zigmini 1.0.0-beta.2 → 1.1.0-beta.1

package/src/test-crash.ts

@@ -0,0 +1,20 @@
+import { writeSync } from "node:fs";
+
+/** The named process-stop boundaries of the Q-10 restart contract (test/contract/agent-collaboration-gaps-restart.contract.test.ts). */
+export type TestCrashPoint =
+	| "collaboration.admission.before-commit"
+	| "collaboration.admission.after-commit"
+	| "collaboration.input.rpc-written"
+	| "collaboration.result.committed";
+
+/**
+ * Test-only crash seam. Production never sets ZGW_TEST_CRASH_AT, so this returns at once there. When a restart contract
+ * test sets it to one point, the gateway writes `ZGW_TEST_CRASH_POINT <point>` synchronously to stderr and stops itself
+ * (SIGSTOP) at that exact boundary; the test then SIGKILLs the stopped process. Nothing runs between the boundary and the
+ * kill, so a pending transaction stays uncommitted and no later callback or socket frame is processed.
+ */
+export function testCrashPoint(point: TestCrashPoint): void {
+	if (process.env.ZGW_TEST_CRASH_AT !== point) return;
+	writeSync(2, `ZGW_TEST_CRASH_POINT ${point}\n`);
+	process.kill(process.pid, "SIGSTOP");
+}

package/src/usage.ts

@@ -26,6 +26,7 @@ const USAGE_TEXT = {
 	reset: { en: " (resets {time})", ko: " (초기화 {time})" },
 	lastUsed: { en: " · Last used {time}", ko: " · 최근 사용 {time}" },
 	failed: { en: "Lookup failed ({detail})", ko: "조회 실패 ({detail})" },
+	limited: { en: " · Limit reached ({detail})", ko: " · 한도 도달 ({detail})" },
 	unknown: { en: "Unknown", ko: "알 수 없음" },
 	expired: { en: "Token expired (the engine will refresh it on next use)", ko: "토큰 만료 (엔진이 다음 사용 때 갱신)" },
 	unsupported: { en: "Usage API unavailable", ko: "사용량 API 없음" },
@@ -69,7 +70,8 @@ export interface UsageRow {
 	readonly provider: string;
 	readonly slot: string;
 	readonly pinned: boolean;
-	readonly status: "ok" | "failed" | "expired" | "unsupported";
+	/** limited: HTTP 429; the windows are the last ones seen for this slot, as omo-usage keeps them. */
+	readonly status: "ok" | "limited" | "failed" | "expired" | "unsupported";
 	/** Why a lookup failed: an HTTP status or a fixed phrase, never a server message. */
 	readonly detail?: string;
 	readonly windows: readonly UsageWindow[];
@@ -280,7 +282,7 @@ async function lookup(account: Account, now: number, deps: UsageDeps): Promise<U
 			redirect: "error",
 			signal: AbortSignal.timeout(deps.timeoutMs ?? 10_000),
 		});
-		if (!response.ok) return { ...base, status: "failed", detail: say(USAGE_TEXT.http, { status: response.status }) };
+		if (!response.ok) return { ...base, status: response.status === 429 ? "limited" : "failed", detail: say(USAGE_TEXT.http, { status: response.status }) };
 		const windows = windowsOf(account.kind, await response.json().catch(() => undefined), now);
 		return windows.length > 0 ? { ...base, status: "ok", windows } : { ...base, status: "failed", detail: say(USAGE_TEXT.noUsage) };
 	} catch (error) {
@@ -289,11 +291,18 @@ async function lookup(account: Account, now: number, deps: UsageDeps): Promise<U
 	}
 }
 
