perf: v2.5.10 — ready for 10+ concurrent users, leaner locally

Measured on a copy of a real 1.2 GB / 253K-event database, 10 simulated
browsers + 10 hooks/s for 90 s: event-loop delay p99 1239 ms → 32 ms (max
2.0 s → 94 ms), 266 failed requests → 0, 74 → 111 requests/s served, server
RSS 633 → 346 MB. Entry bundle 975 KB raw → 394 KB (106 KB brotli).

Server
- /api/analytics: the events-table scans run in the read worker
  (scoped-stats eventAggregates, read-pool job analyticsEvents); runRead takes
  maxAgeMs — analytics 10 s, /api/workflows 30 s — keyed by the args
- /api/workflows/skill-usage: +event_type and a tool_name range instead of
  LIKE, so it uses idx_events_tool (784 ms → a few ms)
- idx_events_session_type_tool (session_id, event_type, tool_name,
  created_at) replaces idx_events_session_type: covering reads for session
  stats, the hook dedupes and the import resume point (1.2 s → 20 ms); 64 MB
  cache_size and 256 MB mmap_size on both connections
- WAL: the server sets wal_autocheckpoint = 0 and checkpoints PASSIVE every
  DASHBOARD_WAL_CHECKPOINT_MS (5 s) from the read worker's own writable
  connection; a failed checkpoint restores the automatic one (hook COMMIT p95
  109 ms → 15 ms at 100 hooks/s)
- tmux: one list-sessions answers a whole GET /api/lanes and the heal beat
  (liveSessions), shared for 1 s and cleared by this process's new/kill —
  GET /api/run's sync spawns had blocked 60 s of a 90 s run; the heal beat
  skips tmux when nothing runs; attach options chained into 2 spawns
- hooks: TurnDuration/APIError deduped against one read per hook instead of a
  query per transcript entry (23 ms/hook on a 763-turn session); one lane
  scan per hook; hourly upserts skip rows that did not grow; frames are sent
  after the transaction commits (and after the pane binding); new_event
  carries its row id; a split pane's (slot 1–9) hooks no longer rebind the
  lane's session_id
- watchdog liveness probe runs ps asynchronously; transcript newline scan via
  indexOf; startup subagent backfill fingerprints the files it already checked
- pty attach: backpressure (pause past 1 MB unsent, resume under 256 KB)
- static: hashed assets served from their pre-compressed .br/.gz sibling

Client
- hidden tabs neither refetch on WS events nor poll (useLiveRefresh, panes,
  lane cards, git header, changes panel, settings); no per-tab hourly
  /updates/check (the server already checks)
- refetch storms throttled (workspace tree/session list 3 s, /api/run only on
  a run-key change, notification pane lookup only when shown); WS reconnect
  jitter; terminal retry backoff 1.5 → 30 s, stops on 1008
- heavier throttles for aggregates (15 s) and detail views; Monitor keepIfSame;
  GET in-flight dedupe in request()
- lazy Dashboard/History, xterm (with the first terminal), lane modals, Sagi
  (only while enabled); only the active locale loads; Workspace chunk
  prefetched on a /workspace deep link
- Sagi: no work while disabled, pupil via CSS variables, memo avatar
- build: .br/.gz siblings, sourcemap hidden; service worker no longer caches
  /assets/ (cache v3 drops the old one)

Tests: scripts/test-server.js drops the GIT_DIR-family variables a hook
exports, so a suite run from a linked worktree's pre-commit can no longer
commit into the real repository or set core.bare.

Docs: ARCHITECTURE, DATABASE, API, DEPLOYMENT, client README,
docs/plans/perf/README.md (audit, checklist, results).

server/__tests__/tmux.test.js

@@ -28,6 +28,35 @@ describe("tmux wrapper", () => {
     assert.equal(tmux.hasSession("agenthub-lane-1"), false);
   });
 
