perf(diagnostics): default-off and off-thread the always-on diagnostic subsystems

[Juliusolsson05]

Symptom

The daily-driver dev profile runs every optional diagnostic at once (.env: AGENT_CODE_PERF=1, AGENT_CODE_DEV_DEBUG=1, AGENT_CODE_SESSION_RECORD=1; settings useProxyStreaming, aggressiveDebugPersistence), and several diagnostics have no gate at all:

• feed-debug ring + persistence: no gate, on in packaged builds; 167–172 appends/min (20/s bursts), max 731 ms on main; 4 MiB ring × 39 sessions ≈ up to 156 MB renderer heap; 89 MB on disk (perf(feed-debug): persistence appends on every runtimes replacement instead of batching by time #748/perf(feed-debug): pace persistence appends by time instead of per runtimes replacement #750 paces it, does not gate it).
• session recorder: every outbound message on 10 channels, ~1 MB/s stringify on main; 93% of bytes are screen frames; 1.6 GB on disk (86 recordings).
• memoryInstrumentation sampler (useIpcSubscriptions.ts:335,624-625): every 30 s per session, stringifies 64 samples even when perf is off.
• worktree activity index (WorktreeActivityIndex.ts:31,163-206, indexStore.ts:142-164): 51.8 MB JSON, stringified in full and temp/renamed on every change (0.3–0.5 s main-thread), no retention bucket (debugRetention.ts:354-396) → grows forever.
• heap watchdog (heapWatchdog.ts:28,236): first crossing of min(1.5 GiB, 70%) runs a synchronous writeHeapSnapshot — a multi-second stop-the-world freeze with every session live; this IS the "2 GB watchdog freeze".
• mitmproxy per session (claudeSession.ts:261,305-317; mitmAddon.py:438-535 open/append/close per SSE chunk): 3.7 GB on disk, 12 live processes, and 20 orphaned mitmdump processes (ppid 1, 2 days old) survived the previous run — not reaped on abnormal exit.
• debug-bundle autosave: per pane per 60 s DOM outerHTML + sanitise; 654 MB.

Expected

1. Gate feed-debug persistence behind dev-debug or a setting; a small sampled ring in packaged builds.
2. Gate the memory sampler on perf-enabled.
3. Worktree activity index: cap/TTL, per-project files or append-only, stringify off-thread.
4. Heap watchdog: on trip, journal an incident and defer the snapshot to idle or a user action; never a synchronous snapshot on a live workspace.
5. mitmproxy: batch addon writes; reap children on session stop and will-quit; kill stale _shared-conf mitmdump processes at startup; consider one shared proxy.
6. Diagnostics sink (recorder, perf exporter, feed-debug, ghost/paste/dictation journals) in one utilityProcess/worker; main only postMessages.
7. Document a "daily" profile: SESSION_RECORD, useProxyStreaming, aggressiveDebugPersistence off; DEV_DEBUG=1 kept for on-demand recording.

Refs #722, #748, #750, #733, #734.
Refs #103, #390. Source: architecture audit 2026-09-03 (scratchpad/arch-perf-audit.md).

[Juliusolsson05]

Proxy cleanup #777 now revalidates process identity before TERM, delayed KILL and synchronous exit signalling, retaining uncertain targets. 33 focused safety tests and both full host CI gates pass on f62fd22. POSIX inspection is not atomic; the documented check-to-signal race remains. No live processes were signalled. Awaiting owner merge confirmation; shared-proxy/batched-write work remains separate.

[Juliusolsson05]

Current-source validation at 5d641845 (2026-09-05), with two corrections/refinements to this report:

• The renderer memory sampler's disabled-mode serialization is already fixed. emitRendererMemoryGauges now returns before traversing sessions when performance telemetry is disabled. useIpcSubscriptions.ts:626 calls that gated emitter. Keep this sub-item marked addressed; I did not rerun or repeat the previous private-data measurements.
• Worktree index writes are broader than “on every change”: refreshNow constructs a new updatedAt and calls save even when every candidate was a cache hit. saveWorktreeActivityIndex again updates the timestamp and synchronously stringifies the complete index before async write/rename. This means a successful zero-content-change refresh still pays serialization and disk replacement. The existing one-shot disk snapshot/LRU avoids reparsing the whole index per miss; that older mitigation remains present.

Concrete next step: retain a semantic generation/content-dirty flag separate from “last successfully checked at”, skip full persistence and downstream cache invalidation on unchanged refreshes, and verify deletion/provider identity/mtime-size changes still invalidate. This is functional worktree metadata, so simply disabling it with optional diagnostics is not the appropriate fix. Worker serialization or partitioned storage can follow after measuring the remaining changed-data cost.

Confidence: the no-op write path and early telemetry gate are confirmed by current code. Current index size, wall time, deployed settings, renderer diagnostic CPU, and app-wide improvement were not measured in this non-disruptive pass. No live logs, heap dumps, or private transcripts were collected. New, separate retained-memory evidence for Remote is in #804/#805; those are not diagnostic sinks.