-export async function collectUsage(auth: unknown, poolState: unknown, now: number, deps: UsageDeps = {}): Promise<UsageRow[]> {
+/** `last` holds each slot's newest windows (key provider/name); a 429 shows them, and without them the slot failed. */
+export async function collectUsage(auth: unknown, poolState: unknown, now: number, deps: UsageDeps = {}, last = new Map<string, readonly UsageWindow[]>()): Promise<UsageRow[]> {
 	const used = lastUsed(poolState);
 	return Promise.all(readAccounts(auth).map(async (account) => {
-		const row = await lookup(account, now, deps);
-		const at = used.get(`${account.provider}/${account.name}`);
+		const key = `${account.provider}/${account.name}`;
+		let row = await lookup(account, now, deps);
+		if (row.status === "ok") last.set(key, row.windows);
+		if (row.status === "limited") {
+			const windows = last.get(key);
+			row = windows ? { ...row, windows } : { ...row, status: "failed" };
+		}
+		const at = used.get(key);
 		return at === undefined ? row : { ...row, lastUsedAt: at };
 	}));
 }
@@ -310,8 +319,9 @@ export function formatUsageReport(rows: readonly UsageRow[], timeZone?: string):
 	for (const row of rows) {
 		const name = say(USAGE_TEXT.account, { slot: row.slot, provider: row.provider, pinned: row.pinned ? say(USAGE_TEXT.pinned) : "" });
 		let body: string;
-		if (row.status === "ok") {
+		if (row.status === "ok" || row.status === "limited") {
 			body = row.windows.map((window) => `${say(USAGE_TEXT.remaining, { label: window.label === "기간" ? say(USAGE_TEXT.period) : window.label, percent: window.remaining })}${window.resetsAt === null ? "" : say(USAGE_TEXT.reset, { time: stamp(window.resetsAt, timeZone) })}`).join(" · ");
+			if (row.status === "limited") body += say(USAGE_TEXT.limited, { detail: row.detail ?? say(USAGE_TEXT.unknown) });
 		} else if (row.status === "failed") body = say(USAGE_TEXT.failed, { detail: row.detail ?? say(USAGE_TEXT.unknown) });
 		else body = say(USAGE_TEXT[row.status]);
 		const recent = row.lastUsedAt === undefined ? "" : say(USAGE_TEXT.lastUsed, { time: stamp(row.lastUsedAt, timeZone) });
@@ -340,13 +350,14 @@ export function createUsageReport(deps: UsageDeps & {
 	now?: () => number;
 	timeZone?: string;
 }): () => Promise<string> {
+	const last = new Map<string, readonly UsageWindow[]>();
 	return async () => {
 		if (deps.inContainer) return `${say(USAGE_TEXT.title)}\n${say(USAGE_UNAVAILABLE)}`;
 		const auth = readJson(join(deps.dir, "auth.json"));
 		if ("missing" in auth) return `${say(USAGE_TEXT.title)}\n${say(USAGE_TEXT.emptyAuth)}`;
 		if ("broken" in auth) return `${say(USAGE_TEXT.title)}\n${say(USAGE_TEXT.brokenAuth)}`;
 		const pool = readJson(join(deps.dir, "credential-pool-state.json"));
-		const rows = await collectUsage(auth.value, "value" in pool ? pool.value : null, (deps.now ?? Date.now)(), deps);
+		const rows = await collectUsage(auth.value, "value" in pool ? pool.value : null, (deps.now ?? Date.now)(), deps, last);
 		return formatUsageReport(rows, deps.timeZone);
 	};
 }

package/src/work-watch.ts

@@ -116,6 +116,31 @@ const NOTE_QUIET_IN_TOOL: Text = { en: "No activity for over {duration} while a
 const NOTE_CANCEL_STOPPED: Text = { en: "The run stopped after the cancel command", ko: "취소 명령 뒤 실행이 멈췄습니다" };
 const NOTE_UNDELIVERED: Text = { en: "The command was not confirmed as received", ko: "명령 수신을 확인하지 못했습니다" };
 const NOTE_DELIVERY_CHECKING: Text = { en: "Confirming that the command was received", ko: "명령 수신을 확인하는 중입니다" };
+const NOTE_ADMISSION_FAILED: Text = { en: "The command could not be delivered to the work session", ko: "명령을 작업 세션에 전달하지 못했습니다" };
+/** Closures by housekeeping reconcile (bug 282): the stored reason says why, the note says it on the card. */
