[jappyjan]

Many parallel chats, scheduled runs, delegated tasks and pipeline steps can overload one machine. This adds server-side turn admission per environment, with two opt-in controls (both off by default): Pace new turns by host load (hold turns at severe memory pressure, one per 30 s while elevated or CPU is busy) and Limit running turns (1–64). Waiting turns stay queued with an admissionWait reason and start oldest first through a cross-thread pump. Running turns are never paused. Steer, interrupt and stop are never gated. "Start now" bypasses admission; MCP has no bypass. A turn blocked in t3_thread_wait, or in delegate_task/task_status with mode: "wait", frees its slot.

Stacked on feat/multi-repo-projects. The first commit is the port of pingdotgg#27253 (memory pressure), kept unchanged so it can be dropped once upstream merges it. Docs: docs/user/host-capacity.md, docs/internals/host-admission.md.

Known: ServerEnvironment.test.ts (macOS path), Playwright browser tests (no Chromium), and an OrchestratorMcpService model-manifest test ("gpt-5.5 not advertised") fail locally and are outside this change.

QA findings fixed in this PR

• The sidebar rows showed "Working" (pulsing) for turns waiting on admission; only the command palette showed "Queued". Rows now show a static "Queued" and re-render only on their own wait.
• A run left waiting when the server restarted never started. The first pump now runs after recovery.
• Cancelling a waiting run kept admissionWait; it is now cleared.
• The sidebar pill popover grew without bound; it now scrolls and truncates long titles.
• Fixed two typecheck errors in the host admission tests.

Review findings fixed in this PR

Seven parallel reviews (correctness, requirements, architecture, security, performance, tests, UX) plus a re-review of the fixes.

• Pump hot loop: each denial inside the pump requested another pump, so the server re-read the database continuously while any turn waited (about 3,000 passes a second in a test, 6 after the fix).
• Restart and shutdown: the pump could start waiting turns while startup or shutdown recovery was reconciling, and recovery then cancelled or held them. The pump now stays off until recovery finishes and from the start of shutdown.
• Oldest first: a thread's own next turn could take a freed slot from an older turn on another thread, and a busy thread could starve the rest. decide now counts older waiting threads, judging each by its oldest waiting turn. A thread held for another reason drops its wait marker so it cannot block newer turns.
• Same-thread order: a second message on a thread with a waiting turn could start first. It now queues behind it.
• Lost or stuck turns: a server message on a held queue got held forever instead of waiting for a slot; a forked thread's first message lost its fork context when it waited; a launch requeued at release ran after follow-ups sent while it was prepared.
• Deadlock: delegate_task with mode: "wait" kept the parent's slot, so at the cap the parent and its child blocked each other until the wait timed out.
• Performance: the snapshot queries scanned every run (now use the recovery index); a host CPU sample ran under the global admission lock.
• Clients: web and mobile disagreed on "Queued" (now one shared check from the thread's own data, also used by pipeline status); settings showed for servers that cannot store them and wrote one host's limit to every selected environment; mobile offered a Start now the server refuses; the counts line went stale with both controls off; copy was duplicated (now in client-runtime); settings search entries added.
• Tests: new cases for oldest-first by request time, concurrent sends for the last slot, same-thread order, held queues, launch order at release, a turn left waiting across a restart, and a thread judged by its oldest turn. The replay harness now always builds host admission, so existing orchestration tests cover the unlimited path. Each new case fails without its fix.

Open

• task_status describes workState as working, waiting_for_children or result_available; it does not mention the new queued value. Changing that text needs the mcp-tool-use evals, and this machine has no API keys.
• A delegated child task's record is created "running" before its turn starts, so its timeline row reads running while the child waits (its own thread shows Queued and MCP reports queued). This predates host capacity.
• Follow-ups: keep hostAdmission out of the server config map so live counts don't recompute the sidebar; check the cap before loading a thread in the pump; trigger the pump on unarchive.
• The client fixes after QA were checked by tests, lint and typecheck, not in a running client.

QA (before the review fixes): verified on web with the Replay provider (cap, Start now, Remove, oldest first, scheduled task, restart, light/dark, 375 px) and on an iOS simulator. Severe memory pressure and the memory warning were covered by unit tests only.

🤖 Generated with Claude Code

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for b1d9dde.

This comment will update automatically after the next completed run.