Integrate r6.2 agent sessions and remote terminal control

[guohai]

Superseded by consolidated PR #50, which targets main and contains every commit from this PR plus the push-notification transport. Use #50 for review and integration.

Astation can now discover and control the original Claude/Codex sessions served by Atem's runtime using atem-session r6.2, with no legacy fallback. Connections and terminal windows share one authenticated client per host; opening a window no longer sends a second hello. Reconnect resets per-attachment registry/stream/control state and queries durable receipts without replaying commands.

This combines all changes from superseded #48 with the session client. It targets main and stays draft pending joint live testing with Atem #69. Contract: Atem #68, history tag atem-session-v1-r6.2, commit 22de096b1980ee3ae342c0352b4c1d5fa54e3b51. No local Atem checkout was changed, built or tested.

Changes

• Keep the bundled native terminal renderer, exact session chooser, input/paste/resize, explicit takeover/release, scoped voice/shortcuts, stop confirmation and owner-authentication UI from the combined work.
• Replace removed agent/terminal lists with the authenticated session registry; show workspace/session identity, semantic activity and capabilities in Connections. Claude supports structured prompts; Codex currently uses terminal typing/paste.
• Reset registry sequence, removals, pending replies, streams and leases for each attachment while preserving durable trust/runtime floors and request recovery metadata. Failed attachments need a new authenticated connection; no duplicate hello or resume.
• Handle session unsupported_version without re, terminal errors with terminal/stream/code/message and chat error.code. Refusals during registry resync still invalidate cached leases; stale-stream errors cannot close a successor view. Host admission order is permission, accepting session, then lease.
• Bind terminal requests to the full target/attachment and current mutation lease. Accept the real r6.2 host's unbound events only through verified connection and exact process/subscription/stream checks. Preserve 15-second leases, five-second renewal, late-reply fencing and durable receipt recovery without automatic resubmission.
• Disable all older browser host access, including before hello, and remove outgoing unbound voice/console/control fallbacks. Browser UI and offline conformance code remain for future secure companion work.
• Import all 18 shared fixture files byte-for-byte, with pinned hashes and all three client scenarios executed by Swift/JavaScript. Document the host run procedure, fixture harness coverage, security invariants and concrete joint live checks.

Validation

• Final focused native suite: 102 pass, including real wire decoding, shared client scenarios, registry ownership, family refusals, persistence/reload, terminal and WebKit integration.
• Broader native run: 849 tests, eight skipped, zero failures, explicitly excluding five documented prior local failures (three protected Secure Enclave tests, caption scrolling and TimeSync). The final resync/permission adjustments pass the focused suite. This is not an unfiltered full-suite signoff.
• Webapp: 49 pass, one skipped. All eight pinned terminal assets verify; git diff --check passes.
• Current-head r6.2 CI is green: macOS Release build, bundled-resource and development-app checks, unfiltered Swift suite (854 tests, 10 skipped, zero failures), relay Rust/Postgres/Valkey tests and container verification, and webapp checks.

Integration Gates

The host currently has one Astation link/attachment at a time. Joint live testing with #69 is next. Account-wide enrollment, multiple native attachments, resume, secure browser/QR grants, authenticated freshness and traffic E2EE remain gated by section 9. Prompt-bound r7 approval decisions await the contract text and are not enabled.

Two upstream wording clarifications are recorded in the handoff: terminal host events carry no binding (requests do), and #69 documents uncertain delivery after a double I/O failure despite busy. Astation handles both conservatively; neither blocks initial live testing.

Handoff and live test sequence: https://truck.netbird.cloud:58310/protocol/atem-implementation-handoff.md

Local Atem memory was updated, but relay sync is still refused because the memory does not match the account encryption mode; the hosted handoff is the cross-machine source. No app/agent restart, merge or deployment is included.

Generated with SMT smt@agora.build