Add durable goal output, steering, realtime replay, and statistics

[integry]

Context

Part of #2003 and #2002. Depends on #2006 and consumes normalized runtime events from #2007.

Current live task details poll transient files/Redis and overwrite full snapshots. Follow-up comments create separate jobs rather than an ordered goal inbox. Goal monitoring needs durable replay, ownership-safe sockets, and deduplicated statistics.

Scope

Implement the event ingestion/query layer, durable steering/status messages, goal socket rooms, checklist projection, and statistics aggregation used by both API clients and the web UI.

Event and output pipeline

• Append every lifecycle, scheduler, provider output, todo, usage, checkpoint, message acknowledgement, GitHub, CI, review, and Ultrafix event with a monotonically increasing per-goal sequence.
• Accept an idempotency key plus fenced controller/session/turn identity; reject stale epochs and deduplicate retries.
• Store terminal chunks incrementally with stream/type metadata and bounded chunk sizes. Preserve stdout/stderr and structured events without keeping an unbounded in-memory transcript.
• Expose paginated historical replay and tailing from an exclusive cursor. A reconnect from sequence N returns N+1 onward with no gaps or duplicates.
• Define retention/compaction that preserves audit, checklist, and aggregate correctness while bounding raw terminal storage.

Messaging and status

• Enqueue free-form and predefined messages through one durable ordered inbox.
• Provide stable canned actions for at least “what’s done?” and “what’s left?” while storing the resolved text/action and author.
• Deliver each message at most once to a fenced provider turn and persist pending/delivered/acknowledged/failed state.
• Return controller-derived status immediately when possible; provider-authored replies remain ordinary ordered events and cannot override authoritative progress.
• Allow corrective messages to be cancelled before delivery when safe, with an audit record.

Realtime and authorization

Add Socket.IO goal rooms/events and REST fallback polling.

• Authorize ownership/repository access on subscription and every mutation.
• Unsubscribe on auth loss, goal deletion, or permission change.
• Never expose another goal’s objective, output, branch names, messages, usage, or session metadata.
• Use typed shared event envelopes with versioning and reconnect cursors.
• Preserve current task/draft/indexing socket channels.

Checklist and statistics

Project an authoritative hierarchical checklist from persisted goal nodes and external reconciliation. Provider todo items may be displayed as a separate advisory list but never replace controller state.

Aggregate with retry-safe identities:

• issues total, ready, active, processed, failed, and blocked;
• PRs open, review/Ultrafix pending, merge-ready, and merged;
• input/output/cache/reasoning tokens by provider/model and total;
• elapsed, active, paused, and recovery time;
• active providers/models and current controller state.

Do not double count retries, synthetic pool attempts, llm_logs plus llm_executions, or replayed events.

Acceptance criteria

• Replay tests prove cursor ordering through process restart, chunk boundaries, compaction, and socket reconnect.
• Duplicate and stale events/messages are rejected without gaps in committed sequence.
• Concurrent message delivery preserves FIFO order and exactly-once acknowledgement.
• Authorization tests cover HTTP mutations, list/detail reads, sockets, permission loss, and multi-user isolation.
• Stats tests cover retries, multiple models, pause intervals, no-code tasks, failed attempts, and cache/reasoning tokens.
• Checklist tests distinguish durable work nodes from provider todos.
• Existing live task output and socket resource authorization tests remain green.