feat(workhub): add coordination session lifecycle

[ARE404]

Summary

• provision and reuse one stable Coordination Session per Runtime Host through the existing Session/SQLite authority
• revoke an old Host scope as soon as the default Host changes, and retry recoverable provisioning when model authority becomes available
• reserve the Coordination identity/role pair from ordinary creation, copies, configuration, retirement, catalogs, and root execution

Refs #3492

Authority and deferred work

Session remains the only durable substrate: this adds no second WorkHub database, event store, lifecycle authority, or transcript copy. Each Runtime Host remains independent; cross-Host coordination is not supported.

Coordination transcript rendering and answer_here belong to Slice 3. Model dispositions, the deterministic Action Gate, bounded delegation links, and the deferred Work cardinality decision remain for later slices.

UI evidence

Missing default model	Recovered after model configuration

Verification

• npm run lint
• npm run format:check
• git diff --check
• npm run typecheck
• npm run build
• Storage focused regressions: 29 passed
• Runtime Host: 1,156 passed
• Runtime Host two-client branch/revision regression: 1 passed
• Desktop: 1,506 passed
• Electron default-model failure/recovery e2e: 1 passed
• Standards and Spec adversarial review: no findings
• GitHub CI: passed for exact head 35efcd6d9, including Desktop e2e, browser smoke, Storybook, and installed CLI validation

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and tested the lifecycle, storage boundary, protocol, Desktop integration, review fixes, and Standards/Spec reviews.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally or in clean CI

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

I reviewed this head and found blocking issues.

[P2] Default-Host switch while not ready leaves old generation active

Switching default Host to a reconnecting/unavailable Host does not increment the generation, so late results from the previous Host still pass checks and WorkHub continues using the old Host until the new one becomes ready — which may never happen.

[P2] Ordinary workspace relocation can permanently break Coordination identity

session.workspace.relocate can change the reserved maka_workhub_coordination cwd/projectId, after which the next resolve permanently fails with operation_conflict and the row is hidden with no repair path.

[P3] Write-only ref duplication

workHubCoordinationSessionIdRef is never read; state is the sole authority.

Checks on becd9f133e are test: success.

简体中文

存在两项身份/代次阻断与一项冗余。

[ARE404]

Addressed the review findings in 35efcd6d9:

• every default-Host change now revokes the old generation immediately, including connecting, reconnecting, and unavailable targets; stale resolves and stale controllers cannot mutate
• ordinary workspace/configuration/metadata/read-state/retirement authority rejects either half of the reserved Coordination identity/role pair, including corrupt persisted pairings
• workHubCoordinationSessionIdRef now participates in the current-scope guard alongside the generation
• also closed ordinary session.create, branch/revision copy, and generic root-execution paths over the reserved identity; missing-model startup is visible and retryable

Exact-head CI is green, and the final Standards/Spec adversarial re-review has no findings.

[Astro-Han]

Update on 35efcd6d9b:

No blocking issues. The prior generation/identity P2s are now closed: default-Host changes correctly invalidate the old generation, and the Coordination identity is protected across copy paths.

[P3] Copy reservation only protects the target, not the source

session-revision-coordinator.ts:179 checks only targetSessionId. A valid Coordination Session supplied as sourceSessionId can still be copied into an ordinary Session, exposing hidden messages. This is latent until Slice 3 writes transcripts, but should be rejected before admission.

Checks on 35efcd6d9b are test: success.

简体中文

该头无阻断，剩余 P3 为源侧拷贝保护。

[ARE404]

Self-review pass over this slice, graded by severity. Fixes for all seven follow in the next commit.

P1 — correctness, must fix before merge

1. validCoordinationHeader treats cwd as part of the identity, and nothing can repair the mismatch.
workhub-coordination-coordinator.ts requires header.cwd === join(stateRoot, 'workhub-coordination'). The create fingerprint is a constant, so after the state root moves to a different absolute path — restoring the state directory on a new machine, a renamed home directory, a remote Host whose home path changed — probeStableSessionCreate still answers existing, the cwd comparison fails, and #resolve returns identityConflict() forever. This slice deliberately blocks session.remove, session.lifecycle.set, session.workspace.relocate, session.configuration.update and session.metadata.update for the reserved identity, so there is no product path left to repair or drop the stale row: WorkHub becomes permanently unopenable and the surface tells the user to check their default model, which is not the problem. cwd is repairable state, not identity — resolve should relocate it instead of rejecting.

2. The copy reservation covers the target but not the source.
session-revision-coordinator.ts rejects the reserved identity only as input.targetSessionId. The Coordination Session is still a legal source for session.conversation.copy (ordinary copy, revision, and side conversation): the source header is only checked for archived / subagentParent / Deep Research. #createInput does not carry role, so the identity/role pairing check in createStableSession passes and the copy lands as an ordinary Session holding the Coordination transcript — with an ordinary id and no role, so runtimeHostExecutionUnavailableReason also lets it run Turns. Any owner client can reach this: workhub.coordination.resolve hands out the id, and the copy does the rest.

P2 — should fix in this PR

3. The Coordination workspace directory is only guaranteed at provisioning time.
mkdir runs on the create branch only. If stateRoot/workhub-coordination is later removed — a pruned state directory, a database restored without its sibling directory — the existing branch compares the cwd string, reports success, and the directory never comes back. mkdir with recursive is idempotent; running it before the probe makes both branches converge on the same guarantee.

4. A default Host that is not ready leaves WorkHub on an indefinite spinner.
workhub-coordination-lifecycle.ts always revokes on a default-Host change but only re-resolves when readiness === 'ready', and revoke() clears failedGeneration. When the default Host goes unavailable (crash, failed respawn, onTargetRemoved), reportFailure never runs, so the surface stays on Preparing WorkHub… with no error and no Retry, and the connection_list_changed handler cannot restart it either because it is gated on failedGeneration === generation. Recovery waits for a ready event that may never arrive. connecting / reconnecting should keep the spinner; unavailable should report a failure.

P3 — cleanups

5. Every resolveCreateTarget() failure is reported as a missing default model.
The bare catch maps any error to operation_conflict / “requires an available default model”. resolveExternalSessionImportTarget also awaits the runtime policy read, which raises persistence_failed / “Runtime policy is unavailable”; the user is then told to fix a model setting that was never wrong, and the real persistence failure is never surfaced.

6. #updateMetadata reads the header snapshot twice.
The new snapshot read and Coordination guard duplicate the read and guard #replaceUserLabels already performs inside the same admission lease, on the same sessionId. A label update now costs two identical reads, and rename / flag updates pay a new one on a hot path (auto-titling renames land on most Turns). Threading the record through removes both.

7. Unused import.
registerRuntimeHostSessionCatalogIpc is imported in runtime-host-session-catalog-ipc-main.test.ts and never referenced — it is the file's only change. Biome's allowlist has no unused-import rule, so nothing caught it.

[ARE404]

Pushed cd4b60ed8, which addresses all seven.

P1-1 — Coordination workspace no longer acts as identity.validCoordinationHeader checks the id/role pair, lineage and archive state only. The durable cwd is relocated in place under the admission lease with the probed revision, so a state directory restored under a different absolute path keeps its Session instead of answering operation_conflict forever. New regression: relocates the durable workspace when the Host state root moves.

P1-2 — the copy reservation now holds on both sides.#copy refuses the reserved id as a source, and #copyAdmitted refuses either half of the reserved pair once the source header is known. The two-client UDS regression now asserts both directions for session.branch.create and session.revision.create, and that the would-be target never appears in the catalog.

P2-3 — the workspace directory is ensured on reuse.mkdir moved above the probe, so both branches converge on the same guarantee and a pruned directory comes back before the identity is handed out. This also simplified the create branch: everything after the probe is now a single outcome-unknown boundary. New regression: restores a Coordination workspace that was pruned after provisioning.

P2-4 — an unavailable default Host reports a failure.connecting and reconnecting still hold the loading state; unavailable (and removed) now reports through the same path a rejected resolve takes, so the surface shows the error with Retry and the availability subscription can reopen the generation. New regression: WorkHub reports an unavailable default Host instead of holding the loading state.

P3-5 — a persistence_failed model-authority read keeps its code and message; everything else still maps to the default-model conflict. Covered by separates an unreadable model authority from a missing default model.

P3-6 — #updateMetadata reads the admitted snapshot once and threads it into label replacement; #replaceUserLabels became the pure replaceUserLabels(current, …).

P3-7 — unused import removed.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check all clean. Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on cd4b60ed86:

No blocking issues. The source-side copy guard now correctly rejects reserved source Sessions, and workspace/generation handling is sound.

Checks on cd4b60ed86 — code GO, no P0-P3.

简体中文

该头未发现阻断。

[ARE404]

Both P3 depth items are in 9966f7ae7.

1 — the id/role pairing moved into the header builder.assertCoordinationIdentityPairing(sessionId, role) now runs inside buildSessionHeader(), so createSubagent() and createAgentGraphOperator() meet the same invariant as createStableSession() rather than depending on their inputs never carrying a role.

createStableSession() keeps its own call to the assertion, deliberately: it runs before claimStableSessionCreate(), and the builder runs after. Dropping the early one would let a malformed request write a durable create claim for the identity it names, which a later legitimate create would then see as a conflict. Same fact, asserted at the boundary that must fail before a write and at the low-level constructor that every creator shares.

Regression extended: requires the reserved WorkHub Coordination identity and role together now rejects a role claimed through both sibling creators and asserts the store stays empty afterwards.

2 — the metadata role scope has no default.SqliteSessionMetadataStore.list() takes (filter: SessionListFilter | undefined, roleScope: SessionMetadataRoleScope), both required, and the type is exported so a call site names its scope. The three readers now read as: catalog 'ordinary', recovery 'recoverable', usage statistics 'all' — the last stated explicitly with a note that a durable cost aggregate counts every Session that spent tokens, including rows a catalog hides.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check clean. Storage 940 passed / 14 skipped, Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on 9966f7ae7b:

No blocking issues. The delta makes Coordination identity/role pairing pre-claim and shared across Session creators, correct for preventing ordinary copies from capturing the reserved Session.

Checks on 9966f7ae7b are test: success.

简体中文

该头未发现阻断。

[Astro-Han]

APPROVE — 9966f7a, no P0-P3, identity pairing correctly pre-claimed.

