Tower sessions expose no input-generation observable: 'turn ended' vs 'new turn ended' are indistinguishable, blinding reset/arch-save freshness guarantees

[waleedkadous]

Problem

Tower's session observables are output-shaped: lastDataAt (terminal/shellper-client.ts) timestamps the last output, and nothing at all changes observably when new input reaches a session (user keystrokes, afx send, raw writes). Consequence: "the original turn ended" and "a follow-up turn started and ended" are observationally identical from outside the session.

Two shipped/in-flight consumers are blinded by this today:

1. afx reset (R4, PR [Spec 1273] Builder context reset: save-state → /clear → re-orient #1305): the quiesce step infers "builder is idle at the state it saved" from output-quiet — but output-quiet after a new instruction's turn looks exactly the same. A reset armed before an afx send lands can clear work created after the save.
2. /arch-save (/arch-save: packaged save→clear→re-init cycle for architect context refresh (counterpart to /arch-init) #1307, in design): its criterion "the clear can never destroy work created after the verified save" was found UNIMPLEMENTABLE against current observables during spec review (codex, verified against source) — the spec now honestly states a bounded window with an output-total heuristic, not a guarantee, and names this issue's primitive as the missing piece.

Ask

A monotonic per-session input-generation counter: incremented whenever input is written to the session's PTY (any source — interactive keys, afx send formatted/raw/escape, dev writes), exposed on the session info surface (GET /api/terminals / session.info).

Consumers then get a sound freshness protocol: snapshot the counter when the save is verified; before executing the clear, compare — counter advanced ⇒ refuse or re-verify, counter unchanged + output-quiet ⇒ the quiet window actually proves what it's assumed to prove. The heuristics both consumers ship today upgrade in place to guarantees.

Notes

• Increment-on-input-write means no protocol parsing and no turn semantics — Tower doesn't need to understand turns, only to count input arrivals, which it mediates already.
• The wire contract addition should carry its own test per the established pattern (the session.info passthrough test debate in project 1273's phase 2 is the precedent: the wire shape is contract, not implementation detail).
• Origin: raised by the aspir-1307 builder during spec review, deliberately NOT pulled into /arch-save: packaged save→clear→re-init cycle for architect context refresh (counterpart to /arch-init) #1307's scope; [Spec 1273] Builder context reset: save-state → /clear → re-orient #1305's R4 gains the same soundness upgrade when this lands.