ccdeck 3.22.14 → 3.23.0

package/src/server/self-update.mjs

@@ -460,17 +460,90 @@ export function hostPackage(pkgRoot, name = PUBLISHED_NAME) {
  * sit above us is not evidence.
  *
  * Guarded on our own manifest being unreadable, so nothing changes for an
- * install that is intact — including the ordinary nested layout before it is
- * upgraded, where pkgRoot answers for itself and this is never consulted.
+ * install that is intact — except for the one replacement that leaves a
+ * readable manifest behind, which is nestedDeckRoot below.
  */
 export function successorRoot(pkgRoot) {
-  if (readManifest(pkgRoot)) return null;
+  if (readManifest(pkgRoot)) return nestedDeckRoot(pkgRoot);
   const root = hostRoot(pkgRoot);
   if (!root) return null;
   const name = readManifest(root)?.name;
   return typeof name === "string" && ALIAS_PACKAGES.includes(name) ? root : null;
 }
 
+/**
+ * The other direction the same replacement can go: the deck moved DOWN, into a
+ * node_modules underneath the directory it used to be.
+ *
+ * `npm i -g agents-deck` before 3.22.3 installed the deck flat — that directory
+ * WAS the deck, bin/ and src/ and hook/ and all. What the registry serves for
+ * that name now is a 5 KB pointer package: a shim.js, a manifest, and a
+ * dependency on `ccdeck`. So reinstalling it replaces the deck with the pointer
+ * and puts the real deck one level down, in `<pkgRoot>/node_modules/ccdeck`.
+ *
+ * The guard above cannot see that, and that is the whole of #975. npm's reify
+ * deleted bin/ and src/ but WROTE a package.json in their place, so
+ * `readManifest(pkgRoot)` answers — with the shim's manifest — and every reader
+ * downstream reads "intact". successorRoot returned null, replacedNote was
+ * handed `moved: null` and stayed silent, and the supervisor went on spawning a
+ * bin/deck.js npm had just removed: five crash restarts in ten minutes and then
+ * a deck that stops for good, with nothing on screen about an upgrade.
+ *
+ * Three facts together, because none of them alone is evidence. Our name is one
+ * of the retired ones; our manifest declares a dependency on the published name,
+ * which a deck's own manifest never does; and the package that dependency names
+ * is really sitting under us. A deck that merely vendors something, or a
+ * retired-name package from before the pointer, matches none of them.
+ */
+function nestedDeckRoot(pkgRoot) {
+  const self = readManifest(pkgRoot);
+  if (!RETIRED_NAMES.includes(self?.name)) return null;
+  if (typeof self?.dependencies?.[PUBLISHED_NAME] !== "string") return null;
+  const root = join(pkgRoot, "node_modules", PUBLISHED_NAME);
+  return readManifest(root)?.name === PUBLISHED_NAME ? root : null;
+}
+
+/**
+ * The retired package this install IS, when reinstalling that package would
+ * replace a working deck with the pointer npm now serves for it — or null,
+ * which is every other install shape on the planet.
+ *
+ * `npm i -g agents-deck` and `npm i -g agent-dag` at 3.22.1 or earlier put the
+ * deck straight into `<prefix>/lib/node_modules/<name>`: no host above it, no
+ * nested copy under it, that directory is the deck. registryName's exception
+ * asks npm about `ccdeck` for such an install and is right to — a retired name's
+ * dist-tag stopped moving — so the deck correctly learns that a newer version
+ * exists. What it then offers is `npm i -g agents-deck@latest`, and since 3.22.8
+ * that command fetches 5 KB of shim and deletes the deck to make room for it.
+ *
+ * The nested layout is the case registryName's comment describes and it is
+ * unaffected: there the retired package is the host, the deck is its dependency,
+ * and reinstalling the host re-resolves `ccdeck@^3` to the newest deck. The
+ * difference is entirely whether the retired name is the wrapper or the thing
+ * inside it, and a wrapper is a package — so the directory test below answers
+ * that too, before it is asked whose name is on it.
+ *
+ * Confined to the global layout — `<prefix>/lib/node_modules/<us>` on POSIX,
+ * `<prefix>/node_modules/<us>` on Windows — because that is the only tree
+ * `npm i -g` rewrites. The test for it is that the directory holding our
+ * node_modules is not a package: a global prefix's `lib` has no manifest, while
