batch3 T5 review fixes: backoff off-by-one + activeSession shape + headers

- useUserEvents: double delay before scheduling, producing 1/2/4/8/16/30s
- useSidebar: activeSessionProjectId -> activeSession {session_id,project_id}
  so consumers can verify URL match and ignore stale values
- api.panes.create/update: drop redundant Content-Type (request helper sets)
- useUserEvents: minimal type guard on incoming WS frame before emit

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/src/hooks/useSidebar.ts

@@ -13,7 +13,7 @@ let sharedError: string | null = null;
 let sharedLoading: boolean = true;
 let initialized = false;
 let fetchInFlight: Promise<void> | null = null;
-let activeSessionProjectId: string | null = null;
+let activeSession: { session_id: string; project_id: string } | null = null;
 const subscribers = new Set<() => void>();
 
 function notify(): void {
@@ -150,7 +150,7 @@ sessionEvents.subscribe((event) => {
   // session_loaded updates activeSessionProjectId regardless of whether
   // sharedData is populated yet — notify so subscribers can re-read.
   if (event.type === 'session_loaded') {
-    activeSessionProjectId = event.project_id;
+    activeSession = { session_id: event.session_id, project_id: event.project_id };
     notify();
     return;
   }
@@ -165,11 +165,11 @@ interface Snapshot {
   data: SidebarResponse | null;
   error: string | null;
   loading: boolean;
-  activeSessionProjectId: string | null;
+  activeSession: { session_id: string; project_id: string } | null;
 }
 
 function snapshot(): Snapshot {
-  return { data: sharedData, error: sharedError, loading: sharedLoading, activeSessionProjectId };
+  return { data: sharedData, error: sharedError, loading: sharedLoading, activeSession };
 }
 
 export function useSidebar(): {
@@ -177,7 +177,7 @@ export function useSidebar(): {
   error: string | null;
   loading: boolean;
   retry: () => void;
-  activeSessionProjectId: string | null;
+  activeSession: { session_id: string; project_id: string } | null;
 } {
   const [state, setState] = useState<Snapshot>(snapshot);
 
@@ -199,5 +199,5 @@ export function useSidebar(): {
     void load();
   };
 
-  return { data: state.data, error: state.error, loading: state.loading, retry, activeSessionProjectId: state.activeSessionProjectId };
+  return { data: state.data, error: state.error, loading: state.loading, retry, activeSession: state.activeSession };
 }

apps/web/src/hooks/useUserEvents.ts

@@ -23,11 +23,10 @@ export function useUserEvents(): void {
 
       ws.onmessage = (ev) => {
         try {
-          const frame = JSON.parse(ev.data);
-          // The server emits frames whose `type` matches SessionEvent union members
-          // (project_created, project_deleted, session_created, session_deleted, session_updated).
-          // Pass through onto the bus.
-          sessionEvents.emit(frame);
+          const parsed: unknown = JSON.parse(ev.data);
+          if (parsed && typeof (parsed as { type?: unknown }).type === 'string') {
+            sessionEvents.emit(parsed as import('./sessionEvents').SessionEvent);
+          }
         } catch (err) {
           console.warn('useUserEvents: failed to parse frame', err);
         }
@@ -35,10 +34,9 @@ export function useUserEvents(): void {
 
       ws.onclose = () => {
         if (unmounted) return;
-        reconnectTimer = setTimeout(() => {
-          reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);
-          connect();
-        }, reconnectDelay);
+        const delay = reconnectDelay;
+        reconnectDelay = Math.min(reconnectDelay * 2, RECONNECT_MAX_MS);
+        reconnectTimer = setTimeout(connect, delay);
       };
 
       ws.onerror = () => {