feat(engine): sequenced, replayable global event stream (epoch:seq ids, replay buffer, reset) #1776

Acceptance Criteria

• Every global-stream frame, including heartbeats and the connected frame, carries an SSE id of the form epoch-and-sequence; the sequence strictly increases across all subscribers of one engine process; a sync copy carries its source event's id.
• Reconnecting with a cursor inside the replay window delivers exactly the frames after it and then live frames — no duplicate and no missing sequence, including events published while the reconnect is in flight.
• Reconnecting with a cursor from a different epoch, or older than the buffer's oldest entry, yields a reset frame first (carrying the current epoch and sequence), then live frames.
• The buffer evicts oldest-first when it exceeds its byte or age bound; both bounds are configurable by environment.
• Heartbeats carry server time in milliseconds and the current sequence.
• A client that disconnects mid-stream releases its subscription — listener unregistered, queued frames freed, disconnect logged — verified against the compiled binary on a scratch engine.

Testing Decisions

• Extend the engine server suite in the overlay with an in-process client (id format, replay, reset, bounds, heartbeat contents); add a scratch-engine test against the compiled binary for replay and abort release.

Key Decisions

• The epoch is a random token per process start; the sequence is a per-process counter assigned at bus emit.
• The cursor is accepted from both the standard header and the existing query parameter.
• Reset is a named event type that the client handles (end-to-end resume slice); it is never silent.

Data Contracts

• SSE id: <epoch>:<seq> — the epoch a short random token, the sequence a decimal integer.
• Reset frame: a named "cursor unservable" event whose properties are the current epoch and sequence.
• Heartbeat properties: server time in milliseconds and the current sequence.

Constraints & Invariants

• Live delivery latency is unchanged for connected subscribers.
• Buffer memory is bounded regardless of subscriber count (one shared buffer).

Prior Art

• The global bus's ascending payload-id assignment; the global stream handler's queue, heartbeat merge, and finalizer; the HTTP server adapter's client-abort interrupt; the event-v2 bridge's twin emission.

Source

• Part of Fleet event stream is lossy by construction — remote sessions lag and desync during live activity #1770.

Notes

• Validate on a scratch engine (spare port, temporary database) before any hub restart; hub restarts are human-scheduled per machine because they end in-flight sessions (The hub engine bounce kills all in-flight campaign loops — sessions must survive their own deploy step (interrupted-session re-dispatch) #1552).