great-cto 3.62.0 → 3.62.1

package/board/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "great-cto",
   "description": "You already have the agent. This is everything around it. great_cto runs Claude Code as a pipeline of 72 specialist agents \u2014 an independent model checks each stage before the next builds on it, spending caps refuse rather than warn, and three decisions stay yours: what gets built, how, and whether it ships.",
-  "version": "3.62.0",
+  "version": "3.62.1",
   "author": {
     "name": "Alexander Velikiy",
     "url": "https://hashnode.com/@Greatcto"

package/board/packages/board/fixtures/beads-read-owner.mjs

@@ -0,0 +1,3 @@
+// Fixed test-only parent, killed after the child-start handshake.
+import { getTasksAsync } from '../lib/beads.mjs';
+await getTasksAsync(process.cwd());

package/board/packages/board/fixtures/fake-bd-controlled.mjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+// Fixed local test protocol. No shell commands or operator stores.
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+const root = process.env.FAKE_BD_CONTROL_ROOT;
+if (!root || !path.isAbsolute(root)) process.exit(2);
+const key = path.basename(process.cwd());
+const marker = name => path.join(root, `${key}.${name}`);
+if (process.argv.includes('--descendant')) {
+  process.on('SIGTERM', () => {});
+  fs.writeFileSync(marker('descendant'), String(process.pid));
+  setInterval(() => {}, 1000);
+} else {
+  fs.appendFileSync(marker('started'), `${process.pid}\n`);
+  fs.writeFileSync(marker('worker'), String(process.ppid));
+  if (process.env.FAKE_BD_CONTROL_MODE === 'fail') {
+    process.exit(1);
+  } else if (['hang', 'leader-exit'].includes(process.env.FAKE_BD_CONTROL_MODE)) {
+    process.on('SIGTERM', () => {});
+    spawn(process.execPath, [new URL(import.meta.url).pathname, '--descendant'], { stdio: 'inherit' });
+    if (process.env.FAKE_BD_CONTROL_MODE === 'leader-exit') {
+      setInterval(() => { if (fs.existsSync(marker('descendant'))) process.exit(0); }, 25);
+    }
+    setInterval(() => {}, 1000);
+  } else if (process.env.FAKE_BD_CONTROL_MODE === 'large-success') {
+    process.stdout.write(JSON.stringify([{ id: 'FIXTURE-1', title: 'x'.repeat(131072), status: 'open', priority: 0 }]), () => {
+      fs.writeFileSync(marker('output-written'), 'ready');process.exit(0);
+    });
+  } else if (['closed-success', 'closed-fail'].includes(process.env.FAKE_BD_CONTROL_MODE)) {
+    const descendant = spawn(process.execPath, [new URL(import.meta.url).pathname, '--descendant'], { stdio: 'ignore' });
+    descendant.unref();
+    const ready = setInterval(() => {
+      if (!fs.existsSync(marker('descendant'))) return;
+      clearInterval(ready);
+      process.stdout.write(JSON.stringify([{ id: 'FIXTURE-1', title: 'Fixture task', status: 'open', priority: 0 }]),
+        () => process.exit(process.env.FAKE_BD_CONTROL_MODE === 'closed-fail' ? 1 : 0));
+    }, 25);
+  } else if (process.env.FAKE_BD_CONTROL_MODE === 'oversize') {
+    process.stdout.write(Buffer.alloc(16 * 1024 * 1024 + 1, 120));
+    setInterval(() => {}, 1000);
+  } else {
+    const timer = setInterval(() => {
+      if (!fs.existsSync(marker('release'))) return;
+      clearInterval(timer);
+      process.stdout.write(JSON.stringify([{ id: 'FIXTURE-1', title: 'Fixture task', status: 'open', priority: 0 }]));
+    }, 25);
+  }
+}

package/board/packages/board/lib/alerts.mjs

@@ -27,7 +27,7 @@ import { getCostHistory, getInbox } from './data-readers.mjs';
 // reporting "live · synced just now". `sweep: true` must NEVER be added to
 // an interactive read's opts: an ordinary request is someone waiting on
 // THIS project's answer, and the fill path answers `[]` instead.
-import { getTasks, SWEEP_MAX_AGE_MS } from './beads.mjs';
+import { getTasks, getTasksAsync, getReadDegradation, SWEEP_MAX_AGE_MS } from './beads.mjs';
 const SWEEP = { maxAgeMs: SWEEP_MAX_AGE_MS, sweep: true };
 import { readVerdicts } from './verdicts.mjs';
 import { isFailure } from './fleet.mjs';
@@ -303,11 +303,16 @@ function startAlertCron() {
   }, FIVE_MIN);
 
