zigmini 1.0.0-beta.3 → 1.1.0-beta.1

package/src/test-crash.ts

@@ -0,0 +1,20 @@
+import { writeSync } from "node:fs";
+
+/** The named process-stop boundaries of the Q-10 restart contract (test/contract/agent-collaboration-gaps-restart.contract.test.ts). */
+export type TestCrashPoint =
+	| "collaboration.admission.before-commit"
+	| "collaboration.admission.after-commit"
+	| "collaboration.input.rpc-written"
+	| "collaboration.result.committed";
+
+/**
+ * Test-only crash seam. Production never sets ZGW_TEST_CRASH_AT, so this returns at once there. When a restart contract
+ * test sets it to one point, the gateway writes `ZGW_TEST_CRASH_POINT <point>` synchronously to stderr and stops itself
+ * (SIGSTOP) at that exact boundary; the test then SIGKILLs the stopped process. Nothing runs between the boundary and the
+ * kill, so a pending transaction stays uncommitted and no later callback or socket frame is processed.
+ */
+export function testCrashPoint(point: TestCrashPoint): void {
+	if (process.env.ZGW_TEST_CRASH_AT !== point) return;
+	writeSync(2, `ZGW_TEST_CRASH_POINT ${point}\n`);
+	process.kill(process.pid, "SIGSTOP");
+}

package/src/work-watch.ts

@@ -116,6 +116,31 @@ const NOTE_QUIET_IN_TOOL: Text = { en: "No activity for over {duration} while a
 const NOTE_CANCEL_STOPPED: Text = { en: "The run stopped after the cancel command", ko: "취소 명령 뒤 실행이 멈췄습니다" };
 const NOTE_UNDELIVERED: Text = { en: "The command was not confirmed as received", ko: "명령 수신을 확인하지 못했습니다" };
 const NOTE_DELIVERY_CHECKING: Text = { en: "Confirming that the command was received", ko: "명령 수신을 확인하는 중입니다" };
+const NOTE_ADMISSION_FAILED: Text = { en: "The command could not be delivered to the work session", ko: "명령을 작업 세션에 전달하지 못했습니다" };
+/** Closures by housekeeping reconcile (bug 282): the stored reason says why, the note says it on the card. */
+const RECONCILE_NOTES: Readonly<Record<string, Text>> = {
+	reconcile_session_closed: { en: "Closed because the work session ended without a report", ko: "작업 세션이 보고 없이 닫혀 실패로 정리했습니다" },
+	reconcile_cancel_unreachable: { en: "Cancelled because the cancel command could not reach a work that was not running", ko: "실행 중이 아닌 작업에 취소 명령이 닿지 못해 취소로 정리했습니다" },
+};
+/** Confirm alerts from housekeeping reconcile (bug 282): main reads the summary and asks the operator; the stored reason stays the key. */
+const CONFIRM_TAIL: Text = {
+	en: "Ask the operator whether to cancel this work or send a new instruction. If the new instruction returns prior_command_unknown, send the cancel first.",
+	ko: "운영자에게 이 작업을 취소할지, 새 지시를 보낼지 물어봐 주세요. 새 지시가 prior_command_unknown으로 거부되면 취소를 먼저 보내 주세요.",
+};
+export const RECONCILE_CONFIRM_SUMMARIES: Readonly<Record<string, Text>> = {
+	reconcile_confirm_undelivered: {
+		en: `The last command was not confirmed as received by the work session. ${CONFIRM_TAIL.en}`,
+		ko: `마지막 명령을 작업 세션이 받았는지 확인하지 못했습니다. ${CONFIRM_TAIL.ko}`,
+	},
+	reconcile_confirm_no_report: {
+		en: `The work session stopped after receiving the command, but it sent no report. ${CONFIRM_TAIL.en}`,
+		ko: `작업 세션이 명령을 받은 뒤 보고 없이 멈췄습니다. ${CONFIRM_TAIL.ko}`,
+	},
+	reconcile_confirm_unreachable: {
+		en: `The last command could not reach the work session. ${CONFIRM_TAIL.en}`,
+		ko: `마지막 명령이 작업 세션에 닿지 못했습니다. ${CONFIRM_TAIL.ko}`,
+	},
+};
 const NOTE_REPORT: Text = { en: "Report: {summary}", ko: "보고: {summary}" };
 const NOTE_REQUEST_UNANSWERED: Text = { en: "The status report request got no response", ko: "상태 보고 요청에 응답이 없습니다" };
 const NOTE_REQUESTED: Text = { en: "Stopped without a report, so a status report was requested", ko: "보고 없이 멈춰 상태 보고를 요청했습니다" };
@@ -164,7 +189,10 @@ function storeState(work: WorkItem): WatchState {
 export function judge(input: JudgeInput, config: WatchConfig = DEFAULT_WATCH): Verdict {
 	const { work, commands, updates, live, now } = input;
 	const base = Date.parse(work.updatedAt);
