fix(fleet): every lost stretch of events forces a resync — no silent gaps #1773

Acceptance Criteria

• With engine-shaped (id-less) frames, a non-initial re-open of an arm that delivered data in composite mode emits exactly one gap signal naming that namespace.
• In fleet-of-one mode, a re-opened local arm ends the listener's stream with a transport error and never injects a synthetic frame; while connected, the stream stays byte-identical to the local source.
• A fan-in connection closed for any reason other than graceful service shutdown errors the listener's stream instead of ending it cleanly; the engine and hub proxies do the same when response headers were already sent.
• The arm reader reports upstream end and upstream error as distinct reasons.
• In the client, an unexpected normal end of the global stream advances the forced-resync signal, so the viewed transcript and the entity rail refetch; a user-initiated stop or a page hide does not.

Testing Decisions

• Extend the aggregator suite (re-open gap with the engine-shaped id-less fixtures), the driver pump suite (error-close semantics), the engine-proxy suite (error after headers), and the app's gap-frame and stream-liveness suites (unexpected end leads to resync). Extends the census slice's fixture surface.

Key Decisions

• "Delivered" means any data frame, not only a frame carrying an SSE id.
• Solo-mode loss is signalled by severing the connection, never by injecting a frame — preserves Fleet thin client — Slice 4: lossless SSE reconnect (cursor resume) #1264.
• The client keeps treating an unexpected end as a gap even after replay exists (defense in depth).

Constraints & Invariants

• Fleet thin client — Slice 4: lossless SSE reconnect (cursor resume) #1264 byte identity, Fan-in relay never re-arms backpressure (flowing stuck false) → session transcript + rail go stale until reload #1617 drain flush, and Fan-in relay resumes re-opened arm from connect-time cursor + no gap frame on reconnect → silent event loss #1638 cursor bookkeeping are all preserved.
• A gap signal never advances a cursor.

Prior Art

• Fan-in relay resumes re-opened arm from connect-time cursor + no gap frame on reconnect → silent event loss #1638's composite-only re-open gap and its id-gated delivered set; Fan-in /event driver never re-opens the LOCAL arm → local session events freeze until reload #1601's local-arm re-open; Chat message transcript has no reconnect/resync self-heal — stale rail heals only on reload (the #1617 fourth root) #1646's transcript heal hooks; Client: honor status seq + re-seed status on reconnect/gap + turn-level working floor (non-text turns) #1637's status re-seed on gap; the proxies' end-after-headers behavior; the client stream loop's normal-completion path.

Source

• Part of Fleet event stream is lossy by construction — remote sessions lag and desync during live activity #1770 · Blocked by feat(fleet): fan-in census line + engine-shaped stream fixtures #1771 (engine-shaped fixtures).