   // cost.threshold: monthly LLM spend at 80% / 100% of budget
-  setInterval(() => {
+  setInterval(async () => {
     try {
       const projects = listProjects();
       for (const proj of projects) {
-        const m = getMetrics(proj.path);
+        let tasks;
+        try {
+          tasks = await getTasksAsync(proj.path);
+          if (getReadDegradation(proj.path)) continue;
+        } catch { continue; } // Unknown spend must not be treated as zero.
+        const m = getMetrics(proj.path, 30, { tasks });
         const meta = readProjectMd(proj.path) || {};
         const budget = parseFloat(meta['monthly-budget']?.replace?.(/[$\s]/g, '') || '0');
         if (!budget) continue;
@@ -356,7 +361,12 @@ function startAlertCron() {
       // next project reads alerts-fired.json. Prevents the race condition where
       // all N projects read an empty map simultaneously and all fire.
       for (const proj of projects) {
-        const m = getMetrics(proj.path);
+        let tasks;
+        try {
+          tasks = await getTasksAsync(proj.path);
+          if (getReadDegradation(proj.path)) continue;
+        } catch { continue; } // Unknown is not a zero-activity weekly report.
+        const m = getMetrics(proj.path, 30, { tasks });
         const dedupeKey = `digest.weekly:${proj.slug}:${isoWeek}`;
         const weeklyPayload = {
           title: `${proj.slug} weekly — ${m.tasks?.done || 0} shipped, $${(m.cost?.llm_usd || 0).toFixed(2)} spent`,
@@ -395,18 +405,22 @@ function startAlertCron() {
       const projects = listProjects();
       for (const proj of projects) {
         const dedupeKey = `digest.daily:${proj.slug}:${isoDay}`;
+        let tasks;
+        try {
+          tasks = await getTasksAsync(proj.path);
+          if (getReadDegradation(proj.path)) continue;
+        } catch { continue; } // Do not send or record a fabricated quiet day.
         // Pull last 2 days so "yesterday" is always in the window
-        const cost = getCostHistory(proj.path, 2);
+        const cost = getCostHistory(proj.path, 2, { tasks });
         const yBucket = (cost.series || []).find(s => s.date === yesterday);
         const ySpend = yBucket ? yBucket.llm : 0;
         // Feature breakdown for yesterday
         const topFeatures = (cost.by_feature || []).slice(0, 3);
         // Inbox for blocked + gates
-        const inbox = (() => { try { return getInbox(proj.path); } catch { return {}; } })();
+        const inbox = getInbox(proj.path, { tasks });
         const blocked = inbox.summary?.blocked ?? 0;
         const gates = inbox.summary?.gates ?? 0;
         // Tasks closed yesterday
-        const tasks = (() => { try { return getTasks(proj.path, SWEEP); } catch { return []; } })();
         const doneYesterday = tasks.filter(t => {
           if (!t.closed_at) return false;
           return t.closed_at.slice(0, 10) === yesterday;

package/board/packages/board/lib/bd-read-worker.mjs

@@ -0,0 +1,64 @@
+// A read's process-group lifetime must not depend on the HTTP event loop.
+// Forked into a newly owned group; ordinary module imports do not start work.
+import { fork, spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+const entry = fileURLToPath(import.meta.url);
+export function spawnBdRead(binary, { readDeadlineMs = 20250, ...options }) {
+  return fork(entry, [binary, String(readDeadlineMs)], { ...options, silent: true });
+}
+if (process.argv[1] === entry) {
+  const grouped = process.platform !== 'win32';
+  let child;
+  function killOwnedGroup() {
+    // POSIX fork is detached: the worker PID is exclusively this read's PGID.
+    if (grouped) {
+      try { process.kill(-process.pid, 'SIGKILL'); } catch { process.exit(1); }
+    } else {
+      try { child?.kill('SIGKILL'); } catch { /* already gone */ }
+      process.exit(1);
+    }
+  }
+  process.on('disconnect', killOwnedGroup);
+  process.on('SIGTERM', () => {}); // keep the independent KILL deadline alive
+  process.stdout.on('error', killOwnedGroup);
+  process.stderr.on('error', killOwnedGroup);
+  // Independent upper bound even if the parent's event loop is stalled.
+  const budget = Number(process.argv[3]);
+  if (!Number.isFinite(budget) || budget < 1 || budget > 20250) process.exit(2);
+  setTimeout(killOwnedGroup, budget);
+  let completing = false;
+  function complete(code) {
+    if (completing) return;
+    completing = true;
+    // A successful leader can leave descendants with closed/ignored pipes.
+    // Flush the result over IPC before killing the whole owned group. Keep
+    // the independent deadline alive until cleanup, even if IPC stalls.
+    if (!process.connected) return killOwnedGroup();
+    // child 'close' means its pipes ended, not that this worker's output
+    // queues reached the parent. Flush before announcing success or KILL
+    // can truncate an otherwise valid snapshot under pipe backpressure.
+    try { process.stdout.write('', stdoutError => {
+      if (stdoutError) return killOwnedGroup();
+      process.stderr.write('', stderrError => {
+        if (stderrError || !process.connected) return killOwnedGroup();
+        try { process.send({ type: 'bd-read-result', code }, () => killOwnedGroup()); }
+        catch { killOwnedGroup(); }
+      });
+    }); }
+    catch { killOwnedGroup(); }
+  }
+  try {
+    child = spawn(process.argv[2], ['list', '--json', '--all', '--include-gates'], {
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    child.stdout.pipe(process.stdout, { end: false });
+    child.stderr.pipe(process.stderr, { end: false });
+    child.on('error', () => complete(1));
+    child.on('close', code => {
+      // No background descendants are part of a completed read contract.
+      // Wait for inherited pipes too: exiting on leader 'exit' would remove
+      // the IPC watchdog while a descendant was still holding those pipes.
+      complete(Number.isInteger(code) ? code : 1);
+    });
+  } catch { complete(1); }
+}

package/board/packages/board/lib/beads.mjs

@@ -5,6 +5,7 @@ import { spawnSync, spawn } from 'child_process';
 import { readSafe } from './util.mjs';
 import { bdCache } from './state.mjs';
 import { log } from './log.mjs';
+import { spawnBdRead } from './bd-read-worker.mjs';
 
 // ── Beads data ─────────────────────────────────────────────────────────────────
 // Cache bdList output per cwd for BD_CACHE_TTL_MS. Invalidated when the project's
@@ -39,13 +40,11 @@ import { log } from './log.mjs';
 const BD_CACHE_TTL_MS = Number(process.env.GREAT_CTO_BD_CACHE_TTL_MS || 300000);
 