+ * a workspace, a CI job or any tool that vendors the deck as a dependency does.
+ * Reinstalling a retired name from inside one of THOSE writes a global tree the
+ * project never reads and leaves its copy exactly where it is — a different
+ * complaint, and not one to answer by telling somebody to uninstall.
+ *
+ * A checkout and an npx run are refused before this in every caller, and are
+ * refused here too, so the predicate is true on its own terms rather than only
+ * in the order it happens to be asked.
+ */
+export function frozenNameInstall(pkgRoot, name = PUBLISHED_NAME) {
+  if (isGitCheckout(pkgRoot) || isNpxInstall(pkgRoot)) return null;
+  const above = hostRoot(pkgRoot);
+  if (!above || readManifest(above)) return null;
+  const self = installedName(pkgRoot, name);
+  return RETIRED_NAMES.includes(self) ? self : null;
+}
+
 /** The package an upgrade would actually install here — and, but for a retired
  *  name, the one worth asking npm about (see registryName).
  *
@@ -539,6 +612,14 @@ export function upgradeCommand(pkgRoot, name = PUBLISHED_NAME) {
   // so `npm run build` is part of the answer rather than an afterthought.
   if (isGitCheckout(pkgRoot)) return "git pull && npm run build";
   if (isNpxInstall(pkgRoot)) return `npx -y ${upgradeName(pkgRoot, name)}@latest`;
+  // A flat install of a retired name cannot be updated by reinstalling itself —
+  // that fetches the pointer package and deletes the deck (frozenNameInstall).
+  // The command has to move them onto the published name, and the removal is
+  // not optional: the old package owns `<prefix>/bin/ccdeck` as well as its own
+  // command, so installing ccdeck alongside it is npm linking a bin over a file
+  // another package still claims.
+  const frozen = frozenNameInstall(pkgRoot, name);
+  if (frozen) return `npm rm -g ${frozen} && npm i -g ${PUBLISHED_NAME}`;
   // Through upgradeName for the same reason the npx line above it is: the
   // printed command is the user's escape hatch when the button fails or is not
   // offered, and one that names a package this install cannot be replaced by is
@@ -897,7 +978,7 @@ export function upgradeSpec(target, platform = process.platform, deps) {
  * Pure so the policy can be read and tested on its own — it is the part that
  * decides whether we are allowed to write to the user's machine.
  */
-export function upgradeBlockedReason({ git, npx, writable, optedOut }) {
+export function upgradeBlockedReason({ git, npx, writable, optedOut, frozen }) {
   if (optedOut) return "opted_out";
   // The maintainer's own tree. Its version leads npm's, and installing over it
   // would replace a working copy with a published tarball.
@@ -906,6 +987,15 @@ export function upgradeBlockedReason({ git, npx, writable, optedOut }) {
   // place — `npx agents-deck@latest` fetches a DIFFERENT directory, which this
   // process could not switch to even after restarting.
   if (npx) return "npx";
+  // A flat install of a retired name: the one shape where `npm i -g <us>@latest`
+  // runs cleanly, reports success, and leaves no deck behind — the registry
+  // serves a 5 KB pointer for those names now, and npm's reify removes bin/,
+  // src/ and hook/ to make room for it. Every other refusal here is "this
+  // install cannot be written over"; this one is "what the write would fetch is
+  // not a deck", so it is asked before writability rather than after: on a
+  // prefix nobody can write, the remedy is still a different command, and
+  // naming the wrong one is what #975 is about.
+  if (frozen) return "retired_name";
   // Almost always a root-owned global prefix. Failing inside npm with EACCES
   // tells the user less than declining up front does.
   if (!writable) return "not_writable";
@@ -996,6 +1086,10 @@ export function upgradeBlock(pkgRoot) {
     // node_modules), so both have to be ours to write.
     writable: dirWritable(target) && dirWritable(resolve(target, "..")),
     optedOut: process.env.AGENTS_DECK_NO_INSTALL === "1",
+    // Whether the package that write would fetch is still a deck. Kept out of
+    // the pure rule above, like every other input here, so the policy stays one
+    // readable expression and this file owns the filesystem half of it.
+    frozen: frozenNameInstall(pkgRoot) !== null,
   });
 }
 

