[Juliusolsson05]

Closes #375.

The renderer's per-session runtime grew without bound on the live path: initial history loads 120 entries and older pages load 200, but every live jsonl burst appended forever ([...baseEntries, ...appended]), and several side structures (tool indices, seen-uuid sets, raw semantic/debug payload rings) never shrank. This PR bounds the live transcript window by count, makes what's trimmed reloadable, instruments every structure the investigation flagged, and stops retaining raw event payloads by default. Hibernation of background agents is deliberately out of scope (deferred by design).

Part A — memory instrumentation

• New performance/memoryInstrumentation.ts, driven by a 30s interval in useIpcSubscriptions (separate from the 1 Hz ghost sweep — sweep cadence is a correctness knob, gauge cadence a cost knob).
• Per-session gauges (renderer.session.memory.*): entries count + byte estimate, semantic history/log byte estimates, feed-debug ring length, ghost map size, tool_use/tool_result index sizes, seen-uuid + trimmed-uuid set sizes.
• Global gauges: code-block registry size; Monaco model count via a probe registry (lib/code/monacoModelProbe.ts) registered from inside getMonaco() — instrumentation can never force the Monaco lazy chunk, and the workspace hook's module graph never imports monaco-editor (which the renderer vitest project cannot even resolve).
• Byte estimates sample ≤64 evenly-spaced items and extrapolate. Ingest-time accounting would tax the hot append path and need decrement bookkeeping at every trim/reload site; full stringify per tick is the exact workload being instrumented. A trend gauge only needs order-of-magnitude fidelity.

Part B — the live entries window (the core)

New session-runtime/liveEntryWindow.ts + wiring in the jsonl burst handler:

• Trim fires when entries.length > MAX_LIVE_ENTRIES (2000, deliberately generous) down to TRIM_TO_LIVE_ENTRIES (1500) — hysteresis so the index rebuild + ledger recompute is paid ~once per 500 appends.

Trim-safety constraints (each one load-bearing):

1. totalEntries is never decremented — it is the on-disk denominator; entries was always documented as a window over it.
2. Ownership bound: the trim boundary stays strictly older than the oldest semantic.history turn's startedAt, currentTurn.startedAt, and every un-superseded ghost's updatedAt. Trimming a live turn's committed owner would defeat committed-ownership suppression and re-paint duplicates — the fix(feed): keep semantic history visible while JSONL catches up #165/Fix stale semantic web-search rows sticking at bottom after rollout commit #191/Semantic tool and edit rows can disappear without diagnostics explaining the suppression reason #344 regression class. Superseded ghosts don't protect (they're already scheduled for GC). Optimistic rows are never trimmed.
3. uuid guard: any uuid-less entry anywhere freezes the window. Uuid-less entries can't reload dedupe-safely through pagination, and the ledger's entry:ingest-${index} fallback ids (comment updated in observations/committed.ts) assume unshifted indices — a front-trim would re-key a retained uuid-less entry into an id previously owned by a different entry (the phantom-duplicate React-key class). In practice every mapped entry carries a uuid, so this is a freeze-don't-corrupt failsafe.
4. Pagination reload: all three ingest sites (live burst, initial history, older history) now stamp the mapper's historyMarker on each entry as a non-enumerable symbol rider — chosen over a parallel uuid→marker map because a rider dies with the entry (no new unbounded structure, no extra lifecycle plumbing) and is invisible to JSON.stringify (debug bundles, byte sampling). On trim, historyOldestMarker advances to the oldest retained entry's marker and hasOlderHistory flips true; if no retained marker exists the trim aborts rather than strand the region.
   Asymmetric dedupe: live ingest treats seen ∪ trimmed as already-seen (a resume bootstrapTail replay must not re-append old rows at the tail); the older-history path lets trimmed uuids back through, releasing them from the set as they reload. Trimmed-uuid bookkeeping follows the seenUuids lifecycle at all six teardown/reset sites (pane close, kill, rename ×2, restart-in-place, tab close).
5. Index rebuild: toolUseIndex/toolResultIndex are rebuilt in place from retained entries (per-id deletion breaks cross-entry pairings — a retained tool_result resolves its command via the map) with a toolIndexVersion bump. loadOlderHistory now also indexes paged-in entries — previously a latent gap, load-bearing after a rebuild so a reloaded trimmed region restores its pairings.
6. Scroll safety: no trim while loadingOlderHistory or within a 30s grace after an older-history prepend — Feed has no shrink-anchoring, and a user who just paged history in is reading exactly the rows a trim would remove. Skipping is always safe; the next quiet burst trims.
7. Debuggability: every trim appends a feed-debug record (kind: 'entries_trimmed', layer STATE) with trimmed/retained counts, the new marker, and the protection bound.
8. Ledger unchanged: adapter caches are keyed on the entries array reference — a trim mints a new array and costs exactly one clean recompute.

Part C — raw-payload compaction

• semantic.log entries no longer retain raw: ev by default (SemanticLogEntry.raw is now optional); feed-debug SEM entries store { eventType } instead of the entire semantic event (the summary field already carries the digest). Both capture raw only when semantic/rawCapture.ts is enabled, which rides the existing AGENT_CODE_DEV_DEBUG probe (App.tsx → getDevDebugConfig) — raw payloads are only readable through dev-debug surfaces, so capture and surface share one switch. No consumer reads .raw outside JSON-dumping debug exports, verified by grep.
• semantic.history turn block maps deliberately NOT compacted: they are paint inputs for the ledger's semantic-history plane, and compacting safely requires committed-suppression knowledge that lives in the decide layer. Decision recorded next to semanticHistoryRow in semantic/helpers.ts.

Verification

• npx tsc -b tsconfig.node.json — clean.
• npx tsc --noEmit -p tsconfig.web.json — clean (no TS6305/TS6307 either).
• NODE_ENV=test npx vitest run — 476 passed (467 on main + 9 new); the full rendering corpus (bundleCorpus, recordingCorpus, replay invariants: 18 files / 151 tests) green. The agent-voice-dictation hotkeyBinding suite failure is pre-existing on main.
• Tests extended in existing files only: session-runtime/entries.test.ts (trim planner constraint matrix + marker-rider invisibility) and useIpcSubscriptions.renderer.test.tsx (burst-handler trim wiring: window applied, totalEntries untouched, pagination re-anchored, entries_trimmed record, tail-replay dedupe).

Closes #375

🤖 Generated with Claude Code