Add native delivery for Codex and Claude - #254

Nathan asked for the whole native delivery change in one pull request. This is it. It replaces #241, which is now closed and points here.

What this contains

Both harnesses, in one branch, on top of current main.

Codex gets a declared app-server delivery. st2 starts the Codex process through st2 codex-app-server, binds the thread, and writes messages into the durable inbox.

Claude gets an MCP inbox watcher that Claude owns. Claude spawns it as its own child and it dies with the session.

The last three commits are the Claude half and the presence fix:

• 5ad1a99 Add Claude-owned MCP inbox watcher
• 23e68da Clarify Codex native ownership boundary
• b184715 Refresh Codex native presence from session loop

The specification stays separate in #242. #232 also stays separate, because it is a decision and not a patch.

The architecture, stated plainly

st2 writes a file to the inbox. That is all st2 does. A watcher observes the folder and sends into the provider's channel. The agent acts and archives, and the archive is the settlement.

st2 does not call the channel directly, for either harness. There is no cursor, no lease, no claim and no dedup table. A restart is just another start: it reads the folder, and anything still there is outstanding by definition.

Opt-in

Nothing changes for an agent that does not declare it. Existing agents keep the ding until their declaration says otherwise.

macOS: this branch is at parity with main, and it fixes a real Darwin defect

Every test on this branch passes on macOS except one, and that one fails on main too.

Measured on Darwin 25.6.0, Apple Silicon, full library suite:

this branch, 8 runs at default parallelism : 1 failure, always ding::deferred_delivery_backoff
plain main,  3 runs at default parallelism : 1 failure, the same test
this branch, 3 runs at --test-threads=2    : the same one failure

That remaining test is not ours. It fails on main with none of this work in the tree, and it is
filed separately as #255.

A real macOS delivery defect was found and fixed here

When a Codex app-server wrote its messages and exited promptly, macOS threw those messages away.

Darwin fails setsockopt as soon as the peer is gone, so the control pump abandoned the connection
with data still buffered and unread. Linux delivers buffered bytes after a close, so the pump read
on and bound normally — which is why CI, which is ubuntu-latest only, never saw it.

The fix drains what already arrived before reporting the connection closed. A close is an
end-of-stream marker, not a stop signal. It took the affected test from 7 failures in 8 runs to 0
in 8.

Two fixture budgets were also raised, because they were sized for a quieter machine and timed out
under parallel Darwin scheduling. Both changes are inside mod tests.

How it was found

CI proves Linux only. Every failure here came from running the suite on a Mac, and each fix was
measured over matched samples of six to eight full runs before it was believed. Two of the commits
are diagnostics rather than fixes, and they are the reason the rest exist — three theories died
against them.