perf(server): batch terminal output and bound replay buffer eviction

[chuks-qua]

What

The terminal output path paid a fixed serialization gauntlet per PTY chunk and had no flow control. This PR batches output at the host, adds real backpressure, and removes quadratic decay in the server-side replay buffer.

• Coalescing: publishOutput now buffers per session and flushes on a 2ms window (or immediately at a full 64 KiB chunk), collapsing output bursts into far fewer IPC events, Zod parses, WS frames, and xterm.write calls. outputSeq stays contiguous; no contract change.
• Backpressure: when the IPC queue (inbound pending + outbound in-flight) crosses 768 KiB the host pauses that session's PTY reads and resumes below 512 KiB. Previously a fast producer could push outboundBytes past the 1 MiB cap, making publish throw and failHost kill every session on every thread.
• Exit ordering under pressure: an exited session flushes pending output before its exit event publishes (bounded by a 2s deadline that drops unsequenced bytes), so close/shutdown cannot wedge the serial inbound queue. Inbound commands are dropped for exited-but-mapped sessions instead of throwing into failHost.
• Replay buffer: eviction advances a head index (O(1) amortized) instead of Array.shift (O(n) per append at capacity), and per-chunk cumulative endBytes makes bytesAfter O(1) instead of a full-array reduce on every append while a checkpoint exists.
• Removed waste: the PTY host no longer Zod-parses its own outbound events (the supervisor validates every inbound event at the trust boundary), and handleOutput no longer copies each decoded buffer twice more for headless/attached delivery.

Verified: bun run --cwd apps/server test -- on the five touched suites, 64/64 pass including new tests for coalescing, immediate full-chunk flush, pressure pause/resume, hysteresis band, exit-after-flush ordering, pressured-exit deadline, and the 4 MiB kill path. tsc --noEmit clean, oxlint clean. Live proof: verify-mcode runtime health on a rebuilt bundle; pty-host-supervisor.real.test.ts and terminal-session-runtime.real.test.ts (real ConPTY + real shell detach/reattach) pass. Two independent reviewers audited the diff; two major findings (dead-scope command window, close-under-pressure deadlock) were fixed and rechecked.

Limits: known environment flakes unrelated to this diff (EBUSY temp-dir cleanup in composition/diagnostics tests, pty-host-runtime.real ConPTY timeout) reproduce identically on the pre-change baseline.

Why

Under heavy output (build logs, floods) each PTY chunk paid base64 encode, two Zod parses with canonical re-encode, two JSON stringifies, base64 decode, and multiple buffer copies, then one WS frame per chunk. A sustained flood could exceed the shared 1 MiB outbound cap and crash the entire PTY host, taking every terminal on every thread down. The replay buffer also degraded quadratically once full or while a checkpoint was retained.

UI Changes

None — server-side pipeline only.

Config Changes

None.

Review Notes

• Flood-killed sessions report reason: "natural" because the protocol's exitReason enum has no fitting value; noted in a code comment. Dropped bytes were never assigned seqs, so contiguity holds.
• queueBytes intentionally sums inbound + outbound queue pressure; the 2s exit deadline bounds the worst-case close delay to a delay, not a deadlock.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}