fix(terminal): non-Latin input, per-client PTY ownership, and reliable delivery - #181

A user reported the terminal misbehaving after switching to a Russian layout.
Three independent causes, none of them xterm's — its own chord and printable
paths handle direct non-Latin layouts correctly.

The PTY inherited no locale. A GUI-launched host (Finder/Dock, launchd, a
container) gets none, which leaves bash/readline byte-oriented: one backspace
deletes half of a two-byte character and the line desyncs from what the shell
holds. Verified against a real PTY — "привет" reports 12 with no locale, 6 with
one. `resolveShellEnv` now repairs the locale as well as PATH, treating the two
as independent so the PATH short-circuit no longer skips it. Only LANG is set,
and only when nothing at all is configured, so a user's per-category settings
survive and an explicit LANG=C is not overruled. The rule is a pure exported
`localeRepair()` — the same testable-seam role `pathLooksComplete` plays for
PATH — and it lives in shellEnv rather than ptyEnv so the in-process agent's own
bash gets the fix too.

Two shortcuts matched `e.key`, the character a key produces, which is
layout-dependent: on a Cyrillic layout R yields `к` and S yields `ы`, so both
guards bailed before preventDefault() and the browser won instead — Ctrl+R
reloaded the whole app, the exact behaviour useGlobalHotkeys exists to prevent,
and Ctrl+S opened "Save page as" despite its comment promising to always
swallow. Both now match `e.code`, which also agrees with the terminal one layer
down (xterm resolves chords through keyCode, derived from the US layout).

xterm measures the character cell once at construction and never again, unlike
Monaco, which treats an early measurement as untrusted. Our code font ships as
per-alphabet woff2 subsets, so the Cyrillic file lands later — non-Latin glyphs
were sized for the fallback font and the PTY held the wrong cols/rows. Adds
@xterm/addon-web-fonts with initialRelayout disabled, so we drive the re-measure
and know when to re-fit and push the corrected size to the shell.

Also drops four addon dependencies pinned but never imported (webgl, image,
ligatures, serialize — taking five transitive deps with them) and records the
resulting choice, xterm.js on the DOM renderer, as architecture.md Decision #11
with the triggers for re-evaluating it. Loading addon-webgl would be a
regression, not an upgrade: the DOM renderer is a prerequisite for touch support
and WebglAddon.dispose() leaks its WebGL2 context, which our per-worktree
terminal churn would hit.

Regression-pinned in e2e: a Cyrillic character-count check in terminals.spec.ts,
and a CDP-driven layout test in history-search.spec.ts that dispatches trusted
events whose `key` and `code` disagree (Playwright's press() always sends the
matching pair, so it passed both before and after). The chord test was confirmed
to fail with the fix reverted.

`TerminalsPanel` is mounted only inside the shell's `hasActiveWorkspace` branch,
and selecting a project row clears the active workspace. So the deliberate
"project home" gesture unmounted every terminal of *every* workspace, and each
unmount closed its PTY — silently killing whatever was running in one (a dev
server, a watch build) on a single click. The tabs reappeared afterwards backed
by brand-new empty shells, so nothing looked broken; panels/SPEC.md even claimed
re-selecting a workspace "restores its view", true for editor tabs and false for
terminals.

Invert the ownership: the PTY now outlives the component. An unmount that leaves
its tab in place detaches the shell into a module-level registry keyed by
clientId, and the next mount re-adopts it. Resuming costs no round trip —
`terminal.data` is already keyed by PTY id, so re-subscribing to the same id
reconnects the stream. Only a genuinely closed tab kills its PTY, and the store
is the authority on which case it is: closing a tab removes it before React
unmounts, so a real close is already absent while an incidental unmount still
finds it. The process survives; the painted scrollback does not (a remount is a
fresh xterm buffer).

The store stays transport-free, so the reap decision lives in the component
rather than in `closeTerminalTab`.

