perf(orchestration): bound in-memory read model and client per-thread state

[RusiruSadathana]

What Changed

Server: replaced the array-backed in-memory orchestration command read model with a HashMap-keyed CommandReadModel. Thread and project lookups and updates are now O(1) instead of O(N) linear scans plus full-array copies on every event, and deleted threads are evicted from the in-memory model (archived threads are retained because unarchive needs them and the projection cannot rehydrate them). The wire OrchestrationReadModel contract is unchanged; it is served by the DB-backed projection, which is untouched.

Web: wired the existing but previously uncalled per-thread cleanup into the thread deletion flow (preview state, right panel, diff panel, ui state), switched previewStateAtom from keepAlive to an idle TTL so idle preview atoms are collected, and made a released browser surface delete its entry instead of leaving a tombstone.

VCS: the VcsStatusBroadcaster per-cwd status cache is now pruned when the last poller subscriber releases, instead of growing for the process lifetime.

Added unit and integration coverage for the read model, projector eviction, decider behavior against a deleted thread, and the client store cleanup.

Why

After long uptime the server RSS and CPU climbed and the web UI became laggy. The cause was unbounded in-memory state on the single orchestration worker fiber (every event did O(N) work over a collection that never shed deleted or archived threads) compounded by client stores that accumulated one entry per thread ever visited and were never pruned on deletion. Making the hot-path structures O(1), evicting dead threads, and pruning the client and VCS caches removes the growth without changing any external contract or the projection that serves reads.

UI Changes

No visible UI changes. The web portion only prunes per-thread client state on deletion and adjusts atom retention; sidebar and panel behavior are unchanged.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (not applicable)
• I included a video for animation/interaction changes (not applicable)

Related Issues

Closes#4178.

---

Note

Medium Risk
Orchestration command-path behavior changes (deleted-thread eviction and id retention) affect invariant checks and decider/projector semantics; web/VCS changes are localized leak fixes with tests.

Overview
Addresses unbounded memory growth on long-running server and web sessions by changing how hot-path state is stored and when it is dropped.

Server orchestration introduces an internal CommandReadModel (HashMap/HashSet) for the serial command worker, replacing array scans on every event. thread.deletedevicts thread bodies from memory while deletedThreadIds preserves the “cannot create twice” invariant across restarts; boot seeds via fromWireReadModel with dropDeletedThreads: true. The wire OrchestrationReadModel and DB projection are unchanged.

Web wires per-thread cleanup into thread delete (preview, right panel, diff panel, UI state in localStorage), switches previewStateAtom from keepAlive to a 5-minute idle TTL, and removes browser surface entries on release instead of tombstones.

VCS evicts per-cwd cache when the last remote poller releases, fixing a race where concurrent retain/release could leave stale entries forever.

^{Reviewed by Cursor Bugbot for commit 56b6615. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bound in-memory orchestration read model and client per-thread state to prevent unbounded growth

• Replaces array-backed OrchestrationReadModel with a CommandReadModel backed by HashMap for O(1) lookups of threads and projects in commandReadModel.ts.
• Deleted threads are evicted from the in-memory projector state and their IDs tracked in a HashSet, preventing memory growth and blocking re-creation of deleted thread IDs.
• The VcsStatusBroadcaster now atomically evicts cached VCS status when the last subscriber releases a poller, closing a race condition.
• Deleting a thread in the client now clears its associated state across preview, right-panel, diff-panel, and UI stores in useThreadActions.ts.
• Idle per-thread preview atoms are evicted after 5 minutes via Atom.setIdleTTL instead of Atom.keepAlive.
• Behavioral Change: released browser surface store entries are deleted entirely rather than retained as tombstones with visible=false.

^{Macroscope summarized 56b6615.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 30f20953-b942-43f8-bcf8-3a2f69a5f75f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. Cross-cutting performance refactor affecting memory management in orchestration engine and multiple client stores. Unresolved review comments include a high-severity issue where the preview index keys may still grow unbounded despite the eviction changes.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

🟡 Medium

t3code/apps/web/src/browser/browserSurfaceStore.ts

Lines 104 to 120 in 56b6615

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current){
	return{
	byTabId: {
	...state.byTabId,
	[tabId]: {
	rect: null,
	visible: false,
	content,
	updatedAt: Date.now(),
	owner: null,
	},
	},
	};
	}

release deletes the entry from byTabId, but presentContent is owner-independent and recreates a { owner: null } entry whenever the entry is missing. If HostedBrowserWebview fires a scheduled layout or scroll update after the lease has released, presentContent resurrects the deleted entry, so released tabs still accumulate in byTabId — defeating the bounded-state goal of this change. Consider guarding presentContent so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new owner: null entry.

Suggested change

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current)returnstate;

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/web/src/browser/browserSurfaceStore.ts around lines 104-120:
`release` deletes the entry from `byTabId`, but `presentContent` is owner-independent and recreates a `{ owner: null }` entry whenever the entry is missing. If `HostedBrowserWebview` fires a scheduled layout or scroll update after the lease has released, `presentContent` resurrects the deleted entry, so released tabs still accumulate in `byTabId` — defeating the bounded-state goal of this change. Consider guarding `presentContent` so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new `owner: null` entry.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Idle preview TTL drops tab suppressions

Medium Severity

Introducing Atom.setIdleTTL on previewStateAtom causes client-only suppressedTabIds to be lost when a thread's preview state is evicted. This results in preview tabs that a user previously closed reappearing from the server list.

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Preview index keys never pruned

High Severity

activePreviewThreadKeysAtom is keepAlive and only updated via syncActivePreviewThread on explicit preview writes. When previewStateAtom idle TTL evicts a thread that still had sessions, the index entry is never removed, so the key set grows without bound and activePreviewSessionsAtom keeps scanning stale keys.

Additional Locations (1)

• apps/web/src/previewStateStore.ts#L93-L102

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[juliusmarminge]

Closing in favor of #2829 (orchestration V2).

#2829 deletes the V1 orchestration layer this PR builds on — apps/server/src/orchestration/**, provider/Layers/*Adapter.ts and provider/Services/** are removed and replaced by apps/server/src/orchestration-v2/**, with the IPC surface renamed to ORCHESTRATION_V2_WS_METHODS. The files this PR touches either no longer exist or are rewritten, so it can't be rebased — it would need reimplementing against the V2 adapters.

This is not a judgement on the change itself. Several of these are real gaps we still want fixed; the base just moved out from under them.

Once #2829 merges, please rebase onto main, port the change to the V2 equivalent, and reopen (or open a fresh PR). Ping me and I'll prioritise the review.

