fix(desktop): keep session workspace action identities fixed - #4110

Summary

Switching a session held the renderer at 34% CPU with peaks near 77%, and roughly 58% of that was React render and commit work. The cause is one function identity.

setActiveId was a function declaration in the useAppShellSessionWorkspace body, so it changed identity on every AppShell render. As activateSession it invalidated openSession's useCallback, then the Session navigation controller's commands, then the host's rowActions and onSelectSession, then renderSessionRow — which defeated SessionNavRow's memo on every commit. A single switch re-rendered all 32 sidebar rows about twenty times, and because every Astryx button removes and re-adds its inline anchor-name per render, that switch also produced roughly 2,500 style writes and the style recalculation they force.

Every dependency these actions close over is a ref box, a React state setter, or a method of the once-created session-UI controller, so they are constant by construction rather than by discipline. createSessionWorkspaceActions moves them out of the render body and the hook instantiates it once; refreshSessions and seedSessions get the same treatment. They are deliberately not routed through useStableActions, whose facade exists for factories whose closures do capture changing deps — paying for that indirection here would buy nothing.

Smaller pieces ride along, each its own commit:

• @maka/ui's formatAbsoluteTimestamp was a second copy of the Intl options @maka/core/relative-time already owned, and built a formatter per call — about 1,300 per switch, since the sidebar reads one per row for the tooltip and one for the accessible name. Core's cache could not have absorbed them either: getRelativeFormat and getAbsoluteFormat shared one cachedLocale and cleared each other on a miss, so alternating readings rebuilt a formatter every call. Core now caches each with its own locale and exports the function, and the three UI call sites import it from there. Profiling attributed ~33 ms per switch to this, and an A/B swapping in a memoising Intl.DateTimeFormat moved renderer JS by less than the run-to-run spread — a duplicate-authority removal, not a measurable win.
• Two declarations the move left without an owner: the local MessageListUpdater copies in app-shell-{chat,turn,revision}-actions, and the alias re-export of formatAbsoluteTimestamp in chat-display-helpers.
• A contract spec that budgets the rail's DOM writes for one switch, described under Review focus.

Refs #4109

Behaviour differences worth naming

Neither is reachable from a current call site; both are recorded because they widen what a future one could do.

• The moved formatAbsoluteTimestamp drops a typeof Intl === 'undefined' fallback to toISOString(). Core's module has never had that guard and formatRelativeTimestamp's absolute branch already called Intl unconditionally, so it only protected a runtime that would fail a line later.
• Core's signature defaults locale to 'zh', where the UI copy required it. All four call sites pass it explicitly; the default matches the module's three sibling formatters.

Verification

All measurements are same-instance A/B: the two identities were made runtime-switchable and alternated inside one running dev app, six switches each. Cross-instance comparison is not usable here — restarting the app moves these numbers by more than the effect.

Renderer JS fell in 6 of 6 paired runs. Idle CPU was 0.1% before and after; this workload is entirely interaction-driven.

Ran locally:

• session-workspace-action-identity, session-navigation-controller, relative-time — pass
• session-rail-render-contract (Playwright) — pass, three consecutive runs
• tsc -p apps/desktop/tsconfig.renderer.json --noEmit, @maka/core and @maka/ui builds, npm run format — clean

Not run: the full repository suite, and the end-to-end check on a dev app built from this branch — a dev app from another checkout holds the shared profile lock. The Playwright spec covers the same observable on a clean fixture, so the gap is the manual pass, not the assertion.

Falsifiability was checked for both new tests by reverting the fix in the built renderer bundle. The identity test fails with setActiveId changed identity between renders; the contract spec fails on rows-touched, 12 of 12 rows written where 2 is the budget. Restoring the mutual cache invalidation in core fails the formatter test.

Review focus

The contract spec is the piece worth arguing about. It asserts an outcome rather than an identity, because this rail has had several independent regressions of the same shape and each was invisible to the others. An identity assertion pins one mechanism in one hook; the next plain function declaration upstream passes every existing check, since the dependency arrays stay correct and useExhaustiveDependencies has nothing to flag.

What carries the contract is which rows were written, not how many writes there were. A switch touches the leaving row and the arriving row and nothing else, at any rail length. A total budget cannot say that: 3 * rows is 1.5 whole-rail renders, so a regression that re-renders the rail exactly once — the likeliest one, since renderSessionRow depends on rowActions, sessionMeta and three Sets — would have passed. The spec also counts row remounts, because React sets attributes before insertion and an attribute-only observer reads a whole rail remounting as cheaper than a re-render, and asserts the counter fired at all, because its sensitivity comes from an Astryx ref callback that upstream could reasonably memoise.

It also covers ground this PR does not fix. A switch still produces about twenty commits, and why is not yet attributed; it is not animation-driven, since emulating prefers-reduced-motion cuts requestAnimationFrame callbacks from 188 to 13 while the render count is unchanged. That cascade multiplies whatever the rail costs per render, and anything that raises it shows up in this budget. Tracked in #4109 along with the structural direction — letting the rail subscribe through the store seam app-shell-session-ui-state.ts already establishes, instead of receiving props through five layers.

AI use

Select exactly one:

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool(s) and scope: Claude Code. It drove the CDP profiling and DOM probes that isolated the cause and produced every number above, then wrote the change, the tests, and this description. Three Claude Code agents then reviewed the branch adversarially — runtime correctness, formatter equivalence, and test validity — each tasked with refuting the PR's claims rather than confirming them; they found no correctness defect, and every finding they did raise about the tests is addressed in the last three commits. That review is AI output and does not substitute for human review. The human contributor reviewed the diff, the commit messages, and the measurement method. Generated-by trailers are on all six commits.

Checklist

• Tests cover the change and fail without it
• Lint, format, typecheck and the affected suites pass locally

Does this PR entail a change in behavior?

• Yes — described under Summary above
• No