Gate startup mail and recover suspended AgentPost sessions

[5000Stadia]

What changed

• Gate startup unread mail behind an explicit user choice across managed Codex, ordinary Codex hooks, Claude, Antigravity, and embedded Python hosts.
• Preserve the existing exact-ID live-mail workflow after startup, including the empty-inbox startup edge case.
• Report held consumer leases truthfully as suspended, unresponsive, or incoherent instead of misleadingly offline.
• Add guarded recovery through agentpost consumer-stop NAME --instance FULL_INSTANCE_ID.
• Convert managed terminal suspension into cleanup, detect cross-seat resumes of the same Codex thread, and print exact recovery/relaunch commands.
• Ship the implementation spec, generated skill updates, adapter generation bumps, compatibility notes, and operator documentation together.

Root cause

A terminal-stopped managed launcher remains alive and retains consumer.lock, but its stale heartbeat previously made presence look offline. A new launcher then failed at the lock boundary and offered a numbered mailbox, which would split mail instead of recovering the intended seat. Separately, startup adapters injected imperative read/claim workflows as soon as queued mail was found, before the user could reload the correct conversation or mailbox context.

Compatibility and impact

• Mailbox layout and unread/read state are unchanged.
• Startup gates do not read, claim, reply to, or execute work from mail.
• Mail arriving after startup keeps the existing immediate/idle and exact-ID behavior.
• Python Notification.origin is additive and defaults to live.
• Claude generation is now 0.0.8; Codex generation is 0.0.7+codex.20260804015728.

Validation

• python -m unittest discover -s tests -v — 244 tests passed
• python scripts/verify_clean_install.py — Python 3.12 clean bootstrap passed
• ./scripts/smoke_two_agents.sh — passed
• python -m compileall -q src tests scripts
• node --check src/agentpost/data/codex_bridge.mjs
• sh -n scripts/install.sh
• git diff --check