Remote sessions can hold transcript uploads across model calls, with a new launch-time flush policy

What

In a remote session, Claude Code runs on a cloud worker and sends the rows of the conversation up to a session service so that viewers can follow along. The set of rules deciding when rows are held back and when they are sent is called the flush policy. That policy has new options and new behaviour:

• hold_across_model_calls (holdAcrossModelCalls) lets the worker keep holding rows across several model calls instead of sending at the end of each one. When it is on, the policy uses different default age and event limits and turns off flush_on_sampling_end. While the turn hold is open, user rows are no longer allowed to wait.
• merge_worker_reports (mergeWorkerReports) lets back-to-back worker_status updates be combined. The uploader now drains a pending worker_status event when another one follows. When the new mergesSameRun check passes (it needs mergeWorkerReports and the hold switch), it drains a moment later in a microtask instead of straight away.
• CLAUDE_CODE_CCR_EVENT_FLUSH_POLICY is a new environment variable, read as JSON with the raw text as a fallback, that becomes launchFlushPolicy. When the server sends no policy, takeUpFlushPolicy falls back to it. The variable is added to two lists of allowed environment variables. The same options object reads the server-controlled switches tengu_ccr_event_hold_enabled (falls back to on) and tengu_ccr_upload_hold_marker (falls back to off).
• Pickup barriers and a pickupWaitMs setting now delay writes. Setting the worker to idle opens every pickup barrier and sets the turn hold back to "open".
• Viewer checkpoints: a viewer can request one through setOnCheckpointRequest, which calls checkpointForViewer("watcher"), and a reconnect calls checkpointForViewer("reconnect") when rows are held across model calls. A checkpoint_done system event is sent after held rows are uploaded.
• Live rows are tagged with live_turn_id and live_index.
• Delivery reports now carry the user message's uuid, not only the event id and status.
• Event types starting with control_ are dropped from live_twin_types.
• The check for unsent items now counts a pending item as unsent, and close() drains the queue first.
• The policy comparison checks both new fields, and both are recorded in usage reporting.

The new fields come from server config or the launch environment, not from a user setting.

Why

This changes when a remote session's transcript reaches the people watching it, how status updates are batched, and how a viewer catches up after reconnecting. Nothing here is set by an ordinary user.