fix: harden orchestration performance and recovery

[numnx]

Summary

This change hardens high-concurrency orchestration after the provider-invocation heap exhaustion incident. It bounds retained runtime data and QA context, resumes interrupted planning and remote work durably, reuses one scoped Git helper per active project, repairs packaged Electron dependency startup, and expands local stress and release-candidate validation.

What changed

• Bounded provider activity, invocation messages, realtime snapshots, database retention work, logging payloads, and subprocess buffering to prevent multi-gigabyte heap growth during large DAGs.
• Reduced Task QA context without redacting its deliverable: the current task keeps its full specification while previously completed sibling tasks are title-only. Sprint-level QA keeps every task in order and uses first-half task instructions only when the estimated full list exceeds 100,000 tokens.
• Added durable restart recovery for planning and remote provider work, including native-session continuation, stale-session reconciliation, and restart-safe task/merge state projection.
• Refactored Git operations around a reusable per-project helper container while a project has active sprint work, with lease ownership, cleanup, concurrency, and fast local merge coverage.
• Added Jules capacity awareness and durable remote-session recovery so hosted work waits for an API-confirmed slot and survives runtime restarts.
• Fixed Electron runtime dependency packaging, including the missing zod startup regression, and added installed-application launch smoke checks to desktop release workflows.
• Added the local-only 400-task extreme DAG scenario with dependency edge cases, QA requested-changes repair, CI repair, forced restarts, capacity pressure, and resource/performance reporting.
• Hardened dashboard realtime caching, focus handling, and viewport-aware sprint action menus under short viewports and sustained browser load.
• Updated canonical and published documentation for orchestration, restart behavior, QA context, Electron packaging, testing, operations, and troubleshooting.

Validation

• pnpm run ci
  • Quality and supply-chain guardrails passed.
  • Dependency audit passed with no known high-severity vulnerabilities.
  • Strict typecheck/lint passed.
  • Backend: 462 files, 6,038 tests passed, 12 skipped.
  • Coverage: 83.29% statements, 73.22% branches, 84.23% functions, 84.56% lines.
  • Dashboard: 270 files, 2,514 tests passed, 1 skipped.
  • Production server and dashboard build passed.
• pnpm run test:e2e: 74/74 Playwright tests passed in the complete matrix.
• Local 400-task extreme DAG:
  • 400/400 tasks completed and merged.
  • 8/8 forced restart checkpoints recovered.
  • Dependency integrity, Task QA, Sprint QA, requested-changes repair, and CI repair assertions passed.
  • Peak runtime RSS was 294 MiB with no OOM, fatal runtime log, or scheduler stall.
  • Provider p50 improved 25%, Git p50 improved 49%, and workflow p50 improved 25% against the baseline.
  • The functional run completed successfully; its wrapper returned non-zero only because workflow p50 was 38.659 seconds against the deliberately strict local 35-second benchmark threshold.

Risk and rollback

This is a broad runtime change touching scheduling, persistence, provider recovery, Git helpers, packaging, and dashboard behavior. The primary risks are recovery-state misclassification and helper lifecycle regressions; targeted restart/capacity/helper tests, the complete CI suite, Playwright matrix, and 400-task run mitigate those risks.

Rollback by reverting commit 3a61d32eb286be2a23a0b7a5a482cb9b56d31a81. Database additions are backward-compatible, so rollback does not require destructive migration work.