Separately, `terminal.create` now carries the client's measured cols/rows and the
PTY spawns at that size. It previously always started at 80x24 and relied on a
follow-up resize, so the shell's first prompt was laid out for the wrong width
and then reflowed. The params are optional, so an older client still works, and
they are forwarded whole rather than rebuilt because under
exactOptionalPropertyTypes an absent `cols` and an explicit `cols: undefined` are
different types — only the former means "use the default".

Regression-pinned in e2e/terminals.spec.ts: a shell variable set before visiting
Project Home is still set after returning. Confirmed to fail with the fix
reverted (the replacement shell echoes an empty value).

Terminals were the one host resource that is per-client, but nothing in the
system knew that. Four consequences, fixed together because they are the same
missing concept.

**Output reached every client.** The host published every PTY's bytes to a
single `terminal.data` topic that *every* socket subscribed to, leaving each
browser to discard the frames that weren't its own. Anything typed or printed in
any terminal of any workspace — tokens, keys, private paths — was delivered to
every connected client, which matters all the more once the host is reachable
from a phone. Frames are now addressed to the owning client, and write/resize/
close reject an id the caller doesn't own, answering exactly as for an id that
never existed so probing reveals nothing.

**Ownership is keyed to the page, not the socket.** The transport reconnects on
its own, so socket-keyed ownership would either stop streaming for good or kill
a running shell on any hiccup. A `?client=` id on the socket URL spans
reconnects but not reloads; an abandoned client's PTYs are reaped on a grace
timer instead of on close. The id is minted lazily and NOT via
`crypto.randomUUID`, which is secure-context-only: called at module scope it
threw during `main.tsx`'s import over plain http from a LAN IP or a Tailscale
MagicDNS name — a blank page with the ErrorBoundary never mounted.

**A dead shell looked alive.** `pty.onExit` discarded the exit code and the wire
had no exit event, so typing `exit` left a tab with a blinking cursor writing
every keystroke to a dead id. `terminal.exit` now announces it, is held and
retried if the owner is momentarily away, and `terminal.alive` lets a tab
re-attaching to a shell it detached earlier confirm it is still there — the exit
event is only heard by a *mounted* terminal, and detaching happens precisely
when none is.

**Output was one WS frame per PTY read.** `bun-pty` exposes no `pause()` and
starts reading at spawn, so a shell cannot be slowed down; reads are now batched
(`outputBatcher.ts`, timer-only so it is unit-tested directly), a batch the
owner can't take is kept and retried, and held output is capped — dropping the
oldest and flagging `truncated` so the client marks the gap. Resize is debounced
and no-op resizes are skipped, so dragging the divider no longer fires an ioctl
and SIGWINCH per layout frame.

Also: the transport rejects requests that were in flight when a socket died
(queued ones still flush on reconnect) and no longer replays event channels to
late subscribers — replaying an append-only byte stream repainted stale output.
Ctrl+letter and Escape are recovered while a CJK IME is active, working around
xterm 6.0.0 dropping them outright (keyCode 229 has no case in its chord table,
upstream #6065). One shared `onThemeSwap` replaces three hand-copied
MutationObservers; terminal derivations move to the store module.

PROTOCOL_VERSION 24 -> 25.

Every new test was mutation-verified rather than trusted: three of them passed
against the broken code on the first attempt and were rewritten. The isolation
test asserted rendered text, which the client's own id filter made meaningless,
so it now inspects the wire; the IME test asserted typed text, which the tty
echoes even while the shell is blocked; and the detached-exit test used plain
`kill`, which an interactive zsh ignores. That last rewrite is what exposed the
re-attach bug `terminal.alive` fixes.

Fixes a Playwright glob regression this change caused: `routeWebSocket("**/ws")`
compiles to an anchored `^(.*/)ws$`, so it silently stopped matching once the
URL gained a query string — in an @agent spec no commit gate runs.