[RusiruSadathana]

What Changed

Server: replaced the array-backed in-memory orchestration command read model with a HashMap-keyed CommandReadModel. Thread and project lookups and updates are now O(1) instead of O(N) linear scans plus full-array copies on every event, and deleted threads are evicted from the in-memory model (archived threads are retained because unarchive needs them and the projection cannot rehydrate them). The wire OrchestrationReadModel contract is unchanged; it is served by the DB-backed projection, which is untouched.

Web: wired the existing but previously uncalled per-thread cleanup into the thread deletion flow (preview state, right panel, diff panel, ui state), switched previewStateAtom from keepAlive to an idle TTL so idle preview atoms are collected, and made a released browser surface delete its entry instead of leaving a tombstone.

VCS: the VcsStatusBroadcaster per-cwd status cache is now pruned when the last poller subscriber releases, instead of growing for the process lifetime.

Added unit and integration coverage for the read model, projector eviction, decider behavior against a deleted thread, and the client store cleanup.

Why

After long uptime the server RSS and CPU climbed and the web UI became laggy. The cause was unbounded in-memory state on the single orchestration worker fiber (every event did O(N) work over a collection that never shed deleted or archived threads) compounded by client stores that accumulated one entry per thread ever visited and were never pruned on deletion. Making the hot-path structures O(1), evicting dead threads, and pruning the client and VCS caches removes the growth without changing any external contract or the projection that serves reads.

UI Changes

No visible UI changes. The web portion only prunes per-thread client state on deletion and adjusts atom retention; sidebar and panel behavior are unchanged.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (not applicable)
• I included a video for animation/interaction changes (not applicable)

Related Issues

Closes#4178.

---

Note

Medium Risk
Orchestration command-path behavior changes (deleted-thread eviction and id retention) affect invariant checks and decider/projector semantics; web/VCS changes are localized leak fixes with tests.

Overview
Addresses unbounded memory growth on long-running server and web sessions by changing how hot-path state is stored and when it is dropped.

Server orchestration introduces an internal CommandReadModel (HashMap/HashSet) for the serial command worker, replacing array scans on every event. thread.deletedevicts thread bodies from memory while deletedThreadIds preserves the “cannot create twice” invariant across restarts; boot seeds via fromWireReadModel with dropDeletedThreads: true. The wire OrchestrationReadModel and DB projection are unchanged.

Web wires per-thread cleanup into thread delete (preview, right panel, diff panel, UI state in localStorage), switches previewStateAtom from keepAlive to a 5-minute idle TTL, and removes browser surface entries on release instead of tombstones.

VCS evicts per-cwd cache when the last remote poller releases, fixing a race where concurrent retain/release could leave stale entries forever.

^{Reviewed by Cursor Bugbot for commit 56b6615. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bound in-memory orchestration read model and client per-thread state to prevent unbounded growth

• Replaces array-backed OrchestrationReadModel with a CommandReadModel backed by HashMap for O(1) lookups of threads and projects in commandReadModel.ts.
• Deleted threads are evicted from the in-memory projector state and their IDs tracked in a HashSet, preventing memory growth and blocking re-creation of deleted thread IDs.
• The VcsStatusBroadcaster now atomically evicts cached VCS status when the last subscriber releases a poller, closing a race condition.
• Deleting a thread in the client now clears its associated state across preview, right-panel, diff-panel, and UI stores in useThreadActions.ts.
• Idle per-thread preview atoms are evicted after 5 minutes via Atom.setIdleTTL instead of Atom.keepAlive.
• Behavioral Change: released browser surface store entries are deleted entirely rather than retained as tombstones with visible=false.

^{Macroscope summarized 56b6615.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 30f20953-b942-43f8-bcf8-3a2f69a5f75f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. Cross-cutting performance refactor affecting memory management in orchestration engine and multiple client stores. Unresolved review comments include a high-severity issue where the preview index keys may still grow unbounded despite the eviction changes.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

🟡 Medium

t3code/apps/web/src/browser/browserSurfaceStore.ts

Lines 104 to 120 in 56b6615

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current){
	return{
	byTabId: {
	...state.byTabId,
	[tabId]: {
	rect: null,
	visible: false,
	content,
	updatedAt: Date.now(),
	owner: null,
	},
	},
	};
	}

release deletes the entry from byTabId, but presentContent is owner-independent and recreates a { owner: null } entry whenever the entry is missing. If HostedBrowserWebview fires a scheduled layout or scroll update after the lease has released, presentContent resurrects the deleted entry, so released tabs still accumulate in byTabId — defeating the bounded-state goal of this change. Consider guarding presentContent so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new owner: null entry.

Suggested change

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current)returnstate;

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/web/src/browser/browserSurfaceStore.ts around lines 104-120:
`release` deletes the entry from `byTabId`, but `presentContent` is owner-independent and recreates a `{ owner: null }` entry whenever the entry is missing. If `HostedBrowserWebview` fires a scheduled layout or scroll update after the lease has released, `presentContent` resurrects the deleted entry, so released tabs still accumulate in `byTabId` — defeating the bounded-state goal of this change. Consider guarding `presentContent` so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new `owner: null` entry.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Idle preview TTL drops tab suppressions

Medium Severity

Introducing Atom.setIdleTTL on previewStateAtom causes client-only suppressedTabIds to be lost when a thread's preview state is evicted. This results in preview tabs that a user previously closed reappearing from the server list.

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Preview index keys never pruned

High Severity

activePreviewThreadKeysAtom is keepAlive and only updated via syncActivePreviewThread on explicit preview writes. When previewStateAtom idle TTL evicts a thread that still had sessions, the index entry is never removed, so the key set grows without bound and activePreviewSessionsAtom keeps scanning stale keys.

Additional Locations (1)

• apps/web/src/previewStateStore.ts#L93-L102

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[juliusmarminge]

Closing in favor of #2829 (orchestration V2).

#2829 deletes the V1 orchestration layer this PR builds on — apps/server/src/orchestration/**, provider/Layers/*Adapter.ts and provider/Services/** are removed and replaced by apps/server/src/orchestration-v2/**, with the IPC surface renamed to ORCHESTRATION_V2_WS_METHODS. The files this PR touches either no longer exist or are rewritten, so it can't be rebased — it would need reimplementing against the V2 adapters.

This is not a judgement on the change itself. Several of these are real gaps we still want fixed; the base just moved out from under them.

Once #2829 merges, please rebase onto main, port the change to the V2 equivalent, and reopen (or open a fresh PR). Ping me and I'll prioritise the review.