[ARE404]

Summary

• provision and reuse one stable Coordination Session per Runtime Host through the existing Session/SQLite authority
• revoke an old Host scope as soon as the default Host changes, and retry recoverable provisioning when model authority becomes available
• reserve the Coordination identity/role pair from ordinary creation, copies, configuration, retirement, catalogs, and root execution

Refs #3492

Authority and deferred work

Session remains the only durable substrate: this adds no second WorkHub database, event store, lifecycle authority, or transcript copy. Each Runtime Host remains independent; cross-Host coordination is not supported.

Coordination transcript rendering and answer_here belong to Slice 3. Model dispositions, the deterministic Action Gate, bounded delegation links, and the deferred Work cardinality decision remain for later slices.

UI evidence

Missing default model	Recovered after model configuration

Verification

• npm run lint
• npm run format:check
• git diff --check
• npm run typecheck
• npm run build
• Storage focused regressions: 29 passed
• Runtime Host: 1,156 passed
• Runtime Host two-client branch/revision regression: 1 passed
• Desktop: 1,506 passed
• Electron default-model failure/recovery e2e: 1 passed
• Standards and Spec adversarial review: no findings
• GitHub CI: passed for exact head 35efcd6d9, including Desktop e2e, browser smoke, Storybook, and installed CLI validation

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and tested the lifecycle, storage boundary, protocol, Desktop integration, review fixes, and Standards/Spec reviews.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally or in clean CI

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

I reviewed this head and found blocking issues.

[P2] Default-Host switch while not ready leaves old generation active

Switching default Host to a reconnecting/unavailable Host does not increment the generation, so late results from the previous Host still pass checks and WorkHub continues using the old Host until the new one becomes ready — which may never happen.

[P2] Ordinary workspace relocation can permanently break Coordination identity

session.workspace.relocate can change the reserved maka_workhub_coordination cwd/projectId, after which the next resolve permanently fails with operation_conflict and the row is hidden with no repair path.

[P3] Write-only ref duplication

workHubCoordinationSessionIdRef is never read; state is the sole authority.

Checks on becd9f133e are test: success.

简体中文

存在两项身份/代次阻断与一项冗余。

[ARE404]

Addressed the review findings in 35efcd6d9:

• every default-Host change now revokes the old generation immediately, including connecting, reconnecting, and unavailable targets; stale resolves and stale controllers cannot mutate
• ordinary workspace/configuration/metadata/read-state/retirement authority rejects either half of the reserved Coordination identity/role pair, including corrupt persisted pairings
• workHubCoordinationSessionIdRef now participates in the current-scope guard alongside the generation
• also closed ordinary session.create, branch/revision copy, and generic root-execution paths over the reserved identity; missing-model startup is visible and retryable

Exact-head CI is green, and the final Standards/Spec adversarial re-review has no findings.

[Astro-Han]

Update on 35efcd6d9b:

No blocking issues. The prior generation/identity P2s are now closed: default-Host changes correctly invalidate the old generation, and the Coordination identity is protected across copy paths.

[P3] Copy reservation only protects the target, not the source

session-revision-coordinator.ts:179 checks only targetSessionId. A valid Coordination Session supplied as sourceSessionId can still be copied into an ordinary Session, exposing hidden messages. This is latent until Slice 3 writes transcripts, but should be rejected before admission.

Checks on 35efcd6d9b are test: success.

简体中文

该头无阻断，剩余 P3 为源侧拷贝保护。

[ARE404]

Self-review pass over this slice, graded by severity. Fixes for all seven follow in the next commit.

P1 — correctness, must fix before merge

1. validCoordinationHeader treats cwd as part of the identity, and nothing can repair the mismatch.
workhub-coordination-coordinator.ts requires header.cwd === join(stateRoot, 'workhub-coordination'). The create fingerprint is a constant, so after the state root moves to a different absolute path — restoring the state directory on a new machine, a renamed home directory, a remote Host whose home path changed — probeStableSessionCreate still answers existing, the cwd comparison fails, and #resolve returns identityConflict() forever. This slice deliberately blocks session.remove, session.lifecycle.set, session.workspace.relocate, session.configuration.update and session.metadata.update for the reserved identity, so there is no product path left to repair or drop the stale row: WorkHub becomes permanently unopenable and the surface tells the user to check their default model, which is not the problem. cwd is repairable state, not identity — resolve should relocate it instead of rejecting.

2. The copy reservation covers the target but not the source.
session-revision-coordinator.ts rejects the reserved identity only as input.targetSessionId. The Coordination Session is still a legal source for session.conversation.copy (ordinary copy, revision, and side conversation): the source header is only checked for archived / subagentParent / Deep Research. #createInput does not carry role, so the identity/role pairing check in createStableSession passes and the copy lands as an ordinary Session holding the Coordination transcript — with an ordinary id and no role, so runtimeHostExecutionUnavailableReason also lets it run Turns. Any owner client can reach this: workhub.coordination.resolve hands out the id, and the copy does the rest.

P2 — should fix in this PR

3. The Coordination workspace directory is only guaranteed at provisioning time.
mkdir runs on the create branch only. If stateRoot/workhub-coordination is later removed — a pruned state directory, a database restored without its sibling directory — the existing branch compares the cwd string, reports success, and the directory never comes back. mkdir with recursive is idempotent; running it before the probe makes both branches converge on the same guarantee.

4. A default Host that is not ready leaves WorkHub on an indefinite spinner.
workhub-coordination-lifecycle.ts always revokes on a default-Host change but only re-resolves when readiness === 'ready', and revoke() clears failedGeneration. When the default Host goes unavailable (crash, failed respawn, onTargetRemoved), reportFailure never runs, so the surface stays on Preparing WorkHub… with no error and no Retry, and the connection_list_changed handler cannot restart it either because it is gated on failedGeneration === generation. Recovery waits for a ready event that may never arrive. connecting / reconnecting should keep the spinner; unavailable should report a failure.

P3 — cleanups

5. Every resolveCreateTarget() failure is reported as a missing default model.
The bare catch maps any error to operation_conflict / “requires an available default model”. resolveExternalSessionImportTarget also awaits the runtime policy read, which raises persistence_failed / “Runtime policy is unavailable”; the user is then told to fix a model setting that was never wrong, and the real persistence failure is never surfaced.

6. #updateMetadata reads the header snapshot twice.
The new snapshot read and Coordination guard duplicate the read and guard #replaceUserLabels already performs inside the same admission lease, on the same sessionId. A label update now costs two identical reads, and rename / flag updates pay a new one on a hot path (auto-titling renames land on most Turns). Threading the record through removes both.

7. Unused import.
registerRuntimeHostSessionCatalogIpc is imported in runtime-host-session-catalog-ipc-main.test.ts and never referenced — it is the file's only change. Biome's allowlist has no unused-import rule, so nothing caught it.

[ARE404]

Pushed cd4b60ed8, which addresses all seven.

P1-1 — Coordination workspace no longer acts as identity.validCoordinationHeader checks the id/role pair, lineage and archive state only. The durable cwd is relocated in place under the admission lease with the probed revision, so a state directory restored under a different absolute path keeps its Session instead of answering operation_conflict forever. New regression: relocates the durable workspace when the Host state root moves.

P1-2 — the copy reservation now holds on both sides.#copy refuses the reserved id as a source, and #copyAdmitted refuses either half of the reserved pair once the source header is known. The two-client UDS regression now asserts both directions for session.branch.create and session.revision.create, and that the would-be target never appears in the catalog.

P2-3 — the workspace directory is ensured on reuse.mkdir moved above the probe, so both branches converge on the same guarantee and a pruned directory comes back before the identity is handed out. This also simplified the create branch: everything after the probe is now a single outcome-unknown boundary. New regression: restores a Coordination workspace that was pruned after provisioning.

P2-4 — an unavailable default Host reports a failure.connecting and reconnecting still hold the loading state; unavailable (and removed) now reports through the same path a rejected resolve takes, so the surface shows the error with Retry and the availability subscription can reopen the generation. New regression: WorkHub reports an unavailable default Host instead of holding the loading state.

P3-5 — a persistence_failed model-authority read keeps its code and message; everything else still maps to the default-model conflict. Covered by separates an unreadable model authority from a missing default model.

P3-6 — #updateMetadata reads the admitted snapshot once and threads it into label replacement; #replaceUserLabels became the pure replaceUserLabels(current, …).

P3-7 — unused import removed.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check all clean. Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on cd4b60ed86:

No blocking issues. The source-side copy guard now correctly rejects reserved source Sessions, and workspace/generation handling is sound.

Checks on cd4b60ed86 — code GO, no P0-P3.

简体中文

该头未发现阻断。

[ARE404]

Both P3 depth items are in 9966f7ae7.

1 — the id/role pairing moved into the header builder.assertCoordinationIdentityPairing(sessionId, role) now runs inside buildSessionHeader(), so createSubagent() and createAgentGraphOperator() meet the same invariant as createStableSession() rather than depending on their inputs never carrying a role.

createStableSession() keeps its own call to the assertion, deliberately: it runs before claimStableSessionCreate(), and the builder runs after. Dropping the early one would let a malformed request write a durable create claim for the identity it names, which a later legitimate create would then see as a conflict. Same fact, asserted at the boundary that must fail before a write and at the low-level constructor that every creator shares.

Regression extended: requires the reserved WorkHub Coordination identity and role together now rejects a role claimed through both sibling creators and asserts the store stays empty afterwards.

2 — the metadata role scope has no default.SqliteSessionMetadataStore.list() takes (filter: SessionListFilter | undefined, roleScope: SessionMetadataRoleScope), both required, and the type is exported so a call site names its scope. The three readers now read as: catalog 'ordinary', recovery 'recoverable', usage statistics 'all' — the last stated explicitly with a note that a durable cost aggregate counts every Session that spent tokens, including rows a catalog hides.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check clean. Storage 940 passed / 14 skipped, Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on 9966f7ae7b:

No blocking issues. The delta makes Coordination identity/role pairing pre-claim and shared across Session creators, correct for preventing ordinary copies from capturing the reserved Session.

Checks on 9966f7ae7b are test: success.

简体中文

该头未发现阻断。

[Astro-Han]

APPROVE — 9966f7a, no P0-P3, identity pairing correctly pre-claimed.