-	if (TERMINAL.has(work.status)) return { state: work.status as WatchState, reason: "reported", since: base, next: Infinity };
+	if (TERMINAL.has(work.status)) {
+		const reconciled = work.statusReason?.startsWith("reconcile_") ? RECONCILE_NOTES[work.statusReason] : undefined;
+		return { state: work.status as WatchState, reason: "reported", ...(reconciled ? { note: say(reconciled) } : {}), since: base, next: Infinity };
+	}
 	// While OMO is away nothing new can be observed: show the record, judge nothing.
 	if (!input.ready) return { state: storeState(work), reason: "omo_not_ready", since: base, next: Infinity };
 	if (input.openDecisions > 0 || work.status === "waiting_input") {
@@ -183,6 +211,11 @@ export function judge(input: JudgeInput, config: WatchConfig = DEFAULT_WATCH): V
 		state: "waiting", waitingFor: "children", reason: "children_running",
 		note: say(NOTE_CHILDREN, { count: children }), since: waitSince, next,
 	});
+	// Bug 282: an admission failure leaves the command pending with its error and nothing retries it, so it is not
+	// being sent; this holds with or without runtime evidence (right after a restart there is none).
+	if (command.delivery === "pending" && command.error !== null) {
+		return { state: "unknown", reason: "command_admission_failed", note: say(NOTE_ADMISSION_FAILED), since: base, next: Infinity };
+	}
 	// Without confirmed runtime evidence (no event, no reconciliation yet) the watcher shows the record and never acts.
 	if (live.streaming === null) return { state: storeState(work), reason: "runtime_unknown", since: base, next: Infinity };
 
@@ -307,6 +340,11 @@ export class WorkWatcher {
 		return live;
 	}
 
+	/** Active child tasks of a work from its live signals; null when none were seen since OMO came back (unknown). */
+	children(workId: string): number | null {
+		return this.lives.get(workId)?.children?.active ?? null;
+	}
+
 	/** OMO is away: forget every live signal; judge and act on nothing. */
 	pause(): void {
 		if (this.stopped) return;
@@ -412,18 +450,28 @@ export class WorkWatcher {
 				if (event.success !== false || event.finalError === "Retry cancelled") return false;
 				live.lastError = { kind: "retry_exhausted", message: typeof event.finalError === "string" ? event.finalError : say(ERROR_LABELS.retry_exhausted), at: now };
 				return true;
-			case "extension_event": {
+			case "extension_event":
 				if (event.name !== "omo.task.updated" || !record(event.data) || !Array.isArray(event.data.tasks)) return false;
-				const active = event.data.tasks.filter((task) => record(task) && (task.status === "pending" || task.status === "running")).length;
-				const before = live.children?.active;
-				live.children = { active, at: now };
-				return before !== active;
-			}
+				return this.setChildren(live, event.data.tasks, now);
 			default:
 				return false;
 		}
 	}
 
+	/** Counts the running sub-tasks of a task list; true when the count changed. */
+	private setChildren(live: Live, tasks: readonly unknown[], now: number): boolean {
+		const active = tasks.filter((task) => record(task) && (task.status === "pending" || task.status === "running")).length;
+		const before = live.children?.active;
+		live.children = { active, at: now };
+		return before !== active;
+	}
+
+	/** OMO's child-task list answered at a bind (bug 282, F3 F-1): sets the count like `omo.task.updated`, not activity. */
+	childTasks(workId: string, tasks: readonly unknown[]): void {
+		if (!this.observing) return;
+		if (this.setChildren(this.live(workId), tasks, this.clock())) this.schedule();
+	}
+
 	/** A reconciliation read the native isStreaming. */
 	runtime(workId: string, streaming: boolean): void {
 		if (!this.observing) return;

package/src/work.ts

@@ -5,6 +5,11 @@ import { OmoCommandError, type OmoClient, type OmoEvent, type OmoStatus } from "