[RusiruSadathana]

What Changed

Server: replaced the array-backed in-memory orchestration command read model with a HashMap-keyed CommandReadModel. Thread and project lookups and updates are now O(1) instead of O(N) linear scans plus full-array copies on every event, and deleted threads are evicted from the in-memory model (archived threads are retained because unarchive needs them and the projection cannot rehydrate them). The wire OrchestrationReadModel contract is unchanged; it is served by the DB-backed projection, which is untouched.

Web: wired the existing but previously uncalled per-thread cleanup into the thread deletion flow (preview state, right panel, diff panel, ui state), switched previewStateAtom from keepAlive to an idle TTL so idle preview atoms are collected, and made a released browser surface delete its entry instead of leaving a tombstone.

VCS: the VcsStatusBroadcaster per-cwd status cache is now pruned when the last poller subscriber releases, instead of growing for the process lifetime.

Added unit and integration coverage for the read model, projector eviction, decider behavior against a deleted thread, and the client store cleanup.

Why

After long uptime the server RSS and CPU climbed and the web UI became laggy. The cause was unbounded in-memory state on the single orchestration worker fiber (every event did O(N) work over a collection that never shed deleted or archived threads) compounded by client stores that accumulated one entry per thread ever visited and were never pruned on deletion. Making the hot-path structures O(1), evicting dead threads, and pruning the client and VCS caches removes the growth without changing any external contract or the projection that serves reads.

UI Changes

No visible UI changes. The web portion only prunes per-thread client state on deletion and adjusts atom retention; sidebar and panel behavior are unchanged.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (not applicable)
• I included a video for animation/interaction changes (not applicable)

Related Issues

Closes#4178.

---

Note

Medium Risk
Orchestration command-path behavior changes (deleted-thread eviction and id retention) affect invariant checks and decider/projector semantics; web/VCS changes are localized leak fixes with tests.

Overview
Addresses unbounded memory growth on long-running server and web sessions by changing how hot-path state is stored and when it is dropped.

Server orchestration introduces an internal CommandReadModel (HashMap/HashSet) for the serial command worker, replacing array scans on every event. thread.deletedevicts thread bodies from memory while deletedThreadIds preserves the “cannot create twice” invariant across restarts; boot seeds via fromWireReadModel with dropDeletedThreads: true. The wire OrchestrationReadModel and DB projection are unchanged.

Web wires per-thread cleanup into thread delete (preview, right panel, diff panel, UI state in localStorage), switches previewStateAtom from keepAlive to a 5-minute idle TTL, and removes browser surface entries on release instead of tombstones.

VCS evicts per-cwd cache when the last remote poller releases, fixing a race where concurrent retain/release could leave stale entries forever.

^{Reviewed by Cursor Bugbot for commit 56b6615. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bound in-memory orchestration read model and client per-thread state to prevent unbounded growth

• Replaces array-backed OrchestrationReadModel with a CommandReadModel backed by HashMap for O(1) lookups of threads and projects in commandReadModel.ts.
• Deleted threads are evicted from the in-memory projector state and their IDs tracked in a HashSet, preventing memory growth and blocking re-creation of deleted thread IDs.
• The VcsStatusBroadcaster now atomically evicts cached VCS status when the last subscriber releases a poller, closing a race condition.
• Deleting a thread in the client now clears its associated state across preview, right-panel, diff-panel, and UI stores in useThreadActions.ts.
• Idle per-thread preview atoms are evicted after 5 minutes via Atom.setIdleTTL instead of Atom.keepAlive.
• Behavioral Change: released browser surface store entries are deleted entirely rather than retained as tombstones with visible=false.

^{Macroscope summarized 56b6615.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 30f20953-b942-43f8-bcf8-3a2f69a5f75f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. Cross-cutting performance refactor affecting memory management in orchestration engine and multiple client stores. Unresolved review comments include a high-severity issue where the preview index keys may still grow unbounded despite the eviction changes.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

🟡 Medium

t3code/apps/web/src/browser/browserSurfaceStore.ts

Lines 104 to 120 in 56b6615

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current){
	return{
	byTabId: {
	...state.byTabId,
	[tabId]: {
	rect: null,
	visible: false,
	content,
	updatedAt: Date.now(),
	owner: null,
	},
	},
	};
	}

release deletes the entry from byTabId, but presentContent is owner-independent and recreates a { owner: null } entry whenever the entry is missing. If HostedBrowserWebview fires a scheduled layout or scroll update after the lease has released, presentContent resurrects the deleted entry, so released tabs still accumulate in byTabId — defeating the bounded-state goal of this change. Consider guarding presentContent so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new owner: null entry.

Suggested change

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current)returnstate;

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/web/src/browser/browserSurfaceStore.ts around lines 104-120:
`release` deletes the entry from `byTabId`, but `presentContent` is owner-independent and recreates a `{ owner: null }` entry whenever the entry is missing. If `HostedBrowserWebview` fires a scheduled layout or scroll update after the lease has released, `presentContent` resurrects the deleted entry, so released tabs still accumulate in `byTabId` — defeating the bounded-state goal of this change. Consider guarding `presentContent` so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new `owner: null` entry.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Idle preview TTL drops tab suppressions

Medium Severity

Introducing Atom.setIdleTTL on previewStateAtom causes client-only suppressedTabIds to be lost when a thread's preview state is evicted. This results in preview tabs that a user previously closed reappearing from the server list.

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Preview index keys never pruned

High Severity

activePreviewThreadKeysAtom is keepAlive and only updated via syncActivePreviewThread on explicit preview writes. When previewStateAtom idle TTL evicts a thread that still had sessions, the index entry is never removed, so the key set grows without bound and activePreviewSessionsAtom keeps scanning stale keys.

Additional Locations (1)

• apps/web/src/previewStateStore.ts#L93-L102

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[juliusmarminge]

Closing in favor of #2829 (orchestration V2).

#2829 deletes the V1 orchestration layer this PR builds on — apps/server/src/orchestration/**, provider/Layers/*Adapter.ts and provider/Services/** are removed and replaced by apps/server/src/orchestration-v2/**, with the IPC surface renamed to ORCHESTRATION_V2_WS_METHODS. The files this PR touches either no longer exist or are rewritten, so it can't be rebased — it would need reimplementing against the V2 adapters.

This is not a judgement on the change itself. Several of these are real gaps we still want fixed; the base just moved out from under them.

Once #2829 merges, please rebase onto main, port the change to the V2 equivalent, and reopen (or open a fresh PR). Ping me and I'll prioritise the review.