+  it("liveSessions answers every live name with ONE list-sessions call", () => {
+    const calls = [];
+    tmux.__setExecImpl((args) => {
+      calls.push(args[0]);
+      return "agenthub-lane-1\nagenthub-lane-12\nmain\n";
+    });
+    assert.deepEqual([...tmux.liveSessions()], ["agenthub-lane-1", "agenthub-lane-12", "main"]);
+    assert.deepEqual(calls, ["list-sessions"]);
+  });
+
+  it("liveSessions is empty when tmux answers that no server runs (or is not installed)", () => {
+    tmux.__setExecImpl(() => {
+      throw Object.assign(new Error("no server running"), { status: 1 });
+    });
+    assert.equal(tmux.liveSessions().size, 0);
+    tmux.__setExecImpl(() => {
+      throw Object.assign(new Error("spawn tmux ENOENT"), { code: "ENOENT" });
+    });
+    assert.equal(tmux.liveSessions().size, 0);
+  });
+
+  it("liveSessions is null when tmux could not be asked — not 'every pane is gone'", () => {
+    // Out of memory/processes: the panes are fine, the question failed.
+    tmux.__setExecImpl(() => {
+      throw Object.assign(new Error("spawnSync tmux EAGAIN"), { code: "EAGAIN" });
+    });
+    assert.equal(tmux.liveSessions(), null);
+  });
+
   it("newSession names a command that exited at once instead of tmux's set-option error", () => {
     tmux.__setExecImpl((args) => {
       if (args[0] === "new-session") return "";
@@ -79,6 +108,22 @@ describe("tmux wrapper", () => {
     calls = fake(true);
     tmux.enableMouse("agenthub-lane-1");
     assert.ok(calls.some((c) => c[0] === "set-option" && c[2] === "=agenthub-lane-1:"));
+    // tmux chains the four options into two spawns; psmux above got four.
+    const sets = calls.filter((c) => c[0] === "set-option");
+    assert.equal(sets.length, 2);
+    assert.deepEqual(sets[0], [
+      "set-option",
+      "-t",
+      "=agenthub-lane-1:",
+      "mouse",
+      "on",
+      ";",
+      "set-option",
+      "-t",
+      "=agenthub-lane-1:",
+      "status",
+      "off",
+    ]);
   });
 
   it("newSession builds the correct argv", () => {
@@ -104,16 +149,18 @@ describe("tmux wrapper", () => {
       "--model",
       "opus",
     ]);
-    assert.deepEqual(calls[1], ["set-option", "-t", "=agenthub-lane-1:", "mouse", "on"]);
-    assert.deepEqual(calls[2], ["set-option", "-t", "=agenthub-lane-1:", "status", "off"]);
-    assert.deepEqual(calls[3], ["set-option", "-t", "=agenthub-lane-1:", "pane-scrollbars", "on"]);
-    assert.deepEqual(calls[4], [
-      "set-option",
-      "-t",
-      "=agenthub-lane-1:",
-      "pane-scrollbars-style",
+    // One tmux call per `;`-chained group: the options every tmux knows, then
+    // the 3.7+ scrollbar pair (allowed to fail on its own).
+    assert.deepEqual(calls[1], [
+      ...["set-option", "-t", "=agenthub-lane-1:", "mouse", "on", ";"],
+      ...["set-option", "-t", "=agenthub-lane-1:", "status", "off"],
+    ]);
+    assert.deepEqual(calls[2], [
+      ...["set-option", "-t", "=agenthub-lane-1:", "pane-scrollbars", "on", ";"],
+      ...["set-option", "-t", "=agenthub-lane-1:", "pane-scrollbars-style"],
       "fg=brightwhite,bg=black,width=1,pad=0",
     ]);
+    assert.equal(calls.length, 3);
   });
 
   it("newSession still succeeds on a tmux older than 3.7 (no pane-scrollbars)", () => {
@@ -171,6 +218,22 @@ describe("tmux wrapper", () => {
     assert.deepEqual(tmux.listSessions("agenthub-lane-"), ["agenthub-lane-1", "agenthub-lane-2"]);
   });
 
+  it("shares one list-sessions answer for a second, until this process creates or kills one", () => {
+    const calls = [];
+    let names = "agenthub-lane-1\n";
+    tmux.__setExecImpl((args) => {
+      calls.push(args[0]);
+      return args[0] === "list-sessions" ? names : "";
+    });
+    assert.deepEqual(tmux.listSessions("agenthub-lane-"), ["agenthub-lane-1"]);
+    assert.deepEqual([...tmux.liveSessions()], ["agenthub-lane-1"]);
+    assert.equal(calls.filter((c) => c === "list-sessions").length, 1);
+    tmux.killSession("agenthub-lane-1");
+    names = "";
+    assert.deepEqual(tmux.listSessions("agenthub-lane-"), []);
+    assert.equal(calls.filter((c) => c === "list-sessions").length, 2);
+  });
+
   it("listSessions returns [] when tmux has no sessions at all (exit 1)", () => {
     tmux.__setExecImpl(() => {
       const e = new Error("no server running");