+const RECONCILE_NOTES: Readonly<Record<string, Text>> = {
+	reconcile_session_closed: { en: "Closed because the work session ended without a report", ko: "작업 세션이 보고 없이 닫혀 실패로 정리했습니다" },
+	reconcile_cancel_unreachable: { en: "Cancelled because the cancel command could not reach a work that was not running", ko: "실행 중이 아닌 작업에 취소 명령이 닿지 못해 취소로 정리했습니다" },
+};
+/** Confirm alerts from housekeeping reconcile (bug 282): main reads the summary and asks the operator; the stored reason stays the key. */
+const CONFIRM_TAIL: Text = {
+	en: "Ask the operator whether to cancel this work or send a new instruction. If the new instruction returns prior_command_unknown, send the cancel first.",
+	ko: "운영자에게 이 작업을 취소할지, 새 지시를 보낼지 물어봐 주세요. 새 지시가 prior_command_unknown으로 거부되면 취소를 먼저 보내 주세요.",
+};
+export const RECONCILE_CONFIRM_SUMMARIES: Readonly<Record<string, Text>> = {
+	reconcile_confirm_undelivered: {
+		en: `The last command was not confirmed as received by the work session. ${CONFIRM_TAIL.en}`,
+		ko: `마지막 명령을 작업 세션이 받았는지 확인하지 못했습니다. ${CONFIRM_TAIL.ko}`,
+	},
+	reconcile_confirm_no_report: {
+		en: `The work session stopped after receiving the command, but it sent no report. ${CONFIRM_TAIL.en}`,
+		ko: `작업 세션이 명령을 받은 뒤 보고 없이 멈췄습니다. ${CONFIRM_TAIL.ko}`,
+	},
+	reconcile_confirm_unreachable: {
+		en: `The last command could not reach the work session. ${CONFIRM_TAIL.en}`,
+		ko: `마지막 명령이 작업 세션에 닿지 못했습니다. ${CONFIRM_TAIL.ko}`,
+	},
+};
 const NOTE_REPORT: Text = { en: "Report: {summary}", ko: "보고: {summary}" };
 const NOTE_REQUEST_UNANSWERED: Text = { en: "The status report request got no response", ko: "상태 보고 요청에 응답이 없습니다" };
 const NOTE_REQUESTED: Text = { en: "Stopped without a report, so a status report was requested", ko: "보고 없이 멈춰 상태 보고를 요청했습니다" };
@@ -164,7 +189,10 @@ function storeState(work: WorkItem): WatchState {
 export function judge(input: JudgeInput, config: WatchConfig = DEFAULT_WATCH): Verdict {
 	const { work, commands, updates, live, now } = input;
 	const base = Date.parse(work.updatedAt);
-	if (TERMINAL.has(work.status)) return { state: work.status as WatchState, reason: "reported", since: base, next: Infinity };
+	if (TERMINAL.has(work.status)) {
+		const reconciled = work.statusReason?.startsWith("reconcile_") ? RECONCILE_NOTES[work.statusReason] : undefined;
+		return { state: work.status as WatchState, reason: "reported", ...(reconciled ? { note: say(reconciled) } : {}), since: base, next: Infinity };
+	}
 	// While OMO is away nothing new can be observed: show the record, judge nothing.
 	if (!input.ready) return { state: storeState(work), reason: "omo_not_ready", since: base, next: Infinity };
 	if (input.openDecisions > 0 || work.status === "waiting_input") {
@@ -183,6 +211,11 @@ export function judge(input: JudgeInput, config: WatchConfig = DEFAULT_WATCH): V
 		state: "waiting", waitingFor: "children", reason: "children_running",
 		note: say(NOTE_CHILDREN, { count: children }), since: waitSince, next,
 	});
+	// Bug 282: an admission failure leaves the command pending with its error and nothing retries it, so it is not
+	// being sent; this holds with or without runtime evidence (right after a restart there is none).
+	if (command.delivery === "pending" && command.error !== null) {
+		return { state: "unknown", reason: "command_admission_failed", note: say(NOTE_ADMISSION_FAILED), since: base, next: Infinity };
+	}
 	// Without confirmed runtime evidence (no event, no reconciliation yet) the watcher shows the record and never acts.
 	if (live.streaming === null) return { state: storeState(work), reason: "runtime_unknown", since: base, next: Infinity };
 