 /**
- * When a cwd was last told "your cache entry is wrong" — by an invalidate or
- * a stale-mark, whichever most recently ran. A background fetch that STARTED
- * before this timestamp answers a question nobody is asking anymore: see
- * `bdRefreshAsync`, which compares its own start time against this map before
- * committing its result, so a slow fetch racing a write always loses to it.
+ * Per-project invalidation generation. A background fetch may publish only
+ * when its generation is still current. Wall-clock timestamps cannot order
+ * an invalidate followed by a read within the same millisecond.
  */
-const lastInvalidatedAt = new Map();
+const invalidationGeneration = new Map();
 
 /**
  * Drop a directory's entry so the next read is guaranteed fresh.
@@ -56,7 +55,7 @@ const lastInvalidatedAt = new Map();
  */
 function bdCacheInvalidate(cwd) {
   clearSelfTouch(cwd);
-  lastInvalidatedAt.set(cwd, Date.now());
+  invalidationGeneration.set(cwd, (invalidationGeneration.get(cwd) || 0) + 1);
   bdCache.delete(cwd);
 }
 
@@ -73,7 +72,7 @@ function bdCacheInvalidate(cwd) {
  */
 function bdCacheStale(cwd) {
   clearSelfTouch(cwd);
-  lastInvalidatedAt.set(cwd, Date.now());
+  invalidationGeneration.set(cwd, (invalidationGeneration.get(cwd) || 0) + 1);
   const cached = bdCache.get(cwd);
   if (cached) bdCache.set(cwd, { ...cached, ts: 0 });
 }
@@ -297,6 +296,17 @@ const EMPTY_TTL_MS = Number(process.env.GREAT_CTO_BD_EMPTY_TTL_MS || 5000);
  * Without this, ten requests arriving while one refresh runs start ten more.
  */
 const refreshing = new Set();
+const refreshWaiters = new Map();
+const refreshQueue = [];
+let activeReads = 0;
+const READ_TIMEOUT_MS = 20000;
+const READ_MAX_BYTES = 16 * 1024 * 1024;
+function drainRefreshQueue() {
+  while (activeReads < 4 && refreshQueue.length) {
+    activeReads++;
+    refreshQueue.shift()();
+  }
+}
 
