Track Codex app-server turn state

[myobie]

Review order

This is the next Codex implementation slice after #234. Read the native-delivery set in this order:

1. Specify declared native DING delivery #229 — shared native-delivery VRS
2. Add declared native delivery selector #230 — delivery selector and Doctor support
3. docs(vrs): specify Codex native DING delivery #233 — Codex app-server contract
4. Bind Codex app-server threads at controlled launch #234 — controlled launch and durable thread binding
5. this PR — subscribed turn-state watcher

#232 is the separate Claude contract. It remains parked on provider organization policy.

Summary

• subscribe the dedicated control connection to its bound thread with thread/resume
• persist the exact runtime incarnation, thread, subscription state, and delivery-relevant turn state
• track idle, one exact regular active turn, review, compaction, protocol error, and conflict holds
• ignore events from other threads and refuse stale control-state files
• preserve authored resume and fork selections instead of constraining them to an older saved binding
• distinguish client responses from server requests that reuse the same JSON-RPC ID

This PR is task 11 only. It does not select inbox messages, call turn/start or turn/steer, or record a delivery receipt.

Safety boundary

Only the latest unmatched turn/started event supplies an active turn ID. Review, compaction, conflicting turns, active-without-ID, notLoaded, and systemError are explicit hold states. An exact turn/completed event or a later idle thread status clears safe state to idle.

A new blank thread may report no rollout found when the control connection first calls thread/resume. The watcher treats only that exact response as deferred. It does not claim subscription success, and it retries after a later bound status change. Other protocol errors fail closed.

Verification

Green on exact head 0d98a6071961e5abb3dbaa1439156231c38ca869:

• cargo check --locked
• cargo test --locked --lib codex_app_server --no-fail-fast — 11/11
• cargo test --locked --test codex_app_server --no-fail-fast — 3/3
• cargo clippy --all-targets --locked — no new warnings; existing repository warnings remain
• rustfmt --check --edition 2024 src/codex_app_server.rs
• git diff --check

The repository-wide test command is not green in this checkout. It reports failures in catalog_diff, eval_up, native_only, and nomad_survival. This PR changes only src/codex_app_server.rs; hosted Nix remains the required full gate.

Live Codex receipt

The exact committed binary ran Codex CLI 0.145.0 through one private Unix socket. The control connection bound and subscribed to thread 019fecca-8538-7302-b13e-461d986bb6bd in runtime incarnation aa1c2bc10e718238a9d1bcb480a3ffeb. It persisted idle, then active with exact turn 019feccc-7559-7f12-9d4c-e5afbcfa277c, then idle after the TUI returned WATCH_ACTIVE_DONE.

The owned session exited 0. Its owner lock was free, no private socket remained, and the private proof root was removed after shutdown.

[myobie]

Folded into the reviewable implementation replacement #241 at exact head d8269638bc6a82e4b2f9ce29b2e8509be5bd2337. The replacement preserves this draft’s relevant history and has exact-head hosted Nix green. Closing this superseded draft; its branch is intentionally retained.