perf: v2.5.10 — ready for 10+ concurrent users, leaner locally

Measured on a copy of a real 1.2 GB / 253K-event database, 10 simulated
browsers + 10 hooks/s for 90 s: event-loop delay p99 1239 ms → 32 ms (max
2.0 s → 94 ms), 266 failed requests → 0, 74 → 111 requests/s served, server
RSS 633 → 346 MB. Entry bundle 975 KB raw → 394 KB (106 KB brotli).

Server
- /api/analytics: the events-table scans run in the read worker
  (scoped-stats eventAggregates, read-pool job analyticsEvents); runRead takes
  maxAgeMs — analytics 10 s, /api/workflows 30 s — keyed by the args
- /api/workflows/skill-usage: +event_type and a tool_name range instead of
  LIKE, so it uses idx_events_tool (784 ms → a few ms)
- idx_events_session_type_tool (session_id, event_type, tool_name,
  created_at) replaces idx_events_session_type: covering reads for session
  stats, the hook dedupes and the import resume point (1.2 s → 20 ms); 64 MB
  cache_size and 256 MB mmap_size on both connections
- WAL: the server sets wal_autocheckpoint = 0 and checkpoints PASSIVE every
  DASHBOARD_WAL_CHECKPOINT_MS (5 s) from the read worker's own writable
  connection; a failed checkpoint restores the automatic one (hook COMMIT p95
  109 ms → 15 ms at 100 hooks/s)
- tmux: one list-sessions answers a whole GET /api/lanes and the heal beat
  (liveSessions), shared for 1 s and cleared by this process's new/kill —
  GET /api/run's sync spawns had blocked 60 s of a 90 s run; the heal beat
  skips tmux when nothing runs; attach options chained into 2 spawns
- hooks: TurnDuration/APIError deduped against one read per hook instead of a
  query per transcript entry (23 ms/hook on a 763-turn session); one lane
  scan per hook; hourly upserts skip rows that did not grow; frames are sent
  after the transaction commits (and after the pane binding); new_event
  carries its row id; a split pane's (slot 1–9) hooks no longer rebind the
  lane's session_id
- watchdog liveness probe runs ps asynchronously; transcript newline scan via
  indexOf; startup subagent backfill fingerprints the files it already checked
- pty attach: backpressure (pause past 1 MB unsent, resume under 256 KB)
- static: hashed assets served from their pre-compressed .br/.gz sibling

Client
- hidden tabs neither refetch on WS events nor poll (useLiveRefresh, panes,
  lane cards, git header, changes panel, settings); no per-tab hourly
  /updates/check (the server already checks)
- refetch storms throttled (workspace tree/session list 3 s, /api/run only on
  a run-key change, notification pane lookup only when shown); WS reconnect
  jitter; terminal retry backoff 1.5 → 30 s, stops on 1008
- heavier throttles for aggregates (15 s) and detail views; Monitor keepIfSame;
  GET in-flight dedupe in request()
- lazy Dashboard/History, xterm (with the first terminal), lane modals, Sagi
  (only while enabled); only the active locale loads; Workspace chunk
  prefetched on a /workspace deep link
- Sagi: no work while disabled, pupil via CSS variables, memo avatar
- build: .br/.gz siblings, sourcemap hidden; service worker no longer caches
  /assets/ (cache v3 drops the old one)

Tests: scripts/test-server.js drops the GIT_DIR-family variables a hook
exports, so a suite run from a linked worktree's pre-commit can no longer
commit into the real repository or set core.bare.

Docs: ARCHITECTURE, DATABASE, API, DEPLOYMENT, client README,
docs/plans/perf/README.md (audit, checklist, results).

server/index.js

@@ -51,6 +51,7 @@ if (require.main === module) require("./lib/claude-home").migrateLegacyDataDir()
 