package/src/server/session-recap.mjs

@@ -0,0 +1,89 @@
+// Claude Code's own account of where a session stands, read off its transcript.
+//
+// WHAT IT IS. Once a turn has been finished for three minutes and the terminal
+// is not focused, Claude Code writes one line into the transcript — the
+// "※ recap:" the terminal prints when you come back to it:
+//
+//   {"type":"system","subtype":"away_summary","content":"VCRM-8867 is planned: … (disable recaps in /config)","timestamp":"…",…}
+//
+// Measured on this machine on 2026-09-14: 60 of them in two days of
+// transcripts, 181 to 305 characters each, written a median 3.1 minutes after
+// the line before them. Claude Code caps them at 400 characters, writes one only
+// once a session has three turns, and never writes two in a row.
+//
+// WHY THE DECK WANTS IT. It is written at the moment the person has left the
+// terminal, which is exactly when they are looking at the deck instead. It is
+// the only line in the file written for a human who is catching up, and it is
+// written in their language.
+//
+// WHEN IT STOPS BEING TRUE. A recap describes the session as the last turn left
+// it, so the next turn makes it history: a main-chain assistant line after it
+// retires it here. The client holds the other half of that rule — a prompt
+// newer than the recap — because a prompt reaches the deck through its hook
+// seconds before the model has written anything to this file.
+
+/** The cheap test every line gets before anything is parsed. */
+export const RECAP_MARK = '"away_summary"';
+const ASSISTANT_MARK = '"type":"assistant"';
+
+/** Above Claude Code's own 400, so it never cuts a real recap. It bounds what a
+ *  malformed line could put on a card, and nothing else. */
+const RECAP_MAX_CHARS = 600;
+
+/**
+ * The recap as a card can show it.
+ *
+ * Claude Code ends every one with its own opt-out hint, "(disable recaps in
+ * /config)". That is advice about the terminal, it is the same on every recap,
+ * and on a 260px card it is a tenth of the room, so it goes. Only a trailing
+ * parenthetical that mentions `/config` is taken: a recap that ends on a
+ * bracket of its own keeps it.
+ */
+export function cleanRecap(raw) {
+  if (typeof raw !== "string") return "";
+  let text = raw.replace(/\s+/g, " ").trim();
+  text = text.replace(/\s*\([^()]*\/config[^()]*\)\s*$/, "").trim();
+  if (text.length > RECAP_MAX_CHARS) text = text.slice(0, RECAP_MAX_CHARS - 1).trimEnd() + "…";
+  return text;
+}
+
+/**
+ * The recap one transcript line carries, or null.
+ *
+ * Main chain only: a subagent's sidechain is not the session a person comes
+ * back to. The line's own timestamp is the recap's time, never the clock here —
+ * the deck may be reading a line written while it was down, and the client
+ * compares this time against the session's prompts to decide whether the recap
+ * still describes it. A line with no usable time cannot be compared, so it is
+ * not a recap the deck can use.
+ */
+export function recapOf(line) {
+  if (!line || !line.includes(RECAP_MARK)) return null;
+  let obj = null;
+  try { obj = JSON.parse(line); } catch { return null; }
+  if (!obj || typeof obj !== "object") return null;
+  if (obj.type !== "system" || obj.subtype !== "away_summary") return null;
+  if (obj.isSidechain === true) return null;
+  const text = cleanRecap(obj.content);
+  const at = typeof obj.timestamp === "string" ? Date.parse(obj.timestamp) : NaN;
+  if (!text || !Number.isFinite(at)) return null;
+  return { text, at };
+}
+
+/**
+ * Fold one line into `out.recap`: set by a recap, retired by the next turn.
+ *
+ * Pure, and shaped like foldSessionNamingLine beside it so the transcript
+ * cursor can run both over the same line. A line is parsed only when it could
+ * matter — it carries the recap mark, or a recap is standing and the line looks
+ * like the model answering — so the ordinary line costs two substring tests.
+ */
+export function foldRecapLine(out, line) {
+  if (!line) return;
+  const recap = recapOf(line);
+  if (recap) { out.recap = recap; return; }
+  if (!out.recap || !line.includes(ASSISTANT_MARK)) return;
+  let obj = null;
+  try { obj = JSON.parse(line); } catch { return; }
+  if (obj && obj.type === "assistant" && obj.isSidechain !== true) out.recap = null;
+}

