Work Request, classifier, hidden begin_work, or a frontend activation command.

Locked invariants

• One user action creates at most one authoritative message and one Root Turn.
• Explicit @Member never falls back to Coordinator and never enters a work Inbox.
• Paused conversation stays Paused; Archived rejects sends and mutations.
• Idle Root conversation cannot create/update Tasks, write work Inbox, Wake Workers, or run completion tools.
• Routing and Turn kind come from canonical backend identity, not model judgment or frontend flags.
• Ordinary SDE send/Queue/Stop/Resume/Compaction paths remain unchanged.

Acceptance criteria

• Idle Root questions produce exactly one Coordinator turn and zero Worker Wake/Provider starts.
• Paused Root and unaddressed Group questions are answered by Coordinator without auto-resume.
• Working/Idle/Paused explicit @Member all return the same typed unavailable receipt before PR 4.
• Rejected member sends write no Worker Inbox, create no Provider, and do not start Coordinator as fallback.
• Root EventStore or Queue failure cannot leave a broadcast-only/optimistic-only message.
• Replaying the same user message from multiple windows does not duplicate append or dispatch.
• Generic Task create/update, Worker work send/Wake, and completion tools are rejected in Idle with zero side effects.
• Archived ordinary send returns a typed rejection.
• Root context, Team/Task/Inbox/Artifact projection, and history reads remain bounded.
• Ordinary SDE chat does not read Agent Org state or add listeners.

Verification

• Production-path Root ordinary-turn integration for Working/Idle/Paused.
• Rust Store/Tool gate tests, typed error tests, duplicate-message/idempotency tests, and Archived rejection tests.
• Frontend single-send-path and canonical mention parser tests.
• TypeScript typecheck and focused Vitest.
• Negative tests proving zero Worker Inbox/Wake/Provider/Task side effects.
• Architecture review of message ownership, Turn kind, Store gates, and wire mapping.
• Performance guard for bounded context/projection and listener/polling isolation.

Out of scope

• Coordinator Task creation or Idle → Working activation (PR 3).
• Direct Member conversation or Group @Member answers (PR 4).
• Proposal, confirmation, hidden activation commands, or a separate classification model call.
• Complete UI/locales/E2E/performance sign-off (PR 5).
• Releasing PR 2 alone as the complete long-lived Team experience.

Effort and budget

• Labels: Effort: Medium, UX
• P50 range: 1,200–1,800 review lines; planning point: 1,400
• P90 cap: 2,400 review lines
• Expected substantive files: 11–16
• At 70% of P50, review the diff and risks. Above 1.25× P50, explain new entry points/test surface; at 1.5×, stop and re-spike before expanding scope.