[ARE404]

Summary

• provision and reuse one stable Coordination Session per Runtime Host through the existing Session/SQLite authority
• revoke an old Host scope as soon as the default Host changes, and retry recoverable provisioning when model authority becomes available
• reserve the Coordination identity/role pair from ordinary creation, copies, configuration, retirement, catalogs, and root execution

Refs #3492

Authority and deferred work

Session remains the only durable substrate: this adds no second WorkHub database, event store, lifecycle authority, or transcript copy. Each Runtime Host remains independent; cross-Host coordination is not supported.

Coordination transcript rendering and answer_here belong to Slice 3. Model dispositions, the deterministic Action Gate, bounded delegation links, and the deferred Work cardinality decision remain for later slices.

UI evidence

Missing default model	Recovered after model configuration

Verification

• npm run lint
• npm run format:check
• git diff --check
• npm run typecheck
• npm run build
• Storage focused regressions: 29 passed
• Runtime Host: 1,156 passed
• Runtime Host two-client branch/revision regression: 1 passed
• Desktop: 1,506 passed
• Electron default-model failure/recovery e2e: 1 passed
• Standards and Spec adversarial review: no findings
• GitHub CI: passed for exact head 35efcd6d9, including Desktop e2e, browser smoke, Storybook, and installed CLI validation

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and tested the lifecycle, storage boundary, protocol, Desktop integration, review fixes, and Standards/Spec reviews.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally or in clean CI

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

I reviewed this head and found blocking issues.

[P2] Default-Host switch while not ready leaves old generation active

Switching default Host to a reconnecting/unavailable Host does not increment the generation, so late results from the previous Host still pass checks and WorkHub continues using the old Host until the new one becomes ready — which may never happen.

[P2] Ordinary workspace relocation can permanently break Coordination identity

session.workspace.relocate can change the reserved maka_workhub_coordination cwd/projectId, after which the next resolve permanently fails with operation_conflict and the row is hidden with no repair path.

[P3] Write-only ref duplication

workHubCoordinationSessionIdRef is never read; state is the sole authority.

Checks on becd9f133e are test: success.

简体中文

存在两项身份/代次阻断与一项冗余。

[ARE404]

Addressed the review findings in 35efcd6d9:

• every default-Host change now revokes the old generation immediately, including connecting, reconnecting, and unavailable targets; stale resolves and stale controllers cannot mutate
• ordinary workspace/configuration/metadata/read-state/retirement authority rejects either half of the reserved Coordination identity/role pair, including corrupt persisted pairings
• workHubCoordinationSessionIdRef now participates in the current-scope guard alongside the generation
• also closed ordinary session.create, branch/revision copy, and generic root-execution paths over the reserved identity; missing-model startup is visible and retryable

Exact-head CI is green, and the final Standards/Spec adversarial re-review has no findings.

[Astro-Han]

Update on 35efcd6d9b:

No blocking issues. The prior generation/identity P2s are now closed: default-Host changes correctly invalidate the old generation, and the Coordination identity is protected across copy paths.

[P3] Copy reservation only protects the target, not the source

session-revision-coordinator.ts:179 checks only targetSessionId. A valid Coordination Session supplied as sourceSessionId can still be copied into an ordinary Session, exposing hidden messages. This is latent until Slice 3 writes transcripts, but should be rejected before admission.

Checks on 35efcd6d9b are test: success.

简体中文

该头无阻断，剩余 P3 为源侧拷贝保护。

[ARE404]

Self-review pass over this slice, graded by severity. Fixes for all seven follow in the next commit.

P1 — correctness, must fix before merge

1. validCoordinationHeader treats cwd as part of the identity, and nothing can repair the mismatch.
workhub-coordination-coordinator.ts requires header.cwd === join(stateRoot, 'workhub-coordination'). The create fingerprint is a constant, so after the state root moves to a different absolute path — restoring the state directory on a new machine, a renamed home directory, a remote Host whose home path changed — probeStableSessionCreate still answers existing, the cwd comparison fails, and #resolve returns identityConflict() forever. This slice deliberately blocks session.remove, session.lifecycle.set, session.workspace.relocate, session.configuration.update and session.metadata.update for the reserved identity, so there is no product path left to repair or drop the stale row: WorkHub becomes permanently unopenable and the surface tells the user to check their default model, which is not the problem. cwd is repairable state, not identity — resolve should relocate it instead of rejecting.

2. The copy reservation covers the target but not the source.
session-revision-coordinator.ts rejects the reserved identity only as input.targetSessionId. The Coordination Session is still a legal source for session.conversation.copy (ordinary copy, revision, and side conversation): the source header is only checked for archived / subagentParent / Deep Research. #createInput does not carry role, so the identity/role pairing check in createStableSession passes and the copy lands as an ordinary Session holding the Coordination transcript — with an ordinary id and no role, so runtimeHostExecutionUnavailableReason also lets it run Turns. Any owner client can reach this: workhub.coordination.resolve hands out the id, and the copy does the rest.

P2 — should fix in this PR

3. The Coordination workspace directory is only guaranteed at provisioning time.
mkdir runs on the create branch only. If stateRoot/workhub-coordination is later removed — a pruned state directory, a database restored without its sibling directory — the existing branch compares the cwd string, reports success, and the directory never comes back. mkdir with recursive is idempotent; running it before the probe makes both branches converge on the same guarantee.

4. A default Host that is not ready leaves WorkHub on an indefinite spinner.
workhub-coordination-lifecycle.ts always revokes on a default-Host change but only re-resolves when readiness === 'ready', and revoke() clears failedGeneration. When the default Host goes unavailable (crash, failed respawn, onTargetRemoved), reportFailure never runs, so the surface stays on Preparing WorkHub… with no error and no Retry, and the connection_list_changed handler cannot restart it either because it is gated on failedGeneration === generation. Recovery waits for a ready event that may never arrive. connecting / reconnecting should keep the spinner; unavailable should report a failure.

P3 — cleanups

5. Every resolveCreateTarget() failure is reported as a missing default model.
The bare catch maps any error to operation_conflict / “requires an available default model”. resolveExternalSessionImportTarget also awaits the runtime policy read, which raises persistence_failed / “Runtime policy is unavailable”; the user is then told to fix a model setting that was never wrong, and the real persistence failure is never surfaced.

6. #updateMetadata reads the header snapshot twice.
The new snapshot read and Coordination guard duplicate the read and guard #replaceUserLabels already performs inside the same admission lease, on the same sessionId. A label update now costs two identical reads, and rename / flag updates pay a new one on a hot path (auto-titling renames land on most Turns). Threading the record through removes both.

7. Unused import.
registerRuntimeHostSessionCatalogIpc is imported in runtime-host-session-catalog-ipc-main.test.ts and never referenced — it is the file's only change. Biome's allowlist has no unused-import rule, so nothing caught it.

[ARE404]

Pushed cd4b60ed8, which addresses all seven.

P1-1 — Coordination workspace no longer acts as identity.validCoordinationHeader checks the id/role pair, lineage and archive state only. The durable cwd is relocated in place under the admission lease with the probed revision, so a state directory restored under a different absolute path keeps its Session instead of answering operation_conflict forever. New regression: relocates the durable workspace when the Host state root moves.

P1-2 — the copy reservation now holds on both sides.#copy refuses the reserved id as a source, and #copyAdmitted refuses either half of the reserved pair once the source header is known. The two-client UDS regression now asserts both directions for session.branch.create and session.revision.create, and that the would-be target never appears in the catalog.

P2-3 — the workspace directory is ensured on reuse.mkdir moved above the probe, so both branches converge on the same guarantee and a pruned directory comes back before the identity is handed out. This also simplified the create branch: everything after the probe is now a single outcome-unknown boundary. New regression: restores a Coordination workspace that was pruned after provisioning.

P2-4 — an unavailable default Host reports a failure.connecting and reconnecting still hold the loading state; unavailable (and removed) now reports through the same path a rejected resolve takes, so the surface shows the error with Retry and the availability subscription can reopen the generation. New regression: WorkHub reports an unavailable default Host instead of holding the loading state.

P3-5 — a persistence_failed model-authority read keeps its code and message; everything else still maps to the default-model conflict. Covered by separates an unreadable model authority from a missing default model.

P3-6 — #updateMetadata reads the admitted snapshot once and threads it into label replacement; #replaceUserLabels became the pure replaceUserLabels(current, …).

P3-7 — unused import removed.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check all clean. Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on cd4b60ed86:

No blocking issues. The source-side copy guard now correctly rejects reserved source Sessions, and workspace/generation handling is sound.

Checks on cd4b60ed86 — code GO, no P0-P3.

简体中文

该头未发现阻断。

[ARE404]

Both P3 depth items are in 9966f7ae7.

1 — the id/role pairing moved into the header builder.assertCoordinationIdentityPairing(sessionId, role) now runs inside buildSessionHeader(), so createSubagent() and createAgentGraphOperator() meet the same invariant as createStableSession() rather than depending on their inputs never carrying a role.

createStableSession() keeps its own call to the assertion, deliberately: it runs before claimStableSessionCreate(), and the builder runs after. Dropping the early one would let a malformed request write a durable create claim for the identity it names, which a later legitimate create would then see as a conflict. Same fact, asserted at the boundary that must fail before a write and at the low-level constructor that every creator shares.

Regression extended: requires the reserved WorkHub Coordination identity and role together now rejects a role claimed through both sibling creators and asserts the store stays empty afterwards.

2 — the metadata role scope has no default.SqliteSessionMetadataStore.list() takes (filter: SessionListFilter | undefined, roleScope: SessionMetadataRoleScope), both required, and the type is exported so a call site names its scope. The three readers now read as: catalog 'ordinary', recovery 'recoverable', usage statistics 'all' — the last stated explicitly with a note that a durable cost aggregate counts every Session that spent tokens, including rows a catalog hides.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check clean. Storage 940 passed / 14 skipped, Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on 9966f7ae7b:

No blocking issues. The delta makes Coordination identity/role pairing pre-claim and shared across Session creators, correct for preventing ordinary copies from capturing the reserved Session.

Checks on 9966f7ae7b are test: success.

简体中文

该头未发现阻断。

[Astro-Han]

APPROVE — 9966f7a, no P0-P3, identity pairing correctly pre-claimed.