@@ -307,6 +340,11 @@ export class WorkWatcher {
 		return live;
 	}
 
+	/** Active child tasks of a work from its live signals; null when none were seen since OMO came back (unknown). */
+	children(workId: string): number | null {
+		return this.lives.get(workId)?.children?.active ?? null;
+	}
+
 	/** OMO is away: forget every live signal; judge and act on nothing. */
 	pause(): void {
 		if (this.stopped) return;
@@ -412,18 +450,28 @@ export class WorkWatcher {
 				if (event.success !== false || event.finalError === "Retry cancelled") return false;
 				live.lastError = { kind: "retry_exhausted", message: typeof event.finalError === "string" ? event.finalError : say(ERROR_LABELS.retry_exhausted), at: now };
 				return true;
-			case "extension_event": {
+			case "extension_event":
 				if (event.name !== "omo.task.updated" || !record(event.data) || !Array.isArray(event.data.tasks)) return false;
-				const active = event.data.tasks.filter((task) => record(task) && (task.status === "pending" || task.status === "running")).length;
-				const before = live.children?.active;
-				live.children = { active, at: now };
-				return before !== active;
-			}
+				return this.setChildren(live, event.data.tasks, now);
 			default:
 				return false;
 		}
 	}
 
+	/** Counts the running sub-tasks of a task list; true when the count changed. */
+	private setChildren(live: Live, tasks: readonly unknown[], now: number): boolean {
+		const active = tasks.filter((task) => record(task) && (task.status === "pending" || task.status === "running")).length;
+		const before = live.children?.active;
+		live.children = { active, at: now };
+		return before !== active;
+	}
+
+	/** OMO's child-task list answered at a bind (bug 282, F3 F-1): sets the count like `omo.task.updated`, not activity. */
+	childTasks(workId: string, tasks: readonly unknown[]): void {
+		if (!this.observing) return;
+		if (this.setChildren(this.live(workId), tasks, this.clock())) this.schedule();
+	}
+
 	/** A reconciliation read the native isStreaming. */
 	runtime(workId: string, streaming: boolean): void {
 		if (!this.observing) return;

