feat(delivery): add durable delivery ledger

[schickling-assistant]

Problem

The single-message delivery guard cannot represent several queued files or distinguish crash positions safely.

Goal

Track every message through monotone delivery phases without duplicate sends across restarts or rollback.

Decisions

• fresh st2.delivery-ledger.v1 namespace; no in-place legacy bump
• recipient archive remains consumption authority
• ambiguous attempts hold until typed negative evidence or resumed-history reconciliation
• one-shot legacy adoption never grants retry authority
• preserve the oldest outstanding v1 lower-bound record

Verification

• cargo test -p st2 --lib delivery_ledger::
• cargo test -p st2 --test delivery_ledger_migration
• typed quarantine tests for Codex and OpenCode
• independent review completed with no remaining P0-P2 findings

Complexity

The ledger is required to encode crash evidence per filename and preserve downgrade safety.

Concerns

Linux draft CI exceeded its 90-minute job window and was cancelled; Darwin and focused local tests passed.

Friction & bottlenecks

The repository-wide formatter traverses unrelated baseline files, so changed files were checked with git diff --check.

Follow-ups

#479 integrates this ledger with the v3 adapters.

References

Depends on #469.

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.9exwnk6h
session	dev3.9exwnk6h
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.7
agent_runtime	OMP 18.1.7
tooling_profile	dotfiles@931583a

[schickling-assistant]

Closing in favour of #484, which is merged as 29b5e7c.

#484 is a from-scratch delivery ledger rather than a revision of this branch. The core this PR established is kept verbatim — Profile::proves, the monotone phase lattice (attempted < transportAccepted < persisted < consumed), typed Evidence, per-filename entries, quarantine, and archive reconciliation. What is gone is the predecessor half: no delivery-state.json reader, no rollback floor, no adoption path, no writer gate, and no dead configuration axes (RetryPolicy, non-native CorrelationKind, Phase::Admitted, idempotent_resend, ceiling). Canonical production shrank from 1,009 to 497 LOC (measurements in the bakeoff baseline report).

That is a decision, not an oversight. Per decisions Q2/Q7 (seat dev3.direct.omp.43sz6ujq) the accepted harm is stated verbatim in #484's body:

At first open after upgrade, at most one in-flight pre-ledger attempt per seat may be re-sent once; the archive receipt keeps inbox settlement idempotent (decisions Q2/Q7, seat dev3.direct.omp.43sz6ujq). Legacy delivery-state.json files are ignored, not read or deleted.

Removing the predecessor reader also removes the three highest-priority findings from this PR's architecture review, which were all about the floor: the begin write-order window, floor retention until archive rather than phase release, and adoption only on the NotFound arm. The two findings that were not about migration are fixed in #484:

• per-entry correlation validation — an entry must rederive its own correlation from its own binding and filename, so an injected entry that merely shares another entry's value can no longer wedge a transport (every_entry_must_validate_its_own_correlation);
• the create_new + 0600 hardening the Codex record had is preserved, now under a temp name unique per process and per write (the_persisted_ledger_is_owner_only_and_leaves_no_temp_residue).

#484 also adds an INVARIANTS.md row, Durable native delivery ownership, with eight real proof tests.

Branch schickling-assistant/2026-09-05-delivery-ledger-v1 is kept.

Gate on #484: nix build .#st2 --no-link -L exit 0, 929 tests, all 11 delivery_ledger tests green.

agent-identity: dev3.direct.omp.43sz6ujq

Posted on behalf of @schickling

field	value
agent_identity	dev3.direct.omp.43sz6ujq
session	dev3.43sz6ujq
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.1.7
agent_runtime	OMP 18.1.7
tooling_profile	dotfiles@39a19af