SSE: Multiple robustness issues (cleanup races, no idle timeout, no reconnection handling)

[OneStepAt4time]

Issue

Multiple SSE and event bus robustness issues:

1. emitEnded emitter cleanup race (events.ts:154): The 1-second setTimeout after emitEnded can delete a fresh emitter created by a new subscriber during that window.

2. No idle SSE timeout (server.ts:307): No logic to close connections where the client stopped reading. Zombie connections persist until TCP timeout.

3. Duplicate legacy route (server.ts:938): A second SSE route at /sessions/:id/events (no /v1/ prefix) duplicates attack surface.

4. No Last-Event-ID (client.ts:254): Events during reconnection are silently lost. Standard SSE feature not implemented.

5. No reconnection circuit-breaker (client.ts:251): When the server is permanently down, EventSource retries indefinitely.

6. Synchronous EventEmitter.emit() (events.ts:87): Blocks the monitor loop when SSE writes are slow.

Files

• src/events.ts
• src/server.ts
• dashboard/src/api/client.ts

Severity

MEDIUM — Robustness and reliability issues under production load.