The authenticated dashboard uses server actions; private responses must not be cached publicly to reduce bandwidth. Existing full-history actions remain available.
getSessionUpdates(sessionId, afterMessageId?) authenticates the caller and checks
session ownership. It returns { status, messages, cursor, hasMore }, with at most
100 messages per response. cursor is the last returned message ID, or the valid
input cursor when no new messages exist. Missing/deleted/cross-session cursors
replay only the owned session's history. Unknown or inaccessible sessions fail.
Messages are append-only. Both the initial history and deltas use SQLite insertion order, rather than timestamps or UUID ordering, so equal/delayed timestamps cannot skip new messages. The server resolves the opaque cursor to its current SQLite rowid within the owned session; clients do not persist rowids.
The client merges by message ID, polls every 10 seconds while active, and drains additional batches every second. Status is read before messages; terminal sessions stop only after the last batch arrives. A mount fetch closes the race between SSR status and message reads. Hidden tabs do not poll.
getWorkflowRunJobsSnapshot(actionRepoId, runId, filter?) verifies repository
ownership, reads the webhook-backed run status, then fetches jobs. It returns
{ status, jobs }. Job polling stops when the run and all returned jobs have
completed. Unknown runs continue polling because an empty list or completed jobs
alone cannot establish completion of the run. Returning focus fetches again to
detect reruns. Missing/delayed webhook tracking can delay stopping.
Session lists, project boards, saved board views, and workflow history refresh once per minute. The live workflow list refreshes every 15 seconds with active runs and once per minute otherwise, so new runs remain discoverable. Mutations continue to invalidate their queries immediately.
Local database and component tests cover the incremental contract and polling lifecycle. Actual Vercel transfer savings require deployed traffic measurement; these changes do not establish which production route caused the October spike.