[ARE404]

Summary

• provision and reuse one stable Coordination Session per Runtime Host through the existing Session/SQLite authority
• revoke an old Host scope as soon as the default Host changes, and retry recoverable provisioning when model authority becomes available
• reserve the Coordination identity/role pair from ordinary creation, copies, configuration, retirement, catalogs, and root execution

Refs #3492

Authority and deferred work

Session remains the only durable substrate: this adds no second WorkHub database, event store, lifecycle authority, or transcript copy. Each Runtime Host remains independent; cross-Host coordination is not supported.

Coordination transcript rendering and answer_here belong to Slice 3. Model dispositions, the deterministic Action Gate, bounded delegation links, and the deferred Work cardinality decision remain for later slices.

UI evidence

Missing default model	Recovered after model configuration

Verification

• npm run lint
• npm run format:check
• git diff --check
• npm run typecheck
• npm run build
• Storage focused regressions: 29 passed
• Runtime Host: 1,156 passed
• Runtime Host two-client branch/revision regression: 1 passed
• Desktop: 1,506 passed
• Electron default-model failure/recovery e2e: 1 passed
• Standards and Spec adversarial review: no findings
• GitHub CI: passed for exact head 35efcd6d9, including Desktop e2e, browser smoke, Storybook, and installed CLI validation

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and tested the lifecycle, storage boundary, protocol, Desktop integration, review fixes, and Standards/Spec reviews.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally or in clean CI

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

I reviewed this head and found blocking issues.

[P2] Default-Host switch while not ready leaves old generation active

Switching default Host to a reconnecting/unavailable Host does not increment the generation, so late results from the previous Host still pass checks and WorkHub continues using the old Host until the new one becomes ready — which may never happen.

[P2] Ordinary workspace relocation can permanently break Coordination identity

session.workspace.relocate can change the reserved maka_workhub_coordination cwd/projectId, after which the next resolve permanently fails with operation_conflict and the row is hidden with no repair path.

[P3] Write-only ref duplication

workHubCoordinationSessionIdRef is never read; state is the sole authority.

Checks on becd9f133e are test: success.

简体中文

存在两项身份/代次阻断与一项冗余。

[ARE404]

Addressed the review findings in 35efcd6d9:

• every default-Host change now revokes the old generation immediately, including connecting, reconnecting, and unavailable targets; stale resolves and stale controllers cannot mutate
• ordinary workspace/configuration/metadata/read-state/retirement authority rejects either half of the reserved Coordination identity/role pair, including corrupt persisted pairings
• workHubCoordinationSessionIdRef now participates in the current-scope guard alongside the generation
• also closed ordinary session.create, branch/revision copy, and generic root-execution paths over the reserved identity; missing-model startup is visible and retryable

Exact-head CI is green, and the final Standards/Spec adversarial re-review has no findings.

[Astro-Han]

Update on 35efcd6d9b:

No blocking issues. The prior generation/identity P2s are now closed: default-Host changes correctly invalidate the old generation, and the Coordination identity is protected across copy paths.

[P3] Copy reservation only protects the target, not the source

session-revision-coordinator.ts:179 checks only targetSessionId. A valid Coordination Session supplied as sourceSessionId can still be copied into an ordinary Session, exposing hidden messages. This is latent until Slice 3 writes transcripts, but should be rejected before admission.

Checks on 35efcd6d9b are test: success.

简体中文

该头无阻断，剩余 P3 为源侧拷贝保护。

[ARE404]

Self-review pass over this slice, graded by severity. Fixes for all seven follow in the next commit.

P1 — correctness, must fix before merge

1. validCoordinationHeader treats cwd as part of the identity, and nothing can repair the mismatch.
workhub-coordination-coordinator.ts requires header.cwd === join(stateRoot, 'workhub-coordination'). The create fingerprint is a constant, so after the state root moves to a different absolute path — restoring the state directory on a new machine, a renamed home directory, a remote Host whose home path changed — probeStableSessionCreate still answers existing, the cwd comparison fails, and #resolve returns identityConflict() forever. This slice deliberately blocks session.remove, session.lifecycle.set, session.workspace.relocate, session.configuration.update and session.metadata.update for the reserved identity, so there is no product path left to repair or drop the stale row: WorkHub becomes permanently unopenable and the surface tells the user to check their default model, which is not the problem. cwd is repairable state, not identity — resolve should relocate it instead of rejecting.

2. The copy reservation covers the target but not the source.
session-revision-coordinator.ts rejects the reserved identity only as input.targetSessionId. The Coordination Session is still a legal source for session.conversation.copy (ordinary copy, revision, and side conversation): the source header is only checked for archived / subagentParent / Deep Research. #createInput does not carry role, so the identity/role pairing check in createStableSession passes and the copy lands as an ordinary Session holding the Coordination transcript — with an ordinary id and no role, so runtimeHostExecutionUnavailableReason also lets it run Turns. Any owner client can reach this: workhub.coordination.resolve hands out the id, and the copy does the rest.

P2 — should fix in this PR

3. The Coordination workspace directory is only guaranteed at provisioning time.
mkdir runs on the create branch only. If stateRoot/workhub-coordination is later removed — a pruned state directory, a database restored without its sibling directory — the existing branch compares the cwd string, reports success, and the directory never comes back. mkdir with recursive is idempotent; running it before the probe makes both branches converge on the same guarantee.

4. A default Host that is not ready leaves WorkHub on an indefinite spinner.
workhub-coordination-lifecycle.ts always revokes on a default-Host change but only re-resolves when readiness === 'ready', and revoke() clears failedGeneration. When the default Host goes unavailable (crash, failed respawn, onTargetRemoved), reportFailure never runs, so the surface stays on Preparing WorkHub… with no error and no Retry, and the connection_list_changed handler cannot restart it either because it is gated on failedGeneration === generation. Recovery waits for a ready event that may never arrive. connecting / reconnecting should keep the spinner; unavailable should report a failure.

P3 — cleanups

5. Every resolveCreateTarget() failure is reported as a missing default model.
The bare catch maps any error to operation_conflict / “requires an available default model”. resolveExternalSessionImportTarget also awaits the runtime policy read, which raises persistence_failed / “Runtime policy is unavailable”; the user is then told to fix a model setting that was never wrong, and the real persistence failure is never surfaced.

6. #updateMetadata reads the header snapshot twice.
The new snapshot read and Coordination guard duplicate the read and guard #replaceUserLabels already performs inside the same admission lease, on the same sessionId. A label update now costs two identical reads, and rename / flag updates pay a new one on a hot path (auto-titling renames land on most Turns). Threading the record through removes both.

7. Unused import.
registerRuntimeHostSessionCatalogIpc is imported in runtime-host-session-catalog-ipc-main.test.ts and never referenced — it is the file's only change. Biome's allowlist has no unused-import rule, so nothing caught it.

[ARE404]

Pushed cd4b60ed8, which addresses all seven.

P1-1 — Coordination workspace no longer acts as identity.validCoordinationHeader checks the id/role pair, lineage and archive state only. The durable cwd is relocated in place under the admission lease with the probed revision, so a state directory restored under a different absolute path keeps its Session instead of answering operation_conflict forever. New regression: relocates the durable workspace when the Host state root moves.

P1-2 — the copy reservation now holds on both sides.#copy refuses the reserved id as a source, and #copyAdmitted refuses either half of the reserved pair once the source header is known. The two-client UDS regression now asserts both directions for session.branch.create and session.revision.create, and that the would-be target never appears in the catalog.

P2-3 — the workspace directory is ensured on reuse.mkdir moved above the probe, so both branches converge on the same guarantee and a pruned directory comes back before the identity is handed out. This also simplified the create branch: everything after the probe is now a single outcome-unknown boundary. New regression: restores a Coordination workspace that was pruned after provisioning.

P2-4 — an unavailable default Host reports a failure.connecting and reconnecting still hold the loading state; unavailable (and removed) now reports through the same path a rejected resolve takes, so the surface shows the error with Retry and the availability subscription can reopen the generation. New regression: WorkHub reports an unavailable default Host instead of holding the loading state.

P3-5 — a persistence_failed model-authority read keeps its code and message; everything else still maps to the default-model conflict. Covered by separates an unreadable model authority from a missing default model.

P3-6 — #updateMetadata reads the admitted snapshot once and threads it into label replacement; #replaceUserLabels became the pure replaceUserLabels(current, …).

P3-7 — unused import removed.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check all clean. Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on cd4b60ed86:

No blocking issues. The source-side copy guard now correctly rejects reserved source Sessions, and workspace/generation handling is sound.

Checks on cd4b60ed86 — code GO, no P0-P3.

简体中文

该头未发现阻断。

[ARE404]

Both P3 depth items are in 9966f7ae7.

1 — the id/role pairing moved into the header builder.assertCoordinationIdentityPairing(sessionId, role) now runs inside buildSessionHeader(), so createSubagent() and createAgentGraphOperator() meet the same invariant as createStableSession() rather than depending on their inputs never carrying a role.

createStableSession() keeps its own call to the assertion, deliberately: it runs before claimStableSessionCreate(), and the builder runs after. Dropping the early one would let a malformed request write a durable create claim for the identity it names, which a later legitimate create would then see as a conflict. Same fact, asserted at the boundary that must fail before a write and at the low-level constructor that every creator shares.

Regression extended: requires the reserved WorkHub Coordination identity and role together now rejects a role claimed through both sibling creators and asserts the store stays empty afterwards.

2 — the metadata role scope has no default.SqliteSessionMetadataStore.list() takes (filter: SessionListFilter | undefined, roleScope: SessionMetadataRoleScope), both required, and the type is exported so a call site names its scope. The three readers now read as: catalog 'ordinary', recovery 'recoverable', usage statistics 'all' — the last stated explicitly with a note that a durable cost aggregate counts every Session that spent tokens, including rows a catalog hides.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check clean. Storage 940 passed / 14 skipped, Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on 9966f7ae7b:

No blocking issues. The delta makes Coordination identity/role pairing pre-claim and shared across Session creators, correct for preventing ordinary copies from capturing the reserved Session.

Checks on 9966f7ae7b are test: success.

简体中文

该头未发现阻断。

[Astro-Han]

APPROVE — 9966f7a, no P0-P3, identity pairing correctly pre-claimed.