 /**
  * Refresh a directory's entry WITHOUT holding the event loop.
@@ -304,44 +314,108 @@ const refreshing = new Set();
  * `spawnSync` is what made this board unanswerable: `bd list` costs seconds and
  * blocks everything for the whole of it — /api/version, one readdirSync,
  * measured at 1-10 s because it was queued behind a task read. Warming at boot
- * moved the first stall out of sight; this removes the rest.
+ * moved the first stall out of sight; HTTP cold reads now await this path.
+ * Direct synchronous write broadcasts and background readers remain separate.
  *
- * `onDone`, if given, fires exactly once at every exit point (success,
- * failure, or "already refreshing"). Every existing caller omits it and stays
- * fire-and-forget — the ONE caller that wants to know when the fill finished
- * is the boot warm-up (see `warmTasksAsync`), which logs how long it took.
+ * `onDone`, if given, fires exactly once when the shared read finishes. A
+ * concurrent reader joins it rather than receiving a premature "skipped".
+ * Background callers omit it and stay fire-and-forget. Boot warm-up and
+ * interactive cold reads join the same completion through `warmTasksAsync`.
  */
-function bdRefreshAsync(cwd, onDone = () => {}) {
-  if (refreshing.has(cwd)) { onDone({ ok: false, skipped: true }); return; }
+function bdRefreshAsync(cwd, onDone = null) {
+  if (refreshing.has(cwd)) { if (onDone) refreshWaiters.get(cwd).push(onDone); return; }
   refreshing.add(cwd);
+  refreshWaiters.set(cwd, onDone ? [onDone] : []);
+  const due = performance.now() + READ_TIMEOUT_MS;
+  const run = () => {
+    clearTimeout(queuedDeadline);
+    startRefresh(cwd, Math.max(1, due - performance.now()));
+  };
+  const queuedDeadline = setTimeout(() => {
+    const index = refreshQueue.indexOf(run);
+    if (index < 0) return;
+    refreshQueue.splice(index, 1);
+    refreshing.delete(cwd);
+    bdFailures.set(cwd, 'bd read timed out waiting for a slot');
+    const waiters = refreshWaiters.get(cwd) || [];
+    refreshWaiters.delete(cwd);
+    for (const done of waiters) done({ ok: false });
+  }, READ_TIMEOUT_MS);
+  refreshQueue.push(run);
+  drainRefreshQueue();
+}
+
+function startRefresh(cwd, remainingMs) {
   const startedAt = Date.now();
+  const generation = invalidationGeneration.get(cwd) || 0;
   lastBdRunAt.set(cwd, startedAt);
-  let out = '';
+  let out = '', outBytes = 0;
+  let child, deadline, killDeadline, finished = false, workerResult;
+  const grouped = process.platform !== 'win32';
+  function signalOwned(signal) {
+    if (!child?.pid) return;
+    try { if (grouped) process.kill(-child.pid, signal); else child.kill(signal); } catch { /* already exited */ }
+  }
+  function finish(result) {
+    if (finished) return;
+    finished = true;
+    clearTimeout(deadline); clearTimeout(killDeadline);
+    refreshing.delete(cwd);
+    const waiters = refreshWaiters.get(cwd) || [];
+    refreshWaiters.delete(cwd);
+    activeReads--;
+    for (const done of waiters) done(result);
+    drainRefreshQueue();
+  }
+  function stop(reason) {
+    if (finished || killDeadline) return;
+    bdFailures.set(cwd, reason);
+    signalOwned('SIGTERM');
+    // TERM alone can leave a read and inherited pipes alive indefinitely.
+    killDeadline = setTimeout(() => {
+      signalOwned('SIGKILL');
+      child.stdout?.destroy(); child.stderr?.destroy();
+      finish({ ok: false });
+    }, 250);
+  }
   try {
-    // Bounded like every other bd call. Without a timeout a hung bd never fires
-    // 'close', so `refreshing` stays held for this cwd forever and the cache
-    // silently serves stale tasks with no error anywhere — the async twin of the
-    // sync path's 500s. Node kills on timeout, which DOES fire 'close' with a
-    // non-zero code, so the failure handling below reports it rather than the
-    // board simply going quiet.
-    const child = spawn(BD_BIN, ['list', '--json', '--all', '--include-gates'], { cwd, env: bdEnv(), timeout: 20000 });
-    child.stdout?.on('data', (d) => { out += d; });
+    // At most four reads run concurrently. The fixed deadline escalates TERM
+    // to KILL for this newly owned process group; Node's TERM-only timeout did
+    // not release the slot when a child ignored it or inherited pipes stayed open.
+    child = spawnBdRead(BD_BIN, { cwd, env: bdEnv(), detached: grouped, readDeadlineMs: Math.ceil(remainingMs) + 250 });
+    child.on('message', message => {
+      if (message?.type === 'bd-read-result' && Number.isInteger(message.code)) workerResult = message.code;
+    });
+    deadline = setTimeout(() => stop('bd read timed out'), remainingMs);
+    child.stdout?.setEncoding('utf8');
+    child.stdout?.on('data', (d) => {
+      if (finished || killDeadline) return;
+      outBytes += Buffer.byteLength(d);
+      if (outBytes > READ_MAX_BYTES) { stop('bd output exceeded limit'); return; }
+      out += d;
+    });
+    // Drain stderr without retaining arbitrary private subprocess output.
+    child.stderr?.resume();
     child.on('error', (e) => {
-      refreshing.delete(cwd);
       bdFailures.set(cwd, `bd could not be run: ${e?.message || e}`.slice(0, 300));
-      onDone({ ok: false });
+      finish({ ok: false });
     });
     child.on('close', (code) => {
-      refreshing.delete(cwd);
+      if (finished) return;
+      if (killDeadline) { signalOwned('SIGKILL'); finish({ ok: false }); return; }
+      // The worker reports its leader result, then terminates its entire
+      // owned group, including itself. A bare signal without that result
+      // remains a failed read, never a fabricated successful empty list.
+      code = workerResult ?? code;
       lastBdRunAt.set(cwd, Date.now());
-      if (code !== 0) { bdFailures.set(cwd, `bd exited ${code}`); onDone({ ok: false }); return; }
+      if (code !== 0) { bdFailures.set(cwd, `bd exited ${code}`); finish({ ok: false }); return; }
       try {
         const parsed = JSON.parse(out || '[]');
         // Same guard as the sync path: bd 0.6x can answer 0 with a JSON object,
         // and a non-array rendered as no tasks is the silent zero again.
         if (!Array.isArray(parsed)) {
           bdFailures.set(cwd, String(parsed?.error || 'bd returned something that is not a task list').slice(0, 300));
-          onDone({ ok: false });
+          finish({ ok: false });
           return;
         }
         // This fetch answers "what was true at `startedAt`?" — if anyone has
@@ -353,24 +427,23 @@ function bdRefreshAsync(cwd, onDone = () => {}) {
         // `tests/pipeline-e2e.test.mjs`'s gate-approval assertions flake once
         // this function started running from a COLD cache (the boot warm-up)
         // instead of only ever refreshing an already-populated one.
-        const supersededByInvalidation = (lastInvalidatedAt.get(cwd) || 0) >= startedAt;
+        const supersededByInvalidation = (invalidationGeneration.get(cwd) || 0) !== generation;
         const supersededByFresherEntry = (bdCache.get(cwd)?.ts || 0) >= startedAt;
         if (supersededByInvalidation || supersededByFresherEntry) {
-          onDone({ ok: true, count: parsed.length, discarded: true });
+          finish({ ok: true, count: parsed.length, discarded: true });
           return;
         }
         bdFailures.delete(cwd);
         bdCache.set(cwd, { ts: Date.now(), data: parsed });
-        onDone({ ok: true, count: parsed.length });
+        finish({ ok: true, count: parsed.length });
       } catch (e) {
         bdFailures.set(cwd, `bd output could not be parsed: ${e?.message || e}`.slice(0, 300));
-        onDone({ ok: false });
+        finish({ ok: false });
       }
     });
   } catch (e) {
-    refreshing.delete(cwd);
     bdFailures.set(cwd, `bd could not be spawned: ${e?.message || e}`.slice(0, 300));
-    onDone({ ok: false });
+    finish({ ok: false });
   }
 }
 
@@ -410,6 +483,34 @@ function warmTasksAsync(cwd) {
   });
 }
 
+/** Wait for an actual cold snapshot without blocking Node or inventing []. */
+async function getTasksAsync(cwd = process.cwd()) {
+  if (!bdCache.has(cwd)) {
+    const result = await warmTasksAsync(cwd);
+    if (!bdCache.has(cwd)) {
+      // tasks.md-only projects remain supported, but never hide a failed
+      // initialized Beads store or a snapshot invalidated during this read.
+      if (!result.ok && checkBeadsAvailable(cwd)) {
+        bdCache.set(cwd, { ts: Date.now(), data: [] });
+        return getTasks(cwd);
+      }
+      throw new Error(bdFailureFor(cwd) || 'Task snapshot changed while being read; retry');
+    }
+  }
+  return getTasks(cwd);
+}
+
+/** Other-project badges may be incomplete, but must never block HTTP. */
+function getTasksCached(cwd = process.cwd()) {
+  if (!bdCache.has(cwd)) {
+    bdRefreshAsync(cwd);
+    throw new Error('Task snapshot is loading');
+  }
+  const tasks = getTasks(cwd);
+  if (getReadDegradation(cwd)) throw new Error('Task snapshot is unavailable');
+  return tasks;
+}
+
 function bdList(cwd = process.cwd(), runner = bd, opts = {}) {
   const maxAge = Number.isFinite(opts.maxAgeMs) ? opts.maxAgeMs : BD_CACHE_TTL_MS;
   const cached = bdCache.get(cwd);
@@ -864,6 +965,8 @@ export {
   getReadDegradation,
   setTaskStatusInTasksMd,
   getTasks,
+  getTasksAsync,
+  getTasksCached,
   mapStatus,
   detectAgent,
 };