 import { DecisionStoreError, Store, WorkStoreError, type LedgerState, type MainInput, type StoredEvent, type WorkCommand, type WorkItem, type WorkReport, type WorkUpdateKind } from "./store.ts";
 import { nativeReplyEntry, type NativeReplyEntry, type NativeReplyObserver } from "./reply-notifications.ts";
 import { notificationHistory } from "./notification-history.ts";
+import type { AuditLine, AuditSink } from "./housekeeping/audit.ts";
+import { reconcileWorkId, type ReconcileItem } from "./housekeeping/collectors/reconcile-work.ts";
+import { say } from "./server-text.ts";
+import { RECONCILE_CONFIRM_SUMMARIES } from "./work-watch.ts";
+import { classify, retryableRefusal, type ReconcileEvidence, type ReconcileVerdict } from "./housekeeping/reconcile/work.ts";
 
 const ACK_TIMEOUT_MS = 30_000;
 const PREFIX = "ZGW_WORK_COMMAND ";
@@ -15,7 +20,7 @@ type Session = { sessionId: string; sessionPath?: string; status: string };
 type State = {
 	isStreaming?: boolean; steering?: string[]; followUp?: string[];
 	ordered?: { text: string; mode?: string; clientInputId?: string }[];
-	pendingQuestions?: OmoEvent[]; atomicQueuedResume?: boolean; queueEpoch?: string;
+	pendingQuestions?: OmoEvent[]; atomicQueuedResume?: boolean; queueEpoch?: string; sessionId?: string;
 };
 type Entry = NativeReplyEntry & { id: string; type: string; customType?: string; data?: unknown };
 export interface WorkSessionOwner {
@@ -25,6 +30,8 @@ export interface WorkSessionOwner {
 	readonly sessionPath: string;
 }
 type Binding = { sessionId: string; generation: number; questions: Set<string>; owner: WorkSessionOwner };
+/** The last get_state of a bound work session: native isStreaming, when it was read, and which commands it showed. */
+type StateRead = { isStreaming: boolean; stateReadAt: string; matched: ReadonlySet<string> };
 export interface WorkRequest {
 	operation: "start" | "send" | "list" | "get" | "cancel" | "report" | "publish" | "precomment";
 	requestKey: string;
@@ -44,6 +51,8 @@ export interface WorkRouterOptions {
 	/** Synchronous: release this exact old binding; never infer an owner from a later event. */
 	onUnbound?(owner: WorkSessionOwner, reason: "parked" | "closed" | "disconnected" | "stopped"): void;
 	onUiEvent?(owner: WorkSessionOwner, event: OmoEvent): void;
+	/** Bug 236: OMO queued an instruction (not a watcher status request) behind the work's running turn. */
+	onInstructionQueued?(owner: WorkSessionOwner): void;
 	onDecisionsChanged?(): void;
 	onSettled?(owner: WorkSessionOwner): void;
 	/** Every event of a currently bound work session, for the work watcher's live signals. */
@@ -54,6 +63,14 @@ export interface WorkRouterOptions {
 	mainLedger?(conv: string, sessionId: string): Promise<LedgerState | null>;
 	/** Production uses the locked 30s bound. Tests may exercise the timeout at a shorter bound. */
 	ackTimeoutMs?: number;
+	/** Active child tasks of a work, from the watcher's live signals; null or absent = unknown, which never allows a closure. */
+	children?(workId: string): number | null;
+	/** OMO's child-task list of a work session (`omo.task.list`, the `omo.task.updated` tasks), asked at every bind. */
+	onChildTasks?(workId: string, tasks: readonly unknown[]): void;
+	/** Housekeeping audit log: one line per reconcile closure (or refused closure) and per new confirm alert. */
+	audit?: AuditSink;
+	/** The reconcile items changed; housekeeping rescans its reconcile-work collector. */
+	onReconciled?(): void;
 }
 class RoutingError extends Error {
 	constructor(readonly code: string, readonly status = 409) { super(code); }
@@ -114,6 +131,12 @@ export class WorkRouter {
 	private readonly reconciliations = new Map<string, Promise<void>>();
 	private readonly scheduled = new Set<string>();
 	private readonly pendingUi = new Map<string, OmoEvent[]>();
+	// Reconcile evidence of the current OMO generation (bug 282); cleared whenever the generation changes.
