Server: session status has no ordering key + multiple emitters → stale idle while agent runs #1636

Acceptance Criteria

• Every published session.status event — for every transition type including retry — carries a seq that is strictly increasing per session across all transitions for that session's lifetime (not reset per turn).
• The seq counter and the drop-older guard live in SessionStatus.set / its persistent per-session state; no per-turn structure (the runner) owns the counter.
• A completing turn's idle presented to set after a newer turn's busy (older generation) is dropped at the funnel, so the last status published for a still-running session is never idle.
• Given two turns racing for one session, the final published status is busy with a seq greater than the dropped idle, in every interleaving the test exercises — asserted on the emitted event stream, not via SessionStatus.get (which synthesizes a default idle and deletes the entry on idle, so get mis-measures).
• cancel when no runner is present does not publish an idle that supersedes a newer generation (guarded by the same drop-older rule).
• The generated client SDK/protocol types include seq on the status event.

Testing Decisions

• Reuse-first: extend the processor's effect-level test that already owns a controllable event sink via EventV2Bridge.Service.listen (it asserts on the emitted session.status event stream — the correct place, since SessionStatus.get synthesizes idle and deletes on idle). The retry path has an existing effect test to extend for the retry-carries-seq criterion. (There is no standalone status/run-state unit suite — do not claim one.)
• New ordering test: drive two overlapping turn lifecycles for one session; assert the emitted status seq is strictly monotonic and never ends on a stale idle; assert retry transitions also carry seq.
• Assert the schema round-trips seq and the SDK regen picks it up.

Key Decisions

• The ordering key is stamped at SessionStatus.set, the single publish funnel — not at the runner. The runner is deleted every turn, so a counter there resets and cannot be "monotonic across all transitions"; and the runner's counter is closure-private and unreadable from the processor fiber that emits mid-turn. The service's persistent per-session state is the only correct owner.
• All transition types are stamped, including retry. retry is not a busy/idle transition and cannot be a runner busy/idle hook; stamping at the funnel covers it uniformly. Any framing of the fix as "collapse to busy/idle hooks" is wrong and is explicitly rejected.
• The premise is a value/ordering race among callers of one emitter, not multiple emitters. The mitigation is ordering at the funnel, not emitter consolidation.
• Stale transitions are dropped at emit, not only at the client. The client seq-honor (Client: honor status seq + re-seed status on reconnect/gap + turn-level working floor (non-text turns) #1637) is defense-in-depth; the authoritative fix is that a superseded status is never published.
• This is an engine-side change and therefore outside Fan-in relay never re-arms backpressure (flowing stuck false) → session transcript + rail go stale until reload #1617's stated scope (Fan-in relay never re-arms backpressure (flowing stuck false) → session transcript + rail go stale until reload #1617 carries a "no engine-side change" invariant). Filed as a sibling root by design.
• SDK/protocol regeneration is part of the change, not an afterthought — the client sibling reads the generated type.

Constraints & Invariants

• Status ordering is enforceable end-to-end: a client tracking max seq per session can discard any status with seq <= what it has seen.
• No change to message/part event ordering or ids.
• Idle/busy/retry semantics are unchanged; only ordering, stamping, and the drop-older guard change.
• An errored / overflow-aborted / cancelled turn still reaches idle exactly once (a retained emitter path, now stamped) — the fix must not lose a legitimate idle while suppressing a stale one.

Prior Art

• The SessionStatus service and its set/publish funnel and instance-state Map; the run-state machine (onBusy/onIdle/cancel); the processor's busy (turn entry), halt-idle (overflow + error/abort), and retry writes; the compaction path that also drives the processor; the overlaid runner (turn serialization, fix(fleet): serialize concurrent prompts to one session — queue instead of coalesce-and-drop #1582) — as context, not as the seq owner; the status-event schema; the whole-object SSE serializer; the effect-level processor/retry tests with the EventV2Bridge.listen sink.
• Related: Fan-in relay never re-arms backpressure (flowing stuck false) → session transcript + rail go stale until reload #1617 (fan-in backpressure wedge — same symptom, different mechanism); [A3] Add status reconciliation fallback for remote prompts #1567 (status reconcile); Client: honor status seq + re-seed status on reconnect/gap + turn-level working floor (non-text turns) #1637 (the client consumer of seq); Fan-in relay resumes re-opened arm from connect-time cursor + no gap frame on reconnect → silent event loss #1638 (relay sibling).

Source

• Full-path event-delivery sweep + adversarial deliberation on feature/free-tier-fleet. The deliberation corrected the seam (runner → SessionStatus.set), added the two missed emitters (processor busy + retry), and fixed the test target (wire, not get).
• Part of the Fan-in relay never re-arms backpressure (flowing stuck false) → session transcript + rail go stale until reload #1617 staleness family.

Notes

• Sibling Client: honor status seq + re-seed status on reconnect/gap + turn-level working floor (non-text turns) #1637 (client) depends on this for seq to exist; its other halves (turn-active flag, reconnect re-seed) are independent and can land first.