perf: performance improvements 1

toju-app/src/app/domains/attachment/README.md

@@ -210,9 +210,11 @@ Components read attachment state reactively through the store's signals. The sto
 Image inline previews on Electron/desktop use renderer `blob:` URLs rebuilt from disk. To cap RAM in media-heavy channels:
 
 - **Room restore** (`restoreLocalAttachmentsForRoom`) resolves `savedPath` for hosting only — it does not hydrate every image blob up front.
-- **Visibility** (`ChatMessageItemComponent` + `IntersectionObserver` on the chat scrollport) hydrates blobs when a message enters view (with `ATTACHMENT_BLOB_VISIBILITY_ROOT_MARGIN`) and revokes them when it leaves, as long as a disk path can rehydrate later (`canRevokeAttachmentDisplayBlob`).
+- **Visibility** (`ChatMessageItemComponent` + `IntersectionObserver` on the chat scrollport) hydrates blobs when a message enters view (with `ATTACHMENT_BLOB_VISIBILITY_ROOT_MARGIN`) and revokes them when it leaves, as long as a disk path can rehydrate later (`canRevokeAttachmentDisplayBlob`). Hydration itself is visibility-gated (`attachment-hydration-visibility.rules.ts`) — off-screen rows never load blobs, and destroyed rows always release theirs.
+- **No byte duplication:** disk-hydrated blobs are never copied into `AttachmentRuntimeStore.originalFiles` (`applyAttachmentBlob`); revocation of a disk-backed blob also drops any stale `originalFiles` entry. `originalFiles` only carries uploads/downloads that have no disk copy yet.
+- **Room switch sweep:** `releaseDisplayBlobsForInactiveRooms` revokes display blobs for messages of all other rooms when navigation lands on a different room.
 - **Pinned overlays** (lightbox / image gallery) call `pinDisplayBlobs` so an open full-screen view is not revoked while its message scrolls off-screen.
-- **Serving** is unaffected: peers still download from `savedPath` / `filePath`; blob URLs are display-only.
+- **Serving** is unaffected: peers still download from `savedPath` / `filePath` (`streamRequestedFile` prefers the disk path); blob URLs are display-only.
 
 While a revoked image waits to rehydrate, chat renders the existing image-grid spinner skeleton (`isAttachmentPendingInlineHydration`).
 

toju-app/src/app/domains/attachment/application/services/attachment-manager.service.ts

@@ -10,7 +10,11 @@ import { RealtimeSessionFacade } from '../../../../core/realtime';
 import { selectCurrentUserId } from '../../../../store/users/users.selectors';
 import { DatabaseService } from '../../../../infrastructure/persistence';
 import { yieldToAttachmentHydrationLoop } from '../../domain/logic/attachment-blob.rules';
-import { buildAttachmentDisplayPinKey, shouldRevokeDisplayBlobForAttachment } from '../../domain/logic/attachment-blob-eviction.rules';
+import {
+  buildAttachmentDisplayPinKey,
+  collectMessageIdsForInactiveRoomBlobRelease,
+  shouldRevokeDisplayBlobForAttachment
+} from '../../domain/logic/attachment-blob-eviction.rules';
 import {
   getWatchedAttachmentRoomIdFromUrl,
   isDirectMessageAttachmentRoomId,
@@ -68,8 +72,14 @@ export class AttachmentManagerService {
         return;
       }
 
+      const previousRoomId = this.watchedRoomId;
+
       this.watchedRoomId = this.extractWatchedRoomId(event.urlAfterRedirects || event.url);
 
+      if (this.watchedRoomId !== previousRoomId) {
+        this.releaseDisplayBlobsForInactiveRooms(this.watchedRoomId);
+      }
+
       if (this.watchedRoomId) {
         void this.restoreLocalAttachmentsForRoom(this.watchedRoomId);
         void this.requestAutoDownloadsForRoom(this.watchedRoomId);
@@ -211,6 +221,18 @@ export class AttachmentManagerService {
     }
   }
 
+  releaseDisplayBlobsForInactiveRooms(activeRoomId: string | null): void {
+    const messageIds = collectMessageIdsForInactiveRoomBlobRelease(
+      Array.from(this.runtimeStore.getAttachmentEntries(), ([messageId]) => messageId),
+      (messageId) => this.runtimeStore.getMessageRoomId(messageId) ?? null,
+      activeRoomId
+    );
+
+    for (const messageId of messageIds) {
+      this.revokeOffscreenDisplayBlobsForMessage(messageId);
+    }
+  }
+
   requestFile(messageId: string, attachment: Attachment): Promise<void> {
     return this.transfer.requestFile(messageId, attachment);
   }

toju-app/src/app/domains/attachment/application/services/attachment-persistence.service.spec.ts

@@ -134,6 +134,35 @@ describe('AttachmentPersistenceService', () => {
     expect(attachmentStorage.readFile).not.toHaveBeenCalled();
   });
 
