Prevent remote command replay and share SSE parsing

[parsakhaz]

Remote commands were replayed after transient failures even when the host could already have applied them. That could repeat terminal input or create extra panes. The browser's fetch fallback also ignored valid SSE frames with CRLF line endings.

This change:

• Retries only explicitly reviewed read channels. Mutations and unknown channels are sent once, and ambiguous outcomes ask the user to inspect current state before trying again.
• Uses the existing terminal status to show input-bar and shortcut failures as well as typed-input failures.
• Discards hydrated output for a terminal that has been replaced or disposed, and stops retired initialization after async requests. This fixes the xterm dimensions crash reproduced during StrictMode startup and rapid tab changes.
• Shares one SSE text parser across browser fallback and desktop transport, keeping native EventSource and Node's incremental UTF-8 decoder. The conformance suite covers LF/CRLF/CR, split delimiters, BOM, whitespace, multiline data, and reconnect reset.

No dependencies, supply-chain controls, authentication headers, or event-stream reconnect policy change.

Validation completed locally:

• pnpm lint
• pnpm typecheck
• pnpm build:main, including the sandboxed preload verifier
• pnpm build:frontend, including xterm and React Scan bundle verifiers
• 50 targeted transport tests pass. One existing Tailscale DNS-fallback test is excluded from the local repeat because this workspace's environment HTTP proxy intercepts its fabricated hostname; it remains unchanged and enabled in CI.
• Chromium: abort a terminal-control request after applying it; verify one request and the visible uncertain-outcome message.
• New maintained smoke regression: hold a terminal output response, replace that panel, release the response, and verify no browser errors. The same test fails on base with two xterm dimensions errors and passes with this fix.
• Instrumented real xterm lifecycle: base made 24 clear/write calls after disposal; the fixed code makes zero.

CI passes on 75944df48f03974ce2b9b72f1401156f3a8d983c: Linux quality checks, full main/frontend unit suites, maintained browser smoke (including the new lifecycle regression), sandboxed Electron preload smoke, macOS/Windows main tests, and React Doctor.

Closes #613
Closes #623
Closes #636

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T07:29:07.126168Z	d09bb61	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 75944df.}