Lab #3661: Dashboard: a hidden tab keeps polling and re-rendering (health stream, live run page)

Found while triaging swamp-club#3660 (Workers host map leaking d3 transitions in a hidden tab). That leak is fixed separately. This issue covers the remaining work every dashboard page does while document.visibilityState is hidden. It is steady CPU and server load, not memory growth.

Observed (code reading, packages/dashboard/src)

App.tsx calls useHealthStream() for every view. The SSE stream at /api/v1/health/stream?interval=5000 stays open while hidden, and each snapshot calls setHealth, which re-renders the whole app shell and the current view every 5 s.
Approvals, Overview and RunDetail call useActiveRunsRefetch, so a run starting or finishing on serve triggers their refetches even while hidden.
RunDetail polls the run every 2.5 s (LIVE_POLL_MS, usePolling) and ticks a 1 s clock (useNow) while a run is live, without checking visibility. A tab left on a long-running or stuck run polls serve all day. swamp-club#3444 moved run summaries to activity plus coming into view, but not this live poll.
PendingSignalsPanel ticks a 1 s clock while it shows held signals.

Expected

A hidden tab does close to nothing: no 5 s re-render, no live-run polling, no clock ticks. It catches up once when it comes back into view. RunActivityProvider already tracks visibility and can drive this.

Notes

The second tab in #3660 (page not identified) used ~40% CPU and 2.1 GB. If it was not on Workers, the memory growth there is still unexplained; this issue explains only CPU.

Follow-ups from the swamp-eval migration (swamp-club#4403)

model output logs shows the latest log version instead of the output's own artifact version

Manual: Sensitive Method Arguments claims a literal value is refused, but a method run accepts it

workflow run: show artifact attributes for runs through serve, and let a run leave out the "Data produced" box

Docs: what serve instances must not share, flat AWS Secrets Manager names, and where OAuth values are stored

Let a serve:* collective key look up usernames, so a recreated swamp serve does not need oauth:manage at runtime

aws-sm vault: optional secret_prefix to scope secrets within an AWS account and region

@swamp/cve http2shell, php-rce-2026-10 and tailworm: scan fails with 'Duplicate data instance name' (log and status share a name)

swamp skill: add a workspace guide and routing-table entry

stagecraft tracker: relate tickets across trackers (another repo's tracker)

serve: a capability probe answered by a follower does not speak for the leader that handles the forwarded request

serve OAuth client reuse: remaining review findings from swamp-club#4264

Agents.md: consider not using H1 'Project' inside managed block

serve: the cron-fire dedup claim has no deadline, so a hung control plane stalls every scheduled fire

serve: define what swamp serve does when its OAuth client is deleted at swamp-club

Docs: schedule catch-up and missed-fire tracking for scheduled workflows

Work-item commands run from the wrong repo report the work item as not started

Docs: step concurrency caps only that step's forEach iterations, not its whole dependency level

Package everything on ops.swamp-club.com; stop direct server edits

workflow run: let a run skip the "Data produced" box, or make it show what each artifact holds

Shorten swamp serve's token session re-check so revocation takes effect sooner

@swamp/cve/emudhra: Ubuntu's pip vendored certifi reported as exposed although pip uses the OS store

cfgmgmt firewall (ufw): an input for rule position (insert before/after)

@swamp/video: informal demos — join multiple takes into one video, and a full-length background music bed

agent-sessions: lockfile test helper silently depends on the captured @swamp/git key

agent-sessions: low-severity edge cases from the Codex importer reviews (#4158)

Team mode manual pages: swamp-serve and remote-execution for leader/follower, member checkouts, offline work, run control and known limits

Agent session record: four questions from the Codex importer (#4158)

@swamp/video: upload workflow to publish a take to YouTube (video, description, chapters, captions, thumbnail)

@swamp/video/brand: customizable outro card (next steps, headline, per-video CTA)

data prune through serve deletes data of an auto-definition whose declared type is invalid

serve: give the definition index a change signal (file watcher with a sync barrier) so a write to a definitions directory costs O(1), not a stat of every file in it

