# perf\(server\): the Pull Requests page no longer burns GitHub's GraphQL budget while agents run · PR \#20093 · pingdotgg/t3code

[View on GitCafe](https://git.cafe/pingdotgg/t3code/pull/20093)

Repository: [pingdotgg/t3code](https://git.cafe/pingdotgg/t3code)

Visibility: public

State: open

Source repository: pingdotgg/t3code

Source branch: t3code/pr-list-quota

Target branch: main

Head commit: 3d7b2f06716ff8a392e195f0dfd9f723ddaafc49

[Discussion and reviews](https://git.cafe/pingdotgg/t3code/pull/20093)

[Commits](https://git.cafe/pingdotgg/t3code/pull/20093/commits?format=markdown)

[Files changed](https://git.cafe/pingdotgg/t3code/pull/20093/diffs?format=markdown)

## Description

---

The Pull Requests page repeatedly spends GitHub quota on silent repositories and invalidates global listings after every agent turn ([#19363](https://github.com/pingdotgg/t3code/issues/19363)).

This preserves @juliusmarminge's original proposal and branch history, with main merged in. GitHub now batches coverage checks for repositories absent from search, remembers both outcomes for ten minutes, and retains repository reads when coverage is unconfirmed. Other hosts keep their existing fallback. Global agent-turn refreshes share a thirty-second window with a trailing refresh; the turn's own project refreshes immediately. Explicit refresh, user pushes/create-PR, and stack actions remain immediate.

Whole-request failures, including transport/HTTP/rate-limit errors and GraphQL timeouts with null data, remain uncached so the next listing can retry. Confirmed negative and missing answers still cache for ten minutes; repository-scoped refusals stay isolated.

Canceling a listing reader no longer cancels its paid host lookup. The service finishes that work even after its last reader leaves, so reattached readers can share the result; service shutdown still interrupts it.

Verification at [88087307f6](https://github.com/pingdotgg/t3code/commit/88087307f6fdc8702fc12cc2fc6c116856f9e9f5):

- **Live github.com:** the unchanged generated 25-repository coverage batch, measured at [ce7cfc75e5](https://github.com/pingdotgg/t3code/commit/ce7cfc75e5b839c2e070a340978a9b6ef2129ed8), was accepted and cost **1 GraphQL point**, including an isolated missing-repository error. GitHub estimated **4 points** for the current generated single-repository 100-row listing with `rateLimit(dryRun:true)`.
- **Before/after behavior:** mutation checks prove coverage batching/caching, turn coalescing, own-project freshness, and cancellation. A real push-helper/service regression failed with two host reads before the follow-up and now immediately makes read three and returns the new PR ten seconds into the turn window.
- **532 focused cases pass across nine existing files.** Service/API cases: **361 → 365 (two added on main)**, retaining five original behaviors and adding a review-discovered push regression and one whole-query timeout case. Scoped server/core/GitHub typechecks, lint, formatting, generated-query consistency, and scoped unused-export checks pass.
- **Four full review rounds:** Claude Opus 5.5 and Codex gpt-6-sol ended with no findings after fixing delayed user-push refresh and whole-query probe recovery. Current-head executable CI passed; Macroscope approval remains a human gate. Main was merged normally; a one-line correction to an existing web fixture fixes the missing required editor-shortcut prop exposed by merge-based CI. Web typecheck reproduced that failure before the correction and passed afterward. No additional production behavior changed.

[Detailed before/after evidence](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/290f15545f161052/20093-quota-proof-final.md) · [Live measurement summary](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e0742ca9d658fdc9/20093-quota-proof-r4.json)

This verifies the live query and integrated service behavior; it does not measure a full running-client agent workload or secondary search-limit saturation. No visual layout changed. macOS, Windows, Electron, iOS, Android, and a live GHES account were not exercised. Macroscope's human approval gate remains.

Fixes [#19363](https://github.com/pingdotgg/t3code/issues/19363).

Tests: Codex gpt-6-astra. Implementation: Codex gpt-6.1-sol. Reviews: Claude Opus 5.5 and Codex gpt-6-sol. Harness: T3 Code.