package/board/packages/board/lib/data-readers.mjs

@@ -3,7 +3,7 @@ import fs from 'fs';
 import path from 'path';
 import { GREAT_CTO_DIR } from './config.mjs';
 import { readFileSafe } from './util.mjs';
-import { getTasks } from './beads.mjs';
+import { getTasks, getTasksAsync, getTasksCached } from './beads.mjs';
 import { readVerdicts, readSecStats } from './verdicts.mjs';
 import { datePlans } from './plan-date.mjs';
 
@@ -73,7 +73,7 @@ function getMemory(cwd = process.cwd()) {
 }
 
 // ── Pipeline state ────────────────────────────────────────────────────────────
-function getPipeline(cwd = process.cwd()) {
+function getPipeline(cwd = process.cwd(), { tasks = getTasks(cwd) } = {}) {
   const stages = ['product-owner', 'architect', 'pm', 'senior-dev', 'reviewers', 'qa-engineer', 'security-officer', 'devops', 'l3-support'];
   const verdicts = readVerdicts(cwd);
   const now = Date.now();
@@ -87,7 +87,6 @@ function getPipeline(cwd = process.cwd()) {
   }
 
   // Tasks in_progress give us "active" agents
-  const tasks = getTasks(cwd);
   const activeAgents = new Set(
     tasks.filter(t => t.status === 'in_progress').map(t => (t.agent || '').toLowerCase()).filter(Boolean)
   );
@@ -179,7 +178,7 @@ function getPipeline(cwd = process.cwd()) {
 }
 
 // ── Cost history (daily LLM burn) ────────────────────────────────────────────
-function getCostHistory(cwd = process.cwd(), days = 30) {
+function getCostHistory(cwd = process.cwd(), days = 30, { tasks: suppliedTasks } = {}) {
   // Build a map<dateISO, { llm, human, plans, verdictCost }>.
   // Inclusive window: `days=30` means [today-30 ... today] = 31 buckets.
   // Previous behaviour (days buckets only) created a one-day gap on the
@@ -315,7 +314,7 @@ function getCostHistory(cwd = process.cwd(), days = 30) {
   const LLM_RATE_PER_HR   = parseFloat(process.env.GREATCTO_LLM_RATE_PER_HR || '0.30');
   const DEFAULT_TASK_MIN  = 30;
   try {
-    const tasks = getTasks(cwd);
+    const tasks = suppliedTasks ?? getTasks(cwd);
     for (const t of tasks) {
       if (!t.closed_at) continue;
       if (!t.agent) continue;
@@ -401,8 +400,7 @@ function getCostHistory(cwd = process.cwd(), days = 30) {
 }
 
 // ── Inbox: what needs the user's decision right now ──────────────────────────
-function getInbox(cwd = process.cwd()) {
-  const tasks = getTasks(cwd);
+function getInbox(cwd = process.cwd(), { tasks = getTasks(cwd) } = {}) {
   // Use raw_status here: mapStatus() rewrites status to 'gate' for any task with the
   // 'gate' label, regardless of bd-native state. Filtering on the mapped value would
   // leave closed/blocked gates in the inbox forever.
@@ -502,7 +500,7 @@ function getInbox(cwd = process.cwd()) {
  * `readInbox` is injectable so the walk can be tested with stub projects
  * without a beads store behind each one.
  */
-function inboxElsewhere(projects, currentPath, { readInbox = getInbox } = {}) {
+function inboxElsewhere(projects, currentPath, { readInbox = getInboxCached } = {}) {
   const same = (a, b) => {
     if (!a || !b) return false;
     try { return fs.realpathSync(a) === fs.realpathSync(b); } catch { return path.resolve(a) === path.resolve(b); }
@@ -521,4 +519,6 @@ function inboxElsewhere(projects, currentPath, { readInbox = getInbox } = {}) {
   return out;
 }
 
-export { getMemory, getPipeline, getCostHistory, getInbox, inboxElsewhere };
+async function getInboxAsync(cwd) { return getInbox(cwd, { tasks: await getTasksAsync(cwd) }); }
+function getInboxCached(cwd) { return getInbox(cwd, { tasks: getTasksCached(cwd) }); }
+export { getMemory, getPipeline, getCostHistory, getInbox, getInboxAsync, getInboxCached, inboxElsewhere };

package/board/packages/board/lib/metrics.mjs

@@ -43,11 +43,10 @@ function acceptanceMetrics(verdicts = [], windowCostUsd = null) {
 }
 
 // ── Metrics ────────────────────────────────────────────────────────────────────
-function getMetrics(cwd = process.cwd(), days = 30) {
+function getMetrics(cwd = process.cwd(), days = 30, { tasks = getTasks(cwd) } = {}) {
   // `days` controls the window for cost/agents_cost and for "shipped in window".
   // Tasks shipped within the window are returned in `tasks.done_in_window`.
   // Full lifetime `tasks.done` is still returned for backwards compatibility.
-  const tasks = getTasks(cwd);
   // BH-28: resolved gates (approve→closed, reject→blocked) get mapped to
   // status='done' by mapStatus(). Those are governance decisions, not shipped
   // features — counting them inflates velocity / tasks-shipped on the report.