package/src/server/static-cache.mjs

@@ -0,0 +1,67 @@
+// How the deck serves its own UI: compressed when the browser takes it, and
+// cached for good when a file's name is its content (#883).
+//
+// Every static response went out uncompressed and marked `no-cache`, the 833 KB
+// bundle included — so every reload, and every deck opened from another machine
+// on the LAN, fetched the whole of it again at full size. Vite names every file
+// under assets/ by a hash of its content, which means such a file can never
+// change under its name: it is cached for a year and marked immutable. The files
+// that name them — index.html above all — stay no-cache, because they are what
+// moves when the deck upgrades itself.
+import { brotliCompressSync, constants, gzipSync } from "node:zlib";
+
+/** The types worth compressing; images and fonts are compressed already. */
+const COMPRESSIBLE = new Set([".html", ".js", ".mjs", ".css", ".json", ".svg", ".map"]);
+
+/** Vite's output under assets/: `<name>-<hash>.<ext>`, the hash eight or more
+ *  characters of base64url. */
+const HASHED = /^assets\/[^/]+-[A-Za-z0-9_-]{8,}\.[A-Za-z0-9]+$/;
+
+/** The Cache-Control for a path relative to the web root, as the URL spells it. */
+export function cacheControlFor(rel) {
+  return HASHED.test(rel) ? "public, max-age=31536000, immutable" : "no-cache";
+}
+
+/** Does an Accept-Encoding header take `encoding`? A `q=0` is a refusal. */
+function accepts(header, encoding) {
+  for (const part of String(header ?? "").split(",")) {
+    const [name, ...params] = part.trim().split(";");
+    if (name.trim().toLowerCase() !== encoding) continue;
+    const q = params.map(p => p.trim()).find(p => p.startsWith("q="));
+    return q ? Number(q.slice(2)) > 0 : true;
+  }
+  return false;
+}
+
+/** The encoding to send a file of this extension in, or null for none. Brotli
+ *  first — about 15% smaller than gzip on this bundle — and gzip for the rest. */
+export function pickEncoding(acceptEncoding, ext) {
+  if (!COMPRESSIBLE.has(ext)) return null;
+  if (accepts(acceptEncoding, "br")) return "br";
+  if (accepts(acceptEncoding, "gzip")) return "gzip";
+  return null;
+}
+
+/** Compressed bytes, made once per file, build and encoding. The key carries the
+ *  file's mtime, so a rebuild is a new entry rather than a stale one; the set of
+ *  files is the dist folder's, so the cache is as big as the build and no bigger.
+ *  Quality 9 rather than 11: the first request after a build pays for it, and 11
+ *  costs seconds there for a percent or two. */
+const encodedCache = new Map();
+
+export function encodedBody(filePath, mtimeMs, buf, encoding) {
+  const key = `${encoding}\0${mtimeMs}\0${filePath}`;
+  let out = encodedCache.get(key);
+  if (!out) {
+    out = encoding === "br"
+      ? brotliCompressSync(buf, {
+          params: {
+            [constants.BROTLI_PARAM_QUALITY]: 9,
+            [constants.BROTLI_PARAM_SIZE_HINT]: buf.length,
+          },
+        })
+      : gzipSync(buf, { level: 6 });
+    encodedCache.set(key, out);
+  }
+  return out;
+}

package/src/server/stop-deck.mjs

@@ -35,11 +35,11 @@ import { isProcessAlive } from "./deck-probe.mjs";
 
 /** Long enough for a loopback POST and the deck's own teardown to begin; short
  *  enough that a wedged deck does not hold the terminal. */
-export const STOP_ASK_MS = 2000;
+const STOP_ASK_MS = 2000;
 /** How long a deck gets to actually disappear after each rung. A clean shutdown
  *  drains SSE connections and closes the listener; 1500ms of that is the
  *  fallback timer in bin/deck.js's shutdown(), so this has to outlast it. */
-export const STOP_GONE_MS = 3000;
+const STOP_GONE_MS = 3000;
 
 /**
  * Ask one deck to end itself, politely.