+  it('does not duplicate disk-hydrated bytes into the original-file cache', async () => {
+    const injector = Injector.create({
+      providers: [
+        AttachmentPersistenceService,
+        AttachmentRuntimeStore,
+        { provide: DatabaseService, useValue: database },
+        { provide: AttachmentStorageService, useValue: attachmentStorage },
+        { provide: Store, useValue: { select: () => of('room-1') } }
+      ]
+    });
+    const service = runInInjectionContext(injector, () => injector.get(AttachmentPersistenceService));
+    const runtimeStore = injector.get(AttachmentRuntimeStore);
+    const attachment = {
+      id: 'att-1',
+      messageId: 'msg-1',
+      filename: 'photo.png',
+      size: 3,
+      mime: 'image/png',
+      isImage: true,
+      savedPath: '/appdata/photo.png',
+      available: false
+    };
+
+    await expect(service.ensureInlineDisplayObjectUrl(attachment)).resolves.toBe(true);
+
+    expect(attachment.objectUrl).toMatch(/^blob:/);
+    expect(runtimeStore.getOriginalFile('msg-1:att-1')).toBeUndefined();
+  });
+
   it('restores a blob from a whole-file read when the store cannot read chunks (browser store)', async () => {
     attachmentStorage.canReadFileChunks.mockReturnValue(false);
 
@@ -263,4 +292,66 @@ describe('AttachmentPersistenceService', () => {
 
     revokeSpy.mockRestore();
   });
+
+  it('releases the cached original file when revoking a disk-backed display blob', () => {
+    const injector = Injector.create({
+      providers: [
+        AttachmentPersistenceService,
+        AttachmentRuntimeStore,
+        { provide: DatabaseService, useValue: database },
+        { provide: AttachmentStorageService, useValue: attachmentStorage },
+        { provide: Store, useValue: { select: () => of('room-1') } }
+      ]
+    });
+    const service = runInInjectionContext(injector, () => injector.get(AttachmentPersistenceService));
+    const runtimeStore = injector.get(AttachmentRuntimeStore);
+    const attachment = {
+      id: 'att-1',
+      messageId: 'msg-1',
+      filename: 'photo.png',
+      size: 3,
+      mime: 'image/png',
+      isImage: true,
+      savedPath: '/appdata/photo.png',
+      available: true,
+      objectUrl: 'blob:http://localhost/abc'
+    };
+    const revokeSpy = vi.spyOn(URL, 'revokeObjectURL').mockImplementation(() => undefined);
+
+    runtimeStore.setOriginalFile('msg-1:att-1', new File(['abc'], 'photo.png', { type: 'image/png' }));
+
+    expect(service.revokeAttachmentDisplayBlob(attachment)).toBe(true);
+    expect(runtimeStore.getOriginalFile('msg-1:att-1')).toBeUndefined();
+
+    revokeSpy.mockRestore();
+  });
+
+  it('keeps the cached original file when the attachment is not persisted to disk yet', () => {
+    const injector = Injector.create({
+      providers: [
+        AttachmentPersistenceService,
+        AttachmentRuntimeStore,
+        { provide: DatabaseService, useValue: database },
+        { provide: AttachmentStorageService, useValue: attachmentStorage },
+        { provide: Store, useValue: { select: () => of('room-1') } }
+      ]
+    });
+    const service = runInInjectionContext(injector, () => injector.get(AttachmentPersistenceService));
+    const runtimeStore = injector.get(AttachmentRuntimeStore);
+    const attachment = {
+      id: 'att-2',
+      messageId: 'msg-1',
+      filename: 'clip.mp4',
+      size: 3,
+      mime: 'video/mp4',
+      isImage: false,
+      available: true,
+      objectUrl: 'blob:http://localhost/def'
+    };
+
+    runtimeStore.setOriginalFile('msg-1:att-2', new File(['abc'], 'clip.mp4', { type: 'video/mp4' }));
+
+    expect(service.revokeAttachmentDisplayBlob(attachment)).toBe(false);
+    expect(runtimeStore.getOriginalFile('msg-1:att-2')).toBeDefined();
+  });
 });

toju-app/src/app/domains/attachment/application/services/attachment-persistence.service.ts

@@ -141,6 +141,13 @@ export class AttachmentPersistenceService {
     this.revokeAttachmentObjectUrl(attachment);
     attachment.objectUrl = undefined;
 
+    // Once the bytes live on disk, the cached File duplicate is redundant:
+    // peer requests are served from the disk path and re-display rehydrates
+    // from disk, so keeping it would double the attachment's memory cost.
+    if (attachment.savedPath?.trim()) {
+      this.runtimeStore.deleteOriginalFile(`${attachment.messageId}:${attachment.id}`);
+    }
+
     return true;
   }
 
@@ -388,15 +395,12 @@ export class AttachmentPersistenceService {
     return true;
   }
 
+  // The blob always comes from a disk path here, so peers are served from
+  // disk and no original-file copy is cached; caching one would keep a second
+  // full copy of the bytes alive for the whole session.
   private applyAttachmentBlob(attachment: Attachment, blob: Blob): void {
     attachment.objectUrl = URL.createObjectURL(blob);
     attachment.available = true;
-
-    this.runtimeStore.setOriginalFile(
-      `${attachment.messageId}:${attachment.id}`,
-      new File([blob], attachment.filename, { type: attachment.mime })
-    );
-
     this.runtimeStore.touch();
   }
 

toju-app/src/app/domains/attachment/domain/logic/attachment-blob-eviction.rules.spec.ts

