perf: v2.5.10 — ready for 10+ concurrent users, leaner locally

Measured on a copy of a real 1.2 GB / 253K-event database, 10 simulated
browsers + 10 hooks/s for 90 s: event-loop delay p99 1239 ms → 32 ms (max
2.0 s → 94 ms), 266 failed requests → 0, 74 → 111 requests/s served, server
RSS 633 → 346 MB. Entry bundle 975 KB raw → 394 KB (106 KB brotli).

Server
- /api/analytics: the events-table scans run in the read worker
  (scoped-stats eventAggregates, read-pool job analyticsEvents); runRead takes
  maxAgeMs — analytics 10 s, /api/workflows 30 s — keyed by the args
- /api/workflows/skill-usage: +event_type and a tool_name range instead of
  LIKE, so it uses idx_events_tool (784 ms → a few ms)
- idx_events_session_type_tool (session_id, event_type, tool_name,
  created_at) replaces idx_events_session_type: covering reads for session
  stats, the hook dedupes and the import resume point (1.2 s → 20 ms); 64 MB
  cache_size and 256 MB mmap_size on both connections
- WAL: the server sets wal_autocheckpoint = 0 and checkpoints PASSIVE every
  DASHBOARD_WAL_CHECKPOINT_MS (5 s) from the read worker's own writable
  connection; a failed checkpoint restores the automatic one (hook COMMIT p95
  109 ms → 15 ms at 100 hooks/s)
- tmux: one list-sessions answers a whole GET /api/lanes and the heal beat
  (liveSessions), shared for 1 s and cleared by this process's new/kill —
  GET /api/run's sync spawns had blocked 60 s of a 90 s run; the heal beat
  skips tmux when nothing runs; attach options chained into 2 spawns
- hooks: TurnDuration/APIError deduped against one read per hook instead of a
  query per transcript entry (23 ms/hook on a 763-turn session); one lane
  scan per hook; hourly upserts skip rows that did not grow; frames are sent
  after the transaction commits (and after the pane binding); new_event
  carries its row id; a split pane's (slot 1–9) hooks no longer rebind the
  lane's session_id
- watchdog liveness probe runs ps asynchronously; transcript newline scan via
  indexOf; startup subagent backfill fingerprints the files it already checked
- pty attach: backpressure (pause past 1 MB unsent, resume under 256 KB)
- static: hashed assets served from their pre-compressed .br/.gz sibling

Client
- hidden tabs neither refetch on WS events nor poll (useLiveRefresh, panes,
  lane cards, git header, changes panel, settings); no per-tab hourly
  /updates/check (the server already checks)
- refetch storms throttled (workspace tree/session list 3 s, /api/run only on
  a run-key change, notification pane lookup only when shown); WS reconnect
  jitter; terminal retry backoff 1.5 → 30 s, stops on 1008
- heavier throttles for aggregates (15 s) and detail views; Monitor keepIfSame;
  GET in-flight dedupe in request()
- lazy Dashboard/History, xterm (with the first terminal), lane modals, Sagi
  (only while enabled); only the active locale loads; Workspace chunk
  prefetched on a /workspace deep link
- Sagi: no work while disabled, pupil via CSS variables, memo avatar
- build: .br/.gz siblings, sourcemap hidden; service worker no longer caches
  /assets/ (cache v3 drops the old one)

Tests: scripts/test-server.js drops the GIT_DIR-family variables a hook
exports, so a suite run from a linked worktree's pre-commit can no longer
commit into the real repository or set core.bare.

Docs: ARCHITECTURE, DATABASE, API, DEPLOYMENT, client README,
docs/plans/perf/README.md (audit, checklist, results).

server/lib/read-pool.js

@@ -2,10 +2,11 @@
  * @file Runs the dashboard's heavy read-only aggregations in a worker thread
  * on its own SQLite connection, so a slow one never blocks the event loop that
  * serves every other page, hook and websocket. Identical requests in flight are
- * shared, a job over `AGENTHUB_READ_TIMEOUT_MS` (default 60 s) is answered with
- * `EREADTIMEOUT` and its worker replaced, and `AGENTHUB_READ_WORKER=0` — or a
- * worker that cannot start — runs the job inline as before. This file is also
- * the worker's entry point.
+ * shared (and, when the caller asks, reused for a short window), a job over
+ * `AGENTHUB_READ_TIMEOUT_MS` (default 60 s) is answered with `EREADTIMEOUT` and
+ * its worker replaced, and `AGENTHUB_READ_WORKER=0` — or a worker that cannot
+ * start — runs the job inline as before. The server's periodic WAL checkpoint
+ * also runs here (`walCheckpoint`). This file is also the worker's entry point.
  * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
  */
 
