perf: overhaul session loading, caching, and runtime isolation (#2360)

Improve OpenChamber responsiveness under large session workloads while fixing
cache, synchronization, and persistence correctness across runtimes, projects,
directories, and worktrees.

- prioritize selected and visible sessions during bootstrap and defer
  non-critical enrichment work
- reduce redundant message loading, event processing, store publication, and
  hidden sidebar work
- prevent stale session and message requests from overwriting newer
  authoritative state
- preserve existing data when authoritative fetches fail instead of treating
  failures as successful empty responses
- scope session materialization, messages, drafts, queues, todos, pins,
  permissions, folders, tabs, Git state, and pull request data by runtime and
  directory identity
- harden runtime switching, reconnect, cleanup, mutation reconciliation, and
  persisted-state ordering
- preserve live subagent Task linkage when metadata arrives after an older
  message request or while streaming parts are suspended
- coalesce overlapping tail refreshes without losing newer refresh demand
- improve cold-session loading by moving deferrable work out of the critical
  bootstrap path
- isolate URL authentication, mobile credentials, native secrets, and other
  runtime-owned state across endpoint changes
- bound long-lived caches and remove avoidable allocations from event and
  rendering hot paths
- limit virtualization to archive collections where it improves rendering
  without disrupting active sidebar layout
- stabilize session folders, pin ordering, expanded state, and persisted
  sidebar behavior
- open skill files through the same secure editor and outside-workspace grant
  flow used by file navigation, including worktree sessions
- expand regression coverage for stale completions, runtime collisions,
  reconnect behavior, persistence races, authoritative empty results, and
  subagent refresh ordering
- document the updated synchronization, cache ownership, performance, and
  runtime-isolation invariants

.agents/skills/sync-state-invariants/SKILL.md

@@ -35,6 +35,14 @@ Never swallow an SDK/API error into `[]`, `{}`, or another valid empty success.
 
 Track completeness at the smallest entity/scope. One failed project or directory blocks destructive work for itself, not for unrelated complete scopes.
 
+Inferring destructive cleanup from disappearance between snapshots requires an established authoritative baseline. This is separate from applying a complete snapshot whose contract explicitly authorizes first-load replacement.
+
+- Never infer a disappearance event from the first snapshot, startup-empty state, filtered/visible subsets, or partially loaded scopes.
+- Compare two complete authoritative snapshots from the same runtime and logical scope before treating disappearance as removal.
+- Key disappearance by stable entity identity. Owner, directory, grouping, category, or presentation moves are not deletion unless the authoritative contract says so.
+- Reset the baseline when runtime identity or authoritative scope changes.
+- Prefer explicit deletion events; snapshot-difference cleanup is a fallback that requires completeness guarantees.
+
 ## Live And Historical State
 
 - Use historical state to restore context, not to infer ongoing execution.
@@ -61,6 +69,10 @@ For streaming-frequency work, also load `performance-engineering`.
 - Treat startup 502/503 as transient with bounded retry/recovery.
 - A retry loop requires a real failure signal; swallowed errors disable retries.
 - Preserve previous authoritative state during transient bootstrap/reconnect failures.
+- Distinguish stale-scope rejection from same-scope mutation reconciliation. A generation token rejects obsolete owners but does not protect mutations made while a still-valid request is in flight.
+- Capture a mutation revision when an authoritative load starts. At commit time, read current state and preserve or overlay entity mutations newer than that revision.
+- Record removals as mutations even when the entity is already absent, so an in-flight response cannot resurrect it.
+- Return committed reconciled state, not the raw fetched snapshot, when callers depend on the result.
 
 ## Optimistic Updates
 
@@ -85,6 +97,18 @@ For streaming-frequency work, also load `performance-engineering`.
 - Key runtime-scoped caches by runtime identity when IDs or paths can collide.
 - Clean optimistic and local cache state after partial failures.
 
+## Persisted Snapshot Ordering
+
+When state exists in memory and one or more persistent stores, define an explicit authority and ordering protocol:
+
+- Distinguish a missing snapshot from authoritative empty data, malformed data, and read failure.
+- Preserve mutation order independently per owner by serializing writes or attaching monotonic revisions and rejecting stale writes. Do not rely on uncontrolled wall-clock timestamps.
+- Capture runtime/owner identity with every debounced or asynchronous operation and verify it again before commit.
+- Pending writes must complete against their captured owner, drain before an owner switch, or be canceled only under an explicit durability/data-loss contract. Apply the strongest available guarantee at page hide/freeze and shutdown boundaries.
+- During hydration, capture the local mutation revision and do not replace state after newer local mutations.
+- Validate persisted payload shape before granting authority. Malformed data is failure, not empty success.
+- Define retention explicitly; never silently evict older owner namespaces unless bounded retention and resulting data loss are intentional contracts.
+
 ## Verification
 
 Cover the relevant lifecycle, not only static state:
@@ -97,6 +121,10 @@ Cover the relevant lifecycle, not only static state:
 - create, stream, abort, permission, archive/delete, and revisit when session behavior changes;
 - partial multi-directory/project failure;
 - runtime or worktree switch with dynamic directory resolution.
+- snapshot-difference cleanup establishing its first authoritative baseline without deletion, then cleaning a later authoritative disappearance exactly once;
+- identity-preserving moves/category changes and runtime/scope changes resetting cleanup baselines;
+- create, update, move, archive, and delete mutations surviving responses started before those mutations;
+- missing versus empty persistence, malformed payloads, out-of-order writes, hydration races, and lifecycle durability behavior.
 
 ## Red Flags
 
@@ -107,3 +135,6 @@ Cover the relevant lifecycle, not only static state:
 - Queue reads current model/agent at send time.
 - New session lookup assumes SSE already indexed it.
 - Optimistic data has no shadow entry or rollback.
+- Snapshot-difference cleanup treats its first startup snapshot as a disappearance event.
+- Missing or malformed persistence becomes authoritative empty state.
+- Debounced writes are canceled on owner/lifecycle change without completing against the captured owner or an explicit durability/data-loss contract.