@@ -7,6 +7,7 @@ import {
 import {
   buildAttachmentDisplayPinKey,
   canRevokeAttachmentDisplayBlob,
+  collectMessageIdsForInactiveRoomBlobRelease,
   shouldRevokeDisplayBlobForAttachment
 } from './attachment-blob-eviction.rules';
 
@@ -58,4 +59,40 @@ describe('attachment-blob-eviction rules', () => {
 
     expect(shouldRevokeDisplayBlobForAttachment('msg-1', attachment, new Set())).toBe(true);
   });
+
+  describe('collectMessageIdsForInactiveRoomBlobRelease', () => {
+    const messageRoomIds = new Map([
+      ['msg-a', 'room-1'],
+      ['msg-b', 'room-2'],
+      ['msg-c', 'room-2']
+    ]);
+
+    it('selects messages that belong to rooms other than the active one', () => {
+      expect(collectMessageIdsForInactiveRoomBlobRelease(
+        [
+          'msg-a',
+          'msg-b',
+          'msg-c'
+        ],
+        (messageId) => messageRoomIds.get(messageId) ?? null,
+        'room-1'
+      )).toEqual(['msg-b', 'msg-c']);
+    });
+
+    it('skips messages with an unknown room so they are not evicted by mistake', () => {
+      expect(collectMessageIdsForInactiveRoomBlobRelease(
+        ['msg-a', 'msg-unknown'],
+        (messageId) => messageRoomIds.get(messageId) ?? null,
+        'room-2'
+      )).toEqual(['msg-a']);
+    });
+
+    it('selects every known-room message when no room is active', () => {
+      expect(collectMessageIdsForInactiveRoomBlobRelease(
+        ['msg-a', 'msg-b'],
+        (messageId) => messageRoomIds.get(messageId) ?? null,
+        null
+      )).toEqual(['msg-a', 'msg-b']);
+    });
+  });
 });

toju-app/src/app/domains/attachment/domain/logic/attachment-blob-eviction.rules.ts

@@ -45,6 +45,31 @@ export function shouldRevokeDisplayBlobForAttachment(
   return canRevokeAttachmentDisplayBlob(attachment);
 }
 
+/**
+ * On room switch, display blobs from every other room are released so their
+ * memory does not accumulate across the servers a user visits in a session.
+ * Messages whose room is unknown are left alone rather than evicted blindly.
+ */
+export function collectMessageIdsForInactiveRoomBlobRelease(
+  messageIds: Iterable<string>,
+  resolveMessageRoomId: (messageId: string) => string | null,
+  activeRoomId: string | null
+): string[] {
+  const selected: string[] = [];
+
+  for (const messageId of messageIds) {
+    const roomId = resolveMessageRoomId(messageId);
+
+    if (!roomId || roomId === activeRoomId) {
+      continue;
+    }
+
+    selected.push(messageId);
+  }
+
+  return selected;
+}
+
 function hasNonEmptyString(value: string | null | undefined): boolean {
   return typeof value === 'string' && value.trim().length > 0;
 }

toju-app/src/app/domains/attachment/domain/logic/attachment-hydration-visibility.rules.spec.ts

@@ -0,0 +1,46 @@
+import { shouldHydrateInlineImageForVisibility, shouldHydratePlayableMediaForVisibility } from './attachment-hydration-visibility.rules';
+
+const diskBackedImage = {
+  available: false,
+  filename: 'photo.png',
+  id: 'att-1',
+  isImage: true,
+  mime: 'image/png',
+  savedPath: '/appdata/photo.png'
+};
+const diskBackedVideo = {
+  available: false,
+  mime: 'video/mp4',
+  savedPath: '/appdata/clip.mp4'
+};
+
+describe('attachment hydration visibility rules', () => {
+  it('hydrates a disk-backed image only when the message is visible', () => {
+    expect(shouldHydrateInlineImageForVisibility(diskBackedImage, true)).toBe(true);
+    expect(shouldHydrateInlineImageForVisibility(diskBackedImage, false)).toBe(false);
+  });
+
+  it('never hydrates an image that is already displayable', () => {
+    const displayable = {
+      ...diskBackedImage,
+      available: true,
+      objectUrl: 'blob:http://localhost/abc'
+    };
+
+    expect(shouldHydrateInlineImageForVisibility(displayable, true)).toBe(false);
+  });
+
+  it('hydrates disk-backed playable media only when the message is visible', () => {
+    expect(shouldHydratePlayableMediaForVisibility(diskBackedVideo, true)).toBe(true);
+    expect(shouldHydratePlayableMediaForVisibility(diskBackedVideo, false)).toBe(false);
+  });
+
+  it('never hydrates media that already has an object URL', () => {
+    const hydrated = {
+      ...diskBackedVideo,
+      objectUrl: 'blob:http://localhost/def'
+    };
+
+    expect(shouldHydratePlayableMediaForVisibility(hydrated, true)).toBe(false);
+  });
+});

toju-app/src/app/domains/attachment/domain/logic/attachment-hydration-visibility.rules.ts

