perf: v2.5.10 — ready for 10+ concurrent users, leaner locally

Measured on a copy of a real 1.2 GB / 253K-event database, 10 simulated
browsers + 10 hooks/s for 90 s: event-loop delay p99 1239 ms → 32 ms (max
2.0 s → 94 ms), 266 failed requests → 0, 74 → 111 requests/s served, server
RSS 633 → 346 MB. Entry bundle 975 KB raw → 394 KB (106 KB brotli).

Server
- /api/analytics: the events-table scans run in the read worker
  (scoped-stats eventAggregates, read-pool job analyticsEvents); runRead takes
  maxAgeMs — analytics 10 s, /api/workflows 30 s — keyed by the args
- /api/workflows/skill-usage: +event_type and a tool_name range instead of
  LIKE, so it uses idx_events_tool (784 ms → a few ms)
- idx_events_session_type_tool (session_id, event_type, tool_name,
  created_at) replaces idx_events_session_type: covering reads for session
  stats, the hook dedupes and the import resume point (1.2 s → 20 ms); 64 MB
  cache_size and 256 MB mmap_size on both connections
- WAL: the server sets wal_autocheckpoint = 0 and checkpoints PASSIVE every
  DASHBOARD_WAL_CHECKPOINT_MS (5 s) from the read worker's own writable
  connection; a failed checkpoint restores the automatic one (hook COMMIT p95
  109 ms → 15 ms at 100 hooks/s)
- tmux: one list-sessions answers a whole GET /api/lanes and the heal beat
  (liveSessions), shared for 1 s and cleared by this process's new/kill —
  GET /api/run's sync spawns had blocked 60 s of a 90 s run; the heal beat
  skips tmux when nothing runs; attach options chained into 2 spawns
- hooks: TurnDuration/APIError deduped against one read per hook instead of a
  query per transcript entry (23 ms/hook on a 763-turn session); one lane
  scan per hook; hourly upserts skip rows that did not grow; frames are sent
  after the transaction commits (and after the pane binding); new_event
  carries its row id; a split pane's (slot 1–9) hooks no longer rebind the
  lane's session_id
- watchdog liveness probe runs ps asynchronously; transcript newline scan via
  indexOf; startup subagent backfill fingerprints the files it already checked
- pty attach: backpressure (pause past 1 MB unsent, resume under 256 KB)
- static: hashed assets served from their pre-compressed .br/.gz sibling

Client
- hidden tabs neither refetch on WS events nor poll (useLiveRefresh, panes,
  lane cards, git header, changes panel, settings); no per-tab hourly
  /updates/check (the server already checks)
- refetch storms throttled (workspace tree/session list 3 s, /api/run only on
  a run-key change, notification pane lookup only when shown); WS reconnect
  jitter; terminal retry backoff 1.5 → 30 s, stops on 1008
- heavier throttles for aggregates (15 s) and detail views; Monitor keepIfSame;
  GET in-flight dedupe in request()
- lazy Dashboard/History, xterm (with the first terminal), lane modals, Sagi
  (only while enabled); only the active locale loads; Workspace chunk
  prefetched on a /workspace deep link
- Sagi: no work while disabled, pupil via CSS variables, memo avatar
- build: .br/.gz siblings, sourcemap hidden; service worker no longer caches
  /assets/ (cache v3 drops the old one)

Tests: scripts/test-server.js drops the GIT_DIR-family variables a hook
exports, so a suite run from a linked worktree's pre-commit can no longer
commit into the real repository or set core.bare.

Docs: ARCHITECTURE, DATABASE, API, DEPLOYMENT, client README,
docs/plans/perf/README.md (audit, checklist, results).

server/lib/tmux.js

@@ -34,10 +34,35 @@ let exactTargets = null;
 function __setExecImpl(fn, { exact = true } = {}) {
   execImpl = fn;
   exactTargets = exact;
+  listed = null;
 }
 function __reset() {
   execImpl = (args) => execFileSync("tmux", args, EXEC_OPTS);
   exactTargets = null;
+  listed = null;
+}
+
+// The `list-sessions` answer, shared for LIST_TTL_MS. Every open dashboard
+// polls GET /api/run, and each synchronous spawn forks this whole process —
+// measured 2,247 calls, 60 s of a 90 s run blocked, at 10 browsers. A session
+// this process creates or kills clears it, so only a pane that exits on its
+// own can read as live for up to a second. "No server" (exit 1) is an answer
+// too and is shared; any other failure is not.
+const LIST_TTL_MS = 1000;
+let listed = null; // { at, out } | { at, err }
+function listOutput() {
+  if (listed && Date.now() - listed.at < LIST_TTL_MS) {
+    if (listed.err) throw listed.err;
+    return listed.out;
+  }
+  try {
+    const out = String(execImpl(["list-sessions", "-F", "#{session_name}"]));
+    listed = { at: Date.now(), out };
+    return out;
+  } catch (err) {
+    listed = err.status === 1 || err.code === "ENOENT" ? { at: Date.now(), err } : null;
+    throw err;
+  }
 }
 