package/src/server/store-lock.mjs

@@ -0,0 +1,51 @@
+// The one mutex every write to claude-swap's store goes through.
+//
+// WHY IT IS ITS OWN MODULE (#1039). It used to live in cswap-admin.mjs, under a
+// header that states the invariant the whole feature rests on — "`cswap add`
+// takes no lock while assigning the next slot as max+1 … so every mutation here
+// goes through one mutex" — and "here" turned out to be doing the work. A lock
+// reachable from one module serializes that module against itself and nothing
+// else, and `grep -n withStoreLock src/server/*.mjs` returned hits in exactly
+// one file while three writers of the same sequence.json lived in two others:
+// the manual switch route, the auto-switch tick, and the first-run seed.
+//
+// cswap-admin.mjs imports claude-accounts.mjs, so the lock could not simply be
+// imported back the other way round. Here it depends on nothing at all, which
+// is what lets every writer reach it — and what keeps the next one from
+// quietly growing a second lock of its own, since there is now an obvious
+// place to look.
+import { AsyncLocalStorage } from "node:async_hooks";
+
+let _chain = Promise.resolve();
+
+// Whether the code running right now is itself the mutation holding the lock.
+// Async context rather than a plain boolean, which could not tell that apart
+// from another request that merely arrived while the lock was held — and would
+// wave that one through, which is the opposite of a mutex.
+const _holder = new AsyncLocalStorage();
+
+/**
+ * One store mutation at a time.
+ *
+ * Not defence against another process — that would need claude-swap's own file
+ * lock, which `add` does not take either. This is defence against ourselves:
+ * two browser tabs, a double-click, or a timer are enough to race a slot
+ * assignment.
+ *
+ * Re-entrant, because a mutation that reaches for the lock from inside one
+ * would otherwise wait for itself forever: the chain cannot advance past the
+ * outer link until it settles, and the outer link is blocked on this call. It
+ * already has exclusive access, so it simply runs. That is also what lets a
+ * whole decision be wrapped — `fillEmptySlot` opens the lock and then calls
+ * `importAccount`, which opens it again — instead of a caller having to know
+ * which of its callees already takes it.
+ */
+export function withStoreLock(fn) {
+  if (_holder.getStore()) return Promise.resolve().then(fn);
+  const held = () => _holder.run(true, fn);
+  const next = _chain.then(held, held);
+  // Keep the chain alive even when a link rejects, or every later mutation
+  // inherits the failure.
+  _chain = next.then(() => {}, () => {});
+  return next;
+}

package/src/server/supervisor.mjs

@@ -76,7 +76,7 @@ export const CRASH_CEILING = 5;
 /** The window those five are counted in. */
 export const CRASH_WINDOW_MS = 10 * 60 * 1000;
 /** The first wait, doubling per crash inside the window. */
-export const CRASH_BACKOFF_MS = 1000;
+const CRASH_BACKOFF_MS = 1000;
 /** …and where the doubling stops. Past this the delay is no longer protecting
  *  anything: five attempts at 30s already span most of the window. */
 export const CRASH_BACKOFF_MAX_MS = 30_000;