@@ -0,0 +1,49 @@
+import type { Attachment } from '../models/attachment.model';
+import { isAttachmentPendingInlineHydration, isInlineDisplayableImage } from './attachment-image.rules';
+import { isAttachmentPendingMediaHydration } from './attachment.logic';
+
+type InlineImageCandidate = Pick<
+  Attachment,
+  'available' | 'filePath' | 'filename' | 'isImage' | 'mime' | 'objectUrl' | 'receivedBytes' | 'savedPath'
+>;
+
+type PlayableMediaCandidate = Pick<
+  Attachment,
+  'available' | 'filePath' | 'mime' | 'objectUrl' | 'receivedBytes' | 'savedPath'
+>;
+
+/**
+ * Display blobs are only hydrated for messages inside (or near) the viewport.
+ * Hydrating off-screen rows loads full decoded media into the blob store for
+ * rows the user may never scroll to, which is the main renderer/browser-process
+ * memory driver in attachment-heavy rooms.
+ */
+export function shouldHydrateInlineImageForVisibility(
+  image: InlineImageCandidate,
+  isMessageVisible: boolean
+): boolean {
+  if (!isMessageVisible) {
+    return false;
+  }
+
+  if (isInlineDisplayableImage(image)) {
+    return false;
+  }
+
+  return isAttachmentPendingInlineHydration(image);
+}
+
+export function shouldHydratePlayableMediaForVisibility(
+  media: PlayableMediaCandidate,
+  isMessageVisible: boolean
+): boolean {
+  if (!isMessageVisible) {
+    return false;
+  }
+
+  if (media.objectUrl) {
+    return false;
+  }
+
+  return isAttachmentPendingMediaHydration(media);
+}

toju-app/src/app/domains/chat/domain/rules/message-sync.rules.spec.ts

@@ -3,9 +3,23 @@ import {
   it,
   expect
 } from 'vitest';
-import { findMissingIds } from './message-sync.rules';
+import {
+  findMissingIds,
+  FULL_SYNC_LIMIT,
+  INVENTORY_LIMIT
+} from './message-sync.rules';
 
 describe('message-sync.rules', () => {
+  it('keeps sync limits bounded so full-room loads cannot spike memory unbounded', () => {
+    // Sync inventories and full-sync batches load complete message rows into
+    // memory. An effectively-unlimited ceiling (previously 1,000,000) turns a
+    // pathological room into a multi-hundred-MB allocation in one sync cycle.
+    expect(INVENTORY_LIMIT).toBeLessThanOrEqual(20_000);
+    expect(FULL_SYNC_LIMIT).toBeLessThanOrEqual(20_000);
+    expect(INVENTORY_LIMIT).toBeGreaterThanOrEqual(5_000);
+    expect(FULL_SYNC_LIMIT).toBeGreaterThanOrEqual(5_000);
+  });
+
   it('requests ids with newer revision or mismatched head hash', () => {
     const localMap = new Map<string, { ts: number; rc: number; ac: number; revision: number; headHash: string }>();
 

toju-app/src/app/domains/chat/domain/rules/message-sync.rules.ts

@@ -6,12 +6,14 @@ import {
 
 /** Maximum number of messages to include in sync inventories.
  *
- * The inventory protocol now ships every message in the room (id, ts, rc, ac)
- * chunked at `CHUNK_SIZE`, so peers converge on the full history regardless
- * of how lopsided their message counts are. The constant remains as a safety
- * ceiling for pathological rooms.
+ * The inventory protocol ships messages in the room (id, ts, rc, ac) chunked
+ * at `CHUNK_SIZE`. Building an inventory loads the full message rows into
+ * memory, so this ceiling must stay bounded: the previous effectively-
+ * unlimited value (1,000,000) let a single sync cycle allocate hundreds of MB
+ * in a pathological room. The most recent `INVENTORY_LIMIT` messages are
+ * reconciled; anything older stays local-only.
  */
-export const INVENTORY_LIMIT = 1_000_000;
+export const INVENTORY_LIMIT = 20_000;
 
 /** Number of messages per chunk for inventory / batch transfers. */
 export const CHUNK_SIZE = 200;
@@ -25,8 +27,8 @@ export const SYNC_POLL_SLOW_MS = 900_000;
 /** Sync timeout duration before auto-completing a cycle (5 seconds). */
 export const SYNC_TIMEOUT_MS = 5_000;
 
-/** Large limit used for legacy full-sync operations. */
-export const FULL_SYNC_LIMIT = 1_000_000;
+/** Ceiling for legacy full-sync and account-sync batches (most recent first). */
+export const FULL_SYNC_LIMIT = 20_000;
 
 /** Inventory item representing a message's sync state. */
 export interface InventoryItem {

toju-app/src/app/domains/chat/feature/chat-messages/components/message-item/chat-message-item.component.ts

@@ -1,4 +1,4 @@
-/* eslint-disable @typescript-eslint/member-ordering, */
+
 import { CommonModule } from '@angular/common';
 import { FormsModule } from '@angular/forms';
 import {
@@ -50,6 +50,8 @@ import {
   isInlineDisplayableImage
 } from '../../../../../attachment/domain/logic/attachment-image.rules';
 import { isAttachmentPendingMediaHydration } from '../../../../../attachment/domain/logic/attachment.logic';
+import { shouldHydrateInlineImageForVisibility } from '../../../../../attachment/domain/logic/attachment-hydration-visibility.rules';
+import { shouldHydratePlayableMediaForVisibility } from '../../../../../attachment/domain/logic/attachment-hydration-visibility.rules';
 import { ATTACHMENT_BLOB_VISIBILITY_ROOT_MARGIN } from '../../../../../attachment/domain/logic/attachment-blob-eviction.rules';
 import { PlatformService, ViewportService } from '../../../../../../core/platform';
 import { ElectronBridgeService } from '../../../../../../core/platform/electron/electron-bridge.service';
@@ -275,11 +277,7 @@ export class ChatMessageItemComponent implements AfterViewInit, OnDestroy {
     const isVisible = this.isMessageVisible();
 
     for (const image of images) {
-      if (isInlineDisplayableImage(image)) {
-        continue;
-      }
-
-      if (!isAttachmentPendingInlineHydration(image)) {
+      if (!shouldHydrateInlineImageForVisibility(image, isVisible)) {
         continue;
       }
 