[ARE404]

Summary

• provision and reuse one stable Coordination Session per Runtime Host through the existing Session/SQLite authority
• revoke an old Host scope as soon as the default Host changes, and retry recoverable provisioning when model authority becomes available
• reserve the Coordination identity/role pair from ordinary creation, copies, configuration, retirement, catalogs, and root execution

Refs #3492

Authority and deferred work

Session remains the only durable substrate: this adds no second WorkHub database, event store, lifecycle authority, or transcript copy. Each Runtime Host remains independent; cross-Host coordination is not supported.

Coordination transcript rendering and answer_here belong to Slice 3. Model dispositions, the deterministic Action Gate, bounded delegation links, and the deferred Work cardinality decision remain for later slices.

UI evidence

Missing default model	Recovered after model configuration

Verification

• npm run lint
• npm run format:check
• git diff --check
• npm run typecheck
• npm run build
• Storage focused regressions: 29 passed
• Runtime Host: 1,156 passed
• Runtime Host two-client branch/revision regression: 1 passed
• Desktop: 1,506 passed
• Electron default-model failure/recovery e2e: 1 passed
• Standards and Spec adversarial review: no findings
• GitHub CI: passed for exact head 35efcd6d9, including Desktop e2e, browser smoke, Storybook, and installed CLI validation

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and tested the lifecycle, storage boundary, protocol, Desktop integration, review fixes, and Standards/Spec reviews.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally or in clean CI

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

I reviewed this head and found blocking issues.

[P2] Default-Host switch while not ready leaves old generation active

Switching default Host to a reconnecting/unavailable Host does not increment the generation, so late results from the previous Host still pass checks and WorkHub continues using the old Host until the new one becomes ready — which may never happen.

[P2] Ordinary workspace relocation can permanently break Coordination identity

session.workspace.relocate can change the reserved maka_workhub_coordination cwd/projectId, after which the next resolve permanently fails with operation_conflict and the row is hidden with no repair path.

[P3] Write-only ref duplication

workHubCoordinationSessionIdRef is never read; state is the sole authority.

Checks on becd9f133e are test: success.

简体中文

存在两项身份/代次阻断与一项冗余。

[ARE404]

Addressed the review findings in 35efcd6d9:

• every default-Host change now revokes the old generation immediately, including connecting, reconnecting, and unavailable targets; stale resolves and stale controllers cannot mutate
• ordinary workspace/configuration/metadata/read-state/retirement authority rejects either half of the reserved Coordination identity/role pair, including corrupt persisted pairings
• workHubCoordinationSessionIdRef now participates in the current-scope guard alongside the generation
• also closed ordinary session.create, branch/revision copy, and generic root-execution paths over the reserved identity; missing-model startup is visible and retryable

Exact-head CI is green, and the final Standards/Spec adversarial re-review has no findings.

[Astro-Han]

Update on 35efcd6d9b:

No blocking issues. The prior generation/identity P2s are now closed: default-Host changes correctly invalidate the old generation, and the Coordination identity is protected across copy paths.

[P3] Copy reservation only protects the target, not the source

session-revision-coordinator.ts:179 checks only targetSessionId. A valid Coordination Session supplied as sourceSessionId can still be copied into an ordinary Session, exposing hidden messages. This is latent until Slice 3 writes transcripts, but should be rejected before admission.

Checks on 35efcd6d9b are test: success.

简体中文

该头无阻断，剩余 P3 为源侧拷贝保护。

[ARE404]

Self-review pass over this slice, graded by severity. Fixes for all seven follow in the next commit.

P1 — correctness, must fix before merge

1. validCoordinationHeader treats cwd as part of the identity, and nothing can repair the mismatch.
workhub-coordination-coordinator.ts requires header.cwd === join(stateRoot, 'workhub-coordination'). The create fingerprint is a constant, so after the state root moves to a different absolute path — restoring the state directory on a new machine, a renamed home directory, a remote Host whose home path changed — probeStableSessionCreate still answers existing, the cwd comparison fails, and #resolve returns identityConflict() forever. This slice deliberately blocks session.remove, session.lifecycle.set, session.workspace.relocate, session.configuration.update and session.metadata.update for the reserved identity, so there is no product path left to repair or drop the stale row: WorkHub becomes permanently unopenable and the surface tells the user to check their default model, which is not the problem. cwd is repairable state, not identity — resolve should relocate it instead of rejecting.

2. The copy reservation covers the target but not the source.
session-revision-coordinator.ts rejects the reserved identity only as input.targetSessionId. The Coordination Session is still a legal source for session.conversation.copy (ordinary copy, revision, and side conversation): the source header is only checked for archived / subagentParent / Deep Research. #createInput does not carry role, so the identity/role pairing check in createStableSession passes and the copy lands as an ordinary Session holding the Coordination transcript — with an ordinary id and no role, so runtimeHostExecutionUnavailableReason also lets it run Turns. Any owner client can reach this: workhub.coordination.resolve hands out the id, and the copy does the rest.

P2 — should fix in this PR

3. The Coordination workspace directory is only guaranteed at provisioning time.
mkdir runs on the create branch only. If stateRoot/workhub-coordination is later removed — a pruned state directory, a database restored without its sibling directory — the existing branch compares the cwd string, reports success, and the directory never comes back. mkdir with recursive is idempotent; running it before the probe makes both branches converge on the same guarantee.

4. A default Host that is not ready leaves WorkHub on an indefinite spinner.
workhub-coordination-lifecycle.ts always revokes on a default-Host change but only re-resolves when readiness === 'ready', and revoke() clears failedGeneration. When the default Host goes unavailable (crash, failed respawn, onTargetRemoved), reportFailure never runs, so the surface stays on Preparing WorkHub… with no error and no Retry, and the connection_list_changed handler cannot restart it either because it is gated on failedGeneration === generation. Recovery waits for a ready event that may never arrive. connecting / reconnecting should keep the spinner; unavailable should report a failure.

P3 — cleanups

5. Every resolveCreateTarget() failure is reported as a missing default model.
The bare catch maps any error to operation_conflict / “requires an available default model”. resolveExternalSessionImportTarget also awaits the runtime policy read, which raises persistence_failed / “Runtime policy is unavailable”; the user is then told to fix a model setting that was never wrong, and the real persistence failure is never surfaced.

6. #updateMetadata reads the header snapshot twice.
The new snapshot read and Coordination guard duplicate the read and guard #replaceUserLabels already performs inside the same admission lease, on the same sessionId. A label update now costs two identical reads, and rename / flag updates pay a new one on a hot path (auto-titling renames land on most Turns). Threading the record through removes both.

7. Unused import.
registerRuntimeHostSessionCatalogIpc is imported in runtime-host-session-catalog-ipc-main.test.ts and never referenced — it is the file's only change. Biome's allowlist has no unused-import rule, so nothing caught it.

[ARE404]

Pushed cd4b60ed8, which addresses all seven.

P1-1 — Coordination workspace no longer acts as identity.validCoordinationHeader checks the id/role pair, lineage and archive state only. The durable cwd is relocated in place under the admission lease with the probed revision, so a state directory restored under a different absolute path keeps its Session instead of answering operation_conflict forever. New regression: relocates the durable workspace when the Host state root moves.

P1-2 — the copy reservation now holds on both sides.#copy refuses the reserved id as a source, and #copyAdmitted refuses either half of the reserved pair once the source header is known. The two-client UDS regression now asserts both directions for session.branch.create and session.revision.create, and that the would-be target never appears in the catalog.

P2-3 — the workspace directory is ensured on reuse.mkdir moved above the probe, so both branches converge on the same guarantee and a pruned directory comes back before the identity is handed out. This also simplified the create branch: everything after the probe is now a single outcome-unknown boundary. New regression: restores a Coordination workspace that was pruned after provisioning.

P2-4 — an unavailable default Host reports a failure.connecting and reconnecting still hold the loading state; unavailable (and removed) now reports through the same path a rejected resolve takes, so the surface shows the error with Retry and the availability subscription can reopen the generation. New regression: WorkHub reports an unavailable default Host instead of holding the loading state.

P3-5 — a persistence_failed model-authority read keeps its code and message; everything else still maps to the default-model conflict. Covered by separates an unreadable model authority from a missing default model.

P3-6 — #updateMetadata reads the admitted snapshot once and threads it into label replacement; #replaceUserLabels became the pure replaceUserLabels(current, …).

P3-7 — unused import removed.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check all clean. Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on cd4b60ed86:

No blocking issues. The source-side copy guard now correctly rejects reserved source Sessions, and workspace/generation handling is sound.

Checks on cd4b60ed86 — code GO, no P0-P3.

简体中文

该头未发现阻断。

[ARE404]

Both P3 depth items are in 9966f7ae7.

1 — the id/role pairing moved into the header builder.assertCoordinationIdentityPairing(sessionId, role) now runs inside buildSessionHeader(), so createSubagent() and createAgentGraphOperator() meet the same invariant as createStableSession() rather than depending on their inputs never carrying a role.

createStableSession() keeps its own call to the assertion, deliberately: it runs before claimStableSessionCreate(), and the builder runs after. Dropping the early one would let a malformed request write a durable create claim for the identity it names, which a later legitimate create would then see as a conflict. Same fact, asserted at the boundary that must fail before a write and at the low-level constructor that every creator shares.

Regression extended: requires the reserved WorkHub Coordination identity and role together now rejects a role claimed through both sibling creators and asserts the store stays empty afterwards.

2 — the metadata role scope has no default.SqliteSessionMetadataStore.list() takes (filter: SessionListFilter | undefined, roleScope: SessionMetadataRoleScope), both required, and the type is exported so a call site names its scope. The three readers now read as: catalog 'ordinary', recovery 'recoverable', usage statistics 'all' — the last stated explicitly with a note that a durable cost aggregate counts every Session that spent tokens, including rows a catalog hides.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check clean. Storage 940 passed / 14 skipped, Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on 9966f7ae7b:

No blocking issues. The delta makes Coordination identity/role pairing pre-claim and shared across Session creators, correct for preventing ordinary copies from capturing the reserved Session.

Checks on 9966f7ae7b are test: success.

简体中文

该头未发现阻断。

[Astro-Han]

APPROVE — 9966f7a, no P0-P3, identity pairing correctly pre-claimed.