package/src/work.ts

@@ -5,6 +5,11 @@ import { OmoCommandError, type OmoClient, type OmoEvent, type OmoStatus } from "
 import { DecisionStoreError, Store, WorkStoreError, type LedgerState, type MainInput, type StoredEvent, type WorkCommand, type WorkItem, type WorkReport, type WorkUpdateKind } from "./store.ts";
 import { nativeReplyEntry, type NativeReplyEntry, type NativeReplyObserver } from "./reply-notifications.ts";
 import { notificationHistory } from "./notification-history.ts";
+import type { AuditLine, AuditSink } from "./housekeeping/audit.ts";
+import { reconcileWorkId, type ReconcileItem } from "./housekeeping/collectors/reconcile-work.ts";
+import { say } from "./server-text.ts";
+import { RECONCILE_CONFIRM_SUMMARIES } from "./work-watch.ts";
+import { classify, retryableRefusal, type ReconcileEvidence, type ReconcileVerdict } from "./housekeeping/reconcile/work.ts";
 
 const ACK_TIMEOUT_MS = 30_000;
 const PREFIX = "ZGW_WORK_COMMAND ";
@@ -15,7 +20,7 @@ type Session = { sessionId: string; sessionPath?: string; status: string };
 type State = {
 	isStreaming?: boolean; steering?: string[]; followUp?: string[];
 	ordered?: { text: string; mode?: string; clientInputId?: string }[];
-	pendingQuestions?: OmoEvent[]; atomicQueuedResume?: boolean; queueEpoch?: string;
+	pendingQuestions?: OmoEvent[]; atomicQueuedResume?: boolean; queueEpoch?: string; sessionId?: string;
 };
 type Entry = NativeReplyEntry & { id: string; type: string; customType?: string; data?: unknown };
 export interface WorkSessionOwner {
@@ -25,6 +30,8 @@ export interface WorkSessionOwner {
 	readonly sessionPath: string;
 }
 type Binding = { sessionId: string; generation: number; questions: Set<string>; owner: WorkSessionOwner };
+/** The last get_state of a bound work session: native isStreaming, when it was read, and which commands it showed. */
+type StateRead = { isStreaming: boolean; stateReadAt: string; matched: ReadonlySet<string> };
 export interface WorkRequest {
 	operation: "start" | "send" | "list" | "get" | "cancel" | "report" | "publish" | "precomment";
 	requestKey: string;
@@ -44,6 +51,8 @@ export interface WorkRouterOptions {
 	/** Synchronous: release this exact old binding; never infer an owner from a later event. */
 	onUnbound?(owner: WorkSessionOwner, reason: "parked" | "closed" | "disconnected" | "stopped"): void;
 	onUiEvent?(owner: WorkSessionOwner, event: OmoEvent): void;
+	/** Bug 236: OMO queued an instruction (not a watcher status request) behind the work's running turn. */
+	onInstructionQueued?(owner: WorkSessionOwner): void;
 	onDecisionsChanged?(): void;
 	onSettled?(owner: WorkSessionOwner): void;
 	/** Every event of a currently bound work session, for the work watcher's live signals. */
@@ -54,6 +63,14 @@ export interface WorkRouterOptions {
 	mainLedger?(conv: string, sessionId: string): Promise<LedgerState | null>;
 	/** Production uses the locked 30s bound. Tests may exercise the timeout at a shorter bound. */
 	ackTimeoutMs?: number;
+	/** Active child tasks of a work, from the watcher's live signals; null or absent = unknown, which never allows a closure. */
+	children?(workId: string): number | null;
+	/** OMO's child-task list of a work session (`omo.task.list`, the `omo.task.updated` tasks), asked at every bind. */
+	onChildTasks?(workId: string, tasks: readonly unknown[]): void;
+	/** Housekeeping audit log: one line per reconcile closure (or refused closure) and per new confirm alert. */
+	audit?: AuditSink;
+	/** The reconcile items changed; housekeeping rescans its reconcile-work collector. */
+	onReconciled?(): void;
 }
 class RoutingError extends Error {
 	constructor(readonly code: string, readonly status = 409) { super(code); }
@@ -114,6 +131,12 @@ export class WorkRouter {
 	private readonly reconciliations = new Map<string, Promise<void>>();
 	private readonly scheduled = new Set<string>();
 	private readonly pendingUi = new Map<string, OmoEvent[]>();
+	// Reconcile evidence of the current OMO generation (bug 282); cleared whenever the generation changes.
+	private readonly refused = new Map<string, { error: string; retryable: boolean }>();
+	private readonly admissionFailed = new Map<string, Set<string>>();
+	private readonly lifecycle = new Map<string, { kind: "closed"; reason: string; at: string }>();
+	private readonly lastState = new Map<string, StateRead>();
+	private readonly reconciled = new Map<string, ReconcileItem>();
 	private wholeReads: Promise<unknown> = Promise.resolve();
 	private generation = 0;
 	private stopped = false;
@@ -151,6 +174,8 @@ export class WorkRouter {
 		const binding = this.bindings.get(workId);
 		if (!binding) return;
 		this.bindings.delete(workId);
+		// A parked or closed session's last state is not evidence about the work any more.
+		this.lastState.delete(workId);
 		this.pendingUi.delete(binding.sessionId);
 		this.options.onUnbound?.(binding.owner, reason);
 	}
@@ -402,7 +427,11 @@ export class WorkRouter {
 		if (!this.ready) return;
 		const previous = this.flights.get(workId);
 		if (previous) return previous;
-		const flight = this.transmit(workId).finally(() => { if (this.flights.get(workId) === flight) this.flights.delete(workId); });
+		const generation = this.generation;
+		// T1: reconcile runs once the flight is gone, so it sees this generation's settled dispatch.
+		const flight: Promise<void> = this.transmit(workId)
+			.finally(() => { if (this.flights.get(workId) === flight) this.flights.delete(workId); })
+			.finally(() => this.reconcileAfterDispatch(workId, generation));
 		this.flights.set(workId, flight);
 		return flight;
 	}
@@ -420,6 +449,11 @@ export class WorkRouter {
 			try { binding = await this.ensure(this.work(workId)); }
 			catch (error) {
 				if (!this.stopped) {
+					if (generation === this.generation) {
+						this.refuse(workId, error);
+						const failed = this.admissionFailed.get(workId) ?? new Set<string>();
+						this.admissionFailed.set(workId, failed.add(command.id));
+					}
 					this.store.setWorkCommandDelivery(command.id, "pending", { error: errorText(error) });
 					this.notify(workId);
 				}
@@ -445,6 +479,9 @@ export class WorkRouter {
 				this.store.setWorkCommandDelivery(command.id, "accepted", { disposition: interrupt ? "turn_aborted_cleanup_unconfirmed" : typeof data?.disposition === "string" ? data.disposition : "prompt_ack" });
 				this.notify(workId);
 				if (!interrupt && data?.disposition === "queued" && this.current(workId, binding)) {
+					if (command.kind === "instruct" && !(record(command.payload) && command.payload.watcher === "status_request")) {
+						this.options.onInstructionQueued?.(binding.owner);
+					}
 					void this.omo.command<State>("get_state", { sessionId: binding.sessionId })
 						.then((state) => { if (this.current(workId, binding)) this.resumeQueuedCommand(workId, binding, state); })
 						.catch((error) => this.fail(error));
@@ -492,10 +529,14 @@ export class WorkRouter {
 			};
 			const binding: Binding = { sessionId: opened.sessionId, generation, questions: new Set(), owner };
 			this.bindings.set(work.id, binding);
+			this.refused.delete(work.id);
+			this.admissionFailed.delete(work.id);
+			this.lifecycle.delete(work.id);
 			this.options.onBound?.(owner, opened.state?.pendingQuestions ?? []);
 			const replay = this.pendingUi.get(opened.sessionId) ?? [];
 			this.pendingUi.delete(opened.sessionId);
 			for (const event of replay) this.onEvent(event);
+			this.learnChildren(work.id, binding, opened.state?.sessionId);
 			return binding;
 		}).finally(() => {
 			if (this.opening.get(work.id) === promise) this.opening.delete(work.id);
@@ -505,6 +546,25 @@ export class WorkRouter {
 		return promise;
 	}
 