Extracts the parts of the terminal path that were still ad hoc in the panel and
the host, and fixes what they got wrong:

- `terminalSend` maps Bun's real `ServerWebSocket.send` contract instead of
  guessing: `> 0` delivered, `-1` enqueued-under-backpressure (so it WAS
  accepted), `0` dropped and must be retried. The previous `!== -1` test had
  both edges backwards — it discarded a frame Bun had queued and reported a
  dropped one as sent.
- `outputBatcher` returns that three-state result and latches "blocked", so a
  flooding shell stops hammering a socket that already refused.
- `completionQueue` keeps a terminal's dying output ordered ahead of its
  `terminal.exit`, per client, and survives a reconnect — the exit could
  previously overtake the last thing the shell printed.
- `ptySizeSync` separates desired / in-flight / acknowledged grids, so a resize
  that failed is retried instead of being remembered as applied.
- `terminalPrebindBuffer` replaces the loose pre-bind array: bounded, and it
  handles a shell that exits before `terminal.create` even returns its id.
- `requestReplayCache` gives a reconnecting page exactly-once semantics for
  requests it replays, keyed per client, never evicting an in-flight entry.

Each new module is unit-tested directly, plus two e2e specs: a `terminal.create`
whose response was lost with its socket runs once, and final output arrives
before the exit.

Comments elsewhere that described a dropped socket as a read failure are updated
— a dropped socket is now recoverable.

The abandoned-client reaper cleared the whole replay namespace 60s after a
socket went away, in-flight entries included — contradicting the cache's own
stated invariant that "in-flight entries are never evicted: that is the interval
in which executing a duplicate would be most damaging".

The page identity outlives that window. `dialog.selectDirectory` holds its frame
for 30 minutes (a human is looking at a folder picker), the transport replays
every unresolved frame on reconnect under the same id, and reconnect backoff
caps at 10s — so it retries forever. An offline stretch longer than the grace
window (a closed laptop, a wifi handover) was therefore enough to forget a
running handler and let the returning page start it again: a second native
picker beside the one still on screen. Any long-timeout mutation could likewise
execute twice.

`clearClient` now reports whether the page is really gone, declining while
anything is unresolved, and the reaper re-arms instead of forgetting. Retirement
is all-or-nothing: an unresolved request is proof the page may return, and its
settled siblings are just as replay-addressable to it (already bounded by count
and serialized weight). The shells still die on the first pass — only the
retirement waits. It ends when the last handler settles, on a reconnect, or at
`stop()`.

Both halves of the contract are mutation-verified: reverting `clearClient` to
the unconditional delete fails the new test, and so does a version that answers
`false` but clears anyway.

The replay cache bounded settled results by count and serialized weight and
evicted the oldest to stay under it. Nothing in that decision consulted whether
the page had actually received the result being thrown away.

A successful `send` is not delivery: a socket that dies with a reply still in
its buffer is indistinguishable from one that flushed it. So an evicted entry
could be exactly the one the page still holds unresolved and replays on
reconnect — and with the entry gone the host treats that replay as new work.
A `terminal.create` whose response was lost would create a second PTY. The
window is real: the transport keeps queueing requests while offline and sends
them all at once on reconnect, so a burst can cross the bound before the
replay that needs the old entry has been served.

Two halves. The client now acknowledges every response it reads — `WsAck`,
batched on a microtask, held across a disconnect and sent on the next socket
after the replays. That receipt is the host's only evidence a reply was not
lost, and it is what frees the retained copy; a client that reads its replies
therefore keeps the cache near-empty and never approaches the bound at all.

The bound still has to exist, for a peer that never acknowledges. It can no
longer cause a duplicate: it reclaims the *result* and leaves the *id* behind
as a tombstone, so a replay of a reclaimed request fails with a visible error
instead of silently executing the work a second time. Exactly-once now holds
regardless of how the peer behaves — only the answer can be lost, and only
under pressure an acknowledging client never creates.

Both halves are mutation-verified: reverting to unconditional eviction fails
the new cache test, and dropping the tombstone turns that failure into the
second execution the test names.