[RusiruSadathana]

What Changed

Server: replaced the array-backed in-memory orchestration command read model with a HashMap-keyed CommandReadModel. Thread and project lookups and updates are now O(1) instead of O(N) linear scans plus full-array copies on every event, and deleted threads are evicted from the in-memory model (archived threads are retained because unarchive needs them and the projection cannot rehydrate them). The wire OrchestrationReadModel contract is unchanged; it is served by the DB-backed projection, which is untouched.

Web: wired the existing but previously uncalled per-thread cleanup into the thread deletion flow (preview state, right panel, diff panel, ui state), switched previewStateAtom from keepAlive to an idle TTL so idle preview atoms are collected, and made a released browser surface delete its entry instead of leaving a tombstone.

VCS: the VcsStatusBroadcaster per-cwd status cache is now pruned when the last poller subscriber releases, instead of growing for the process lifetime.

Added unit and integration coverage for the read model, projector eviction, decider behavior against a deleted thread, and the client store cleanup.

Why

After long uptime the server RSS and CPU climbed and the web UI became laggy. The cause was unbounded in-memory state on the single orchestration worker fiber (every event did O(N) work over a collection that never shed deleted or archived threads) compounded by client stores that accumulated one entry per thread ever visited and were never pruned on deletion. Making the hot-path structures O(1), evicting dead threads, and pruning the client and VCS caches removes the growth without changing any external contract or the projection that serves reads.

UI Changes

No visible UI changes. The web portion only prunes per-thread client state on deletion and adjusts atom retention; sidebar and panel behavior are unchanged.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (not applicable)
• I included a video for animation/interaction changes (not applicable)

Related Issues

Closes#4178.

---

Note

Medium Risk
Orchestration command-path behavior changes (deleted-thread eviction and id retention) affect invariant checks and decider/projector semantics; web/VCS changes are localized leak fixes with tests.

Overview
Addresses unbounded memory growth on long-running server and web sessions by changing how hot-path state is stored and when it is dropped.

Server orchestration introduces an internal CommandReadModel (HashMap/HashSet) for the serial command worker, replacing array scans on every event. thread.deletedevicts thread bodies from memory while deletedThreadIds preserves the “cannot create twice” invariant across restarts; boot seeds via fromWireReadModel with dropDeletedThreads: true. The wire OrchestrationReadModel and DB projection are unchanged.

Web wires per-thread cleanup into thread delete (preview, right panel, diff panel, UI state in localStorage), switches previewStateAtom from keepAlive to a 5-minute idle TTL, and removes browser surface entries on release instead of tombstones.

VCS evicts per-cwd cache when the last remote poller releases, fixing a race where concurrent retain/release could leave stale entries forever.

^{Reviewed by Cursor Bugbot for commit 56b6615. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bound in-memory orchestration read model and client per-thread state to prevent unbounded growth

• Replaces array-backed OrchestrationReadModel with a CommandReadModel backed by HashMap for O(1) lookups of threads and projects in commandReadModel.ts.
• Deleted threads are evicted from the in-memory projector state and their IDs tracked in a HashSet, preventing memory growth and blocking re-creation of deleted thread IDs.
• The VcsStatusBroadcaster now atomically evicts cached VCS status when the last subscriber releases a poller, closing a race condition.
• Deleting a thread in the client now clears its associated state across preview, right-panel, diff-panel, and UI stores in useThreadActions.ts.
• Idle per-thread preview atoms are evicted after 5 minutes via Atom.setIdleTTL instead of Atom.keepAlive.
• Behavioral Change: released browser surface store entries are deleted entirely rather than retained as tombstones with visible=false.

^{Macroscope summarized 56b6615.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 30f20953-b942-43f8-bcf8-3a2f69a5f75f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. Cross-cutting performance refactor affecting memory management in orchestration engine and multiple client stores. Unresolved review comments include a high-severity issue where the preview index keys may still grow unbounded despite the eviction changes.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

🟡 Medium

t3code/apps/web/src/browser/browserSurfaceStore.ts

Lines 104 to 120 in 56b6615

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current){
	return{
	byTabId: {
	...state.byTabId,
	[tabId]: {
	rect: null,
	visible: false,
	content,
	updatedAt: Date.now(),
	owner: null,
	},
	},
	};
	}

release deletes the entry from byTabId, but presentContent is owner-independent and recreates a { owner: null } entry whenever the entry is missing. If HostedBrowserWebview fires a scheduled layout or scroll update after the lease has released, presentContent resurrects the deleted entry, so released tabs still accumulate in byTabId — defeating the bounded-state goal of this change. Consider guarding presentContent so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new owner: null entry.

Suggested change

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current)returnstate;

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/web/src/browser/browserSurfaceStore.ts around lines 104-120:
`release` deletes the entry from `byTabId`, but `presentContent` is owner-independent and recreates a `{ owner: null }` entry whenever the entry is missing. If `HostedBrowserWebview` fires a scheduled layout or scroll update after the lease has released, `presentContent` resurrects the deleted entry, so released tabs still accumulate in `byTabId` — defeating the bounded-state goal of this change. Consider guarding `presentContent` so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new `owner: null` entry.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Idle preview TTL drops tab suppressions

Medium Severity

Introducing Atom.setIdleTTL on previewStateAtom causes client-only suppressedTabIds to be lost when a thread's preview state is evicted. This results in preview tabs that a user previously closed reappearing from the server list.

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Preview index keys never pruned

High Severity

activePreviewThreadKeysAtom is keepAlive and only updated via syncActivePreviewThread on explicit preview writes. When previewStateAtom idle TTL evicts a thread that still had sessions, the index entry is never removed, so the key set grows without bound and activePreviewSessionsAtom keeps scanning stale keys.

Additional Locations (1)

• apps/web/src/previewStateStore.ts#L93-L102

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[juliusmarminge]

Closing in favor of #2829 (orchestration V2).

#2829 deletes the V1 orchestration layer this PR builds on — apps/server/src/orchestration/**, provider/Layers/*Adapter.ts and provider/Services/** are removed and replaced by apps/server/src/orchestration-v2/**, with the IPC surface renamed to ORCHESTRATION_V2_WS_METHODS. The files this PR touches either no longer exist or are rewritten, so it can't be rebased — it would need reimplementing against the V2 adapters.

This is not a judgement on the change itself. Several of these are real gaps we still want fixed; the base just moved out from under them.

Once #2829 merges, please rebase onto main, port the change to the V2 equivalent, and reopen (or open a fresh PR). Ping me and I'll prioritise the review.

[RusiruSadathana]

What Changed

Server: replaced the array-backed in-memory orchestration command read model with a HashMap-keyed CommandReadModel. Thread and project lookups and updates are now O(1) instead of O(N) linear scans plus full-array copies on every event, and deleted threads are evicted from the in-memory model (archived threads are retained because unarchive needs them and the projection cannot rehydrate them). The wire OrchestrationReadModel contract is unchanged; it is served by the DB-backed projection, which is untouched.

