fix(managed-agent): bounded growth for managed session stores and panel projection #13184

What happened?

"Unbounded in the time dimension" is the default posture across the managed-agent persistence and UI layers — everything only grows. Audit-verified against main (a7deb01):

TS core (packages/core/src/managed-runtime):

1. The session authority keeps every event of a session in process memory for its lifetime (managed-session-authority.ts:346, :361, :1910 — push-only), and the read paths replay everything: the local JSONL journal reads the whole file per open (local-jsonl-managed-session-journal-store.ts:70), the HTTP store pages the whole journal from revision 0 and concatenates (http-managed-session-store.ts:436-498), and each transcript-chain rebuild re-reads the full transcript plus every referenced resource body (chatRecordingService.ts:1959 → config.ts:445).
2. The activation store and inbox journals never compact: released activations stay in a permanent in-memory map and an append-only JSONL journal that a restart replays in full (managed-activation-store.ts:265, :528, :288-320; managed-session-inbox.ts:385). Lease renewals append a durable journal record roughly every 100 seconds per open session for as long as the process lives (managed-session-assembly.ts:33-46).
3. Process-level maps never evict: dispatch gates keep settled/handed-off entries forever (managed-runtime-dispatch-gate.ts:31-46, :63), the operation grant gate documents entries staying until process end (managed-operation-grant-gate.ts:93-101), shell-result prepared entries accumulate (managed-shell-result-session.ts:66).
4. Hardening is uneven between sibling stores: the tool-result store has pending+link durability, directory symlink refusal, O_NOFOLLOW opens, and 0700 directories, while the adjacent session-resource store has no size cap and weaker directory checks (managed-session-resources.ts:64-107 vs local-managed-tool-result-store.ts:107-114). Hot read paths verify by re-scanning instead of using an index (resource-tool-result-store.ts:264-291 full page reads for any range; managed-shell-result-session.ts:132-150, :219-226, :360-388 repeated O(history) scans and re-hashing per shell call).

Web Shell (packages/web-shell/client/components/managed):

5. Message projection re-reduces the entire event array on every delta (managedEventsToMessages called per state change), concatenating the full assistant text per delta; the actions hook re-scans the whole event array per event; loaded older pages accumulate without bound (the merge side was optimized in fix(managed-agent): harden the managed panel failure lifecycle and worker path containment #13179 — this remaining piece is the dominant per-event cost).
6. A single corrupt persisted SSE frame wedges a session panel forever: JSON.parse failure propagates out of the frame loop (java-managed-agent-client.ts:448), resubscribing from the same cursor replays the same frame every 3 seconds.
7. A stream-gap resync replaces the event array wholesale (use-managed-session.ts gap branch), silently discarding history pages the user had loaded and scrolled into.

What did you expect to happen?

Bounded growth as a design default: lightweight indices plus checkpoint/compaction windows instead of full-event retention, snapshot+truncate for append-only journals, TTL/LRU eviction for settled gate/grant/prepared entries, a stop condition for renewal loops on persistent failure or write-stop, one shared set of hardened directory primitives for all durable stores, size caps at every publish boundary, indexed lookups over kind/executionCallId instead of full scans, and an incremental UI projector plus gap handling that preserves loaded history and skips corrupt frames with a bounded failure budget.

Client information

N/A — code audit finding.

Anything else we need to know?

None of these bite in short demo sessions; they are the difference between the feature surviving long-running hosted tenants and not. Fix order suggestion: (1) and (4) first — they shape the disk and memory envelope of every session; (5)-(7) are independent and web-side only.