+	private readonly refused = new Map<string, { error: string; retryable: boolean }>();
+	private readonly admissionFailed = new Map<string, Set<string>>();
+	private readonly lifecycle = new Map<string, { kind: "closed"; reason: string; at: string }>();
+	private readonly lastState = new Map<string, StateRead>();
+	private readonly reconciled = new Map<string, ReconcileItem>();
 	private wholeReads: Promise<unknown> = Promise.resolve();
 	private generation = 0;
 	private stopped = false;
@@ -151,6 +174,8 @@ export class WorkRouter {
 		const binding = this.bindings.get(workId);
 		if (!binding) return;
 		this.bindings.delete(workId);
+		// A parked or closed session's last state is not evidence about the work any more.
+		this.lastState.delete(workId);
 		this.pendingUi.delete(binding.sessionId);
 		this.options.onUnbound?.(binding.owner, reason);
 	}
@@ -402,7 +427,11 @@ export class WorkRouter {
 		if (!this.ready) return;
 		const previous = this.flights.get(workId);
 		if (previous) return previous;
-		const flight = this.transmit(workId).finally(() => { if (this.flights.get(workId) === flight) this.flights.delete(workId); });
+		const generation = this.generation;
+		// T1: reconcile runs once the flight is gone, so it sees this generation's settled dispatch.
+		const flight: Promise<void> = this.transmit(workId)
+			.finally(() => { if (this.flights.get(workId) === flight) this.flights.delete(workId); })
+			.finally(() => this.reconcileAfterDispatch(workId, generation));
 		this.flights.set(workId, flight);
 		return flight;
 	}
@@ -420,6 +449,11 @@ export class WorkRouter {
 			try { binding = await this.ensure(this.work(workId)); }
 			catch (error) {
 				if (!this.stopped) {
+					if (generation === this.generation) {
+						this.refuse(workId, error);
+						const failed = this.admissionFailed.get(workId) ?? new Set<string>();
+						this.admissionFailed.set(workId, failed.add(command.id));
+					}
 					this.store.setWorkCommandDelivery(command.id, "pending", { error: errorText(error) });
 					this.notify(workId);
 				}
@@ -445,6 +479,9 @@ export class WorkRouter {
 				this.store.setWorkCommandDelivery(command.id, "accepted", { disposition: interrupt ? "turn_aborted_cleanup_unconfirmed" : typeof data?.disposition === "string" ? data.disposition : "prompt_ack" });
 				this.notify(workId);
 				if (!interrupt && data?.disposition === "queued" && this.current(workId, binding)) {
+					if (command.kind === "instruct" && !(record(command.payload) && command.payload.watcher === "status_request")) {
+						this.options.onInstructionQueued?.(binding.owner);
+					}
 					void this.omo.command<State>("get_state", { sessionId: binding.sessionId })
 						.then((state) => { if (this.current(workId, binding)) this.resumeQueuedCommand(workId, binding, state); })
 						.catch((error) => this.fail(error));
@@ -492,10 +529,14 @@ export class WorkRouter {
 			};
 			const binding: Binding = { sessionId: opened.sessionId, generation, questions: new Set(), owner };
 			this.bindings.set(work.id, binding);
+			this.refused.delete(work.id);
+			this.admissionFailed.delete(work.id);
+			this.lifecycle.delete(work.id);
 			this.options.onBound?.(owner, opened.state?.pendingQuestions ?? []);
 			const replay = this.pendingUi.get(opened.sessionId) ?? [];
 			this.pendingUi.delete(opened.sessionId);
 			for (const event of replay) this.onEvent(event);
+			this.learnChildren(work.id, binding, opened.state?.sessionId);
 			return binding;
 		}).finally(() => {
 			if (this.opening.get(work.id) === promise) this.opening.delete(work.id);
@@ -505,6 +546,25 @@ export class WorkRouter {
 		return promise;
 	}
 
+	/**
+	 * Bug 282 (F3 F-1): a bind starts with the child-task count unknown, and an idle work without sub-tasks sends no later
+	 * `omo.task.updated` (its snapshot at session start arrives before the open ACK, while the session is unbound). So every
+	 * bind asks OMO once, by the durable session id. An answer without a task list (an OMO without `omo.task.list`,
+	 * not_found) or no answer leaves the count unknown, which keeps closures off. Known children re-run the T1 evaluation.