[ARE404]

Summary

• provision and reuse one stable Coordination Session per Runtime Host through the existing Session/SQLite authority
• revoke an old Host scope as soon as the default Host changes, and retry recoverable provisioning when model authority becomes available
• reserve the Coordination identity/role pair from ordinary creation, copies, configuration, retirement, catalogs, and root execution

Refs #3492

Authority and deferred work

Session remains the only durable substrate: this adds no second WorkHub database, event store, lifecycle authority, or transcript copy. Each Runtime Host remains independent; cross-Host coordination is not supported.

Coordination transcript rendering and answer_here belong to Slice 3. Model dispositions, the deterministic Action Gate, bounded delegation links, and the deferred Work cardinality decision remain for later slices.

UI evidence

Missing default model	Recovered after model configuration

Verification

• npm run lint
• npm run format:check
• git diff --check
• npm run typecheck
• npm run build
• Storage focused regressions: 29 passed
• Runtime Host: 1,156 passed
• Runtime Host two-client branch/revision regression: 1 passed
• Desktop: 1,506 passed
• Electron default-model failure/recovery e2e: 1 passed
• Standards and Spec adversarial review: no findings
• GitHub CI: passed for exact head 35efcd6d9, including Desktop e2e, browser smoke, Storybook, and installed CLI validation

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and tested the lifecycle, storage boundary, protocol, Desktop integration, review fixes, and Standards/Spec reviews.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally or in clean CI

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

I reviewed this head and found blocking issues.

[P2] Default-Host switch while not ready leaves old generation active

Switching default Host to a reconnecting/unavailable Host does not increment the generation, so late results from the previous Host still pass checks and WorkHub continues using the old Host until the new one becomes ready — which may never happen.

[P2] Ordinary workspace relocation can permanently break Coordination identity

session.workspace.relocate can change the reserved maka_workhub_coordination cwd/projectId, after which the next resolve permanently fails with operation_conflict and the row is hidden with no repair path.

[P3] Write-only ref duplication

workHubCoordinationSessionIdRef is never read; state is the sole authority.

Checks on becd9f133e are test: success.

简体中文

存在两项身份/代次阻断与一项冗余。

[ARE404]

Addressed the review findings in 35efcd6d9:

• every default-Host change now revokes the old generation immediately, including connecting, reconnecting, and unavailable targets; stale resolves and stale controllers cannot mutate
• ordinary workspace/configuration/metadata/read-state/retirement authority rejects either half of the reserved Coordination identity/role pair, including corrupt persisted pairings
• workHubCoordinationSessionIdRef now participates in the current-scope guard alongside the generation
• also closed ordinary session.create, branch/revision copy, and generic root-execution paths over the reserved identity; missing-model startup is visible and retryable

Exact-head CI is green, and the final Standards/Spec adversarial re-review has no findings.

[Astro-Han]

Update on 35efcd6d9b:

No blocking issues. The prior generation/identity P2s are now closed: default-Host changes correctly invalidate the old generation, and the Coordination identity is protected across copy paths.

[P3] Copy reservation only protects the target, not the source

session-revision-coordinator.ts:179 checks only targetSessionId. A valid Coordination Session supplied as sourceSessionId can still be copied into an ordinary Session, exposing hidden messages. This is latent until Slice 3 writes transcripts, but should be rejected before admission.

Checks on 35efcd6d9b are test: success.

简体中文

该头无阻断，剩余 P3 为源侧拷贝保护。

[ARE404]

Self-review pass over this slice, graded by severity. Fixes for all seven follow in the next commit.

P1 — correctness, must fix before merge

1. validCoordinationHeader treats cwd as part of the identity, and nothing can repair the mismatch.
workhub-coordination-coordinator.ts requires header.cwd === join(stateRoot, 'workhub-coordination'). The create fingerprint is a constant, so after the state root moves to a different absolute path — restoring the state directory on a new machine, a renamed home directory, a remote Host whose home path changed — probeStableSessionCreate still answers existing, the cwd comparison fails, and #resolve returns identityConflict() forever. This slice deliberately blocks session.remove, session.lifecycle.set, session.workspace.relocate, session.configuration.update and session.metadata.update for the reserved identity, so there is no product path left to repair or drop the stale row: WorkHub becomes permanently unopenable and the surface tells the user to check their default model, which is not the problem. cwd is repairable state, not identity — resolve should relocate it instead of rejecting.

2. The copy reservation covers the target but not the source.
session-revision-coordinator.ts rejects the reserved identity only as input.targetSessionId. The Coordination Session is still a legal source for session.conversation.copy (ordinary copy, revision, and side conversation): the source header is only checked for archived / subagentParent / Deep Research. #createInput does not carry role, so the identity/role pairing check in createStableSession passes and the copy lands as an ordinary Session holding the Coordination transcript — with an ordinary id and no role, so runtimeHostExecutionUnavailableReason also lets it run Turns. Any owner client can reach this: workhub.coordination.resolve hands out the id, and the copy does the rest.

P2 — should fix in this PR

3. The Coordination workspace directory is only guaranteed at provisioning time.
mkdir runs on the create branch only. If stateRoot/workhub-coordination is later removed — a pruned state directory, a database restored without its sibling directory — the existing branch compares the cwd string, reports success, and the directory never comes back. mkdir with recursive is idempotent; running it before the probe makes both branches converge on the same guarantee.

4. A default Host that is not ready leaves WorkHub on an indefinite spinner.
workhub-coordination-lifecycle.ts always revokes on a default-Host change but only re-resolves when readiness === 'ready', and revoke() clears failedGeneration. When the default Host goes unavailable (crash, failed respawn, onTargetRemoved), reportFailure never runs, so the surface stays on Preparing WorkHub… with no error and no Retry, and the connection_list_changed handler cannot restart it either because it is gated on failedGeneration === generation. Recovery waits for a ready event that may never arrive. connecting / reconnecting should keep the spinner; unavailable should report a failure.

P3 — cleanups

5. Every resolveCreateTarget() failure is reported as a missing default model.
The bare catch maps any error to operation_conflict / “requires an available default model”. resolveExternalSessionImportTarget also awaits the runtime policy read, which raises persistence_failed / “Runtime policy is unavailable”; the user is then told to fix a model setting that was never wrong, and the real persistence failure is never surfaced.

6. #updateMetadata reads the header snapshot twice.
The new snapshot read and Coordination guard duplicate the read and guard #replaceUserLabels already performs inside the same admission lease, on the same sessionId. A label update now costs two identical reads, and rename / flag updates pay a new one on a hot path (auto-titling renames land on most Turns). Threading the record through removes both.

7. Unused import.
registerRuntimeHostSessionCatalogIpc is imported in runtime-host-session-catalog-ipc-main.test.ts and never referenced — it is the file's only change. Biome's allowlist has no unused-import rule, so nothing caught it.

[ARE404]

Pushed cd4b60ed8, which addresses all seven.

P1-1 — Coordination workspace no longer acts as identity.validCoordinationHeader checks the id/role pair, lineage and archive state only. The durable cwd is relocated in place under the admission lease with the probed revision, so a state directory restored under a different absolute path keeps its Session instead of answering operation_conflict forever. New regression: relocates the durable workspace when the Host state root moves.

P1-2 — the copy reservation now holds on both sides.#copy refuses the reserved id as a source, and #copyAdmitted refuses either half of the reserved pair once the source header is known. The two-client UDS regression now asserts both directions for session.branch.create and session.revision.create, and that the would-be target never appears in the catalog.

P2-3 — the workspace directory is ensured on reuse.mkdir moved above the probe, so both branches converge on the same guarantee and a pruned directory comes back before the identity is handed out. This also simplified the create branch: everything after the probe is now a single outcome-unknown boundary. New regression: restores a Coordination workspace that was pruned after provisioning.

P2-4 — an unavailable default Host reports a failure.connecting and reconnecting still hold the loading state; unavailable (and removed) now reports through the same path a rejected resolve takes, so the surface shows the error with Retry and the availability subscription can reopen the generation. New regression: WorkHub reports an unavailable default Host instead of holding the loading state.

P3-5 — a persistence_failed model-authority read keeps its code and message; everything else still maps to the default-model conflict. Covered by separates an unreadable model authority from a missing default model.

P3-6 — #updateMetadata reads the admitted snapshot once and threads it into label replacement; #replaceUserLabels became the pure replaceUserLabels(current, …).

P3-7 — unused import removed.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check all clean. Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on cd4b60ed86:

No blocking issues. The source-side copy guard now correctly rejects reserved source Sessions, and workspace/generation handling is sound.

Checks on cd4b60ed86 — code GO, no P0-P3.

简体中文

该头未发现阻断。

[ARE404]

Both P3 depth items are in 9966f7ae7.

1 — the id/role pairing moved into the header builder.assertCoordinationIdentityPairing(sessionId, role) now runs inside buildSessionHeader(), so createSubagent() and createAgentGraphOperator() meet the same invariant as createStableSession() rather than depending on their inputs never carrying a role.

createStableSession() keeps its own call to the assertion, deliberately: it runs before claimStableSessionCreate(), and the builder runs after. Dropping the early one would let a malformed request write a durable create claim for the identity it names, which a later legitimate create would then see as a conflict. Same fact, asserted at the boundary that must fail before a write and at the low-level constructor that every creator shares.

Regression extended: requires the reserved WorkHub Coordination identity and role together now rejects a role claimed through both sibling creators and asserts the store stays empty afterwards.

2 — the metadata role scope has no default.SqliteSessionMetadataStore.list() takes (filter: SessionListFilter | undefined, roleScope: SessionMetadataRoleScope), both required, and the type is exported so a call site names its scope. The three readers now read as: catalog 'ordinary', recovery 'recoverable', usage statistics 'all' — the last stated explicitly with a note that a durable cost aggregate counts every Session that spent tokens, including rows a catalog hides.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check clean. Storage 940 passed / 14 skipped, Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on 9966f7ae7b:

No blocking issues. The delta makes Coordination identity/role pairing pre-claim and shared across Session creators, correct for preventing ordinary copies from capturing the reserved Session.

Checks on 9966f7ae7b are test: success.

简体中文

该头未发现阻断。

[Astro-Han]

APPROVE — 9966f7a, no P0-P3, identity pairing correctly pre-claimed.