## Takeover

Credit to @juliusmarminge for the design; retained the optional provider probe and epoch caches, fixed global `projectIds` bypass and empty-repository first-PR fallback, and merged main by merge commits.
Rewrote the behavior tests, dropped the duplicate timeout case, and followed main's deletion of the old web test; there is no net web change.
Defaults remain **30-second global coalescing / 10-minute coverage facts**: the final partial running-server fixture workload measured **215 → 122 GraphQL requests**, with **live quota cost unmeasured**. Warm positive coverage may omit a new PR while GitHub indexing lags despite immediate invalidation; Julius's `land` label remains required.
**Incomplete takeover:** final-pin proof is only 8/54 captures; the remaining 46 and final test results must be completed before landing.

## Evidence

This appendix supersedes the historical evidence above for the current source. **Partial, not a readiness claim.** [Final index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b1148536ffcdbe43/index.md), [matrix and missing rows](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8c4b6de795f3e814/matrix.md), [raw request ledger](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5f449c8d3a7fd566/request-ledger.ndjson), [hashed transcripts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0b758cb8fbe1b1a0/transcripts-850ea9b1fca1918a.tar.gz), [rebuildable driver/fixtures](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f641dc766350fd75/driver-2398cca82501e842.tar.gz), [source manifest](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f0c3783a8e358ae7/manifest.json).

Environment: fs-11 (`freestyle`), Linux x86_64; Node24.21.0, Git2.43.0, Vite+1.3.0, Vitest5.0.5; full production server with isolated T3 homes, authenticated ordinary WebSocket RPC, refresh subscriptions, actual Codex `gpt-6.1-sol` turns, real local commits/pushes/checkpoints and receiver barriers. GitHub listing HTTP uses **recorded synthetic fixtures**. Fixture costs are **simulated**, every live `rateLimit.cost` is null; request counts are not consumed quota points. No browser or screenshots: original web change was test-only, and main deleted that test.

| Scenario / capture name | Before [70e5e384da](https://github.com/pingdotgg/t3code/commit/70e5e384dab96a1d1e4a253ee5a9415ed5d8ce30) | After [3d7b2f0671](https://github.com/pingdotgg/t3code/commit/3d7b2f06716ff8a392e195f0dfd9f723ddaafc49) |
|---|---|---|
| Core, `exact-head-core` | 216 HTTP / 215 GraphQL; simulated cost215; 7 refresh events, 98 list deliveries | 123 HTTP / 122 GraphQL; simulated cost123; 9 refresh events, 112 list deliveries |
| E2, `corrected-http` | 33 HTTP / 32 GraphQL; simulated cost32; no coverage probe | 32 HTTP / 31 GraphQL; simulated cost37; unusable503→503→200, forced retry, fallback D retained, recovery cached |
| O4/G1, `corrected-pagination-v3` | 9 HTTP / 8 GraphQL; simulated cost8; B2 absent page1, delivered continuation | 6 HTTP / 5 GraphQL; simulated cost5; B2 absent page1, delivered continuation |
| V2, `closed-open-v3` | 39 HTTP / 38 GraphQL; simulated cost38; fallback returns new open B during search lag | 31 HTTP / 30 GraphQL; simulated cost32; positive coverage omits B until index recovery + fresh read |
| Other 23 scenarios listed below | Missing current-pin captures | Missing current-pin captures |

Each core runs three actual turns, three separate **explicit app pushes**, and one no-op app push. Explicit pushes are accounted separately in raw native-command/RPC/refresh traces; the total above is not an isolated coalescing multiplier. Later terminal offsets relative to the first: before20.142s/35.903s; after16.320s/32.078s. **Three turns did not fit a single30s window**. Isolated and clock-boundary captures are missing at these final pins. Page1 `limit:1` is per repository; continuation uses returned cursors and `limit:99`, explicitly a size change. Neither live indexing latency nor live rate-limit saturation was measured.