+	/**
+	 * Bug 282 (F3 F-1): a bind starts with the child-task count unknown, and an idle work without sub-tasks sends no later
+	 * `omo.task.updated` (its snapshot at session start arrives before the open ACK, while the session is unbound). So every
+	 * bind asks OMO once, by the durable session id. An answer without a task list (an OMO without `omo.task.list`,
+	 * not_found) or no answer leaves the count unknown, which keeps closures off. Known children re-run the T1 evaluation.
+	 */
+	private learnChildren(workId: string, binding: Binding, durableSessionId: string | undefined): void {
+		if (typeof durableSessionId !== "string") return;
+		void this.omo.command<unknown>("extension_request", { sessionId: binding.sessionId, name: "omo.task.list", data: { parent_session_id: durableSessionId } })
+			.then((answer) => {
+				if (!this.current(workId, binding) || !record(answer) || !Array.isArray(answer.tasks)) return;
+				this.options.onChildTasks?.(workId, answer.tasks);
+				this.schedule(workId);
+			}, (error: unknown) => {
+				// A refusal (no such request on this OMO) is OMO's answer that it cannot tell: the count stays unknown.
+				if (!(error instanceof OmoCommandError)) this.fail(error);
+			});
+	}
+
 	/** The one unbounded response this router asks for: one whole-session read in flight at a time, across works. */
 	private wholeSession(sessionId: string, live: () => boolean): Promise<Entry[] | null> {
 		const read = this.wholeReads.then(() => live()
@@ -605,6 +665,7 @@ export class WorkRouter {
 			}),
 			this.omo.command<State>("get_state", { sessionId: binding.sessionId }),
 		]);
+		const stateReadAt = new Date().toISOString();
 		if (!entries || !this.current(workId, binding)) return;
 		if (replyRevision !== undefined) this.options.replies?.observe({ sessionPath: work.sessionPath, conv: work.ownerConv, workId, title: work.title }, entries, replyRevision);
 		if (typeof state.isStreaming === "boolean") this.options.onRuntime?.(workId, state.isStreaming);
@@ -615,6 +676,10 @@ export class WorkRouter {
 			}
 		}
 		const evidence = [...queue(state), ...entries.filter((e) => e.type === "message" && e.message?.role === "user").map((e) => messageText(e.message?.content))];
+		if (typeof state.isStreaming === "boolean") {
+			const matched = new Set(this.store.listWorkCommands(workId).filter((command) => evidence.some((value) => this.matches(value, command))).map((command) => command.id));
+			this.lastState.set(workId, { isStreaming: state.isStreaming, stateReadAt, matched });
+		}
 		for (const command of this.store.listWorkCommands(workId)) {
 			if (["pending", "sending", "unknown"].includes(command.delivery) && evidence.some((value) => this.matches(value, command))) this.store.setWorkCommandDelivery(command.id, "accepted", { disposition: "command_envelope" });
 		}
@@ -700,12 +765,19 @@ export class WorkRouter {
 				this.store.observeWork(workId, "unknown", "session_closed");
 				this.notify(workId);
 			}
+			// Parked (handoff_parked) is not failure, and a generation slot removal is not this session's loss.
+			if (event.type === "session_closed" && typeof event.reason === "string" && event.reason !== "handoff_parked" &&
+				event.reason !== "generation_ended" && event.synthetic !== true) {
+				this.lifecycle.set(workId, { kind: "closed", reason: event.reason, at: new Date().toISOString() });
+			}
+			this.schedule(workId); // T4
 		}
 		// senpi publishes agent_settled (reason session_closed) before it seals a session closed or
 		// parked mid-turn; that session can no longer be read, and its lifecycle event follows.
 		else if (event.type === "agent_settled" && event.reason !== "session_closed") {
 			void this.reconcile(workId).then(() => {
 				if (this.current(workId, binding)) this.options.onSettled?.(binding.owner);
+				this.schedule(workId); // T3
 			}).catch((error) => this.fail(error));
 		}
 		return true;
@@ -720,6 +792,7 @@ export class WorkRouter {
 			const attached = new Set(this.bindings.keys());
 			this.generation++;
 			for (const workId of [...this.bindings.keys()]) this.unbind(workId, "disconnected");
+			this.clearEvidence();
 			this.opening.clear();
 			this.pendingUi.clear();
 			const affected: string[] = [];
@@ -768,7 +841,14 @@ export class WorkRouter {
 					}
 					continue;
 				}
-				await this.reconcile(work.id);
+				try {
+					await this.reconcile(work.id);
+				} catch (error) {
+					// T2: the refusal is reconcile evidence; dispatch still runs so T1 evaluates it.
+					if (generation === this.generation) this.refuse(work.id, error);
+					this.schedule(work.id);
+					throw error;
+				}
 				this.schedule(work.id);
 			} catch (error) { this.fail(error); }
 		}
@@ -780,6 +860,115 @@ export class WorkRouter {
 		this.stopped = true;
 		this.generation++;
 		for (const workId of [...this.bindings.keys()]) this.unbind(workId, "stopped");
+		this.clearEvidence();
 		this.pendingUi.clear();
 	}
+
+	/** The router's current reconcile closures and pending confirms, for the housekeeping reconcile-work collector. */
+	reconcileItems(): ReconcileItem[] {
+		return [...this.reconciled.values()].filter((item) => this.stillClosed(item) ||
+			(item.kind === "confirm" && !["completed", "failed", "cancelled"].includes(this.store.getWork(item.workId)?.status ?? "completed")));
+	}
+
+	/** A closure stays listed until the work is reopened (a new instruct) or otherwise leaves that closed state. */
+	private stillClosed(item: ReconcileItem): boolean {
