[ZASI v33 P3] Durable event store, transactional outbox, SSE replay and authoritative resync #12

Objective

Replace process-local realtime behavior with a durable, authenticated event stream that can recover deterministically after disconnects and restarts.

Source-grounded findings

• Current /ws uses a raw socket list in process memory and broadcasts telemetry every 2 seconds.
• WebSocket upgrade occurs before normal API auth handling.
• Current /api/jarvis/stream is a compatibility-style word stream, not a durable run/event stream.
• Rate limits, event/log history, and active socket state are process-local.

Scope

• Implement append-only tenant-scoped event store with monotonic sequence/cursor semantics.
• Add transactional outbox tied atomically to state/audit mutations.
• Make SSE the primary durable server→client event channel; keep WebSocket only where bidirectional behavior is required.
• Add authenticated cursor replay, retention-gap detection, resync.required, authoritative snapshot and reconnect flow.
• Define typed event envelopes for intent, plan, approval, action, tool, verification, evidence, briefing and run lifecycle.
• Add bounded queues/backpressure and explicit low-priority telemetry dropping rules.

Acceptance criteria

• Unauthenticated stream clients receive no event data.
• Event order survives process restart and reconnect.
• Duplicate outbox/worker delivery does not duplicate authoritative events or side effects.
• Cursor outside retention produces explicit resync, never silent data loss.
• UI can distinguish LIVE, DEGRADED, RECONNECTING and STALE from actual transport/freshness state.
• 10,000 scoped event replay test completes without loss or duplication.
• Audit/event/evidence correlation IDs are preserved end to end.

Depends on

#10 #11

Priority

P3 / required before live autonomous task views.