fix(broker): isolate alternate-screen snapshots

[almogdepaz]

summary

• suppress primary-screen scrollback when broker snapshots serialize the active alternate screen
• strengthen the active-buffer regression so primary history exists before entering alt-screen
• keep primary-screen snapshot and restoration behavior unchanged

root cause

snapshot_with_reflow selected the alternate visible grid but unconditionally serialized inner.scrollback, which belongs to the primary screen. narrow viewports made the leak visible after reconnect because wrapped shell output had already entered primary scrollback.

verification

• regression observed red before the fix and green after
• Rust: 174 passed
• Bun: 1,695 passed with local Git signing disabled to match CI
• broker release build passed
• iphone-se broker TUI reconnect: 5/5 passed
• rustfmt and git diff --check passed
• standalone security review: approve, no findings

scope

independent of PR #180 and PR #183. no auth, protocol, PTY ownership, replay sequencing, or browser behavior changes.

[almogdepaz]

edc delivery + security + quality review

scope: main@ed009b3...1f03e7c (fix/alt-screen-snapshot-isolation)
context loaded: broker-rust, coupled broker transport/browser/tests invariants, known issues

delivery verdict: delivered
architecture fit: fits
security recommendation: approve
quality verdict: lean already. ship.

delivery / architecture

no findings.

• goal was to prevent alt-screen snapshots from exposing primary scrollback.
• implementation gates snapshot scrollback on inner.on_alt in broker/src/terminal_state.rs:286-301 while leaving primary-screen snapshot behavior intact.
• regression now creates actual primary scrollback before entering alt screen and asserts alt snapshot scrollback stays empty at broker/src/terminal_state.rs:1893-1910.
• this matches the broker invariant that snapshots are broker-owned terminal truth and avoids browser/server alternate history.

security

no security findings.

checked:

• auth/authorization impact: none; no server/api/auth path touched.
• validation/input boundaries: no new external input parser or filesystem/process boundary.
• broker trust boundary: change is internal snapshot serialization only; no protocol, socket, pty ownership, or sequence semantics changed.
• history/regression scan: diff removes data leakage between terminal buffers, not a protection bypass.

limitations: review was diff/context based; i did not run the rust/bun/browser suites locally.

quality

no code-quality findings. small, targeted change; regression covers the previous leak without duplicating production logic.