@@ -293,7 +291,7 @@ export class ChatMessageItemComponent implements AfterViewInit, OnDestroy {
     }
 
     for (const media of mediaAttachments) {
-      if (media.objectUrl || !isAttachmentPendingMediaHydration(media)) {
+      if (!shouldHydratePlayableMediaForVisibility(media, isVisible)) {
         continue;
       }
 
@@ -595,9 +593,10 @@ export class ChatMessageItemComponent implements AfterViewInit, OnDestroy {
     this.visibilityObserver?.disconnect();
     this.visibilityObserver = null;
 
-    if (this.isMessageVisible()) {
-      this.attachmentsSvc.revokeOffscreenDisplayBlobsForMessage(this.message().id);
-    }
+    // Destroyed rows always release their display blobs (pins are respected
+    // inside the facade); rows destroyed while off-screen previously kept
+    // their blobs alive for the rest of the session.
+    this.attachmentsSvc.revokeOffscreenDisplayBlobsForMessage(this.message().id);
 
     this.clearLongPressTimer();
     this.detachMobileSheet();

toju-app/src/app/features/room/voice-workspace/voice-workspace-stream-tile/voice-workspace-stream-tile.component.ts

@@ -28,6 +28,7 @@ import { ViewportService } from '../../../../core/platform';
 import { MobileAppLifecycleService, MobilePictureInPictureService } from '../../../../infrastructure/mobile';
 import { VoiceWorkspacePlaybackService } from '../voice-workspace-playback.service';
 import { VoiceWorkspaceStreamItem } from '../voice-workspace.models';
+import { releaseVideoElementStream } from './voice-workspace-stream-video.rules';
 import { APP_TRANSLATE_IMPORTS, AppI18nService } from '../../../../core/i18n';
 
 @Component({
@@ -169,6 +170,7 @@ export class VoiceWorkspaceStreamTileComponent implements OnDestroy {
       void document.exitFullscreen().catch(() => {});
     }
 
+    releaseVideoElementStream(this.videoRef()?.nativeElement);
     this.unlockOrientation();
   }
 

toju-app/src/app/features/room/voice-workspace/voice-workspace-stream-tile/voice-workspace-stream-video.rules.spec.ts

@@ -0,0 +1,33 @@
+import { releaseVideoElementStream } from './voice-workspace-stream-video.rules';
+
+describe('releaseVideoElementStream', () => {
+  it('pauses the element and detaches the media stream so the decoder can be released', () => {
+    const pause = vi.fn();
+    const video = {
+      srcObject: { getTracks: () => [] } as unknown as MediaStream,
+      pause
+    };
+
+    releaseVideoElementStream(video);
+
+    expect(pause).toHaveBeenCalled();
+    expect(video.srcObject).toBeNull();
+  });
+
+  it('is a no-op for a missing element', () => {
+    expect(() => releaseVideoElementStream(undefined)).not.toThrow();
+  });
+
+  it('still detaches when pause throws', () => {
+    const video = {
+      srcObject: {} as MediaStream,
+      pause: vi.fn(() => {
+        throw new Error('detached element');
+      })
+    };
+
+    releaseVideoElementStream(video);
+
+    expect(video.srcObject).toBeNull();
+  });
+});

toju-app/src/app/features/room/voice-workspace/voice-workspace-stream-tile/voice-workspace-stream-video.rules.ts

@@ -0,0 +1,22 @@
+export interface DetachableVideoElement {
+  srcObject: MediaStream | MediaSource | Blob | null | undefined;
+  pause(): void;
+}
+
+/**
+ * Detach a media stream from a video element so Chromium can release the
+ * decoder and frame buffers immediately instead of waiting for GC. Destroyed
+ * tiles that keep `srcObject` bound retain decode state for streams that are
+ * no longer rendered, which accumulates across camera/screen-share churn.
+ */
+export function releaseVideoElementStream(video: DetachableVideoElement | null | undefined): void {
+  if (!video) {
+    return;
+  }
+
+  try {
+    video.pause();
+  } catch { /* already detached from the document */ }
+
+  video.srcObject = null;
+}