+		return item.kind === "close" && this.store.getWork(item.workId)?.statusReason === item.reason;
+	}
+
+	private clearEvidence(): void {
+		this.refused.clear();
+		this.admissionFailed.clear();
+		this.lifecycle.clear();
+		this.lastState.clear();
+	}
+
+	private refuse(workId: string, error: unknown): void {
+		const typed = error instanceof OmoCommandError;
+		const data = typed && record(error.errorData) ? error.errorData : null;
+		const retryAfterMs = typeof data?.retry_after_ms === "number" ? data.retry_after_ms : null;
+		this.refused.set(workId, { error: errorText(error), retryable: retryableRefusal(typed ? error.code : null, retryAfterMs) });
+	}
+
+	/** Evidence for the classifier, exactly as the field comments of ReconcileEvidence define it. */
+	private collect(workId: string, generation: number): ReconcileEvidence | null {
+		const work = this.store.getWork(workId);
+		if (!work) return null;
+		const commands = this.store.listWorkCommands(workId);
+		const latest = commands.at(-1);
+		const state = this.lastState.get(workId);
+		const inSession = (id: string) => state ? state.matched.has(id) : null;
+		const reported = new Set(this.store.listWorkUpdates(workId)
+			.filter((u) => reportKinds.has(u.kind) && !(record(u.details) && u.details.source === "watcher")).map((u) => u.commandSeq));
+		const blocked = latest?.delivery === "pending" ? commands.filter((c) => c.seq < latest.seq && c.delivery === "unknown").at(-1) : undefined;
+		const refused = this.refused.get(workId);
+		return {
+			status: work.status,
+			latest: latest ? {
+				id: latest.id, seq: latest.seq, kind: latest.kind, delivery: latest.delivery, error: latest.error, createdAt: latest.createdAt, acceptedAt: latest.acceptedAt,
+				admissionFailed: this.admissionFailed.get(workId)?.has(latest.id) ?? false, inSession: inSession(latest.id), reported: reported.has(latest.seq),
+			} : null,
+			blockedBy: blocked ? { id: blocked.id, seq: blocked.seq, delivery: blocked.delivery, inSession: inSession(blocked.id) } : null,
+			omoReady: this.ready,
+			evaluatedAfterDispatch: generation === this.generation,
+			session: refused ? { kind: "refused", retryable: refused.retryable, error: refused.error }
+				: state ? { kind: "readable", isStreaming: state.isStreaming, stateReadAt: state.stateReadAt } : { kind: "unread" },
+			lifecycle: this.lifecycle.get(workId) ?? null,
+			children: this.options.children?.(workId) ?? null,
+			openDecisions: this.store.unresolvedWorkDecisions(workId),
+			inFlight: this.flights.has(workId),
+		};
+	}
+
+	/** T1. Never sends a command; a cancel that is not accepted gets one fresh read first. */
+	private async reconcileAfterDispatch(workId: string, generation: number): Promise<void> {
+		try {
+			if (!this.ready || generation !== this.generation) return;
+			const latest = this.store.listWorkCommands(workId).at(-1);
+			const open = !["completed", "failed", "cancelled"].includes(this.store.getWork(workId)?.status ?? "completed");
+			if (open && latest?.kind === "cancel" && latest.delivery !== "accepted") {
+				try { await this.reconcile(workId); } catch (error) { if (generation === this.generation) this.refuse(workId, error); }
+			}
+			const evidence = this.collect(workId, generation);
+			if (evidence) this.applyVerdict(workId, evidence, classify(evidence));
+		} catch (error) { this.fail(error); }
+	}
+
+	private applyVerdict(workId: string, evidence: ReconcileEvidence, verdict: ReconcileVerdict): void {
+		const latest = evidence.latest;
+		if (verdict.kind === "keep" || !latest) {
+			const held = this.reconciled.get(workId);
+			if (held && !this.stillClosed(held)) {
+				this.reconciled.delete(workId);
+				this.options.onReconciled?.();
+			}
+			return;
+		}
+		const id = reconcileWorkId({ reason: verdict.reason, commandId: latest.id });
+		const item = (status: ReconcileItem["status"]): ReconcileItem => ({ workId, title: this.work(workId).title, kind: verdict.kind, reason: verdict.reason,
+			status, commandId: latest.id, commandSeq: latest.seq, evidence: verdict.evidence, at: new Date().toISOString() });
+		if (verdict.kind === "close") {
+			const closed = this.store.closeByReconcile(workId, latest.seq, verdict.status, verdict.reason, verdict.evidence);
+			this.audit({ id, target: workId, verdict: "act", evidence: verdict.evidence, method: "state", ok: closed !== null, ...(closed ? {} : { error: "close_refused" }) });
+			if (!closed) return;
+			this.reconciled.set(workId, item(closed.status));
+			this.notify(workId);
+			this.options.onReconciled?.();
+			return;
+		}
+		const alert = this.store.recordWatchAlert(workId, { sourceKey: id, commandSeq: latest.seq,
+			summary: RECONCILE_CONFIRM_SUMMARIES[verdict.reason] ? say(RECONCILE_CONFIRM_SUMMARIES[verdict.reason]!) : verdict.reason,
+			details: { ...verdict.evidence, source: "watcher", reconcile: true, requiresUserAction: true } });
+		this.reconciled.set(workId, item(evidence.status));
+		if (alert) {
+			this.audit({ id, target: workId, verdict: "confirm", evidence: verdict.evidence, method: null, ok: true });
+			this.options.onUpdate?.(this.work(workId));
+		}
+		this.options.onReconciled?.();
+	}
+
+	private audit(line: Pick<AuditLine, "id" | "target" | "verdict" | "evidence" | "method" | "ok" | "error">): void {
+		try {
+			this.options.audit?.append({ at: new Date().toISOString(), trigger: "work_event", actor: "reconcile", collector: "reconcile-work", ...line });
+		} catch (error) { this.fail(error); }
+	}
 }

