fix: restore UX after performance improvements

[t3dotgg]

The performance pass removed useful status feedback and introduced recovery, worker-lifetime, and cache problems. This restores the feedback and fixes those problems while keeping the performance safeguards.

This is one combined PR at Theo's request.

Regressions and fixes

Regression	Source PR	Fix
Thinking, setup, compaction, and loading states lost motion.	#9709	Restore transform shimmer and loader rotation. Pause offscreen and in hidden tabs. Keep reduced-motion support and a static forced-color fallback for the shine.
Every code-view reopen could restart 2 to 6 workers and show Loading code again.	#9692	Start workers only after a viewer commits. Share the initialized pool for 30 idle seconds, then dispose it. Keep failure fallback and pending file reveals.
A temporary highlighter failure left streaming code plain after the highlighter recovered.	#9677	Reset failed code boundaries when code, language, theme, or streaming state changes. Keep healthy renderers and code controls mounted.
A large raw tool result could reset an empty live stream even when its client payload was small.	#9715	Project tool payloads before retaining them. Shell queues keep only event identity. Preserve queued and in-flight item and byte bounds, replay, and recovery.
One unreadable mobile outbox record hid all valid saved messages.	#9710	Recover readable records and offer Retry. Preserve edits and removals across retries. Keep attachment cleanup and outbox clearing blocked while ownership is incomplete. Remove duplicate upload deletion that bypassed those checks.
Same-size HTML with preserved timestamps could receive an incorrect 304 after deployment.	#9669	Always send current HTML without validators. Keep streamed responses, HEAD behavior, and immutable caching for hashed assets.
The homepage lost pointer response, hero drift, caret motion, and automatic endorsement exposure.	#9697	Restore gated motion and native smooth paging every 8 seconds. Keep 21 cards. Pause on hover or focus and stop paging after manual input. No JavaScript scrolling frame loop.

#9777 restored the running-tool shine while this work was in progress. This PR keeps its single text element, contrast colors, 30-step sweep, and accessibility guards. It adds visibility pausing instead of a second tool-label overlay.

The outbox restriction was disclosed in its original PR. Recovery now works without relaxing data safety. The HTML issue was reproduced with preserved archive timestamps, not ordinary npm installation.

Deliberate safeguards retained

• Keep terminal and history limits, timeline and draft optimizations, idle thread-stream shutdown, and query and cache improvements.
• Keep the mobile long-line highlighting guard, parsed-review cache bounds, and lazy image signing. No text or images were removed by those changes.
• Keep the separate panel-navigation fix and sidebar-priority changes. Explicit panel toggles still use their configured duration.
• Keep ultrathink colors static pending GPU measurements. No wire schema, persisted outbox version, native binding, or native fingerprint changes.

Verification

Takeover verification passed on the rebased product code. 281 focused tests passed: 71 web/marketing, 158 mobile, and 52 server. Full CI passed on a19faa6b, including the desktop build, preload check, and mobile native analysis. Cursor and Macroscope correctness checks passed.

Area	Observed result
Status feedback	Browser checks passed for Thinking, real worktree setup, compaction, running tools, loading, syncing, and update/error states. Offscreen mounted rows paused. Shimmer text stayed in place and had one accessible text node. Stopped and failed rows stayed static.
Code viewers	Plain text, highlighted files, and this PR's Code tab rendered. Warm reopens reused six workers. All six stopped after 30 idle seconds, and cold reopen created a working pool. Draft text survived. Dark/light/dark changes kept code visible without new workers. Forced worker creation failure still rendered plain text.
Markdown recovery	The base stayed plain after an injected highlighter failure. This PR recovered after the code changed. The same code controls and open details stayed mounted. Copy used the new code.
Live streams	Real-WebSocket tests delivered raw tool results over 8 MiB through thread and shell streams without a false reset. Replay, true overflow, and queue bounds passed.
Mobile outbox	On an iPhone Air simulator with iOS 26.5, the warning and Retry worked. The readable record sent once while the bad record and shared attachment remained. After repair and Retry, the second record sent once. Both records and the shared attachment then cleared.
HTML caching	Real HTTP tests passed for equal-length replacement HTML with preserved timestamps, stale validators, bodyless HEAD, and unchanged hashed-asset caching.
Homepage	Wide and 390px browser checks kept all 21 cards. Pointer response, drift, caret motion, offscreen pause, eight-second paging, end reversal, hover/focus pause, and manual-input stop passed.

Compaction, sync, update, highlighter failure, and media preference checks used controlled inputs in the real client. Pointer, focus, and wheel events were dispatched in the browser. Copy payloads were captured without changing the system clipboard. The narrow homepage ran in a 390px iframe of the real page. Tests used disposable state and synthetic conversations.