[ARE404]

Summary

• provision and reuse one stable Coordination Session per Runtime Host through the existing Session/SQLite authority
• revoke an old Host scope as soon as the default Host changes, and retry recoverable provisioning when model authority becomes available
• reserve the Coordination identity/role pair from ordinary creation, copies, configuration, retirement, catalogs, and root execution

Refs #3492

Authority and deferred work

Session remains the only durable substrate: this adds no second WorkHub database, event store, lifecycle authority, or transcript copy. Each Runtime Host remains independent; cross-Host coordination is not supported.

Coordination transcript rendering and answer_here belong to Slice 3. Model dispositions, the deterministic Action Gate, bounded delegation links, and the deferred Work cardinality decision remain for later slices.

UI evidence

Missing default model	Recovered after model configuration

Verification

• npm run lint
• npm run format:check
• git diff --check
• npm run typecheck
• npm run build
• Storage focused regressions: 29 passed
• Runtime Host: 1,156 passed
• Runtime Host two-client branch/revision regression: 1 passed
• Desktop: 1,506 passed
• Electron default-model failure/recovery e2e: 1 passed
• Standards and Spec adversarial review: no findings
• GitHub CI: passed for exact head 35efcd6d9, including Desktop e2e, browser smoke, Storybook, and installed CLI validation

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and tested the lifecycle, storage boundary, protocol, Desktop integration, review fixes, and Standards/Spec reviews.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally or in clean CI

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

I reviewed this head and found blocking issues.

[P2] Default-Host switch while not ready leaves old generation active

Switching default Host to a reconnecting/unavailable Host does not increment the generation, so late results from the previous Host still pass checks and WorkHub continues using the old Host until the new one becomes ready — which may never happen.

[P2] Ordinary workspace relocation can permanently break Coordination identity

session.workspace.relocate can change the reserved maka_workhub_coordination cwd/projectId, after which the next resolve permanently fails with operation_conflict and the row is hidden with no repair path.

[P3] Write-only ref duplication

workHubCoordinationSessionIdRef is never read; state is the sole authority.

Checks on becd9f133e are test: success.

简体中文

存在两项身份/代次阻断与一项冗余。

[ARE404]

Addressed the review findings in 35efcd6d9:

• every default-Host change now revokes the old generation immediately, including connecting, reconnecting, and unavailable targets; stale resolves and stale controllers cannot mutate
• ordinary workspace/configuration/metadata/read-state/retirement authority rejects either half of the reserved Coordination identity/role pair, including corrupt persisted pairings
• workHubCoordinationSessionIdRef now participates in the current-scope guard alongside the generation
• also closed ordinary session.create, branch/revision copy, and generic root-execution paths over the reserved identity; missing-model startup is visible and retryable

Exact-head CI is green, and the final Standards/Spec adversarial re-review has no findings.

[Astro-Han]

Update on 35efcd6d9b:

No blocking issues. The prior generation/identity P2s are now closed: default-Host changes correctly invalidate the old generation, and the Coordination identity is protected across copy paths.

[P3] Copy reservation only protects the target, not the source

session-revision-coordinator.ts:179 checks only targetSessionId. A valid Coordination Session supplied as sourceSessionId can still be copied into an ordinary Session, exposing hidden messages. This is latent until Slice 3 writes transcripts, but should be rejected before admission.

Checks on 35efcd6d9b are test: success.

简体中文

该头无阻断，剩余 P3 为源侧拷贝保护。

[ARE404]

Self-review pass over this slice, graded by severity. Fixes for all seven follow in the next commit.

P1 — correctness, must fix before merge

1. validCoordinationHeader treats cwd as part of the identity, and nothing can repair the mismatch.
workhub-coordination-coordinator.ts requires header.cwd === join(stateRoot, 'workhub-coordination'). The create fingerprint is a constant, so after the state root moves to a different absolute path — restoring the state directory on a new machine, a renamed home directory, a remote Host whose home path changed — probeStableSessionCreate still answers existing, the cwd comparison fails, and #resolve returns identityConflict() forever. This slice deliberately blocks session.remove, session.lifecycle.set, session.workspace.relocate, session.configuration.update and session.metadata.update for the reserved identity, so there is no product path left to repair or drop the stale row: WorkHub becomes permanently unopenable and the surface tells the user to check their default model, which is not the problem. cwd is repairable state, not identity — resolve should relocate it instead of rejecting.

2. The copy reservation covers the target but not the source.
session-revision-coordinator.ts rejects the reserved identity only as input.targetSessionId. The Coordination Session is still a legal source for session.conversation.copy (ordinary copy, revision, and side conversation): the source header is only checked for archived / subagentParent / Deep Research. #createInput does not carry role, so the identity/role pairing check in createStableSession passes and the copy lands as an ordinary Session holding the Coordination transcript — with an ordinary id and no role, so runtimeHostExecutionUnavailableReason also lets it run Turns. Any owner client can reach this: workhub.coordination.resolve hands out the id, and the copy does the rest.

P2 — should fix in this PR

3. The Coordination workspace directory is only guaranteed at provisioning time.
mkdir runs on the create branch only. If stateRoot/workhub-coordination is later removed — a pruned state directory, a database restored without its sibling directory — the existing branch compares the cwd string, reports success, and the directory never comes back. mkdir with recursive is idempotent; running it before the probe makes both branches converge on the same guarantee.

4. A default Host that is not ready leaves WorkHub on an indefinite spinner.
workhub-coordination-lifecycle.ts always revokes on a default-Host change but only re-resolves when readiness === 'ready', and revoke() clears failedGeneration. When the default Host goes unavailable (crash, failed respawn, onTargetRemoved), reportFailure never runs, so the surface stays on Preparing WorkHub… with no error and no Retry, and the connection_list_changed handler cannot restart it either because it is gated on failedGeneration === generation. Recovery waits for a ready event that may never arrive. connecting / reconnecting should keep the spinner; unavailable should report a failure.

P3 — cleanups

5. Every resolveCreateTarget() failure is reported as a missing default model.
The bare catch maps any error to operation_conflict / “requires an available default model”. resolveExternalSessionImportTarget also awaits the runtime policy read, which raises persistence_failed / “Runtime policy is unavailable”; the user is then told to fix a model setting that was never wrong, and the real persistence failure is never surfaced.

6. #updateMetadata reads the header snapshot twice.
The new snapshot read and Coordination guard duplicate the read and guard #replaceUserLabels already performs inside the same admission lease, on the same sessionId. A label update now costs two identical reads, and rename / flag updates pay a new one on a hot path (auto-titling renames land on most Turns). Threading the record through removes both.

7. Unused import.
registerRuntimeHostSessionCatalogIpc is imported in runtime-host-session-catalog-ipc-main.test.ts and never referenced — it is the file's only change. Biome's allowlist has no unused-import rule, so nothing caught it.

[ARE404]

Pushed cd4b60ed8, which addresses all seven.

P1-1 — Coordination workspace no longer acts as identity.validCoordinationHeader checks the id/role pair, lineage and archive state only. The durable cwd is relocated in place under the admission lease with the probed revision, so a state directory restored under a different absolute path keeps its Session instead of answering operation_conflict forever. New regression: relocates the durable workspace when the Host state root moves.

P1-2 — the copy reservation now holds on both sides.#copy refuses the reserved id as a source, and #copyAdmitted refuses either half of the reserved pair once the source header is known. The two-client UDS regression now asserts both directions for session.branch.create and session.revision.create, and that the would-be target never appears in the catalog.

P2-3 — the workspace directory is ensured on reuse.mkdir moved above the probe, so both branches converge on the same guarantee and a pruned directory comes back before the identity is handed out. This also simplified the create branch: everything after the probe is now a single outcome-unknown boundary. New regression: restores a Coordination workspace that was pruned after provisioning.

P2-4 — an unavailable default Host reports a failure.connecting and reconnecting still hold the loading state; unavailable (and removed) now reports through the same path a rejected resolve takes, so the surface shows the error with Retry and the availability subscription can reopen the generation. New regression: WorkHub reports an unavailable default Host instead of holding the loading state.

P3-5 — a persistence_failed model-authority read keeps its code and message; everything else still maps to the default-model conflict. Covered by separates an unreadable model authority from a missing default model.

P3-6 — #updateMetadata reads the admitted snapshot once and threads it into label replacement; #replaceUserLabels became the pure replaceUserLabels(current, …).

P3-7 — unused import removed.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check all clean. Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on cd4b60ed86:

No blocking issues. The source-side copy guard now correctly rejects reserved source Sessions, and workspace/generation handling is sound.

Checks on cd4b60ed86 — code GO, no P0-P3.

简体中文

该头未发现阻断。

[ARE404]

Both P3 depth items are in 9966f7ae7.

1 — the id/role pairing moved into the header builder.assertCoordinationIdentityPairing(sessionId, role) now runs inside buildSessionHeader(), so createSubagent() and createAgentGraphOperator() meet the same invariant as createStableSession() rather than depending on their inputs never carrying a role.

createStableSession() keeps its own call to the assertion, deliberately: it runs before claimStableSessionCreate(), and the builder runs after. Dropping the early one would let a malformed request write a durable create claim for the identity it names, which a later legitimate create would then see as a conflict. Same fact, asserted at the boundary that must fail before a write and at the low-level constructor that every creator shares.

Regression extended: requires the reserved WorkHub Coordination identity and role together now rejects a role claimed through both sibling creators and asserts the store stays empty afterwards.

2 — the metadata role scope has no default.SqliteSessionMetadataStore.list() takes (filter: SessionListFilter | undefined, roleScope: SessionMetadataRoleScope), both required, and the type is exported so a call site names its scope. The three readers now read as: catalog 'ordinary', recovery 'recoverable', usage statistics 'all' — the last stated explicitly with a note that a durable cost aggregate counts every Session that spent tokens, including rows a catalog hides.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check clean. Storage 940 passed / 14 skipped, Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on 9966f7ae7b:

No blocking issues. The delta makes Coordination identity/role pairing pre-claim and shared across Session creators, correct for preventing ordinary copies from capturing the reserved Session.

Checks on 9966f7ae7b are test: success.

简体中文

该头未发现阻断。

[Astro-Han]

APPROVE — 9966f7a, no P0-P3, identity pairing correctly pre-claimed.