toju-app/src/app/infrastructure/realtime/logging/debug-network-metrics.spec.ts

@@ -0,0 +1,30 @@
+import {
+  clearDebugNetworkPeerMetrics,
+  getDebugNetworkMetricSnapshot,
+  MAX_TRACKED_DEBUG_NETWORK_PEERS,
+  recordDebugNetworkPing
+} from './debug-network-metrics';
+
+describe('debug network metrics retention', () => {
+  it('releases a peer metric entry when the peer is cleared', () => {
+    recordDebugNetworkPing('peer-cleared', 42);
+    expect(getDebugNetworkMetricSnapshot('peer-cleared')).not.toBeNull();
+
+    clearDebugNetworkPeerMetrics('peer-cleared');
+
+    expect(getDebugNetworkMetricSnapshot('peer-cleared')).toBeNull();
+  });
+
+  it('evicts the oldest peer entries once the tracked-peer cap is exceeded', () => {
+    recordDebugNetworkPing('peer-oldest', 10);
+
+    for (let index = 0; index < MAX_TRACKED_DEBUG_NETWORK_PEERS; index++) {
+      recordDebugNetworkPing(`peer-fill-${index}`, index);
+    }
+
+    expect(getDebugNetworkMetricSnapshot('peer-oldest')).toBeNull();
+    expect(
+      getDebugNetworkMetricSnapshot(`peer-fill-${MAX_TRACKED_DEBUG_NETWORK_PEERS - 1}`)
+    ).not.toBeNull();
+  });
+});

toju-app/src/app/infrastructure/realtime/logging/debug-network-metrics.ts

@@ -3,6 +3,13 @@ type DebugNetworkHandshakeType = 'answer' | 'ice_candidate' | 'offer';
 
 const FILE_RATE_WINDOW_MS = 6_000;
 
+/**
+ * Peer metric entries are tiny, but the store is keyed by every peer id ever
+ * seen in the session. Long sessions with peer churn would otherwise grow the
+ * map for the app lifetime, so the oldest entries are evicted past this cap.
+ */
+export const MAX_TRACKED_DEBUG_NETWORK_PEERS = 200;
+
 export interface DebugNetworkMetricHandshakeCounts {
   answersReceived: number;
   answersSent: number;
@@ -236,12 +243,25 @@ class DebugNetworkMetricsStore {
     };
   }
 
+  clearPeer(peerId: string): void {
+    this.metrics.delete(peerId);
+  }
+
   private ensure(peerId: string): InternalDebugNetworkMetricState {
     const existing = this.metrics.get(peerId);
 
     if (existing)
       return existing;
 
+    while (this.metrics.size >= MAX_TRACKED_DEBUG_NETWORK_PEERS) {
+      const oldestPeerId = this.metrics.keys().next().value;
+
+      if (oldestPeerId === undefined)
+        break;
+
+      this.metrics.delete(oldestPeerId);
+    }
+
     const created: InternalDebugNetworkMetricState = {
       connectionDrops: 0,
       downloads: createDownloadRates(),
@@ -384,3 +404,8 @@ export function recordDebugNetworkFileChunk(
 export function getDebugNetworkMetricSnapshot(peerId: string): DebugNetworkMetricSnapshot | null {
   return debugNetworkMetricsStore.getSnapshot(peerId);
 }
+
+/** Drop the metric entry for a peer that fully left (no reconnect pending). */
+export function clearDebugNetworkPeerMetrics(peerId: string): void {
+  debugNetworkMetricsStore.clearPeer(peerId);
+}

toju-app/src/app/infrastructure/realtime/peer-connection-manager/peer-connection.manager.ts

@@ -340,6 +340,12 @@ export class PeerConnectionManager {
       return false;
 
     try {
+      // Release the failed channel before adopting the replacement; otherwise
+      // its SCTP resources and handlers stay alive for the connection lifetime.
+      try {
+        expectedChannel.close();
+      } catch { /* channel may already be closed */ }
+
       const replacement = peerData.connection.createDataChannel(DATA_CHANNEL_LABEL, { ordered: true });
 
       peerData.dataChannel = replacement;

toju-app/src/app/infrastructure/realtime/peer-connection-manager/recovery/peer-recovery.spec.ts

@@ -5,7 +5,11 @@ import {
   PeerConnectionManagerContext,
   RecoveryHandlers
 } from '../shared';
-import { scheduleDataChannelRecovery } from './peer-recovery';
+import {
+  closeAllPeers,
+  removePeer,
+  scheduleDataChannelRecovery
+} from './peer-recovery';
 
 describe('peer recovery', () => {
   afterEach(() => {
@@ -13,6 +17,40 @@ describe('peer recovery', () => {
     vi.useRealTimers();
   });
 
+  it('removes every remote stream map entry for a removed peer, including camera streams', () => {
+    const channel = createDataChannel(DATA_CHANNEL_STATE_OPEN);
+    const context = createContext('alice');
+
+    context.state.activePeerConnections.set('bob', createPeerData(channel, 'connected'));
+    context.state.remotePeerStreams.set('bob', createMediaStream());
+    context.state.remotePeerVoiceStreams.set('bob', createMediaStream());
+    context.state.remotePeerScreenShareStreams.set('bob', createMediaStream());
+    context.state.remotePeerCameraStreams.set('bob', createMediaStream());
+
+    removePeer(context, 'bob');
+
+    expect(context.state.remotePeerStreams.has('bob')).toBe(false);
+    expect(context.state.remotePeerVoiceStreams.has('bob')).toBe(false);
+    expect(context.state.remotePeerScreenShareStreams.has('bob')).toBe(false);
+    expect(context.state.remotePeerCameraStreams.has('bob')).toBe(false);
+  });
+
+  it('clears every remote stream map when all peers close, including camera streams', () => {
+    const context = createContext('alice');
+
+    context.state.remotePeerStreams.set('bob', createMediaStream());
+    context.state.remotePeerVoiceStreams.set('bob', createMediaStream());
+    context.state.remotePeerScreenShareStreams.set('bob', createMediaStream());
+    context.state.remotePeerCameraStreams.set('bob', createMediaStream());
+
+    closeAllPeers(context.state);
+
+    expect(context.state.remotePeerStreams.size).toBe(0);
+    expect(context.state.remotePeerVoiceStreams.size).toBe(0);
+    expect(context.state.remotePeerScreenShareStreams.size).toBe(0);
+    expect(context.state.remotePeerCameraStreams.size).toBe(0);
+  });
+
   it('recreates a peer immediately when the data channel is already closed', () => {
     vi.useFakeTimers();
 
