fix(upload): time-consistent replay so delegated sessions don't strand at status=running

[Diego Colombo (colombod)]

Problem

When a recorded session is uploaded, run_upload feeds events one whole session at a time, parents before children, in strict file order, with nothing relating that feed to the server's own drain order. The server drains each session's events on an independent, concurrent queue. So for a session that used delegated sub-agents, a cross-session write that (re)opens a node — the parent's delegate:agent_spawned opening the child, or the child's session:start opening the parent — can be processed after that node's own session:end. The node is then left stranded at status="running" in the graph even though the upload completed with no error.

This is an upload-ordering artifact only: it does not occur for live, real-time capture (the events are naturally spaced), and it is invisible at upload time (every POST returns 2xx).

Fix (client-side only)

Make the uploader replay time-consistently, so a spawned sub-session drains before its parent resumes — reproducing the real capture timing that is race-free:

1. Feed events in true global timestamp order across the session-tree closure, via a lazy heapq.merge over per-line generators. A spawned sub-session's events therefore interleave before its parent's later-timestamped resume, exactly as they occurred.
2. Pace by the events' own inter-event gaps, capped at max_gap_s (default 2.0s), derived purely from the recorded timestamp fields.

Everything else is reused verbatim — parsing, build_payload, the POST + bounded-retry loop, per-attempt auth, reconciliation, and progress. Only the feed order + pacing + the tracker's start/complete triggers changed.

Explicitly NOT in this change

• No server change of any kind.
• No new server calls — the only request remains the existing POST /events. No /status polling, no drain/barrier signal. (Enforced in tests: the client mock is spec=["post"], so any non-POST call raises.)

What this gives user data uploads

• Delegated sessions land correctly. Sub-agent (and parent) nodes end completed, so the uploaded graph faithfully represents what happened instead of showing phantom "still running" sessions.
• Bounded memory — safe on large sessions. The merge is a lazy generator: memory is O(number of sessions), not O(events); no events.jsonl is ever read whole. Measured: a 74.9 MB single-session file uploads inside a ~41 MB process; 430× more events / ~1960× more bytes cost +944 KB peak RSS.
• Not a real-time replay. Idle gaps are capped, so a 19-minute session uploads in ~2 minutes (~80% of events sleep ~0); the cost is bounded per gap, not wall-clock fidelity.
• No regression for ordinary sessions. Non-delegated uploads are unchanged; event accounting stays exact (accepted == written, 0 dead-letter/residual).

Evidence

Validated against an isolated server instance with small real sessions:

Check	Result
Delegated session correctness	root + all sub-sessions completed 20/20 trials
Non-delegated regression	clean upload, exact event accounting, 0 loss/dup
Memory / streaming	peak RSS flat (~41 MB) uploading a 74.9 MB single events.jsonl; RSS independent of event count
No /status	proxy log shows only POST /events
Real-time?	19.4-min session replays in ~2 min
Tests	564 existing + 10 new pass; ruff/pyright clean

Scope / not claimed

• Does not claim race-freedom under concurrent external writers to the same server — the ordering guarantee is for offline, sole-writer uploads (the upload model). The pacing is bounded by max_gap_s, never a wrong result.
• Does not address the separate IncompleteSession co-labelling (its own PR).

Test plan

• uv run pytest (module) — green (574).
• uv run ruff check / pyright — clean.
• New tests/test_replay_ordering.py: global timestamp ordering, parent/child interleave (child session:end before parent's; parent spawn before child session:end), capped-gap pacing with event_delay_s floor, and a mechanical assertion that no non-/events request is ever made.