Web: wired the existing but previously uncalled per-thread cleanup into the thread deletion flow (preview state, right panel, diff panel, ui state), switched previewStateAtom from keepAlive to an idle TTL so idle preview atoms are collected, and made a released browser surface delete its entry instead of leaving a tombstone.

VCS: the VcsStatusBroadcaster per-cwd status cache is now pruned when the last poller subscriber releases, instead of growing for the process lifetime.

Added unit and integration coverage for the read model, projector eviction, decider behavior against a deleted thread, and the client store cleanup.

Why

After long uptime the server RSS and CPU climbed and the web UI became laggy. The cause was unbounded in-memory state on the single orchestration worker fiber (every event did O(N) work over a collection that never shed deleted or archived threads) compounded by client stores that accumulated one entry per thread ever visited and were never pruned on deletion. Making the hot-path structures O(1), evicting dead threads, and pruning the client and VCS caches removes the growth without changing any external contract or the projection that serves reads.

UI Changes

No visible UI changes. The web portion only prunes per-thread client state on deletion and adjusts atom retention; sidebar and panel behavior are unchanged.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (not applicable)
• I included a video for animation/interaction changes (not applicable)

Related Issues

Closes#4178.

---

Note

Medium Risk
Orchestration command-path behavior changes (deleted-thread eviction and id retention) affect invariant checks and decider/projector semantics; web/VCS changes are localized leak fixes with tests.

Overview
Addresses unbounded memory growth on long-running server and web sessions by changing how hot-path state is stored and when it is dropped.

Server orchestration introduces an internal CommandReadModel (HashMap/HashSet) for the serial command worker, replacing array scans on every event. thread.deletedevicts thread bodies from memory while deletedThreadIds preserves the “cannot create twice” invariant across restarts; boot seeds via fromWireReadModel with dropDeletedThreads: true. The wire OrchestrationReadModel and DB projection are unchanged.

Web wires per-thread cleanup into thread delete (preview, right panel, diff panel, UI state in localStorage), switches previewStateAtom from keepAlive to a 5-minute idle TTL, and removes browser surface entries on release instead of tombstones.

VCS evicts per-cwd cache when the last remote poller releases, fixing a race where concurrent retain/release could leave stale entries forever.

^{Reviewed by Cursor Bugbot for commit 56b6615. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bound in-memory orchestration read model and client per-thread state to prevent unbounded growth

• Replaces array-backed OrchestrationReadModel with a CommandReadModel backed by HashMap for O(1) lookups of threads and projects in commandReadModel.ts.
• Deleted threads are evicted from the in-memory projector state and their IDs tracked in a HashSet, preventing memory growth and blocking re-creation of deleted thread IDs.
• The VcsStatusBroadcaster now atomically evicts cached VCS status when the last subscriber releases a poller, closing a race condition.
• Deleting a thread in the client now clears its associated state across preview, right-panel, diff-panel, and UI stores in useThreadActions.ts.
• Idle per-thread preview atoms are evicted after 5 minutes via Atom.setIdleTTL instead of Atom.keepAlive.
• Behavioral Change: released browser surface store entries are deleted entirely rather than retained as tombstones with visible=false.

^{Macroscope summarized 56b6615.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 30f20953-b942-43f8-bcf8-3a2f69a5f75f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. Cross-cutting performance refactor affecting memory management in orchestration engine and multiple client stores. Unresolved review comments include a high-severity issue where the preview index keys may still grow unbounded despite the eviction changes.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

🟡 Medium

t3code/apps/web/src/browser/browserSurfaceStore.ts

Lines 104 to 120 in 56b6615

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current){
	return{
	byTabId: {
	...state.byTabId,
	[tabId]: {
	rect: null,
	visible: false,
	content,
	updatedAt: Date.now(),
	owner: null,
	},
	},
	};
	}

release deletes the entry from byTabId, but presentContent is owner-independent and recreates a { owner: null } entry whenever the entry is missing. If HostedBrowserWebview fires a scheduled layout or scroll update after the lease has released, presentContent resurrects the deleted entry, so released tabs still accumulate in byTabId — defeating the bounded-state goal of this change. Consider guarding presentContent so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new owner: null entry.

Suggested change

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current)returnstate;

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/web/src/browser/browserSurfaceStore.ts around lines 104-120:
`release` deletes the entry from `byTabId`, but `presentContent` is owner-independent and recreates a `{ owner: null }` entry whenever the entry is missing. If `HostedBrowserWebview` fires a scheduled layout or scroll update after the lease has released, `presentContent` resurrects the deleted entry, so released tabs still accumulate in `byTabId` — defeating the bounded-state goal of this change. Consider guarding `presentContent` so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new `owner: null` entry.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Idle preview TTL drops tab suppressions

Medium Severity

Introducing Atom.setIdleTTL on previewStateAtom causes client-only suppressedTabIds to be lost when a thread's preview state is evicted. This results in preview tabs that a user previously closed reappearing from the server list.

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Preview index keys never pruned

High Severity

activePreviewThreadKeysAtom is keepAlive and only updated via syncActivePreviewThread on explicit preview writes. When previewStateAtom idle TTL evicts a thread that still had sessions, the index entry is never removed, so the key set grows without bound and activePreviewSessionsAtom keeps scanning stale keys.

Additional Locations (1)

• apps/web/src/previewStateStore.ts#L93-L102

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[juliusmarminge]

Closing in favor of #2829 (orchestration V2).

#2829 deletes the V1 orchestration layer this PR builds on — apps/server/src/orchestration/**, provider/Layers/*Adapter.ts and provider/Services/** are removed and replaced by apps/server/src/orchestration-v2/**, with the IPC surface renamed to ORCHESTRATION_V2_WS_METHODS. The files this PR touches either no longer exist or are rewritten, so it can't be rebased — it would need reimplementing against the V2 adapters.

This is not a judgement on the change itself. Several of these are real gaps we still want fixed; the base just moved out from under them.

Once #2829 merges, please rebase onto main, port the change to the V2 equivalent, and reopen (or open a fresh PR). Ping me and I'll prioritise the review.

[RusiruSadathana]

What Changed

Server: replaced the array-backed in-memory orchestration command read model with a HashMap-keyed CommandReadModel. Thread and project lookups and updates are now O(1) instead of O(N) linear scans plus full-array copies on every event, and deleted threads are evicted from the in-memory model (archived threads are retained because unarchive needs them and the projection cannot rehydrate them). The wire OrchestrationReadModel contract is unchanged; it is served by the DB-backed projection, which is untouched.

