perf(server): the Pull Requests page no longer burns GitHub's GraphQL budget while agents run#20093

The Pull Requests page repeatedly spends GitHub quota on silent repositories and invalidates global listings after every agent turn (#19363).

This preserves @juliusmarminge's original proposal and branch history, with main merged in. GitHub now batches coverage checks for repositories absent from search, remembers both outcomes for ten minutes, and retains repository reads when coverage is unconfirmed. Other hosts keep their existing fallback. Global agent-turn refreshes share a thirty-second window with a trailing refresh; the turn's own project refreshes immediately. Explicit refresh, user pushes/create-PR, and stack actions remain immediate.

Whole-request failures, including transport/HTTP/rate-limit errors and GraphQL timeouts with null data, remain uncached so the next listing can retry. Confirmed negative and missing answers still cache for ten minutes; repository-scoped refusals stay isolated.

Canceling a listing reader no longer cancels its paid host lookup. The service finishes that work even after its last reader leaves, so reattached readers can share the result; service shutdown still interrupts it.

Verification at 88087307f6:

• Live github.com: the unchanged generated 25-repository coverage batch, measured at ce7cfc75e5, was accepted and cost 1 GraphQL point, including an isolated missing-repository error. GitHub estimated 4 points for the current generated single-repository 100-row listing with rateLimit(dryRun:true).
• Before/after behavior: mutation checks prove coverage batching/caching, turn coalescing, own-project freshness, and cancellation. A real push-helper/service regression failed with two host reads before the follow-up and now immediately makes read three and returns the new PR ten seconds into the turn window.
• 532 focused cases pass across nine existing files. Service/API cases: 361 → 365 (two added on main), retaining five original behaviors and adding a review-discovered push regression and one whole-query timeout case. Scoped server/core/GitHub typechecks, lint, formatting, generated-query consistency, and scoped unused-export checks pass.
• Four full review rounds: Claude Opus 5.5 and Codex gpt-6-sol ended with no findings after fixing delayed user-push refresh and whole-query probe recovery. Current-head executable CI passed; Macroscope approval remains a human gate. Main was merged normally; a one-line correction to an existing web fixture fixes the missing required editor-shortcut prop exposed by merge-based CI. Web typecheck reproduced that failure before the correction and passed afterward. No additional production behavior changed.

Detailed before/after evidence · Live measurement summary

This verifies the live query and integrated service behavior; it does not measure a full running-client agent workload or secondary search-limit saturation. No visual layout changed. macOS, Windows, Electron, iOS, Android, and a live GHES account were not exercised. Macroscope's human approval gate remains.

Fixes #19363.

Tests: Codex gpt-6-astra. Implementation: Codex gpt-6.1-sol. Reviews: Claude Opus 5.5 and Codex gpt-6-sol. Harness: T3 Code.

Takeover

Credit to @juliusmarminge for the design; retained the optional provider probe and epoch caches, fixed global projectIds bypass and empty-repository first-PR fallback, and merged main by merge commits. Rewrote the behavior tests, dropped the duplicate timeout case, and followed main's deletion of the old web test; there is no net web change. Defaults remain 30-second global coalescing / 10-minute coverage facts: the final partial running-server fixture workload measured 215 → 122 GraphQL requests, with live quota cost unmeasured. Warm positive coverage may omit a new PR while GitHub indexing lags despite immediate invalidation; Julius's land label remains required. Incomplete takeover: final-pin proof is only 8/54 captures; the remaining 46 and final test results must be completed before landing.

Evidence

This appendix supersedes the historical evidence above for the current source. Partial, not a readiness claim. Final index, matrix and missing rows, raw request ledger, hashed transcripts, rebuildable driver/fixtures, source manifest.

Environment: fs-11 (freestyle), Linux x86_64; Node24.21.0, Git2.43.0, Vite+1.3.0, Vitest5.0.5; full production server with isolated T3 homes, authenticated ordinary WebSocket RPC, refresh subscriptions, actual Codex gpt-6.1-sol turns, real local commits/pushes/checkpoints and receiver barriers. GitHub listing HTTP uses recorded synthetic fixtures. Fixture costs are simulated, every live rateLimit.cost is null; request counts are not consumed quota points. No browser or screenshots: original web change was test-only, and main deleted that test.

Each core runs three actual turns, three separate explicit app pushes, and one no-op app push. Explicit pushes are accounted separately in raw native-command/RPC/refresh traces; the total above is not an isolated coalescing multiplier. Later terminal offsets relative to the first: before20.142s/35.903s; after16.320s/32.078s. Three turns did not fit a single30s window. Isolated and clock-boundary captures are missing at these final pins. Page1 limit:1 is per repository; continuation uses returned cursors and limit:99, explicitly a size change. Neither live indexing latency nor live rate-limit saturation was measured.

Unverified current-pin pairs (46 captures): core-isolated, single-turn, explicit-variants, reconnect, restart-cold, forge-variants, clock-turn, clock-coverage, coverage-empty-transition, mutation, batching26, batching101, coverage-null, coverage-alias, coverage-transport, coverage-null-data, coverage-timeout, coverage-primary, coverage-secondary, coverage-search-fail, coverage-fallback-fail, coverage-stale, coverage-expiry. Natural expiry failed with socket-open timeouts; isolated core hit ping timeout/interruption; host load was approximately31 with recorded event-loop stalls up to79s. Failed attempts are excluded. Earlier complete proof and SUFFICIENT audit cover older pins only and do not fill these gaps.

Commands: the driver archive README gives exact source export, dependency linking, seeding, ports, server invocation and paired replay. Representative invocation after extracting into a fresh PROOF_REPLAY_ROOT:

Full paired replay contains54 captures; the published sanitized archive contains only the8 completed ones. Its selected semantic assertions and both negative controls pass. Source stamps and2482 tracked export blobs per pin were verified; no old trace was relabelled. Isolated provider compatibility is supplemental harness evidence. Live GHES/Forgejo and non-Codex agent runs remain unverified; exact equal-time scheduling covers timer-first only in older proof, and create-PR/combined-action busy-window combination is not separately captured.

What else changed:

• Singular project lists stay fresh after their own turns; global/subset lists coalesce. A trailing refresh follows bursts; immediate pushes/manual/stack actions bypass the window, but a pending trailing refresh can still add a read.
• Positive and negative coverage facts persist ten minutes. Empty repositories retain direct fallback; failed probes remain uncached and can cost more than base because retry plus fallback both run.
• Immediate invalidation does not guarantee newly indexed rows: a historically covered repository can omit a new open PR during search lag. Own-project additions/deletions can also lag30s because stats use the global epoch.
• Paid listing reads survive a reader cancellation until service shutdown. Pagination can defer a covered silent repository to continuation.
• Seven production files and two test files change against the frozen main base. Main's draft-status and upstream-branch changes were merged, not added by this takeover. No dependency patch, wire-contract change, or net web change.