@@ -205,9 +243,14 @@ function createPeerData(
   };
 }
 
+function createMediaStream(): MediaStream {
+  return { getTracks: () => [] } as unknown as MediaStream;
+}
+
 function createDataChannel(readyState: RTCDataChannelState): RTCDataChannel {
   return {
     bufferedAmount: 0,
+    close: vi.fn(),
     label: 'chat',
     readyState
   } as unknown as RTCDataChannel;

toju-app/src/app/infrastructure/realtime/peer-connection-manager/recovery/peer-recovery.ts

@@ -14,6 +14,7 @@ import {
   RemovePeerOptions
 } from '../shared';
 import { clearAllPingTimers, stopPingInterval } from '../messaging/ping';
+import { clearDebugNetworkPeerMetrics } from '../../logging/debug-network-metrics';
 
 /**
  * Close and remove a peer connection, data channel, and emit a disconnect event.
@@ -33,11 +34,13 @@ export function removePeer(
   if (!preserveReconnectState) {
     clearPeerReconnectTimer(state, peerId);
     state.disconnectedPeerTracker.delete(peerId);
+    clearDebugNetworkPeerMetrics(peerId);
   }
 
   state.remotePeerStreams.delete(peerId);
   state.remotePeerVoiceStreams.delete(peerId);
   state.remotePeerScreenShareStreams.delete(peerId);
+  state.remotePeerCameraStreams.delete(peerId);
 
   if (peerData) {
     if (peerData.dataChannel)
@@ -72,6 +75,7 @@ export function closeAllPeers(state: PeerConnectionManagerState): void {
   state.remotePeerStreams.clear();
   state.remotePeerVoiceStreams.clear();
   state.remotePeerScreenShareStreams.clear();
+  state.remotePeerCameraStreams.clear();
   state.peerNegotiationQueue.clear();
   state.peerLatencies.clear();
   state.pendingPings.clear();

toju-app/src/app/store/messages/messages.reducer.spec.ts

@@ -0,0 +1,104 @@
+import type { Message } from '../../shared-kernel';
+import { MessagesActions } from './messages.actions';
+import {
+  CACHED_INACTIVE_ROOM_MESSAGE_LIMIT,
+  initialState,
+  messagesReducer
+} from './messages.reducer';
+
+function buildMessage(id: string, roomId: string, timestamp: number): Message {
+  return {
+    id,
+    roomId,
+    senderId: 'user-1',
+    senderName: 'User One',
+    content: `message ${id}`,
+    timestamp,
+    reactions: [],
+    isDeleted: false
+  };
+}
+
+function buildMessages(roomId: string, count: number, startTimestamp = 0): Message[] {
+  return Array.from({ length: count }, (_, index) =>
+    buildMessage(`${roomId}-msg-${index}`, roomId, startTimestamp + index)
+  );
+}
+
+describe('messagesReducer inactive-room pruning', () => {
+  it('prunes an inactive room down to the cached limit when switching to another room', () => {
+    const overflow = 40;
+    const seeded = messagesReducer(
+      initialState,
+      MessagesActions.loadMessagesSuccess({
+        messages: buildMessages('room-a', CACHED_INACTIVE_ROOM_MESSAGE_LIMIT + overflow)
+      })
+    );
+    const loadedRoomA = { ...seeded, currentRoomId: 'room-a' };
+    const afterSwitch = messagesReducer(
+      loadedRoomA,
+      MessagesActions.loadMessages({ roomId: 'room-b' })
+    );
+    const roomAMessages = Object.values(afterSwitch.entities).filter(
+      (message) => message?.roomId === 'room-a'
+    );
+
+    expect(roomAMessages).toHaveLength(CACHED_INACTIVE_ROOM_MESSAGE_LIMIT);
+    // The most recent messages survive; the oldest are dropped.
+    expect(afterSwitch.entities[`room-a-msg-${overflow - 1}`]).toBeUndefined();
+    expect(afterSwitch.entities[`room-a-msg-${overflow}`]).toBeDefined();
+  });
+
+  it('keeps every message of the room being loaded', () => {
+    const seeded = messagesReducer(
+      initialState,
+      MessagesActions.loadMessagesSuccess({
+        messages: buildMessages('room-a', CACHED_INACTIVE_ROOM_MESSAGE_LIMIT + 50)
+      })
+    );
+    const loadedRoomA = { ...seeded, currentRoomId: 'room-b' };
+    const afterLoad = messagesReducer(
+      loadedRoomA,
+      MessagesActions.loadMessages({ roomId: 'room-a' })
+    );
+    const roomAMessages = Object.values(afterLoad.entities).filter(
+      (message) => message?.roomId === 'room-a'
+    );
+
+    expect(roomAMessages).toHaveLength(CACHED_INACTIVE_ROOM_MESSAGE_LIMIT + 50);
+  });
+
+  it('does not prune anything when reloading the same room', () => {
+    const seeded = messagesReducer(
+      initialState,
+      MessagesActions.loadMessagesSuccess({
+        messages: buildMessages('room-a', CACHED_INACTIVE_ROOM_MESSAGE_LIMIT + 50)
+      })
+    );
+    const loadedRoomA = { ...seeded, currentRoomId: 'room-a' };
+    const afterReload = messagesReducer(
+      loadedRoomA,
+      MessagesActions.loadMessages({ roomId: 'room-a' })
+    );
+
+    expect(afterReload.ids).toHaveLength(CACHED_INACTIVE_ROOM_MESSAGE_LIMIT + 50);
+  });
+
+  it('prunes each inactive room independently', () => {
+    let state = messagesReducer(
+      initialState,
+      MessagesActions.loadMessagesSuccess({
+        messages: [...buildMessages('room-a', CACHED_INACTIVE_ROOM_MESSAGE_LIMIT + 10, 0), ...buildMessages('room-b', 5, 100_000)]
+      })
+    );
+
+    state = { ...state, currentRoomId: 'room-a' };
+    state = messagesReducer(state, MessagesActions.loadMessages({ roomId: 'room-c' }));
+
+    const roomACount = Object.values(state.entities).filter((message) => message?.roomId === 'room-a').length;
+    const roomBCount = Object.values(state.entities).filter((message) => message?.roomId === 'room-b').length;
+
+    expect(roomACount).toBe(CACHED_INACTIVE_ROOM_MESSAGE_LIMIT);
+    expect(roomBCount).toBe(5);
+  });
+});

