feat(workhub): add work identity, prompt status, and keyboard selection - #5198

Design verdict. Target selection is decided at the right authority: the Host keeps the pending offer (per-Turn, 64 entries, 10 min TTL), re-validates the opaque candidateRef against a fresh candidate set, binds the durable routingDecision before admission, and the renderer only echoes requestId + candidateRef. Loss of the offer (Host restart, expiry, removed target, second prompt) degrades to "ask again", which is fine for unadmitted draft state. But the pause is signalled by throwing TargetSelectionRequired out of prepareWorkHubRoutingDecision / prepareFreshContent, through RootTurnCoordinator.startRootMessage, and catching it back in the coordinator. startRootMessage runs under runCommand, which treats any non-whitelisted error as an authority failure and drains the Host. The selector therefore takes the Runtime Host down on its first use. Not merge-ready; the fix is local in shape (return a value instead of throwing) but must go through the root authority's outcome type.

P0 — Every ambiguous prompt drains the Runtime Host

Reachability ①: user sends a prompt the routing model classifies clarify.

• packages/runtime-host/src/server/workhub-coordination-coordinator.ts:808,898 throw TargetSelectionRequired; :919,923,927 throw plain Error from #selectedRoutingDecision, which runs inside prepareFreshContent.
• Both run inside startRootMessage's admission task (packages/runtime-host/src/server/root-turn-coordinator.ts:2032-2155), which is wrapped by runCommand (:3347-3360): anything that is not RuntimeHostedRootConflictError / RuntimeHostedRootUnavailableError / HostedRootAdmissionGateError / shutdown-cancel calls this.requestHostDrain() before rethrowing.
• packages/runtime-host/src/server/host-kernel.ts:356-364 then sets #shutdownRequested, arms the shutdown deadline and begins the composition drain; every later operation, including the selection answer, is refused with host_draining (:622).

Repro (ran locally through the real RootTurnCoordinator, then removed): append to root-turn-coordinator.test.ts a createFailureFixture({ prepareWorkHubRoutingDecision: async () => { throw new Error('WorkHub target selection required'); } }), create the coordination stable session, call startWorkHubCoordinationMessage(...). It rejects and fixture.drainRequested() === true; no admission is written. The PR's coordinator test cannot see this because its startWorkHubCoordinationMessage fixture bypasses RootTurnCoordinator.

Fix: make the pause a value, not an exception. prepareWorkHubRoutingDecision returns { kind: 'decision', decision } | { kind: 'target_selection', request }; prepareFreshWorkHubExecution propagates it and startRootMessage returns completedStart(...) with a dedicated outcome (e.g. ok: false, code: 'target_selection_required', request) that #answer maps to targetSelection. #selectedRoutingDecision returns { kind: 'rejected', outcome: turnFailure('operation_conflict', …) } through prepareFreshContent instead of throwing (today a mismatched candidateRef also surfaces as internal_failure + console.error, operation-dispatcher.ts:369-377). Add the real-authority test above with drainRequested() === false.

P1 — Intent-unclear prompts can no longer reach the assistant

Reachability ①: any prompt whose intent the model cannot classify ("hi", "帮我看看这个").

applyWorkHubRoutingPolicy maps intent.kind === 'unclear' to clarify (packages/core/src/workhub-routing.ts:127). The coordinator turns every model clarify into a selector when allowTargetSelection (workhub-coordination-coordinator.ts:866-878), and startRootMessage always passes true (root-turn-coordinator.ts:2096). The selector offers only existing candidates, create_new, or "continue explaining", which returns the draft unsent (apps/desktop/src/renderer/features/workhub/ui/workhub-target-selector.tsx:44-54, use-workhub-controller.ts:186-198). On main a clarify Turn is admitted and the assistant asks in conversation; now "Which work do you want to continue?" is shown for prompts that are not about continuing work, and there is no way to deliver them. The test asserts this ('intent clarification also waits before admission').

Fix (smallest): add a third selection { kind: 'answer_here' } that admits with { disposition: 'answer_here' }, and make the "none of these" button send it instead of dismissing. Alternative: let the policy distinguish target ambiguity from intent ambiguity and only pause on the former.

P2 — New text and keycaps are hand-rolled instead of Astryx roles

Reachability ① (every rendered label). RadioList, Button and TextInput are used correctly; the surrounding text is not. packages/ui/src/choice-panel.tsx:83 renders a raw <kbd className="maka-choice-shortcut"> where Astryx exports Kbd; the hint at :85, workhub-selection-hint and workhub-delegation-status are <p>/<span> with font-size: 11px/12px literals (workhub.css:281,307, packages/ui/src/styles.css:1147,1149), giving 15.7px/17.1px line boxes off the 4px grid. The Workspace / Session label is a Button variant="ghost" restyled by CSS to height: auto; padding: 0; font-size: 11px (workhub.css:275-281) — fighting the primitive to get a text-sized navigation control. DESIGN.md §7 "Role, Not Axes" and §9 "Use Astryx primitives as the default seam"; the settings pages already use <Text type="supporting" color="secondary"> 68 times. Fix: Kbd keys="1" for shortcuts; Text type="supporting" color="secondary" for hint and status; Link (no href renders a <button>) with type="supporting" for the identity label, keeping only the --workhub-work-hue override since Astryx has no per-hue variant. That removes the three CSS literals and the ghost-button override.