 const express = require("express");
 const cors = require("cors");
+const fs = require("fs");
 const path = require("path");
 const http = require("http");
 const swaggerUi = require("swagger-ui-express");
@@ -216,6 +217,30 @@ function startServer(app, port) {
     //     so they must revalidate every load — without this the browser's
     //     heuristic cache happily serves a stale index.html that references
     //     asset hashes that no longer exist on disk.
+    //
+    // A hashed asset's `.br`/`.gz` sibling (written by the client build) goes
+    // to a browser that accepts it: ~75 % fewer bytes over a network, and no
+    // compression CPU here. Only a flat file name is looked up.
+    const assetsDir = path.join(clientDist, "assets");
+    const ENCODINGS = [
+      ["br", ".br", /\bbr\b/],
+      ["gzip", ".gz", /\bgzip\b/],
+    ];
+    app.use("/assets", (req, res, next) => {
+      res.setHeader("Vary", "Accept-Encoding");
+      if (req.method !== "GET" && req.method !== "HEAD") return next();
+      const name = req.path.slice(1);
+      if (!/^[\w.-]+$/.test(name) || name.startsWith(".")) return next();
+      const accept = String(req.headers["accept-encoding"] || "");
+      for (const [encoding, ext, re] of ENCODINGS) {
+        if (!re.test(accept) || !fs.existsSync(path.join(assetsDir, name + ext))) continue;
+        res.setHeader("Content-Encoding", encoding);
+        res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+        res.type(path.extname(name)); // the original's type, not the sibling's
+        return res.sendFile(name + ext, { root: assetsDir }, (err) => err && next(err));
+      }
+      next();
+    });
     app.use(
       express.static(clientDist, {
         etag: true,
@@ -377,6 +402,29 @@ function startBackgroundServices() {
     }
   }
 
+  // WAL checkpoints off the event loop. SQLite's automatic checkpoint runs
+  // inside whichever COMMIT crosses 1000 pages — a hook's, on this thread —
+  // and measured up to 2.7 s per commit under load. This process stops doing
+  // that and checkpoints every few seconds from the read worker instead; a
+  // failed checkpoint puts the automatic one back. Other processes on the same
+  // file (a second dashboard, the CLI) keep their own setting. Off with
+  // DASHBOARD_WAL_CHECKPOINT_MS=0.
+  {
+    const every = Number(process.env.DASHBOARD_WAL_CHECKPOINT_MS ?? 5000);
+    if (every > 0) {
+      const { db } = require("./db");
+      const { runRead } = require("./lib/read-pool");
+      db.pragma("wal_autocheckpoint = 0");
+      const t = setInterval(() => {
+        runRead("walCheckpoint").catch(() => {
+          db.pragma("wal_autocheckpoint = 1000");
+          clearInterval(t);
+        });
+      }, every);
+      if (t.unref) t.unref();
+    }
+  }
+
   // Scheduled reports (Settings → Reports). Off with DASHBOARD_REPORTS_MS=0.
   require("./lib/reports").startReportScheduler();
 
@@ -619,18 +667,26 @@ function startBackgroundServices() {
     }
   }
   // A codex/antigravity pane that exits fires no hook, so release its lane on
-  // a beat instead (one `tmux has-session` per lane with a run), and end the
-  // run record of any pane that is gone. Off with DASHBOARD_RUN_HEAL_MS=0.
+  // a beat instead (ONE `tmux list-sessions` per beat — each tmux call is
+  // synchronous and stalls every terminal's keystrokes), and end the run
+  // record of any pane that is gone. Off with DASHBOARD_RUN_HEAL_MS=0.
   const HEAL_MS = Number(process.env.DASHBOARD_RUN_HEAL_MS ?? 10_000);
   if (Number.isFinite(HEAL_MS) && HEAL_MS > 0) {
     const { healAllRunIds } = require("./routes/lanes");
     const { reconcileOrphans } = require("./lib/dashboard-runs");
-    const { hasSession } = require("./lib/tmux");
+    const { liveSessions } = require("./lib/tmux");
+    const anyRun = require("./db").db.prepare(
+      `SELECT EXISTS (SELECT 1 FROM lanes WHERE run_id IS NOT NULL)
+           OR EXISTS (SELECT 1 FROM dashboard_runs WHERE status IN ('running', 'spawning')) AS any`
+    );
     const healTimer = setInterval(() => {
       try {
-        healAllRunIds();
+        if (!anyRun.get().any) return; // nothing to heal: no tmux spawn at all
+        const live = liveSessions();
+        if (!live) return; // tmux could not be asked: skip, never end every run
+        healAllRunIds(live);
         // A pane that quit (Ctrl+C, `exit`) ends its run record too.
-        reconcileOrphans(hasSession);
+        reconcileOrphans((id) => live.has(id));
       } catch (err) {
         console.warn("run heal failed:", err.message);
       }