package/board/packages/board/lib/routes.mjs

@@ -27,9 +27,9 @@ import { status as routerKeyStatus, writeKey as writeRouterKey, verifyKey as ver
 let routerKeyCheck = null;
 import { broadcastTasks } from './sse.mjs';
 import { saveNotifHistory } from './notifications.mjs';
-import { getMemory, getPipeline, getCostHistory, getInbox, inboxElsewhere } from './data-readers.mjs';
+import { getMemory, getPipeline, getCostHistory, getInbox, getInboxAsync, inboxElsewhere } from './data-readers.mjs';
 import { log } from './log.mjs';
-import { bdCacheInvalidate, checkBeadsAvailable, bdWriteSerialised, bd, bdErr, getTasks, setTaskStatusInTasksMd, getReadDegradation } from './beads.mjs';
+import { bdCacheInvalidate, checkBeadsAvailable, bdWriteSerialised, bd, bdErr, getTasks, getTasksAsync, setTaskStatusInTasksMd, getReadDegradation } from './beads.mjs';
 import { getMetrics } from './metrics.mjs';
 import { agentActivity, agentActivitySince } from './agent-activity.mjs';
 import { issueTokens, checkToken, checkBinding, consumeToken } from './gate-tokens.mjs';
@@ -124,6 +124,32 @@ async function dispatch(req, res, url, cwd) {
   const scopedProject = ['/api/skills', '/api/usage', '/api/outcomes'].includes(pathname)
     ? scopedReadProject(cwd, serverCwd, requestedProject) : null;
 
+  // Existing synchronous projections may consume a completed snapshot, but
+  // HTTP cold reads must await async I/O instead of freezing unrelated clients.
+  const taskRead = ['/api/work', '/api/sse', '/api/tasks', '/api/metrics',
+    '/api/memory', '/api/pipeline', '/api/heartbeat', '/api/share', '/api/cost', '/api/resume'].includes(pathname)
+    || /^\/api\/tasks\/[^/]+\/history$/.test(pathname);
+  const unknownWork = pathname === '/api/work' && requestedProject
+    && resolveProjectInfo(requestedProject).resolved === 'fallback';
+  let sseClosed = false;
+  if (pathname === '/api/sse') {
+    // Install lifecycle ownership before the cold snapshot await. Request
+    // 'close' also occurs for normally completed GET bodies; response close
+    // is the actual stream lifetime signal.
+    res.once('close', () => { sseClosed = true; sseClients.delete(res); });
+  }
+  const closedSse = () => pathname === '/api/sse'
+    && (sseClosed || req.aborted || res.destroyed || res.writableEnded);
+  if (req.method === 'GET' && taskRead && !unknownWork) {
+    try { await getTasksAsync(cwd); }
+    catch {
+      if (closedSse()) return true;
+      res.writeHead(503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: 'Task snapshot is unavailable; retry', state: 'unreadable' }));
+      return true;
+    }
+  }
+
   if (pathname === '/api/work/publication') {
     const respond = (status, body) => { res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' }); res.end(JSON.stringify(body)); };
     if (requestedProject && resolveProjectInfo(requestedProject).resolved === 'fallback') { respond(404, { error: 'Unknown project' }); return true; }
@@ -222,6 +248,7 @@ async function dispatch(req, res, url, cwd) {
 
   // SSE
   if (pathname === '/api/sse') {
+    if (closedSse()) return true;
     res.writeHead(200, {
       'Content-Type': 'text/event-stream',
       'Cache-Control': 'no-cache',
@@ -229,7 +256,11 @@ async function dispatch(req, res, url, cwd) {
     });
     res._gctoCwd = cwd;  // remember which project this client wants
     sseClients.add(res);
-    res.write(`event: tasks\ndata: ${JSON.stringify(getTasks(cwd))}\n\n`);
+    if (getReadDegradation(cwd)) {
+      res.write(`event: task-read-state\ndata: ${JSON.stringify({ ok: false, state: 'unreadable' })}\n\n`);
+    } else {
+      res.write(`event: tasks\ndata: ${JSON.stringify(getTasks(cwd))}\n\n`);
+    }
     // ADR-021: the agent activity strip starts from a snapshot, then follows pushes.
     // Phase 2: a client that hands back the cursor of the last frame it saw — the
     // Last-Event-ID header, or ?since= from a page that had to recreate its
@@ -243,7 +274,6 @@ async function dispatch(req, res, url, cwd) {
     }
     res._gctoAgentCursor = a.cursor;
     res.write(`${a.cursor ? `id: ${a.cursor}\n` : ''}event: agent\ndata: ${JSON.stringify(a)}\n\n`);
-    req.on('close', () => sseClients.delete(res));
     return true;
   }
 
@@ -718,7 +748,7 @@ async function dispatch(req, res, url, cwd) {
       // Without this, concurrent approve+reject on the same gate produced
       // TWO appendDecisionLog entries (one wrong) — log says approved AND
       // rejected. bdWriteSerialised guarantees one-at-a-time semantics.
-      const result = await bdWriteSerialised(() => {
+      const result = await bdWriteSerialised(async () => {
         const status = action === 'approve' ? 'closed' : 'blocked';
         let via = 'beads';
         // Try beads first (unless there's no store at all); on any bd failure
@@ -761,7 +791,7 @@ async function dispatch(req, res, url, cwd) {
         const projectSlug = parsed.project && !/^[\/~]/.test(parsed.project) ? parsed.project : path.basename(gateCwd);
         let title = id;
         try {
-          const gateTask = getTasks(gateCwd).find((t) => t.id === id);
+          const gateTask = (await getTasksAsync(gateCwd)).find((t) => t.id === id);
           if (gateTask?.title) title = gateTask.title;
         } catch { /* the id is a documented fallback; the record still gets written */ }
         gateTitle = title;
@@ -847,7 +877,13 @@ async function dispatch(req, res, url, cwd) {
 
