[AbirAbbas]

Why

The desktop app spent a lot of CPU while agents worked. In the app, every finished tool batch ended in a full-workspace capture. A shell call's changed paths are unknown, so each capture made the saving daemon (furrow-<ver> serve) stat every tracked file and all of .git. codeaf app also listed ignored files with about 20 git calls per capture.

Measured on an M4 Pro (desk main + this engine, Ollama, side-by-side app with a throwaway home):

	before (app/v3 0f8574e)	after (this branch)
saving daemon, CPU-s per shell call	0.51 (big checkout), 0.55 (small)	0.11, 0.17
saves per turn	one per call + turn end (6 for 4 calls)	30 s cadence + turn end (3 for 11 calls; 1 for 4)
11 short calls over 66 s	~5.5 CPU-s, 12 saves (estimated)	1.23 CPU-s, 2 saves
idle app (shell / webview / engine)	~2.5% / ~6% / 0.2% of a core	unchanged

The UI's rewind only reaches the start of the person's turns, and it leaves files as they are. File seals serve moving, taking over and recovering a chat. The WAL already makes every finished call durable before any capture.

What changes

• executor.SettleStep marks the turn loop's per-batch settle (internal/session/loop.go). Every other Settle caller still forces a capture.
• In pipeline mode, a step settle starts no capture while an unknown-effect call is pending and the oldest unsaved call is under 30 s old (saveInterval). Exact-path-only and transcript-only steps capture as before. Turn end, close, exit (Flush) and other forced settles capture everything pending.
• Boundaries that read the head (Captured/Await and their callers: take-over checks, rewind, upload, reacquire, displacement) force held calls into a capture between steps only. During an open step they keep today's behaviour and never wait on a running tool. A seal taken mid-step would carry a call's work without its result line. The per-command ownership check (CheckLease) only joins a running capture (WaitCapture).
• Displacement settles held calls before choosing the head to keep (Batcher.BeforeResolve).
• Needs a careful review (relay ownership):
  • stamping.Seal now lets finished calls seal locally after the hold is lost, so displacement keeps them in the branch. New tools and bookkeeping-only seals stay refused.
  • Batcher.Displaced now always joins lost(), so CheckLease waits for a branch a background heartbeat or follower is still writing. That race was latent; the longer pre-branch save exposed it.

Tests

New contract tests: TestSavePauses* in cellstore, cellsync, syncsetup, executor and session. They use an injected clock and a counting fake store. The contract:

• a young step holds;
• a 30 s-old step captures;
• 5 one-call batches, each with a step settle, produce one seal at turn end;
• a boundary between steps captures, and during a step it doesn't;
• a crash leaves held calls in the WAL;
• displacement keeps held calls in the branch.

Status:

• On macOS at 9cac8c2 (before the rebase): go build ./... and go vet clean, and every focused group passes: TestSavePauses* in all 5 packages (syncsetup 3/3 runs), plus the cellstore, syncsetup and session rewind/displacement sets.
• Full make test on the 5 packages there: 10 failures. All 10 fail the same way on app/v3 59cdf22: the macOS SIGPIPE pipe-stage tests, the bash belt truncation tests, the TestNoRoadIn* complexity tests, programhold, the prefix budgets, and a known syncsetup R9 flake. None are new.
• CI PR gate at 3d3e90e: touched packages pass. The light gate fails only TestNoRoadIn* on files this branch does not touch; app/v3's own gate fails the same tests.
• Rebased onto app/v3 1f1a733 (Moving a chat says how far it has got, stops when stalled, and can be cancelled #2348, Agent spend is complete: agents.open and agent.changed carry the saved figure, and late receipts save it #2347). Moving a chat says how far it has got, stops when stalled, and can be cancelled #2348 adds no head reads or settle points; git range-diff shows only a context-line change in the syncsetup commit. On macOS at 0868e9a: build and vet are clean, every focused group passes (syncsetup TestSavePauses 3/3), and Moving a chat says how far it has got, stops when stalled, and can be cancelled #2348's own Move|Take|Stall tests pass (1 skip: a hosted-only proof). CI is re-running on 0868e9a.

Open points

• One ~1.9 CPU-s codeaf app burst was seen once, at a turn-end settle of 11 held calls in a large checkout. It did not recur in three later runs (two repeats with an unstripped build and sampling, plus a 66 s turn with a mid-turn save). Treated as a one-off.
• Follow-up in furrow: a capture still stats all of .git (immutable packs included). Fewer captures make that rarer, but each one still costs the same.
• Will rebase onto the latest app/v3 (which now has Moving a chat says how far it has got, stops when stalled, and can be cancelled #2348, moving a chat) and re-run the focused tests before marking ready.

🤖 Generated with Claude Code