Notes (not blocking)

• AskUserQuestion vs. selector. Two composer-area choice surfaces now exist with different plumbing (Host-transient offer vs. interaction authority). Keeping target selection before admission is justified because the routing decision must be durable before the model runs; say so in the PR body so the split does not look accidental.
• Epoch. 143 is correct against current main (142). #5164 also bumps 142→144; whichever merges second must re-bump.
• Prompt status noise (P3). workhub-root.tsx:85 gives every historical turn_state a status, so every completed prompt reads "Completed · time" (verified in DOM for product-workhub--question-lifecycle and --colored-work-history). Only non-terminal, failed or aborted states change what the user does next; consider dropping completed for plain coordination turns.
• PNGs under docs/images/pr/ (P3). No tracked rule forbids them, but CONTRIBUTING.md:87 asks for screenshots in the PR, and the raw.githubusercontent.com/ARE404/... links die with the branch. Attach to the PR and drop the files.
• Scope. The unchecked real-model flow matters for merge only for AskUserQuestion under the bypass coordination session; the selector itself is fully exercised without a model once the P0 path is fixed.

Verified: @maka/runtime-host coordinator/protocol/tool-profile tests (41 pass); @maka/desktop workhub-send-visibility + workhub-anchor-rail (26 pass); both new tests go red with the fix reverted; storybook-static computed styles for product-workhub--colored-work-history, --target-selection, --question-lifecycle, product-ask-user-question--keyboard-choices in light and dark (accent bars 3px on the sender edge, labels oklch(0.42 0.075 h) / oklch(0.8 0.09 h), status before timestamp); real key presses select radios in both stories.

Status check on 9f31d58fa. Three commits landed since the last round; none touches packages/runtime-host or packages/core, so the P0 and P1 stand unchanged. 76639a86a resolves one inline item. bb8bf7ad0 is a new alignment tweak. 9f31d58fa adds a conversation filter that is not in the PR title, body, or any issue; as fresh code it has a P1 of its own. Still not merge-ready.

bb8bf7ad0 gives every WorkHub prompt a transparent 3px end border so unlinked and delegated prompts share a metadata edge, with a story assertion; no concerns.

9f31d58 — conversation filter: does not belong in this PR

Design. The commit adds a second interaction model on top of the identity rails: double-click / shift-click on a navigation item filters the conversation, a single click now opens the Session only after a 500 ms timer, and every linked prompt and answer grows an invisible 12 px <button> on its accent edge. None of this is in the PR summary, the verification list, or an issue. It lands mid-review on a PR that already carries an open P0, and it changes the primary rail gesture for everyone. Split it out and open it against a short design note (which gesture, why a hidden edge button when the visible label already opens the Work), after P0/P1 are fixed here.

P1 — Sending while filtered makes the user's own prompt disappear

Reachability ①: filter by any Work (edge button or rail double-click), type a follow-up, press Enter.

workhub-conversation.tsx:120-121,133 keep only messages, liveTurn, and transient messages whose turnId is in matchingTurns, and matchingTurns comes from workLinks, which linked-work.ts:64-96 derives only from durable delegation_assigned / tasks tool results. A new Turn has no link until delegation lands, so the optimistic bubble, the admitted prompt, the streaming answer, and the running status are all hidden; runningStatus is forced false (:134). Reproduced on product-workhub--colored-work-history in the static build: filter to 支付回调幂等性, send FILTERED_SEND_PROBE: transcript stays at 2 turns, no transient row, no running status, filter bar still shown; clearing the filter reveals 5 turns including the new prompt and answer. For a clarify/answer_here Turn the message never appears until the user clears the filter by hand.

Fix (smallest): clear selectedWork on send (highlight.selectWork(undefined) in the send path, or in the controller's send), so the transcript returns to the full view exactly when new content is about to arrive. If the filter is meant to survive a send, the pending Turn and the live Turn must be exempt from the filter until their link exists.

P2 — Single click on the navigation rail now waits 500 ms

Reachability ①: every click on a rail item. workhub-navigation-rail.tsx:141 defers onOpenSession behind setTimeout(..., 500) so a double-click can be distinguished; on main the same click opens immediately. Measured in the static build: a single click resolves nothing for 500 ms. The primary action of the rail should not pay for a secondary gesture; keyboard-only users already get the immediate path (event.detail === 0). If the filter stays, put it on a modifier or a distinct control and keep single click immediate.

P2 — Hidden 12 px edge buttons in the tab order

Reachability ①. Each linked prompt and answer renders .workhub-message-rail (chat-turn.tsx:575,645,675; workhub.css:321-323): 12 px wide, transparent, no text, tabIndex 0, positioned over the accent border. In product-workhub--colored-work-history that is six extra focus stops between the rail and the composer, each right before a visible identity button that already opens the same Work. Nothing on screen tells a pointer user the edge is clickable except the title. DESIGN.md's rule that an element must change the user's next action is not met; if a per-message filter entry is wanted, add it as a visible action on the existing label (MoreMenu or a second Button), not as an invisible hit area.