   // Inbox — what needs your attention right now
   if (pathname === '/api/inbox') {
-    const inbox = getInbox(cwd);
+    let inbox;
+    try { inbox = await getInboxAsync(cwd); }
+    catch {
+      res.writeHead(503, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' });
+      res.end(JSON.stringify({ error: 'Task snapshot is unavailable; retry', state: 'unreadable' }));
+      return true;
+    }
     // BRD-R3: the Decisions row shows both reviewers. The second opinion is a
     // fact about the TREE, not about a gate — every pending gate on this tree
     // shares it — so it is resolved once: the newest cross-review line whose
@@ -861,7 +897,7 @@ async function dispatch(req, res, url, cwd) {
     // If the registry itself cannot be walked, say so — `unreadable` is not
     // `{p0: 0}`, and the page must not print "nothing elsewhere" from it.
     let elsewhere;
-    try { elsewhere = inboxElsewhere(listProjects(), cwd, { readInbox: getInbox }); }
+    try { elsewhere = inboxElsewhere(listProjects(), cwd); }
     catch (e) { elsewhere = { state: 'unreadable', why: String(e?.message || e) }; }
     // ADR-024 §1: each pending gate carries the token an approval must present,
     // bound to the project as it is now. The typed name stored with it is the one

package/board/packages/board/lib/share.mjs

@@ -3,7 +3,7 @@ import path from 'path';
 import { GREAT_CTO_DIR, PUBLIC, SHARE_ENDPOINT } from './config.mjs';
 import { readProjectMd } from './projects.mjs';
 import { getMetrics } from './metrics.mjs';
-import { getTasks } from './beads.mjs';
+import { getTasks, getTasksAsync, getReadDegradation } from './beads.mjs';
 import { readVerdicts } from './verdicts.mjs';
 import { readDecisionsLog } from './fleet.mjs';
 
@@ -87,8 +87,10 @@ async function toggleShare(enable, cwd = process.cwd(), force = false) {
     // Generate and publish
     // Share report is a marketing artifact — show LIFETIME numbers, not a
     // rolling window. 365 days × 100 = effectively-lifetime cap for any project.
-    const html = generateShareHTML(getTasks(cwd), getMetrics(cwd, 36500), cwd);
     try {
+      const tasks = await getTasksAsync(cwd);
+      if (getReadDegradation(cwd)) return { error: 'Task snapshot is unavailable; report not published' };
+      const html = generateShareHTML(tasks, getMetrics(cwd, 36500, { tasks }), cwd);
       const result = await publishReport(html);
       const newState = { enabled: true, url: result.url, hash: result.hash, published_at: new Date().toISOString() };
       saveShareState(newState, cwd);

package/board/packages/board/lib/sse.mjs

@@ -1,5 +1,6 @@
 import { sseClients } from './state.mjs';
-import { getTasks } from './beads.mjs';
+import { getTasksAsync, getReadDegradation, warmTasksAsync, checkBeadsAvailable } from './beads.mjs';
+import { getPipeline, getInbox } from './data-readers.mjs';
 
 function broadcast(event, data) {
   const msg = `event: ${event}\ndata: ${JSON.stringify(data)}\n\n`;
@@ -8,13 +9,41 @@ function broadcast(event, data) {
   }
 }
 
-function broadcastTasks(cwd) {
-  const msg = `event: tasks\ndata: ${JSON.stringify(getTasks(cwd))}\n\n`;
-  for (const res of sseClients) {
-    if (res._gctoCwd === cwd) {
+async function broadcastTasks(cwd, { fresh = false, projections = false } = {}) {
+  // A completed write invalidates its cache. Reading it synchronously here
+  // froze every HTTP client even though the write response was already sent.
+  // With no subscriber there is no projection to refresh at all.
+  for (const res of sseClients) if (res.destroyed || res.writableEnded) sseClients.delete(res);
+  const clients = [...sseClients].filter(res => res._gctoCwd === cwd);
+  if (!clients.length) return { ok: true, subscribers: 0 };
+  let msg, result;
+  try {
+    if (fresh && !checkBeadsAvailable(cwd)) {
+      const read = await warmTasksAsync(cwd);
+      if (!read.ok || read.discarded) throw Error('fresh snapshot unavailable');
+    }
+    const tasks = await getTasksAsync(cwd);
+    if (getReadDegradation(cwd)) throw Error('snapshot unavailable');
+    msg = `event: tasks\ndata: ${JSON.stringify(tasks)}\n\n`;
+    if (projections) {
+      // All projections describe the same snapshot, without another Beads read.
+      msg += `event: pipeline\ndata: ${JSON.stringify(getPipeline(cwd, { tasks }))}\n\n`;
+      msg += `event: inbox\ndata: ${JSON.stringify(getInbox(cwd, { tasks }))}\n\n`;
+    }
+    result = { ok: true };
+  } catch {
+    // Preserve the last visible tasks instead of publishing a fabricated [].
+    // Explicit transport state; clients retain the last visible snapshot.
+    result = { ok: false, state: 'unreadable' };
+    msg = `event: task-read-state\ndata: ${JSON.stringify(result)}\n\n`;
+  }
+  for (const res of clients) {
+    // A client may have disconnected or changed project while the read ran.
+    if (sseClients.has(res) && res._gctoCwd === cwd && !res.destroyed && !res.writableEnded) {
       try { res.write(msg); } catch { sseClients.delete(res); }
     }
   }
+  return result;
 }
 
 export { broadcast, broadcastTasks };

package/board/packages/board/lib/watchers.mjs

@@ -3,8 +3,8 @@ import path from 'path';
 import { GREAT_CTO_DIR } from './config.mjs';
 import { sseClients } from './state.mjs';
 import { listProjects } from './projects.mjs';
-import { bdCacheStale, getTasks, isSelfInflictedTouch } from './beads.mjs';
-import { getPipeline, getInbox } from './data-readers.mjs';
+import { bdCacheStale, isSelfInflictedTouch } from './beads.mjs';
+import { broadcastTasks } from './sse.mjs';
 import { agentActivitySince, activityStamp } from './agent-activity.mjs';
 