+	 */
+	private learnChildren(workId: string, binding: Binding, durableSessionId: string | undefined): void {
+		if (typeof durableSessionId !== "string") return;
+		void this.omo.command<unknown>("extension_request", { sessionId: binding.sessionId, name: "omo.task.list", data: { parent_session_id: durableSessionId } })
+			.then((answer) => {
+				if (!this.current(workId, binding) || !record(answer) || !Array.isArray(answer.tasks)) return;
+				this.options.onChildTasks?.(workId, answer.tasks);
+				this.schedule(workId);
+			}, (error: unknown) => {
+				// A refusal (no such request on this OMO) is OMO's answer that it cannot tell: the count stays unknown.
+				if (!(error instanceof OmoCommandError)) this.fail(error);
+			});
+	}
+
 	/** The one unbounded response this router asks for: one whole-session read in flight at a time, across works. */
 	private wholeSession(sessionId: string, live: () => boolean): Promise<Entry[] | null> {
 		const read = this.wholeReads.then(() => live()
@@ -605,6 +665,7 @@ export class WorkRouter {
 			}),
 			this.omo.command<State>("get_state", { sessionId: binding.sessionId }),
 		]);
+		const stateReadAt = new Date().toISOString();
 		if (!entries || !this.current(workId, binding)) return;
 		if (replyRevision !== undefined) this.options.replies?.observe({ sessionPath: work.sessionPath, conv: work.ownerConv, workId, title: work.title }, entries, replyRevision);
 		if (typeof state.isStreaming === "boolean") this.options.onRuntime?.(workId, state.isStreaming);
@@ -615,6 +676,10 @@ export class WorkRouter {
 			}
 		}
 		const evidence = [...queue(state), ...entries.filter((e) => e.type === "message" && e.message?.role === "user").map((e) => messageText(e.message?.content))];
+		if (typeof state.isStreaming === "boolean") {
+			const matched = new Set(this.store.listWorkCommands(workId).filter((command) => evidence.some((value) => this.matches(value, command))).map((command) => command.id));
+			this.lastState.set(workId, { isStreaming: state.isStreaming, stateReadAt, matched });
+		}
 		for (const command of this.store.listWorkCommands(workId)) {
 			if (["pending", "sending", "unknown"].includes(command.delivery) && evidence.some((value) => this.matches(value, command))) this.store.setWorkCommandDelivery(command.id, "accepted", { disposition: "command_envelope" });
 		}
@@ -700,12 +765,19 @@ export class WorkRouter {
 				this.store.observeWork(workId, "unknown", "session_closed");
 				this.notify(workId);
 			}
+			// Parked (handoff_parked) is not failure, and a generation slot removal is not this session's loss.