package/src/server/system-metrics.mjs

@@ -754,8 +754,19 @@ export function parseGetProcessJson(json, totalMem) {
       // shape covers both. Absent rather than zero when the value did not come
       // back: `StartTime` throws for a process this session may not open, and
       // `Threads.Count` is undefined on a row that failed to project.
+      //
+      // `typeof` rather than `Number.isFinite(Number(…))` on the uptime, and the
+      // difference is the whole of that rule: `Number(null)` is 0, and 0 is
+      // finite, so the projection's own `else{$null}` — the branch it takes for
+      // every process whose StartTime this session may not read — arrived as an
+      // uptime of ZERO SECONDS. Every protected process on the machine was
+      // reported to the panel as having started this instant, which is the
+      // reading the comment above says must never be invented. A genuine zero
+      // is still kept: `[int]` of a sub-second TimeSpan is 0, and a process that
+      // started this instant is a real answer when it is the real answer. Same
+      // guard the CPU field two lines up already used, for the same reason.
       ...(Number.isFinite(Number(r.Threads)) && Number(r.Threads) > 0 ? { threads: Number(r.Threads) } : {}),
-      ...(Number.isFinite(Number(r.StartedAt)) ? { uptimeSec: Number(r.StartedAt) } : {}),
+      ...(typeof r.StartedAt === "number" && Number.isFinite(r.StartedAt) ? { uptimeSec: r.StartedAt } : {}),
       rssBytes: Number(r.WorkingSet) || 0,
     }));
 }
@@ -781,6 +792,21 @@ export function parseGetProcessJson(json, totalMem) {
  * Core count is deliberately not a parameter any more. The aggregate meter's
  * 0-100 convention (see cpuPercent) is a different question with a different
  * answer, and the only way this drifts back is if a core count is in reach.
+ *
+ * THE ROW IS CARRIED, NOT REBUILT, and that is the half this used to get wrong
+ * (#954). It listed the four fields it knew about — pid, cpu, mem, name — so
+ * `threads`, `uptimeSec` and `rssBytes` were silently dropped on their way
+ * through, and this is the only step the Windows reading takes: readProcessesNow
+ * returns straight out of the win32 branch, on the other side of the
+ * `attachDetail` call that puts those three back on POSIX. Every Windows row
+ * therefore reached the panel with three of its seven columns missing, always,
+ * and the memory header — which sorts on `rssBytes` and treats `undefined` as a
+ * missing reading — reordered nothing when clicked, because every row was
+ * missing it. Invisible to anyone developing on macOS or Linux.
+ *
+ * `cpuSec` is the one field deliberately removed: it is the raw counter this
+ * function exists to turn into a rate, the POSIX rows never carry one, and
+ * shipping it would put two spellings of the same quantity on the wire.
  */
 export function cpuFromDeltas(rows, prev, elapsedMs, limit = Infinity) {
   const secs = elapsedMs / 1000;
@@ -793,7 +819,8 @@ export function cpuFromDeltas(rows, prev, elapsedMs, limit = Infinity) {
       // process; report nothing rather than a negative or a wild number.
       if (d >= 0) cpu = Math.round((d / secs) * 1000) / 10;
     }
-    return { pid: r.pid, cpu, mem: r.mem, name: r.name };
+    const { cpuSec: _raw, ...rest } = r;
+    return { ...rest, cpu };
   });
   // Until the second reading lands there is no CPU to sort on, so the list is
   // ordered by memory — which is a real answer to "what is this machine doing",
@@ -869,20 +896,35 @@ export async function readProcesses(platform = process.platform, detail = false)
   return procInFlight;
 }
 