Web: wired the existing but previously uncalled per-thread cleanup into the thread deletion flow (preview state, right panel, diff panel, ui state), switched previewStateAtom from keepAlive to an idle TTL so idle preview atoms are collected, and made a released browser surface delete its entry instead of leaving a tombstone.

VCS: the VcsStatusBroadcaster per-cwd status cache is now pruned when the last poller subscriber releases, instead of growing for the process lifetime.

Added unit and integration coverage for the read model, projector eviction, decider behavior against a deleted thread, and the client store cleanup.

Why

After long uptime the server RSS and CPU climbed and the web UI became laggy. The cause was unbounded in-memory state on the single orchestration worker fiber (every event did O(N) work over a collection that never shed deleted or archived threads) compounded by client stores that accumulated one entry per thread ever visited and were never pruned on deletion. Making the hot-path structures O(1), evicting dead threads, and pruning the client and VCS caches removes the growth without changing any external contract or the projection that serves reads.

UI Changes

No visible UI changes. The web portion only prunes per-thread client state on deletion and adjusts atom retention; sidebar and panel behavior are unchanged.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (not applicable)
• I included a video for animation/interaction changes (not applicable)

Related Issues

Closes#4178.

---

Note

Medium Risk
Orchestration command-path behavior changes (deleted-thread eviction and id retention) affect invariant checks and decider/projector semantics; web/VCS changes are localized leak fixes with tests.

Overview
Addresses unbounded memory growth on long-running server and web sessions by changing how hot-path state is stored and when it is dropped.

Server orchestration introduces an internal CommandReadModel (HashMap/HashSet) for the serial command worker, replacing array scans on every event. thread.deletedevicts thread bodies from memory while deletedThreadIds preserves the “cannot create twice” invariant across restarts; boot seeds via fromWireReadModel with dropDeletedThreads: true. The wire OrchestrationReadModel and DB projection are unchanged.

Web wires per-thread cleanup into thread delete (preview, right panel, diff panel, UI state in localStorage), switches previewStateAtom from keepAlive to a 5-minute idle TTL, and removes browser surface entries on release instead of tombstones.

VCS evicts per-cwd cache when the last remote poller releases, fixing a race where concurrent retain/release could leave stale entries forever.

^{Reviewed by Cursor Bugbot for commit 56b6615. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bound in-memory orchestration read model and client per-thread state to prevent unbounded growth

• Replaces array-backed OrchestrationReadModel with a CommandReadModel backed by HashMap for O(1) lookups of threads and projects in commandReadModel.ts.
• Deleted threads are evicted from the in-memory projector state and their IDs tracked in a HashSet, preventing memory growth and blocking re-creation of deleted thread IDs.
• The VcsStatusBroadcaster now atomically evicts cached VCS status when the last subscriber releases a poller, closing a race condition.
• Deleting a thread in the client now clears its associated state across preview, right-panel, diff-panel, and UI stores in useThreadActions.ts.
• Idle per-thread preview atoms are evicted after 5 minutes via Atom.setIdleTTL instead of Atom.keepAlive.
• Behavioral Change: released browser surface store entries are deleted entirely rather than retained as tombstones with visible=false.

^{Macroscope summarized 56b6615.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 30f20953-b942-43f8-bcf8-3a2f69a5f75f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. Cross-cutting performance refactor affecting memory management in orchestration engine and multiple client stores. Unresolved review comments include a high-severity issue where the preview index keys may still grow unbounded despite the eviction changes.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

🟡 Medium

t3code/apps/web/src/browser/browserSurfaceStore.ts

Lines 104 to 120 in 56b6615

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current){
	return{
	byTabId: {
	...state.byTabId,
	[tabId]: {
	rect: null,
	visible: false,
	content,
	updatedAt: Date.now(),
	owner: null,
	},
	},
	};
	}

release deletes the entry from byTabId, but presentContent is owner-independent and recreates a { owner: null } entry whenever the entry is missing. If HostedBrowserWebview fires a scheduled layout or scroll update after the lease has released, presentContent resurrects the deleted entry, so released tabs still accumulate in byTabId — defeating the bounded-state goal of this change. Consider guarding presentContent so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new owner: null entry.

Suggested change

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current)returnstate;

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/web/src/browser/browserSurfaceStore.ts around lines 104-120:
`release` deletes the entry from `byTabId`, but `presentContent` is owner-independent and recreates a `{ owner: null }` entry whenever the entry is missing. If `HostedBrowserWebview` fires a scheduled layout or scroll update after the lease has released, `presentContent` resurrects the deleted entry, so released tabs still accumulate in `byTabId` — defeating the bounded-state goal of this change. Consider guarding `presentContent` so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new `owner: null` entry.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Idle preview TTL drops tab suppressions

Medium Severity

Introducing Atom.setIdleTTL on previewStateAtom causes client-only suppressedTabIds to be lost when a thread's preview state is evicted. This results in preview tabs that a user previously closed reappearing from the server list.

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Preview index keys never pruned

High Severity

activePreviewThreadKeysAtom is keepAlive and only updated via syncActivePreviewThread on explicit preview writes. When previewStateAtom idle TTL evicts a thread that still had sessions, the index entry is never removed, so the key set grows without bound and activePreviewSessionsAtom keeps scanning stale keys.

Additional Locations (1)

• apps/web/src/previewStateStore.ts#L93-L102

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[juliusmarminge]

Closing in favor of #2829 (orchestration V2).

#2829 deletes the V1 orchestration layer this PR builds on — apps/server/src/orchestration/**, provider/Layers/*Adapter.ts and provider/Services/** are removed and replaced by apps/server/src/orchestration-v2/**, with the IPC surface renamed to ORCHESTRATION_V2_WS_METHODS. The files this PR touches either no longer exist or are rewritten, so it can't be rebased — it would need reimplementing against the V2 adapters.

This is not a judgement on the change itself. Several of these are real gaps we still want fixed; the base just moved out from under them.

Once #2829 merges, please rebase onto main, port the change to the V2 equivalent, and reopen (or open a fresh PR). Ping me and I'll prioritise the review.

[RusiruSadathana]

What Changed

Server: replaced the array-backed in-memory orchestration command read model with a HashMap-keyed CommandReadModel. Thread and project lookups and updates are now O(1) instead of O(N) linear scans plus full-array copies on every event, and deleted threads are evicted from the in-memory model (archived threads are retained because unarchive needs them and the projection cannot rehydrate them). The wire OrchestrationReadModel contract is unchanged; it is served by the DB-backed projection, which is untouched.