+			if (event.type === "session_closed" && typeof event.reason === "string" && event.reason !== "handoff_parked" &&
+				event.reason !== "generation_ended" && event.synthetic !== true) {
+				this.lifecycle.set(workId, { kind: "closed", reason: event.reason, at: new Date().toISOString() });
+			}
+			this.schedule(workId); // T4
 		}
 		// senpi publishes agent_settled (reason session_closed) before it seals a session closed or
 		// parked mid-turn; that session can no longer be read, and its lifecycle event follows.
 		else if (event.type === "agent_settled" && event.reason !== "session_closed") {
 			void this.reconcile(workId).then(() => {
 				if (this.current(workId, binding)) this.options.onSettled?.(binding.owner);
+				this.schedule(workId); // T3
 			}).catch((error) => this.fail(error));
 		}
 		return true;
@@ -720,6 +792,7 @@ export class WorkRouter {
 			const attached = new Set(this.bindings.keys());
 			this.generation++;
 			for (const workId of [...this.bindings.keys()]) this.unbind(workId, "disconnected");
+			this.clearEvidence();
 			this.opening.clear();
 			this.pendingUi.clear();
 			const affected: string[] = [];
@@ -768,7 +841,14 @@ export class WorkRouter {
 					}
 					continue;
 				}
-				await this.reconcile(work.id);
+				try {
+					await this.reconcile(work.id);
+				} catch (error) {
+					// T2: the refusal is reconcile evidence; dispatch still runs so T1 evaluates it.
+					if (generation === this.generation) this.refuse(work.id, error);
+					this.schedule(work.id);
+					throw error;
+				}
 				this.schedule(work.id);
 			} catch (error) { this.fail(error); }
 		}
@@ -780,6 +860,115 @@ export class WorkRouter {
 		this.stopped = true;
 		this.generation++;
 		for (const workId of [...this.bindings.keys()]) this.unbind(workId, "stopped");
+		this.clearEvidence();
 		this.pendingUi.clear();
 	}
+
+	/** The router's current reconcile closures and pending confirms, for the housekeeping reconcile-work collector. */
+	reconcileItems(): ReconcileItem[] {
+		return [...this.reconciled.values()].filter((item) => this.stillClosed(item) ||
+			(item.kind === "confirm" && !["completed", "failed", "cancelled"].includes(this.store.getWork(item.workId)?.status ?? "completed")));
+	}
+
+	/** A closure stays listed until the work is reopened (a new instruct) or otherwise leaves that closed state. */
+	private stillClosed(item: ReconcileItem): boolean {
+		return item.kind === "close" && this.store.getWork(item.workId)?.statusReason === item.reason;
+	}
+
+	private clearEvidence(): void {
+		this.refused.clear();
+		this.admissionFailed.clear();
+		this.lifecycle.clear();
+		this.lastState.clear();
+	}
+
+	private refuse(workId: string, error: unknown): void {
+		const typed = error instanceof OmoCommandError;
+		const data = typed && record(error.errorData) ? error.errorData : null;
+		const retryAfterMs = typeof data?.retry_after_ms === "number" ? data.retry_after_ms : null;
+		this.refused.set(workId, { error: errorText(error), retryable: retryableRefusal(typed ? error.code : null, retryAfterMs) });
+	}
+
+	/** Evidence for the classifier, exactly as the field comments of ReconcileEvidence define it. */
+	private collect(workId: string, generation: number): ReconcileEvidence | null {
+		const work = this.store.getWork(workId);
+		if (!work) return null;
+		const commands = this.store.listWorkCommands(workId);
+		const latest = commands.at(-1);
+		const state = this.lastState.get(workId);
+		const inSession = (id: string) => state ? state.matched.has(id) : null;
+		const reported = new Set(this.store.listWorkUpdates(workId)
+			.filter((u) => reportKinds.has(u.kind) && !(record(u.details) && u.details.source === "watcher")).map((u) => u.commandSeq));
+		const blocked = latest?.delivery === "pending" ? commands.filter((c) => c.seq < latest.seq && c.delivery === "unknown").at(-1) : undefined;
+		const refused = this.refused.get(workId);
+		return {
+			status: work.status,
+			latest: latest ? {