@@ -19,6 +20,11 @@ const JOBS = {
       { status: a.status || null, tool: a.tool || null, range: a.range || null },
       a.sections || null
     ),
+  // Not a read: the worker runs it on its own writable connection (below), so
+  // the checkpoint's copy into the database file never blocks the event loop.
+  walCheckpoint: (conn) => conn.pragma("wal_checkpoint(PASSIVE)", { simple: false }),
+  analyticsEvents: (conn, a) =>
+    require("./scoped-stats").eventAggregates(conn, a.scope, a.range, a.tzModifier),
 };
 
 function timeoutMs() {
@@ -35,6 +41,7 @@ let worker = null;
 let seq = 0;
 const pending = new Map(); // id → { resolve, reject, timer, w }
 const inflight = new Map(); // job+args → Promise
+const recent = new Map(); // job+args → { at, result } for callers passing maxAgeMs
 
 function spawn(dbPath) {
   const w = new Worker(__filename, { workerData: { agenthubReadWorker: true, dbPath } });
@@ -93,37 +100,59 @@ function dispatch(job, args) {
 
 /**
  * Run a named read job off the event loop. Concurrent calls with the same job
- * and args share one run.
+ * and args share one run; with `maxAgeMs`, a result that young is reused too,
+ * so N open dashboards cost one query per window instead of N. Args are part
+ * of the key, so a result is only reused for the very same query.
  *
  * @param {keyof JOBS} job
  * @param {object} [args] structured-cloneable
+ * @param {{maxAgeMs?: number}} [opts]
  * @returns {Promise<any>}
  */
-function runRead(job, args = {}) {
+function runRead(job, args = {}, { maxAgeMs = 0 } = {}) {
   if (!JOBS[job]) return Promise.reject(codedError(`unknown read job ${job}`, "EBADJOB"));
   const key = `${job}:${JSON.stringify(args)}`;
+  const now = Date.now();
+  const fresh = recent.get(key);
+  if (fresh && now - fresh.at < maxAgeMs) return Promise.resolve(fresh.result);
   const hit = inflight.get(key);
   if (hit) return hit;
-  const p = dispatch(job, args).finally(() => inflight.delete(key));
+  const p = dispatch(job, args)
+    .then((result) => {
+      if (maxAgeMs > 0) {
+        // ponytail: drop-expired-on-write keeps this bounded by the keys used
+        // within one window; an LRU if a caller ever varies args per request.
+        for (const [k, v] of recent) if (now - v.at > 60_000) recent.delete(k);
+        recent.set(key, { at: Date.now(), result });
+      }
+      return result;
+    })
+    .finally(() => inflight.delete(key));
   inflight.set(key, p);
   return p;
 }
 
 if (!isMainThread && workerData?.agenthubReadWorker) {
   // Same driver order as server/db.js: better-sqlite3, else node:sqlite.
-  let conn;
-  try {
-    const Database = require("better-sqlite3");
-    conn = new Database(workerData.dbPath);
-  } catch {
-    const Database = require("../compat-sqlite");
-    conn = new Database(workerData.dbPath);
-  }
+  const open = () => {
+    try {
+      const Database = require("better-sqlite3");
+      return new Database(workerData.dbPath);
+    } catch {
+      const Database = require("../compat-sqlite");
+      return new Database(workerData.dbPath);
+    }
+  };
+  const conn = open();
+  let writer = null; // walCheckpoint's connection, opened on first use
   conn.pragma("busy_timeout = 5000");
   conn.pragma("query_only = ON"); // this connection can never write
+  conn.pragma("cache_size = -65536"); // same read tuning as server/db.js
+  conn.pragma("mmap_size = 268435456");
   parentPort.on("message", ({ id, job, args }) => {
     try {
-      parentPort.postMessage({ id, result: JOBS[job](conn, args) });
+      const c = job === "walCheckpoint" ? (writer ??= open()) : conn;
+      parentPort.postMessage({ id, result: JOBS[job](c, args) });
     } catch (err) {
       parentPort.postMessage({ id, error: { message: err.message, code: err.code } });
     }