Web: wired the existing but previously uncalled per-thread cleanup into the thread deletion flow (preview state, right panel, diff panel, ui state), switched previewStateAtom from keepAlive to an idle TTL so idle preview atoms are collected, and made a released browser surface delete its entry instead of leaving a tombstone.

VCS: the VcsStatusBroadcaster per-cwd status cache is now pruned when the last poller subscriber releases, instead of growing for the process lifetime.

Added unit and integration coverage for the read model, projector eviction, decider behavior against a deleted thread, and the client store cleanup.

Why

After long uptime the server RSS and CPU climbed and the web UI became laggy. The cause was unbounded in-memory state on the single orchestration worker fiber (every event did O(N) work over a collection that never shed deleted or archived threads) compounded by client stores that accumulated one entry per thread ever visited and were never pruned on deletion. Making the hot-path structures O(1), evicting dead threads, and pruning the client and VCS caches removes the growth without changing any external contract or the projection that serves reads.

UI Changes

No visible UI changes. The web portion only prunes per-thread client state on deletion and adjusts atom retention; sidebar and panel behavior are unchanged.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (not applicable)
• I included a video for animation/interaction changes (not applicable)

Related Issues

Closes#4178.

---

Note

Medium Risk
Orchestration command-path behavior changes (deleted-thread eviction and id retention) affect invariant checks and decider/projector semantics; web/VCS changes are localized leak fixes with tests.

Overview
Addresses unbounded memory growth on long-running server and web sessions by changing how hot-path state is stored and when it is dropped.

Server orchestration introduces an internal CommandReadModel (HashMap/HashSet) for the serial command worker, replacing array scans on every event. thread.deletedevicts thread bodies from memory while deletedThreadIds preserves the “cannot create twice” invariant across restarts; boot seeds via fromWireReadModel with dropDeletedThreads: true. The wire OrchestrationReadModel and DB projection are unchanged.

Web wires per-thread cleanup into thread delete (preview, right panel, diff panel, UI state in localStorage), switches previewStateAtom from keepAlive to a 5-minute idle TTL, and removes browser surface entries on release instead of tombstones.

VCS evicts per-cwd cache when the last remote poller releases, fixing a race where concurrent retain/release could leave stale entries forever.

^{Reviewed by Cursor Bugbot for commit 56b6615. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bound in-memory orchestration read model and client per-thread state to prevent unbounded growth

• Replaces array-backed OrchestrationReadModel with a CommandReadModel backed by HashMap for O(1) lookups of threads and projects in commandReadModel.ts.
• Deleted threads are evicted from the in-memory projector state and their IDs tracked in a HashSet, preventing memory growth and blocking re-creation of deleted thread IDs.
• The VcsStatusBroadcaster now atomically evicts cached VCS status when the last subscriber releases a poller, closing a race condition.
• Deleting a thread in the client now clears its associated state across preview, right-panel, diff-panel, and UI stores in useThreadActions.ts.
• Idle per-thread preview atoms are evicted after 5 minutes via Atom.setIdleTTL instead of Atom.keepAlive.
• Behavioral Change: released browser surface store entries are deleted entirely rather than retained as tombstones with visible=false.

^{Macroscope summarized 56b6615.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 30f20953-b942-43f8-bcf8-3a2f69a5f75f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. Cross-cutting performance refactor affecting memory management in orchestration engine and multiple client stores. Unresolved review comments include a high-severity issue where the preview index keys may still grow unbounded despite the eviction changes.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

🟡 Medium

t3code/apps/web/src/browser/browserSurfaceStore.ts

Lines 104 to 120 in 56b6615

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current){
	return{
	byTabId: {
	...state.byTabId,
	[tabId]: {
	rect: null,
	visible: false,
	content,
	updatedAt: Date.now(),
	owner: null,
	},
	},
	};
	}

release deletes the entry from byTabId, but presentContent is owner-independent and recreates a { owner: null } entry whenever the entry is missing. If HostedBrowserWebview fires a scheduled layout or scroll update after the lease has released, presentContent resurrects the deleted entry, so released tabs still accumulate in byTabId — defeating the bounded-state goal of this change. Consider guarding presentContent so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new owner: null entry.

Suggested change

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current)returnstate;

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/web/src/browser/browserSurfaceStore.ts around lines 104-120:
`release` deletes the entry from `byTabId`, but `presentContent` is owner-independent and recreates a `{ owner: null }` entry whenever the entry is missing. If `HostedBrowserWebview` fires a scheduled layout or scroll update after the lease has released, `presentContent` resurrects the deleted entry, so released tabs still accumulate in `byTabId` — defeating the bounded-state goal of this change. Consider guarding `presentContent` so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new `owner: null` entry.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Idle preview TTL drops tab suppressions

Medium Severity

Introducing Atom.setIdleTTL on previewStateAtom causes client-only suppressedTabIds to be lost when a thread's preview state is evicted. This results in preview tabs that a user previously closed reappearing from the server list.

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Preview index keys never pruned

High Severity

activePreviewThreadKeysAtom is keepAlive and only updated via syncActivePreviewThread on explicit preview writes. When previewStateAtom idle TTL evicts a thread that still had sessions, the index entry is never removed, so the key set grows without bound and activePreviewSessionsAtom keeps scanning stale keys.

Additional Locations (1)

• apps/web/src/previewStateStore.ts#L93-L102

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[juliusmarminge]

Closing in favor of #2829 (orchestration V2).

#2829 deletes the V1 orchestration layer this PR builds on — apps/server/src/orchestration/**, provider/Layers/*Adapter.ts and provider/Services/** are removed and replaced by apps/server/src/orchestration-v2/**, with the IPC surface renamed to ORCHESTRATION_V2_WS_METHODS. The files this PR touches either no longer exist or are rewritten, so it can't be rebased — it would need reimplementing against the V2 adapters.

This is not a judgement on the change itself. Several of these are real gaps we still want fixed; the base just moved out from under them.

Once #2829 merges, please rebase onto main, port the change to the V2 equivalent, and reopen (or open a fresh PR). Ping me and I'll prioritise the review.

[RusiruSadathana]

What Changed

Server: replaced the array-backed in-memory orchestration command read model with a HashMap-keyed CommandReadModel. Thread and project lookups and updates are now O(1) instead of O(N) linear scans plus full-array copies on every event, and deleted threads are evicted from the in-memory model (archived threads are retained because unarchive needs them and the projection cannot rehydrate them). The wire OrchestrationReadModel contract is unchanged; it is served by the DB-backed projection, which is untouched.