A physical hidden-tab check was not completed. Hidden-tab callbacks passed focused tests. Reduced-motion and forced-color CSS branches passed with controlled media signals. No OS forced-color palette, GPU benchmark, separate packaged Electron UI, or Android run is claimed.

Browser and iOS evidence

Check	Before	After
Highlighter recovery
Homepage, wide
Homepage, 390px

Worktree setup clip. This contains 20 real browser screenshots with their capture timestamps, about five frames per second. It is not a high-refresh performance recording.

Plain-text viewer and preserved draft.

Corrupt-record warning	Recovered messages

The original fixes and Theo Browne's authorship are preserved. Takeover added a correction to the attachment cleanup comment. CI could not reach Ubuntu mirrors over HTTP, so the CI-only HTTPS fix by @shivamhwp was imported from #9806, with its Git author preserved. Package choices and test commands did not change. No V2 session changes were imported.

Original verification kit. Refs #9661.

Created with GPT-6 Astra (preview) in Codex.

---

Note

Medium Risk
Mobile outbox and attachment lifecycle semantics changed (partial recovery, stricter cleanup gates), and static HTML caching behavior is altered—both affect offline queue integrity and post-deploy client updates.

Overview
This PR reverses several user-visible and correctness regressions introduced by recent performance work while keeping the underlying safeguards.

Web and marketing: Restores homepage hero drift, pointer parallax, caret blink, and 8s endorsement carousel paging via new startHomeMotion, with pauses for visibility, reduced motion, hover/focus, and manual scroll. Chat activity rows and composer loaders get shimmer/spin again through observeVisibleAnimation, which ties CSS animation-play-state to viewport intersection and tab visibility. Diff highlighting reuses a shared worker pool for 30s after the last viewer closes. Streaming code fences retry Shiki via RenderErrorBoundary resetKeys without remounting block controls.

Mobile: Thread outbox load now returns readable messages plus per-file errors instead of failing entirely; the manager merges recoverable records, blocks destructive cleanup until a complete load, surfaces a retryable alert, and drops post-delivery releaseUploads in favor of draft/outbox-owned attachment cleanup.

Server: HTML responses skip ETag/Last-Modified and never 304, so same-size deploys still deliver fresh shells. Live thread streaming budgets retain projected tool payloads; shell subscriptions queue only event metadata before coalescing refetches.

CI: Forces HTTPS in apt mirror sources before installing libsecret build deps on Blacksmith runners.

^{Reviewed by Cursor Bugbot for commit a19faa6. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Restore outbox load UX and add shared diff worker pool and visible animations

• Thread outbox storage now returns readable messages alongside per-record storage errors instead of aborting the whole load. The manager exposes those messages, returns false for incomplete loads, retries later without resurrecting removed or edited records, and useThreadOutboxDrain shows a retryable native alert on load failure.
• Removed releaseUploads from PreparedTurnAttachments; durable owners now clean up uploads after checking shared references, and useCreateProjectThread schedules cleanup from prepared draft attachments.
• Web adds a shared, idle-terminated diff worker pool acquired via useSyncExternalStore, a reusable observeVisibleAnimation utility, and a homepage motion controller for pointer parallax and automatic endorsement paging.
• handleStaticAndDevRequest no longer returns 304 or immutable cache headers for HTML; ThreadLiveEventCoalescer no longer double-projects flushed events and retains projected client payloads in the stream budget.
• Risk: ThreadOutboxStorage.load now returns ThreadOutboxLoadResult (messages + errors) instead of an array, so any out-of-tree loader callers must adapt; clearEnvironment now refuses candidate removal when any outbox record is unreadable.

^{Macroscope summarized a19faa6.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ The exact PR base did not have a successful artifact. Baseline uses the latest successful main measurement shown below.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.5 KiB	13.5 KiB	+26 B (+0.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.0 KiB	7.0 KiB	−5 B (−0.1%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.5 KiB	6.5 KiB	+31 B (+0.5%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	57.0 KiB	57.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	8	8	0 (0.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.5 KiB	−220 B (−1.6%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.0 KiB	7.0 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.5 KiB	−217 B (−3.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	59.3 KiB	57.8 KiB	−1.5 KiB (−2.5%)	66.4 KiB	✅
Claude	Live turn messages	10	8	−2 (−20.0%)	21	✅

Baseline: 2dca7a1 · PR result: a19faa6 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 113.8 KiB
• Claude decoded thread snapshot: 114.5 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This PR changes default user-visible behavior and shared runtime lifecycles across mobile, server, marketing, and web surfaces, including persistence recovery, streaming, caching, animation, and worker management. The breadth and interaction of these changes warrant human validation beyond the added focused tests.

^{You can add or adjust custom eligibility rules. Learn more.}