Warn when a grant with a methods list is a deny: it also refuses requests that name no method

serve reload reports 0 types reloaded when it replaced edited repo-local behaviors

@swamp/video/brand: cap each Chromium stderr line kept for errors

serve resolves realpath for thousands of files under .swamp/outputs/swamp/worker/set_status

Retention or GC for auto-definitions whose runs and data are gone

S3 and GCS: after a real commit by another writer, a serve stays off the pull fast path until it restarts

Licence header check only compares the first line of a file

CI: an accepted attestation approves the PR, and anything else fails the attestation job

artifacts.swamp-club.com unreachable in Spain during LaLiga matches (ISP blocking of Cloudflare IPs)

Supported binary file ingestion for remote members of swamp serve, without the bytes landing in run history

Worker queryData fails at the fixed 30 s RPC limit while it waits for a full catalog rebuild

Add expiring service-account token requests and authorization checks to RBAC

Reads other than findById still treat a lapsed temporary ban as active until the operative next signs in

verify-build upgrade gate silently skips models whose version is a constant

@swamp/agent-sessions: explore a decision model (TypeSafe Jev) for call labelling

agent-sessions: follow-ups from the 4211 reviews (repo resolution cache and edge cases)

agent-sessions: revisit the import's remaining review findings (redaction edge cases, import robustness)

Swamp Club collective GUI: show the swamp serve instances currently connected to a collective

A malformed --ca-cert file is reported as an unreadable OS certificate store

TLS hint blames a missing root CA and macOS for every invalid peer certificate failure

workflow cancel --server does not send SWAMP_SERVE_EXTRA_HEADERS

S3/GCS repairUnpushedFiles: the pull it asks for after a lost last-synced index does not stop it re-uploading copies a peer deleted

swamp-uat private-registry tests leave npm/<port> dirs in the shared Deno cache

A resume runs settled work after the teardown gated on it has already run, and nothing tears that work down

serve (token mode): --admins accepts idp-group entries that can never match

build-swamp-extension example: code-review isn't given the quality evidence, so the reviewer reports quality as missing

deployment: getLogs method (deployment-aware pod log tailing)

model.output.search response phase takes 3.9s for 5,000 items with no attribution (redaction vs serialization vs send)

Skill/docs: document registry listing limits, static-extraction rules, and splitting large APIs by domain

Check registry listing limits in extension quality/push and suggest splitting into per-domain extensions

Over-limit contentMetadata publishes a blank extension page; archive fallback extracts nothing

swamp inbox: with a filter active, sitting on the last row pages through the whole inbox in the background

@swamp/video/hyprland: recording hotkeys, retake marker and phone-mirror window rules

@swamp/video/obs: optional OBS recording with per-person hardware config for @swamp/video

serve daemon enable: add Windows support (service or startup task)

swamp skill docs: publishing.md contradicts itself on dynamic imports, overstates where git dependencies are listed, and never says consumers keep the publisher's bundle

extension push: the dynamic import() refusal tells authors to run swamp extension fmt, and the archive-project-file fix names the kind directory push never filters

extension push: file:, link:, workspace: and git package.json dependencies are left out of the unaudited list when the project also has a deno.json

push (Apple Containers) makes an index whose platform manifest is unpullable on Forgejo

Streak projector: incremental runs instead of a full scan every minute

Registry: detect code from outside npm and JSR in a v2 archive itself, not only from the author's dependency-audit.json

Scorecard: code past the analyzer's read caps, or unreadable, is skipped silently instead of counting as not audited

Claude audit hook misses PowerShell tool calls and sessions started above the swamp repo

access can-i: evaluate a local grants file without --server

Support search and filters as URL query parameters on /extensions

bundleExtension same-cache test can pass with a broken first-bundle gate under CPU load

Five Mongo queues can hand the same row to two replicas

Collective invite shows "This invitation has expired or has already been used" after a successful join via Google sign-in