 // ── File watcher ───────────────────────────────────────────────────────────────
@@ -51,17 +51,9 @@ function watchBeads() {
     if (isSelfInflictedTouch(dir)) return;
     // Stale, not deleted. A change we NOTICED must not make the next reader pay
     // for it — they asked for something else. The broadcast below still reads
-    // fresh, because a stale entry refreshes on read.
+    // fresh, because it explicitly awaits the shared asynchronous refresh.
     bdCacheStale(dir);
-    for (const res of sseClients) {
-      if (res._gctoCwd === dir) {
-        try {
-          res.write(`event: tasks\ndata: ${JSON.stringify(getTasks(dir))}\n\n`);
-          res.write(`event: pipeline\ndata: ${JSON.stringify(getPipeline(dir))}\n\n`);
-          res.write(`event: inbox\ndata: ${JSON.stringify(getInbox(dir))}\n\n`);
-        } catch {}
-      }
-    }
+    void broadcastTasks(dir, { fresh: true, projections: true });
   };
 
   // Debounce per-dir: dolt writes can fire 3-5 events in <50ms during a single
@@ -130,12 +122,9 @@ function watchVerdicts() {
     if (pushTimer) clearTimeout(pushTimer);
     // debounce: collapse a burst of writes (multiple agents finishing within ~150ms)
     pushTimer = setTimeout(() => {
-      for (const res of sseClients) {
-        const dir = res._gctoCwd || process.cwd();
-        try {
-          res.write(`event: pipeline\ndata: ${JSON.stringify(getPipeline(dir))}\n\n`);
-          res.write(`event: inbox\ndata: ${JSON.stringify(getInbox(dir))}\n\n`);
-        } catch { sseClients.delete(res); }
+      const dirs = new Set([...sseClients].map(res => res._gctoCwd || process.cwd()));
+      for (const dir of dirs) {
+        void broadcastTasks(dir, { projections: true });
       }
     }, 150);
   };

package/board/packages/board/public/index.html

@@ -1768,8 +1768,8 @@ h1, h2, h3, h4 { font-weight: 600; font-family: var(--sans); }
 .pl-gate.active .pl-msg, .pl-gate.active .pl-meta { opacity: 1; color: var(--text); }
 .pl-gate .gate-badge {
   margin-left: auto;
-  background: var(--status-blocked); color: var(--on-solid);
-  font-size: var(--fs-eyebrow); font-weight: 700;
+  background: var(--status-blocked); color: var(--on-status);
+  font-size: var(--fs-eyebrow); font-weight: 500;
   min-width: 16px; height: 16px; padding: 0 4px;
   border-radius: 0;
   display: inline-flex; align-items: center; justify-content: center;
@@ -8117,6 +8117,12 @@ function connectSSE() {
   };
   es.addEventListener('tasks', e => {
     const newTasks = JSON.parse(e.data);
+    delete BOARD_DEGRADED['/api/tasks'];
+    renderDegradedBanner('degraded-read', null, '');
+    if (es.readyState === EventSource.OPEN) {
+      document.getElementById('live-dot').className = 'live-dot pulse';
+      document.getElementById('live-label').textContent = 'live · synced just now';
+    }
     // A transient bd failure (dolt lock, timeout) can produce an empty
     // snapshot indistinguishable from "no tasks" (great_cto-e2ew). Don't
     // blindly wipe a populated board — refetch once via the regular API
@@ -8130,6 +8136,20 @@ function connectSSE() {
     }
     applyTasksSnapshot(newTasks);
   });
+  es.addEventListener('task-read-state', e => {
+    try {
+      const state = JSON.parse(e.data);
+      if (state.state !== 'unreadable') return;
+      BOARD_DEGRADED['/api/tasks'] = 'Task snapshot is unavailable. Showing the last loaded tasks.';
+      document.getElementById('live-dot').className = 'live-dot error';
+      document.getElementById('live-label').textContent = 'connected · task data unavailable';
+      // Re-evaluate existing healthy claims as well as adding the banner.
+      // A previously painted "All clear" must not survive a failed refresh.
+      if (window.__inboxData) renderInbox(window.__inboxData);
+      renderDegradedBanner('degraded-read', degradedFor('/api/tasks'),
+        'Project data could not be refreshed. Counts may be out of date.');
+    } catch { /* Malformed transport data must not erase the last snapshot. */ }
+  });
   es.addEventListener('pipeline', e => {
     try {
       const stages = JSON.parse(e.data);
@@ -8165,8 +8185,10 @@ function connectSSE() {
   });
   es.onopen = () => {
     const d = document.getElementById('live-dot');
-    d.className = 'live-dot pulse';
-    document.getElementById('live-label').textContent = 'live · synced just now';
+    const unreadable = degradedFor('/api/tasks');
+    d.className = unreadable ? 'live-dot error' : 'live-dot pulse';
+    document.getElementById('live-label').textContent = unreadable
+      ? 'connected · task data unavailable' : 'live · synced just now';
   };
   es.onerror = () => {
     document.getElementById('live-dot').className = 'live-dot error';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "3.62.0",
+  "version": "3.62.1",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",