Web: wired the existing but previously uncalled per-thread cleanup into the thread deletion flow (preview state, right panel, diff panel, ui state), switched previewStateAtom from keepAlive to an idle TTL so idle preview atoms are collected, and made a released browser surface delete its entry instead of leaving a tombstone.

VCS: the VcsStatusBroadcaster per-cwd status cache is now pruned when the last poller subscriber releases, instead of growing for the process lifetime.

Added unit and integration coverage for the read model, projector eviction, decider behavior against a deleted thread, and the client store cleanup.

Why

After long uptime the server RSS and CPU climbed and the web UI became laggy. The cause was unbounded in-memory state on the single orchestration worker fiber (every event did O(N) work over a collection that never shed deleted or archived threads) compounded by client stores that accumulated one entry per thread ever visited and were never pruned on deletion. Making the hot-path structures O(1), evicting dead threads, and pruning the client and VCS caches removes the growth without changing any external contract or the projection that serves reads.

UI Changes

No visible UI changes. The web portion only prunes per-thread client state on deletion and adjusts atom retention; sidebar and panel behavior are unchanged.

Checklist

• This PR is small and focused
• I explained what changed and why
• I included before/after screenshots for any UI changes (not applicable)
• I included a video for animation/interaction changes (not applicable)

Related Issues

Closes#4178.

---

Note

Medium Risk
Orchestration command-path behavior changes (deleted-thread eviction and id retention) affect invariant checks and decider/projector semantics; web/VCS changes are localized leak fixes with tests.

Overview
Addresses unbounded memory growth on long-running server and web sessions by changing how hot-path state is stored and when it is dropped.

Server orchestration introduces an internal CommandReadModel (HashMap/HashSet) for the serial command worker, replacing array scans on every event. thread.deletedevicts thread bodies from memory while deletedThreadIds preserves the “cannot create twice” invariant across restarts; boot seeds via fromWireReadModel with dropDeletedThreads: true. The wire OrchestrationReadModel and DB projection are unchanged.

Web wires per-thread cleanup into thread delete (preview, right panel, diff panel, UI state in localStorage), switches previewStateAtom from keepAlive to a 5-minute idle TTL, and removes browser surface entries on release instead of tombstones.

VCS evicts per-cwd cache when the last remote poller releases, fixing a race where concurrent retain/release could leave stale entries forever.

^{Reviewed by Cursor Bugbot for commit 56b6615. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Bound in-memory orchestration read model and client per-thread state to prevent unbounded growth

• Replaces array-backed OrchestrationReadModel with a CommandReadModel backed by HashMap for O(1) lookups of threads and projects in commandReadModel.ts.
• Deleted threads are evicted from the in-memory projector state and their IDs tracked in a HashSet, preventing memory growth and blocking re-creation of deleted thread IDs.
• The VcsStatusBroadcaster now atomically evicts cached VCS status when the last subscriber releases a poller, closing a race condition.
• Deleting a thread in the client now clears its associated state across preview, right-panel, diff-panel, and UI stores in useThreadActions.ts.
• Idle per-thread preview atoms are evicted after 5 minutes via Atom.setIdleTTL instead of Atom.keepAlive.
• Behavioral Change: released browser surface store entries are deleted entirely rather than retained as tombstones with visible=false.

^{Macroscope summarized 56b6615.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 30f20953-b942-43f8-bcf8-3a2f69a5f75f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Needs human review

1 blocking correctness issue found. Cross-cutting performance refactor affecting memory management in orchestration engine and multiple client stores. Unresolved review comments include a high-severity issue where the preview index keys may still grow unbounded despite the eviction changes.

^{You can customize Macroscope's approvability policy. Learn more.}

[macroscopeapp]

🟡 Medium

t3code/apps/web/src/browser/browserSurfaceStore.ts

Lines 104 to 120 in 56b6615

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current){
	return{
	byTabId: {
	...state.byTabId,
	[tabId]: {
	rect: null,
	visible: false,
	content,
	updatedAt: Date.now(),
	owner: null,
	},
	},
	};
	}

release deletes the entry from byTabId, but presentContent is owner-independent and recreates a { owner: null } entry whenever the entry is missing. If HostedBrowserWebview fires a scheduled layout or scroll update after the lease has released, presentContent resurrects the deleted entry, so released tabs still accumulate in byTabId — defeating the bounded-state goal of this change. Consider guarding presentContent so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new owner: null entry.

Suggested change

	presentContent: (tabId,content)=>
	set((state)=>{
	constcurrent=state.byTabId[tabId];
	if(!current)returnstate;

🤖 Copy this AI Prompt to have your agent fix this:

In file @apps/web/src/browser/browserSurfaceStore.ts around lines 104-120:
`release` deletes the entry from `byTabId`, but `presentContent` is owner-independent and recreates a `{ owner: null }` entry whenever the entry is missing. If `HostedBrowserWebview` fires a scheduled layout or scroll update after the lease has released, `presentContent` resurrects the deleted entry, so released tabs still accumulate in `byTabId` — defeating the bounded-state goal of this change. Consider guarding `presentContent` so it no-ops (or requires a valid owner) when no entry exists, instead of creating a new `owner: null` entry.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Idle preview TTL drops tab suppressions

Medium Severity

Introducing Atom.setIdleTTL on previewStateAtom causes client-only suppressedTabIds to be lost when a thread's preview state is evicted. This results in preview tabs that a user previously closed reappearing from the server list.

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[cursor]

Preview index keys never pruned

High Severity

activePreviewThreadKeysAtom is keepAlive and only updated via syncActivePreviewThread on explicit preview writes. When previewStateAtom idle TTL evicts a thread that still had sessions, the index entry is never removed, so the key set grows without bound and activePreviewSessionsAtom keeps scanning stale keys.

Additional Locations (1)

• apps/web/src/previewStateStore.ts#L93-L102

^{Reviewed by Cursor Bugbot for commit 56b6615. Configure here.}

[juliusmarminge]

Closing in favor of #2829 (orchestration V2).

#2829 deletes the V1 orchestration layer this PR builds on — apps/server/src/orchestration/**, provider/Layers/*Adapter.ts and provider/Services/** are removed and replaced by apps/server/src/orchestration-v2/**, with the IPC surface renamed to ORCHESTRATION_V2_WS_METHODS. The files this PR touches either no longer exist or are rewritten, so it can't be rebased — it would need reimplementing against the V2 adapters.

This is not a judgement on the change itself. Several of these are real gaps we still want fixed; the base just moved out from under them.

Once #2829 merges, please rebase onto main, port the change to the V2 equivalent, and reopen (or open a fresh PR). Ping me and I'll prioritise the review.