Summary

PR 5 of the performance series — the biggest UX defect found in the deep-dive: plugin update() ran inline in the render loop (execute_update's thread.join(timeout=30) blocked it), so one slow HTTP fetch froze scrolling for the whole fetch. On a flaky network this is constant: we watched soccer's ESPN DNS-retry storms stall the devpi repeatedly.

Design (safety-first):

• Scheduling logic untouched — every existing gate stays on the render thread (enabled, circuit breaker, can_execute, interval). Only execution moves, to a single serialized worker (same one-at-a-time behavior as before; no concurrent fetch herd). RUNNING set at enqueue + a pending-set gives double re-entry protection.
• Per-plugin locks make the old implicit update/display no-overlap guarantee explicit — and strengthen it: previously, after a timeout, the lingering update thread overlapped display(); now the lock holds through that window too. The display side try-locks; if the plugin is mid-update it holds the last frame for that iteration and reports success, so a skip never falsely advances rotation. Deadlock-free by construction (worker holds one lock; display never blocks).
• Timeout semantics byte-identical (unkillable lingering thread documented in-code).
• Kill switch: plugin_system.synchronous_updates: true restores the inline path with no deploy.
• Thread-safety audit: state_manager is RLock-guarded; health_tracker uses whole-value per-key writes (worst case one-cycle staleness, self-correcting — no worse than today's post-timeout overlap).

Verification

• 8 concurrency tests: scheduler returns <100ms with a 2s update in flight; overlap-assertion under a 500Hz try-lock display loop across repeated updates (zero violations); lock released on failure paths; no double-enqueue; unload-while-queued harmless; kill switch blocks inline as before.
• Existing suites green (one pre-existing failure, test_circuit_breaker, is the mock drift fixed in fix(core): harden text-measurement caches; surface snapshot failures #400).
• Devpi soak: updates completing on the worker, rotation advancing, zero stuck RUNNING states, no new errors. Extended soak continues on the devpi.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FqzC1nzTWL4kaqgMaQZFam