fix: harden remote terminal protocol and UX

[rixzkiye]

Summary

Layer 6 of 6, stacked on #1670. This is the final protocol-v3, security/reliability, and UX hardening layer for the experimental default-off remote terminal.

Final guarantees

• Every daemon frame is epoch-bound; stale frames are rejected and daemon restarts rotate the control stream.
• Input, resize, and signal share one ordered ACK/NACK stream with replay and gap recovery.
• Attach is subscribe-first and snapshot/replay aware; live gaps trigger bounded resync.
• The first subscriber is writer, later subscribers are view-only, and takeover is explicit.
• Writer forwarding is generation-fenced across replicas; active Redis leases are atomically verified and renewed.
• Native rendering queues operations until WebView readiness and enforces read-only mode for viewers.
• Managed tmux recovery targets the persisted pane and never recreates a missing session.
• Daemon registry/policy persistence is serialized and recovers after transient write failures.
• Detach fences in-flight attach/decrypt/takeover work and releases late writer grants.
• Attach-time live output buffering is bounded; overflow resyncs instead of growing memory or applying ambiguous output.

Latest audit fixes — 2026-08-11

1. fix(cli): make terminal persistence queues recoverable
2. fix(app): fence terminal work across detach
3. fix(server): harden terminal writer lease handling
4. fix(app): bound terminal attach buffering

This layer contains 24 atomic commits relative to #1670: the original 20 protocol/UI hardening commits plus the four audit fixes above.

Validation — 2026-08-11

• pnpm --filter happy test — 88 files / 831 tests passed, including 5 real tmux tests.
• Server production build and full typecheck — passed.
• Server suite with real Redis — 14 files / 106 tests passed.
• pnpm --filter happy-app typecheck — passed.
• Terminal client suite — 24 tests passed.
• Full serial app suite — 86/87 files and 941/942 tests passed; only the pre-existing 1 MB blob-encryption test exceeded its 5s timeout.
• The same blob test also fails standalone on current origin/main (9.65s), confirming it is not introduced by this stack.
• git diff --check — passed.
• Merge-tree for every stack head against current origin/main — clean.

Review this layer

Unique diff: rixzkiye/happy@feat/terminal/5-docs...feat/terminal/6-hardening

Stack workflow

Because these contributor branches live in a fork and I do not have push access to slopus/happy, GitHub requires every upstream PR to target main. Descendant PRs therefore show cumulative diffs.

Only the first unmerged layer is ready for review. Later layers stay draft. After each parent lands, I will restack descendants onto the updated main before promoting the next PR; this remains correct whether maintainers rebase-merge or squash-merge.

Merge order: #1666 → #1667 → #1668 → #1669 → #1670 → #1671.

Known release boundary: hosted workflows still require maintainer approval, and physical iOS/Android/Web smoke testing remains separate from local code/test proof.