perf(desktop): GUI performance sweep — async offload, poll reduction, render stabilization

[tlongwell-block]

Summary

Team-wide sweep of the desktop GUI for (a) sync work on the macOS main thread (beachball risk), (b) redundant network/draw calls, (c) perceived latency. 7 sweep lanes → ranked findings → fix package on eva/gui-perf-fixes off base 5dce80af, one fix per commit, tip 77bd0e70.

Mechanism (Wren-verified): sync #[tauri::command] runs on the macOS main thread; (async) alone only moves work to Tokio workers. Fix law applied throughout: async command + explicit spawn_blocking; no rusqlite::Connection/locks across .await.

Fixes by lane

• Boot (Sami): archive-seed hooks deferred behind startupReady — seed delayed, never dropped (test_undefined_pubkey_does_nothing, test_explicit_choice_set_does_not_reseed).
• Render path (Dawn): messageProfiles reference stabilization kills typing-storm timeline re-renders (render-count-discipline test pair: value-equal re-derive holds the ref → memo skips; real profile change swaps it → memo fires). Plus per-row agent-pubkey rescan removal, non-DM channel-name filter hoist, MessageActionBar memoization.
• Topbar/Pulse/Huddle polls (Wren): topbar search lazy-loads agent data (dialog open no longer pulls kind:10100); Pulse interval refetches pause when hidden; huddle fallback polls slowed (fail-closed TTS membership semantics preserved — error path still clears set + mutes).
• Agents/Workflows polling (Quinn): relay-agents poll 30s→5min + background pause (only kind:10100 refresh path — kept, not dropped); redundant personas/teams/managed-idle 30s polls dropped (event-driven agents-data-changed covers them; managed running-5s branch kept — process liveness has no event); workflows overview N-per-channel → single #h-batched query (no limit on either path → no truncation change).
• Backend offload (Mari): archive sqlite work in spawn_blocking; event sync deferred off setup path; huddle device/model setup offloaded + membership fetches parallelized (TOCTOU sentinels preserved).
• Reconnect/invalidation (Perci): reconnect replay parallelized (live REQs parallel; paged history bounded at concurrency 4 preserving per-subscription page order); aux backfill concurrency cap; relay-only invalidation taxonomy.
• Commands (Max): 13 sync-command conversions in commands/** — blocking filesystem/sqlite/CLI/store-mutex work behind explicit spawn_blocking.

Verification

• Green-at-tip gate on every integration: tsc clean + full desktop unit suite + vite build + cargo check + full src-tauri suite at every merge tip. Final tip 77bd0e70: node tests 2047/2047, Rust 1041 passed / 11 ignored (+ rodio 3/3), tsc --noEmit clean, vite build clean.
• Disjoint cross-review pairs: every lane reviewed to PASS by a non-author before integration (one lane held at "ready" until its reviewer passed it).
• Whole-package red-team (Wren) at frozen tip 77bd0e70: PASS, no blockers. Re-checked: no locks/DB connections across .await in reviewed paths; huddle shutdown no longer joins workers under the mutex; deferred startup keeps live-ingestion/agent-observer coverage; reconnect replay ordering; workflows #h batch preserves channel attribution.
• Live-relay e2e pass at tip 77bd0e70 (519 specs vs local relay): 490 passed initially; 3 flaky (pass on rerun); 2 failures reproduce at base 5dce80af (pre-existing: channels.spec.ts:876 intro-actions, custom-emoji.spec.ts:375); 3 integration failures were relay-env (relay started without BUZZ_RECONCILE_CHANNELS=true, so SQL-seeded channels had no kind:39000 discovery events) — with the correct env all 3 pass. Zero failures attributable to the package.

Reviewer manual-smoke checklist (Wren's carry-forward)

Startup, channel open/archive scrollback, agents tab inbound refresh, huddle STT/TTS startup, workflows overview, relay reconnect.

Toolchain note (environment, not this PR)

Early lane pushes hit buzz-db+sqlx 0.9 requiring rustc 1.94 in pre-push hooks: Homebrew rustc 1.89 was shadowing the repo-pinned toolchain. PATH="$PWD/bin:$PATH" clears it — hook suites then run green with no --no-verify. No lane touched Cargo.toml/Cargo.lock/crates/buzz-db.

Named follow-ups (out of scope, recorded)

1. secret_store boot-identity redesign — sync keychain access on boot path; HIGH risk, needs its own design.
2. Subscription multiplexer / multi-#h filter-family merge — Perci design sketch, Wren/Mari red-team gate before build.
3. relay-agents kind:10100 since-cursor — cut payload, not just cadence; own tests.
4. Projects issues/PRs #a-batch (deferred Fix D) — MUST ship with scaled pooled limit (limit*N), a-tag re-split, multi-project split/truncation guard test.
5. Workflow run-reconstruction event stream.
6. WorkflowsView rename-cache note (Max; pre-existing, non-blocking).

[wesbillman]

Reviewed on behalf of Wes's crew — full diff read lane by lane against tip 77bd0e70, worktree build of the branch, CI green across the board (Desktop Core/Build/E2E Relay, 4× Smoke E2E, 2× E2E Integration, Rust Lint, Windows Rust).

Verified in the code:

• All 13 sync→async command conversions follow the same safe shape: spawn_blocking closure, std::sync::Mutex locks acquired and released inside the closure, no lock or rusqlite::Connection crossing an .await. Archive commands share one run_archive_db_task helper; the archive DB is WAL + 5s busy_timeout, so cross-thread opens are safe. import_identity even gains a correct persist-before-swap ordering.
• spawn_event_sync boot deferral: keys snapshotted before spawn; retention writes are last-write-wins upserts under the same store-lock discipline, so racing an inbound reconcile_inbound_persona_event is benign.
• profileLookupsEqual compares all five UserProfileSummary fields — no stale-render hole — and both MessageRow call sites receive agentPubkeys from parents that still derive it, so the per-row rescan removal loses nothing.
• Poll removals are genuinely event-covered: both backend agents-data-changed emit sites + the coalescing listener handle personas/teams; relay-agents correctly keeps its (relaxed) poll as the only kind:10100 refresh path; the managed-agents idle→false branch is sound because running→exited can only happen while the 5s running-branch poll is live.
• Reconnect replay: per-subscription page order preserved (sequential paging inside a sub, concurrency 4 across subs), isActive re-checked after each await; the relay-only invalidation predicate has include/exclude tests.

One non-blocking note — workflows #h batch truncation semantics: the comment says "no limit on either path → no truncation change," but the relay applies MAX_HISTORICAL_LIMIT = 2000 as the default when a filter carries no limit (crates/buzz-relay/src/handlers/req.rs). So the practical budget went from 2000 per channel to 2000 pooled across all channels. Unreachable for kind 30620 volumes today, and follow-up #4 already names this exact trap for the projects batch — but a one-line comment correction at get_channels_workflows would keep the next reader from copying the "no limit = no truncation" reasoning onto a high-volume kind.

Also flagging as a deliberate, user-visible trade (no change requested): relay-agents 30s→5min means a newly registered relay agent can take up to 5 minutes to appear in mention/member surfaces until follow-up #3's since-cursor lands.

Approving. Great discipline on one-fix-per-commit — it made a 44-file perf sweep genuinely reviewable.