Unverified current-pin pairs (46 captures): `core-isolated`, `single-turn`, `explicit-variants`, `reconnect`, `restart-cold`, `forge-variants`, `clock-turn`, `clock-coverage`, `coverage-empty-transition`, `mutation`, `batching26`, `batching101`, `coverage-null`, `coverage-alias`, `coverage-transport`, `coverage-null-data`, `coverage-timeout`, `coverage-primary`, `coverage-secondary`, `coverage-search-fail`, `coverage-fallback-fail`, `coverage-stale`, `coverage-expiry`. Natural expiry failed with socket-open timeouts; isolated core hit ping timeout/interruption; host load was approximately31 with recorded event-loop stalls up to79s. Failed attempts are excluded. Earlier [complete proof](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7b09888342c8bbd8/index.md) and [SUFFICIENT audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3a380fedac153ddf/audit-pass2-round3.md) cover older pins only and do not fill these gaps.

Commands: the driver archive README gives exact source export, dependency linking, seeding, ports, server invocation and paired replay. Representative invocation after extracting into a fresh `PROOF_REPLAY_ROOT`:

```sh
node "$PROOF_REPLAY_ROOT/driver/supervise.mjs" final "$PROOF_REPLAY_ROOT/final-source" "$PROOF_REPLAY_ROOT/seed-final-http" 19593 coverage-http corrected-http
python3 "$PROOF_REPLAY_ROOT/driver/assert-evidence.py" "$PROOF_REPLAY_ROOT" final-corrected-http
python3 "$PROOF_REPLAY_ROOT/driver/run-paired.py"
```

Full paired replay contains54 captures; the published sanitized archive contains only the8 completed ones. Its selected semantic assertions and both negative controls pass. Source stamps and2482 tracked export blobs per pin were verified; no old trace was relabelled. Isolated provider compatibility is supplemental harness evidence. Live GHES/Forgejo and non-Codex agent runs remain unverified; exact equal-time scheduling covers timer-first only in older proof, and create-PR/combined-action busy-window combination is not separately captured.

What else changed:

- Singular project lists stay fresh after their own turns; global/subset lists coalesce. A trailing refresh follows bursts; immediate pushes/manual/stack actions bypass the window, but a pending trailing refresh can still add a read.
- Positive and negative coverage facts persist ten minutes. Empty repositories retain direct fallback; failed probes remain uncached and can cost more than base because retry plus fallback both run.
- Immediate invalidation does not guarantee newly indexed rows: a historically covered repository can omit a new open PR during search lag. Own-project additions/deletions can also lag30s because stats use the global epoch.
- Paid listing reads survive a reader cancellation until service shutdown. Pagination can defer a covered silent repository to continuation.
- Seven production files and two test files change against the frozen main base. Main's draft-status and upstream-branch changes were merged, not added by this takeover. No dependency patch, wire-contract change, or net web change.

<details><summary>Verification log</summary>

Tests: original PR service/API tests were pruned and rewritten around observable coalescing, trailing refresh, own-project freshness, immediate pushes/manual refresh, coverage reuse/expiry/fallback, cancellation sharing and alias isolation. Each was mutation/revert checked; the no-trailing mutation times out on the awaited receipt. Main subsequently pruned unrelated tests. Before final merge:191 server cases across4 files plus106 API cases passed. Final head: API106/106 passed; package-local GitManager recheck2/2 passed (102 skipped). Broad5-file run recorded5 timeouts in104 GitManager cases and was interrupted; it is not a pass. Final PullRequestService suite and scoped typechecks are pending. Scoped formatting and diff checks passed; lint has only main's existing no-empty-pattern warning at service test line1432.

Review rounds:1 found subset epoch bypass and empty-repository staleness, both fixed;2 found evidence503/empty-pagination overclaims, corrected;3 both reviewers found no code blocker, timing/index-lag NEEDS_JULIUS;4 both reviewers read the final merged9-file diff and callers, no code blockers, NEEDS_JULIUS timing only. Independent proof audit for final pins is pending; old SUFFICIENT verdict applies only to old pins. CI for the pushed final SHA has not yet been certified; no merge performed. Julius's landing label is still required.

Models/harness: tests and implementation Claude Opus5.5/Claude harness; independent reviews Claude Opus5.5 and Codex gpt-6.1-sol; runtime capture/proof audit/lead Codex gpt-6.1-sol in T3 Code. Artifacts uploaded with [ghdrop](https://github.com/juliusmarminge/gh-file-drop).

</details>