+/**
+ * The one-liner the Windows process list is read with.
+ *
+ * Threads and StartTime ride along on the call that was already being made —
+ * `Get-Process` has both, so the two columns cost nothing here. `WorkingSet64`
+ * joins `PrivateMemorySize64` rather than replacing it: the percentage has
+ * always been computed from private bytes and moving it would change a number
+ * that is on screen today, while the new column wants the resident figure Task
+ * Manager itself shows.
+ *
+ * NOT `-IncludeUserName`: it requires an elevated session, and no part of this
+ * deck may ask for one. The user column is simply absent on Windows, which is
+ * the same rule the thermal section keeps.
+ *
+ * A named export for the reason WIN_THERMAL_PS is one, and #954 is why it
+ * became one: three of the seven columns this projection is built to fill were
+ * being dropped after it, and every assertion in the suite was made against a
+ * payload somebody typed. A constant can be handed to the real powershell.exe
+ * on the Windows leg of the matrix, which is the only place the claim "Windows
+ * really does answer with these seven keys" can be measured rather than
+ * reasoned about.
+ */
+export const WIN_PROCESS_PS =
+  "Get-Process | Select-Object Id,ProcessName,CPU,@{n='Threads';e={$_.Threads.Count}},@{n='StartedAt';e={if($_.StartTime){[int]((Get-Date)-$_.StartTime).TotalSeconds}else{$null}}},@{n='WorkingSet';e={$_.WorkingSet64}},@{n='WorkingSetPrivate';e={$_.PrivateMemorySize64}} | ConvertTo-Json -Compress";
+
 async function readProcessesNow(platform, detail = false) {
   if (platform === "win32") {
     const out = await run("powershell.exe", [
-      "-NoProfile", "-NonInteractive", "-Command",
-      // Threads and StartTime ride along on the call that was already being
-      // made — `Get-Process` has both, so the two columns cost nothing here.
-      // `WorkingSet64` joins `PrivateMemorySize64` rather than replacing it:
-      // the percentage has always been computed from private bytes and moving
-      // it would change a number that is on screen today, while the new column
-      // wants the resident figure Task Manager itself shows.
-      // NOT `-IncludeUserName`: it requires an elevated session, and no part
-      // of this deck may ask for one. The user column is simply absent on
-      // Windows, which is the same rule the thermal section keeps.
-      "Get-Process | Select-Object Id,ProcessName,CPU,@{n='Threads';e={$_.Threads.Count}},@{n='StartedAt';e={if($_.StartTime){[int]((Get-Date)-$_.StartTime).TotalSeconds}else{$null}}},@{n='WorkingSet';e={$_.WorkingSet64}},@{n='WorkingSetPrivate';e={$_.PrivateMemorySize64}} | ConvertTo-Json -Compress",
+      "-NoProfile", "-NonInteractive", "-Command", WIN_PROCESS_PS,
     ], 6_000);
     // The same shape the POSIX branch below returns, and not a bare array: the
     // caller reads `read.procs.length` to decide whether this was a real
@@ -1167,14 +1209,33 @@ export async function readHwmon(root = "/sys/class/hwmon", deps = {}) {
       if (!m) continue;
       const celsius = celsiusFromMilli(await read(`${base}/${entry}`));
       if (celsius == null) continue;
+      const chipMax = celsiusFromMilli(await read(`${base}/${m[1]}_max`));
+      const chipCrit = celsiusFromMilli(await read(`${base}/${m[1]}_crit`));
       out.push({
         chip,
         label: await read(`${base}/${m[1]}_label`),
         celsius,
         // The hardware's own bands where it has them. `max` is where the chip
         // says it is unhappy and `crit` is where it says it will act.
-        warnAt: celsiusFromMilli(await read(`${base}/${m[1]}_max`)) ?? WARN_C,
-        critAt: celsiusFromMilli(await read(`${base}/${m[1]}_crit`)) ?? CRIT_C,
+        //
+        // `max` ONLY WHEN IT IS BELOW `crit`, because on Intel coretemp the two
+        // files carry the same number. Measured on a live machine:
+        //
+        //   coretemp  temp1_input 88000  temp1_max 100000  temp1_crit 100000
+        //   nvme      temp1_input 45850  temp1_max  84850  temp1_crit  85850
+        //
+        // The nvme row is a real band and works. The coretemp row is not: with
+        // max === crit the amber band is zero degrees wide, so thermalTone goes
+        // from calm straight to hot at 100C — a number a CPU reaches only as it
+        // shuts the machine down. A CPU at 89C was painted the same grey as one
+        // at 45C, on the one row anybody reads, and the 75/90 fallback that
+        // would have said so was discarded precisely BECAUSE the chip published
+        // its own. A chip that publishes one usable threshold is telling us
+        // where it will act, not where to start worrying.
+        warnAt: chipMax != null && chipCrit != null && chipMax >= chipCrit
+          ? Math.min(WARN_C, Math.round(chipCrit * 0.9))
+          : chipMax ?? WARN_C,
+        critAt: chipCrit ?? CRIT_C,
       });
     }
   }
@@ -1262,6 +1323,57 @@ export const WIN_THERMAL_PS = [
   "$r = [ordered]@{}",
   // Get-Counter, not Get-CimInstance: this is the half that works unelevated.
   "try { $r.perf = @((Get-Counter -Counter '\\Thermal Zone Information(*)\\High Precision Temperature' -EA Stop).CounterSamples | ForEach-Object { @{ i = $_.InstanceName; v = $_.CookedValue } }) } catch {}",
+  // THE SAME COUNTER UNDER THE NAME THIS WINDOWS CALLS IT.
+  //
+  // Performance-counter set and counter names are LOCALIZED. That is why PDH