package/web/DESIGN.md

@@ -49,7 +49,8 @@ former 72px rail, widened by 200px on 2026-10-04 for the 작업 상태 drawing;
 below 1280px, 200px at 900px and below). The profile block is split in two halves. The left half shows the owner's nickname (double-click edits it:
 Enter or leaving saves, Esc cancels); the gateway keeps it (`GET/PUT /api/profile`, `profile.updated`) and the
 same name labels the user's chat messages, their avatar letter and the 작업 상태 user card. The right half shows the
-agent's (gateway main) name with the Zig icon and the same editing (`agentName` in the same API; default "지그"; at most
+agent's (gateway main) name with the Zig icon and the same editing (`agentName` in the same API; the gateway stores the default "지그" or "Zig" of its language once at first start, and the
+name is never translated afterwards (bug 271); at most
 20 display-width units, Hangul/CJK 2 and ASCII 1; a name too wide stays red and is not saved). The main session reads
 the name at the start of each turn, and the 작업 상태 hub shows it when WebGL is unavailable. The conversation list keeps at least 140px; the 작업 상태 drawing shrinks before it does.
 
@@ -178,3 +179,36 @@ remain visible. No animation, network, remote fonts, new settings or exports.
 Source foldouts retain their local open state across streaming updates.
 Desktop/phone light/dark, enlarged text, source/copy and reference QA belong
 to the parent integration lane; local unit checks do not claim visual approval.
+
+## 11. Agent collaboration cards and targets (292, C-10)
+Brief. Primary action: none by default; 요청 취소 is the one prominent (danger) control and appears only while a request
+can still move. Priorities: 1) who asked whom and the request text, 2) the state word, 3) the result and its files.
+Left out on purpose: a per-request avatar row, a progress bar, a duplicate state badge in the head of the transcript,
+and any success wording for an action the gateway refused.
+Layout: one `collaboration-card` per request (`data-request-id`), a block in the message list aligned with message text
+(68px left, 640px max; 16px/8px margins and full width at 640px and below); the message list stays the only scroll owner.
+The card is drawn at the first stored event that names the request (`message.collaboration`) and is updated in place by
+later events (`agent.collaboration.status`, the reply, blocked/delivery notes) and by the owner listing
+(`GET /api/agent-collaboration/requests?conv=`), which is the gateway's truth for kind, state and revision; a replayed
+event never adds a second card. web/collaboration.js decides, app.js draws.
+Tokens: the existing `--bg-card`, `--bg-input`, `--border`, `--text`, `--muted`, `--ok`, `--warn`, `--danger`, the
+1px #4e5058 hairline and 4px/6px radii; no side stripe. The state is a dot plus a monospace word, never colour alone:
+ok (완료), busy (대기 중, 진행 중, 다른 에이전트의 답 대기, 결과 준비 중), warn (내 답 대기, 취소 요청됨, 전달 미확인, 정의
+변경으로 미실행, 상태 미확인), danger (실패, 중단됨, 취소됨). An unknown or unconfirmed state never reads as done.
+Head: title (보낸/받은 협업 요청), kind tag (작업/질문, from the listing), state, time. Parties: 보낸 쪽 → 받는 쪽; the
+sender of a received request is its actor, the recipient of a sent request reads 다른 에이전트 until the gateway names it.
+Body: the request text as DOM text; 요청과 함께 보낸 파일 and the 결과 files as rows (`data-artifact-id`, name, size,
+내려받기); the result text or 회신에 본문이 없습니다; 회신 보냄 on the answering side; notes for waiting owner, blocked,
+unconfirmed delivery and definition change. A status line (`role=status`) under the body carries the last action's
+answer. Actions: 요청 취소 (`data-action=collaboration-cancel`, needs the listing's revision), 다시 확인
+(`collaboration-recheck`), 내려받기 (`collaboration-download`, saved only when the gateway's sha256 header and the
+browser's digest match the manifest). Owner actions answered 503 `owner_auth_unavailable` by the gateway are shown as
+"not available yet", never as success. Controls keep 24px (44px on phones) targets and the #a3acff focus ring.
+Agent editor: the gateway's `collaboration` group and `collaboration.targets` rows are drawn (the registry marks them
+hidden for older webs) as a check list of the other agents by name (`pe-skills pe-targets`, the skills list's shape),
+never the agent itself; a saved id the list no longer carries stays checked with a 없음 tag. Knowledge files: a source/
+file carries its origin tag (직접 올림 or 협업 사본, the latter in the accent ink) and the copy's delete confirmation says
+only this copy goes. Dictionaries: `collab.*`, `agents.targets.*`, `agents.file.origin.*` in web/i18n/agents.js.
+Verification: test/unit/agent-collaboration-web.test.ts (guards doubling as mutation watchers in
+test/mutation/agent-collaboration-web.test.ts) and the Aside browser QA test/fixtures/agent-collaboration-web-qa.ts at
+1440x900 and 390x844 in both colour schemes (the UI ships one dark palette; light is the media emulation).