toju-app/src/app/store/messages/messages.reducer.ts

@@ -41,6 +41,41 @@ export const initialState: MessagesState = messagesAdapter.getInitialState({
   exhaustedConversations: {}
 });
 
+/**
+ * Maximum messages retained in the store per *inactive* room. Cached rooms
+ * keep a recent slice so a return visit renders immediately, but sync and
+ * scroll-up can grow a room's slice to thousands of entries; without pruning,
+ * the store grows unbounded across every room visited in a session. The
+ * active room is never pruned - its window is managed by the chat view.
+ */
+export const CACHED_INACTIVE_ROOM_MESSAGE_LIMIT = 100;
+
+function pruneInactiveRoomMessages(state: MessagesState, activeRoomId: string): MessagesState {
+  const retainedPerRoom = new Map<string, number>();
+  const idsToRemove: string[] = [];
+  const ids = state.ids as string[];
+
+  // ids are sorted oldest-to-newest; walk backwards so the newest messages of
+  // each inactive room are the ones retained.
+  for (let index = ids.length - 1; index >= 0; index--) {
+    const message = state.entities[ids[index]];
+
+    if (!message || message.roomId === activeRoomId) {
+      continue;
+    }
+
+    const retained = (retainedPerRoom.get(message.roomId) ?? 0) + 1;
+
+    retainedPerRoom.set(message.roomId, retained);
+
+    if (retained > CACHED_INACTIVE_ROOM_MESSAGE_LIMIT) {
+      idsToRemove.push(ids[index]);
+    }
+  }
+
+  return idsToRemove.length > 0 ? messagesAdapter.removeMany(idsToRemove, state) : state;
+}
+
 export const messagesReducer = createReducer(
   initialState,
 
@@ -48,17 +83,23 @@ export const messagesReducer = createReducer(
   // return visit (or a prefetched room) renders immediately from memory. The
   // selectors (`selectChannelMessages`, `channelMessages` computed) already
   // filter by `currentRoom.id`, so leaving stale rooms in the entity adapter
-  // is safe. Memory cost is ~30 messages per saved room; tracked at
-  // /memories/repo/electron-server-switch-performance.md.
-  on(MessagesActions.loadMessages, (state, { roomId }) => ({
-    ...state,
-    loading: true,
-    error: null,
-    currentRoomId: roomId,
-    exhaustedConversations: state.currentRoomId === roomId
-      ? state.exhaustedConversations
-      : {}
-  })),
+  // is safe. On room switch, inactive rooms are pruned to
+  // `CACHED_INACTIVE_ROOM_MESSAGE_LIMIT` so the cache stays bounded.
+  on(MessagesActions.loadMessages, (state, { roomId }) => {
+    const pruned = state.currentRoomId === roomId
+      ? state
+      : pruneInactiveRoomMessages(state, roomId);
+
+    return {
+      ...pruned,
+      loading: true,
+      error: null,
+      currentRoomId: roomId,
+      exhaustedConversations: state.currentRoomId === roomId
+        ? state.exhaustedConversations
+        : {}
+    };
+  }),
 
   on(MessagesActions.loadMessagesSuccess, (state, { messages }) =>
     messagesAdapter.upsertMany(messages, {