feat(stream): implement declared event ingress - #300

…s unsupported (#309)

archive_validated_file hardlinks the validated predecessor through
/proc/self/fd/N (Linux) or /dev/fd/N (elsewhere) with AT_SYMLINK_FOLLOW.
Linux procfs permits materializing that link; macOS fdescfs answers with
EPERM, so publication failed on every Darwin host and cargo test -p st2
--lib could not pass there since #300.

Classify EPERM/ENOSYS/EOPNOTSUPP from the capability linkat as
platform-unsupported and install the receipt as a staged, fsynced,
rename_noreplace byte copy instead; every other error stays a hard
failure. The caller's readback proves whichever receipt won carries the
validated bytes, so supersession semantics are unchanged. The tradeoff is
inode identity: a crash between copy and conditional unlink leaves the
retained inbox entry in place until revalidation.

A debug-only TEST_FORCE_ARCHIVE_RECEIPT_COPY switch exercises the
fallback on every platform; the new ding supersession test asserts receipt
bytes match and no staging files leak into the archive.

Fixes #308

…d human output

The chosen $E surface from #268: an appended observedState object on both
roster JSON shapes (null = no record, distinct from derived unknown), a
compact observed column in human output, and advisory-only doctor lines.
The session-liveness cross-check demands positive evidence of death
(ding::session_liveness); an unreadable registry downgrades nothing.
Row 22's wording now names the third independent axis with its proof, and
two stale stream proof references from the #300/#313 renames are corrected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…d human output

The chosen $E surface from #268: an appended observedState object on both
roster JSON shapes (null = no record, distinct from derived unknown), a
compact observed column in human output, and advisory-only doctor lines.
The session-liveness cross-check demands positive evidence of death
(ding::session_liveness); an unreadable registry downgrades nothing.
Row 22's wording now names the third independent axis with its proof, and
two stale stream proof references from the #300/#313 renames are corrected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…d human output

The chosen $E surface from #268: an appended observedState object on both
roster JSON shapes (null = no record, distinct from derived unknown), a
compact observed column in human output, and advisory-only doctor lines.
The session-liveness cross-check demands positive evidence of death
(ding::session_liveness); an unreadable registry downgrades nothing.
Row 22's wording now names the third independent axis with its proof, and
two stale stream proof references from the #300/#313 renames are corrected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…d human output

The chosen $E surface from #268: an appended observedState object on both
roster JSON shapes (null = no record, distinct from derived unknown), a
compact observed column in human output, and advisory-only doctor lines.
The session-liveness cross-check demands positive evidence of death
(ding::session_liveness); an unreadable registry downgrades nothing.
Row 22's wording now names the third independent axis with its proof, and
two stale stream proof references from the #300/#313 renames are corrected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…d human output

The chosen $E surface from #268: an appended observedState object on both
roster JSON shapes (null = no record, distinct from derived unknown), a
compact observed column in human output, and advisory-only doctor lines.
The session-liveness cross-check demands positive evidence of death
(ding::session_liveness); an unreadable registry downgrades nothing.
Row 22's wording now names the third independent axis with its proof, and
two stale stream proof references from the #300/#313 renames are corrected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…d human output

The chosen $E surface from #268: an appended observedState object on both
roster JSON shapes (null = no record, distinct from derived unknown), a
compact observed column in human output, and advisory-only doctor lines.
The session-liveness cross-check demands positive evidence of death
(ding::session_liveness); an unreadable registry downgrades nothing.
Row 22's wording now names the third independent axis with its proof, and
two stale stream proof references from the #300/#313 renames are corrected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…d human output

The chosen $E surface from #268: an appended observedState object on both
roster JSON shapes (null = no record, distinct from derived unknown), a
compact observed column in human output, and advisory-only doctor lines.
The session-liveness cross-check demands positive evidence of death
(ding::session_liveness); an unreadable registry downgrades nothing.
Row 22's wording now names the third independent axis with its proof, and
two stale stream proof references from the #300/#313 renames are corrected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…d human output

The chosen $E surface from #268: an appended observedState object on both
roster JSON shapes (null = no record, distinct from derived unknown), a
compact observed column in human output, and advisory-only doctor lines.
The session-liveness cross-check demands positive evidence of death
(ding::session_liveness); an unreadable registry downgrades nothing.
Row 22's wording now names the third independent axis with its proof, and
two stale stream proof references from the #300/#313 renames are corrected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…d human output

The chosen $E surface from #268: an appended observedState object on both
roster JSON shapes (null = no record, distinct from derived unknown), a
compact observed column in human output, and advisory-only doctor lines.
The session-liveness cross-check demands positive evidence of death
(ding::session_liveness); an unreadable registry downgrades nothing.
Row 22's wording now names the third independent axis with its proof, and
two stale stream proof references from the #300/#313 renames are corrected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…d human output (#322)

* feat(agents): join observed harness state into the roster, doctor, and human output

The chosen $E surface from #268: an appended observedState object on both
roster JSON shapes (null = no record, distinct from derived unknown), a
compact observed column in human output, and advisory-only doctor lines.
The session-liveness cross-check demands positive evidence of death
(ding::session_liveness); an unreadable registry downgrades nothing.
Row 22's wording now names the third independent axis with its proof, and
two stale stream proof references from the #300/#313 renames are corrected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(agents): catalog-derived probe root, explicit nulls, and labeled observed output

Review-pass fixes for the exposure slice: the session-liveness probe
derives the runner's own pty root from the catalog (PTY_ROOT and
PTY_SESSION_DIR still win) so operator shells get the cross-check without
exporting anything, with the errno mapping now unit-tested; observedState
serializes exit and reason as explicit null per the roster's
null-not-omit convention; Doctor gains the ended-while-desired-running
crashed-seat advisory and tests covering all four observed-state arms;
and the human observed column is prefixed obs: so two bare state words
never sit ambiguously side by side.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(agents): probe exactly the runner's pty root and expose the ask kind

PTY_SESSION_DIR pointed the probe at a directory st2-managed sessions
never use (provable deaths read indeterminate); the probe now shares
run::effective_pty_root verbatim. observedState gains the machine-readable
ask axis, pinned literals updated.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(agents): observedState field order matches the documented contract

reason precedes exit, as the spec example pins; pinned literals updated
in the same change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(agents): doctor reports a reason-only terminal instead of exit unstated

An ended record can carry only a reason — Codex's observed systemError
writes reason without an exit — and the catch-all advisory discarded it,
leaving the operator 'exit unstated' with nothing to act on. The advisory
now falls back to the recorded reason when no exit is present.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
agent-identity: unknown
agent-persona: generalist
agent-supervisor: unavailable
agent-tool: OMP
agent-tool-version: 18.0.3
agent-runtime: OMP 18.0.3
tooling-profile: dotfiles@f33cd9c-dirty

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Co-authored-by: schickling-assistant <261620128+schickling-assistant@users.noreply.github.com>