feat(agent): mutable address routing behind one typed selector

`st2 agent address <agent> <address>` becomes reachable, and every reference
plane resolves through the one algorithm decision 0015 mandates instead of each
site's own precedence filter.

- `message`'s resolution surface takes `&AgentSelector`, not `&str`: recipients,
  inboxes, state directories, message boxes, and archival all state which
  namespace they were named in. There is no `&str` arm left to fall back to, so a
  route can never be silently retyped as an exact subject or the reverse.
  Recipient matching moves from `bus_id == r || identity == r` to the effective
  address, with retirement handled by two books rather than a tie-break: a
  retired subject cannot make a live claimant ambiguous, and still answers to its
  own address when nothing routable does, keeping its retained state reachable.
- Every command that names an agent gains the exact `--id` / `--to-id` form,
  which resolves without consulting the address namespace at all.
- Drivers, channels, and hooks select their own subject by exact key, so an
  address cutover cannot disconnect a running seat from its own directories. A
  supervisor reference stays an ordinary address reference.
- `event::resolve_stream` routes through `identity::resolve` instead of a
  hand-rolled three-arm filter, which is also a fix: stream ingress had no
  dedupe-by-ID and no host pinning, so it did not implement the mandated
  algorithm. Built-in resync names its recipient by the agent key reconciliation
  holds, so publication survives a cutover; `st2 event emit` names an ordinary
  address, so the released spelling refuses at once.
- An interrupted send recovers by its record's canonical endpoint, which is an
  immutable key: a cutover between the pending write and the retry is a route
  change, not a changed recipient.

Durable state is untouched by design. `ST_AGENT`, default task IDs, session
socket paths, declaration-parent state, harness records, PTY tags, message
provenance, and supervisor edges are all keyed on values this cutover never
writes.

agent-identity: dev3.direct.omp.v6c4mkm2
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.1.2
agent-runtime: OMP 18.1.2
tooling-profile: dotfiles@7534055

Author: schickling-assistant

src/claude_mcp.rs

@@ -26,7 +26,7 @@ fn channel_content(subject: Option<&str>, body: &str) -> String {
 }
 
 pub fn run(catalog_root: &Path, identity: &str) -> Result<()> {
-    let agent_dir = message::resolve_agent_dir(catalog_root, identity, &crate::run::detect_host())?
+    let agent_dir = message::resolve_actor_dir(catalog_root, identity, &crate::run::detect_host())?
         .with_context(|| format!("Claude MCP agent '{identity}' is not declared"))?;
     let inbox = message::inbox_dir(&agent_dir);
     let (input_tx, input_rx) = mpsc::channel();

src/claude_session.rs

@@ -30,7 +30,7 @@ pub fn run(
     claude_argv: Vec<String>,
 ) -> Result<()> {
     let agent_dir =
-        message::resolve_agent_dir(catalog_root, &identity, &crate::run::detect_host())?
+        message::resolve_actor_dir(catalog_root, &identity, &crate::run::detect_host())?
             .with_context(|| format!("Claude driver agent '{identity}' is not declared"))?;
     anyhow::ensure!(
         !claude_argv.is_empty(),
@@ -159,7 +159,7 @@ pub fn run_observe(
     runtime_id: Option<&str>,
     event: &str,
 ) -> Result<()> {
-    let agent_dir = message::resolve_agent_dir(catalog_root, identity, &crate::run::detect_host())?
+    let agent_dir = message::resolve_actor_dir(catalog_root, identity, &crate::run::detect_host())?
         .with_context(|| format!("Claude driver agent '{identity}' is not declared"))?;
     // Counted only once the invocation has its application target: a hook for an undeclared
     // agent errors out before any state is applied and must not inflate `hook_invocations_total`.
@@ -464,7 +464,7 @@ pub fn run_statusline(catalog_root: &Path, identity: &str) -> Result<()> {
 
 fn record_statusline(catalog_root: &Path, identity: &str, raw: &[u8]) -> Result<()> {
     let payload: serde_json::Value = serde_json::from_slice(raw).unwrap_or(serde_json::Value::Null);
-    let agent_dir = message::resolve_agent_dir(catalog_root, identity, &crate::run::detect_host())?
+    let agent_dir = message::resolve_actor_dir(catalog_root, identity, &crate::run::detect_host())?
         .with_context(|| format!("Claude driver agent '{identity}' is not declared"))?;
     // Deliberately uncounted. The tee builds no telemetry pipeline at all (`DQ-C13`, see
     // `main`), so a `record_hook_invocation` here could never reach a collector — and a metric

src/codex_app_server.rs

@@ -31,7 +31,7 @@ use serde_json::{Value, json};
 use sha2::{Digest as _, Sha256};
 use tungstenite::{Message as WebSocketMessage, WebSocket};
 
-use crate::{ding, driver_diagnostic, harness_context, harness_state, message, run, status};
+use crate::{ding, driver_diagnostic, harness_context, harness_state, identity::AgentSelector, message, run, status};
 
 const REQUIRED_CODEX_CLIENT_REQUESTS: &[&str] = &[
     "hooks/list",
@@ -390,7 +390,7 @@ struct CodexDeliveryConfig {
 impl CodexDeliveryConfig {
     fn resolve(catalog_root: &Path, identity: &str) -> Result<Self> {
         let this_host = run::detect_host();
-        let agent_dir = message::resolve_agent_dir(catalog_root, identity, &this_host)?
+        let agent_dir = message::resolve_actor_dir(catalog_root, identity, &this_host)?
             .with_context(|| {
                 format!(
                     "Codex native delivery agent '{identity}' is not declared in {}",
@@ -431,11 +431,23 @@ impl CodexDeliveryConfig {
         key_hash.update(body.as_bytes());
         let idempotency_key = format!("st2.codex-protocol-rejection.v1:{:x}", key_hash.finalize());
         let tags = ["codex-protocol".to_string(), "launch-rejected".to_string()];
+        // This runtime names itself by exact key, never through its own mutable address.
+        let sender = match message::actor_selector(&self.catalog_root, &self.identity, &self.this_host)
+        {
+            Ok(sender) => sender,
+            Err(resolve_error) => {
+                eprintln!(
+                    "st2 codex: failed to resolve agent '{}' as the sender of a protocol rejection report: {resolve_error:#}",
+                    self.identity
+                );
+                return;
+            }
+        };
         if let Err(report_error) = message::send_to_resolved_inbox(
             &self.catalog_root,
-            supervisor,
+            &AgentSelector::Address(supervisor.to_owned()),
             &self.this_host,
-            &self.identity,
+            &sender,
             Some(&subject),
             None,
             &tags,