+				id: latest.id, seq: latest.seq, kind: latest.kind, delivery: latest.delivery, error: latest.error, createdAt: latest.createdAt, acceptedAt: latest.acceptedAt,
+				admissionFailed: this.admissionFailed.get(workId)?.has(latest.id) ?? false, inSession: inSession(latest.id), reported: reported.has(latest.seq),
+			} : null,
+			blockedBy: blocked ? { id: blocked.id, seq: blocked.seq, delivery: blocked.delivery, inSession: inSession(blocked.id) } : null,
+			omoReady: this.ready,
+			evaluatedAfterDispatch: generation === this.generation,
+			session: refused ? { kind: "refused", retryable: refused.retryable, error: refused.error }
+				: state ? { kind: "readable", isStreaming: state.isStreaming, stateReadAt: state.stateReadAt } : { kind: "unread" },
+			lifecycle: this.lifecycle.get(workId) ?? null,
+			children: this.options.children?.(workId) ?? null,
+			openDecisions: this.store.unresolvedWorkDecisions(workId),
+			inFlight: this.flights.has(workId),
+		};
+	}
+
+	/** T1. Never sends a command; a cancel that is not accepted gets one fresh read first. */
+	private async reconcileAfterDispatch(workId: string, generation: number): Promise<void> {
+		try {
+			if (!this.ready || generation !== this.generation) return;
+			const latest = this.store.listWorkCommands(workId).at(-1);
+			const open = !["completed", "failed", "cancelled"].includes(this.store.getWork(workId)?.status ?? "completed");
+			if (open && latest?.kind === "cancel" && latest.delivery !== "accepted") {
+				try { await this.reconcile(workId); } catch (error) { if (generation === this.generation) this.refuse(workId, error); }
+			}
+			const evidence = this.collect(workId, generation);
+			if (evidence) this.applyVerdict(workId, evidence, classify(evidence));
+		} catch (error) { this.fail(error); }
+	}
+
+	private applyVerdict(workId: string, evidence: ReconcileEvidence, verdict: ReconcileVerdict): void {
+		const latest = evidence.latest;
+		if (verdict.kind === "keep" || !latest) {
+			const held = this.reconciled.get(workId);
+			if (held && !this.stillClosed(held)) {
+				this.reconciled.delete(workId);
+				this.options.onReconciled?.();
+			}
+			return;
+		}
+		const id = reconcileWorkId({ reason: verdict.reason, commandId: latest.id });
+		const item = (status: ReconcileItem["status"]): ReconcileItem => ({ workId, title: this.work(workId).title, kind: verdict.kind, reason: verdict.reason,
+			status, commandId: latest.id, commandSeq: latest.seq, evidence: verdict.evidence, at: new Date().toISOString() });
+		if (verdict.kind === "close") {
+			const closed = this.store.closeByReconcile(workId, latest.seq, verdict.status, verdict.reason, verdict.evidence);
+			this.audit({ id, target: workId, verdict: "act", evidence: verdict.evidence, method: "state", ok: closed !== null, ...(closed ? {} : { error: "close_refused" }) });
+			if (!closed) return;
+			this.reconciled.set(workId, item(closed.status));
+			this.notify(workId);
+			this.options.onReconciled?.();
+			return;
+		}
+		const alert = this.store.recordWatchAlert(workId, { sourceKey: id, commandSeq: latest.seq,
+			summary: RECONCILE_CONFIRM_SUMMARIES[verdict.reason] ? say(RECONCILE_CONFIRM_SUMMARIES[verdict.reason]!) : verdict.reason,
+			details: { ...verdict.evidence, source: "watcher", reconcile: true, requiresUserAction: true } });
+		this.reconciled.set(workId, item(evidence.status));
+		if (alert) {
+			this.audit({ id, target: workId, verdict: "confirm", evidence: verdict.evidence, method: null, ok: true });
+			this.options.onUpdate?.(this.work(workId));
+		}
+		this.options.onReconciled?.();
+	}
+
+	private audit(line: Pick<AuditLine, "id" | "target" | "verdict" | "evidence" | "method" | "ok" | "error">): void {
+		try {
+			this.options.audit?.append({ at: new Date().toISOString(), trigger: "work_event", actor: "reconcile", collector: "reconcile-work", ...line });
+		} catch (error) { this.fail(error); }
+	}
 }

package/web/DESIGN.md

@@ -179,3 +179,36 @@ remain visible. No animation, network, remote fonts, new settings or exports.