+  // ships `PdhAddEnglishCounter` beside `PdhAddCounter` at all, and
+  // `Get-Counter -Counter` takes a localized path: hand it the English one on a
+  // German, French, Japanese or Russian Windows and it answers "The specified
+  // object was not found on the computer." `-EA Stop` plus `catch {}` turns
+  // that into silence, so the line above falls straight through to MSAcpi —
+  // which this module's own header says needs elevation a deck never has — and
+  // then to LibreHardwareMonitor, which is only there if the user installed it.
+  // A machine with real ACPI thermal zones and a non-English display language
+  // therefore drew no Thermal section at all, indistinguishable from the
+  // modern-Intel-laptop case the section is written to tolerate.
+  //
+  // This is the class #552 fixed one module over: exec.mjs spends two screens
+  // on "Windows ships cmd.exe in every language it ships in, and these
+  // sentences are translated with it", and there is a C_LOCALE block in this
+  // very file for the same reason.
+  //
+  // Perflib is the documented map between the two spellings. `…\Perflib\009`
+  // holds a REG_MULTI_SZ of alternating index and ENGLISH name; the parallel
+  // `…\Perflib\CurrentLanguage` holds index and LOCAL name. Look the two
+  // English names up to get their indices, read the local names at the same
+  // indices, and build the path out of those.
+  //
+  // SECOND, NOT FIRST, and that is what makes it safe to add: an English
+  // Windows never reaches this line, because `$r.perf` is already filled. It
+  // can only turn a machine that was reporting nothing into one that reports
+  // something.
+  //
+  // NOT ONE DOUBLE QUOTE, for the reason the whole of this string has none: it
+  // travels as a single `-Command` argument on a Windows command line. The
+  // counter path is concatenated rather than interpolated so that no quoting
+  // form beyond the single quote is needed anywhere in it.
+  //
+  // REASONED, NOT REPRODUCED. The localization of counter names is documented
+  // Microsoft behaviour and the Perflib layout is documented with it, but no
+  // localized Windows was available to run this against, and CI's runners are
+  // English — so what CI proves about this line is that it parses and runs
+  // clean on a real Windows, not that it resolves a German counter name.
+  "if (-not $r.perf) { try { "
+    + "$en = (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\009' -EA Stop).Counter; "
+    + "$lo = (Get-ItemProperty 'HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\CurrentLanguage' -EA Stop).Counter; "
+    + "$byIndex = @{}; for ($i = 1; $i -lt $lo.Count; $i += 2) { $byIndex[$lo[$i-1]] = $lo[$i] }; "
+    + "$set = $null; $ctr = $null; "
+    + "for ($i = 1; $i -lt $en.Count; $i += 2) { "
+    + "if ($en[$i] -eq 'Thermal Zone Information') { $set = $byIndex[$en[$i-1]] } "
+    + "elseif ($en[$i] -eq 'High Precision Temperature') { $ctr = $byIndex[$en[$i-1]] } }; "
+    + "if ($set -and $ctr) { $r.perf = @((Get-Counter -Counter ('\\' + $set + '(*)\\' + $ctr) -EA Stop).CounterSamples "
+    + "| ForEach-Object { @{ i = $_.InstanceName; v = $_.CookedValue } }) } "
+    + "} catch {} }",
   "if (-not $r.perf) { try { $r.acpi = @(Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -EA Stop | ForEach-Object { @{ i = $_.InstanceName; v = $_.CurrentTemperature } }) } catch {} }",
   // Depth matters: the default of 2 turns the inner hashtables into the string
   // "System.Collections.Hashtable" and this parser would see nothing at all.
@@ -1729,8 +1841,17 @@ function sampleCpu() {
   // Free — os.loadavg() reads a kernel value, no syscall worth the name — so it
   // rides the CPU tick rather than earning a timer. Windows returns [0,0,0],
   // which is not a reading and is not recorded as one.
+  //
+  // THE PLATFORM TEST IS THE WHOLE TEST. It used to be joined by
+  // `load.some(n => n > 0)`, which reads as belt and braces and is not: Node
+  // documents `os.loadavg()` as always [0,0,0] on Windows, so the platform test
+  // alone already excludes every non-reading — and the extra clause could only
+  // ever reject a reading that was REAL. `/proc/loadavg` on a genuinely quiet
+  // Linux box says `0.00 0.00 0.00`, so "Queued work" recorded no points at all
+  // for every quiet minute, and after the machine woke the chart read as though
+  // the deck had been switched off through them.
   const load = os.loadavg();
-  if (process.platform !== "win32" && load.some(n => n > 0)) record("load:1m", Math.round(load[0] * 100) / 100);
+  if (process.platform !== "win32") record("load:1m", Math.round(load[0] * 100) / 100);
 }
 
 /**
@@ -1804,7 +1925,12 @@ export function stopSystemMetrics() {
 export function systemSnapshot() {
   const cpu = cpuHistory.length ? cpuHistory[cpuHistory.length - 1] : null;
   const load = os.loadavg();
-  const hasLoad = process.platform !== "win32" && load.some(n => n > 0);
+  // Platform alone, for the reason spelled out beside the `load:1m` record in
+  // sampleCpu: Node's own contract makes the platform test sufficient, and the
+  // `load.some(n => n > 0)` that used to join it here rejected nothing except a
+  // real reading of zero. MachinePanel gates the whole section on `{loadavg &&
+  // …}`, so an idle Linux box had the section disappear from under it.
+  const hasLoad = process.platform !== "win32";
   return {
     ok: true,
     cpu,