[alexeyzimarev]

Closes #1022 — AI-2962

What & why

Cloud-output congestion can block the PTY read loop and freeze local terminals. This draft specifies bounded journals and acknowledged terminal checkpoints so cloud mirroring recovers automatically while local output continues. Release includes automatic snapshot/resync recovery.

Where to look

Terminal-engine qualification, delivery ordering, and bounded memory across the daemon, server, and viewers are the main implementation constraints. Keep this PR in draft until implementation and qualification are complete.

Verification

git diff --check 72553b0d..de290e47 passed. The committed changes contain only the design document; implementation tests remain pending.

[alexeyzimarev]

Please treat M1 terminal-engine qualification as a hard prerequisite for freezing the M2 wire contract and enabling M4 automatic recovery. The design review establishes a coherent approach; checkpoint fidelity and performance remain unverified. XTerm.NET is a candidate, not yet a proven checkpoint provider.

The qualification should produce reproducible tests and measurements covering:

• State and continuation fidelity: for the pinned desktop, web and mobile engines, compare uninterrupted playback of the declared cloud profile with fresh-surface checkpoint restoration followed by the same suffix. Assert both screens, retained history, cursor/saved cursor, modes, attributes, widths, links and wrap/reflow behavior. Include real Claude Code/Codex captures, every-byte splits around UTF-8 and control sequences, and distinguishing suffixes such as saved-cursor restore, REP, alternate-screen exit and resize. A visually plausible repaint or a passing RIS/reset test is insufficient.
• Local responsiveness: because the model/tokenizer adds synchronous work to the PTY path, measure mirror-disabled, healthy-cloud and blocked-cloud runs on the same recorded hardware. Meet the design's added local p99 <=10 ms, added maximum <=50 ms and capture-boundary <=2 ms gates, including the specified multi-agent load and control-flood corpus.
• Bounded allocation and deployment viability: demonstrate the charged memory limits under maximum geometry/history, unterminated controls and combining floods; verify no retained growth in the repeating workload. Publish the actual CLI/daemon trim- and NativeAOT-clean, measure the <=10 MiB added daemon artifact budget, and exercise the real published-daemon SignalR streaming/serialization path.

Record the exact engine/version, supported-feature manifest, fixtures, commands and benchmark results with this PR. Unsupported behavior must be explicitly excluded or consistently normalized in both live playback and restoration.

If qualification fails, revise the engine/profile or recovery design before proceeding with the dependent protocol work. The already-merged nonblocking sink and lifecycle tests remain useful foundations; reuse them while this feasibility gate is proved.