 Source foldouts retain their local open state across streaming updates.
 Desktop/phone light/dark, enlarged text, source/copy and reference QA belong
 to the parent integration lane; local unit checks do not claim visual approval.
+
+## 11. Agent collaboration cards and targets (292, C-10)
+Brief. Primary action: none by default; 요청 취소 is the one prominent (danger) control and appears only while a request
+can still move. Priorities: 1) who asked whom and the request text, 2) the state word, 3) the result and its files.
+Left out on purpose: a per-request avatar row, a progress bar, a duplicate state badge in the head of the transcript,
+and any success wording for an action the gateway refused.
+Layout: one `collaboration-card` per request (`data-request-id`), a block in the message list aligned with message text
+(68px left, 640px max; 16px/8px margins and full width at 640px and below); the message list stays the only scroll owner.
+The card is drawn at the first stored event that names the request (`message.collaboration`) and is updated in place by
+later events (`agent.collaboration.status`, the reply, blocked/delivery notes) and by the owner listing
+(`GET /api/agent-collaboration/requests?conv=`), which is the gateway's truth for kind, state and revision; a replayed
+event never adds a second card. web/collaboration.js decides, app.js draws.
+Tokens: the existing `--bg-card`, `--bg-input`, `--border`, `--text`, `--muted`, `--ok`, `--warn`, `--danger`, the
+1px #4e5058 hairline and 4px/6px radii; no side stripe. The state is a dot plus a monospace word, never colour alone:
+ok (완료), busy (대기 중, 진행 중, 다른 에이전트의 답 대기, 결과 준비 중), warn (내 답 대기, 취소 요청됨, 전달 미확인, 정의
+변경으로 미실행, 상태 미확인), danger (실패, 중단됨, 취소됨). An unknown or unconfirmed state never reads as done.
+Head: title (보낸/받은 협업 요청), kind tag (작업/질문, from the listing), state, time. Parties: 보낸 쪽 → 받는 쪽; the
+sender of a received request is its actor, the recipient of a sent request reads 다른 에이전트 until the gateway names it.
+Body: the request text as DOM text; 요청과 함께 보낸 파일 and the 결과 files as rows (`data-artifact-id`, name, size,
+내려받기); the result text or 회신에 본문이 없습니다; 회신 보냄 on the answering side; notes for waiting owner, blocked,
+unconfirmed delivery and definition change. A status line (`role=status`) under the body carries the last action's
+answer. Actions: 요청 취소 (`data-action=collaboration-cancel`, needs the listing's revision), 다시 확인
+(`collaboration-recheck`), 내려받기 (`collaboration-download`, saved only when the gateway's sha256 header and the
+browser's digest match the manifest). Owner actions answered 503 `owner_auth_unavailable` by the gateway are shown as
+"not available yet", never as success. Controls keep 24px (44px on phones) targets and the #a3acff focus ring.
+Agent editor: the gateway's `collaboration` group and `collaboration.targets` rows are drawn (the registry marks them
+hidden for older webs) as a check list of the other agents by name (`pe-skills pe-targets`, the skills list's shape),
+never the agent itself; a saved id the list no longer carries stays checked with a 없음 tag. Knowledge files: a source/
+file carries its origin tag (직접 올림 or 협업 사본, the latter in the accent ink) and the copy's delete confirmation says
+only this copy goes. Dictionaries: `collab.*`, `agents.targets.*`, `agents.file.origin.*` in web/i18n/agents.js.
+Verification: test/unit/agent-collaboration-web.test.ts (guards doubling as mutation watchers in
+test/mutation/agent-collaboration-web.test.ts) and the Aside browser QA test/fixtures/agent-collaboration-web-qa.ts at
+1440x900 and 390x844 in both colour schemes (the UI ships one dark palette; light is the media emulation).