fix(review round 1, own slice): plugin welcome-gap counting + null-id guard; bridge setup group-kill; Makefile staticcheck gate + worker-image rsync; deploy excludes

plugin/lvmh-agent.ts

@@ -487,6 +487,20 @@ export default function (pi: ExtensionAPI): void {
 			const counter: number = seqCounters.get(currentSessionId) ?? 0;
 			if (counter <= lastSeq) seqCounters.set(currentSessionId, lastSeq);
 		}
+		// Events already covered by the daemon's lastSeq are silently absent
+		// from both replay and queue below — count them so the buffer_overflow
+		// notice reflects every gap, not just cap drops.
+		const covered: number =
+			replayBuf.filter((f) => f.seq <= lastSeq).length +
+			sendQueue.filter(
+				(f) => !TRANSIENT_TYPES.has(f.type) && f.seq <= lastSeq,
+			).length;
+		if (covered > 0) {
+			droppedEvents += covered;
+			log(
+				`welcome lastSeq=${lastSeq} covers ${covered} in-flight events; flagging`,
+			);
+		}
 		// Replay persisted events the daemon is missing, before queued live
 		// frames. Persisted-kind frames still sitting in the queue are dropped
 		// here: they are already in replayBuf, so sending both would duplicate
@@ -620,6 +634,10 @@ export default function (pi: ExtensionAPI): void {
 		}
 		if (sessionId === null) {
 			log("no session id; lvmh mirroring disabled for this session");
+			// Enforce the logged contract: stop mirroring rather than
+			// attributing this session's events to the previous session id.
+			currentSessionId = null;
+			handleDisconnect();
 			return;
 		}
 		const assignedId = process.env[ENV_SESSION_ID];