[ARE404]

Summary

• provision and reuse one stable Coordination Session per Runtime Host through the existing Session/SQLite authority
• revoke an old Host scope as soon as the default Host changes, and retry recoverable provisioning when model authority becomes available
• reserve the Coordination identity/role pair from ordinary creation, copies, configuration, retirement, catalogs, and root execution

Refs #3492

Authority and deferred work

Session remains the only durable substrate: this adds no second WorkHub database, event store, lifecycle authority, or transcript copy. Each Runtime Host remains independent; cross-Host coordination is not supported.

Coordination transcript rendering and answer_here belong to Slice 3. Model dispositions, the deterministic Action Gate, bounded delegation links, and the deferred Work cardinality decision remain for later slices.

UI evidence

Missing default model	Recovered after model configuration

Verification

• npm run lint
• npm run format:check
• git diff --check
• npm run typecheck
• npm run build
• Storage focused regressions: 29 passed
• Runtime Host: 1,156 passed
• Runtime Host two-client branch/revision regression: 1 passed
• Desktop: 1,506 passed
• Electron default-model failure/recovery e2e: 1 passed
• Standards and Spec adversarial review: no findings
• GitHub CI: passed for exact head 35efcd6d9, including Desktop e2e, browser smoke, Storybook, and installed CLI validation

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Codex implemented and tested the lifecycle, storage boundary, protocol, Desktop integration, review fixes, and Standards/Spec reviews.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally or in clean CI

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No

[Astro-Han]

I reviewed this head and found blocking issues.

[P2] Default-Host switch while not ready leaves old generation active

Switching default Host to a reconnecting/unavailable Host does not increment the generation, so late results from the previous Host still pass checks and WorkHub continues using the old Host until the new one becomes ready — which may never happen.

[P2] Ordinary workspace relocation can permanently break Coordination identity

session.workspace.relocate can change the reserved maka_workhub_coordination cwd/projectId, after which the next resolve permanently fails with operation_conflict and the row is hidden with no repair path.

[P3] Write-only ref duplication

workHubCoordinationSessionIdRef is never read; state is the sole authority.

Checks on becd9f133e are test: success.

简体中文

存在两项身份/代次阻断与一项冗余。

[ARE404]

Addressed the review findings in 35efcd6d9:

• every default-Host change now revokes the old generation immediately, including connecting, reconnecting, and unavailable targets; stale resolves and stale controllers cannot mutate
• ordinary workspace/configuration/metadata/read-state/retirement authority rejects either half of the reserved Coordination identity/role pair, including corrupt persisted pairings
• workHubCoordinationSessionIdRef now participates in the current-scope guard alongside the generation
• also closed ordinary session.create, branch/revision copy, and generic root-execution paths over the reserved identity; missing-model startup is visible and retryable

Exact-head CI is green, and the final Standards/Spec adversarial re-review has no findings.

[Astro-Han]

Update on 35efcd6d9b:

No blocking issues. The prior generation/identity P2s are now closed: default-Host changes correctly invalidate the old generation, and the Coordination identity is protected across copy paths.

[P3] Copy reservation only protects the target, not the source

session-revision-coordinator.ts:179 checks only targetSessionId. A valid Coordination Session supplied as sourceSessionId can still be copied into an ordinary Session, exposing hidden messages. This is latent until Slice 3 writes transcripts, but should be rejected before admission.

Checks on 35efcd6d9b are test: success.

简体中文

该头无阻断，剩余 P3 为源侧拷贝保护。

[ARE404]

Self-review pass over this slice, graded by severity. Fixes for all seven follow in the next commit.

P1 — correctness, must fix before merge

1. validCoordinationHeader treats cwd as part of the identity, and nothing can repair the mismatch.
workhub-coordination-coordinator.ts requires header.cwd === join(stateRoot, 'workhub-coordination'). The create fingerprint is a constant, so after the state root moves to a different absolute path — restoring the state directory on a new machine, a renamed home directory, a remote Host whose home path changed — probeStableSessionCreate still answers existing, the cwd comparison fails, and #resolve returns identityConflict() forever. This slice deliberately blocks session.remove, session.lifecycle.set, session.workspace.relocate, session.configuration.update and session.metadata.update for the reserved identity, so there is no product path left to repair or drop the stale row: WorkHub becomes permanently unopenable and the surface tells the user to check their default model, which is not the problem. cwd is repairable state, not identity — resolve should relocate it instead of rejecting.

2. The copy reservation covers the target but not the source.
session-revision-coordinator.ts rejects the reserved identity only as input.targetSessionId. The Coordination Session is still a legal source for session.conversation.copy (ordinary copy, revision, and side conversation): the source header is only checked for archived / subagentParent / Deep Research. #createInput does not carry role, so the identity/role pairing check in createStableSession passes and the copy lands as an ordinary Session holding the Coordination transcript — with an ordinary id and no role, so runtimeHostExecutionUnavailableReason also lets it run Turns. Any owner client can reach this: workhub.coordination.resolve hands out the id, and the copy does the rest.

P2 — should fix in this PR

3. The Coordination workspace directory is only guaranteed at provisioning time.
mkdir runs on the create branch only. If stateRoot/workhub-coordination is later removed — a pruned state directory, a database restored without its sibling directory — the existing branch compares the cwd string, reports success, and the directory never comes back. mkdir with recursive is idempotent; running it before the probe makes both branches converge on the same guarantee.

4. A default Host that is not ready leaves WorkHub on an indefinite spinner.
workhub-coordination-lifecycle.ts always revokes on a default-Host change but only re-resolves when readiness === 'ready', and revoke() clears failedGeneration. When the default Host goes unavailable (crash, failed respawn, onTargetRemoved), reportFailure never runs, so the surface stays on Preparing WorkHub… with no error and no Retry, and the connection_list_changed handler cannot restart it either because it is gated on failedGeneration === generation. Recovery waits for a ready event that may never arrive. connecting / reconnecting should keep the spinner; unavailable should report a failure.

P3 — cleanups

5. Every resolveCreateTarget() failure is reported as a missing default model.
The bare catch maps any error to operation_conflict / “requires an available default model”. resolveExternalSessionImportTarget also awaits the runtime policy read, which raises persistence_failed / “Runtime policy is unavailable”; the user is then told to fix a model setting that was never wrong, and the real persistence failure is never surfaced.

6. #updateMetadata reads the header snapshot twice.
The new snapshot read and Coordination guard duplicate the read and guard #replaceUserLabels already performs inside the same admission lease, on the same sessionId. A label update now costs two identical reads, and rename / flag updates pay a new one on a hot path (auto-titling renames land on most Turns). Threading the record through removes both.

7. Unused import.
registerRuntimeHostSessionCatalogIpc is imported in runtime-host-session-catalog-ipc-main.test.ts and never referenced — it is the file's only change. Biome's allowlist has no unused-import rule, so nothing caught it.

[ARE404]

Pushed cd4b60ed8, which addresses all seven.

P1-1 — Coordination workspace no longer acts as identity.validCoordinationHeader checks the id/role pair, lineage and archive state only. The durable cwd is relocated in place under the admission lease with the probed revision, so a state directory restored under a different absolute path keeps its Session instead of answering operation_conflict forever. New regression: relocates the durable workspace when the Host state root moves.

P1-2 — the copy reservation now holds on both sides.#copy refuses the reserved id as a source, and #copyAdmitted refuses either half of the reserved pair once the source header is known. The two-client UDS regression now asserts both directions for session.branch.create and session.revision.create, and that the would-be target never appears in the catalog.

P2-3 — the workspace directory is ensured on reuse.mkdir moved above the probe, so both branches converge on the same guarantee and a pruned directory comes back before the identity is handed out. This also simplified the create branch: everything after the probe is now a single outcome-unknown boundary. New regression: restores a Coordination workspace that was pruned after provisioning.

P2-4 — an unavailable default Host reports a failure.connecting and reconnecting still hold the loading state; unavailable (and removed) now reports through the same path a rejected resolve takes, so the surface shows the error with Retry and the availability subscription can reopen the generation. New regression: WorkHub reports an unavailable default Host instead of holding the loading state.

P3-5 — a persistence_failed model-authority read keeps its code and message; everything else still maps to the default-model conflict. Covered by separates an unreadable model authority from a missing default model.

P3-6 — #updateMetadata reads the admitted snapshot once and threads it into label replacement; #replaceUserLabels became the pure replaceUserLabels(current, …).

P3-7 — unused import removed.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check all clean. Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on cd4b60ed86:

No blocking issues. The source-side copy guard now correctly rejects reserved source Sessions, and workspace/generation handling is sound.

Checks on cd4b60ed86 — code GO, no P0-P3.

简体中文

该头未发现阻断。

[ARE404]

Both P3 depth items are in 9966f7ae7.

1 — the id/role pairing moved into the header builder.assertCoordinationIdentityPairing(sessionId, role) now runs inside buildSessionHeader(), so createSubagent() and createAgentGraphOperator() meet the same invariant as createStableSession() rather than depending on their inputs never carrying a role.

createStableSession() keeps its own call to the assertion, deliberately: it runs before claimStableSessionCreate(), and the builder runs after. Dropping the early one would let a malformed request write a durable create claim for the identity it names, which a later legitimate create would then see as a conflict. Same fact, asserted at the boundary that must fail before a write and at the low-level constructor that every creator shares.

Regression extended: requires the reserved WorkHub Coordination identity and role together now rejects a role claimed through both sibling creators and asserts the store stays empty afterwards.

2 — the metadata role scope has no default.SqliteSessionMetadataStore.list() takes (filter: SessionListFilter | undefined, roleScope: SessionMetadataRoleScope), both required, and the type is exported so a call site names its scope. The three readers now read as: catalog 'ordinary', recovery 'recoverable', usage statistics 'all' — the last stated explicitly with a note that a durable cost aggregate counts every Session that spent tokens, including rows a catalog hides.

Local: npm run typecheck, npm run format:check, npm run lint, git diff --check clean. Storage 940 passed / 14 skipped, Runtime Host 1,159 passed, Desktop 1,487 passed.

[Astro-Han]

Update on 9966f7ae7b:

No blocking issues. The delta makes Coordination identity/role pairing pre-claim and shared across Session creators, correct for preventing ordinary copies from capturing the reserved Session.

Checks on 9966f7ae7b are test: success.

简体中文

该头未发现阻断。

[Astro-Han]

APPROVE — 9966f7a, no P0-P3, identity pairing correctly pre-claimed.