 /**
@@ -117,6 +142,7 @@ function envFlags(env) {
 function newSession({ name, cwd, argv, env }) {
   // No argv = tmux's own default shell (a Windows Terminal pane).
   const cmd = argv.length ? ["--", ...argv] : [];
+  listed = null;
   execImpl(["new-session", "-d", "-s", name, "-c", cwd, ...envFlags(env), ...cmd]);
   try {
     enableMouse(name);
@@ -144,25 +170,37 @@ function newSession({ name, cwd, argv, env }) {
 // The status bar goes off here too: the dashboard's tab bar already names the
 // pane, and tmux's green line only eats a row of the terminal.
 function enableMouse(name) {
-  execImpl(["set-option", "-t", pane(name), "mouse", "on"]);
-  execImpl(["set-option", "-t", pane(name), "status", "off"]);
+  // tmux runs `;`-separated commands from ONE argv (each tmux call is a
+  // synchronous spawn on the event loop), stopping at the first that fails —
+  // so the options every tmux knows go first, in their own call. psmux (no
+  // `=name` targets) is not known to chain, so it gets one call per option.
+  const run = (...cmds) => {
+    if (exact()) return execImpl(cmds.flatMap((c, i) => (i ? [";", ...c] : c)));
+    for (const c of cmds) execImpl(c);
+  };
+  run(
+    ["set-option", "-t", pane(name), "mouse", "on"],
+    ["set-option", "-t", pane(name), "status", "off"]
+  );
   // A draggable scrollbar beside the pane (mouse mode makes it drag). Only a
   // tmux SERVER of 3.7+ knows the option; an older one refuses it, which is
   // fine — the pane just has none (`/agenthub-doctor` says how to upgrade).
   try {
-    execImpl(["set-option", "-t", pane(name), "pane-scrollbars", "on"]);
-    // tmux's default (`fg=white,bg=black,width=1`) is a one-column track in
-    // ANSI black — the terminal theme's border colour, almost the background —
-    // so it reads as no scrollbar at all. Bright slider. ONE column: tmux 3.7c
-    // reserves `width` columns but paints only the first, so a second one is
-    // never cleared and shows stale cells — a ghost second scrollbar.
-    execImpl([
-      "set-option",
-      "-t",
-      pane(name),
-      "pane-scrollbars-style",
-      "fg=brightwhite,bg=black,width=1,pad=0",
-    ]);
+    run(
+      ["set-option", "-t", pane(name), "pane-scrollbars", "on"],
+      // tmux's default (`fg=white,bg=black,width=1`) is a one-column track in
+      // ANSI black — the terminal theme's border colour, almost the background —
+      // so it reads as no scrollbar at all. Bright slider. ONE column: tmux 3.7c
+      // reserves `width` columns but paints only the first, so a second one is
+      // never cleared and shows stale cells — a ghost second scrollbar.
+      [
+        "set-option",
+        "-t",
+        pane(name),
+        "pane-scrollbars-style",
+        "fg=brightwhite,bg=black,width=1,pad=0",
+      ]
+    );
   } catch {
     /* tmux < 3.7 */
   }
@@ -239,6 +277,7 @@ function pasteText(name, text) {
 
 /** Idempotent — a session that's already gone is not an error. */
 function killSession(name) {
+  listed = null;
   try {
     execImpl(["kill-session", "-t", session(name)]);
   } catch {
@@ -250,7 +289,7 @@ function killSession(name) {
 function listSessions(prefix) {
   let out;
   try {
-    out = execImpl(["list-sessions", "-F", "#{session_name}"]);
+    out = listOutput();
   } catch {
     return [];
   }
@@ -260,6 +299,27 @@ function listSessions(prefix) {
     .filter((s) => s && s.startsWith(prefix));
 }
 
+/**
+ * Every live session name from ONE `list-sessions` — what a poll asks instead
+ * of a synchronous has-session per name, each of which blocks the event loop
+ * (and so every terminal keystroke) for a whole tmux spawn. Empty when no
+ * server runs (tmux exits 1) or tmux is not installed; null when the call
+ * itself failed (EAGAIN/ENOMEM under memory pressure), which proves nothing
+ * about the panes — a caller must not read that as "every pane is gone".
+ */
+function liveSessions() {
+  try {
+    return new Set(
+      listOutput()
+        .split("\n")
+        .map((s) => s.trim())
+        .filter(Boolean)
+    );
+  } catch (err) {
+    return err.status === 1 || err.code === "ENOENT" ? new Set() : null;
+  }
+}
+
 function isTmuxAvailable() {
   return clientVersion() !== null;
 }
@@ -297,6 +357,7 @@ module.exports = {
   pasteText,
   killSession,
   listSessions,
+  liveSessions,
   isTmuxAvailable,
   clientVersion,
   serverVersion,