feat(delivery): make ledger attempts transactional

[schickling-assistant]

Problem

The delivery ledger used mutable in-memory state and split authorization from persistence. Concurrent pumps, recovery, retargeting, and late receipts could therefore act on stale state or let evidence for one attempt affect a later attempt. Operators also had no audited, fenced way to resolve a provably absent attempt, and the roster did not expose delivery holds as their own actionable axis.

Goal

Make one durable ledger transaction the sole transport permit. Fence every later action to the exact attempt, expose held delivery state to operators, and provide a narrow audited absence command without changing inbox archive authority.

Decisions

• Keep one permanent delivery-ledger.lock. Open it with no-follow semantics, serialize every mutation with the kernel lock, and publish through atomic file-and-directory fsync.
• Make claim the only transport permit. It re-reads under lock, preserves FIFO, mints a fresh 128-bit token, persists attempted, and only then returns a permit.
• Bind positive evidence, negative evidence, retargeting, and pruning to the full filename, provider binding, correlation, and attempt token fence. Stale operations land on nothing.
• Preserve ambiguous attempts across retargeting. Only settlement or authoritative negative evidence can release or replace an attempt.
• Add the bounded Q35 compatibility reader: canonical tokenless v1 rows get deterministic tokens during an ordinary provider transaction. Read-only observation and doctor never backfill. DELTA-007 counts the remaining rows.
• Add delivery-negative as an evidence-only operator boundary. It requires exact token and ledger digest preconditions, same-UID ownership, a bounded reason, and records a complete audit. It never transports, recovers, initializes, or backfills.
• Expose delivery as an independent absent | idle | held | indeterminate roster axis. Provider-private binding and correlation values remain private.
• Amend requirements T03/T04 and decision Q35. Johannes explicitly confirmed the bounded token backfill, so the constitutional requirement now states that exception and its deletion gate.

Verification

Focused behavior and regression coverage passed:

cargo test --lib delivery_ledger::tests::
32 passed, 1 ignored subprocess entrypoint

cargo test --lib codex_app_server::tests::
63 passed

cargo test --lib opencode_session::tests::
all passed

cargo test --test message_cli
all passed

cargo test --test status_agents
all passed

cargo test --test doctor
16 passed

cargo test --test invariants
2 passed

cargo test --test vrs_ledger
4 passed

Independent review found five P2 defects: provider retries ignored operator evidence, Codex retained a stale in-memory pending request, operator audit could outlive its receipt, non-adjacent duplicate filenames passed validation, and a repaired Codex ledger left a stale diagnostic. Each defect now has a focused regression. The reviewer re-read the fixes and reported no remaining correctness issue.

The repository-owned full gate passed with bounded host concurrency:

nix flake check --no-build
all x86_64-linux outputs evaluated

nix build .#checks.x86_64-linux.st2 --no-link --print-build-logs --max-jobs 1 --cores 2
Finished cargoCheckHook
checkPhase completed in 6 minutes 19 seconds
process completed in 11 minutes 6 seconds

Production evidence:

OpenCode 1.18.27
P2-OPENCODE-SEEN opencode-p2-4b8c91

The resulting OpenCode ledger retained one tokenized, correlated persisted attempt and a permanent lock. Starting the P2 Codex driver against the retained P1 tokenless ledger also durably backfilled its attempt token before transport.

Pre-flip deviations

• This repository has no devenv.nix, so devenv tasks run check:all is unavailable on both this branch and the merge base. The repository-owned checks.x86_64-linux.st2 derivation is the full local gate.
• A fresh supplementary Codex nonce probe could not pass the provider login gate because the selected local account link pointed to absent credential state. This is tracked by schickling/dotfiles#2353. P1 already proved a real Codex 0.153.0 nonce delivery; P2 adds full deterministic Codex transaction, operator-retry, crash, and recovery coverage, and the exact repository gate passed.

Complexity

The ledger core is larger because it now owns the complete transaction protocol, attempt identity, compatibility read, read-only observation, and operator preconditions. Keeping those rules in one provider-neutral module avoids five subtly different authorization implementations. No external dependency was added.

Concerns

• This PR depends on refactor(delivery): separate harness identity from evidence policy #514 and must land after it.
• Q35 is intentionally temporary. DELTA-007 must reach zero before the compatibility reader is removed.
• Draft PR feat: compose clean agent lifecycle states #513 overlaps shared CLI and VRS files. Whichever change lands second will need a semantic rebase; the delivery and desired-state behavior are otherwise independent.

Friction & bottlenecks

• A delegated worker ignored its explicit worktree and edited another branch. Those edits were restored before implementation; no unrelated diff remains.
• The shared build host reached 116 MiB available memory with swap exhausted during verification. The exact Nix gate used one job and two cores under the active build-admission incident schickling/dotfiles#2377.
• The full Nix gate reduced root free space from 119 GB to 100 GB while the host was already below its 200 GB floor. The underlying disk-pressure incident is schickling/dotfiles#2293; no cleanup or shared-process disruption was attempted.

Follow-ups

• Make native delivery claims transactional across all harnesses #506 P3: adopt the attempt-only ledger in pi and OMP.
• Make native delivery claims transactional across all harnesses #506 P4: adopt Claude and tighten the all-five invariant.
• DELTA-007: remove Q35 after fleet observation reaches zero tokenless rows.

References

Refs #506
Depends on #514

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.9exwnk6h
session	dev3.9exwnk6h
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.7
agent_runtime	OMP 18.1.7
tooling_profile	dotfiles@931583a